kernel/Syscalls.js

Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/ThemeEngine.js

kernel/ThemeEngine.js
Classes
class ThemeEngine
Functions
normalizeAppearance(input = {})
readAppearanceRecord()
writeAppearanceRecord(input)
removeAppearanceRecord()
Constants
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: ThemeEngine.js — Kernel level theme orchestration service. Single source of truth for all OS appearance state. Exposes a middleware chain hook system so mods can intercept theme changes before or after they are applied to the DOM. ── Modder API ──────────────────────────────────────────────────────────── const tm = syscalls.theme; // Before hook — middleware: receive appear + next(modified) tm.before('my mod', (appear, next) = next({ ...appear, chromeStyle: 'metal' }), 'Force metal chrome'); // After hook — react to a completed theme change tm.after('my mod', (appear) = console.log('Theme applied:', appear)); // Remove hooks tm.removeHook('my mod'); // Reorder tm.moveHook('my mod', 'before', 1); // move to index 1 in before list // Preview (no save, no events) tm.preview({ ...tm.current(), chromeStyle: 'metal' }); // Apply (save + emit os:theme change) tm.apply({ ...tm.current(), themeId: 'crimson' }); // Export / import theme JSON const json = tm.export(); tm.import(json); // List registered hooks tm.hookList(); // → [{ id, phase, description, enabled, order }] Classes Method Signature Summary Call once at boot to restore persisted appearance. Start a reversible live preview transaction. Idempotent while active. Restore the saved appearance after an abandoned preview. Register a BEFORE hook (middleware). fn(appear, next) — call next(modified) to continue the chain. Register an AFTER hook (reaction). fn(appear) — called after DOM is updated and state is saved. Remove all hooks (before + after) for the given id. Enable or disable a hook by id without removing it. Move a hook to a specific index within its phase list. Returns a snapshot of all registered hooks. Preview: apply to


kernel/ThemeEngine.js

disable a hook by id without removing it. Move a hook to a specific index within its phase list. Returns a snapshot of all registered hooks. Preview: apply to DOM instantly without saving or firing events. Used for live preview in Theme Manager or Settings. Apply: run before hooks → apply to DOM → save → run after hooks → emit event. Serialize the current appearance as a portable, versioned theme pack. Parse a JSON string and apply it. Return user saved named appearance profiles, newest first. Functions Normalize untrusted or legacy appearance data into the supported schema. Publish one canonical appearance record after guarding the existing version. Remove the current record only when this runtime can understand it. Constants <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/ToolDriver.js

async projectContentFreeToolFailure(error, { toolName = 'unknown', errorCode = null, } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: ToolDriver — small OS native tool registry for LLM/tool callers. This mirrors the useful parts of Augment's tool registry in browser native form: schema listing, guarded execution, history, read only batching, and a narrow terminal bridge that never exposes the interactive terminal's eval path. Classes Method Signature Summary Remove one tool. When originAppId is supplied, ownership is mandatory so app scoped callers cannot remove kernel tools or another app's handlers. Remove all tools registered by one app origin, preserving built ins. Deterministically search the live tool catalog without invoking a model. Exact name/tag hits outrank description matches; an empty query returns the catalog in stable name order. Execution authority is never granted. Raw internal descriptor for a tool (resolves aliases). Used by ToolRouter's firewall pipeline. Independently verify a tool result before a Navi Faculty receipt may claim success. Mutations fail closed unless their descriptor registered an authoritative readback verifier. Read only calls are self verifying observations because they cannot mutate canonical state. Content free retention diagnostics; rows and argument hashes are omitted. Functions Project an arbitrary handler failure without retaining its message. Handler messages are untrusted and may quote complete tool inputs, credentials, or provider content. The digest preserves deterministic incident correlation. Constants <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app


kernel/ToolDriver.js

app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/TrayManager.js

kernel/TrayManager.js
Classes
class TrayManager
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: TrayManager.js — system notification area (status icons). Background/utility apps register a small status icon next to the clock, the same model used by Windows' notification area, macOS' menu bar extras, and the FreeDesktop StatusNotifier spec. Apps register via syscalls.ui.registerTrayIcon(spec) and the StatusTray renders them, with an overflow popup for icons beyond the visible limit. Icon spec: { id, appId?, icon, tooltip?, onClick?, menu?, priority? } icon: emoji/glyph string (or short text) onClick: fn() invoked on left click (shared realm apps only) menu: [{ label, onClick }] optional right click menu priority: higher sorts first (default 0) Classes TrayManager.js — system notification area (status icons). Background/utility apps register a small status icon next to the clock, the same model used by Windows' notification area, macOS' menu bar extras, and the FreeDesktop StatusNotifier spec. Apps register via syscalls.ui.registerTrayIcon(spec) and the StatusTray renders them, with an overflow popup for icons beyond the visible limit. Icon spec: { id, appId?, icon, tooltip?, onClick?, menu?, priority? } icon: emoji/glyph string (or short text) onClick: fn() invoked on left click (shared realm apps only) menu: [{ label, onClick }] optional right click menu priority: higher sorts first (default 0) Method Signature Summary Register (or replace) a tray icon. Returns an unregister function. Update mutable fields (icon/tooltip) of an existing icon, if present. Remove every icon owned by an app (called on app close). Icons sorted by priority (desc), then insertion order. <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and


kernel/TrayManager.js

by priority (desc), then insertion order. <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/TrustStore.js

kernel/TrustStore.js
Classes
class TrustStore
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: TrustStore.js — ring 0 trust anchors + publisher pinning for the package system. Two tiers of trust: 1. ROOTS — public keys baked into the OS bundle (kernel/trust/roots.json). A publisher certificate that chains to a root is fully trusted. 2. PINS — publishers the user accepted on first install (trust on first use). Persisted in IndexedDB (kv store, key ). Anti takeover: a pinned publisher is bound to a specific key fingerprint. If a later package for the same publisher presents a different fingerprint, the caller (PackageManager.verifyAndAuthorize) treats it as an identity change and blocks pending explicit re consent — defending event stream/durabletask style account takeovers. SECURITY NOTE: signatures prove who built a package, not that the build was clean. Trust here is combined with provenance + static scan + egress controls. Classes Method Signature Summary Validate a publisher certificate. Returns { trusted, selfSigned, fingerprint, reason }. trusted=true → cert chains to a ring 0 root (signature verified) selfSigned=true → not rooted; eligible for pin on consent Canonical bytes of a cert (excluding issuer signature) for chain verification. 16 char fingerprint of a base64 raw public key (matches the OS identity scheme). Has this publisher (by name) been pinned under ANY fingerprint? Returns the pin record or null. True if the fingerprint is a root or an explicitly pinned publisher. <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level


kernel/TrustStore.js

register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/UiSounds.js

kernel/UiSounds.js
Classes
class UiSounds
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: UiSounds.js — OS wide UI sound engine (kernel service). Procedurally synthesizes short UI sounds (click, open, close, notify, error, …) through the OS AudioDriver's shared context, so every cue is mixed and volume controlled centrally (it appears in the Sound mixer as a "System sounds" session). Sounds are auto triggered from OS wide kernel events (panel open/close/minimize/ restore, notifications, theme toggle) and from a global click listener, so the whole desktop gets feedback without each app wiring anything. Apps can also play a cue explicitly via syscalls.ui.sound('click'). ── Future customization ────────────────────────────────────────────────────────── Every cue is a named entry in a registry. A mod / sound pack can override or add cues at runtime: kernel.uiSounds.register('click', (ctx, out, t0) = { ... custom synth ... }); kernel.uiSounds.register('coin', (ctx, out, t0) = { ... new cue ... }); Per cue enable flags, global enable, and volume persist in localStorage, ready for a settings UI (the Sound app exposes the global toggle + volume today). Classes Method Signature Summary DND is owned by NotificationCenter / Quick Settings via the shared notif prefs key. List registered cue names (for a future customization UI). Register or override a cue. synth(ctx, out, t0, opts) schedules nodes on . Play a named cue. No op if disabled, unknown, or audio unavailable. <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example:


kernel/UiSounds.js

handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/VRAMTracker.js

kernel/VRAMTracker.js
Classes
class VRAMTracker
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: VRAMTracker.js — per app GPU memory budget tracking. WebGPU does not expose actual VRAM usage. We track requested allocations: Surfaces — estimated from canvas dimensions × bytes per pixel Buffers — exact size passed to createBuffer (when routed via syscalls) Textures — estimated from width × height × format bytes per pixel Admission is checked before allocations. Canvas surfaces receive a small, bounded reserve so buffer/texture workloads cannot consume the final UI capacity and make an app impossible to close or recover. Phase 5+ upgrade path: hook device.createBuffer/createTexture via a GPUDevice proxy to track all allocations, not just syscall routed ones. Classes Method Signature Summary Record a GPU canvas surface allocation. Returns the estimated byte size. Record a GPU buffer allocation. Returns an opaque handle for freeing. Track a texture by an already estimated byte size (used by the GPU facade). Count a created render/compute pipeline for this app. Count a created shader module for this app. Return a typed admission decision with enough evidence to diagnose it. Check ordinary buffer/texture admission without using the UI reserve. Check canvas admission against the bounded per app and global UI reserve. Return usage summary for all tracked apps. Format bytes as human readable string. Drop all tracking for an app (call on app close). <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and


kernel/VRAMTracker.js

commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/VirtualFS.js

kernel/VirtualFS.js
Classes
class VirtualFS
Constants
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: VirtualFS.js — path tree virtual filesystem. Features: POSIX like paths — /user/notepad/file.txt Directories — implicit from file paths; explicit mkdir supported Persistence — OPFS backed via StorageManager (falls back to localStorage) Events — on('write' 'delete' ' ', cb) for live watchers (e.g. Notepad tabs) JSON helpers — readJSON / writeJSON All public methods are synchronous (reads from in memory cache). Writes flush to OPFS asynchronously in the background. Call once at OS boot to preload OPFS → memory. Classes Method Signature Summary Initialize StorageManager + preload OPFS files into memory. Call once at OS boot: Bind a schema name to a path prefix or exact path. Any write to a matching path will be validated. Read a file. Returns the stored string, or null if not found. Write a file. Content may be a string or any JSON serialisable value. If a schema is bound to this path, the value is validated before writing. Pass to bypass (trusted internal writes). Check if a path exists as a file. List direct children of a directory. Returns basenames only (not full paths). Recursively list all file paths under a directory. Create a directory marker (optional — files implicitly create dirs). Return basic stat information for a path. Move / rename a file. Subscribe to fs events: 'write', 'delete', ' '. Returns unsubscribe fn. Keep the synchronous VFS cache coherent with storage based apps. Constants <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or


kernel/VirtualFS.js

Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


inspectJavaScriptProjectFacts({ path = '', content = '', maxTokens = MAXTOKENS, maxSymbols = MAXSYMBOLS, maxImports = MAXIMPORTS, } = {})

resolveJavaScriptImport({ sourcePath = '', specifier = '', knownFiles = null } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Bounded lexical facts shared by project indexing and source verification. This module deliberately does not claim to parse JavaScript, TypeScript, or JSX. It identifies inspectable declarations and import specifiers while keeping lexical evidence distinct from parser evidence. Functions Constants — Bounded lexical facts shared by project indexing and source verification. This module deliberately does not claim to parse JavaScript, TypeScript, or JSX. It identifies inspectable declarations and import specifiers while keeping lexical evidence distinct from parser evidence. <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


async buildMountedProjectIntelligence({ invokeTool, rootPath, workspaceRevision = '', maxEntries = DEFAULTMAXENTRIES, maxDepth = DEFAULTMAXDEPTH, maxReadFiles = DEFAULTMAXREADFILES, maxReadChars = DEFAULTMAXREADCHARS, maxTotalReadChars = DEFAULTMAXTOTALREADCHARS, } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Deterministic, authority free project intelligence for a mounted workspace. The builder can see a workspace only through AI Echo's existing bounded storage.list and storage.read tool contracts. It returns source backed facts separately from advisory suggestions and never exposes complete source text. Functions Constants <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/ai-hub/AIDispatchScheduler.js
Classes
class AIDispatchError extends Error
class AIDispatchScheduler
Constants
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: AIDispatchScheduler.js — bounded, in memory admission for live model calls. Prompts stay inside the caller's run closure and are never serialized or persisted by this scheduler. Owners are serviced round robin while each owner's jobs retain FIFO start order. Provider and exact route limits keep a burst of Navi work from crushing one remote endpoint. Classes Method Signature Summary Method Signature Summary requestId:string, ownerId:string, provider:string, model:string, signal?:AbortSignal null, run:()= Promise< , abort?:()= Promise< , onStart?:(snapshot:object)= void, onRelease?:(snapshot:object)= void }} rawJob Cancel a queued or active request without widening provider authority. Constants — AIDispatchScheduler.js — bounded, in memory admission for live model calls. Prompts stay inside the caller's run closure and are never serialized or persisted by this scheduler. Owners are serviced round robin while each owner's jobs retain FIFO start order. Provider and exact route limits keep a burst of Navi work from crushing one remote endpoint. <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/ai-hub/AIService.js
Classes
class AIHub
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: AIService.js — the OS.ai() entrypoint (Phase 1 skeleton). Remote provider based through an adaptive credential boundary. It prefers the isolated AI Bridge extension and falls back on phones to browser direct OpenRouter or an approved user controlled HTTPS proxy. Fully separate from (the local on device GGUF runtime). Exposed at kernel.aiHub and wrapped by syscalls.aiHub (capability gated). Classes Method Signature Summary The public OS.ai(appId, request) entrypoint. In flight OS.ai() requests, for the Task Ledger / overlay (Phase 8). <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/ai-hub/AdaptiveProviderBridge.js
Classes
class AdaptiveProviderBridge
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Classes Chooses one credential/transport boundary per operation. The extension is always preferred because its origin isolates secrets from the OS page. Browser direct is selected only when the extension remains unavailable after a bridge reprobe. Provider requests are never replayed across the two backends, preventing duplicate billing and duplicate tool/model effects. Method Signature Summary <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


writeCustomEndpointAllowlist(endpoints, storage = globalThis.localStorage)

writeDirectModelCache(records, storage = globalThis.localStorage)

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Browser direct AI transport for phones and other browsers without extension support. The allowlist is deliberately narrow: OpenRouter, whose official OAuth/PKCE flow supports browser clients. A user approved HTTPS OpenAI compatible proxy controlled by the user. OpenAI, Anthropic, and other long lived provider keys stay extension/server only. Their presence in the shared provider catalog does not grant this transport permission to call them. Classes Method Signature Summary Functions Constants <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/ai-hub/ExtensionBridge.js
Classes
class ExtensionBridge
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: ExtensionBridge.js — the AI Hub's preferred isolated path to a remote provider. Talks to WebGPU OS Companion via kernel.browserBridge (relay.js's message contract). Never called with a page supplied header; built in routes accept only provider/model/messages/ params while custom endpoints remain explicitly approved by the user. Classes Method Signature Summary <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


class LocalCredentialContractError extends Error

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Same origin credential vault for browsers that cannot install extensions. Session credentials remain ephemeral. Opt in persistent credentials use a non extractable IndexedDB CryptoKey and a versioned, encrypted readback. V2 commits the Files visible readback first and the matching IndexedDB slot second. Readers compare monotonically increasing generations and repair an interrupted second step. V1 envelopes/readbacks remain read only inputs. Classes Method Signature Summary Method Signature Summary Constants <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


automaticRoutingReadiness(model, runtimeStatus = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: AI Hub adapter for the kernel owned, on device GGUF runtime. Installed models and generation defaults stay authoritative in LLMDriver; this class only translates that state into the provider neutral AI Hub contract. Classes Method Signature Summary Functions Automatic Navi routing is stricter than catalog presence. A saved handle can identify a model without proving that this tab can read it, and an initialized driver can exist without a usable WebGPU device. Manual LLM Runtime flows may still ask the operator to reconnect a handle; unattended routing may not. Constants — AI Hub adapter for the kernel owned, on device GGUF runtime. Installed models and generation defaults stay authoritative in LLMDriver; this class only translates that state into the provider neutral AI Hub contract. <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


writeModelCapabilityRouting(tiers, storage = globalThis.localStorage)

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: ModelCapabilityRegistry.js — maps an abstract to a concrete { provider, model } pair for the OS AI Hub. Apps ask for a tier ('fast', 'balanced', 'reasoning'), not a specific vendor model, so the default can change without touching every app's request payload. Classes Method Signature Summary Override (or add) the { provider, model } pair for a tier. Resolve a tier to { provider, model }, falling back to 'balanced'. Functions Constants <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/ai-hub/ProviderRouter.js
Classes
class ProviderRouter
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: ProviderRouter.js — picks the concrete { provider, model } for a normalized OS.ai() request: an explicit provider/model on the request always wins, otherwise it resolves the request's modelTier via ModelCapabilityRegistry. Classes ProviderRouter.js — picks the concrete { provider, model } for a normalized OS.ai() request: an explicit provider/model on the request always wins, otherwise it resolves the request's modelTier via ModelCapabilityRegistry. Method Signature Summary <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/ai-hub/RequestNormalizer.js
Classes
class RequestNormalizer
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: RequestNormalizer.js — validates and normalizes an OS.ai(request) payload into the canonical shape the rest of the AI Hub pipeline consumes. Classes Method Signature Summary <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/ai-hub/ResultBroker.js
Classes
class ResultBroker
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: ResultBroker.js — wraps a raw provider chat result into the OS.ai() response envelope and stamps it with CSE provenance (engine/state). Model output is always MODEL PREDICTED/untrusted for authority — it becomes canonical only if/when Phase 9's finalizer + CommitCoordinator commit it. Classes Method Signature Summary <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


rankSmartModelPool({ policy: rawPolicy = null, models = [], task = {}, usage = null } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: SmartModelPolicy.js deterministic policy and catalog ranking for AI Hub. This module performs no provider calls, stores no credentials, and grants no authority. It projects provider catalog records into an inspectable ranking that Navi cognition can compile into its existing signed route contract. Functions Classify provider side router aliases separately from concrete model IDs. Dynamic aliases may resolve to a different model on every request, so their catalog capabilities cannot safely authorize strict or effectful tasks. Return a detached, immutable basic policy suitable for persisted settings. Normalize persisted policy. Missing fields migrate to v1 defaults, while an unknown field or version is rejected so misspelled safety controls never silently disappear. Infer preference only workload affinities from one provider catalog row. The result improves ranking and model picker explanations. It is never an authorization claim: privacy, modality, tool transport, context, endpoint health, and budget remain separate hard eligibility checks. Classify a task without consulting a model. Explicit purpose wins; otherwise bounded, ordered rules use declared modality/privacy/background state before keyword signals. Raw user text is never copied into the returned evidence. Project one provider catalog record into the policy's provider neutral form. Conservative projected cost for a normalized candidate and token estimate. Rank a catalog and return a deterministic, inspectable decision. The caller still owns provider authentication, canonical resource reservations, and final execution authority. Semantic alias for callers that consume the selected route and fallbacks. Constants —


canonical resource reservations, and final execution authority. Semantic alias for callers that consume the selected route and fallbacks. Constants — SmartModelPolicy.js deterministic policy and catalog ranking for AI Hub. This module performs no provider calls, stores no credentials, and grants no authority. It projects provider catalog records into an inspectable ranking that Navi cognition can compile into its existing signed route contract. <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: CapabilityAttestation.js — gates capability minting on descriptor attestation. Wraps engine/state's CapabilityRegistry/Capability.js (via the Phase 4 CapabilityNegotiator, kernel.protocol.capabilities — no parallel capability logic) and layers DescriptorHashStore on top so a capability is only minted for a tool whose descriptor hash matches the approved hash. The always on Navi runtime requires explicit package or operator approval for every first seen descriptor. Classes Method Signature Summary Attest a tool descriptor and, if it passes, mint a capability for to invoke it. Returns without minting anything if the descriptor changed since approval — callers (Phase 8's ApprovalCard) surface this as a re review prompt. Kernel only signed release handoff; never exposed as an application syscall. DescriptorHashStore binds the exact callable and deliberately treats package timestamps as audit data, never executable authority. <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: DescriptorHashStore.js — persists approved tool/resource/prompt descriptor hashes IDB side, so a "rug pull" (descriptor silently changing after the user approved it) is detected across sessions, not just within one runtime (that in memory check is webgpu os/kernel/tools/MetadataRugPullDetector.js). Hashing reuses the same SHA 256 primitive as packages/PackageVerifier.js (contentHashHex from engine/core/math/ChecksumMath.js) rather than a new hashing routine. Storage reuses the generic 'kv' IndexedDB store (see storage/IndexedDBDriver.js) instead of adding a new object store/migration. Classes Method Signature Summary Canonical SHA 256 hex hash of a tool/resource/prompt descriptor's meaning bearing fields. Stable signed contract hash used by Faculty manifests. Release builds may minify function spelling, so this projection uses the declared, package signed implementationHash when one is present. It must never be used for live approval or rug pull checks; hashDescriptor() binds the exact callable code for those decisions. Atomically bind a live descriptor to a package policy verified ring 0 Faculty revision. The exact handler/verifier text is a per runtime tamper canary. Durable authority comes from the package signed portable descriptor, which deliberately survives raw/minified emission changes. A clean runtime may therefore rebind a verified emission, while an exact callback change observed by this store instance is always rejected. Compare a descriptor's current hash against the last approved one. Functions Complete approval identity for a callable descriptor. This intentionally includes authority, mutability, effect, provenance, timeout, and executable source fields so


approval identity for a callable descriptor. This intentionally includes authority, mutability, effect, provenance, timeout, and executable source fields so retaining the same JSON input schema cannot conceal a more dangerous implementation after approval. Package portable descriptor identity for signed Faculty manifests only. <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: DescriptorSanitizer.js — static scanner for tool/resource/prompt descriptors: flags prompt injection strings in description/schema text, reuses HiddenParameterDetector (Phase 3) for undeclared/suspicious parameters instead of a parallel implementation, and flags a mismatch between a tool's self declared risk and its AffordanceRegistry declared risk. Classes Method Signature Summary True if a tool understates its own risk relative to its declared affordance risk. <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/attestation/DryRunManager.js
Classes
class DryRunManager
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: DryRunManager.js — thin wrapper over engine/state/worldmodel/PredictionSandbox.js (rollout/plan, confidence decay) — no new dry run engine. Lets a tool call's declared predictedEffects (AffordanceRegistry, Phase 3) be previewed against a state snapshot WITHOUT ever touching canonical state. Classes Method Signature Summary <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: ParameterPreviewer.js — resolves a tool call args object into a human safe preview: sensitive looking values (key/secret/token/password/ credential) are masked and long strings are truncated, so an approval UI (Phase 8's ApprovalCard) can show "what will actually be sent" without ever rendering raw secrets to the screen. Classes Method Signature Summary <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/drivers/LLMDriver.js
Classes
class LLMDriver
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Classes Method Signature Summary <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/drivers/WebGPUAmbientDriver.js
Functions
createWebGPUParticleDriver()
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: No file level description found in source. Add one as a leading JSDoc comment, or document it below. Functions Factory: returns an AmbientEngine driver object { apply, destroy }. Internal simulation state is held in a closure and fully reset between mounts. <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


classifySteeringImpact(kind, value = '')

classifySteeringDelivery(kind, value = '', { progressEstimate = null } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: ActiveTurnCoordinator.js — bounded, provider neutral user steering for one active AI executor request. It owns ordering and deduplication only; kernel policy, tool approval, persistence, and model dispatch remain elsewhere. Classes Method Signature Summary Return an already admitted steering event without spending a model call. Admit a non authoritative model interpretation of an otherwise ambiguous steering message. The coordinator still owns delivery, task invalidation, cancellation, and ordering. A low confidence or malformed interpretation degrades to the deterministic additive classification. Functions Describe which cached work a steering message invalidates. This is a data decision only; it never widens authority or silently approves a new target. Select when one operator instruction should affect an active task. This is deliberately a score of the instruction/task relationship, never a score of the person. It is deterministic, local, content free in diagnostics, and grants no authority. The task Storylet consumes the resulting delivery mode at its next transition. Constants <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/execution/AuditLog.js
Classes
class AuditLog
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: AuditLog.js — thin audit VIEW over the same shared EventLog used by the Phase 7 Time Engine (one log, not two): filters to commit/receipt/ledger events via the existing TimelineExporter, with chain verification attached. Classes Method Signature Summary Audit relevant entries (tamper evident: chain verification included). Commit receipts only. <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


async verifyBrowserNativeJavaScript({ path = '', content = '', sourceRevision = '', rulesHash = '', knownFiles = null, knownDependencies = null, parserAdapters = {}, } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Non executing browser verifier for JavaScript, TypeScript, JSX, and TSX. Browser engines expose a non executing parser only for classic JavaScript through Function construction. Module, TypeScript, and JSX verification must therefore use an explicitly supplied parser adapter or remain inconclusive. Lexical balance is always reported separately and is never promoted to parse evidence. Functions Constants <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/execution/BudgetLimiter.js
Classes
class BudgetLimiter
Re-exports
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: BudgetLimiter.js — wraps engine/state/authority/PolicyEngine.js (ordered rules, deny overrides allow, risk classification, approval required) for AI request/tool call/commit policy, plus per request step budgets via the Phase 7 CooldownManager's BoundedCounterEscrow. Classes Method Signature Summary Add an app/deployment specific policy rule (evaluated in order; DENY overrides). Open a step budget for a request. Charge n steps against a request's budget. @returns {{ ok:boolean, reason:string null }} Record locally verified progress. Provider prose must never call this. Grant the one pre reserved extension after verified progress. This uses only the executor's step escrow and cannot consume Navi verification or compensation resource lanes. Re exports , <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/execution/CommitGate.js
Classes
class OSCommitGate
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: CommitGate.js — the OS's ONE commit path: wraps engine/state's createCommitCoordinator (the 14 step atomic protocol) and createCommitGate (lightweight fact only commits) over the SHARED Phase 7 stores — the same FactStore, EventLog, USORegistry (CooldownManager's), IdempotencyRegistry, and the Phase 4 CapabilityRegistry. Nothing AI produced becomes canonical except through here. Classes Method Signature Summary Full 14 step atomic commit of a sealed transaction envelope against the shared canonical FactStore. Lightweight fact only commit (no USOs/capabilities/envelope) through CommitGate; merges the committed store back on success. <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/execution/ContextBroker.js
Classes
class ContextBroker
Re-exports
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: ContextBroker.js — wraps engine/state/worldmodel/BeliefStore.js: one BeliefStore per AI request keeping the five worlds strictly separated (CANONICAL/OBSERVED/BELIEF/PREDICTED/PROPOSED). A belief or prediction can NEVER become canonical here — syncCanonical() is only called by the execution loop AFTER a witnessed commit. Classes Method Signature Summary ONLY after a witnessed commit (rule 47). Re exports <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


buildDodadForgeBlueprint(prompt = '', { decision = null } = {})

buildDodadForgeAuthoringPrompt(prompt = '', { failures = [] } = {})

parseDodadForgeProject(value, { prompt = '', blueprint = null } = {})

validateDodadForgeProject(input = {}, { prompt = '', blueprint = null } = {})

async verifyDodadForgeProjectRuntime(project, { timeoutMs = RUNTIMETIMEOUTMS } = {})

scoreDodadForgeProject({ html = '', css = '', javascript = '', manifest = null, recipe: selectedRecipe = null, blueprint = null } = {})

async verifyDodadJavaScriptWorker(source, { timeoutMs = WORKERTIMEOUTMS } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: DodadForge.js — OS owned project contracts for interactive AI Echo outputs. Provider text is never executed directly. The forge accepts one explicit four file envelope, validates it as data, and runs declared behavior only in an opaque, network blocked iframe before the existing signed Dodad Faculty is allowed to persist the project. Functions Build a deterministic specialist handoff for one Dodad request. Roles are responsibility slices inside one bounded episode, not agents and not authority. Only patterns whose trigger evidence is present are loaded. Deterministic quality projection; blockers cover recipe defining behavior only. Compile and execute only the Dodad's top level JavaScript inside a killable Worker with inert DOM shims. Runtime deltas are never executed. A hung or syntactically invalid script is terminated before the DOM sandbox opens. Constants — DodadForge.js — OS owned project contracts for interactive AI Echo outputs. Provider text is never executed directly. The forge accepts one explicit four file envelope, validates it as data, and runs declared behavior only in an opaque, network blocked iframe before the existing signed Dodad Faculty is allowed to persist the project. <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


executionApprovalRepeatProfile(review, { appId = '', naviId = '' } = {})

decideExecutionApproval({ mode, review, priorReceipt = null } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Deterministic execution approval modes. This module decides whether an already reviewed tool action still needs an operator prompt. It never grants authority: ToolActionReview, ToolRouter, Navi Faculty capability leases, workspace roots, and mounted folder scopes remain authoritative for every call. Functions Content free identity for a repeatable approval scope. Arguments are intentionally omitted: changed values may repeat only when the tool, descriptor, authority, data classes, and exact target scope are unchanged. Decide only the prompt behavior for an action that has already passed the OS review. must be an OS recorded successful call for the same repeat profile; model recommendations never substitute for it. Constants — Deterministic execution approval modes. This module decides whether an already reviewed tool action still needs an operator prompt. It never grants authority: ToolActionReview, ToolRouter, Navi Faculty capability leases, workspace roots, and mounted folder scopes remain authoritative for every call. <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Pure adaptive execution window policy. It has no authority vocabulary and can only reduce caller supplied action/concurrency ceilings. Descriptor risk and reversibility dominate calibration: confidence never changes approval, capability, tool selection, or the static execution ceiling. Callers must enforce the returned action and mutation limits as hard dispatch boundaries. Classes Method Signature Summary Decide whether one more descriptor authorized action fits inside an already selected horizon. This is deliberately authority free: it can only reject work after a caller ceiling or mutation observation boundary has been reached. Constants — Pure adaptive execution window policy. It has no authority vocabulary and can only reduce caller supplied action/concurrency ceilings. Descriptor risk and reversibility dominate calibration: confidence never changes approval, capability, tool selection, or the static execution ceiling. Callers must enforce the returned action and mutation limits as hard dispatch boundaries. <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


class JavaScriptExecutionGrantError extends Error

resolveJavaScriptPermittedApis(source, permittedApis = null)

async hashJavaScriptNavigationGeneration({ tabId, url, pendingUrl = '', status = '' } = {})

async createJavaScriptApprovalBinding({ source, permittedApis = null, surface = 'browser-page', world = surface === 'os-worker' ? 'WORKER' : 'USERSCRIPT', tabId = null, naviId = '', facultyId = '', taskId = '', requestId = '', } = {})

async createJavaScriptExecutionGrant({ source, permittedApis = null, surface = 'browser-page', world = surface === 'os-worker' ? 'WORKER' : 'USERSCRIPT', target = null, naviId = '', facultyId = '', taskId = '', requestId = '', issuedAt = Date.now()

async verifyJavaScriptExecutionGrant(grant, { source, permittedApis = null, surface = 'browser-page', world = surface === 'os-worker' ? 'WORKER' : 'USERSCRIPT', target = null, naviId = '', facultyId = '', taskId = '', requestId = '', now = Date.now()

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: JavaScriptExecutionGrant.js — exact source, short lived execution binding. This contract narrows an already authorized raw JavaScript tool call. It is not an authority source: ToolRouter, the Faculty capability grant, OS policy, developer mode, and the browser extension approval boundary still decide whether execution is allowed. Classes Method Signature Summary Functions Return the conservative, inspectable API categories visible in source. Normalize a caller declared API allowance and ensure it covers every API category the conservative source scan can observe. Omission selects the observed set, keeping existing developer only calls compatible. Hash the observable browser navigation identity without publishing its URL. Build the exact source/API projection embedded in ToolActionReview. Create one exact, bounded runtime grant after the target has been observed. Recompute every meaning bearing field and reject expired or altered grants. Constants <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


class NaviContextRolloverError extends Error

async createNaviContextRollover(raw = {}, options = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Compact, derived task context for rollover between bounded execution turns. The projection contains identifiers, hashes, classifications, and counts only. It has no persistence and rejects raw content, tool arguments, or reasoning. Classes Method Signature Summary Method Signature Summary Functions Constants <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


async projectNaviSmartRoutingExplanation(raw = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: NaviExplainabilityProjection.js — compact, authority free explanations derived from records the OS already owns. This module has no persistence and never accepts provider reasoning. It projects task state, steering, routing, tool outcomes, verification, and receipts into inspectable local evidence. Functions Explain one active or completed Navi task from its existing projections and ledgers. is the TaskLedger FinalReport (or its durable compact form), and is ActiveTurnCoordinator.snapshot(). No record is written. Project one signed/validated resource selection receipt without re ranking. Explain an exact NaviModelBroker decision, including excluded routes and the smallest policy/settings change that could make each route eligible. The explanation is derived after routing and cannot alter the decision. Constants <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


async createEvidenceBoundProposal(value = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: NaviProposalEnvelope.js — binds a proposed change to observed evidence, explicit inferences, unresolved questions, an exact target revision, and deterministic verification/compensation. A proposal has no authority by itself and must still pass the normal review and capability path. Functions Constants <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


class NaviTaskGraphCheckpointError extends Error

async createNaviTaskGraphCheckpoint(raw = {})

async validateNaviTaskGraphCheckpointTransition(raw = {})

async classifyNaviTaskGraphResume(raw = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Durable, content free checkpoints for compiled Navi task graphs. This module neither executes nor replays graph nodes. Persistence is supplied by an exact key adapter with one read and one compare and swap operation. Classes Method Signature Summary Method Signature Summary Functions Enforce task lifetime monotonicity for the mutation ledger. Completed tombstones are immutable. Outcome unknown tombstones may resolve to a completed tombstone, or be removed by an exact current mutation node whose failed outcome is explicitly verifier bound. Generic failures never evict. Constants <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


class NaviTaskGraphCompilerError extends Error

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: NaviTaskGraphCompiler.js — deterministic compiler for model proposed tool plans. A compiled graph is evidence, never authority: every node still enters ToolActionReview, ToolRouter, and the Faculty membrane before it can execute. Classes Method Signature Summary Method Signature Summary Compile twice, compare canonical bytes, then retain the exact last good graph. Functions Constants <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


evolveNaviTaskStateProjection(current, patch = {}, { now = Date.now()

acceptNaviTaskSteering(current, event, options = {})

setNaviTaskCurrentAction(current, action, options = {})

completeNaviTaskWork(current, work, options = {})

setNaviTaskPendingApproval(current, approval, options = {})

clearNaviTaskApproval(current, approvalId, options = {})

syncNaviTaskRuntime(current, { executorPhase, status = null, remainingBudget = null, artifacts = null, planRef = undefined, contextManifestRef = undefined, resourceSelectionRef = undefined, investigationCaseRef = undefined, goalProgress = null, } = {}, options = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: NaviTaskStateProjection.js — immutable, schema validated runtime projection for one active Navi task. Canonical task persistence remains NaviCognition; this module projects inspectable live state for streams and in flight views. Functions <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/execution/PrivacyGuard.js
Classes
class PrivacyGuard
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: PrivacyGuard.js — scrubs context before it leaves the OS toward a remote model provider: sensitive looking values are masked (reuses Phase 5's ParameterPreviewer — one masking implementation), obvious credential literals in free text are redacted, and payload size is capped. Classes Method Signature Summary Deterministically classify secret like text before provider routing. Findings contain rule identifiers only, never matching credential text. Scrub a value for inclusion in an outbound prompt. <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/execution/RepairLoop.js
Classes
class RepairLoop
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: RepairLoop.js — malformed model output repair: first a local structural extraction (strip code fences, isolate the outermost JSON object/array), then target shape validation and at most one model assisted repair pass on the selected route's fast tier. Repair duration is operator controlled: steering may supersede it and Stop aborts it. The route/attempt policy stays bounded, and wrong schema JSON is never accepted merely because it parses. Classes Method Signature Summary Best effort local JSON extraction. @returns { } parsed value or null Explain incomplete provider output without misclassifying it as malformed JSON. Repair malformed output: local extraction, then one model assisted pass. <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


class RunEventStreamGapError extends Error

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: Kernel owned resumable event streams for AI executions. App callbacks are only a live view. This registry assigns monotonic sequence numbers, buffers bounded events, and supports same owner replay after an app remount or transient UI failure. Durable history remains in FinalReport. Classes Kernel owned resumable event streams for AI executions. App callbacks are only a live view. This registry assigns monotonic sequence numbers, buffers bounded events, and supports same owner replay after an app remount or transient UI failure. Durable history remains in FinalReport. Method Signature Summary Method Signature Summary <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


class SemanticEffectContractError extends Error

async compileDescriptorPostcondition({ descriptor, descriptorHash, args = {}, } = {})

async validateSemanticInvocation(postcondition, { descriptorHash, args = {} } = {})

async createExecutionPrestate({ graphHash, sourceHash, nodeId, dependencies = [], } = {})

async compareSemanticEffects({ postcondition, prestate, receiptEvidence = null, observedEffects = null, resultOk = false, } = {})

projectSemanticNodeOutcome({ nodeId, graphHash, sourceHash, comparison, } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: SemanticEffectContract.js Pure, authority free compilation and comparison for descriptor authored postconditions. The model never supplies these contracts. Exact contracts are declared by trusted tool descriptors and are bound to the descriptor, arguments, graph prestate, and verified Faculty receipt before comparison. Durable projections contain hashes and bounded counts, never tool arguments or effect values. Classes Method Signature Summary Functions Compile a trusted descriptor's effect declaration into a value free graph postcondition. Legacy descriptors remain receipt/success bound; only the explicit closed contract enables exact semantic comparison. Bind a live invocation to the graph authored descriptor and argument hashes. Bind a node's comparison to the graph and exact terminal evidence of each dependency. No provider visible text or raw values enter this projection. Compare trusted readback effects with descriptor authored expectations. must be the kernel created verified Faculty projection for exact and mutation comparisons; caller supplied receipt shaped data cannot acquire authority through this pure function. Compact semantic node outcome consumed by checkpoint/episode projections. Constants <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


class SemanticTransactionError extends Error

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: SemanticTransaction.js — deterministic multi target preview/commit contract. The coordinator never writes storage itself. Callers provide one atomic commit callback that must recheck every expected revision/hash in the same critical section as its writes. This module validates that exact request, emits explicit conflict choices, and creates a hash bound undo record. Classes Method Signature Summary Method Signature Summary Build an immutable, deterministic semantic diff preview. Re read every target and invoke exactly one atomic commit callback. Conflicts are returned as inspectable records; the callback is never run. Apply the hash bound inverse only if the committed targets are unchanged. Functions Bind one explicit UI choice to the exact conflict record. Constants <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


classifyTaskEstimateProfile(prompt = '', taskKind = '')

createTaskProgressEstimate({ prompt = '', taskKind = '', estimatedInputTokens = null, routeAverageMs = null, routeSampleCount = 0, now = Date.now()

updateTaskProgressEstimate(current, event = {}, now = Date.now()

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: TaskProgressEstimator.js — deterministic, content free duration and progress estimates for an active Navi task. Estimates are ranges, never deadlines. They consume local prompt signals, historical route timing, and OS events; they do not call a model and never grant authority. Functions Constants — TaskProgressEstimator.js — deterministic, content free duration and progress estimates for an active Navi task. Estimates are ranges, never deadlines. They consume local prompt signals, historical route timing, and OS events; they do not call a model and never grant authority. <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


verifiedToolProgressFingerprint(results, toolDriver = null)

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: TaskProgressGuard.js — bounded semantic progress detection for iterative AI work. The guard observes fingerprints only; it never executes tools, grants authority, persists state, or decides that unverified provider prose is work. Classes Method Signature Summary Observe one bounded execution round. must come from locally observed successful work. A new value resets stagnation counters; provider claims alone must omit it. Functions Return a stable fingerprint only for successful, locally observed progress. Fingerprint a round made entirely from status/polling tools. Constants <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


async reviewToolAction({ tool, args = {}, policy = null, appId = '', requestId = '', naviId = '', facultyId = '', taskId = '', proposal = null, } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: ToolActionReview.js — deterministic pre approval inspection for one exact AI tool call. This is an explanatory safety layer, not an authority source: BudgetLimiter policy and the ToolRouter capability boundary remain final. Classes Method Signature Summary Functions Review one exact tool descriptor and argument object before approval. Parameters: (object) — No description in source JSDoc. (object) — live ToolDriver descriptor (object) — exact model supplied arguments (object) — BudgetLimiter/PolicyEngine decision (string) — No description in source JSDoc. (string) — No description in source JSDoc. (string) — No description in source JSDoc. (string) — No description in source JSDoc. (string) — No description in source JSDoc. (object null) — already created evidence bound proposal Returns: deeply frozen, deterministic review projection Constants <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/execution/TransactionManager.js
Classes
class TransactionManager
Re-exports
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: TransactionManager.js — wraps engine/state/transaction/Transaction.js (makeTransaction/sealTransaction) for the OS.ai() request/commit envelope, and engine/state/transaction/ProposalPool.js for candidate proposal management (competing proposals over the same exclusive inputs pick a deterministic winner; losers re observe and re plan — never silently overwritten). Classes Method Signature Summary Build + seal a transaction envelope. Submit a sealed envelope as a commit candidate. Resolve contention deterministically. @returns {{ winners:object[], superseded:object[] }} Build a deterministic multi target semantic preview. Commit one exact preview through the caller's atomic storage callback. Apply a receipt's exact compensation record through the same callback boundary. Re exports <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


taskGraphRuntimeInvalidation(previousGraph, nextGraph, { approvalCount = 0, toolResults = [], } = {})

naviModelRoutePreflightError(decision, requirements = {}, route = {})

providerToolTransportFallbackEligible(error, request = {})

compileNaviModelCompatibilityRequirements(rawRequest = {}, base = {})

applyNaviModelProviderContract(rawRequest = {}, purpose = 'chat')

selectInvestigationForPrompt({ objective, taskKind = '', goalType = '' } = {})

async validateInvestigationReadReceipt({ kernel, ws, result, descriptorHash, argumentHash, dataClassification, caseId = null, } = {})

prioritizeRequiredPlannerTools(toolDescs, requiredNames = [])

classifySavedArtifactPlanSteps(steps, pending = false, { preferredKind = '' } = {})

buildSavedArtifactWebFiles({ title = 'AI Echo Artifact', authoredHtml = '' } = {})

normalizeSavedArtifactFallbackContent(value, { kind = 'document' } = {})

normalizeFinalizerOutput(value, schema = DEFAULTOUTPUTSCHEMA, rawText = '')

readOnlyObservationSignature(results, toolDriver = null)

detectFinalToolEnvelope(answer, toolDriver = null, toolResults = [])

resolveNegotiatedToolName(requestedName, capabilities = [])

waitForNaviExecutionMode(kernel, { timeoutMs = NAVICOGNITIONTRANSIENTWAITMS, signal = null, } = {})

resolveNaviFacultyToolInvocation(toolName, rawArgs = {})

projectVerifiedFacultyOutcomeAck(receiptEvidence, replayed = false)

projectArtifactFileActivity({ toolName = '', args = {}, result = null, phase = 'preparing', errorCode = null, error = null, } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: TwoPassPlannerFinalizer.js — the Phase 9 execution loop (kernel.aiExecutor). Full flow per OS.ai() task: prompt → goal classify → gather context (roots checked resource reads, PrivacyGuard scrubbed) → capability negotiation (Ph4/Ph5 attestation) → model tier choice → PASS 1 planner (JSON plan; tools executed through the AI Tool Firewall with idempotency keys, policy gating and approval elicitations) → PASS 2 finalizer (strict schema, NO tools) → validator → repair if needed (bounded RepairLoop) → CommitCoordinator commit → Witness receipt → Task Ledger record. The pipeline is driven as Phase 6 storylets over worldState.phase; every fired storylet returns (see AIStoryletFactory) which this loop awaits, then applies via StoryletEffectsApplier. Classes Method Signature Summary Run one AI task end to end. Ask the dedicated free steering lane to classify only an ambiguous operator instruction. The result is advisory: it cannot execute tools, approve actions, cancel work, or choose its own delivery semantics. Ask one exact 2–4 choice task checkpoint through the existing elicitation surface. Deterministic goal classification — no model call needed for routing. Roots checked, scrubbed resource reads → OBSERVED context. Attest + mint per tool capabilities for the negotiated tool set. PASS 1 — planner produces a JSON plan; tools run through the firewall. Complete an explicit saved Artifact obligation without asking a model to serialize a large mutation inside the general planner transport. The model authors ordinary text only. The OS constructs one exact local task graph and still routes the mutation through normal Faculty resolution, approval, ToolRouter execution, readback verification,


taskGraphRuntimeInvalidation(previousGraph, nextGraph, { approvalCount = 0, toolResults = [], } = {})

naviModelRoutePreflightError(decision, requirements = {}, route = {})

providerToolTransportFallbackEligible(error, request = {})

compileNaviModelCompatibilityRequirements(rawRequest = {}, base = {})

applyNaviModelProviderContract(rawRequest = {}, purpose = 'chat')

selectInvestigationForPrompt({ objective, taskKind = '', goalType = '' } = {})

async validateInvestigationReadReceipt({ kernel, ws, result, descriptorHash, argumentHash, dataClassification, caseId = null, } = {})

prioritizeRequiredPlannerTools(toolDescs, requiredNames = [])

classifySavedArtifactPlanSteps(steps, pending = false, { preferredKind = '' } = {})

buildSavedArtifactWebFiles({ title = 'AI Echo Artifact', authoredHtml = '' } = {})

normalizeSavedArtifactFallbackContent(value, { kind = 'document' } = {})

normalizeFinalizerOutput(value, schema = DEFAULTOUTPUTSCHEMA, rawText = '')

readOnlyObservationSignature(results, toolDriver = null)

detectFinalToolEnvelope(answer, toolDriver = null, toolResults = [])

resolveNegotiatedToolName(requestedName, capabilities = [])

waitForNaviExecutionMode(kernel, { timeoutMs = NAVICOGNITIONTRANSIENTWAITMS, signal = null, } = {})

resolveNaviFacultyToolInvocation(toolName, rawArgs = {})

projectVerifiedFacultyOutcomeAck(receiptEvidence, replayed = false)

projectArtifactFileActivity({ toolName = '', args = {}, result = null, phase = 'preparing', errorCode = null, error = null, } = {})

constructs one exact local task graph and still routes the mutation through normal Faculty resolution, approval, ToolRouter execution, readback verification, and receipts. Run the OS owned Sherlock episode before the general mutation capable planner. Model output may frame hypotheses and propose observations, but it never receives authority: every observation is re bound to a live read only descriptor, normal authorization, and a signed local receipt. Restore the exact encrypted Sherlock state before any provider dispatch. The persistence order is evidence episode case, so recovery admits only bounded deterministic layouts: a case only genesis, a single evidence first record, or one hash bound episode transition ahead of the case head. Every wider disagreement remains visible and read only. PASS 2 — finalizer (strict schema, NO tools) → validate → commit → receipt. Build the exact descriptor snapshot and integrity head used by planner validation. Normalize and compile a candidate through the same deterministic task graph boundary used immediately before authorization. Repair validation uses an isolated compiler so a rejected candidate cannot become a last good graph merely by being inspected. Bounded JSON repair; routes back to the phase that consumes the repaired value. Assemble the user facing content block (goal + context [+ tool results]). Bound app owned identity/policy context before it enters a system role. Functions Normalize app owned context before it crosses into the Navi task envelope. Applications may contribute only an identifier, a descriptive kind, and bounded text. Classification, authority, ranking, provenance, disclosure, and source hashes are deliberately absent because the kernel owns them. Convert a content free kernel route decision into one


taskGraphRuntimeInvalidation(previousGraph, nextGraph, { approvalCount = 0, toolResults = [], } = {})

naviModelRoutePreflightError(decision, requirements = {}, route = {})

providerToolTransportFallbackEligible(error, request = {})

compileNaviModelCompatibilityRequirements(rawRequest = {}, base = {})

applyNaviModelProviderContract(rawRequest = {}, purpose = 'chat')

selectInvestigationForPrompt({ objective, taskKind = '', goalType = '' } = {})

async validateInvestigationReadReceipt({ kernel, ws, result, descriptorHash, argumentHash, dataClassification, caseId = null, } = {})

prioritizeRequiredPlannerTools(toolDescs, requiredNames = [])

classifySavedArtifactPlanSteps(steps, pending = false, { preferredKind = '' } = {})

buildSavedArtifactWebFiles({ title = 'AI Echo Artifact', authoredHtml = '' } = {})

normalizeSavedArtifactFallbackContent(value, { kind = 'document' } = {})

normalizeFinalizerOutput(value, schema = DEFAULTOUTPUTSCHEMA, rawText = '')

readOnlyObservationSignature(results, toolDriver = null)

detectFinalToolEnvelope(answer, toolDriver = null, toolResults = [])

resolveNegotiatedToolName(requestedName, capabilities = [])

waitForNaviExecutionMode(kernel, { timeoutMs = NAVICOGNITIONTRANSIENTWAITMS, signal = null, } = {})

resolveNaviFacultyToolInvocation(toolName, rawArgs = {})

projectVerifiedFacultyOutcomeAck(receiptEvidence, replayed = false)

projectArtifactFileActivity({ toolName = '', args = {}, result = null, phase = 'preparing', errorCode = null, error = null, } = {})

ranking, provenance, disclosure, and source hashes are deliberately absent because the kernel owns them. Convert a content free kernel route decision into one stable, actionable blocker. Eligibility remains owned by NaviModelBroker; this projection only explains why a zero route decision stopped before disclosure or dispatch. Native provider tool envelopes are an optimization, not an execution authority. If preflight proves that the approved route set cannot carry them, the planner may fall back before disclosure or dispatch to its exact JSON transport. Privacy, policy, and other route failures remain terminal. Compile hard model route requirements from the actual model protocol. Provider tools are an optional ty


kernel/ledger/AgentScratchpad.js
Classes
class AgentScratchpad
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: AgentScratchpad.js — bounded execution notes for AI requests. This records operational state (plans, actions, observations, failures and phase changes), not hidden model reasoning. Entries are safe to render in a task report and give the user a replayable account of what the agent did. Classes Method Signature Summary <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/ledger/BlockerList.js
Classes
class BlockerList
Re-exports
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: BlockerList.js — active blockers for an AI request: pending approvals, unanswered elicitations, effects parked for reconciliation, denied capabilities. The overlay's Mini Bar badge count comes from here. Classes Method Signature Summary Unresolved blockers, optionally for one request. Re exports <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/ledger/BoundedTrace.js
Classes
class BoundedTrace
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: BoundedTrace.js — shared base for the ledger's simple per request traces (resource reads, sampling, elicitations, storylet fires): bounded, timestamped, requestId keyed append log. Type specific traces extend this instead of quadruplicating the same buffer logic. Classes BoundedTrace.js — shared base for the ledger's simple per request traces (resource reads, sampling, elicitations, storylet fires): bounded, timestamped, requestId keyed append log. Type specific traces extend this instead of quadruplicating the same buffer logic. Method Signature Summary Append an entry (timestamped). Returns the stored entry. Entries, optionally filtered to one request. <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


class ElicitationTrace extends BoundedTrace

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: ElicitationTrace.js — ledger trace of mid task user questions (Phase 4 ElicitationManager): what was asked, whether the user answered/declined/ timed out, and how long the task waited. Classes Method Signature Summary <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/ledger/ExecutionGraph.js
Classes
class ExecutionGraph
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: ExecutionGraph.js — the executed steps DAG for an AI request: nodes are storylet fires / tool calls / model passes; edges are causal ("B used A's output"). Feeds the Timeline Panel's graph view. Classes ExecutionGraph.js — the executed steps DAG for an AI request: nodes are storylet fires / tool calls / model passes; edges are causal ("B used A's output"). Feeds the Timeline Panel's graph view. Method Signature Summary <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


publicErrorNumberForFailure({ errorCode = '', failure = null } = {})

projectAIEchoPipelineTrace(value, { requestId = '', incidentId = null, outcome = '', errorCode = null, errorNumber = null, openedAt = 0, closedAt = 0, } = {})

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: FinalReport.js — assembles the end of task report for one AI request from the ledger's parts: goal outcome, task summary, tool/resource/sampling/ elicitation activity, blockers hit, receipts issued. This is what the overlay shows when a task completes and what gets persisted with the request record. Classes Method Signature Summary Functions Convert an Artifact mutation failure into a fixed, content free diagnostic. Raw handler text is used only to select a known category and is never returned, so prompts, file contents, tool arguments, and provider bodies cannot enter Run Details or copied diagnostics through this path. Keep only broker authored, content free failure evidence. Provider payloads, prompts, credentials, endpoints, and response bodies are deliberately absent. Preserve a content free model compatibility decision when the kernel stops before provider dispatch. This is intentionally separate from : zero attempts is evidence that no provider was called. Project a Navi broker execution into a bounded diagnostic receipt. Request hashes and partial result hashes are intentionally excluded because they can fingerprint operator content without helping an operator diagnose routing. Project the existing resumable run stream into one compact, durable, content free diagnostic trace. This is deliberately a report projection, not a second event registry or ledger. Unknown fields are dropped rather than recursively scrubbed so prompts, provider bodies, credentials, raw tool arguments, and reasoning deltas cannot cross this boundary. Constants <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps


boundary. Constants <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/ledger/GoalTree.js
Classes
class GoalTree
Re-exports
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: GoalTree.js — hierarchical goal decomposition for an AI request: the root goal (the user's prompt intent) breaks into subgoals; each node tracks its status so the Task Panel can render live progress. Classes Method Signature Summary Add a goal. The first goal added (or parentId=null) becomes the root. Serializable nested tree for UI rendering. Overall progress: done leaf goals / total leaf goals. Re exports <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/ledger/ObservationLog.js
Classes
class ObservationLog
Re-exports
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: ObservationLog.js — wraps engine/state/entity/ProvenanceStore.js: every observation an AI task makes carries W3C PROV style provenance (observed/inferred/model predicted/user asserted/untrusted). Tool/model/ resource content is recorded as UNTRUSTED observation by default — never authority (the prompt injection boundary). Classes Method Signature Summary Record an observation for a request. Provenance records for a subject id (from ProvenanceStore). True if an entry's provenance marks it untrusted. Ordered observations, optionally filtered to one request. Re exports <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


class ResourceReadTrace extends BoundedTrace

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: ResourceReadTrace.js — ledger trace of every resource read an AI request performed (URI, byte size, roots check outcome), so the Task Panel can show exactly WHAT the AI looked at. Classes Method Signature Summary <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


class SamplingTrace extends BoundedTrace

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: SamplingTrace.js — ledger trace of nested LLM completions requested by tool handlers via the SamplingBroker (Phase 4): parent request, depth, model tier, token/cost accounting when available. Classes Method Signature Summary <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


class StoryletTrace extends BoundedTrace

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: StoryletTrace.js — ledger trace of storylet fires for an AI request (Phase 6 pipeline): which storylet fired, the phase transition it caused, and its result summary. Classes Method Signature Summary <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model


kernel/ledger/TaskLedger.js
Classes
class TaskLedger
Notes & Examples
Command Bus Pattern

<! AUTOGENERATED by tools/extract api.py — content above HUMAN NOTES is overwritten Source: TaskLedger.js — aggregation facade over the Phase 8 ledger parts, wired as kernel.taskLedger. One shared instance holds cross request traces (observations, tool calls, resource reads, sampling, elicitations, storylet fires, blockers) plus per request records (goal tree, task list, execution graph, receipts). Every recorded receipt/witness reuses engine/state/witness/Witness.js (makeWitness/makeReceipt) and every record lands in the SHARED Phase 7 event log via kernel.timeEngine.record(). Classes Method Signature Summary Close a request and freeze its final report. Record a commit/rejection receipt for a request. Record a projection/decision witness for a request. Record operator guidance attached to one exact elicitation decision. The scratchpad entry remains available to normal task reports, while the shared time engine event also preserves decisions that use a synthetic request id and therefore never open a full AI task record. Record one bounded planner round for diagnostics and durable app history. Mark a recorded planner round as a safe executor stop with a durable reason. Untargeted event sink (OSEventGraphAdapter forwards storylet events here). <! HUMAN NOTES Notes & Examples Command Bus Pattern The OS uses a capability gated command bus for inter app and system communication. Apps register command handlers; the kernel routes commands based on capabilities. Commands can be local (same app), cross app (with permission), or system level (elevated). Example: Command registration and invocation See also: WebGPU OS Architecture · Security Model