A small control plane with explicit recovery
Substrate serves JSON over HTTP and bounded WebSocket channels. Resource responses carry observed state, and every response identifies the contract bundle and its digest in headers.
This page summarizes the currently implemented public families. Capability facts remain the authority for what a particular daemon can serve.
Machine
| Method | Path | Purpose |
|---|---|---|
GET | /v1/machine | deployment, driver generation, verified capabilities, limits, contract identity |
More columns: swipe horizontally, or focus the table and use the arrow keys.
Query this first. Do not infer support from a version number or deployment label.
Workspaces
| Method | Path | Purpose |
|---|---|---|
POST | /v1/workspaces | create a workspace through a keyed operation |
GET | /v1/workspaces/{workspace_id} | read observed workspace state |
DELETE | /v1/workspaces/{workspace_id} | destroy a workspace through a keyed operation |
GET | /v1/workspaces/{workspace_id}/files/{*path} | read a bounded file range |
PUT | /v1/workspaces/{workspace_id}/files/{*path} | atomically replace a file |
DELETE | /v1/workspaces/{workspace_id}/files/{*path} | delete a guarded path |
POST | /v1/workspaces/{workspace_id}/lease/renew | renew workspace liveness |
More columns: swipe horizontally, or focus the table and use the arrow keys.
The host serves empty workspaces and conditionally serves Git materialization. A Git request names
a deployment-configured HTTPS source, an authorized opaque locator, the provider branch, an exact
commit and a depth from 1 through 50. It requires the workspace.git fact and transient source
authority. The resulting working tree has detached HEAD at that commit. Its .git directory is
usable in confined terminals but hidden from file and tree APIs.
The bounded Git routes below compare against the host-private immutable materialization baseline. They do not turn the workspace API into an arbitrary Git remote client.
Development v2 byte plane
Bundle 0.9.0 declares the already-served v2 workspace byte plane. It adds no new resource family:
it gives file operations closed request shapes for bounded directory reads, byte replacement,
edits, and patches.
| Method | Path | Purpose |
|---|---|---|
GET | /v2/workspaces/{workspace_id}/files/{*path} | read bounded file bytes |
GET | /v2/workspaces/{workspace_id}/tree | read a bounded directory tree |
GET | /v2/workspaces/{workspace_id}/git/baseline/{*path} | read one bounded file at the materialized commit |
GET | /v2/workspaces/{workspace_id}/git/changes | compare the index/worktree with the materialized commit under item and byte bounds |
PUT | /v2/workspaces/{workspace_id}/files/{*path} | atomically replace file bytes |
POST | /v2/workspaces/{workspace_id}/file-edits/{*path} | apply one bounded positional edit |
POST | /v2/workspaces/{workspace_id}/file-patches/{*path} | apply one bounded patch |
More columns: swipe horizontally, or focus the table and use the arrow keys.
Release 0.7.3 advertises substrate-wire/0.16.0 in x-b10x-contract and its inner
bundle.json SHA-256 in x-b10x-contract-bundle-sha256. The two headers are one claim. The signed
outer OCI manifest has a different digest because it identifies the distribution package rather
than the inner contract manifest.
The current release is 0.7.3 with development bundle 0.16.0. That bundle adds the
closed Git source request and two Git observation routes. Earlier additions now served include
PTY sessions, metrics, hard storage quotas, scoped workspace write authority and hosted admission.
The session routes moved to /v1/sessions in bundle 0.15.0; no /v1/pipe-sessions
compatibility alias is served.
Frozen compatibility declarations and route/schema details are available in the 0.16.0 bundle. See system model and derivation for which artifacts are generated and status for release maturity.
Metrics
| Method | Path | Purpose |
|---|---|---|
GET | /v1/metrics | refresh one exec or workspace usage observation |
GET | /v1/metrics/stream | receive latest-wins live exec samples over WebSocket |
More columns: swipe horizontally, or focus the table and use the arrow keys.
Execs
| Method | Path | Purpose |
|---|---|---|
POST | /v1/execs | start a bounded exec through a keyed operation |
GET | /v1/execs/{exec_id} | read observed exec state |
GET | /v1/execs/{exec_id}/output | read persisted bounded output |
POST | /v1/execs/{exec_id}/signal | signal a running exec |
POST | /v1/execs/{exec_id}/lease/renew | renew exec liveness |
DELETE | /v1/execs/{exec_id} | retire an exec |
More columns: swipe horizontally, or focus the table and use the arrow keys.
Exec start is served only when the daemon verified its complete host confinement floor.
Sessions
| Method | Path | Purpose |
|---|---|---|
GET | /v1/sessions | read session capability information |
POST | /v1/sessions | start a leased raw-pipe or PTY session |
GET | /v1/sessions/{session_id} | read observed session state |
GET | /v1/sessions/{session_id}/attach | attach the one bounded WebSocket channel |
POST | /v1/sessions/{session_id}/attachment-authorities | mint one bounded hosted WSS attachment authority |
POST | /v1/sessions/{session_id}/signal | signal the underlying process |
POST | /v1/sessions/{session_id}/lease/renew | renew session liveness |
DELETE | /v1/sessions/{session_id} | retire a session |
More columns: swipe horizontally, or focus the table and use the arrow keys.
Sessions are a development slice. Raw pipes remain the default; PTY mode requires a bounded initial
window and a verified sessions.pty machine fact. Hosted attachment requires a short-lived,
one-use key-and-channel-bound authority; Unix attachment continues to use kernel peer credentials.
Recovery and events
| Method | Path | Purpose |
|---|---|---|
GET | /v1/ops/{operation_id} | reconcile one caller-minted operation |
GET | /v1/events | page through retained typed events |
GET | /v1/events/stream | follow the same event sequence over WebSocket |
POST | /v1/reconciliation-snapshots | create a bounded state barrier |
GET | /v1/reconciliation-snapshots/{snapshot_id} | read the barriered recovery view |
More columns: swipe horizontally, or focus the table and use the arrow keys.
Event replay is bounded by the retention advertised in machine facts. Consumers must reconcile from a snapshot after a history gap. A reconciliation snapshot contains observed resource state, not a restorable copy of workspace files.
Identity and operation IDs
Resource IDs are opaque and server-minted. Mutation operation IDs are caller-minted and stable across retry. Resource and operation lookup stays within the authenticated subject namespace.
Read operations and observations for retry semantics and status for the implementation boundary.