4.2 Core Concepts

4.2.1 Two independent lanes

• Execution: Runs one Job against an existing BioLine Flow and records its plan, real IDs, polling, finalization, and downstream results.
• Authoring: Creates or updates a Tool, Tool Version, or Flow and records its draft, validation, publication, and handoff.
• Registry: The factual record for one workspace, not a cross-job object directory; each lane has a closed schema.
• Image: A fixed runtime selected by execution after finalization and never reused by an authoring workspace.

Execution and authoring use /data/output/<job-id>/ and /data/authoring/<slug>/, with their documented environment-variable overrides. Cross-root paths, cross-lane fields, and authoring labels in an execution container are rejected.

4.2.2 Document-driven dynamic fkit

Every task begins by loading the authoritative AI docs and recording document IDs. Execution planning dynamically discovers and inspects Flows through fkit; authoring verifies new objects through list/config/summary/inspect read-back. If required documentation is unavailable, the registry enters document_gap with the topic, missing information, and blocking reason.

There is no shared Flow mapping. The auditable facts are the confirmed plan, IDs returned by BioLine, and verification evidence for this workspace.

4.2.3 Container boundary

Execution downstream runs with network none, --cap-drop ALL, and a read-only stage/ mount. Generated scripts, analysis outputs, and logs stay inside the execution workspace. Authoring builds may use the default build network, but carry the openclaw.role=authoring, slug, and kind labels and never reuse a downstream container.