function.py is the source of truth for deploy behavior. Store runtime secret values outside this file; keep only env var names, named secret references, and non-secret configuration in source control.
function.py
import nullspace

function = nullspace.Function(
    "repo-review-agent",
    mode="job",
    template="base",
    workdir="/workspace/project",
    install="python -m pip install -e .",
    entrypoint="python main.py",
    bundle=nullspace.Bundle(
        include=["src/**", "pyproject.toml", "main.py"],
        exclude=[".env", ".venv/**", "node_modules/**"],
    ),
    env=nullspace.Env(
        required=["OPENAI_API_KEY"],
        optional=["SERPER_API_KEY"],
    ),
    secrets=[nullspace.Secret.from_name("openai")],
    resources=nullspace.Resources(vcpus=2, memory_mb=2048, timeout_seconds=900),
    policy=nullspace.Policy(internet_access=True, allow_out=["api.github.com"]),
    debug=nullspace.Debug(retain_on_failure=True, retain_seconds=3600),
    outputs=nullspace.Outputs(paths=["result.json", "reports"]),
    max_concurrency=4,
)

Core Fields

FieldPurpose
name / modeStable Function name and job or service runtime shape.
template / workdirMachine template and working directory inside the guest.
install / warmup / entrypointDependency install, optional deploy-time warmup, and runtime command.
bundleIncluded and excluded local files uploaded during deploy.
env / secretsRuntime env var names and named secret references.
resources / policyCPU, memory, disk, timeout, internet/public URL, egress, volume, desktop, PTY, and resource policy.
outputs / debugOutput paths and retained-machine debugging defaults.
serviceService port, readiness check, and idle policy for HTTP services.
routes / schedulesNamed entrypoints and cron/period triggers.
max_concurrencyPer-Function admission cap for job runs.

Python And TypeScript Projects

Python and TypeScript projects use the same function.py descriptor. The difference is the project files, install command, and entrypoint.
function.py
import nullspace

function = nullspace.Function(
    "minimal-job-function",
    mode="job",
    template="base",
    install="python -m pip install -e .",
    entrypoint="python main.py",
    outputs=nullspace.Outputs(paths=["result.json"]),
)

Authoring CLI

Use the CLI to generate, inspect, test, and deploy the descriptor without switching tools.
nullspace functions init --project-dir .
nullspace functions dev --project-dir . --env-file .env.local
nullspace functions deploy --project-dir . --dry-run --json
nullspace functions deploy --project-dir . --env prod --rebuild --json
nullspace functions list --env prod
nullspace functions get minimal-job-function --env prod --json
Related examples: Function Job, Function Service, TypeScript Function Job, and TypeScript Function Service.