Repository navigation
[CTX-0003] Implement history Lua policy over the public history-read API - #8
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Priority: P1 | Area: architecture | Labels: feat,P1,area:architecture | Milestone: v0.1.0 | Task: CTX-0003 | Plan: W-137
Closes #2.
W-137 S-3 plugin package (history repo only): manifest, Lua policy, behavior suite, README synchronized.
Public-API-only statement: the plugin consumes exactly three additive v2 capabilities (history.transcript.read, history.commands.read, history.kv.read) and no private surface. No filesystem/process-spawn/network/clipboard/terminal-input/selection-copy authority; per the RFC-0004 grant-combination rule, reading authorizes delivery into the plugin VM only and export stays separately granted. Session snapshots are never queryable (session/snapshot sources fail closed); records are redacted, truncated, attributed, and carry the Core-attached untrusted-observation label with point-in-time-no-guarantee freshness. No Core changes, no SDK changes, no registry onboarding, no release.
Derivation: accepted RFC-0004 (history-read family) + W-131 (storage-and-history boundary) + W-137 (plugin history-and-storage policy) + Core host history-read 76fa42d6 (spellings verified read-only against bitty main: history.*.read heads under the NEW bitty.history root, 8 denial codes, untrusted-observation label, no session-snapshot source). Composer PRs #7/#8 used as the public-API-only precedent (manifest + Lua + wasmoon/MockHost suite + README sync).
SDK-pin note: bitty-plugin-sdk PR #144 (CTX-0066 history/search/selection surface) is OPEN, so package.json pins its head SHA 0a9487f6c6f47ea0e3cadc9b710e7b1150485822 (not a merged release). The accepted basis is RFC-0004 + W-131 + W-137 + Core host 76fa42d6, never the open SDK PR; the pin is derivation evidence only and will be re-pinned once #144 merges.
Behavior evidence: missing-grant denies before capture; capture-disabled denies with grant held; unscoped denies as scope-mismatch and wildcard as malformed; transcript success returns redacted labeled attributed records with foreign-panel isolation; source isolation (transcript grant never implies commands/KV); commands tail/search with explicit bounds and needle rule; own-KV reads stay in caller namespace with foreign rows invisible and extents rejected; over-bound row/byte/needle requests deny without silent clamping; purged content denies as typed unavailability; session/snapshot sources fail closed; safe-mode and L0/L3/L4/unknown trust deny; revoked stays distinct from missing.
Parity/conformance evidence: byte-identical denials and success shapes vs a foreign manifest (example.history-clone) for the same operations; oracle-tight denial texts (no content bytes, no foreign ids, no absent-vs-denied signal); the plugin subscribes to no events and touches only bitty.history + commands wiring; host-level API-99 mismatch fails activation and plugin-level mismatch disables with zero registrations.
Gates: just check green (fmt, markdownlint 0 issues, metadata, hygiene, portable-path, manifest lint 0 errors + 3 expected high-risk warnings, luaparse, lua-control, bun test 24 pass / 143 expects); just workflows green (actionlint + act -n); gitleaks clean.