The default catalog
Thirteen tools are available on a fresh install with nothing configured. None of them reaches past your working directory.
The catalog
| Tool | What it does |
|---|---|
| calculate | Arithmetic, evaluated in code rather than in the model's head |
| time | The clock, the date, the weekday, and the number of days between two dates |
| calendar | Dates and ranges resolved from the words a person actually types |
| read_document | Reads a document already in play and hands back an excerpt plus a reference |
| create_document | Writes a real .xlsx, .docx or text file into your folder |
| edit_document | Rewrites one, in the same format |
| find_file | Finds a file by name or pattern |
| run_code | Runs a script behind a sandbox with the network cut |
| write_code | Writes a source file |
| git | status, log, diff and show. Read only. |
| remember | Notes on disk, brought back when they are relevant |
| archive | Lists or extracts a .zip with the workspace's own inflate |
| checksum | SHA-256 over a file, or a comparison against a published digest |
Documents are real documents
The OOXML is generated by hand in tacet-zip, down to the deflate and the CRC32. An .xlsx produced by Tacet contains a working =SUM() in the cell, not a number that was computed elsewhere and pasted in. That distinction matters the first time somebody edits a row in the file you sent them.
git is read only
The git tool covers status, log, diff and show. It reads a diff so the model can write your commit message. It does not commit, does not push, and does not change a branch. There is no flag that makes it do those things, because the point is that there is nothing to get wrong.
run_code and the sandbox
Code runs behind sandbox-exec on macOS and bwrap on Linux, with the network cut in both cases. If no sandbox is available the tool is removed from the catalog rather than run unprotected, so the model is never handed an unguarded interpreter.
As an ordinary user bwrap --unshare-net fails, because the distro ships kernel.apparmor_restrict_unprivileged_userns=1. So run_code and write_code are absent by default on the most common Linux, which is the honest-refusal path working as designed rather than an edge case. The shell says so on startup and names the sysctl.
archive refuses the whole file, never one entry
Four gates run on the central directory, so both listing and extraction apply them: a name that would escape the destination, an entry that is a symlink, declared sizes that cross the caps, or a repeated name. Any one of those rejects the archive entirely.
The CRC and the declared-against-actual size are proven on extract only, because listing decodes nothing. That is why a listing labels its numbers as declared rather than reporting them as sizes. Extraction always goes into a new directory whose name is rotated until it is free, so there is no argument through which it could overwrite something.
Bulk data never enters the model
A tool that reads a 40,000-row spreadsheet puts the data in a store and hands the model a short summary plus a reference. The next tool that needs it fetches it by that reference. The context window becomes a budget rather than a ceiling, and the model never has to hold something it cannot fit.
Four gates on every call
None of these work by matching text against a list of bad strings.
| Gate | What it rejects |
|---|---|
| Name | A tool that is not in the catalog. The model cannot invent a callable. |
| Schema | Arguments that do not validate, even if the grammar were somehow bypassed. |
| Approval | Outbound data in a session that has already touched personal data. |
| Cancel | Anything at all, the moment you interrupt the turn. |