Core operators

Written in Rust and built into ogund, because they are small, called often and relevant to safety.

Operator	Outputs	What it does
`acquire`	`artifacts`	Resumable, segmented download on the embedded Zeus engine; plan vocabulary shared with Zeus
`zeus.session_acquire`	`artifacts`	A source behind your browser login, acquired by zeusd through the session bridge (tested against a fake zeusd)
`crawl`	`urls, documents`	Pagination, link extraction and selectors from a closed, validated set; honours robots.txt and stays on one origin
`file.copy`	`artifacts`	Safe materialization into workspace paths
`file.move`	`artifacts`	Safe materialization into workspace paths
`archive.extract`	`artifacts`	Zip, tar, tar.gz and gzip, with path containment and size limits
`hash`	`artifacts`	BLAKE3 and SHA-256 digests of artifacts
`dedupe`	`artifacts, duplicates`	Exact or keyed deduplication
`manifest`	`manifest`	A provenance manifest of its inputs
`partition`	`artifacts`	Fan-out over partitions
`filter`	`artifacts, rejected`	Predicate filter with a rejected output
`map`	`artifacts`	Per-artifact mapping
`join_metadata`	`artifacts`	Metadata joins
`window.rollup`	`artifacts`	Rolls sealed stream windows up, for example minutes into hours

Adapters for external tools

Child processes with declared inputs and outputs; versions are pinned and recorded in the lineage. The tools themselves (DuckDB, pdftotext, Tesseract and so on) must be installed where ogund runs: the release does not bundle them.

Operator	Outputs	What it does
`duckdb`	`tables, artifacts`	SQL over Parquet, CSV and JSON; writes tables or Parquet
`pdf.extract`	`text, tables`	Text and tables from PDFs, through pdftotext
`ffmpeg`	`artifacts`	Media conversion
`pandoc`	`artifacts`	Document conversion
`tesseract`	`text`	OCR for scanned documents
`paddleocr`	`text`	OCR for scanned documents
`yt_dlp`	`artifacts`	Acquisition from media sites, through yt-dlp
`rclone`	`artifacts`	Acquisition from cloud storage, through rclone
`git`	`artifacts`	Acquisition from repositories
`hf`	`artifacts`	Acquisition from Hugging Face

Code operators

Your code or script, referenced by BLAKE3 hash. A new or changed hash is a plan diff that needs a person. They run in a bubblewrap sandbox on Linux; Windows has none yet, so they are refused there unless allow_unsandboxed is set.

Operator	Outputs	What it does
`python`	`artifacts, rows`	Your code, pinned by BLAKE3 hash, run in a sandboxed process; needs a person’s approval when it is new or changed
`polars`	`tables`	Dataframe code, pinned and approved like python
`sql`	`tables`	A SQL script, pinned and approved like python
`dbt`	`artifacts, results`	A dbt Core project as a node, with run results as artifacts
`shell`	`artifacts`	Last resort; always needs approval

Stream sources

Sensor readings sealed into event-time windows, which are partitions (ADR 0007). Fed by the ingest bridge, unit-tested and not yet run against real brokers or devices.

Operator	Outputs	What it does
`stream.mqtt`	`window`	Sensor readings from an MQTT broker, sealed into event-time windows
`stream.http`	`window`	Sensor readings pushed over HTTP
`stream.lorawan`	`window`	Uplinks from ChirpStack or The Things Stack
`stream.modbus`	`window`	Registers from Modbus TCP or RTU-over-TCP devices
`stream.file_tail`	`window`	Lines appended to a file

LLM operators

Bound to schemas and label sets, metered by a spend ledger, gated by budgets and approvals. A workflow without them never touches a model.

Operator	Outputs	What it does
`llm.extract`	`rows`	Structured extraction into a JSON Schema
`llm.classify`	`labels`	Labels from a closed label set
`llm.map`	`artifacts`	Per-item transforms with natural-language rules
`llm.filter`	`artifacts, rejected`	Per-item filters with natural-language rules
`llm.rename`	`artifacts`	Names from content
`llm.schema`	`schema`	Infer a schema from samples, for a human to approve
`llm.enrich`	`rows`	Metadata from content
`embedding.generate`	`vectors`	Vectors for search and deduplication

The operator ABI

Specified in O-03. Every operator ships a manifest; Ogun refuses anything the manifest does not declare.

{
  "name": "tesseract",
  "version": "1.0.0",
  "kind": "adapter",
  "inputs": [
    {
      "name": "inputs"
    }
  ],
  "outputs": [
    {
      "name": "text",
      "media_type": "text/plain"
    }
  ],
  "determinism": "pure",
  "sandbox": {
    "network": "none",
    "fs": [
      "inputs:ro",
      "scratch:rw"
    ],
    "memory_bytes": 4294967296,
    "cpu_ms": 14400000
  },
  "invocation": {
    "protocol": "jsonl-stdio/0",
    "command": [
      "ogun-op-shim",
      "tesseract"
    ]
  },
  "config_schema": {
    "type": "object",
    "properties": {
      "lang": {
        "type": "string",
        "pattern": "^[A-Za-z_]+(\\+[A-Za-z_]+)*$",
        "maxLength": 128
      },
      "psm": {
        "type": "integer",
        "minimum": 0,
        "maximum": 13
      },
      "dpi": {
        "type": "integer",
        "minimum": 72,
        "maximum": 1200
      }
    },
    "additionalProperties": false
  },
  "tools": [
    {
      "any_of": [
        "tesseract"
      ],
      "optional": false
    },
    {
      "any_of": [
        "pdftoppm"
      ],
      "optional": true
    }
  ]
}

The tesseract manifest as compiled into ogund 0.0.1-alpha (crates/ogun-ops/src/builtin.rs). A manifest installed as tesseract.manifest.json replaces it, but may not change its kind or drop an output.

Invocation: JSON lines over stdio (jsonl-stdio/0); WASI components are being evaluated
Determinism class: pure, seeded or non-deterministic, recorded with the operator
Sandbox profile: network, filesystem, CPU and memory, enforced where a sandbox exists. A manifest that asks for a network allowlist is refused, not run with more network than it declares
Errors map onto typed codes (op.integrity, op.sandbox_violation and so on), so retries and approvals behave predictably
The manifest’s BLAKE3 is recorded in the lineage of every artifact the operator produces
Shell exists as a last resort and always needs approval

Read the design

The decisions and first-draft specifications are public, and the runtime is being tested. Feedback is most useful now, before the contracts are frozen.

Read the architecture See the roadmap