OPAL reference
Operator Permission and Access Layer
OPAL (Operator Permission and Access Layer) is the structured command interface every operator uses to drive Korall Engineering™ ā you, an automation rule, or a connected language model. This page is the per-domain catalogue of registered OPAL Tasks.
For the architectural overview (why OPAL exists, the three operator types, permissions, audit), see OPAL architecture.
Security Consideration
OPAL Tasks are validated against operator permissions before execution. An LLM can only perform tasks the user has explicitly granted scope for ā and those permissions can be revoked at any time. Every execution lands in the OPAL History database, so you can always see exactly what was done, by whom, against which Sentient and Node.
Task domains
Every subsystem registers its tasks into the central registry under a domain prefix. Click through for per-task parameter schemas, permissions, and examples.
| Domain | Prefix | What it controls |
|---|---|---|
| Catalog | catalog. |
Browse and capture widgets from the widget catalog |
| Navigation | navigation. |
List and open activities in the running app |
| Screenshot | screenshot. |
Grab the screen or a specific widget |
| Batch | batch. |
Manage long-running background jobs |
| Batch ā node | batch.node. |
Hand this machine to the fleet before a long run, and take it back |
| Batch ā fleet | batch.executors. |
See which machines can run a job, and why one will not place |
| Clockwork | clockwork. |
Store schedules that start batch jobs at their times |
| Filesystem | filesystem. |
Sandbox-restricted file operations |
| Directives | directive. |
Create and manage trigger directives |
| Constellation | constellation. |
Manage your node constellation |
| Help | help. |
Search, read, and open documentation |
| Attachment | attachment. |
Read a folder, an archive or a file you dropped into the chat |
| LLM | llm. |
Read and set the language models of the chat, and its permission mode |
| Web | web. |
Fetch one web page or file into an attachment |
| Serial | serial. |
Manage serial port connections |
| BanterLab | banter. |
Drive the BanterLab parameter / codec / testset workflow |
| Shade | shade. |
Run LLVM-compiled compute shaders |
| Sentient | sentient. / node. |
Create / delete / select Nodes; Sentient password and recovery |
| Config | config. |
Read and change the settings of every open app |
| Singularity | singularity. |
Choose the audio output, the output pair and the volume |
| Construct | construct. |
Edit a Construct scene |
Representative tasks of each domain:
- Catalog ā
catalog.list_widgets,catalog.list_by_tag,catalog.search,catalog.capture_widget,catalog.capture_all,catalog.preview_widget. - Navigation ā
navigation.list_activities,navigation.goto_activity. - Screenshot ā
screenshot.copy,screenshot.save. - Batch ā
batch.list,batch.status,batch.cancel,batch.jobs.query,batch.job.get,batch.job.cancel,batch.job.retry. - Batch ā node ā
batch.node.mode,batch.node.capacity. - Batch ā fleet ā
batch.executors.list,batch.executors.explain,batch.drift. - Clockwork ā
clockwork.list,clockwork.get,clockwork.history,clockwork.preview,clockwork.put,clockwork.pause,clockwork.resume,clockwork.run-now,clockwork.delete. - Filesystem ā
filesystem.copy,filesystem.chmod. - Directives ā
directive.new,directive.list,directive.pause,directive.resume,directive.delete. - Constellation ā
constellation.list,constellation.details,constellation.status,constellation.launch,constellation.stop,constellation.create,constellation.delete,constellation.add_member. - Help ā
help.search,help.list,help.outline,help.read,help.open,help.find. - Attachment ā
attachment.list,attachment.glob,attachment.grep,attachment.read. - LLM ā
llm.status,llm.usage,llm.provider.list,llm.provider.enable,llm.model.list,llm.model.setDefault,llm.credential.set,llm.permission.get,llm.permission.set. - Web ā
web.fetch. - Serial ā
serial.list_ports,serial.list_connections,serial.get_connection,serial.create_connection,serial.update_connection,serial.delete_connection,serial.open. - BanterLab ā
banter.param_list,banter.preset_list,banter.codec_list,banter.testset_describe,banter.testset_list_tests. - Shade ā
shade.run,shade.get_source. - Sentient ā
sentient.set_password,sentient.view_profile,sentient.security_unboxing,sentient.export_recovery,node.create,node.delete,node.list,node.select. - Config ā
config.list,config.get,config.set,config.reset,config.revert,config.export,config.import,config.undo,config.window.open. - Singularity ā
singularity.audio.list-outputs,singularity.audio.set-output,singularity.audio.set-output-pair,singularity.audio.play-test-tone. - Construct ā
construct.item_add,construct.item_remove,construct.item_rename,construct.item_duplicate,construct.item_set_transform,construct.item_set_rotation_mode,construct.item_set_parent,construct.item_set_material,construct.render.capabilities,construct.render.measure,construct.render.queue,construct.library.list,construct.library.rename,construct.library.tag,construct.library.trash,construct.library.restore,construct.library.trash_list,construct.library.health.
Rotation via OPAL is Euler-angle based and gizmo-independent.
construct.item_set_transformsets rotation withrx/ry/rz(degrees) written directly to the item's transform ā it does not go through the interactive rotation gizmo, so OPAL plans set orientation the same way regardless of gizmo behaviour.An SDF item stores its rotation in one of eight representations. By default
rx/ry/rzare degrees in the item's current mode. The optionalrotationModeargument (EulerZYX,EulerXYZ,EulerXZY,EulerYXZ,EulerYZX,EulerZXY,AxisAngle,Quaternion) sets the rotation in that mode; forAxisAngle,rx/ry/rzare the axis andangleis the degrees. Given alone,rotationModeconverts the item's current rotation without moving it, which is also whatconstruct.item_set_rotation_mode(itemId,mode) does.
A transform under an expression is set through the parameter task.
translate,rotateandscaleare parameters, so an expression covers a whole channel:construct.sdf.set_all_parameterswith{"rotate": "=vec3(0, anim.progress * 360, 0)"}. The scalars onconstruct.item_set_transformcarry literal numbers only. It refuses a channel an expression already owns, because the expression is re-evaluated every frame and would discard the write.
Detail pages
| Topic | Description |
|---|---|
| Commands | Per-task parameter schemas |
| Permissions | The permission scopes each domain requires |
| Errors | Error codes and recovery patterns |
| BanterLab | Driving BanterLab from OPAL plans |
| Config | The config.* tasks: read and change settings, import, export, undo |
Operator types
Every task invocation is made by one of three operator types. The task is the same; the permission gate differs:
| Operator | Gate | When it applies |
|---|---|---|
| Sentient | None | You're the device's authority; UI clicks and your direct OPAL Activity invocations |
| Automation | Approved at rule creation | Trigger directives, scheduled jobs |
| LLM | Live scope check | Every assistant action passes through SentientPermissionsActivity |
See OPAL architecture for the rationale and Trust Levels for how permissions are graduated.
TaskPlans
A single task does one thing. A TaskPlan is a JSON document chaining tasks, with each step able to reference earlier outputs:
{
"steps": [
{"task": "catalog.list_by_tag", "tag": "trust"},
{"task": "catalog.capture", "id": "$1.results[0].id"},
{"task": "filesystem.copy", "from": "$2.image_path", "to": "/exports/"}
]
}
The same shape underlies LLM-composed plans, batch jobs, and trigger directives. See Plans for authoring tools.
Where you see OPAL in the UI
| UI surface | What it shows |
|---|---|
| OPAL activity | Direct task explorer ā pick a task, fill its parameters, run it |
| OPAL History activity | Audit log: every task that has run on this Sentient |
| Sentient Permissions activity | Per-LLM grants ā which scopes each model has |
| Batch activity | Long-running tasks reporting progress |
| Directives activity | Rules that fire OPAL TaskPlans on a schedule or condition |
| LLM chat overlay | Assistant actions surface as named OPAL Tasks in the transcript |
After a large task, such as a solve, a bake, a mesh step or a video export,
the chat shows a result card below the row of the task: a small table
of the numbers of the result, at most 12 rows. A task declares its card in
its answer, in the output card. A job that ends after its task returned
(wait: false) shows its card when it ends. The card is part of the
conversation, so the history, a restored conversation and the PDF export
show it too.