Crate cuttlefish_host 

The wasmtime host: drives proc-blocks and enforces what they may reach.

This crate is where the project’s security boundary actually lives. The compile-time capability check in cuttlefish-core exists to give spec authors good error messages; the checks in caps are what a malicious or malfunctioning block actually runs into, and they fail closed.

Three pieces, in the order a job meets them:

• caps — what a job may reach. Deny-by-default, and canonicalizing to defeat traversal and symlink escapes.
• handles — files held open on the guest’s behalf, served as bounded windows so that bulk data never enters guest memory.
• runner — the reactor loop: the host drives the guest one command at a time, which is what makes cancellation free and every iteration observable.

Inference reaches the runner only through infer::InferBackend, so the whole loop is testable with no model present. Which implementation a job gets is decided by backend::Registry, so adding a provider — an OpenAI-compatible endpoint, an embedded llama.cpp — is additive rather than a change to the runner, the parser, or the daemon. ollama is the first real one.

catalog is a local, content-addressed store mapping name@version to a cataloged wasm block or bundle, so a pipeline can reference a block by name instead of a filesystem path. Purely local filesystem operations — no network. The daemon does consult it (resolving a spec’s pipeline entries at startup, via pipeline::resolve_and_load), but the catalog itself has no daemon-specific logic: the same resolution runs identically from cuttlefish build.

bundle packages a pipeline::Checked pipeline into the .cfbundle container cuttlefish build emits — the write side of what catalog’s read_bundle_signature reads.

Modules

accept

Acceptance checks: what “done” means for a node beyond its declared type.

backend

Resolving a spec’s model reference into something that can generate.

bundle

Packaging a crate::pipeline::Checked pipeline into a .cfbundle.

caps

What a job is permitted to reach.

catalog

The local block catalog: maps name@version to a cataloged wasm block or bundle, so a pipeline can reference a block by name instead of a filesystem path.

dag

Typechecking a node graph: topological order, fan-in composition via InputExpr, cycle rejection (unless marked repeat_until), and branch-exclusivity analysis for conditional dispatch.

documents

Reading paged documents — PDFs today.

fetch

Downloading a URL into the job’s directory.

handles

Files the host holds open on a guest’s behalf.

hex

Lowercase hex for digest bytes.

images

Host-side image transforms: the operations that need a decoder.

infer

Where inference comes from.

ledger

Per-job durable checkpoint store. One SQLite file per job ($CUTTLEFISH_HOME/jobs/<job_id>/ledger.sqlite), matching the catalog’s existing one-thing-per-file convention. See docs/superpowers/specs/2026-08-03-dag-core-design.md’s “Durability model” for the full rationale — this module is purely storage; the resume decision logic (skip on completed/skipped, run everything else) lives in crate::runner.

module_cache

A content-hash-keyed cache of compiled wasmtime::Modules.

ollama

Inference served by a local Ollama instance.

pipeline

Checking that a pipeline’s blocks fit together, before any of them run.

render_worker

Rendering PDF pages out-of-process, so a renderer crash cannot take the daemon with it.

runner

The reactor loop: the host drives the guest, one command at a time.

warehouse

Writing a job’s results as a medallion warehouse.

Functions

embedded_rhai_interpreter_bytes

The shared Rhai interpreter’s compiled bytes, embedded at compile time.