AI Operation Catalog

AI operations use the same validators, command executor, semantic planner, and composite undo path as interactive and host actions.

Allowlisted operations

Operation	Scope
set-text	Replace sanitized semantic text at one stable surface/slide/element target.
bind-asset	Assign one declared external asset to an allowlisted slot.
apply-layout	Apply one loaded family layout to one stable slide.
apply-family	Apply coordinated layouts to all three surfaces atomically.
add-slide	Instantiate one loaded layout with a deterministic operation-derived slide ID.
remove-slide	Remove an unreferenced non-final slide and its bindings/fragments.
reorder-slide	Move a stable slide to a validated in-range index.

Every operation contains:

• stable operation ID;
• exact expected accepted revision;
• stable actor ID;
• audit source (interactive, ai, or host);
• optional safe reason and correlation ID; and
• stable surface and target identities where applicable.

Execution

The complete batch is preflighted before mutation. Operations then execute in order against a private clone. Any invalid target, unsafe mapping, stale revision, or invalid final presentation rejects the entire batch and returns the original presentation unchanged.

The result contains operation ID, success, stable code, surface where applicable, warnings, and structured validation issues. Audit output never stores prompts, secrets, binary payloads, or response bodies.

Explicitly forbidden

The protocol has no script operation, callbacks, expressions, arbitrary selectors, unrestricted JSON Patch, arbitrary property paths, inline event handlers, credential-bearing URLs, or binary payload fields. Unknown operation types and fields fail before the Bento store.