# Machine10 Run Now contract v1

Contract: public v1.

Run Now executes one bounded x86-64 guest for one supplied request. It returns
the result synchronously and retains no Machine memory or lifecycle afterward.

## Route and authority

```text
POST https://jmpkit.com/api/apps/<appId>/machine10/run
```

Send `Authorization: Bearer <identity bearer>`. A delegated app manager also
sends `X-JmpKit-Grant: <approved grant id>`. JSON uses
`Content-Type: application/json`.

## Request

```json
{
  "machineId": "one-off-example",
  "programBase64": "<canonical base64>",
  "request": {
    "method": "POST",
    "path": "/tasks/example",
    "query": "mode=demo",
    "bodyBase64": "eyJtZXNzYWdlIjoiaGVsbG8ifQ=="
  },
  "permissions": ["q:append", "q:read"],
  "maxCalls": 2
}
```

`machineId` is optional and labels this invocation. The program is at most
256 KiB decoded. Request paths and queries are bounded app-relative strings;
the request body is canonical base64 and at most 32 KiB decoded. `permissions`
must be a nonempty subset of the current capability contract. `maxCalls` is
1–16 and should equal the maximum calls the guest actually needs.

Gateway chooses the app, requester, billing identity, worker, job authority,
and execution reference. Caller-supplied values cannot replace them.

## Result

A successful response is `200` JSON and includes:

- `profile: "machine10-kvm-mainboard-v1"`;
- the authoritative `appId` and selected `machineId`;
- `status: "completed"`;
- the normalized request visible to the guest;
- the guest result;
- bounded mainboard call receipts; and
- measured execution receipt fields.

Secrets, private callback references, and worker authority are never returned.
Consume the documented result fields. Treat unlisted diagnostic fields as
non-contractual.

## When to use it

Use Run Now for an immediate transformation, validation, decision, or bounded
resource workflow. Use Main Machine when memory, serialized future events,
timers, program lifecycle, or Origin fallback must survive the request.