What is Let'em Cook?
Let'em Cook (LEMC) turns an author's operational knowledge into one
portable unit: wiki, declared inputs, versioned container steps,
timing, ACLs, and durable output. A teammate clicks it in the browser;
an agent discovers and runs the same action with lemcli.
Unhinged, Accelerated DevOps for Agents & Users means one recipe contract, two callers, and one observable result.
Product model
LEMC organizes a unit of work from broadest context to smallest executable step.
| Term | Role | Example |
|---|---|---|
| Cookbook | Groups related operational capabilities. | Release operations |
| Page | Presents a focused surface, wiki text, forms, and actions. | Production readiness |
| Recipe | Names the bounded computational action a caller requests. | Check release readiness |
| Step | Runs one command from a managed container image inside the job boundary. | Query health and render a report |
An app is an installed, user-facing copy of a cookbook. Pages can expose individual or shared scope, but the server remains the authority for admission, scheduling, execution, and events.
Why it exists
Distributed teams accumulate useful scripts, runbooks, and glue code. The code may be sound while the handoff is not: context lives in the author's head, dependencies drift across laptops, delegation expands into broad credentials, and an agent grows a second integration path. LEMC packages the whole job as one discoverable, governed action instead.
- People get a clear form, one run action, live progress, and durable results.
- Agents get structured discovery, stable action IDs, JSON output, and CLI follow/status paths.
- Operators keep execution policy, image authorization, isolation, scheduling, and cleanup on the server.
- Recipe authors can use the language and tooling that fit the task inside a managed image.
One job path
- The browser, API, scheduler, or
lemclisubmits a known recipe action. - The server authenticates the caller, validates the form contract, and acquires the queue slot.
- The operator-selected runner executes a digest-pinned managed image in a fresh job boundary.
- Recipe output becomes structured server events and durable logs.
- The browser and CLI observe matching steps, rendered output, terminal state, and artifacts.
- Cleanup releases the lock and destroys job-owned runtime resources on every terminal path.
Browser, API, and CLI callers never select server execution mode per request. That is an operator startup decision.
Team-owned mini serverless
Hosted-untrusted work runs in one fresh jailed Firecracker guest per job. LEMC loads authorized digest-pinned container steps, exposes only job-scoped broker surfaces, and destroys the guest on success, failure, cancellation, timeout, or lost heartbeat.
- Compute is ephemeral: the job gets a clean microVM rather than inheriting a teammate's laptop or a previous job's runtime.
- The work is durable: events, terminal state, rendered output, logs, artifacts, cache, and workspace state remain available by task ID after teardown.
“Mini Lambda” describes the submit, isolate, run, retain, and tear-down shape. LEMC does not claim AWS Lambda API compatibility.
When to use LEMC
LEMC is a strong fit when a task should be repeatable but its timing or caller varies:
- timed infrastructure such as pentest jump hosts, preview environments, and training labs;
- release checks, maintenance, diagnostics, migrations, and artifact generation;
- restore drills, recurring inventory, certificate checks, and cost hygiene;
- internal self-service that needs permissions and an audit trail;
- agent tools that should call a known contract instead of inventing shell commands;
- multi-step jobs that need live rich output and durable results.
It is not a promise that outside APIs never change or that arbitrary code becomes pure. The useful guarantee is a controlled, inspectable execution boundary. See the operational use-case patterns and deterministic computational units.