I3306 — An external scripted capability runs under default-deny grants, bounded, and leaves an audit record

✕BLOKOVÁNO wave 4 · p3 · implementation profile · parallel safe

Part of repository-automation-is-typed — Repository automation is typed capabilities that Rhai orchestrates, and domain-logic shell only shrinks.

Cíl

Give external packages explicit grants for file, environment, network and process access on top of I1800's sandbox and time bound, quarantine a package after repeated severe failures, and record each privileged action.

Proč

A plugin from outside the tree is untrusted code; the grant model has to exist before the first one is installed. Critique 2026-10-18: this issue overlaps I3157 (refusal) and I1800 (sandbox, time bound). It moves to repository-automation-is-typed#scripted-capability-runs, reduced to explicit grants, quarantine after repeated severe failures and the audit record. It extends milestone automation. Sources: chatgpt-majordomus:c244#8.

Aktuální stav

I1800 sandboxes the engine; no grant model exists.

Cílový stav

Negative tests prove escalation fails through every transport.

Rozsah

• apps/majordomus-cli/src/script/mod.rs
• apps/majordomus-cli/src/capability/model.rs
• apps/majordomus-cli/src/capability/registry.rs
• apps/majordomus-cli/src/capability/executor.rs
• apps/majordomus-cli/src/capability/handler.rs
• apps/majordomus-cli/src/execution/event.rs
• apps/majordomus-cli/tests/engine.rs
• apps/majordomus-cli/tests/external_extension.rs

Mimo rozsah

• The sandboxed engine and its time bound, which I1800 delivers
• The exposure-ceiling refusal, which I3157 delivers

Závislosti

• I3305✕BLOCKED A scripted capability installed from outside the repository registers like one inside it
• I3157✕BLOCKED A scripted capability declared in an adopting repository's layer reaches its surfaces with no change to the tool, and says where it came from and what it may do
• I1800✓HOTOVO Sandboxovaný engine, ve kterém běží skriptovaná schopnost

Kritéria přijetí

• A package without a grant cannot read a file or spawn a process
• A package's privileged actions, and its stop when I1800's time bound ends it, are written to an audit record
• A package that fails severely the declared number of times is quarantined and named

Validace

• cargo test --manifest-path apps/majordomus-cli/Cargo.toml --test engine
• cargo test --manifest-path apps/majordomus-cli/Cargo.toml --test external_extension

Požadované důkazy

• case_external_capabilities_are_default_deny

Důkazy

Nic nezaznamenáno. Za každým tokenem výše musí stát příkaz nebo artefakt, než lze tento úkol dokončit; vyprávění se odmítá.

Časová osa

zahájeno

—

ověřeno

—

dokončeno

—

Tato tři pole, důkazy výše a stav závislostí jsou vše, z čeho se stav skládá. Neexistuje žádné pole stavu, které by s nimi mohlo být v rozporu.

Canonical record: .ai/repo/project/issues/I3306.yaml. Read it back with majordomus plan show I3306.