Runs a model-authored program that calls tools, instead of a chain of individual tool calls.

A program can loop, branch and fan out in one round trip. The substrate that executes it is a provider behind this behaviour, and the behaviour exists before any provider precisely so the choice of substrate is reversible: the spike that evaluated wasm found working mechanisms but a ~1.9 s per-run compilation floor, and an out-of-process or embedded JS runtime has a different cost and isolation profile again. None of that changes the shape below.

Shape

{:ok, request} = Nous.CodeRuntime.Request.new(program, bindings, self())
{:ok, ref} = MyProvider.start_run(request, config)
receive do
  {:code_run, ^ref, %Nous.CodeRuntime.Result{} = result} -> result
end

Two rules that are the whole point

Failure is a field, never a raise. start_run/2 returns {:error, {:contract, message}} for seam misuse only — a disposed runtime, a malformed binding, a program that is not a string. Everything the program itself does, including throwing, looping until the deadline, flooding output, or dying with its substrate, arrives as %Result{error: %Failure{}}. Running model-authored code that fails is the normal case, not an exception: the model reads the failure and writes a better program.

The request carries no tuning knobs. Budgets — wall clock, memory, instruction count — are provider configuration, validated when the provider is configured. A program cannot ask for a longer deadline for itself, and neither can a caller that a later refactor lets the model influence.

What a provider owes the caller

• a real kill. A deadline that leaves a program running is not a deadline, and "the caller stopped waiting" is not the same as "the work stopped". Whether that is achievable is a property of the substrate, and a provider that cannot do it MUST say so in its own moduledoc rather than implying it can.
• eager log streaming, so a killed run still reports what it managed to say.
• bindings called with the caller's authority and nothing more. Bindings are derived from Nous.Permissions.filter_tools/2; a provider must not offer the guest any other route into Elixir. A substrate whose guest can reach an arbitrary-module dispatch function has to have that route removed before any model-authored code runs, because it bypasses permissions, approval and every path guard at once.