How Nexrall Canvas works

Canvas is the same kind of agent as Fullstack Agent Coding — it reads, writes and surgically edits content with the same read-before-edit discipline. This page explains what's actually running under the hood, so you can trust why a finished document is genuinely finished.

The artifact, end to end

Layer	What it is
Document	One self-contained HTML file per session — inline <style>, scripts via CDN only
Rendering	A sandboxed iframe inside the Nexrall app; no app, no server, no deploy
Sources	Extracted text cached in object storage; images/PDFs read natively by vision
Verification	Syntax + render + real-browser checks on every write
Export	A real headless browser's print-to-PDF
Model	Multi-provider — Anthropic, OpenAI, DeepSeek, Qwen

There is no server you rent and no project to keep building. Each session manages one artifact from first write to export.

How a build actually runs

1. You describe the document. The agent decides whether the message is a build instruction or just a question, and asks one clarifying question only if the content itself is ambiguous.
2. It writes. The first write is a complete document (write_canvas); later changes are surgical edits (edit_canvas / multi_edit_canvas) that leave the rest untouched.
3. It verifies. This is the step most document tools skip. Every write is checked automatically (see below), and a failure is reported to the agent as part of that tool's own result — not as a separate step it could forget.
4. It refines and exports. Your next message is the next turn of the same agent. When you ask, it exports a PDF snapshot on the spot.

Verification, in four layers

The agent has no way to know its own HTML is broken — so Canvas checks it:

1. Syntax — every inline <script> block is parsed (via esbuild's transform) without executing, catching malformed JavaScript immediately and cheaply.
2. Render — the full document is loaded with scripts enabled (jsdom), catching uncaught runtime exceptions and the "blank page" failure mode.
3. Real browser — if the document uses a CDN library (Chart.js, Three.js, Mermaid, Reveal.js…), a real headless Chromium loads it with real network access, executes the library, and checks that the script actually drew real pixels in every <canvas>/<svg> the agent claims holds a chart or scene. A chart that stayed blank, a bad CDN URL, or a real console error is caught here — jsdom alone can't see any of that.
4. Page fidelity — a multi-page document is checked against real print boundaries, catching content that overflows its declared page height and would drift every later page in the export.

Layers 3 and 4 are deliberately fail-open: if the browser can't launch or times out, the write isn't blocked — it just means that particular turn didn't get the extra check. The browser itself is one shared, lazily-launched, kept-warm instance (never one launch per call), with a hard concurrency cap.

Model routing

Canvas runs on models from multiple providers — Anthropic, OpenAI, DeepSeek and Qwen — selected from the chat's model picker, which shows the real model name (not a tier label) so you know exactly what you're billed for. The allowlist and capability facts (context window, output ceiling, vision, provider) come from one shared registry, so Canvas and Agent Coding agree on what each model is.

A few things follow from that:

• Output budget. Each model has a real per-turn output ceiling (up to 128k tokens on the current Claude models). Canvas tells the model its actual budget before it starts writing, so a long document is built scaffold-first and filled in with edits across several calls instead of truncating mid-write_canvas.
• Vision. Models that can't read images/PDFs natively get a sidecar: a Claude model transcribes the image/PDF to text so the turn can still proceed, billed separately and transparently. See Sources & grounding.

Memory, sub-agents, and skills

Canvas is wired into the same cross-surface primitives as the rest of Nexrall:

• Memory — the same agent_memory store Agent Coding and the Workflow Builder use, so a preference you state in Canvas ("our brand palette is #0F172A/#38BDF8", "reports in Vietnamese, A4 portrait") is honoured in the other surfaces too.
• Sub-agents — the agent can delegate read-only research across your sources to sub-agents running in parallel, with bounded turns and tokens, billed into the main session's usage.
• Skills — user-authored playbooks are available via use_skill, the same mechanism as the other agent surfaces.

Export engine

Export reuses the verification browser: the document is loaded, scripts run and layout settles, then the browser's own print-to-PDF produces the file. Paper size and orientation are auto-detected from what the document declares, and multi-page documents get correct page breaks. See Exporting to PDF.

Next steps

• Security & trust — sandboxing and how Canvas treats your data as untrusted.
• Charts, diagrams & 3D — what the verification layers are actually checking.