# Machine10 motherboard capabilities v1

Machine programs have no ambient network. Gateway accepts only the routes and
methods below, checks the installed permission, reconstructs app and billing
context, removes guest authority headers, and performs the bounded call.

## Q

| Guest request | Permission | Result |
|---|---|---|
| `POST /api/q10/n/<name>` | `q:append` | Append one raw body |
| `GET /api/q10/n/<name>?since=<n>&limit=<1-100>` | `q:read` | Read items |
| `GET /api/q10/n/<name>/status` | `q:read` | Read head/tail/next metadata |
| `DELETE /api/q10/n/<name>?through=<n>` | `q:prune` | Delete committed prefix |

Queue names use 1–128 letters, digits, `.`, `_`, or `-`, beginning with a
letter or digit. Q is automatically scoped to the Machine's app. `q:prune` is
owner-only and removes sequence numbers through the exact supplied value. Q
SSE and raw global capability codes are not available through this synchronous
bridge.

## Path

| Guest request | Permission | Result |
|---|---|---|
| `GET /api/p10[/path]` | `path:read` | Read one value |
| `GET /api/p10[/path]?list=children|tree&limit=<1-100>&cursor=<cursor>` | `path:read` | List a subtree |
| `PUT /api/p10[/path]` | `path:write` | Store request body |
| `DELETE /api/p10[/path]` | `path:write` | Delete one value |
| `DELETE /api/p10[/path]?recursive=true` | `path:owner` | Delete a subtree |

The underlying Path API supports `Content-Type`, `If-Match`, and
`If-None-Match`. The current raw guest ABI does not yet carry request headers,
so guest programs should use ordinary unconditioned writes unless a later ABI
adds header fields. Responses can return content type, ETag, Path version, and
created/updated timestamps in controller receipts; the guest receives the
bounded response body and status.

`path:owner` and recursive deletion require direct app-owner installation.

## Failure behavior

An unrecognized route or method is denied before an upstream call. A missing
permission is `permission_denied`. Invalid selectors or bounds are rejected.
The guest sees a Machine error or non-success HTTP status and should fail the
turn unless its program deliberately handles that condition.

Calls are idempotently replayed inside one leased turn using request ID and
request fingerprint. Changing a retried call while reusing its request ID is
rejected.