> For the complete documentation index, see [llms.txt](https://dsg-3.gitbook.io/dsg-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dsg-3.gitbook.io/dsg-docs/cinema-proof-agent/runtime-and-integrations/universal-runtime.md).

# Universal Runtime

Plan-bound filesystem, Python, and shell execution through the isolated Universal Runtime boundary.

Universal Runtime handles approved work that is better executed outside browser UI automation.

## Current Agent tools

* `universal_runtime_status`
* `universal_execute_step`
* `universal_evidence_verify`

## Exact-step rule

`universal_execute_step` executes only the step stored in an **already-approved Cinema plan**. The Agent supplies the approved `plan_id + step_id`; it does not replace the approved command, code, path, or file content at execution time.

Supported action families include:

* `fs.list`
* `fs.read`
* `fs.write`
* `python.run`
* `shell.exec`

Browser work remains on the Shared Browser path through `remote_action`.

## E2E contract

```
Agent creates plan
      ↓
execute before approval → BLOCK
      ↓
USER approves exact plan hash
      ↓
fs.write
      ↓
python.run
      ↓
shell.exec
      ↓
universal evidence verification
```

## Production boundary

The in-process local executor is fail-closed by default and is intended only for isolated test/sandbox use when explicitly enabled.

Production is designed to use an isolated executor configured by server-side executor URL and secret settings. Tool presence does not imply arbitrary shell permission; every executable step remains plan-bound and evidence-bearing.