# `Opsmaru.Incus.Operations`
[🔗](https://github.com/upmaru/opsmaru-incus/blob/v0.1.0/lib/opsmaru/incus/operations.ex#L1)

Shared, protocol-neutral Incus operations for agents and direct callers.

Each operation is an `Opsmaru.Incus.Operations.Descriptor` with a canonical
`incus_<resource>_<verb>` name, input/output JSON schemas, a required scope,
a destructive-confirmation rule and bounds. `all/0` lists the exported
operations; one whose client methods lack recorded evidence is never
exported and appears in `unavailable/0` instead.

`run/3` executes one operation synchronously in the caller's process:

1. the host-verified `:scopes` must include the operation's scope;
2. input must match the input schema and byte bounds;
3. destructive operations require `confirm` to repeat the affected resource;
4. restricted create/update input needs the host's `allow_restricted?/3`;
5. the host's `binding/2` and `authorize/3` must succeed.

Only then does the operation contact the backend, through the public
`Opsmaru.Incus` client. A denial at any step makes no backend request.
Nothing here starts a process, opens a connection or stores state; see
`Opsmaru.Incus.Operations.Host` for the host contract.

# `all`

Exported descriptors in canonical name order.

# `describe`

Public contract of a descriptor as JSON-safe data: name, title, description,
scope, destructive flag, confirmation rule, bounds, schemas and evidence.

# `fetch`

Fetch an exported descriptor by canonical name.

# `output_schema`

The full output schema: the success result or an `error` object.

# `run`

Run an exported operation. Options (all host-supplied, never tool input):

  * `:host` - module implementing `Opsmaru.Incus.Operations.Host`;
  * `:caller` - the host's authenticated caller term;
  * `:scopes` - the caller's verified scopes.

Returns `{:ok, result}` or `{:error, %{"kind" => ..., "message" => ...}}`.

# `scopes`

The four scopes operations require.

# `unavailable`

Operations not exported: deferred by scope, or missing client evidence (with the missing requirements).

---

*Consult [api-reference.md](api-reference.md) for complete listing*