Fathom

The operator lends one file anchor. An anchor is a named directory the host opens and pins before the program starts. The program says photos; the lend's io binding decides that photos is a read-only folder under the application's own data root.

chest io = {
    u16 schemaVersion = 1
    chest[] anchors = [{
        u16 schemaVersion = 1
        text name = "photos"
        text? leaf = null
        text access = "read"
        text root = "data"
        text directory = "photos"
    }]
}

The operator admits one program with one argument prefix. meterconv --to png may run; any other argument list or any other binary is refused before the filesystem is touched. The converter comes from a pinned tools directory that no writable anchor reaches, so the application cannot replace the binary it runs.

chest proc = {
    u16 schemaVersion = 2
    text? directory = "tools"
    text root = "cwd"
    u32 maxChildren = 2
    chest[] allowedPrograms = [
        { u16 schemaVersion = 1, text name = "meterconv",
          chest[] arguments = [ { text[] prefix = ["--to", "png"] } ] }
    ]
}

The application calls those services by name. t.io.list reads the anchor and t.proc.spawn starts the converter. The child comes back as an opaque handle, never a process id. The program can only poll, read or stop a child it started.

text main(text[] argv) {
    text[] photos = t.io.list("photos", "route-14")
    resource<t.proc.child> child = t.proc.spawn(["meterconv", "--to", "png", photos[0]],
        { text stdout = "capture", text stderr = "inherit" })
    chest status = t.proc.poll(child, 5000000000)
    return t.proc.stdout.readText(child, 4096)
}

At the yard the laptop connects to the regional server. The host does the network work: framing, size limits, a signed handshake against the server's pinned key, and decoding. Only then does on message run, with the host's facts in context and the server's document in payload.

chest main() {
    chest target = { ip address = 10.40.2.7, u16 port = 9443 }
    chest options = {}
    chest answered = t.net.peer.connect("regional", target, options)
    chest state = {}
    return state
}

on message("regional", "workOrder", const context, const payload) {
    text meter = payload.meter
    t.log.info("work order for meter " + meter)
}

On the regional server, a connection offer reaches the program only after the handshake proved the truck's key. The endpoint admits unknown keys so new laptops can enroll. The program decides: it accepts a pinned truck and rejects anything else with a reason.

chest main() {
    chest state = {}
    return state
}

on event("peerOffered", const chest offer) {
    guid connection = offer.connection
    bool? pinned = offer.pinned
    if (pinned != null && pinned) {
        t.net.peer.accept(connection)
    } else {
        t.net.peer.reject(connection, "unknown truck")
    }
}

on message("trucks", "inspection", const context, const payload) {
    text meter = payload.meter
    t.log.info("inspection received for meter " + meter)
}