OS

Payload schema

configobject

Scope policy. `{}` is the default: full surface, trusted authority.

surfacestring[]optional

Restrict scripts run in this scope to these itx built-in members (e.g. ["chat"] — see domains/itx/surface.ts). Present means scripts see ONLY these members plus this scope's mounts, and run with project-confined, non-admin authority. Absent is the full surface. Recorded at birth; the same-key-different-body rule keeps it fixed.

fallback(string | any[])[] | nulloptional

Where capability reads go on a local miss: an itx expression naming ONE other host — usually ["capabilityHosts", ["get", "/"]], the project root — or null, which ends resolution here. Recorded at birth and re-evaluated against this scope's own itx on every fallback read, so the expression is a durable name, never captured authority. Nullish only so pre-fallback birth certificates still parse; absent means null.

Raw JSON schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "properties": {
    "config": {
      "type": "object",
      "properties": {
        "surface": {
          "description": "Restrict scripts run in this scope to these itx built-in members (e.g. [\"chat\"] — see domains/itx/surface.ts). Present means scripts see ONLY these members plus this scope's mounts, and run with project-confined, non-admin authority. Absent is the full surface. Recorded at birth; the same-key-different-body rule keeps it fixed.",
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^[A-Za-z_$][\\w$]*$"
          }
        }
      },
      "additionalProperties": false,
      "description": "Scope policy. `{}` is the default: full surface, trusted authority."
    },
    "fallback": {
      "description": "Where capability reads go on a local miss: an itx expression naming ONE other host — usually [\"capabilityHosts\", [\"get\", \"/\"]], the project root — or null, which ends resolution here. Recorded at birth and re-evaluated against this scope's own itx on every fallback read, so the expression is a durable name, never captured authority. Nullish only so pre-fallback birth certificates still parse; absent means null.",
      "anyOf": [
        {
          "minItems": 1,
          "type": "array",
          "items": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "array",
                "items": {}
              }
            ]
          }
        },
        {
          "type": "null"
        }
      ]
    }
  },
  "required": [
    "config"
  ],
  "additionalProperties": false
}