Skip to content
Formless Click

Architecture

Request path

Section titled “Request path”
A capability request crosses explicit trust boundariesThe panel calls a declared Click capability. Host authorizes it and brokers HPP/2 to an isolated provider.
01UserClick workspace
02Panel runtimeCanvas · daScript · ABI v2
03Capability brokerDeclaration + grant check
04Host authorityPolicy + revision
05Provider brokerStable typed binding
06HPP/2 socketGeneration-private UDS
07OCI plugingVisor-isolated
EvidenceHost appends the decision and outcome to its causal journal.
EgressThe plugin reaches only an exact approved HTTPS/WSS destination.

Click is a static browser application. It does not proxy arbitrary plugin traffic and does not manage Podman. Host is the only lifecycle authority; Click, formless-pluginctl, REST clients, and MCP agents submit the same revisioned commands.

Security boundaries

Section titled “Security boundaries”
  1. Canvas is sandboxed browser content. It receives a narrow click API and capability results, not Host tokens.
  2. daScript executes inside Click’s compiled runtime with budgeted callbacks and styled UI primitives.
  3. ABI v2 widgets are hash-approved Emscripten side modules. They share Click’s WASM address space and are trusted, not sandboxed.
  4. Host plugins are immutable OCI workloads mediated by runsc, with network=none and a generation-private HPP/2 Unix socket.
  5. External network access exists only after an exact net.connect(host,port) grant. TLS remains end-to-end between the plugin and service.

Lifecycle

Section titled “Lifecycle”
Desired state is reconciled into observed stateCommands change durable intent. Host serializes transitions and owns teardown.
01InstalledVerified digest · disabled
02PendingDemand + dependencies + policy
03LoadingPrivate scope is acquired
04ActiveBroker binding is available
05UnloadingConsumers first · LIFO disposal
06StoppedPrivate data retained
ReplacementA compatible shadow generation cuts over atomically.
FailureDiagnostics persist; quarantine requires explicit review and reset.

Host reconciles desired state rather than exposing container operations. Installation verifies an exact image digest and publisher policy, then stores the plugin disabled. Enablement requires permission approval. On-demand plugins run only while a panel, dependency, or administrative pin demands them.

Every generation owns its socket, egress bridge, secret leases, subscriptions, and effects. Closing the scope tears those resources down and records any failure while continuing remaining disposers.

Why capabilities

Section titled “Why capabilities”

A capability such as dev.formless.binance-market names a provider contract and allowed operations. It is narrower than access to fetch, arbitrary REST, or a Host relay accepting URLs. This keeps policy reviewable, permits provider replacement, and produces meaningful traces for human and AI debugging.