Platform and network I/O
Native capabilities turn host resources into bounded mail contracts. Guest code never receives an unmediated socket, file descriptor, clipboard handle, or credential.
| Boundary | Chapter |
|---|---|
| Namespaced host files | File I/O |
| Outbound HTTP | HTTP egress |
| Inbound HTTP/routes/streams | HTTP server |
| Framed connections | TCP |
| Internal process transport | RPC |
| Container images and runs over stored trees | Workspace imports and runs |
| Text clipboard | Clipboard |
| Provider APIs/subprocesses | Content generation |
Across these systems, preserve the same boundary rules:
- blocking OS/provider work leaves the actor dispatcher;
- actor state remains the serialization point;
- inputs, buffers, in-flight work, and lifetimes are bounded;
- failures become typed replies or terminal events;
- credentials and raw handles stay native;
- disabled backends fail fast rather than hang settlement, and a chassis that cannot serve a capability composes none, so a dependent is refused at load.
Use a higher-level capability when it exists. HTTP route actors are safer and more observable than reimplementing HTTP over raw TCP; content-generation adapters are safer than sending credentials through general egress.