# RS2 (Restspace 2)

> A Rust backend runtime where every service is a sandboxed function on an HTTP
> message. Prebuilt stores, auth, queries, pipelines, and custom sandboxed code
> all share one message → message contract, so anything composes with anything.
> The sandbox adds p99 < 10 µs per dispatch, so untrusted code is the default:
> agents can author and assemble entire backends without a human auditing the
> code first. Pre-1.0.

## Discovery (start here)

- /.well-known/rs2/services: every mount the caller may read, with its pattern
  (store | store-view | transform | api) and facets
- /.well-known/rs2/agent-surface: entities, actions (with effect class and
  Idempotency-Key guidance), and stored queries with parameter schemas;
  MCP-aware via ?surface=mcp
- /.well-known/rs2/openapi: OpenAPI 3.1 for the tenant; the advertised schema
  is the enforced schema, no drift by construction

The catalogue is permission-filtered per caller: an empty surface usually means
an unauthenticated request, not an empty tenant.

## Key properties

- A whole application is one declarative JSON config per tenant, hot-swapped
  atomically after a dry build; invalid config never reaches the running tenant
- Custom services (JS bundles or Wasm components) run under capability
  default-deny with host-allowlisted outbound HTTP; credentials are injected
  host-side, so an agent can use an API key it can never read
- Measured containment: a hostile tenant running an infinite loop moves its
  neighbor's p99 from 14.0 µs to 20.8 µs (1.5×); all hostile requests get
  structured 503 + Retry-After
- Errors are RFC 9457 problem+json with machine-readable codes; honor
  retryable / retryAfterMs
- Exactly-once writes via Idempotency-Key on POST/PUT

## Nearby tools

Cloudflare Workers, Spin, Camel, n8n. What's different here: one contract,
agent-consumability, and an embeddable Rust crate (rs2-core).