Deferred from the P9 review-context layer (second-opinion finding N4).
Context. In v1, the context: provider field is code-owned, built-in-only (declared in
specs.ts; deliberately NOT added to AGENT_MARKDOWN_ACCEPTED_KEYS). This keeps a user/project
Markdown spec from compelling the trusted parent to shell git / assemble a bundle.
Proposed resolution. If we want registered/project agents to declare context:, design the trust
analysis first: a project spec declaring context:[git-diff] makes the trusted parent run git and
feed output to a child — that is a trust expansion and needs explicit gating (project trust + hash
registration already exist; confirm they're sufficient, and decide whether project specs may request
git-bearing providers at all).
Why deferred. Built-in-only covers reviewer/planner/scout (the distinct sets we need now) with no
new attack surface. The frontmatter variant is opt-in scope for later.
Refs: agents/lib/specs.ts (validateContextProviders), agents/lib/agent-markdown.ts (AGENT_MARKDOWN_ACCEPTED_KEYS), agents/SECURITY_MODEL.md → "Review Context Assembly (P9)".
Deferred from the P9 review-context layer (second-opinion finding N4).
Context. In v1, the
context:provider field is code-owned, built-in-only (declared inspecs.ts; deliberately NOT added toAGENT_MARKDOWN_ACCEPTED_KEYS). This keeps a user/projectMarkdown spec from compelling the trusted parent to shell git / assemble a bundle.
Proposed resolution. If we want registered/project agents to declare
context:, design the trustanalysis first: a project spec declaring
context:[git-diff]makes the trusted parent run git andfeed output to a child — that is a trust expansion and needs explicit gating (project trust + hash
registration already exist; confirm they're sufficient, and decide whether project specs may request
git-bearing providers at all).
Why deferred. Built-in-only covers reviewer/planner/scout (the distinct sets we need now) with no
new attack surface. The frontmatter variant is opt-in scope for later.
Refs:
agents/lib/specs.ts(validateContextProviders),agents/lib/agent-markdown.ts(AGENT_MARKDOWN_ACCEPTED_KEYS),agents/SECURITY_MODEL.md→ "Review Context Assembly (P9)".