Compute

ZephCraft runs programs: WebAssembly modules published to the grid (they're content-addressed like everything else) and executed in a fuel-metered sandbox with capability-scoped access to the node's storage and SQL.

One runtime, two profiles

There is a single WASM runtime. What a program may import is decided by its capability grant, enforced at link time — a program importing a host function it wasn't granted fails to even instantiate.

• Deterministic profile (the default): input, state, commit, crypto verify, SQL, object store, and the consensus clock. This is what consensus-critical programs get — note that SQL and storage access are deterministic (content-addressed reads: same state + same query → same rows everywhere). The determinism boundary is clock and randomness, not I/O.
• Full profile (apps): everything above plus wall_clock (real per-node time).

The host surface: input, commit, state, caller, ed25519_verify, sql_execute, sql_query, obj_put, obj_get, clock, wall_clock. A program exports run(); whatever it passes to commit() is the invocation's result.

Confinement by construction

sql_execute takes no namespace argument — a program writes only its own app.<name> database, and can read other identities' same-app databases. Cross-app or cross-personal access isn't forbidden; it's unexpressable.

Invocation

Programs are invoked locally or remotely over the network. The remote caller's identity is free: the QUIC connection is already mutually authenticated, so the caller's node ID arrives with the call — no logins, no tokens. Deploying a program is: publish the WASM, register its name in the head registry; anyone can then invoke it by owner/name.

Program accounts — "the program is the writer"

For state that must follow deterministic rules rather than a keyholder, ZephCraft has program accounts: an account address is derived from (program, seed) — no private key exists for it, and the program's deterministic execution is the write authority. Validation (say, an owner signature on a submission) happens inside the program. The account's address is stable across code upgrades: governance can swap the executing WASM without moving the state.

This substrate is what the head registry runs on, and it's open to any program.

Honest limits

Fuel is the only resource bound today (memory/recursion caps are on the backlog); randomness is deliberately not exposed yet (it must be request-seeded to stay re-verifiable); and the independent verification layer — other nodes re-running a program to check a claimed result — is designed but not built.