I3306 — An external scripted capability runs under default-deny grants, bounded, and leaves an audit record

✕BLOCKED wave 4 · p3 · implementation profile · parallel safe

Part of repository-automation-is-typed — Repository automation is typed capabilities that Rhai orchestrates, and domain-logic shell only shrinks.

Objective

Give external packages explicit grants for file, environment, network and process access on top of I1800's sandbox and time bound, quarantine a package after repeated severe failures, and record each privileged action.

Why

A plugin from outside the tree is untrusted code; the grant model has to exist before the first one is installed. Critique 2026-10-18: this issue overlaps I3157 (refusal) and I1800 (sandbox, time bound). It moves to repository-automation-is-typed#scripted-capability-runs, reduced to explicit grants, quarantine after repeated severe failures and the audit record. It extends milestone automation. Sources: chatgpt-majordomus:c244#8.

Current state

I1800 sandboxes the engine; no grant model exists.

Desired state

Negative tests prove escalation fails through every transport.

Scope

• apps/majordomus-cli/src/script/mod.rs
• apps/majordomus-cli/src/capability/model.rs
• apps/majordomus-cli/src/capability/registry.rs
• apps/majordomus-cli/src/capability/executor.rs
• apps/majordomus-cli/src/capability/handler.rs
• apps/majordomus-cli/src/execution/event.rs
• apps/majordomus-cli/tests/engine.rs
• apps/majordomus-cli/tests/external_extension.rs

Out of scope

• The sandboxed engine and its time bound, which I1800 delivers
• The exposure-ceiling refusal, which I3157 delivers

Dependencies

• I3305✕BLOCKED A scripted capability installed from outside the repository registers like one inside it
• I3157✕BLOCKED A scripted capability declared in an adopting repository's layer reaches its surfaces with no change to the tool, and says where it came from and what it may do
• I1800✓DONE The sandboxed engine a scripted capability runs in

Acceptance criteria

• A package without a grant cannot read a file or spawn a process
• A package's privileged actions, and its stop when I1800's time bound ends it, are written to an audit record
• A package that fails severely the declared number of times is quarantined and named

Validation

• cargo test --manifest-path apps/majordomus-cli/Cargo.toml --test engine
• cargo test --manifest-path apps/majordomus-cli/Cargo.toml --test external_extension

Evidence required

• case_external_capabilities_are_default_deny

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I3306.yaml. Read it back with majordomus plan show I3306.