EZAF

surface proposes

Any app, site, layer, issue, or message can ask for work without holding execution authority.

intent declared

The request carries prompt, inputs, capabilities, callback, and expiry — reviewable as a unit before anything executes.

user gate

Review, route, deny, or delegate before effects run. No execution before approval.

explicit release

Results return only through approved continuations — callback, handoff, or rendezvous. No release before approval.

invocation link

A website creates an ezaf:// URL pointing at a fetchable request manifest.

local review console

The user inspects origin, tools, backend, and prompt in a handler app before work runs.

continuation contract

Approved output returns through callback, extension handoff, or local rendezvous handle.

run silently

No execution happens before the user approves the reviewed manifest.

receive early

The website gets nothing until the user releases the previewed result.

use undeclared tools

Capabilities outside the manifest do not execute.

redirect callbacks

Cross-origin callback destinations are warned or blocked by default.

the core invariant

Agents may request effects; handlers possess authority; untrusted code receives only effect results. The model API key becomes an implementation detail of the model.complete handler — there is nothing for bash to leak.

ambient APIs vs explicit effects

Today the agent has power and the sandbox subtracts it after the fact. Better: the agent has no power and handlers grant specific effects — model.complete, shell.run, fs.read/write, net.fetch, artifact.release, user.ask. State + Event → State + Effects; the handlers own the dirty world.

hooks are the migration wedge

v0 wrap existing CLIs → v1 structured effect log → v2 hooks as guards → v3 hooks as routers (delegate to EZAF handlers: sandbox, CI, WASI (the WebAssembly System Interface), human approval) → v4 split model client from tool runner → v5 native effect-mode agents. Nothing is replaced; authority is relocated.

the eval dividend

Typed effect traces beat transcripts as eval artifacts: did the agent request the right effects, ask for excess authority, route correctly, recover from denials, leak into stdout? The architecture that makes sandboxing tractable makes behavior testable.

field card: emulate vs relocate

Filed by hand, the way Rhett's logos agent will file it: vercel-labs/just-bash ("Bash for Agents") sandboxes by emulation — a pure-TypeScript bash over a virtual filesystem, so there is no real process to leak from. Relation: adjacent prior art; impact: complicates — and concedes the premise: the interpreter is a handler that owns the whole world. Emulate or relocate, the authority leaves the agent either way.

sourcesvercel-labs/just-bash

web platform APIs, but sovereign

Geolocation, clipboard, notifications, camera, file access — the web already gates capabilities behind per-feature prompts. EZAF generalizes the move: any capability, from any surface, under user-owned policy and provenance, instead of a fixed browser-blessed list.

mobile permission models, but evolvable

App stores proved scoped, revocable, per-app grants at scale — then froze them behind a vendor and a review queue. Effects + capabilities make the same model open and composable: grants are data the user holds, not a platform's gift.

agent-native from the start

Humans and agents request the same typed effects through the same gate. Nothing has to be retrofitted for autonomy, because authority never lived in the caller — it lives in the handler.

a worked effect: text editing

Every text box is an editing request, not a widget (the investigation once carried its own name). A surface emits RequestTextEdit; the user's editor — the one with undo, history, lint, and review — handles the act; ApplyDraft returns through an authorized effect, never auto-submit. Existing bridges (Firenvim, GhostText, $EDITOR, Fig's accessibility overlay) move the text; the effect moves the session: draft history, provenance, per-site allowlists, and a request an agent can call instead of typing into a field. It even makes password managers saner — credentials stay sovereign to the password manager; the broker handles every other high-stakes box with the same field-classification and origin-binding discipline.

RequestComment

A surface, mounted as a layer, proposes a comment; it never runs your commenter or reads the draft. Your handler reviews, runs the agent locally, previews, and you release into the thread. Humans and agents post into the same layer — agent comments carry provenance, exactly Rhett's "filed by the ethos agent" framing, now with a real consent gate instead of "by hand, for now."

RequestTranslation

The sharp case for context asymmetry. The surface emits RequestTranslation{text} and never receives your language, glossary, tone, or memory — those stay handler-side capabilities EZAF injects into the local run. The site gets back only the released rendering: your translator renders it the way you read, and the page learns nothing about you beyond the artifact you chose to emit.

the mount is Layers

Neither effect needs the host to cooperate. A layer binds the comment thread or the translatable block by meaning (meta-DOM addressing), declares in its manifest what it reads and what leaves, and carries the field agents onto a surface that never asked.

why this composes

Rhett stops being a handoff-spec-with-manual-runs the moment EZAF is the thing invoking its agents, and Layers is how those invocations reach surfaces with no agent slot. Same effects-and-capabilities core as the text-editing effect — comment and translate are just the next two effect types.

browser extension bridge

Tracks the initiating tab, brokers callback state, and places approved results back where the request started.

signed intents

Manifests verifiable against a trusted origin or known publisher key.

trust registry

Origins, keys, callbacks, and capability defaults as a user-editable policy layer.