---
---


# Bounded Runs

A **run** is one bounded execution attempt commissioned to advance a Bot's
commitment. Runs are how ContextStack uses tools, creates artifacts, operates
applications, and attempts external effects without placing ambient capability
inside a durable worker.

Not every Bot decision needs a run. No-tool triage, disposition, and planning can
use a receipted Gateway call under a standing cognition budget. The boundary is
consequence: when work touches a tool, artifact, application, or external effect,
Kernel commissions an order and resolves a contained execution cell.

## Capability is resolved per order

The cell begins deny-by-default. It receives only the capabilities needed for the
order, which may include:

- a scoped file or repository workspace;
- selected processes or tools;
- an allowlisted network destination;
- a browser or ordinary desktop application;
- a time- and purpose-bound authenticated session;
- model access through Gateway rather than provider credentials.

Sessions and credentials are held by a broker. They are granted to the cell for
the order and reconciled afterward; they never become part of Bot identity,
prompts, or memory. This is what lets the destination include applications with
no API and services requiring persistent authentication without creating a
worker with permanent keys.

## The coding lane is one profile

For a software-change order, the cell uses a disposable repository clone. Its
durable proposal is a verified bundle or branch that must cross an external gate
before it can affect the target repository. The cell cannot silently merge its
own work or rewrite the verifier that judges it.

That branch-only shape is a property of the coding profile, not the definition of
all runs. An application-operation profile may produce a reconciled external
effect; a research profile may produce an evidence bundle; an editorial profile
may produce a versioned artifact. In every case, the order's capability envelope,
acceptance mechanism, and consequence authorization define the bound.

## Fresh execution, durable responsibility

Cells are disposable. Bots and commitments are not. A retry begins from canonical
state and recorded evidence rather than inheriting an ever-growing private model
session. If a process dies, the organization can reconstruct the commitment,
attempt, budget, and next action from records and commission another run.

This prevents executor continuity from becoming worker identity. The same Bot
can use a local model for one attempt, escalate another operation to a hosted
model, or move to a different machine without losing ownership of the outcome.

## Budgets and receipts are part of the boundary

An order carries limits on time, tokens, spend, retries, and allowed effects.
Gateway returns a receipt for purchased intelligence. The cell returns artifacts,
evidence, and an execution record. Exceeding a bound is a recorded terminal or
deferred state, not permission to keep trying indefinitely.

## Current status

ContextStack has stronger evidence for code-oriented execution than for the full
destination described here. Production-path executor cutover, containment
hardening, and brokered ordinary-application sessions remain active or future
work. This page states the target boundary; it does not claim every execution
profile is operational today.