Crate lex_runtime 

M5: effect runtime + sandbox. See spec §7.4 and §8.5.

What’s here:

• policy::Policy and policy::check_program — the static capability gate that walks declared effects and rejects programs whose effects are out of bounds before any code runs.
• handler::DefaultHandler — the host-side effect handler that the VM dispatches EFFECT_CALL through.

What’s not here yet (deferred):

• WASM-level isolation (wasmtime integration). The --unsafe-no-sandbox flag in the spec is operationally implicit for now: native execution only. We ship the policy/dispatch layer, which is the user-visible half of §7.4 and what the §7.6 acceptance tests exercise.

Re-exports

pub use builtins::is_pure_module;

pub use builtins::try_pure_builtin;

pub use handler::CapturedSink;

pub use handler::DefaultHandler;

pub use handler::IoSink;

pub use handler::StdoutSink;

pub use policy::check_program;

pub use policy::Policy;

pub use policy::PolicyReport;

pub use policy::PolicyViolation;

Modules

builtins

Pure stdlib builtins — string, numeric, list, option, result, json ops dispatched via the same EffectHandler interface as effects, but without policy gates (they have no observable side effects).

cli

std.cli — argparse-equivalent for end-user Lex programs (Rubric port follow-up).

handler

Native effect handlers, dispatched at runtime through the VM’s EffectHandler trait. The handler also re-checks the runtime policy per spec §7.4 (the static check is necessary but not sufficient: a fn declared [fs_read("/data")] that’s allowed at startup still has to pass the path check at the point of dispatch).

llm

HTTP-backed LLM completions for the [llm_local] and [llm_cloud] effects (#196).

mcp_client

Minimal stdio MCP (Model Context Protocol) client for the agent.call_mcp builtin (#185). Spawns the named MCP server as a subprocess, completes the initialize handshake, then forwards a tools/call request and returns the result.

policy

Capability/policy layer per spec §7.4.

ws

WebSocket server + chat-broadcast registry.