Everything @genclass/runtime wraps, replaces or listens to in a page, what each mode may change, what it never does, how every action can be undone, and how everything is put back. The source is the code; each row names the file and function. test/interception.test.ts checks this page against the code: it installs the runtime on a synthetic browser global, compares what changed with the inventory at the end of this page, checks that destroy() restores it, and counts the patch sites in src/ (a new addEventListener, defineProperty or global assignment fails the test until this page is updated).

Version. Written for @genclass/runtime 0.3.0-beta.5 as it is on GitHub main (released 2026-11-02). The copy in an npm package describes that package's version. As of 2026-11-02, npm i @genclass/runtime@beta installs 0.3.0-beta.5 (the 0.3.0 line: 0.3.0-beta.1 to 0.3.0-beta.5, released 2026-10-22 to 2026-11-02), and npm i @genclass/runtime installs 0.2.3 (latest, 2026-10-28), which has no measured visual checks, no protect(), no webhook sink and no interaction analytics. Items marked 0.3.0 are not in 0.2.x; the interaction analytics rows (src/analytics/) and the devtools overlay's theme: "dark" default are 0.3.0-beta.1, the genclass.analytics.<token> entry 0.3.0-beta.2.

The src/... links are relative to packages/runtime/ in the repository (GenClass on GitHub): the npm package ships the built dist/, not src/.

Related: THREAT-MODEL.md (what an attacker could do with this surface), SECURITY.md, TELEMETRY.md (what leaves the page), OPTIONS-SPEC.md (every option), API.md.

Contents

• At a glance
• Globals and prototypes it replaces
• Event listeners it adds
• Objects it instruments after handing them to the app
• Automatic state discovery (React, Redux, Zustand)
• Stores you register
• Other side effects
• The coding-agent link (development only)
• What each mode may change
• What it never does
• Actions: preconditions and reversibility
• Money and identity flows
• Turning it off and restoring the page
• Audit trail
• Machine-checked inventory

At a glance

Every action needs the model's calibrated probability over the permitted actions to reach the tier threshold, a diagnosis other than expected, and must pass requests.protect, cross-origin, route scope, policy.allow/deny, action limits, the breaker and onBeforeAction (src/decide/policy.ts gate, src/runtime.ts RuntimeImpl.onDecision). The model never runs code: it picks a label from the list of actions the runtime offered for that subject, and a label that was not offered is ignored.

Observers are installed by RuntimeImpl.installObservers (src/runtime.ts); observe: { fetch: false, ... } leaves any of them out (timers defaults to on only when a document exists). Each installer is wrapped in try/catch: an installer that throws (a read-only global) is skipped, never fatal.

Globals and prototypes it replaces

Each wrapper calls the original with the same this and arguments and returns its result. After destroy() a wrapper is restored only if it is still the installed value; if another library wrapped it afterwards, GenClass's wrapper stays in that chain as a pure pass-through (a disabled flag), so neither library breaks.

Not wrapped or observed: requestAnimationFrame, queueMicrotask, MessageChannel, postMessage, BroadcastChannel, IndexedDB, Cache Storage reads by the app, navigator.sendBeacon, Worker, Service Workers, WebRTC, WebTransport, document.cookie, form navigation (a native <form> submit is recorded as a user action only).

Event listeners it adds

All of them are passive observers: none calls preventDefault, stopPropagation or changes the event. Exception: the devtools overlay's Alt+Shift+G hotkey (only when you mount the overlay).

Objects it instruments after handing them to the app

Automatic state discovery (React, Redux, Zustand)

Installed with autoState (on by default for @genclass/runtime/auto and the script tag; GenClass.init needs import "@genclass/runtime/discover" first), never under ?genclass=off. Code: src/discover/.

test/invariants/discovery.test.ts checks the "No" rows with a hostile model in heal mode.

Stores you register

rt.atom, rt.guard, rt.adapter, useGenClassState (src/adapters/react.ts), the Redux enhancer (src/adapters/redux.ts: wraps the store's dispatch and previews each action through the reducer once) and the Zustand middleware (src/adapters/zustand.ts: replaces the store's set and api.setState). These are the only stores GenClass can write: guard may drop or defer a held write (policy.holdWrites, opt-in) or late-revert one within 800 ms; heal may roll back or resync. GenClass writes whole states back to Redux with the visible action @@genclass/REPLACE. Store options: hold: false keeps a store's writes from ever being held.

Other side effects

The coding-agent link (development only)

connectAgent(rt) from @genclass/runtime/agent (docs/runtime/AGENT.md) is not part of GenClass.init(), /auto or the script tag: an app imports it in its development build. It returns an inert connection on any page not served from this machine (localhost, 127.x, *.localhost; anyHost: true widens it) and with a non-loopback bridge URL. Connected, it:

It never writes to the event log and never feeds a situation, a decision or the model.

What each mode may change

observe (the default) never holds, delays, drops, retries, replays or answers anything, and never writes app state. In code: permittedActions is empty in observe (src/decide/policy.ts modeAllows), so trigger() never waits; deliveryHoldable is false, so a response is released synchronously before any body read (runDelivery); requestHoldable is false, so a request whose body GenClass reads for its identity is sent first (src/observe/fetch.ts runRequest); store holds need mode !== "observe" (hub.hooks.mayHold). What observe does cost: the wrappers above, a few extra microtask hops, response clones, CPU for situations and the model (in its worker), the model download and, from GenClass.init, telemetry. test/invariants/observe.test.ts compares everything the app observes, with virtual timestamps, against a run without GenClass while a hostile model answers every situation.

guard (opt-in) adds holds and the guard-tier actions; heal (experimental) adds the heal tier. A hold never exceeds the hold budget (policy.holdBudgetMs, "auto" = 1.5 × the model's median latency clamped to 150 to 800 ms), including the time spent waiting for a body, deferred re-decisions and onBeforeAction (test/invariants/network.test.ts, test/invariants/state.test.ts "the hold budget caps ..."). When the model is not ready, slow, erroring or over its rate limit, the subject proceeds unchanged (fail open).

Measured visual checks (VISUAL.md) only read in every mode. Their runtime fixes need visual: { on: true, fix: true } and guard or heal mode, and only ever do two things: add an owned stylesheet rule that sets a readable colour on one element (text measured below 1.5:1), or remove one leaked inline pointer-events: none or overflow: hidden declaration on html or body after recording it. Each is re-measured 50 ms later and undone if it did not help, undone by finding.fix.undo(), and undone automatically on setMode("observe"), the breaker, pause() (within 2 s), disable() and destroy() (src/visual/fix.ts).

Every term can only lower the mode: routes rules, sample, the breaker (after 2 undos or 3 errors following actions, the session drops to observe), a hidden tab (nothing new is held; background decisions are skipped in guard and heal, and deferred until the tab is visible in observe, where they can only detect) and ?genclass-mode (and ?genclass-aggr, ?genclass-sample=0), on every host. Since 0.2.2 no URL or localStorage switch can raise the mode on a production host, and since 0.2.3 and 0.3.0-beta.2 debug: true does not change that: ?genclass=guard or heal raises only on a development host, http(s) on a loopback name with an explicit port or *.test (src/devhost.ts; never Capacitor, Tauri, Electron, intranet or private-address hosts; see THREAT-MODEL.md).

What it never does

Actions: preconditions and reversibility

Holding (waiting for the decision) is not an action: it only adds latency, within the hold budget, and the subject then proceeds or the chosen action runs. Every action is recorded (rt.interventions(), rt.explain(id), the console, sinks, rt.audit()) with one sentence saying exactly what changed. Undo: record.undo(), the devtools overlay, or rt.disable({ undo: true }) (actions of the last 60 s, newest first). Two undos within 10 minutes trip the breaker.

Money and identity flows

Automatic intervention in payment, checkout and sign-in flows is not recommended. Keep them observe-only with requests.protect, which is checked before everything else and covers the request, its response and everything its response callbacks cause:

import { GenClass, protectPreset } from "@genclass/runtime";
GenClass.init({ mode: "guard", requests: { protect: [...protectPreset("payments", "auth"), "/api/cart"] } });
// JSON configs (window.GENCLASS_CONFIG, the options file `init` writes, a meta tag):
window.GENCLASS_CONFIG = { requests: { protect: ["preset:payments", "preset:auth"] } };

npx @genclass/runtime@beta init suggests the second form when the project depends on a payment SDK (Stripe, PayPal, Braintree, Adyen, Square, Paddle, ...) or has source files named like a checkout or payments page. The presets (src/presets.ts) match URL words such as checkout, payment(s), payment_intents, billing, invoice, charge, refund, subscription, order, transaction, transfer, payout, wallet and provider names (Stripe, PayPal, Braintree, Adyen, Klarna, Square); auth matches login, logout, sign-in, sign-up, oauth, token, session, sso, saml, oidc, mfa, otp, password, verify. They over-match on purpose (protection only removes interventions). Cross-origin requests (a payment provider's own API) are never acted on in any case. Alternatively put the routes under a routes rule with mode: "observe".

Turning it off and restoring the page

Per-object instrumentation already handed to the app (a Response's methods, an XHR's handler accessors, sockets created while installed) stays attached and passes through.

Audit trail

rt.audit(n?) returns JSON-serialisable entries for every decision, action, undo, breaker trip and reset, and control change (setMode, setAggressiveness, pause, resume, enabled, disable), each with a timestamp, sequence number, session id, the effective and requested mode, the aggressiveness profile, the gate kind, thresholds and their source, the model's probabilities, the action proposed and the one that ran with the reason, the hold and the model (name, version, variant, device and the sha256 its file was verified against). InitOptions.audit sets the in-memory size (default 1,000) and a sink for your own logging. Query values in free text are replaced with "…". The trail is built from values the runtime already has: it never feeds a decision, never changes what the model reads and is never sent anywhere by GenClass (src/decide/audit.ts; API: API.md).

Machine-checked inventory

test/interception.test.ts parses this block. patch lines name what a runtime with every observer and autoState changes on a browser global, and whether destroy() restores it or leaves it in place (inert). listen lines are the listeners it adds to window and document (all removed by destroy()). sites lines count the patch sites per file in src/ (addEventListener( calls, Object.defineProperty(, Reflect.set/defineProperty, assignments to global, prototype and hook objects): a change in a count fails the test until the rows above and this block are updated. src/protect.ts counts two Object.defineProperty( calls that are not interceptions: protect() sets name and length on the wrapper function it returns (its own object, never a page global; nothing to restore).

patch window.fetch restored
patch window.setTimeout restored
patch window.setInterval restored
patch window.WebSocket restored
patch window.EventSource restored
patch window.__REACT_DEVTOOLS_GLOBAL_HOOK__ stays
patch window.__REDUX_DEVTOOLS_EXTENSION_COMPOSE__ restored
patch window.__REDUX_DEVTOOLS_EXTENSION__ restored
patch XMLHttpRequest.prototype.open restored
patch XMLHttpRequest.prototype.send restored
patch XMLHttpRequest.prototype.abort restored
patch XMLHttpRequest.prototype.setRequestHeader restored
patch XMLHttpRequest.prototype.addEventListener restored
patch XMLHttpRequest.prototype.removeEventListener restored
patch history.pushState restored
patch history.replaceState restored
patch Storage.prototype.setItem restored
patch Storage.prototype.removeItem restored
patch Storage.prototype.clear restored
observe PerformanceObserver longtask
listen window click
listen window input
listen window change
listen window submit
listen window keydown
listen window focusin
listen window pointerdown
listen window mousedown
listen window error
listen window unhandledrejection
listen window popstate
listen window hashchange
listen window pagehide
listen document visibilitychange
sites src/adapters/zustand.ts 1
sites src/agent/index.ts 4
sites src/analytics/index.ts 2
sites src/cdn/config.ts 1
sites src/cdn/global.ts 3
sites src/devtools/index.ts 7
sites src/devtools/ui.ts 1
sites src/discover/react.ts 7
sites src/discover/redux.ts 2
sites src/model/backend.ts 2
sites src/model/host.ts 5
sites src/model/worker.ts 2
sites src/observe/cache.ts 1
sites src/observe/dom-user.ts 3
sites src/observe/errors.ts 2
sites src/observe/eventsource.ts 4
sites src/observe/fetch.ts 4
sites src/observe/nav.ts 6
sites src/observe/storage.ts 6
sites src/observe/timers.ts 4
sites src/observe/websocket.ts 4
sites src/observe/xhr.ts 15
sites src/protect.ts 2
sites src/runtime.ts 1
sites src/telemetry/client.ts 2
sites src/visual/engine.ts 3
sites src/visual/start.ts 1

Rendered from packages/runtime/INTERCEPTION.md in the GenClass repository.