Event envelope and callbacks

{
  "version":"1", "id":"inv_...", "topic":"record.updated",
  "collection":"issues", "recordId":"rec_...", "payload":{},
  "callbackScopes":["records:read"]
}

Callback scopes are declared target metadata and remain narrow by design. The initial Lambda adapter does not place long-lived administrator or service credentials in an event. Applications needing callbacks should use a separately managed scoped service identity until short-lived grants are enabled for that target.

Why there is no local runtime

A local user-code runtime would add sandboxing, package, resource-isolation and patching obligations to the trusted server. It is deliberately deferred; external functions interact through the same HTTP API available to every language.