Bounded Runs

A run is one bounded execution attempt commissioned to advance a Bot's commitment. Runs are how ContextStack uses tools, creates artifacts, operates applications, and attempts external effects without placing ambient capability inside a durable worker.

Not every Bot decision needs a run. No-tool triage, disposition, and planning can use a receipted Gateway call under a standing cognition budget. The boundary is consequence: when work touches a tool, artifact, application, or external effect, Kernel commissions an order and resolves a contained execution cell.

Capability is resolved per order

The cell begins deny-by-default. It receives only the capabilities needed for the order, which may include:

• a scoped file or repository workspace;
• selected processes or tools;
• an allowlisted network destination;
• a browser or ordinary desktop application;
• a time- and purpose-bound authenticated session;
• model access through Gateway rather than provider credentials.

Sessions and credentials are held by a broker. They are granted to the cell for the order and reconciled afterward; they never become part of Bot identity, prompts, or memory. This is what lets the destination include applications with no API and services requiring persistent authentication without creating a worker with permanent keys.

The coding lane is one profile

For a software-change order, the cell uses a disposable repository clone. Its durable proposal is a verified bundle or branch that must cross an external gate before it can affect the target repository. The cell cannot silently merge its own work or rewrite the verifier that judges it.

That branch-only shape is a property of the coding profile, not the definition of all runs. An application-operation profile may produce a reconciled external effect; a research profile may produce an evidence bundle; an editorial profile may produce a versioned artifact. In every case, the order's capability envelope, acceptance mechanism, and consequence authorization define the bound.

Fresh execution, durable responsibility

Cells are disposable. Bots and commitments are not. A retry begins from canonical state and recorded evidence rather than inheriting an ever-growing private model session. If a process dies, the organization can reconstruct the commitment, attempt, budget, and next action from records and commission another run.

This prevents executor continuity from becoming worker identity. The same Bot can use a local model for one attempt, escalate another operation to a hosted model, or move to a different machine without losing ownership of the outcome.

Budgets and receipts are part of the boundary

An order carries limits on time, tokens, spend, retries, and allowed effects. Gateway returns a receipt for purchased intelligence. The cell returns artifacts, evidence, and an execution record. Exceeding a bound is a recorded terminal or deferred state, not permission to keep trying indefinitely.

Current status

ContextStack has stronger evidence for code-oriented execution than for the full destination described here. Production-path executor cutover, containment hardening, and brokered ordinary-application sessions remain active or future work. This page states the target boundary; it does not claim every execution profile is operational today.