I3434 — A capability declared as reading checkout-private records answers only this machine: a caller beyond loopback is refused on HTTP and MCP, and the refusal logs no input value

✕BLOKOVÁNO vlna 0 · p1 · profil implementation · bezpečné souběžně

Part of a-prompt-reaches-the-work-it-serves — A captured prompt is matched to its existing intent and recorded on the task that follows, joined to its outcome and evidence, shown on /ui and the Cockpit, read only on its own machine and never published.

Cíl

Add one declared field to the existing ExecutionPolicy (apps/majordomus-cli/src/capability/model.rs, beside signed_input at :597) saying that the capability reads checkout-private records. admits_remote (model.rs:708) answers false for it, so two existing paths refuse it with the existing remote error: the router's refusal (http/router.rs:1028) and MCP's remote flag (mcp/protocol.rs:131, :297). Prove it with a fixture capability in tests/remote_callers.rs.

Proč

The owner's 2026-10-19 Cognitive Fabric pack (campaigns/prismatic-way-cognitive-fabric-prompt-pack/prompts/05_SURFACES.md, contracts/ARCHITECTURE.md, and the verification/ACCEPTANCE.md row on private .ai/local data, which names logs and static JSON) forbids private runtime data on any surface beyond the operator. ADR 0126 admits every read from beyond loopback, and servers bind every interface when MAJORDOMUS_HTTP_HOST says so (lib/context.sh:631). This lands before the slice adds the first reader of the prompt archive.

Aktuální stav

admits_remote answers Effect::Read or signed_input (capability/model.rs:708-710), so every read is served to a caller beyond loopback (ADR 0126). Availability::Authenticated states that nothing authenticates a caller yet (model.rs:1176-1179). No Rust capability reads .ai/local/prompts today.

Cílový stav

One field and the existing refusal, with the field projected as part of the capability's execution policy in the registry. A capability that declares it is answered on the command line and to loopback only.

Rozsah

• apps/majordomus-cli/src/capability/model.rs
• apps/majordomus-cli/tests/remote_callers.rs
• docs/CAPABILITIES.md
• docs/generated/registry.json
• docs/generated/registry.yaml
• site/data/registry/registry.json

Mimo rozsah

• Declaring the field on existing capabilities that read other .ai/local stores (an owner question)
• Authentication
• Changing ADR 0126's rule for any other read

Závislosti

Žádné. Tento úkol je kořenem grafu.

Co na tom čeká

• I3408✕BLOCKED A captured prompt is answered, on this machine only, with the existing intents and issues it matches or with no match, and the answer carries identities and never the prompt's text
• I3433✕BLOCKED A UI snapshot page renders only the readings its subject declares publishable, and a page that reads any other reading, or a capability that refuses remote callers, is withheld with a link to the live page

Kritéria přijetí

• A fixture capability declaring the field is refused with 403 to a remote HTTP request and refused over MCP with the remote flag set
• The same capability is answered from loopback and from the command line
• Every existing remote_callers.rs test passes unchanged
• The refusal's log line names the capability and carries no input value

Validace

• cargo test --manifest-path apps/majordomus-cli/Cargo.toml --test remote_callers
• bash test/run.sh 1086_a_remote_caller_cannot_write
• bin/majordomus-cli generate --check

Požadované důkazy

• a_private_read_is_refused_to_a_remote_caller

Důkazy

Nic nezaznamenáno. Za každým tokenem výše musí stát příkaz nebo artefakt, než lze tento úkol dokončit; vyprávění se odmítá.

Časová osa

zahájeno

—

ověřeno

—

dokončeno

—

Tato tři pole, důkazy výše a stav závislostí jsou vše, z čeho se stav skládá. Neexistuje žádné pole stavu, které by s nimi mohlo být v rozporu.

Canonical record: .ai/repo/project/issues/I3434.yaml. Read it back with majordomus plan show I3434.