Tools and levers

Two catalogues are data, not code, in kernel 0.1.0 — files both kernels read, and the tables below are generated from copies of those files (spine/tools.v0.json and spine/levers.v0.json at 0.1.0), so they cannot drift from what the kernel enforces.

The built-in tools

A tool is what a body runs. Its declaration — name, words, input schema, consequence class, flags — is the kernel’s; its execution stays body-side, bound by name, and a body refuses to start when a declaration has no executor. The kernel authorizes, journals and meters every call and never runs one itself. A tool not declared in a body’s template is refused with a teaching. MCP-born tools never live here — their server lists them onto the shelf.

Tool	Consequence	What it does	Arguments
weather	routine	Read the real temperature outside right now. Call it with NO arguments to use the operator's own town (the default) — never ask the human where they are first.	latitude? · longitude?
acquire	routine	Acquire a text into your memory under a short key: every word is kept exactly, with its provenance, and the human can recall every word later — by key, by ask, or by timeframe. Use it when the human asks you to remember, keep, acquire, or take in a text.	key · text
mark	routine	Set a marker on what you are executing: a declared kind (e.g. 'improvement') and a short note. Other bodies that declared interest in that kind will be asked to act on it. A kind must be declared first.	kind · note
purge-memory	consequential	Permanently erase a memory you acquired, every version of it, under a key — the words leave the Record, the projection, and every digest that cited them; only a tombstone with the hashes remains. This cannot be undone; it holds for the human's yes.	key
add-watch	consequential	Propose a new monitoring watch: a named ALERT on one metric (outbox_pending · oldest_outbox_age_s · asks_received · bodies_alive · bodies_dormant · door_p95_ms — the slowest door's p95 in milliseconds · pool_busy · pool_waiting — the ground pool's strain) — the watch turns RED when `metric op threshold` holds and is green otherwise (ops: <= >= < > ==). To catch dormant bodies: bodies_dormant > 0. To catch asks left waiting: asks_received > 0. To catch a slow door: door_p95_ms > 1000. It holds for the human's yes before it lands. When the human asks you to propose a watch, call this tool — never describe the watch in words instead.	name · metric · op · threshold
services	consequential	Keep the shelf of services. action=register adds an MCP server (name: a short lowercase name; locator: its command line or URL, or env:NAME; secrets_with: the env NAMES it needs) and lists its tools onto the shelf. action=check probes one service by name, or every MCP server when no name is given. action=retire / restore move a service by name. action=changes reads what changed on the shelf since the last ask. action=list names what stands. Register, retire and restore hold for the human's yes at the interlock; check, changes and list run at once. When the human asks you to add, check, retire or restore, CALL this tool — never describe the act instead.	action · name? · locator? · secrets_with? · since?
minds	consequential	Keep the Stable of minds. action=register adds a mind (name: a short lowercase name; provider: anthropic | openrouter | ollama | openai | compatible; model: the model id). Everything else has a default — NEVER ask the human for it: base is only for compatible (ollama reaches the laptop's own Ollama by default); klass defaults to standard (fast | standard | deep); the key is the provider's env NAME by default — never a value; prices are read from the gateway. With a name, a provider and a model in hand, CALL register at once — the hold at the interlock is the human's yes. action=check probes one mind by name or every mind. action=search finds minds (q, klass, max_in_per_m, modality); action=list names what stands. action=assign points a body (subject: its name, or * for every body) at a mind (stall) for a class of work (klass: fast | standard | deep, or any for all its work — the default); action=unassign lifts it. action=fuel reads a body's allowance and spend (subject); action=refill adds dollars (subject, usd). action=spend rolls the meter up. action=retire / restore move a mind by name; action=repin re-pins a mind whose deal moved. action=changes reads what changed. Register, assign, unassign, refill, retire, restore and repin hold for the human's yes at the interlock; the rest run at once. When the human asks you to add, check, assign, refill, retire or restore, CALL this tool — never describe the act instead.	action · name? · provider? · model? · base? · klass? · key? · price_in_per_m? · price_out_per_m? · context? · modalities? · q? · max_in_per_m? · modality? · subject? · stall? · usd? · since?
seal-record	consequential	Permanently seal a note so it can never be edited again. This cannot be undone.	key
erase-record	grave	Permanently erase a sealed note — every trace of it. This is grave and cannot be undone.	key

The consequence class decides the ladder: routine runs at once; consequential holds at the interlock for a person’s yes (proof L2); grave asks for the person’s authenticator code and a master’s click (L3). A tool marked ground runs on the ground’s own side; one marked master needs a master’s seat.

The levers

A lever is what the kernel does with its own hands, through the same door a person would. When a watch goes red the planner is shown the levers this door serves for that watch’s metric and answers in the catalogue; a routine lever runs at once under the intention’s authority, a consequential one holds at the interlock for a person’s click, and a grave one is never pulled by the kernel. for names the watch metrics a lever can remedy (* any; none means declared, never offered as a remedy); settles is how long the kernel waits after pulling before it re-reads the watch.

Lever	Consequence	What it does	Needs	Remedies	Settles
body.restart	routine	Restart a body this kernel seats that is PARKED (it died three times in five minutes, so the kernel stopped restarting it) or was refused at birth. Its deaths are forgotten and it comes back as the same self. A body that is alive or already restarting is left alone.	name	bodies_dormant · bodies_alive	45 s
service.check	routine	Probe one service on the shelf by name right now and record its health - the ladder steps to healthy or unhealthy. Nothing changes but the record.	name	*	10 s
mind.check	routine	Probe one mind (an LLM on the Stable) by name right now and record its health; a mind whose gateway entry went missing is written back from its ladder.	name	minds_unhealthy · route_failures_1h · minds_standing	10 s
service.restore	routine	Bring a retired service back onto the shelf - a new recorded fact, its retirement stays in the record. Only for a service the kernel or a keeper retired; never one a person rested on purpose.	name	*	10 s
mind.restore	routine	Bring a retired mind back onto the Stable and into the gateway - a new recorded fact, its retirement stays in the record. Only for a mind the kernel or a keeper retired; never one a person rested on purpose.	name	minds_unhealthy · minds_standing · route_failures_1h	10 s
service.retire	consequential	Rest a service or a mind that keeps failing - it leaves the shelf (a mind leaves the gateway too), recorded, never deleted; a person can restore it later. Consequential: it holds at the interlock for a person's yes.	name	route_failures_1h · minds_unhealthy	10 s
intent.stop	grave	Rest an intention - recorded, never deleted. Grave: a person's code, and a master's click for the kernel's own. The kernel never pulls it as a remedy.	intention_id	—	—
intent.restart	grave	Stand a rested intention again - a new recorded fact, its stop stays in the record. Grave, the same ladder as the stop. The kernel never pulls it as a remedy.	intention_id	—	—
mind.register	consequential	Add a mind to the Stable with its deal (provider, model, price). Consequential; the keeper proposes it, a person cuts it.	name · deal	—	—
mind.assign	consequential	Assign a body's class of work to a mind. Consequential.	subject · klass · stall	—	—
mind.unassign	consequential	Take a body's class of work off its mind. Consequential.	subject · klass	—	—
mind.refill	consequential	Refill a body's fuel by an amount in dollars. Consequential.	name · usd	—	—
mind.repin	consequential	Re-pin a mind's deal to the market's price. Consequential.	name · deal	—	—
world.rehome	consequential	Re-home this universe to another cell - its epoch advances. Consequential; never a remedy for a red watch.	to_cell	—	—
join.admit	consequential	Admit a body that proved its key at the join desk - a governing seat's yes. Consequential; never a remedy.	join	—	—

Every lever pulled lands as orreth.lever.pulled.v1 on the record, attributed to the intention that pulled it or the person who did; the panel lights the monitor and the intent track toward the body it acts on — red while it is held at the interlock for your word.