Register a bounded worker

What you will build

A capability-bounded worker. Capabilities are explicit and additive; the authority ceiling caps what the worker may propose or execute, and the kernel enforces it regardless of client config.

Architecture preview

Prefer propose-only over effect-capable where a human should decide. Frontend configuration cannot raise the ceiling above tenant policy.

Prerequisites

• A test tenant
• A blueprint to bind the worker to

Steps

1. Register the worker

   Create a worker with a capability profile. Grant the minimum it needs.

   curl --request POST \
     --url "$CRESCEVO_BASE_URL/v1/workers" \
     --header "Authorization: Bearer $CRESCEVO_API_KEY" \
     --header "Content-Type: application/json" \
     --data '{ "name": "brief-drafter", "capabilities": ["artifact.read", "artifact.propose_revision"], "authority_ceiling": "propose-only" }'

   { "worker_id": "w_1", "authority_ceiling": "propose-only" }

2. Bind it to a blueprint

   Bind the worker to the blueprint version whose sessions it will act in.

   curl --request POST \
     --url "$CRESCEVO_BASE_URL/v1/workers/w_1/bindings" \
     --header "Authorization: Bearer $CRESCEVO_API_KEY" \
     --header "Content-Type: application/json" \
     --data '{ "blueprint": { "id": "governed-artifact", "version": "0.8.0" } }'

3. Verify the ceiling

   Confirm the worker cannot execute an effect: a propose-only worker attempting to commit is denied.

   curl --url "$CRESCEVO_BASE_URL/v1/workers/w_1" \
     --header "Authorization: Bearer $CRESCEVO_API_KEY"

   { "worker_id": "w_1", "can_propose": true, "can_execute": false }

Verify success

• The worker exists with the capabilities you granted.
• It is bound to the blueprint version.
• Its authority ceiling prevents executing effects.

Clean up

Test-tenant workers expire automatically; delete the worker to reset sooner.

Next: Build and validate a blueprint →