ADR-0013: Scripts start scripts: the `script.run` permission and the signal events

Status: accepted (2026-10-21)

Context#

An indicator should be able to cause something -- run a calculation, sound an alert, post a message -- when the price crosses a level, and a strategy left running live should tell the person when it signals. Until now only the terminal started scripts (hooks, trigger lines, monitors); a script could not start another, and a strategy's handlers are pure and have no way to say "tell someone".

Decision#

• Components stay pure. An indicator (component indicator) cannot call the host; its way to start anything is a signal it gives (Emit). The terminal turns each signal into the event indicator_signal, and a live strategy's signals into strategy_signal; the hooks attached to those events (a control script, or a built-in webhook) do the rest.
• A control program may start another with script.run(path, args), behind a new permission script.run. The host only asks (a LaunchRequest); the terminal's hook centre serves it under its own limits, so a script cannot get around them.
• Limits: the target is a .tzc or .tz of the scripts folder; the started script holds at most the permissions of the one that started it, cut by the hook cap (which now includes script.run); depth at most 3; at most 16 arguments of 200 characters; 30 starts a minute in all, 16 waiting; the started script is told caller and depth and cannot name them itself. What a program caused does not start hooks, as before.
• The webhook is a hook action of its own, not a script, so telling the world needs no program and goes through the same guards as alert.webhook.

Alternatives#

• Let an indicator call script.run directly. It would stop being pure and replayable, and a faulty indicator could start scripts every second.
• A message bus between scripts. More machinery, a second way to be non-deterministic, and nothing the event system does not already give.
• No depth limit, rely on the rate limit. A loop of two scripts would burn the whole minute's budget; the depth makes it fail at once with a reason.

Consequences#

• Twelve permissions instead of eleven; a hook can be granted script.run, never an order or a backtest.
• Host API 0.1.23; stored hooks files from before still load.
• Not yet: Act.Notify in strategy handlers (a strategy's own explicit signal), and drawing an indicator's line on a chart.