Pre-build once; invoke one Action at a time

Delivery details stay out of the repository

1. The SDK validates shimpz.toml and every direct actions/*.py file.
2. It statically extracts the English message catalog without importing Assistant code.
3. It generates the canonical machine contract, including that catalog.
4. The platform resolves and locks dependencies and creates the runtime/container files.
5. The platform adds the language pack for the catalog; for a Local snapshot, shimpz assistant stage makes it on your machine.
6. The immutable artifact is admitted against the reviewed manifest, contract, and language pack.

The catalog and language-pack steps require SDK 0.7.1 and CLI 0.9.0 or newer.

Validate before and after execution

1. The Brain selects a reviewed Action and supplies JSON arguments.
2. The Controller validates those arguments against the generated input schema.
3. It writes {input, stored_inputs, files, operation_id} to bounded stdin. stored_inputs is always present: it lists the ids of the Stored Inputs the Action declares whose value that Team already keeps, up to eight, and is empty otherwise. No credential is ever part of an invocation: Team keeps every Integration token and Stored Input value and adds it to the Action's provider calls itself. files is empty unless the Action takes a file, and operation_id names one logical operation and stays the same across its replays. A replay also carries the bounded responses transcript.
4. It executes /usr/local/bin/shimpz-action <action-id> in the Assistant runtime.
5. The SDK loads the reviewed project, selects the named Action, and runs its async body once.
6. The Controller bounds and validates the direct JSON result before the Brain can use it.

Each invocation has an 8-second execution deadline. The encoded request is limited to 512 KiB, or 12 MiB when it carries delivered file content, and the direct response to 512 KiB, before schema and private-value validation.

Team checks each credential's routes before it sends a call

An Action reaches a provider only through await ctx.fetch(...). Before Team places any Stored Input on a call, it matches the call against the routes of every Stored Input the Action declares for that host.

1. Team reads the path exactly as sent, before the query, and never normalizes it. A path with percent-encoding, an empty or . or .. segment, a character outside the unreserved set, or a trailing / matches no route.
2. A segment that names a credential endpoint, such as api-keys or access_token, is refused even where a * would match it.
3. A route matches when its method is the call's method, it has as many segments as the path, and each literal equals the call's segment, while each * takes exactly one.
4. On a route with query selectors, the call must carry each selector exactly once, under the exact name, with one of the listed raw values. Such a call is also refused when its query contains ; or a parameter name outside the unreserved set.
5. Every Stored Input declared for the host must admit the call. If one does not, Team sends nothing, places no credential, and ctx.fetch raises FetchError with code refused.

Widen a route only to an endpoint your Actions actually call, and keep the routes of Stored Inputs that share a host identical.

Authority stays outside the workload

• The artifact is pinned by digest and its manifest and generated contract must match review.
• Team identity, OAuth custody, validation, and execution journals remain Controller-owned.
• Integration tokens never travel through the Brain, environment, command arguments, or logs.
• Outbound traffic is limited to reviewed allowed_hosts through authenticated egress.
• Malformed, oversized, unexpected, or private-value-bearing results fail closed.