Architecture
One command model and one authorization boundary across frontends and providers.
The public command model is independent of D-Bus, X11, Blender, MCP, and any specific application API. Frontends converge on the broker; providers adapt the work to an application or system.
The shared path
Section titled “The shared path”The broker snapshots the chosen descriptor and its provenance, evaluates capability and scope, obtains the execution gate, requests human approval when required, validates current references, and invokes the selected provider with cancellation and deadline semantics.
For example, discovering an application operation returns a description of what is available. Calling it is a separate step: the broker evaluates authority and validates the current target before reaching the provider. A capability appearing in search is not permission to execute it.
Provider identity is assigned by the owner
Section titled “Provider identity is assigned by the owner”A provider has identity, source kind, version, namespace and lifecycle. Imported metadata is untrusted. A dynamic provider cannot claim builtin authority, and registration is distinct from a policy grant. Catalogue replacement is revisioned so stale descriptors do not silently target a different operation.
Keep composition separate from authority
Section titled “Keep composition separate from authority”Recipes re-enter the broker for each step. Plugins provide bounded one-shot commands. Persistent application drivers can maintain a connection or application state, but still run through the provider boundary. Federated MCP tools are imported into that same registry rather than becoming an authorization bypass.
Dependency direction
Section titled “Dependency direction”The Native SDK adapts optional application cooperation through the existing Driver SDK and Host. Applications keep their own model, persistence and transactions. Project Graph records dependencies and drift; Effects evaluates scoped readback; artifact handoff transfers bounded verified file-backed output. These surfaces do not introduce another authorization engine.
types owns transport-independent models. registry validates descriptors. policy owns authorization and filesystem grants. backend-api owns provider and backend traits. core owns orchestration, references and provider leases. The daemon wires the components together; frontends depend on the protocol instead of duplicating backend logic.
Source: architecture, source references checked 7 October 2026.