cek-surface

Compose list[Op]. Host authorizes. Peer applies. Peer IR is perception only.

from cek_host import Host
from cek_surface import Surface, Op, search_hits
from cek_surface.domain_loader import load_bundled

load_bundled()
s = Surface(kernel=Host(secret=b"dev-only-not-for-production-32!!"), carrier_kind="memory")
s.use_stdlibs(["baseline", "ui", "search"])

@s.action("hello")
def hello(ctx):
    return [Op.ui_morph("shell", {"tag": "main", "text": "hi"})]

@s.action("find")
def find(ctx):
    return [search_hits("results", [{"title": "a"}], q="a", stamp=ctx.surface.stamp)]

The declared catalog is frozen (Baseline ∪ UI seed). search.hits is a runtime stdlib pair — projected only after Host↔Peer agree and the session stamp includes it.

Carriers: subprocess (default Node Peer) · memory · websocket · kernel (in-process cek_peer_pyo3).

In-process peer: Surface(carrier_kind="kernel") → cek_peer_pyo3.PeerAbi construct → bind → apply → release. Install from cek-runtime (cargo build -p cek-peer-pyo3 --features extension-module --release; export CEK_PEER_PYO3=.../libcek_peer_pyo3.so). CEK_KERNEL_CARRIER=subprocess shells cek apply. That is not the default.

Perception (not shared world): s.mark_pending("btn") · s.mint_continuation("timer.fired:x", "find").

pip install cek-surface          # pulls cek-host>=0.2.0