Crate lex_runtime 

M5: effect runtime + sandbox. See spec §7.4 and §8.5.

What’s here:

• policy::Policy and policy::check_program — the static capability gate that walks declared effects and rejects programs whose effects are out of bounds before any code runs.
• handler::DefaultHandler — the host-side effect handler that the VM dispatches EFFECT_CALL through.

What’s not here yet (deferred):

• WASM-level isolation (wasmtime integration). The --unsafe-no-sandbox flag in the spec is operationally implicit for now: native execution only. We ship the policy/dispatch layer, which is the user-visible half of §7.4 and what the §7.6 acceptance tests exercise.

Re-exports

pub use builtins::is_pure_module;

pub use builtins::try_pure_builtin;

pub use handler::CapturedSink;

pub use handler::DefaultHandler;

pub use handler::IoSink;

pub use handler::StdoutSink;

pub use policy::check_program;

pub use policy::Policy;

pub use policy::PolicyReport;

pub use policy::PolicyViolation;

Modules

builtins

Pure stdlib builtins — string, numeric, list, option, result, json ops dispatched via the same EffectHandler interface as effects, but without policy gates (they have no observable side effects).

handler

Native effect handlers, dispatched at runtime through the VM’s EffectHandler trait. The handler also re-checks the runtime policy per spec §7.4 (the static check is necessary but not sufficient: a fn declared [fs_read("/data")] that’s allowed at startup still has to pass the path check at the point of dispatch).

llm

HTTP-backed LLM completions for the [llm_local] and [llm_cloud] effects (#196).

mcp_client

Minimal stdio MCP (Model Context Protocol) client for the agent.call_mcp builtin (#185). Spawns the named MCP server as a subprocess, completes the initialize handshake, then forwards a tools/call request and returns the result.

policy

Capability/policy layer per spec §7.4.

ws

WebSocket server + chat-broadcast registry.