schemaxis/Agent’s HandsInvited developer reference
The five-point product explanation
In the strict declared-work interface, the agent never runs code or directly handles source data. It declares where the data comes from or how it is generated, which operations it passes through, and how it is output. Schemaxis marshals immutable input captures, sealed execution and outputs retained by digest.
This describes who operates on the inputs: no agent-supplied arbitrary scripts, shell or direct source-filesystem manipulation. The agent can receive bounded observations and receipt content; this does not promise that data is hidden from the model. Sealed container execution requires an explicitly configured, qualified backend. Native applications execute trusted runtime code. The historical local MCP demonstration alone does not establish that isolation.
Admission, the declared schema, task scope and budget reservation are checked before execution. A request outside its authority is refused before a native job can run. Planning and inspection can run without launching the applications; native result verification is a separate step that reports the checks actually performed. In the retained MCP demonstration, a NumPy request under a SymPy-only scope returned SCOPE_EXCEEDED. Calls stopped at planning: zero native execution, all four prior NumPy output digests unchanged, and no successful current invocation to claim.
Historical prepared-recipe local MCP demonstration, core 5cfe1b0. It is separate from both the comparative study and the hosted container-isolation proof.
Haiku 4.5: 22/110 without → 110/110 with Schemaxis; Sonnet 4.6: 22/110 without → 110/110 with Schemaxis; GPT-5.6 Luna: 68/110 without → 110/110 with Schemaxis. Haiku 4.5’s native initial output had 32/32 images rejected, while its retained transcript called the result “production-ready”. The Schemaxis artifacts passed the required checks. The core supplies the verification state and receipt instead of relying on the agent’s success sentence. This records a misleading claim and changed artifact outcomes; it does not measure a general reduction in false-reporting propensity.
29 September 2026: one authoring conversation per model and method, older model versions, 110 checks across an initial task and revision on small, purpose-built serial ParaView fixtures. Checks are not independent tasks. Some historical Schemaxis runs inspected implementation details or used helper code; one revision wrapper was broken despite passing artifacts. These are artifact outcomes, not qualification of the new strict no-shell authoring interface. The Opus native control was excluded after provider substitution.
A supported declared recipe can be repeated with varied authorised inputs and parameters; each execution produces its own receipt. The reusable document and bounded parameter contract are the mechanism, not a measured advantage for junior staff. Anyone using the supported, configured environment and authorised inputs can repeat it. Compatible runtimes, scope and checks still apply; the record preserves honest failure and unknown states.
The downloadable two-case SymPy example checks local-core binding and host planning only: no native execution or new receipt was created by those preflight checks, and no hosted file-template endpoint is implied.
Frontier models passed either way in the retained paired studies, and Schemaxis was slower.
GPT-5.6 Luna with Schemaxis passed all 110 checks at about one tenth of Astra’s native historical scored API cost (US$0.0815 versus US$0.8828); n=1 conversation each, older versions and 29 September 2026 prices. This is not current pricing or a total compute/support-cost estimate.
Self-operated core: use the captured core documentation, install/configure the appropriate runtimes, inspect a plan, then execute and verify under your own operation. Core and Studio remain Apache-2.0; the public source repository is available through the Docs page. A PyPI release is separate.
Invited hosted access: review the actual invitation and terms first. The strict hosted contract is different from local file-based template/CLI entry points. Do not paste local configuration into it.
Read local rendered documentation ↗Try the checked template example ↗Authenticate and read tools/list. Hosted MCP exposes runtime_request. Read the active create_task budget schema and call allowance before choosing the task.
The local stdio tools use a different contract. Local configuration is not a hosted connection recipe.
Discover the admitted capability and its schema. Create a task with authorised providers and a budget within the active bounds, then author your own declaration.
Captured uploads use an admitted immutable format suffix and returned opaque input identity. Do not supply workstation paths.
Use returned task and plan IDs with the current revision. Give each mutation a stable unique idempotency key. Poll the job at a bounded interval and preserve its actual state.
For an interrupted delivery, retry the exact request with the same key. If the outcome is unknown or awaiting reconciliation, stop and ask the operator. A new key can duplicate work.
Request a new check, inspect the result and compare it with your independent acceptance criteria. A process exit, HTTP 200 or an agent’s statement does not establish correctness.
Download results and receipts only through the owned authenticated grants. Keep the receipt IDs and digests with your records.
Call delete_task and poll deletion_status until physical task deletion completes. A request is not completion. Backup expiry is separately governed by the agreed data terms.
Export and arrange closure before the absolute UTC expiry. Access does not automatically renew.
What has been checked
At core 68e139a, installed MCP SDK 2.3.0 (modern and legacy) and the OpenAI Agents SDK 0.24.0 wrapper completed three scripted local native lifecycles, including fresh checks and cleanup. No models were called.
Claude Agent SDK 0.2.174 was checked for connection and status only. Direct tool execution is not claimed for that client. These checks do not prove external customer activation or actual hosted readiness.
Read the evidence boundaries ↗A small, deliberate pilot