#Complete capability map

ash turns repository work into typed, bounded programs for Coding Agents. The current surface covers discovery, process execution, guarded mutation, parallel graphs, workspace state, retained evidence, authorization, and signed delivery. Every operation returns canonical ASON rather than terminal-oriented prose.

#ASH/1 operation surface

The request envelope is always t,i,o,a,u; a trusted harness adds v only for an approved permit retry. Fifteen operation IDs make the behavior explicit:

See ASH/1 for exact argument columns, flags, response variants, framing, handshake, and diagnostic codes.

#Runtime and scheduling

One hierarchical governor bounds host, session, request, and operation work. Tokio owns framed RPC, child processes, pipes, deadlines, and cancellation; Rayon owns search, hashing, diffs, reduction, retained-store commits, and other splittable CPU work. Parallel completion order never becomes protocol order: stable merge produces deterministic canonical ASON.

Batch requests validate the graph before launch. Nodes become ready when their dependencies succeed. A failed node skips only its descendants; already-running or independent nodes drain before ash chooses the stable task error.

#Lossless evidence with a small immediate context

Process output is captured losslessly under a bounded session store. A fixed head/tail projection keeps the immediate response compact; once a session's 4 MiB memory ceiling is crossed, immutable evidence spills to private files. Range fetch, aliases, deduplication, leases, normal release, and proven crash-orphan recovery are part of the same store contract.

Reduction is explicit rather than silent:

• ×N marks repeated lines, ×N#K repeated blocks, and ⋯N omitted diagnostic regions.
• Homogeneous ASON records use columns; repeated paths use dictionaries.
• / # ? - | > operate on complete retained results in the same live session, so a Coding Agent can retrieve only the missing evidence without rerunning broad work.
• Every budget reports whether the immediate projection is complete and whether a retained source is available.

Retained aliases are session-local. A self-contained ash run call ends its temporary session after the response; reference formulas, snapshot deltas, batch-child inspection, active cancellation, and permit retries require one live framed ash rpc session.

#Workspace integrity and recovery

All native workspace operations resolve confined, canonical relative paths and reject lexical or symlink escape. Patches require current BLAKE3 preimages. Multi-file lifecycle changes use a checksummed on-disk journal, cross-process serialization, durable commit markers, reverse rollback, and restart recovery. Native file identity closes hard-link crash windows without confusing equal external bytes with files owned by ash.

The transaction fault matrix drives the implementation through 30 forward durable cutpoints and interrupts recovery again at 12 rollback or cleanup cutpoints. Snapshot/delta adds an independent typed view of the resulting workspace state.

#Capabilities, permits, and delivery

The RPC handshake negotiates the least-privilege capability mask. A risky semantic retry requires a one-time permit bound to the session, action, policy, and expiry; replay is rejected. This authorizes ash behavior, not a universal network or syscall sandbox for arbitrary child programs.

ash self status|check|update|rollback|recover uses canonical ASON. Update metadata is byte-bounded and HTTPS-only; signed manifests enforce Ed25519 verification, sequence monotonicity, exact archive shape, extraction ceilings, embedded binary identity, transactional activation, health-gated recovery, and rollback. The release workflow covers Linux, macOS, and Windows on x86-64 and ARM64, with checksums, SBOMs, and provenance.

#Evidence behind the claims

• 327 Rust workspace tests cover typed schemas, RPC, operations, store, transactions, recovery, cancellation, updates, deterministic scheduling, and the human shell.
• The schema-14 runtime harness contains 22 scenarios across worker matrices, including an 8 MiB spill/fetch proof over the 4 MiB memory ceiling.
• Seven locked coding tasks compare a native-shell Agent trace with an ash Agent trace under one task and transcript schema.
• The complete 1,024-case four-node forward-DAG/success-mask space is tested with forced completion-order variation.
• Source-bound format reports, fuzzing, AddressSanitizer artifacts, installer smoke tests, and third-party license gates keep evidence reproducible.

Read benchmarks for the measurement contract and security for the trust and recovery model.

#Deliberate non-goals

ASH/1 is not a human REPL, a POSIX shell compatibility layer, an embedded model, a remote executor, or a universal process sandbox. It does not provide an interactive terminal, shell-language evaluation, overwrite, recursive directory mutation, or runtime value piping between batch nodes. These boundaries keep the typed contract portable and auditable.

The separate, feature-gated ash shell H1 checkpoint adds a line-edited REPL, configurable prompt, safety-checked persistent history, opt-in Profile startup, and exit, and can execute sequential pwd, echo, cd, expanded export/unset, set pipefail control, portable ls, bounded raw-byte cat, bounded text grep, journaled cp/mv/rm, create-only touch, and direct-argv native host commands from terminal, inline source, or bounded stdin/native script files. Source-spanned $NAME, ${NAME}, and $? nodes expand in a quote-aware native-string stage with fixed unquoted field splitting before resolution; nested $(...) nodes recursively retain the same typed script plan and absolute diagnostic spans. Active unquoted pathname patterns then expand under fixed match and directory-scan limits. Stateful and portable commands use ordinary user authority, while native programs inherit the persistent shell cwd/environment and OS authority through the owned platform process boundary. Unredirected standalone native stdin and first-stage pipeline stdin remain null; foreground interactive programs and job control remain H4. The route is a human frontend, not a free-form ASH/1 operation, and does not change any machine capability or confinement claim.

H2 now provides explicit per-stream modes, validated native OS pipe graphs, and native/WSL/portable/stateful pipeline lowering. A same-line | connects two to 32 native host or explicit Windows WSL stages, implemented portable pwd, echo, ls, cat, grep, cp, mv, rm, and touch, or implemented stateful cd, export, unset, set, and exit only after complete preflight. Native pairs use direct OS pipes; in-process boundaries retain explicit asynchronous parent ends and remain concurrent, bounded, and backpressured. cat - and grep PATTERN - consume incoming streams. Stateful stages close incoming stdin, run on independent state clones, emit EOF downstream, and cannot mutate the parent shell; pipeline exit contributes only its stage status. Final in-process output joins the bounded capture path. Status defaults to the final stage; set -o pipefail selects the rightmost native, WSL, portable, or stateful failure, while set +o pipefail restores the default. Native, WSL, and portable commands plus implemented stateful builtins also accept source-ordered <, >, >>, 2>, 2>>, 2>&1, and 1>&2. File targets expand to exactly one field, relative paths resolve against persistent cwd, and files attach directly to child or parent-task OS handles. One graph order interleaves native, portable, and stateful file opens; shared files or captures preserve real descriptor write order. Parent-facing, parent-to-parent, direct child-to-child, native, mixed, portable-only, stateful, closed-reader, and ordered-redirection regressions lock backpressure, exact bytes, EOF closure, broken-pipe behavior, cloned-state isolation, handle exposure, and side-effect ordering across platforms. Stateful arguments preflight before opens; simple stateful files open before parent mutation, while pipeline files join the graph order and redirected empty stdout closes downstream normally. Shell diagnostics remain outside raw command stderr. Ordered lowering may replace any native, WSL, portable, or implemented stateful stage's internal stdin or stdout: explicit parent-closed ends deliver EOF downstream or native broken-pipe behavior upstream, while a descriptor copy that still names the pipe remains connected. After parent resources are claimed, the native graph becomes one job supervisor: waits preserve specification order, and setup, capture, or wait failures terminate plus reap every native member's owned process tree. In-process stages and captures share that pipeline completion boundary. WSL resolution locates wsl.exe, then exact --distribution/--cd/--exec argv lowers the wrapper into the same stream and host-file graph; missing launchers fail during preflight, and selected status retains backend/distribution metadata. An ASH_TEST_WSL_DISTRIBUTION-gated Windows regression streams an 8 MiB fixture through a prepared distro. The first H3 checkpoint binds portable mutations to the persistent cwd and the same BLAKE3-preimage, journaled, no-overwrite transaction service as ASH/1 fs. Copy, move, and remove revalidate an immediately derived source identity; touch creates only a new empty file. Traversal, symlink/reparse traversal, directories, oversized files, overwrite, and non-journalable paths fail explicitly. Redirection files open before the transaction, mutation stages emit no output, and conflicts participate in final-stage/pipefail selection. The second H3 checkpoint adds source-spanned &&/|| lists over complete pipelines. Both operators have equal precedence and evaluate left to right against visible final-stage or pipefail status. A short-circuited pipeline keeps that status and performs no expansion, resolution, preflight, redirection open, launch, state change, or filesystem transaction; only an admitted exit stops the source. Full-source parsing still precedes effects. The third H3 checkpoint adds nested command substitution to command words and file-redirection targets with a 32-level limit and strict source-order execution. Each substitution uses a full shell-state clone, trims every trailing LF from bounded stdout, keeps external effects, and propagates stderr plus diagnostics once without changing parent state or $?. Double quotes preserve one field; unquoted output uses fixed ASCII splitting. NUL is rejected, Unix keeps non-UTF-8 bytes, Windows requires UTF-8, and substitution values share the remaining 128 MiB capture allowance with stdout/stderr. Capture failure blocks the outer command, while short-circuited pipelines run no substitution. If a later stage fails outer preflight, external effects from substitutions already executed in earlier source positions remain. The fourth H3 checkpoint adds deterministic pathname expansion for unquoted *, ?, and bracket classes after field splitting. Quoted or escaped operators stay literal; unquoted parameters and substitutions can introduce patterns. Matches are case-sensitive, sorted by lossless native path units, require an explicit leading dot for dotfiles, and fail closed on malformed syntax or no match. ** is not recursive. A command plus its redirections share 32,768 active pattern units, 65,536 inspected entries, and 4,096 matches; redirections still require exactly one path and skipped pipelines scan nothing. Aliases, functions, subshell state, visible terminal streaming, installed-distribution probing, backend policy, general WSL argument path/environment mapping, Linux-side ownership, and interruption normalization remain later slices.

For Agent adoption, continue with Coding Agent integration.