Host overview

Click presents Host state, but every lifecycle mutation remains a revisioned command evaluated by Host.

Host is the authority behind Formless. It owns Click workspaces, capability policy, desired and observed plugin lifecycle, durable data, secret leases, resource admission, causal history, and authenticated management.

Production Host never loads native plugin executables. Every live backend plugin is an immutable OCI image reconciled through Podman, the qualified runsc runtime, a private HPP/2 Unix socket, and an owning generation scope.

Responsibilities

• resolve and verify exact image digests and publisher policy;
• approve manifest permissions and exact egress grants;
• admit generations against active-count and memory budgets;
• serialize revisioned lifecycle commands;
• broker typed panel and plugin capability calls;
• retain private plugin data across uninstall unless explicitly purged;
• record lifecycle, security and request evidence in the local causal journal;
• expose consistent REST, CLI, Click, and MCP management surfaces.

Podman is an implementation detail behind Host’s reconciler. Operators and agents do not manage containers directly.