Skip to main content
Functions are the only named read/computation boundary in the platform. Everything that presents data — a dashboard panel, a Workshop block, an assistant answer — reads through one.

The rules that follow from that

  • A dashboard panel reads exactly one governed function. A panel never owns object querying, sorting, grouping, aggregation, or row limits. If the panel needs a different shape, that is a different function.
  • Reads resolve at a basis. Source-only governed reads compile to the temporal engine and execute at an exact basis. Reads use the latest transaction or an explicit historical id; they never see a half-published capture.
  • Results are bounded. A function that would return an unbounded or unselective result is refused, not truncated silently.

Running one

For analytics as code, the same governed table is available in an explicit Arrow representation without adding a second query doorway:
JSON remains the inspectable command contract.

Inference-backed functions

A function may declare one inference terminal. Its code authors ordered messages: one leading developer message followed by one or more user messages. There are no system, assistant, or tool messages.
  • Developer instructions are literal text.
  • Runtime scalar data is serialized canonically into user messages.
  • returns() is the exact structured-output contract.
  • One deterministic query result may feed the inference terminal only through function.value, which requires one complete row, one authored column, and one non-null scalar.
Execution evaluates query terminals first, resolves immutable media inside the request-local source transaction, fingerprints the fully resolved typed input, closes that transaction, and only then makes one synchronous provider call — one choice, no tools, store=false. It rejects refusals, truncation, tool calls, configured model-revision drift, and schema-invalid output, and returns typed provider, request, and response evidence.
Model functions are explicitly invoked only. Dashboards and boot validation never spend nondeterministically.