§ Platform / API & agents
Anything you can click, you can script.
Every capability in Scellis is defined as a typed verb before any surface calls it — so the buttons you press and the code you write are the same product, not two implementations that drift apart. Script what you did by hand, hand a long analysis to the Copilot, and — as the surface lands — connect your own agent. All of it with your consent, and none of it able to spend your money.
One action, one handler
A click, a line of code, a Copilot sentence — every caller lands on the same validated handler, with the same checks and the same consent.
The build order is a rule of the platform: first the typed verb, then the Studio control that calls it, then the Copilot tool that calls the same verb. Validation lives once, in that one method — so a button here is not wired to hidden logic; it is a caller like any other. There is no second implementation to fall out of step.
That symmetry is what makes the Copilot safe to trust as an operator: when it edits a workflow or starts a run, it passes exactly the checks you pass, and your canvas refreshes through exactly the path your own click would have taken. There is no agent-only back door to guard — and no click-only capability a script has to imitate.
The surface reads like the product
About 30 namespaces today — an open list that grows with the product, never a fixed menu.
| Family | Namespaces | What the verbs do |
|---|---|---|
| Compose | program.* | Create, patch, diff, compile, and plan workflows from code — with undo and redo on the same stack the toolbar uses. |
| Run & observe | run.* | Start, pause, resume, cancel — and read a live run's status and metrics as they arrive. |
| Models | model.* | Layers, groups, and adapters; optimizer, scheduler, and loss settings; inference runs. |
| Author & data | catalog.* · dataset.* | Search, create, update, fork; dataset splits, labels, and cards — through the same check the interface uses. |
| Together | share.* · doc.* · pool.* · federation.* | Invitations and access, live co-editing, pooled jobs, federated rounds. |
| Govern & publish | workspace.* · audit.* · publish.* · provenance.* | Roles and policies, a queryable audit log, publication gates, lineage in both directions. |
A snapshot, not a ceiling: the list grows with the product, and a new verb arrives with its interface control and its Copilot tool in the same change — the parity check refuses anything less.
The namespaces span the entire product: catalog, program, run, and model for the work itself; workspace and audit for governance; share, doc, and presence for working together; pool, job, and federation for pooled compute; marketplace, purchase, and billing for commerce; connector and credential for data. Every verb is classified read, write, or destructive — none is left unclassified, so what a caller may do is always a statement, never a guess.
Authoring rides the same verbs: catalog.create and catalog.update run the same check that gates the interface — and the built-in content — so what an agent writes is structurally identical to what you write. Even undo is a verb, aimed at the same stack the toolbar uses: that is why the Copilot can revert its own edits, and why you can revert the Copilot's.
Checked automatically, not promised in a README
A new capability lands as four pieces in one change — the typed method, the verb, the interface control, and the Copilot tool — and an automated check rejects any gap: a verb with nowhere to click it, a tool with no verb behind it, a menu item that goes around the service. On top of that, a browser test drives the real Studio on real WebGPU and asserts that the same operation, done by hand, said to the Copilot, or called from code, leaves the workspace in exactly the same state.
Events close the loop: whichever door a change came through, every open panel refreshes the same way — so a run your script started shows up in your colleague's Studio exactly as if they had started it. The command palette is the same list of verbs projected onto the keyboard, and scripting the platform means reading the product's own source of truth, not learning a bolted-on SDK.
The server knows who is calling — and what they may do
| Kind of call | What it takes | Examples |
|---|---|---|
| Read | Flows within the scope you granted. | catalog.search · run.observe · provenance.backward |
| Write | Your consent, showing the concrete change being proposed — never a bare “allow?”. | program.patch · run.start · optimize.apply |
| Destructive | A confirmation rendering the real operation, plus a rate limit. | catalog.delete · run.cancel · publish.submit |
| Money-moving | One caller only — you, clicking in the app — plus a single-use token the server accepts exactly once. Every machine caller is refused. | purchase.* · payout · refund_request |
| Credentials | Yours to handle, in the app only — never handed to the Copilot or to any outside agent; the secrets stay on your device. | credential.* |
The tier is part of the verb's contract — no verb is unclassified, and the classification is enforced on the server, not in a client's tool list.
Every verb carries a consent tier. Reads flow within the scope you granted; a write shows you the concrete operation being proposed — the actual change, never a bare “allow?” — and a destructive call renders the real operation and is rate-limited. And the server works out who is calling — you in the app, the Copilot, a script, an API key, an outside agent — from the credential itself, never from anything the request claims about itself. A client cannot claim to be you.
Money is the hard line: purchase and billing verbs admit exactly one caller — you, clicking in the app — each bound to a fresh token the server issues and accepts exactly once. A prompt-injected Copilot, a leaked API key, a connected outside agent: none of them can buy, because the refusal is a list held by the server, not a rule written in a prompt. Credentials draw the same line one layer deeper — they never become an agent tool at all, which is part of the platform's security posture, not a setting.
Bring your own agent — on a surface it cannot outgrow
Claude Code, Claude Desktop, claude.ai — any MCP-compatible client is designed in as the third caller of the same surface. Early access: specified end to end, in development now.
The tool set an outside agent sees is generated from the same list of verbs the interface and the Copilot use — zero hand-written tools, so an agent's view of Scellis cannot lag the Scellis you are using. When the surface ships, a capability added tomorrow appears at the next regeneration, without anyone writing a tool for it. The projection format is published in the permissively licensed interchange ring, and the guide walks the whole surface — how the tools are generated, what an agent may and may not touch — in the agent surface.
The security model is the deliberate half of the design. Access rides OAuth 2.1 with short-lived tokens tied to a grant you can revoke — your client, your scope, your expiry — and a scope caps what a namespace may do; the scope grammar cannot even express a commerce scope. Pairing an agent to your tab is an explicit gesture, and while it is paired the tab shows a standing “agent connected” indicator, a live feed of every call it makes, and one-click revoke.
In this design, reads over synced state answer from the platform directly; anything that writes, or touches your device, needs your live, paired tab — no tab, nothing beyond reading. Two honest notes survive into the datasheet: this is the one surface that is not offline-capable, because it runs through the platform relay (the Studio itself stays fully local), and prompt injection is bounded, not eliminated — what remains is written down in honest limits.
Work you can hand off — and audit
Your agent does the analysis — and leaves behind a record you can check.
Delegation only counts if you can check the work. Every edit an agent makes is attributed to it and lands as an explicit, replayable operation — visible in the diff, undoable on its own, never a mystery write. Every call an outside agent makes is designed to leave an audit entry — which grant, which client, which verb, which arguments, what happened — queryable afterwards and streamed into your activity feed while the session is paired.
The work itself carries the strongest evidence: a run links its workflow, its inputs, the engine version, and its outputs into one provenance record, so what your agent built is reproducible by URL like everything else here. You review a change and a lineage — not a chat transcript.
Hand your agent the analysis. Keep the authority to say yes: the intent to run a tool comes only from you, and a destructive confirmation happens in front of a human, showing the real operation rather than the agent's summary of it.