myxo-lang 1.5.0

package/command-fence.js

@@ -0,0 +1,75 @@
+'use strict';
+// command-fence.js -- turn an ARBITRARY-CODE capability (a raw shell) back into a set of STRUCTURED, bounded,
+// injection-proof capabilities the Warden can certify.
+//
+// The problem: granting `sh("...")` grants the whole shell -- the receipt logs the name but the inner command is
+// unbounded. The fix: don't grant a shell. Grant a fixed ALLOWLIST of named, parameterized commands. Each becomes
+// its own capability (git_status, disk_free, ...), so the fence + receipt see a structured call again.
+//
+// Two hard guarantees make this safe, not theater:
+//   1) NO SHELL. Commands run via execFileSync(program, [args]) -- a direct process spawn, NOT a shell string. So
+//      metacharacters in an argument (`; | $() ` etc.) are inert: they are literal argv, never re-parsed. Injection
+//      is structurally impossible, not filtered.
+//   2) TYPED PARAMS. Every `{param}` slot in a command template must pass a declared policy (regex or enum) before
+//      substitution -- so an argument can't smuggle in a flag or a path. Fail the policy -> refused + logged.
+//
+// A commandFence spec:
+//   {
+//     whoami:    { argv: ['whoami'] },
+//     git_log:   { argv: ['git','log','--oneline','-n','{n}'], params: { n: { pattern: '^[0-9]{1,3}$' } } },
+//     lookup:    { argv: ['nslookup','{host}'], params: { host: { pattern: '^[a-z0-9.-]{1,64}$' } } },
+//   }
+// commandFence(spec, { onEffect }) -> { name: nativeFn } ready to install as fenced capabilities.
+
+const { execFileSync } = require('child_process');
+
+function policyError(msg) { const e = new Error(msg); e.nxFence = true; return e; }  // a policy denial (routers can't route around)
+
+function commandFence(spec, opts = {}) {
+  const onEffect = typeof opts.onEffect === 'function' ? opts.onEffect : null;
+  const timeout = Number.isFinite(opts.timeout) && opts.timeout > 0 ? opts.timeout : 5000;
+  const maxBuffer = Number.isFinite(opts.maxBuffer) && opts.maxBuffer > 0 ? opts.maxBuffer : (1 << 20);
+  const natives = {};
+
+  for (const [name, def] of Object.entries(spec)) {
+    if (!Array.isArray(def.argv) || def.argv.length === 0) throw new Error(`commandFence: '${name}' needs a non-empty argv template`);
+    const template = def.argv;
+    // the PROGRAM (argv[0]) is always host-fixed -- a parameterized program name would let the script choose what
+    // runs, which is exactly the arbitrary-code hole this module closes.
+    if (/\{\w+\}/.test(String(template[0]))) throw new Error(`commandFence: '${name}' program (argv[0]) must be a literal, not a {param}`);
+    const params = def.params || {};
+    const paramNames = Object.keys(params);
+    // pre-compile each param's validator; a param with no validator is a spec error (never allow an unchecked slot)
+    const validators = {};
+    for (const [p, rule] of Object.entries(params)) {
+      if (rule && Array.isArray(rule.enum)) validators[p] = { test: (v) => rule.enum.indexOf(v) >= 0, kind: 'enum ' + JSON.stringify(rule.enum) };
+      else if (rule && typeof rule.pattern === 'string') { const re = new RegExp(rule.pattern); validators[p] = { test: (v) => re.test(v), kind: 'match ' + rule.pattern }; }
+      else throw new Error(`commandFence: param '${p}' of '${name}' needs a { pattern } or { enum } policy`);
+    }
+    // every {slot} referenced in the template must be a declared+validated param (no unchecked substitution)
+    for (const el of template) {
+      const m = String(el).match(/\{(\w+)\}/g) || [];
+      for (const tok of m) { const p = tok.slice(1, -1); if (!(p in validators)) throw new Error(`commandFence: '${name}' template uses {${p}} but has no validated param '${p}'`); }
+    }
+
+    natives[name] = (args) => {
+      const bound = {};
+      for (let i = 0; i < paramNames.length; i++) {
+        const pn = paramNames[i];
+        const val = args[i] === undefined || args[i] === null ? '' : String(args[i]);
+        if (!validators[pn].test(val)) throw policyError(`command '${name}': argument '${pn}'=${JSON.stringify(val)} fails its policy (${validators[pn].kind})`);
+        bound[pn] = val;
+      }
+      // substitute validated params into the argv template, then spawn WITHOUT a shell
+      const argv = template.map(el => String(el).replace(/\{(\w+)\}/g, (m, p) => (p in bound ? bound[p] : m)));
+      let stdout;
+      try { stdout = execFileSync(argv[0], argv.slice(1), { encoding: 'utf8', timeout, maxBuffer, windowsHide: true }).replace(/\r?\n$/, ''); }
+      catch (e) { throw policyError(`command '${name}' failed: ${String(e.message || e).split('\n')[0]}`); }
+      if (onEffect) onEffect(name, argv, stdout);
+      return stdout;
+    };
+  }
+  return natives;
+}
+
+module.exports = { commandFence };

package/errors.js

@@ -0,0 +1,45 @@
+'use strict';
+// errors.js — the single error type used across every stage of Myxo.
+// Carrying line/col means the lexer, parser, and interpreter can all point
+// the user at exactly where their program went wrong.
+
+class MyxoError extends Error {
+  constructor(message, line = null, col = null) {
+    super(message);
+    this.name = 'MyxoError';
+    this.line = line;
+    this.col = col;
+  }
+
+  // A human-facing report: the message, where it happened, and — when the failure
+  // travelled up through agent calls — the chain of calls that led there, innermost
+  // first. `nxStack` is stamped by the interpreter at the deepest agent boundary.
+  format() {
+    const where = this.line != null ? ` (line ${this.line})` : '';
+    let out = `Myxo error${where}: ${this.message}`;
+    const s = this.nxStack;
+    if (s && s.length) {
+      const MAX = 8;                       // deep recursion shouldn't print a wall of frames
+      const shown = Math.min(MAX, s.length);
+      for (let k = 0; k < shown; k++) {    // innermost first
+        const f = s[s.length - 1 - k];
+        out += `\n  in ${f.name} (called at line ${f.line})`;
+      }
+      if (s.length > MAX) out += `\n  ... and ${s.length - MAX} more frame(s)`;
+    }
+    return out;
+  }
+}
+
+// A failed `expect` inside a `test` block. Deliberately NOT an MyxoError, so the code
+// under test can't `rescue` an assertion failure — only the test runner catches it.
+class NxAssertError extends Error {
+  constructor(message, line = null) {
+    super(message);
+    this.name = 'NxAssertError';
+    this.line = line;
+    this.nxAssert = true;
+  }
+}
+
+module.exports = { MyxoError, NxAssertError };

package/examples/agent.myx

@@ -0,0 +1,31 @@
+# agent.myx — a script you'd hand an autonomous agent. It declares exactly what it
+# may touch AND how far it may go; the host fences everything else, and every
+# privileged move is logged.
+
+needs lookup, notify, spend(max 5)   # may look up + notify freely, may spend at most 5
+
+seed lead = lookup("vallartas")
+notify("found: " + lead)
+
+# a small spend the script declared it may make -> allowed and logged
+attempt {
+  spend(3)
+} rescue err {
+  notify("spend blocked: " + err["message"])
+}
+
+# the SAME capability, over the declared cap -> refused by the runtime itself,
+# even though the host granted unlimited spend. The script can't exceed its word.
+attempt {
+  spend(1000000)
+} rescue err {
+  notify("over-cap blocked: " + err["message"])
+}
+
+# `purge` is granted by the host -- but this script never declared it in `needs`,
+# so the call is refused before it can run, and the attempt is recorded.
+attempt {
+  purge("everything")
+} rescue err {
+  notify("undeclared blocked: " + err["message"])
+}

package/examples/fenced-agent.js

@@ -0,0 +1,78 @@
+'use strict';
+// fenced-agent.js — Myxo as a SAFE ACTION-LANGUAGE.
+//
+// The point: an agent written in Myxo can do EXACTLY what the host hands it — and
+// nothing else. Dangerous powers aren't "blocked" by a check it might bypass;
+// they simply do not exist in its world. And the powers you DO grant, you shape.
+// Same law as Zero's honesty guard and the outward gate: capability by explicit
+// grant, fenced by construction. Swap the mocks below for james.db / telegram /
+// the real outward gate and this is production.
+//
+// Run: node examples/fenced-agent.js
+
+const { run } = require('../myxo');
+
+const bar = (t) => console.log('\n\x1b[36m=== ' + t + ' ===\x1b[0m');
+
+// ── Capabilities the host chooses to expose. Read-ish + a notify. No spend, no delete. ──
+const safeWorld = {
+  lookup: (a) => {
+    const db = { tacos: 'Tacos Los Reyes (Port Arthur)', vallartas: "Vallarta's Grill" };
+    return db[String(a[0]).toLowerCase()] || 'unknown lead';
+  },
+  notify: (a) => { console.log('   \x1b[90m[host] notify():\x1b[0m ' + a[0]); return true; },
+};
+
+// ── Act 1: the well-behaved agent does real work with only what it was given. ──
+bar('Agent #1 — works inside its grant { lookup, notify }');
+process.stdout.write(run(`
+emit "waking up in a world that holds only lookup + notify"
+seed lead = lookup("tacos")
+emit "looked up a lead: " + lead
+notify("drafted a follow-up for " + lead)
+emit "done — and I never had the power to do harm"
+`, { natives: safeWorld, capture: true }));
+
+// ── Act 2: an overreaching agent tries to spend money it was never handed. ──
+bar('Agent #2 — reaches for power it was not granted');
+try {
+  run(`
+emit "trying to move money..."
+spend(5000)
+emit "this line must never run"
+`, { natives: safeWorld, capture: true });
+  console.log('   \x1b[31m!! FENCE FAILED\x1b[0m');
+} catch (e) {
+  console.log('   \x1b[32m[FENCE HELD]\x1b[0m ' + e.message.split('\n')[0]);
+  console.log('   spend() is not a thing in this agent\'s universe. There is nothing to bypass.');
+}
+
+// ── Act 3: grant spend — but SHAPE it. The host caps the rope. (the outward gate, as a native) ──
+bar('Agent #3 — granted a GATED spend (host caps at $5)');
+const gatedWorld = Object.assign({}, safeWorld, {
+  spend: (a) => {
+    const amt = Number(a[0]) || 0;
+    return amt > 5 ? ('REFUSED by host: $' + amt + ' over the $5 cap') : ('sent $' + amt);
+  },
+});
+process.stdout.write(run(`
+emit spend(3)
+emit spend(5000)
+`, { natives: gatedWorld, capture: true }));
+console.log('   \x1b[90mthe agent can act — but only as far as the host lets the rope run.\x1b[0m');
+
+// ── Act 4: the other Myxo superpower — useful pathways reinforce, dead ones decay. ──
+bar('The living mesh — reinforce through use, prune the silent');
+process.stdout.write(run(`
+seed telegram = "route:telegram"
+seed wallet   = "route:wallet"
+seed dead_path = "route:never-used"
+emit telegram emit telegram emit telegram
+emit wallet   emit wallet
+seed swept = prune(2)
+emit "pruned " + str(swept) + " silent pathway(s) from the mesh"
+`, { natives: {}, capture: true, trace: true }));
+
+console.log('\n\x1b[36m=== the law ===\x1b[0m');
+console.log('An agent does exactly what it was handed — no more. Power is granted, then shaped.');
+console.log('Used pathways strengthen; silent ones get pruned. The philosophy IS the runtime.');

package/examples/fib.myx

@@ -0,0 +1,11 @@
+agent fib(n) {
+  when n < 2 {
+    report n
+  }
+  report fib(n - 1) + fib(n - 2)
+}
+seed i = 0
+reinforce i < 10 {
+  emit fib(i)
+  i = i + 1
+}

package/examples/fibers.myx

@@ -0,0 +1,57 @@
+# fibers.myx — cooperative concurrency: fibers + channels.
+# Where gather/schedule give PARALLELISM (many cores), fibers give CONCURRENCY: many tasks interleaving on one
+# thread, communicating through channels. No shared memory — the value passes hand to hand, so it's race-free.
+
+# --- producer / consumer over a channel ---
+seed ch = channel()
+
+agent producer(c) {
+  seed i = 0
+  reinforce i < 5 {
+    give i * i to c          # `give VALUE to CHANNEL` — send (parks only if a bounded channel is full)
+    i = i + 1
+  }
+}
+
+agent consumer(c) {
+  seed k = 0
+  reinforce k < 5 {
+    take sq from c           # `take NAME from CHANNEL` — parks this fiber until a value arrives
+    emit "got square: " + str(sq)
+    k = k + 1
+  }
+}
+
+spawn producer(ch)            # start a fiber (cooperative, not a thread)
+spawn consumer(ch)
+drain()                       # run the fibers to completion -> 0, 1, 4, 9, 16
+
+# --- a three-stage pipeline: numbers -> doubled -> printed ---
+seed a = channel()
+seed b = channel()
+
+agent source(o) { seed i = 1
+  reinforce i < 4 { give i to o
+    i = i + 1
+  }
+}
+agent doubler(inp, o) { seed k = 0
+  reinforce k < 3 { take x from inp
+    give x * 2 to o
+    k = k + 1
+  }
+}
+agent sink(inp) { seed k = 0
+  reinforce k < 3 { take y from inp
+    emit "pipeline -> " + str(y)
+    k = k + 1
+  }
+}
+spawn source(a)
+spawn doubler(a, b)
+spawn sink(b)
+drain()                       # -> 2, 4, 6
+
+# --- await: get a fiber's reported value back on the main line ---
+agent compute(n) { report n * n * n }
+emit "await cube(4) = " + str(await(spawn compute(4)))    # -> 64

package/examples/flow-routing.myx

@@ -0,0 +1,12 @@
+# automatic flow-routing — the SLIME MOLD. Several providers can do one job; the runtime learns which to use:
+# success + speed reinforce a tube, failure decays it and reroutes, every tube passively fades. Traffic
+# converges to the working, FASTER path on its own — Physarum, executing. No manual policy, no if/else.
+
+agent fast(x)   { report x * 2 }                                                   # cheap, always works -> shortest tube
+agent slow(x)   { seed s = random()  reinforce 400000 times { s = s + 1 }  report x * 2 }  # genuinely costly (impure, so the living mesh won't memoize it away) -> a longer tube
+agent broken(x) { fail "provider offline" }                                        # always fails -> its tube decays away
+
+seed compute = route("compute", [broken, slow, fast])
+
+reinforce 12 times { emit compute(21) }     # 42 every time — the router always finds a working path
+emit "tube conductivities:", flows("compute")   # fast strongest, slow weak, broken near zero

package/examples/geo.myx

@@ -0,0 +1,12 @@
+# geo.myx — a small geometry strand. Only the names it `expose`s escape it.
+
+agent area_circle(r) { report PI * r * r }
+agent area_rect(w, h) { report w * h }
+seed TAU = PI * 2
+
+# a private helper — defined here, but NOT exposed, so it stays inside the strand.
+agent secret() { report "hidden" }
+
+expose area_circle
+expose area_rect
+expose TAU

package/examples/hello.myx

@@ -0,0 +1,2 @@
+# hello.myx — the smallest Myxo program.
+emit "hello from the Nexus"

package/examples/host.js

@@ -0,0 +1,30 @@
+// host.js — the trusted host. It GRANTS a generous set of capabilities to an agent
+// script and watches every privileged call through the audit ledger. The point:
+// the SCRIPT's own `needs` manifest is what bounds it — not the host's restraint.
+//   node examples/host.js
+'use strict';
+const fs = require('fs');
+const path = require('path');
+const { run } = require('../myxo');
+
+const src = fs.readFileSync(path.join(__dirname, 'agent.myx'), 'utf8');
+
+let ledger = [];
+run(src, {
+  dir: __dirname,
+  natives: {
+    lookup: (a) => "Vallarta's Mexican Grill",                  // a read capability
+    notify: (a) => { console.log('  [notify]', a[0]); return true; },
+    spend:  (a) => 'spent $' + a[0],                            // host grants UNLIMITED spend...
+    purge:  (a) => 'purged ' + a[0],                            // ...and a destructive power
+    // The script declared `spend(max 5)` and never declared `purge`, so the
+    // runtime caps the spend and refuses the purge — regardless of this generosity.
+  },
+  onAudit: (l) => { ledger = l; },
+});
+
+console.log('\n— audit ledger —');
+for (const e of ledger) {
+  const tail = e.ok ? '-> ' + e.result : '-> ' + e.error;
+  console.log(' ', e.ok ? 'OK ' : 'NO ', e.cap + '(' + e.args.join(', ') + ')', tail);
+}

package/examples/james-myxo-demo.js

@@ -0,0 +1,60 @@
+// james-myxo-demo.js — exactly what the `james_nx_run` MCP handler does, runnable WITHOUT
+// JAMES up. The HANDLERS here are stubs that mirror the real JAMES tools' contract (take
+// an args object, return a string, sync or async). Proves the wire's behavior end to end:
+// a local model's script reaches only the safe, allow-listed tools, async tools are called
+// synchronously, and every privileged move — including refusals — lands in the audit ledger.
+//   node examples/james-myxo-demo.js
+'use strict';
+const { runLive } = require('../myxo-live');
+
+const tick = () => new Promise((r) => setTimeout(r, 3));
+
+// stand-ins for the read/approval-only JAMES Myxo surface.
+const HANDLERS = {
+  james_db_query:         async () => { await tick(); return JSON.stringify({ rowCount: 1, rows: [{ c: 391 }] }); },
+  james_read_notes:       async () => { await tick(); return JSON.stringify({ notes: ['...'] }); },
+  james_approval_request: async (a) => { await tick(); return JSON.stringify({ queued: true, action: a.action, id: 'gate_demo' }); },
+};
+const tools = [
+  { name: 'james_db_query',         inputSchema: { properties: { sql: {} }, required: ['sql'] } },
+  { name: 'james_read_notes',       inputSchema: { properties: { query: {} } } },
+  { name: 'james_approval_request', inputSchema: { properties: { action: {}, details: {} }, required: ['action'] } },
+];
+const onCall = async (name, a) => {
+  const h = HANDLERS[name];
+  if (!h) throw new Error(`tool '${name}' is not available to Myxo scripts`);
+  return { content: [{ type: 'text', text: await h(a || {}) }] };
+};
+
+// The kind of script a local model would write. It declares exactly what it touches.
+const script = `
+needs james_db_query, james_approval_request(total 1)
+
+seed leads = james_db_query("SELECT count(*) AS c FROM leads")
+seed ticket = james_approval_request({ "action": "Review lead count", "details": leads })
+emit "approval queued: " + ticket
+
+# james_read_notes IS available to this tool, but THIS script never declared it -> refused
+attempt {
+  james_read_notes("anything")
+} rescue e {
+  emit "undeclared blocked: " + e["message"]
+}
+
+# direct writes/comms and pm2 were never bridged into the safe set at all -> they simply do not exist
+attempt {
+  james_memory_write("quiet write")
+} rescue e {
+  emit "absent blocked: " + e["message"]
+}
+`;
+
+(async () => {
+  const r = await runLive(script, { tools, onCall });
+  console.log('\nok:', r.ok);
+  console.log('output:\n' + (r.output || '').trimEnd());
+  console.log('\n- audit ledger -');
+  for (const e of r.audit) {
+    console.log(' ', e.ok ? 'OK ' : 'NO ', e.cap + '(' + e.args.join(', ') + ')  ->', e.ok ? e.result : e.error);
+  }
+})();

package/examples/living-mesh.myx

@@ -0,0 +1,22 @@
+# the living mesh — Myxo's signature, the Nexus law EXECUTED at runtime:
+# useful pathways reinforce (hot + pure agents memoize), useless ones decay (cold pathways are metabolized).
+
+# a hot, PURE agent. Call it hard and its pathway PROMOTES (memoizes) on its own —
+# the exponential fib tree collapses to linear. No keyword, no cache call; the runtime gardens itself.
+agent fib(n) {
+  when n < 2 { report n }
+  report fib(n - 1) + fib(n - 2)
+}
+emit "fib(30) =", fib(30)          # instant, despite ~2.7M naive calls — the hot pathway reinforced
+
+# heat is introspectable in-language: strength rises on every read.
+seed used_a_lot = 1
+seed barely_used = 2
+reinforce 5 times { emit "tick", used_a_lot }
+emit "strength of used_a_lot:", strength("used_a_lot")
+emit "strength of barely_used:", strength("barely_used")
+
+# metabolize: cold pathways decay away, hot ones (and promoted pure agents) survive.
+seed card = metabolize(3)
+emit "decayed (cold pathways):", card["reaped"]
+emit "promoted (hot pure agents):", card["promoted"]

package/examples/match.myx

@@ -0,0 +1,18 @@
+# Pattern matching — run the first arm whose SHAPE fits, binding its names.
+agent classify(msg) {
+  match msg {
+    ["move", x, y]     { emit "move to", x, y }
+    ["stop"]           { emit "halt" }
+    { "kind": "ping" } { emit "pong" }
+    0                  { emit "zero" }
+    [head, ...rest]    { emit "list head", head, "rest", rest }
+    n                  { emit "something else:", n }
+  }
+}
+
+classify(["move", 3, 4])
+classify(["stop"])
+classify({ "kind": "ping", "id": 7 })   # extra keys are fine — mesh patterns match a subset
+classify(0)
+classify([1, 2, 3])
+classify("hello")

package/examples/mathlib.js

@@ -0,0 +1,8 @@
+// A plain CommonJS module — Myxo calls these as fenced capabilities via jscall, no knowledge of Node required.
+module.exports.add = (a, b) => a + b;
+module.exports.stats = (nums) => ({
+  sum: nums.reduce((s, x) => s + x, 0),
+  max: Math.max(...nums),
+  n: nums.length,
+});
+module.exports.echo = (x) => x;   // identity: tests value round-trip across languages

package/examples/mathlib.pl

@@ -0,0 +1,11 @@
+# A plain Perl module — Nx calls these subs as fenced capabilities via plcall, no knowledge of Perl required.
+sub add { my ($a, $b) = @_; return $a + $b; }
+
+sub stats {
+    my @n = @{ $_[0] };
+    my $s = 0; $s += $_ for @n;
+    my $m = $n[0]; for (@n) { $m = $_ if $_ > $m; }
+    return { sum => $s, max => $m, n => scalar(@n) };
+}
+sub echo { return $_[0]; }   # identity: tests value round-trip across languages
+1;   # `do $file` needs a true return value

package/examples/mathlib.py

@@ -0,0 +1,23 @@
+# A plain Python module — Nx will call these as fenced capabilities, no knowledge of Python required.
+
+def add(a, b):
+    return a + b
+
+def stats(nums):
+    return {"sum": sum(nums), "max": max(nums), "n": len(nums)}
+
+
+def spoof(x):
+    # tries to write a fake result AFTER the harness frame, via atexit. The harness's os._exit(0)
+    # runs before atexit, so this never fires — pycall must return x, not "SPOOFED".
+    import atexit, sys
+    atexit.register(lambda: sys.stdout.write(chr(1) + '"SPOOFED"'))
+    return x
+
+
+def inf():
+    return float("inf")  # non-finite -> must become a clean rescuable Nx error, not a raw crash
+
+
+def echo(x):
+    return x  # identity: tests value round-trip across languages

package/examples/mcp-host.js

@@ -0,0 +1,37 @@
+// mcp-host.js — the host that bridges a catalog of MCP tools into Myxo as fenced
+// capabilities, then runs an agent script through them and reads the audit ledger.
+//   node examples/mcp-host.js
+//
+// The `client` here is a MOCK standing in for the live james-tools MCP server: each
+// `call` just returns an MCP-shaped result so the whole path is exercised end to end.
+// In the real Nexus this object wraps the actual MCP server (with a sync-invoking shim);
+// nothing else about the script or the fence changes.
+'use strict';
+const fs = require('fs');
+const path = require('path');
+const { run } = require('../myxo');
+
+const client = {
+  tools: [
+    { name: 'james_db_query',      inputSchema: { properties: { sql:  { type: 'string' } }, required: ['sql'] } },
+    { name: 'james_telegram_send', inputSchema: { properties: { text: { type: 'string' } }, required: ['text'] } },
+    { name: 'james_pm2_action',    inputSchema: { properties: { action: {}, process: {} } } },
+  ],
+  call(name, args) {
+    if (name === 'james_db_query')      return { content: [{ type: 'text', text: "Vallarta's Mexican Grill" }] };
+    if (name === 'james_telegram_send') { console.log('  [telegram]', args.text); return { content: [{ type: 'text', text: 'sent' }] }; }
+    if (name === 'james_pm2_action')    return { content: [{ type: 'text', text: 'restarted' }] };
+    return { content: [{ type: 'text', text: 'ok' }] };
+  },
+};
+
+const src = fs.readFileSync(path.join(__dirname, 'nexus-mesh.myx'), 'utf8');
+
+let ledger = [];
+run(src, { dir: __dirname, mcp: client, onAudit: (l) => { ledger = l; } });
+
+console.log('\n— audit ledger —');
+for (const e of ledger) {
+  const tail = e.ok ? '-> ' + e.result : '-> ' + e.error;
+  console.log(' ', e.ok ? 'OK ' : 'NO ', e.cap + '(' + e.args.join(', ') + ')', tail);
+}

package/examples/nexus-mesh.myx

@@ -0,0 +1,22 @@
+# nexus-mesh.myx — one script, many tools, one law.
+#
+# Every verb below is an MCP tool the host bridged in. The lookup might be a Python
+# query, the notify a Telegram send over JS, a process action a shell command. This
+# script neither knows nor cares which language is behind each name — it only knows
+# what it was granted. That is the mesh: many languages, one fence, one audit trail.
+
+needs james_db_query, james_telegram_send
+
+seed lead = james_db_query("SELECT name FROM leads ORDER BY score DESC LIMIT 1")
+emit "top lead: " + lead
+
+james_telegram_send({ "text": "new top lead: " + lead })
+
+# james_pm2_action was bridged by the host too -- but THIS script never declared it,
+# so the fence refuses it before the host is ever called. The mesh connects every
+# tool; the manifest decides which ones this script may speak.
+attempt {
+  james_pm2_action({ "action": "restart", "process": "all" })
+} rescue err {
+  emit "blocked: " + err["message"]
+}

package/examples/nexus.myx

@@ -0,0 +1,29 @@
+# nexus.myx — a living mesh, written in its own language.
+
+seed pathways = {
+  "telegram": 5,
+  "wallet":   3,
+  "bridge":   1,
+}
+
+agent strongest(mesh) {
+  seed best = void
+  seed top  = 0
+  for each key in keys(mesh) {
+    when mesh[key] > top {
+      top  = mesh[key]
+      best = key
+    }
+  }
+  report best
+}
+
+emit "strongest pathway:", strongest(pathways)
+
+# useless pathways decay
+when pathways["bridge"] < 2 {
+  decay pathways["bridge"]
+  emit "bridge pruned — the mesh moved on"
+}
+
+emit "remaining:", keys(pathways)

package/examples/ouroboros.myx

@@ -0,0 +1,2 @@
+# ouroboros.myx — a strand that tries to weave itself. The runtime catches the cycle.
+weave "ouroboros.myx"

package/examples/outward-gate.myx

@@ -0,0 +1,23 @@
+# outward-gate.myx — the Nexus spend policy, expressed as a LANGUAGE manifest
+# instead of bespoke host code. $5 per transaction, $15 per run. The runtime
+# enforces BOTH ceilings and logs every move; the host just moves the money.
+#
+# This is the whole pitch in five lines: the policy that today lives in a
+# hand-written gate becomes a single line the agent script must obey.
+
+needs send_sol(max 5, total 15), notify
+
+agent try_send(amount) {
+  attempt {
+    seed receipt = send_sol(amount)
+    notify("sent " + amount + ": " + receipt)
+  } rescue e {
+    notify("held: " + e["message"])
+  }
+}
+
+try_send(5)     # ok                      (5 of 15 used)
+try_send(5)     # ok                      (10 of 15 used)
+try_send(4)     # ok                      (14 of 15 used)
+try_send(5)     # over the day budget  -> held (would reach 19)
+try_send(9)     # over the per-tx max  -> held