Everything about how tasks are defined, governed, executed, and audited. Start with the Execution Contract specification — the normative state-machine definition every run follows.
CLI remains available for scripted runs. The operator path above is the first workflow. To productize a public ledger as the weekly deliverable, use The Glass-Box Operator. For public promises vs public proofs, use Public Surface Ledger. For you-vs-you over time (last checkpoint is durable state), use Promise Ledger. For a stateful fictional rival that cannot publish, use Adversarial Twin — paste only; it does not claim a Twin exists. For adversarial self-due-diligence on the public record, use Hostile Mirror — paste only; it does not claim a Mirror or a ledger exists.
atomind run github-actions-audit \ --repo acme/payments \ --budget-usd 2 \ --approval-mode required \ --format json \ --output findings.json atomind watch run_01H... atomind approve run_01H... --step deploy-preview atomind cancel run_01H... atomind export run_01H... --format json
The REST surface mirrors the task state machine:
| Endpoint | Purpose | Status |
|---|---|---|
POST /v1/runs | Create a run (Durable Object coordinator) | Coordinator |
GET /v1/runs/:runId | Current state. Tools do not execute in this slice | Coordinator |
GET /v1/runs/:runId/events | Append-only ledger | Coordinator |
POST /v1/runs/:runId/approve | Grant a pending approval gate | Coordinator |
POST /v1/runs/:runId/pause | Pause a running or planning run | Coordinator |
POST /v1/runs/:runId/cancel | Server-side cancellation; exports hashed run.json to R2 | Coordinator |
GET /v1/runs/:runId/artifacts | Snapshot including R2 ledger pointer when terminal | Coordinator |
An OpenAPI schema and generated reference will ship with the public beta.
Webhooks: run.started, approval.required, step.failed,
run.completed, run.cancelled — signed, with retries and event IDs.
Full details: Execution Contract.
The sandbox executes a safe sample task with mocked external tools and a complete visible trace — no credentials required. Available from the dashboard.