Expand description
Capability profiles — what an interpreter is able to reach.
§The mechanism is absence, not a check
A profile does not gate calls at runtime. It decides which install
functions run at all, so a form outside the profile is never bound
and calling it is an unbound-symbol error raised by the evaluator
itself. There is no policy object to consult, no branch to get wrong,
and nothing for a clever script to talk its way past — the same
shape wasm-platform’s capability mapper uses, where “capabilities not
present in the set are simply not granted”, and the same property
blue’s wasm tests assert as imports: 0.
§Why this exists
install_stdlib was all-or-nothing: 26 unconditional install()
calls. Every embedder got all 56 native functions, including
sh-exec (a literal sh -c with full metacharacter interpretation),
rm-rf, env-set, kube-bearer-token (the pod’s ServiceAccount
token as a string), sops-extract, and dns/upsert+dns/delete
which mutate live DNS. That set is correct for an operator running a
deployment script on a workstation. It is wrong for anything
evaluating source it did not write — a controller reconciling a CR, a
renderer inside a compliance boundary — and there was previously no
way to say so.
§Honest limits
This bounds reach, not time or memory. A sealed profile can still
spin forever or allocate without limit; that is what
tatara-lisp-eval’s Budget is for, and the two compose rather than
substitute. And a profile says nothing about what the embedder
registers itself afterwards — install_with is the floor, not a
ceiling.
Structs§
- Family
- One stdlib family and what it can reach.
- Profile
- Which capabilities an interpreter is allowed to be given.
Enums§
- Capability
- What a family of primitives can reach outside the process.
Functions§
- families
- Every FFI family, with its capability.
- install_
families - Install the FFI families a profile permits. Families outside it are never installed, so their names are simply unbound.