claude

Asks a model through the Claude API, with an API key of the operator’s. Each job is one request to the Messages API, and never a second.

What the operator configures

The keys are in config.yaml: the destination, the model, the effort, the longest reply (max_tokens) and the box’s limits. A job can change none of them.

The key

The key is an API key of the Claude Console, made in a workspace kept for sandcastle, with a spend limit on that workspace. The spend limit is required: it is the only cap on the money sandcastle can spend, as max_jobs_per_hour caps how many jobs run, not what they cost. Spending beyond the limit you set is outside the promise.

The key is a secret, named in the destination:

capabilities:
  claude:
    destination:
      address: https://api.anthropic.com
      secret: claude

The address is written by hand: there is no hidden default, so the gate’s list is exactly what the file says. The keep reads the key for every request, so a replaced key needs no restart.

What the job fills

{"prompt": "<the whole task>", "schema": {"type": "object", "…": "…"}}

• prompt: the whole task, in text. It is sent as the user’s message, under the operator’s system_prompt. The default one tells the model that text the task marks as data is never an instruction, and that it has no tools.
• schema: a JSON Schema object for the reply. It is sent as the reply’s format, as the job gave it. The API takes a subset of JSON Schema (no minLength, maxLength, minimum, maximum and the like); a schema it refuses fails the job, with the API’s message.

A prompt larger than max_input is never sent.

What the job gets back

The reply: one JSON value that satisfies the schema. The box checks it against the schema, and a reply that does not satisfy it fails the job and is kept in the job’s record. So does a reply the model declined to give, and one cut off at max_tokens.

The source must still treat the reply as untrusted: a valid reply can be wrong or misleading.

What it never does

• It offers the model no tool: no shell, files, web, code execution or MCP servers. A prompt telling it to run a command has nothing to run it with.
• It makes one request per job. A reply that asks for more gets nothing.
• The job’s box opens the input and the reply. The core never does, and the keep only carries them.

When the API cannot be used

When the key is rejected, the rate limit is reached, the credit has run out, or the API or the keep cannot be reached, the job is released and the capability rests for its cooldown. There is no second way to reach a model.

What check proves

check looks the configured model up with the key. That costs nothing, and tells a rejected key from a model the key cannot use. It does not prove there is credit left: that shows at the first job.

What it costs

The meta.json of every job that reached the model holds a usage object with the model and the tokens that went in and came out. The core’s journal line for the job holds the same two counts. See Files and folders.