Module policy 

The exposure policy: which surfaces carry a command, derived from what the command is.

Nothing here reads a per-command configuration, because there is none. A surface is not a property a declaration sets; it is a consequence of the effect, the interactivity and the origin — and those are already on the node. The whole policy is the two functions below, so the question “why is this not an MCP tool?” has one answer in one place, and commands explain can quote it.

The rules, in one table:

effect / interactivity	command line	workflow bridge	MCP · HTTP	Cockpit
read-only, non-interactive	yes	yes	yes, when a capability backs it	yes
local mutation	yes	yes	yes, when a capability backs it	yes, confirmed
repository / network mutation	yes	yes	no	no
destructive	yes	yes	no	no
interactive	yes	yes	no	no
long-running	yes	yes	no	no

The command line and the workflow runner carry everything: a person at a terminal is the caller both were built for, and withholding a command from the terminal that implements it would be theatre. Every machine surface stops at local mutation, and the two that execute — MCP and HTTP — additionally require a capability behind the command, because a surface that executes must have a typed input schema to execute from.

Constants

DOCS_PREFIX

Where the architecture of the command graph is documented; the page a command without one of its own points at.

MACHINE_CEILING

The strongest effect a machine surface will carry.

RESERVED_WORKFLOW_NAMES

Words the workflow runner cannot accept as a recipe name, or that would read as one of its own options.

Functions

declared_in

The provenance of a node whose declaration is one file.

docs_route

The route of a command’s page.

machine_verdict

Whether a machine surface may carry this command, and the reason when it may not.

offered_on

Whether a projection on this surface should offer the command at all.

project

Decide every projection of one node.

workflow_name

The workflow runner’s spelling of a command path: the words joined by -.