From d3a8e8130a2a7aa9c8c72bc0f9e8cf6fe9e903c9 Mon Sep 17 00:00:00 2001 From: John Osumi <931193+sumitake@users.noreply.github.com> Date: Sat, 25 Jul 2026 22:28:06 -0700 Subject: [PATCH 1/2] policy: make managed containment structural --- .claude-plugin/marketplace.base.json | 2 +- .claude-plugin/marketplace.json | 4 +- README.md | 47 ++++++++++-- ...-07-26-structural-containment-authority.md | 19 +++++ .../agent-collab/.claude-plugin/plugin.json | 2 +- .../agent-collab/.codex-plugin/plugin.json | 2 +- plugins/agent-collab/README.md | 26 ++++++- plugins/agent-collab/host_policy.py | 2 +- .../skills/agent-readiness/SKILL.md | 2 +- .../skills/agent-runtime-status/SKILL.md | 2 +- .../skills/ai-writing-auditor/SKILL.md | 2 +- .../agent-collab/skills/architect/SKILL.md | 2 +- .../skills/autonomy-readiness/SKILL.md | 2 +- .../agent-collab/skills/brainstorm/SKILL.md | 2 +- .../skills/chain-configurator/SKILL.md | 2 +- plugins/agent-collab/skills/chain/SKILL.md | 2 +- .../agent-collab/skills/code-review/SKILL.md | 2 +- .../skills/compose-skills/SKILL.md | 2 +- .../skills/data-engineer/SKILL.md | 2 +- plugins/agent-collab/skills/debate/SKILL.md | 2 +- plugins/agent-collab/skills/delegate/SKILL.md | 2 +- .../agent-collab/skills/dev-delegate/SKILL.md | 7 +- .../skills/elixir-engineer/SKILL.md | 2 +- .../skills/eval-engineer/SKILL.md | 2 +- .../agent-collab/skills/go-engineer/SKILL.md | 2 +- .../skills/governance-review/SKILL.md | 2 +- .../hallucination-investigator/SKILL.md | 2 +- .../skills/incident-responder/SKILL.md | 2 +- .../agent-collab/skills/intent-check/SKILL.md | 2 +- .../skills/knowledge-compile/SKILL.md | 2 +- .../skills/kubernetes-specialist/SKILL.md | 2 +- .../skills/llm-architect/SKILL.md | 2 +- .../agent-collab/skills/logic-check/SKILL.md | 2 +- .../agent-collab/skills/long-context/SKILL.md | 2 +- .../skills/merge-resolve/SKILL.md | 2 +- .../skills/migration-doctor/SKILL.md | 2 +- .../skills/mlops-engineer/SKILL.md | 2 +- .../agent-collab/skills/orchestrate/SKILL.md | 2 +- .../skills/postgres-engineer/SKILL.md | 2 +- .../skills/prompt-regression-tester/SKILL.md | 2 +- .../agent-collab/skills/qa-verify/SKILL.md | 2 +- plugins/agent-collab/skills/red-team/SKILL.md | 2 +- plugins/agent-collab/skills/route/SKILL.md | 18 +++-- .../skills/rust-engineer/SKILL.md | 2 +- .../skills/second-opinion/SKILL.md | 2 +- .../skills/simulate-user/SKILL.md | 2 +- .../agent-collab/skills/sql-engineer/SKILL.md | 2 +- .../agent-collab/skills/sre-engineer/SKILL.md | 2 +- .../skills/start-inbox-monitor/SKILL.md | 2 +- plugins/agent-collab/skills/teamwork/SKILL.md | 2 +- .../skills/terraform-engineer/SKILL.md | 2 +- .../agent-collab/skills/ui-to-code/SKILL.md | 2 +- .../skills/untrusted-audit/SKILL.md | 2 +- .../skills/visual-review/SKILL.md | 2 +- plugins/agent-collab/skills/worker/SKILL.md | 9 ++- scripts/skill-build-config.json | 2 +- skill-specs/dev-delegate.md | 5 +- skill-specs/route.md | 16 ++-- skill-specs/worker.md | 7 +- ...ructural_containment_authority_contract.py | 76 +++++++++++++++++++ 60 files changed, 244 insertions(+), 88 deletions(-) create mode 100644 changelog.d/2026-07-26-structural-containment-authority.md create mode 100644 tests/test_structural_containment_authority_contract.py diff --git a/.claude-plugin/marketplace.base.json b/.claude-plugin/marketplace.base.json index da3fa5d..c0189af 100644 --- a/.claude-plugin/marketplace.base.json +++ b/.claude-plugin/marketplace.base.json @@ -9,7 +9,7 @@ "plugins": [], "metadata": { "description": "Agent collaboration plugin marketplace", - "version": "4.5.0", + "version": "4.5.1", "repository": "https://github.com/sumitake/agent-collab" } } diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index 5dbf8bf..6eee178 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -10,7 +10,7 @@ { "name": "agent-collab", "description": "Unified dynamic-host collaboration package. Centralized skills and async coordination work without legacy packages; every model-execution route requires the verified signed plugin artifact.", - "version": "4.5.0", + "version": "4.5.1", "author": { "name": "John Osumi" }, @@ -32,7 +32,7 @@ ], "metadata": { "description": "Agent collaboration plugin marketplace", - "version": "4.5.0", + "version": "4.5.1", "repository": "https://github.com/sumitake/agent-collab" } } diff --git a/README.md b/README.md index b67bb8d..a992e3c 100644 --- a/README.md +++ b/README.md @@ -78,7 +78,7 @@ trust: primary's identity, model, and session dynamically — no per-host forks to drift out of sync. -This public repository distributes that one package, **agent-collab** (v4.5.0), and is +This public repository distributes that one package, **agent-collab** (v4.5.1), and is the source of truth for the coordinator policy, skills, migration tooling, the fail-closed runtime client, contribution governance, and release-safety checks. The signed and notarized darwin-arm64 native runtime is committed in this @@ -129,7 +129,22 @@ Contributors need no access to the private build/sign system. See | Package | Version | Role | |---|---:|---| -| `agent-collab` | 4.5.0 | Unified skills, dynamic host policy, migration preflight, and verified native-runtime client | +| `agent-collab` | 4.5.1 | Unified skills, dynamic host policy, migration preflight, and verified native-runtime client | + +## What's new - v4.5.1 + +- **Containment is structural, provider-agnostic, and rare by design.** Managed + providers authenticate from the canonical user HOME while the caller + checkout remains read-only. Each request receives a private temporary + workspace in which the provider may use tools, edit, build, and reason + agentically; OpenCode build returns output-only material for trusted-primary + application. A blocked access attempt is containment success, not an + invocation failure. Structural containment failure is reserved for a + pre-launch boundary that cannot be established or positive evidence that a + write escaped the allowed paths or changed protected source/credentials. + Authentication, protocol/output, timeout, provider, teardown, and cleanup + failures remain orthogonal. Managed execution does not use output/stderr + heuristics or routine direct CLI fallbacks. ## What's new - v4.5.0 @@ -261,6 +276,24 @@ roots and selected-provider auth; Codex keeps a sealed per-call `CODEX_HOME`, SQLite, and XDG overlay. Provider-specific policy overlays may narrow credentials or tools without replacing process HOME. Broker frames cannot invoke local runtime-management actions. +The runtime resolves the canonical user HOME from passwd for provider +authentication while keeping the caller checkout read-only by default. Every +request receives a private temporary workspace where the selected provider may +clone or copy inputs, edit, build, use tools, and reason agentically. Only +explicit provider-state paths are writable outside that workspace, in-request +binary auto-update is disabled, execution is bounded, descendants are reaped, +and temporary cleanup is positively verified. OpenCode build is sealed +output-only: its private-workspace changes are returned for trusted-primary +review and application rather than written into the caller checkout. + +A blocked access attempt inside an established boundary is containment success +and does not by itself fail an invocation. A structural containment failure is +reserved for failure to establish the boundary before launch or positive +evidence that a write escaped allowed paths or changed protected +source/credentials. Authentication, protocol/output, timeout, provider, +teardown, and cleanup failures stay orthogonal; `rc=0`, empty output, or stderr +wording never manufacture a containment result. Direct CLI use is not a normal +reliability fallback for a managed route. If the client disconnects, the broker propagates cancellation through every managed provider route, reaps provider child groups, and discards partial output. Disconnect-driven cancellation is never retried; @@ -533,8 +566,9 @@ path-based attachment or raw-provider fallback. Explicit `target=gemini`, `target=codex`, and `target=opencode` requests are fail-closed and never silently substituted. Gemini has separate read-only -advisory, governance, and long-context actions; Codex advisory and OpenCode plan/workspace-write authority are -sealed separately and never promote or demote into one another. Codex build is +advisory, governance, and long-context actions; Codex advisory, OpenCode plan, +and OpenCode private-workspace/output-only build authority are sealed +separately and never promote or demote into one another. Codex build is a resolvable mutation-capable request but returns typed unavailable until a hardened mutation backend exists; it never widens advisory. @@ -552,8 +586,9 @@ deadline. Final UTF-8 input above the inclusive 1,048,576-byte managed ceiling returns `input_limit` before provider authentication or spawn. Grok 4.5 is reachable only through sealed `architecture`, `governance`, or `huge_context` actions; generic advisory, brainstorm, debate, QA, and fallback -requests cannot select it. OpenCode build is a distinct mutation-capable -workspace-write action and never aliases its read-only plan action. +requests cannot select it. OpenCode build is a distinct tool-capable, +private-workspace/output-only action and never aliases its read-only plan +action or writes the caller checkout. Applicable non-governance review, fallback, and worker requests may include an exact immutable artifact snapshot; its author model is resolved independently and that family is excluded from selection alongside the active primary family. An diff --git a/changelog.d/2026-07-26-structural-containment-authority.md b/changelog.d/2026-07-26-structural-containment-authority.md new file mode 100644 index 0000000..8bcb22c --- /dev/null +++ b/changelog.d/2026-07-26-structural-containment-authority.md @@ -0,0 +1,19 @@ +### Fixed + +- agent-collab 4.5.1 makes managed containment a rare structural signal rather + than an output heuristic. +- Make managed containment provider-agnostic and structural: authenticated + provider state resolves from the canonical user HOME, caller checkouts stay + read-only by default, and each request receives a private temporary workspace + for agentic tools, edits, builds, and reasoning. +- Seal `opencode/build` as output-only to the caller. OpenCode may work inside + its private workspace, but the trusted primary reviews and applies returned + material instead of granting the provider direct caller-worktree mutation. +- Reserve `containment_error` for failure to establish the boundary before + launch or positive write-escape/protected-state evidence. A successfully + blocked access attempt proves containment worked; return code, empty output, + and stderr wording cannot manufacture a containment failure. +- Keep authentication, protocol/output, timeout, provider, teardown, and + cleanup failures orthogonal. Disable in-request binary updates, require + bounded descendant teardown and positively verified temporary cleanup, and + treat routine direct-CLI fallback as a managed-path reliability defect. diff --git a/plugins/agent-collab/.claude-plugin/plugin.json b/plugins/agent-collab/.claude-plugin/plugin.json index eb2e054..b8e44b3 100644 --- a/plugins/agent-collab/.claude-plugin/plugin.json +++ b/plugins/agent-collab/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "agent-collab", - "version": "4.5.0", + "version": "4.5.1", "description": "Unified dynamic-host collaboration package with centralized skills, migration preflight, and a verified plugin-relative native runtime boundary. The signed runtime artifact is intentionally absent until the private build/sign integration completes.", "author": { "name": "John Osumi" diff --git a/plugins/agent-collab/.codex-plugin/plugin.json b/plugins/agent-collab/.codex-plugin/plugin.json index 4212b57..4fa2914 100644 --- a/plugins/agent-collab/.codex-plugin/plugin.json +++ b/plugins/agent-collab/.codex-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "agent-collab", - "version": "4.5.0", + "version": "4.5.1", "description": "Unified dynamic-host collaboration package with centralized skills, migration preflight, and a verified plugin-relative native runtime boundary. The signed runtime artifact is intentionally absent until the private build/sign integration completes.", "author": { "name": "John Osumi" diff --git a/plugins/agent-collab/README.md b/plugins/agent-collab/README.md index 5d679fd..0c1001a 100644 --- a/plugins/agent-collab/README.md +++ b/plugins/agent-collab/README.md @@ -7,7 +7,7 @@ verifiable compliance evidence, and operator final-say, delivered as one package for every supported host. This document is the package's technical reference; the repository README carries the purpose and governance narrative. -Current: **4.5.0** +Current: **4.5.1** It resolves `primary_id`, `primary_family`, `active_model`, `host_runtime`, and `session_identifier` from the current host or explicit configuration. ZCode @@ -65,7 +65,7 @@ one macOS `LC_BUILD_VERSION` with minimum macOS 14.0 instead of trusting those manifest labels. The broker transport and provider protocol are both version 2. The package carries both `.claude-plugin/plugin.json` and `.codex-plugin/plugin.json`; both -identify this same 4.5.0 package. +identify this same 4.5.1 package. Codex, Gemini, OpenCode, Grok, and Composer are broker-only contracts. Their sealed requests cross a mode-`0600`, digest-bound per-user launchd Unix socket; launchd starts the exact @@ -125,6 +125,24 @@ private XDG roots and selected-provider auth; Codex keeps a sealed per-call `CODEX_HOME`, SQLite, and XDG overlay. A provider-specific policy overlay may narrow credentials or tools without replacing process HOME. Broker transport cannot invoke local `status`, `prepare`, or `grok_login` management authority. +The runtime resolves that canonical user HOME from passwd for provider +authentication while keeping the caller checkout read-only by default. Every +request receives a private temporary workspace where the provider may clone or +copy inputs, edit, build, use tools, and reason agentically. Only explicit +provider-state paths are writable outside that workspace, in-request binary +auto-update is disabled, execution is bounded, descendants are reaped, and +temporary cleanup is positively verified. OpenCode build is sealed output-only: +its private-workspace changes are returned for trusted-primary review and +application rather than written into the caller checkout. + +A blocked access attempt inside an established boundary is containment success, +not an invocation failure. Structural containment failure is reserved for a +boundary that cannot be established before launch or positive evidence that a +write escaped allowed paths or changed protected source/credentials. +Authentication, protocol/output, timeout, provider, teardown, and cleanup +failures remain orthogonal; `rc=0`, empty output, or stderr wording never +manufacture a containment result. Direct CLI use is not a normal reliability +fallback for a managed route. Client disconnect propagates cancellation through every managed provider route, reaps provider child groups, and discards partial output. Disconnect cancellation is never retried; a deadline below the managed @@ -226,7 +244,7 @@ mutation-capable authority never promote or demote into one another. | `target=codex` second opinion, high-stakes advice, or tiebreaker | Read-only | Codex advisory | | `target=codex` bounded implementation | Mutation-capable worker | Typed unavailable pending hardened mutation backend; no advisory fallback | | `target=opencode` analysis or implementation plan | Read-only | OpenCode plan | -| `target=opencode` implementation | Mutation-capable worker | OpenCode build with exact workspace-write authority | +| `target=opencode` implementation | Output-only worker | OpenCode build with tools in a private temporary workspace; trusted primary applies the returned material | | `target=grok` architecture consultation | Read-only | Grok 4.5 `architecture` action | | `target=grok` governance review | Read-only | Grok 4.5 `governance` action | | `target=grok` large-corpus extraction | Read-only | Grok 4.5 huge-context ingestion | @@ -442,7 +460,7 @@ Exact row contracts are: | `gemini/long_context` | Gemini advisory fields plus `"documents":[{"label":"...","content":"..."}]` | | `codex/advisory` | `{"model":"openai/...","effort":"low|medium|high|xhigh","mode":"prompt-only"}` or `mode=repo-review` plus absolute `cwd` | | `opencode/plan` | Absolute `cwd`; optional explicitly observed `model` and `variant` | -| `opencode/build` | Absolute `cwd`; optional explicitly observed `model` and `variant`; mutation-capable workspace authority | +| `opencode/build` | Absolute read-only caller `cwd`; optional explicitly observed `model` and `variant`; private temporary workspace with output-only caller authority | | `grok/architecture` | `{"mode":"prompt-only"}` or `mode=repo-review` plus absolute `cwd` | | `grok/governance` | Same exact row as architecture; requires `governance=true` and an artifact snapshot | | `grok/huge_context` | `{"documents":[{"label":"...","content":"..."}]}` | diff --git a/plugins/agent-collab/host_policy.py b/plugins/agent-collab/host_policy.py index c6ceb19..731497d 100644 --- a/plugins/agent-collab/host_policy.py +++ b/plugins/agent-collab/host_policy.py @@ -89,7 +89,7 @@ ("codex", "advisory"): "read_only", ("codex", "governance"): "read_only", ("opencode", "plan"): "read_only", - ("opencode", "build"): "workspace_write", + ("opencode", "build"): "output_only", ("grok", "architecture"): "read_only", ("grok", "governance"): "read_only", ("grok", "huge_context"): "read_only", diff --git a/plugins/agent-collab/skills/agent-readiness/SKILL.md b/plugins/agent-collab/skills/agent-readiness/SKILL.md index d4c964f..0b619df 100644 --- a/plugins/agent-collab/skills/agent-readiness/SKILL.md +++ b/plugins/agent-collab/skills/agent-readiness/SKILL.md @@ -1,6 +1,6 @@ --- name: agent-readiness -version: 4.5.0 +version: 4.5.1 description: Evaluate whether an agent, model, CLI, plugin, or role is ready for a proposed responsibility. Use when the user says "agent readiness," "is this agent ready," "can Codex be primary," "can Grok handle this role," "promote this agent," "evaluate this worker," "review model readiness," or "/agent-collab:agent-readiness." Also offer this proactively before assigning a new primary, reviewer, worker, delegate, headless, release, or merge-related role to Claude, Codex, Antigravity/Gemini, Grok, or a future agent. --- diff --git a/plugins/agent-collab/skills/agent-runtime-status/SKILL.md b/plugins/agent-collab/skills/agent-runtime-status/SKILL.md index 55081e8..d8dece8 100644 --- a/plugins/agent-collab/skills/agent-runtime-status/SKILL.md +++ b/plugins/agent-collab/skills/agent-runtime-status/SKILL.md @@ -1,6 +1,6 @@ --- name: agent-runtime-status -version: 4.5.0 +version: 4.5.1 defaults: tier: Fast effort: low diff --git a/plugins/agent-collab/skills/ai-writing-auditor/SKILL.md b/plugins/agent-collab/skills/ai-writing-auditor/SKILL.md index c4a4913..5de1960 100644 --- a/plugins/agent-collab/skills/ai-writing-auditor/SKILL.md +++ b/plugins/agent-collab/skills/ai-writing-auditor/SKILL.md @@ -1,6 +1,6 @@ --- name: ai-writing-auditor -version: 4.5.0 +version: 4.5.1 description: Audits prose for the tells of machine-generated writing and rewrites it to read as if a careful human wrote it, without softening the actual content. Use when the user says "de-AI this text", "audit this writing for AI patterns", "make this read human", or "/agent-collab:ai-writing-auditor." Also offer this proactively when a piece of customer-facing or published prose is dense with the stock phrasing and mechanical structure typical of unedited model output. --- diff --git a/plugins/agent-collab/skills/architect/SKILL.md b/plugins/agent-collab/skills/architect/SKILL.md index 47ef2f9..f46248c 100644 --- a/plugins/agent-collab/skills/architect/SKILL.md +++ b/plugins/agent-collab/skills/architect/SKILL.md @@ -1,6 +1,6 @@ --- name: architect -version: 4.5.0 +version: 4.5.1 description: Request read-only architecture consultation for codebase analysis, system design, implementation planning, decomposition, or long-horizon coding strategy. Use when the user says "ask the architect," "have Grok design this," "architecture consultation," "plan this implementation," "decompose this build," "analyze the system design," or "/agent-collab:architect." Also offer this proactively before a substantial multi-system or long-horizon implementation where an independent architecture pass can reduce rework. This role never edits files, runs shell commands or tests, mutates a worktree, opens PRs, merges, or deploys. --- diff --git a/plugins/agent-collab/skills/autonomy-readiness/SKILL.md b/plugins/agent-collab/skills/autonomy-readiness/SKILL.md index 33e7023..28e71f9 100644 --- a/plugins/agent-collab/skills/autonomy-readiness/SKILL.md +++ b/plugins/agent-collab/skills/autonomy-readiness/SKILL.md @@ -1,6 +1,6 @@ --- name: autonomy-readiness -version: 4.5.0 +version: 4.5.1 description: Evaluate whether an autonomous, always-on, scheduled, headless, or self-evolving workflow is ready to run safely. Use when the user says "autonomy readiness," "activation gate review," "is this workflow ready to run autonomously," "go/no-go autonomy," "always-on readiness," "headless operation review," or "/agent-collab:autonomy-readiness." Also offer this proactively before enabling background agents, recurring automations, auto-merge/self-evolution, external actions, unattended host runs, or any workflow that can continue without a human watching. --- diff --git a/plugins/agent-collab/skills/brainstorm/SKILL.md b/plugins/agent-collab/skills/brainstorm/SKILL.md index 1524cc2..b0b8f2c 100644 --- a/plugins/agent-collab/skills/brainstorm/SKILL.md +++ b/plugins/agent-collab/skills/brainstorm/SKILL.md @@ -1,6 +1,6 @@ --- name: brainstorm -version: 4.5.0 +version: 4.5.1 defaults: tier: Fast effort: low diff --git a/plugins/agent-collab/skills/chain-configurator/SKILL.md b/plugins/agent-collab/skills/chain-configurator/SKILL.md index c3ec699..fb745a4 100644 --- a/plugins/agent-collab/skills/chain-configurator/SKILL.md +++ b/plugins/agent-collab/skills/chain-configurator/SKILL.md @@ -1,6 +1,6 @@ --- name: chain-configurator -version: 4.5.0 +version: 4.5.1 defaults: tier: Standard effort: medium diff --git a/plugins/agent-collab/skills/chain/SKILL.md b/plugins/agent-collab/skills/chain/SKILL.md index 78f7830..dd5c3b1 100644 --- a/plugins/agent-collab/skills/chain/SKILL.md +++ b/plugins/agent-collab/skills/chain/SKILL.md @@ -1,6 +1,6 @@ --- name: chain -version: 4.5.0 +version: 4.5.1 defaults: tier: Standard effort: medium diff --git a/plugins/agent-collab/skills/code-review/SKILL.md b/plugins/agent-collab/skills/code-review/SKILL.md index e36cb0b..0fdb7c6 100644 --- a/plugins/agent-collab/skills/code-review/SKILL.md +++ b/plugins/agent-collab/skills/code-review/SKILL.md @@ -1,6 +1,6 @@ --- name: code-review -version: 4.5.0 +version: 4.5.1 defaults: tier: Advanced effort: high diff --git a/plugins/agent-collab/skills/compose-skills/SKILL.md b/plugins/agent-collab/skills/compose-skills/SKILL.md index 19bdbc3..56a5a23 100644 --- a/plugins/agent-collab/skills/compose-skills/SKILL.md +++ b/plugins/agent-collab/skills/compose-skills/SKILL.md @@ -1,6 +1,6 @@ --- name: compose-skills -version: 4.5.0 +version: 4.5.1 description: Select a bounded, token-aware combination of collaboration skills or task lenses before execution. Use when the user says "compose skills," "which skills should I use," "use skill composition," "select a recipe," "combine these skills," or "/agent-collab:compose-skills." Also offer this proactively when a task plausibly needs multiple lenses, reviewers, or agents and would benefit from progressive disclosure, explicit fan-out limits, and a smallest-useful-skill plan before routing or loading full skill bodies. --- diff --git a/plugins/agent-collab/skills/data-engineer/SKILL.md b/plugins/agent-collab/skills/data-engineer/SKILL.md index c780a29..c376ee1 100644 --- a/plugins/agent-collab/skills/data-engineer/SKILL.md +++ b/plugins/agent-collab/skills/data-engineer/SKILL.md @@ -1,6 +1,6 @@ --- name: data-engineer -version: 4.5.0 +version: 4.5.1 description: Builds and hardens the pipelines and warehouse structures that move data from source systems to the people and systems that consume it. Use when the user says "build the ETL pipeline", "design the dbt models", "orchestrate this pipeline", or "design the warehouse schema", or "/agent-collab:data-engineer." Also offer this proactively when a pipeline lacks idempotency, has no data-quality checks, or moves data through undocumented schema contracts. --- diff --git a/plugins/agent-collab/skills/debate/SKILL.md b/plugins/agent-collab/skills/debate/SKILL.md index eb1f090..221d8b3 100644 --- a/plugins/agent-collab/skills/debate/SKILL.md +++ b/plugins/agent-collab/skills/debate/SKILL.md @@ -1,6 +1,6 @@ --- name: debate -version: 4.5.0 +version: 4.5.1 defaults: tier: Advanced effort: high diff --git a/plugins/agent-collab/skills/delegate/SKILL.md b/plugins/agent-collab/skills/delegate/SKILL.md index 93985f5..c95532e 100644 --- a/plugins/agent-collab/skills/delegate/SKILL.md +++ b/plugins/agent-collab/skills/delegate/SKILL.md @@ -1,6 +1,6 @@ --- name: delegate -version: 4.5.0 +version: 4.5.1 defaults: tier: Fast effort: low diff --git a/plugins/agent-collab/skills/dev-delegate/SKILL.md b/plugins/agent-collab/skills/dev-delegate/SKILL.md index d2015cd..56b2af1 100644 --- a/plugins/agent-collab/skills/dev-delegate/SKILL.md +++ b/plugins/agent-collab/skills/dev-delegate/SKILL.md @@ -1,6 +1,6 @@ --- name: dev-delegate -version: 4.5.0 +version: 4.5.1 defaults: tier: Standard effort: medium @@ -26,8 +26,9 @@ and preserves artifact provenance. Never discover a provider executable. ## Supported model routes - OpenCode `plan`: read-only plan in one contained cwd. -- OpenCode `build`: mutation-capable workspace-write execution within one - contained cwd; no `.git`, commit, push, PR, merge, or deploy authority. +- OpenCode `build`: tool-capable execution in one private temporary workspace, + returning output-only material; the caller checkout stays read-only and the + route has no `.git`, commit, push, PR, merge, or deploy authority. - Grok 4.5 through the `composer/codegen` compatibility route: output-only patch/code JSON; no workspace tools. Seal simple work as low effort, standard fixes/features as medium, and complex multi-file or architecture work as high. diff --git a/plugins/agent-collab/skills/elixir-engineer/SKILL.md b/plugins/agent-collab/skills/elixir-engineer/SKILL.md index 37a0394..5b57b6d 100644 --- a/plugins/agent-collab/skills/elixir-engineer/SKILL.md +++ b/plugins/agent-collab/skills/elixir-engineer/SKILL.md @@ -1,6 +1,6 @@ --- name: elixir-engineer -version: 4.5.0 +version: 4.5.1 description: Senior Elixir and OTP engineer for fault-tolerant, concurrent, and Phoenix-based systems. Use when the user says "review this supervision tree", "why did this GenServer crash", "help me design this OTP process architecture", or "/agent-collab:elixir-engineer." Also offer this proactively when a change adds a new process, alters a restart strategy, or touches a Phoenix channel or LiveView boundary. --- diff --git a/plugins/agent-collab/skills/eval-engineer/SKILL.md b/plugins/agent-collab/skills/eval-engineer/SKILL.md index abc3f02..d7fb02b 100644 --- a/plugins/agent-collab/skills/eval-engineer/SKILL.md +++ b/plugins/agent-collab/skills/eval-engineer/SKILL.md @@ -1,6 +1,6 @@ --- name: eval-engineer -version: 4.5.0 +version: 4.5.1 description: Designs evaluation suites and scoring methods that measure whether an AI-backed workflow is actually good enough to ship. Use when the user says "design evals for this", "build an eval suite", "how should we measure this workflow", or "/agent-collab:eval-engineer." Also offer this proactively when a project ships a prompt, retrieval pipeline, or agent workflow with no structured way to tell whether a change made it better or worse. --- diff --git a/plugins/agent-collab/skills/go-engineer/SKILL.md b/plugins/agent-collab/skills/go-engineer/SKILL.md index bc35f20..1dea339 100644 --- a/plugins/agent-collab/skills/go-engineer/SKILL.md +++ b/plugins/agent-collab/skills/go-engineer/SKILL.md @@ -1,6 +1,6 @@ --- name: go-engineer -version: 4.5.0 +version: 4.5.1 description: Senior Go engineer for concurrent, service-oriented, and cloud-native code. Use when the user says "review this Go service for concurrency bugs", "help me design this Go interface", "why is this goroutine leaking", or "/agent-collab:go-engineer." Also offer this proactively when a change adds a goroutine, channel, or context-cancellation path without an obvious termination guarantee. --- diff --git a/plugins/agent-collab/skills/governance-review/SKILL.md b/plugins/agent-collab/skills/governance-review/SKILL.md index e49c9dd..580b482 100644 --- a/plugins/agent-collab/skills/governance-review/SKILL.md +++ b/plugins/agent-collab/skills/governance-review/SKILL.md @@ -1,6 +1,6 @@ --- name: governance-review -version: 4.5.0 +version: 4.5.1 description: Use when the operator says "governance review," "high-stakes review," "tiebreaker," or "second opinion." Also offer this proactively when reviewer-family independence must be enforced. --- diff --git a/plugins/agent-collab/skills/hallucination-investigator/SKILL.md b/plugins/agent-collab/skills/hallucination-investigator/SKILL.md index 83fa220..1d2e9a8 100644 --- a/plugins/agent-collab/skills/hallucination-investigator/SKILL.md +++ b/plugins/agent-collab/skills/hallucination-investigator/SKILL.md @@ -1,6 +1,6 @@ --- name: hallucination-investigator -version: 4.5.0 +version: 4.5.1 description: Traces a specific wrong or fabricated AI output back to its root cause in context, retrieval, prompting, or tool use, and recommends the most targeted fix. Use when the user says "why is it hallucinating", "investigate this fabrication", "trace this wrong answer", or "/agent-collab:hallucination-investigator." Also offer this proactively when a factuality failure has been reported but no one has yet reconstructed why the system produced that specific wrong answer. --- diff --git a/plugins/agent-collab/skills/incident-responder/SKILL.md b/plugins/agent-collab/skills/incident-responder/SKILL.md index ae2f32c..53b0fc9 100644 --- a/plugins/agent-collab/skills/incident-responder/SKILL.md +++ b/plugins/agent-collab/skills/incident-responder/SKILL.md @@ -1,6 +1,6 @@ --- name: incident-responder -version: 4.5.0 +version: 4.5.1 description: Leads live incident response — triage, containment, evidence-driven root-cause analysis, and postmortem writeups for active outages or breaches. Use when the user says "we have an incident", "production is down", or "run the postmortem for this outage", or "/agent-collab:incident-responder." Also offer this proactively when the user is trying to write the incident timeline or communicate status while a service disruption is still unresolved. --- diff --git a/plugins/agent-collab/skills/intent-check/SKILL.md b/plugins/agent-collab/skills/intent-check/SKILL.md index db03a52..6cf9e33 100644 --- a/plugins/agent-collab/skills/intent-check/SKILL.md +++ b/plugins/agent-collab/skills/intent-check/SKILL.md @@ -1,6 +1,6 @@ --- name: intent-check -version: 4.5.0 +version: 4.5.1 defaults: tier: Fast effort: low diff --git a/plugins/agent-collab/skills/knowledge-compile/SKILL.md b/plugins/agent-collab/skills/knowledge-compile/SKILL.md index 06cdf88..c9f1080 100644 --- a/plugins/agent-collab/skills/knowledge-compile/SKILL.md +++ b/plugins/agent-collab/skills/knowledge-compile/SKILL.md @@ -1,6 +1,6 @@ --- name: knowledge-compile -version: 4.5.0 +version: 4.5.1 description: Compile multiple sources into a durable, cited knowledge dossier without mixing claims, assumptions, and decisions. Use when the user says "compile knowledge," "build a dossier," "create a knowledge base," "synthesize these sources," "preserve research context," "make this reviewable later," or "/agent-collab:knowledge-compile." Also offer this proactively when a task spans several repos, PRs, papers, articles, logs, agent messages, or drafts and future agents need source-separated context for independent review. --- diff --git a/plugins/agent-collab/skills/kubernetes-specialist/SKILL.md b/plugins/agent-collab/skills/kubernetes-specialist/SKILL.md index 82fa965..a687853 100644 --- a/plugins/agent-collab/skills/kubernetes-specialist/SKILL.md +++ b/plugins/agent-collab/skills/kubernetes-specialist/SKILL.md @@ -1,6 +1,6 @@ --- name: kubernetes-specialist -version: 4.5.0 +version: 4.5.1 description: Designs, hardens, and troubleshoots Kubernetes clusters and the workloads running on them. Use when the user says "review this Kubernetes manifest", "why is my pod crash-looping", or "help me design a multi-tenant cluster", or "/agent-collab:kubernetes-specialist." Also offer this proactively when a change touches Deployment/StatefulSet/DaemonSet specs, RBAC bindings, network policies, or persistent volume claims. --- diff --git a/plugins/agent-collab/skills/llm-architect/SKILL.md b/plugins/agent-collab/skills/llm-architect/SKILL.md index e540c27..d654d69 100644 --- a/plugins/agent-collab/skills/llm-architect/SKILL.md +++ b/plugins/agent-collab/skills/llm-architect/SKILL.md @@ -1,6 +1,6 @@ --- name: llm-architect -version: 4.5.0 +version: 4.5.1 description: Designs the structural shape of an LLM-powered system — how context is assembled, how tools and retrieval are wired in, and how output flows to the caller. Use when the user says "design the RAG pipeline", "plan the agent architecture", or "help me structure the prompt pipeline", or "/agent-collab:llm-architect." Also offer this proactively when a project is wiring multiple prompts, tools, and retrieval steps together without a clear contract between them. --- diff --git a/plugins/agent-collab/skills/logic-check/SKILL.md b/plugins/agent-collab/skills/logic-check/SKILL.md index e609329..61819bd 100644 --- a/plugins/agent-collab/skills/logic-check/SKILL.md +++ b/plugins/agent-collab/skills/logic-check/SKILL.md @@ -1,6 +1,6 @@ --- name: logic-check -version: 4.5.0 +version: 4.5.1 defaults: tier: Advanced effort: xhigh diff --git a/plugins/agent-collab/skills/long-context/SKILL.md b/plugins/agent-collab/skills/long-context/SKILL.md index dcb44a6..a5668e4 100644 --- a/plugins/agent-collab/skills/long-context/SKILL.md +++ b/plugins/agent-collab/skills/long-context/SKILL.md @@ -1,6 +1,6 @@ --- name: long-context -version: 4.5.0 +version: 4.5.1 defaults: tier: Advanced effort: high diff --git a/plugins/agent-collab/skills/merge-resolve/SKILL.md b/plugins/agent-collab/skills/merge-resolve/SKILL.md index 5de06d1..7cb565d 100644 --- a/plugins/agent-collab/skills/merge-resolve/SKILL.md +++ b/plugins/agent-collab/skills/merge-resolve/SKILL.md @@ -1,6 +1,6 @@ --- name: merge-resolve -version: 4.5.0 +version: 4.5.1 defaults: tier: Advanced effort: high diff --git a/plugins/agent-collab/skills/migration-doctor/SKILL.md b/plugins/agent-collab/skills/migration-doctor/SKILL.md index 5e54f8d..474f057 100644 --- a/plugins/agent-collab/skills/migration-doctor/SKILL.md +++ b/plugins/agent-collab/skills/migration-doctor/SKILL.md @@ -1,6 +1,6 @@ --- name: migration-doctor -version: 4.5.0 +version: 4.5.1 description: Use when the user says "migration doctor," "check old collaboration plugins," "verify agent-collab migration," or "/agent-collab:migration-doctor." Also offer this proactively after installing or updating agent-collab, when provider routing is blocked, or when a retired package may still be selected from an installed plugin or cache. --- diff --git a/plugins/agent-collab/skills/mlops-engineer/SKILL.md b/plugins/agent-collab/skills/mlops-engineer/SKILL.md index 9a3a16e..c56fcea 100644 --- a/plugins/agent-collab/skills/mlops-engineer/SKILL.md +++ b/plugins/agent-collab/skills/mlops-engineer/SKILL.md @@ -1,6 +1,6 @@ --- name: mlops-engineer -version: 4.5.0 +version: 4.5.1 description: Designs and hardens the infrastructure that carries models from training through production serving. Use when the user says "set up a model registry", "build the training pipeline", "deploy this model to production", or "/agent-collab:mlops-engineer." Also offer this proactively when a project trains or serves models but has no versioned artifacts, no promotion gate, or no monitoring for prediction quality. --- diff --git a/plugins/agent-collab/skills/orchestrate/SKILL.md b/plugins/agent-collab/skills/orchestrate/SKILL.md index 1c7326b..55078f8 100644 --- a/plugins/agent-collab/skills/orchestrate/SKILL.md +++ b/plugins/agent-collab/skills/orchestrate/SKILL.md @@ -1,6 +1,6 @@ --- name: orchestrate -version: 4.5.0 +version: 4.5.1 defaults: tier: Standard effort: medium diff --git a/plugins/agent-collab/skills/postgres-engineer/SKILL.md b/plugins/agent-collab/skills/postgres-engineer/SKILL.md index 2243acf..3a10b7d 100644 --- a/plugins/agent-collab/skills/postgres-engineer/SKILL.md +++ b/plugins/agent-collab/skills/postgres-engineer/SKILL.md @@ -1,6 +1,6 @@ --- name: postgres-engineer -version: 4.5.0 +version: 4.5.1 description: Administers and hardens PostgreSQL at the engine level — configuration, replication, vacuum behavior, and locking under real workloads. Use when the user says "tune postgres for this workload", "design a vacuum strategy", "set up replication", or "fix our connection pooling", or "/agent-collab:postgres-engineer." Also offer this proactively when a PostgreSQL deployment shows replication lag, bloat, connection exhaustion, or a failover plan that has never been tested. --- diff --git a/plugins/agent-collab/skills/prompt-regression-tester/SKILL.md b/plugins/agent-collab/skills/prompt-regression-tester/SKILL.md index 58eed4b..e8de222 100644 --- a/plugins/agent-collab/skills/prompt-regression-tester/SKILL.md +++ b/plugins/agent-collab/skills/prompt-regression-tester/SKILL.md @@ -1,6 +1,6 @@ --- name: prompt-regression-tester -version: 4.5.0 +version: 4.5.1 description: Builds and runs comparison suites that catch behavioral drift when a prompt, model, or workflow configuration changes. Use when the user says "did the prompt change regress anything", "compare these prompt versions", "regression-test this prompt change", or "/agent-collab:prompt-regression-tester." Also offer this proactively when someone is about to swap a prompt, model, or tool wiring in a live workflow without a way to check whether existing behavior held. --- diff --git a/plugins/agent-collab/skills/qa-verify/SKILL.md b/plugins/agent-collab/skills/qa-verify/SKILL.md index 4404a38..3a8037c 100644 --- a/plugins/agent-collab/skills/qa-verify/SKILL.md +++ b/plugins/agent-collab/skills/qa-verify/SKILL.md @@ -1,6 +1,6 @@ --- name: qa-verify -version: 4.5.0 +version: 4.5.1 defaults: tier: Fast effort: low diff --git a/plugins/agent-collab/skills/red-team/SKILL.md b/plugins/agent-collab/skills/red-team/SKILL.md index be5b585..96c45a6 100644 --- a/plugins/agent-collab/skills/red-team/SKILL.md +++ b/plugins/agent-collab/skills/red-team/SKILL.md @@ -1,6 +1,6 @@ --- name: red-team -version: 4.5.0 +version: 4.5.1 defaults: tier: Advanced effort: high diff --git a/plugins/agent-collab/skills/route/SKILL.md b/plugins/agent-collab/skills/route/SKILL.md index 527ca09..ec709c5 100644 --- a/plugins/agent-collab/skills/route/SKILL.md +++ b/plugins/agent-collab/skills/route/SKILL.md @@ -1,6 +1,6 @@ --- name: route -version: 4.5.0 +version: 4.5.1 description: Use when the operator says "ask Codex," "target=gemini," "target=grok," "target=composer," or explicitly names a managed backend. Also offer this proactively when routing needs dynamic primary-family exclusion. --- @@ -32,19 +32,21 @@ managed worker target. Seal only supported native contracts: Gemini advisory, governance, and long-context are read-only; Codex advisory is read-only; OpenCode plan is read-only and OpenCode -build is mutation-capable workspace-write; Grok architecture, governance, and -huge-context are read-only; the `composer/codegen` compatibility route invokes -Grok 4.5 with output-only authority. Codex build +build is tool-capable only inside a private temporary workspace with output-only +authority to the caller; Grok architecture, governance, and huge-context are +read-only; the `composer/codegen` compatibility route invokes Grok 4.5 with +output-only authority. Codex build resolves as a separate mutation-capable role but is typed unavailable until the hardened backend exists, never advisory. Safe mode makes all five model- execution targets unavailable. A host async inbox is eligible only after an availability observation and exposes readiness only; the public coordinator never sends. -Managed provider execution uses canonical passwd HOME for reliable interactive -authentication state. This does not relax family exclusion, route authority, -the signed broker boundary, bounded lifecycle, or the prohibition on raw CLI -fallbacks. +Managed provider execution uses the canonical user HOME resolved from passwd +for reliable interactive authentication state. The caller checkout stays +read-only by default while each request receives a private temporary workspace. +This does not relax family exclusion, route authority, the signed broker +boundary, bounded lifecycle, or the prohibition on raw CLI fallbacks. Execution mechanics belong to the verified co-packaged native artifact. This skill contains no provider command and authorizes no direct invocation. diff --git a/plugins/agent-collab/skills/rust-engineer/SKILL.md b/plugins/agent-collab/skills/rust-engineer/SKILL.md index ca93584..f8b578b 100644 --- a/plugins/agent-collab/skills/rust-engineer/SKILL.md +++ b/plugins/agent-collab/skills/rust-engineer/SKILL.md @@ -1,6 +1,6 @@ --- name: rust-engineer -version: 4.5.0 +version: 4.5.1 description: Senior Rust engineer for ownership-heavy, performance-sensitive, and systems-level code. Use when the user says "review this Rust code for soundness", "help me fix this borrow checker error", "optimize this Rust hot path", or "/agent-collab:rust-engineer." Also offer this proactively when a diff introduces unsafe blocks, changes lifetime bounds, or touches an async task's cancellation path. --- diff --git a/plugins/agent-collab/skills/second-opinion/SKILL.md b/plugins/agent-collab/skills/second-opinion/SKILL.md index a634dc3..194e431 100644 --- a/plugins/agent-collab/skills/second-opinion/SKILL.md +++ b/plugins/agent-collab/skills/second-opinion/SKILL.md @@ -1,6 +1,6 @@ --- name: second-opinion -version: 4.5.0 +version: 4.5.1 defaults: tier: Advanced effort: high diff --git a/plugins/agent-collab/skills/simulate-user/SKILL.md b/plugins/agent-collab/skills/simulate-user/SKILL.md index 58b75bd..b43538a 100644 --- a/plugins/agent-collab/skills/simulate-user/SKILL.md +++ b/plugins/agent-collab/skills/simulate-user/SKILL.md @@ -1,6 +1,6 @@ --- name: simulate-user -version: 4.5.0 +version: 4.5.1 defaults: tier: Fast effort: low diff --git a/plugins/agent-collab/skills/sql-engineer/SKILL.md b/plugins/agent-collab/skills/sql-engineer/SKILL.md index 0d35837..cf69e5b 100644 --- a/plugins/agent-collab/skills/sql-engineer/SKILL.md +++ b/plugins/agent-collab/skills/sql-engineer/SKILL.md @@ -1,6 +1,6 @@ --- name: sql-engineer -version: 4.5.0 +version: 4.5.1 description: Senior SQL specialist for query design, query optimization, and schema-aware performance work across relational databases. Use when the user says "optimize this SQL query", "explain this query plan", "design these indexes", or "/agent-collab:sql-engineer." Also offer this proactively when a diff adds a new query against a large table, changes a join or aggregation, or introduces a schema change that could affect an existing access pattern. --- diff --git a/plugins/agent-collab/skills/sre-engineer/SKILL.md b/plugins/agent-collab/skills/sre-engineer/SKILL.md index c1c75da..e2a03b8 100644 --- a/plugins/agent-collab/skills/sre-engineer/SKILL.md +++ b/plugins/agent-collab/skills/sre-engineer/SKILL.md @@ -1,6 +1,6 @@ --- name: sre-engineer -version: 4.5.0 +version: 4.5.1 description: Builds and improves system reliability through SLO design, error-budget policy, toil reduction, and resilience architecture. Use when the user says "help me define SLOs for this service", "what's our error budget burn rate", or "reduce the toil in this on-call rotation", or "/agent-collab:sre-engineer." Also offer this proactively when a reliability review, capacity plan, or alert-quality audit is warranted ahead of a launch or growth milestone. --- diff --git a/plugins/agent-collab/skills/start-inbox-monitor/SKILL.md b/plugins/agent-collab/skills/start-inbox-monitor/SKILL.md index 7e0c1ba..48bec72 100644 --- a/plugins/agent-collab/skills/start-inbox-monitor/SKILL.md +++ b/plugins/agent-collab/skills/start-inbox-monitor/SKILL.md @@ -1,6 +1,6 @@ --- name: start-inbox-monitor -version: 4.5.0 +version: 4.5.1 description: Use when the user says "start the inbox monitor", "keep monitoring agent messages", or "/agent-collab:start-inbox-monitor", or when an active cross-agent thread needs durable session-scoped inbox monitoring. Select the native Codex, Claude, or Antigravity lifecycle instead of inventing a universal polling loop. --- diff --git a/plugins/agent-collab/skills/teamwork/SKILL.md b/plugins/agent-collab/skills/teamwork/SKILL.md index 5229a71..703153b 100644 --- a/plugins/agent-collab/skills/teamwork/SKILL.md +++ b/plugins/agent-collab/skills/teamwork/SKILL.md @@ -1,6 +1,6 @@ --- name: teamwork -version: 4.5.0 +version: 4.5.1 defaults: tier: Standard effort: medium diff --git a/plugins/agent-collab/skills/terraform-engineer/SKILL.md b/plugins/agent-collab/skills/terraform-engineer/SKILL.md index f704e0d..a965960 100644 --- a/plugins/agent-collab/skills/terraform-engineer/SKILL.md +++ b/plugins/agent-collab/skills/terraform-engineer/SKILL.md @@ -1,6 +1,6 @@ --- name: terraform-engineer -version: 4.5.0 +version: 4.5.1 description: Designs, refactors, and reviews Terraform infrastructure-as-code across cloud providers, with a focus on module contracts, state safety, and reviewable plans. Use when the user says "review this Terraform plan", "help me design a reusable module", or "why did this apply want to replace my resource", or "/agent-collab:terraform-engineer." Also offer this proactively when a change touches module interfaces, state backend configuration, or resource lifecycle blocks. --- diff --git a/plugins/agent-collab/skills/ui-to-code/SKILL.md b/plugins/agent-collab/skills/ui-to-code/SKILL.md index bdccd34..fa9f996 100644 --- a/plugins/agent-collab/skills/ui-to-code/SKILL.md +++ b/plugins/agent-collab/skills/ui-to-code/SKILL.md @@ -1,6 +1,6 @@ --- name: ui-to-code -version: 4.5.0 +version: 4.5.1 defaults: tier: Advanced effort: high diff --git a/plugins/agent-collab/skills/untrusted-audit/SKILL.md b/plugins/agent-collab/skills/untrusted-audit/SKILL.md index 2ea08c1..4597664 100644 --- a/plugins/agent-collab/skills/untrusted-audit/SKILL.md +++ b/plugins/agent-collab/skills/untrusted-audit/SKILL.md @@ -1,6 +1,6 @@ --- name: untrusted-audit -version: 4.5.0 +version: 4.5.1 description: Audit an external or untrusted source before using it in code, skills, plugins, workflows, prompts, or operations. Use when the user says "audit this untrusted source," "can we use this repo," "review this gist," "prompt injection audit," "is this plugin safe," "evaluate this methodology," or "/agent-collab:untrusted-audit." Also offer this proactively when a task would incorporate third-party instructions, code, scripts, hooks, generated skills, package manifests, install steps, or auto-updated methodology into the workspace or agent environment. --- diff --git a/plugins/agent-collab/skills/visual-review/SKILL.md b/plugins/agent-collab/skills/visual-review/SKILL.md index c92ec65..8245827 100644 --- a/plugins/agent-collab/skills/visual-review/SKILL.md +++ b/plugins/agent-collab/skills/visual-review/SKILL.md @@ -1,6 +1,6 @@ --- name: visual-review -version: 4.5.0 +version: 4.5.1 defaults: tier: Advanced effort: high diff --git a/plugins/agent-collab/skills/worker/SKILL.md b/plugins/agent-collab/skills/worker/SKILL.md index 3885f6c..84ab9d4 100644 --- a/plugins/agent-collab/skills/worker/SKILL.md +++ b/plugins/agent-collab/skills/worker/SKILL.md @@ -1,6 +1,6 @@ --- name: worker -version: 4.5.0 +version: 4.5.1 description: Use when the operator says "delegate this implementation," "use Gemini for this corpus," "ask Codex to build," or "use Composer for codegen." Also offer this proactively when a bounded non-governance task benefits from a managed worker. --- @@ -19,9 +19,10 @@ plan and build never promote, demote, or silently fall back into one another. Honor an explicit target only through the matching sealed route/action. Gemini long-context and Grok huge-context are read-only; Grok has no generic -worker action. OpenCode build is mutation-capable workspace-write, while the -`composer/codegen` compatibility route invokes Grok 4.5 with constrained -output-only authority. Codex build remains a distinct +worker action. OpenCode build may use tools and modify a private temporary +workspace, but it returns output-only material and cannot write the caller +checkout. The `composer/codegen` compatibility route likewise invokes Grok 4.5 +with constrained output-only authority. Codex build remains a distinct mutation-capable role but is typed unavailable until its hardened backend exists and may not fall back to advisory. Automatic worker routing is temporarily unavailable in the closed coordinator schema; require an explicit diff --git a/scripts/skill-build-config.json b/scripts/skill-build-config.json index df2dc24..36f0ccd 100644 --- a/scripts/skill-build-config.json +++ b/scripts/skill-build-config.json @@ -20,7 +20,7 @@ "tier_flash_resolves_to_claude": "an asynchronous Anthropic inbox review; never a synchronous invocation", "tier_pro_resolves_to_gemini": "an eligible managed Google-family reviewer at high effort", "tier_flash_resolves_to_gemini": "an eligible managed Google-family reviewer at low effort", - "skill_version": "4.5.0", + "skill_version": "4.5.1", "agent_runtime_status_defaults_block": "defaults:\n tier: Fast\n effort: low\n", "merge_resolve_defaults_block": "defaults:\n tier: Advanced\n effort: high\n", "merge_resolve_call_params": "`effort='high'` in every eligible advisory row and no `tier` request field", diff --git a/skill-specs/dev-delegate.md b/skill-specs/dev-delegate.md index f2215e0..84c3f1f 100644 --- a/skill-specs/dev-delegate.md +++ b/skill-specs/dev-delegate.md @@ -19,8 +19,9 @@ and preserves artifact provenance. Never discover a provider executable. ## Supported model routes - OpenCode `plan`: read-only plan in one contained cwd. -- OpenCode `build`: mutation-capable workspace-write execution within one - contained cwd; no `.git`, commit, push, PR, merge, or deploy authority. +- OpenCode `build`: tool-capable execution in one private temporary workspace, + returning output-only material; the caller checkout stays read-only and the + route has no `.git`, commit, push, PR, merge, or deploy authority. - Grok 4.5 through the `composer/codegen` compatibility route: output-only patch/code JSON; no workspace tools. Seal simple work as low effort, standard fixes/features as medium, and complex multi-file or architecture work as high. diff --git a/skill-specs/route.md b/skill-specs/route.md index 3758361..78c4217 100644 --- a/skill-specs/route.md +++ b/skill-specs/route.md @@ -32,19 +32,21 @@ managed worker target. Seal only supported native contracts: Gemini advisory, governance, and long-context are read-only; Codex advisory is read-only; OpenCode plan is read-only and OpenCode -build is mutation-capable workspace-write; Grok architecture, governance, and -huge-context are read-only; the `composer/codegen` compatibility route invokes -Grok 4.5 with output-only authority. Codex build +build is tool-capable only inside a private temporary workspace with output-only +authority to the caller; Grok architecture, governance, and huge-context are +read-only; the `composer/codegen` compatibility route invokes Grok 4.5 with +output-only authority. Codex build resolves as a separate mutation-capable role but is typed unavailable until the hardened backend exists, never advisory. Safe mode makes all five model- execution targets unavailable. A host async inbox is eligible only after an availability observation and exposes readiness only; the public coordinator never sends. -Managed provider execution uses canonical passwd HOME for reliable interactive -authentication state. This does not relax family exclusion, route authority, -the signed broker boundary, bounded lifecycle, or the prohibition on raw CLI -fallbacks. +Managed provider execution uses the canonical user HOME resolved from passwd +for reliable interactive authentication state. The caller checkout stays +read-only by default while each request receives a private temporary workspace. +This does not relax family exclusion, route authority, the signed broker +boundary, bounded lifecycle, or the prohibition on raw CLI fallbacks. Execution mechanics belong to the verified co-packaged native artifact. This skill contains no provider command and authorizes no direct invocation. diff --git a/skill-specs/worker.md b/skill-specs/worker.md index 44c3581..a7f18eb 100644 --- a/skill-specs/worker.md +++ b/skill-specs/worker.md @@ -19,9 +19,10 @@ plan and build never promote, demote, or silently fall back into one another. Honor an explicit target only through the matching sealed route/action. Gemini long-context and Grok huge-context are read-only; Grok has no generic -worker action. OpenCode build is mutation-capable workspace-write, while the -`composer/codegen` compatibility route invokes Grok 4.5 with constrained -output-only authority. Codex build remains a distinct +worker action. OpenCode build may use tools and modify a private temporary +workspace, but it returns output-only material and cannot write the caller +checkout. The `composer/codegen` compatibility route likewise invokes Grok 4.5 +with constrained output-only authority. Codex build remains a distinct mutation-capable role but is typed unavailable until its hardened backend exists and may not fall back to advisory. Automatic worker routing is temporarily unavailable in the closed coordinator schema; require an explicit diff --git a/tests/test_structural_containment_authority_contract.py b/tests/test_structural_containment_authority_contract.py new file mode 100644 index 0000000..4ce9f7d --- /dev/null +++ b/tests/test_structural_containment_authority_contract.py @@ -0,0 +1,76 @@ +"""Public authority and containment semantics for managed provider execution.""" + +from __future__ import annotations + +import importlib.util +import sys +import unittest +from pathlib import Path + + +ROOT = Path(__file__).resolve().parents[1] +PLUGIN = ROOT / "plugins" / "agent-collab" + + +def _load_host_policy(): + spec = importlib.util.spec_from_file_location( + "structural_containment_host_policy", PLUGIN / "host_policy.py" + ) + assert spec is not None and spec.loader is not None + module = importlib.util.module_from_spec(spec) + sys.modules[spec.name] = module + spec.loader.exec_module(module) + return module + + +class StructuralContainmentAuthorityContractTests(unittest.TestCase): + @classmethod + def setUpClass(cls) -> None: + cls.policy = _load_host_policy() + + def test_opencode_build_returns_output_without_caller_workspace_authority( + self, + ) -> None: + self.assertEqual( + self.policy.AUTHORITIES[("opencode", "build")], + "output_only", + ) + + def test_public_worker_contract_uses_private_workspace(self) -> None: + paths = ( + ROOT / "README.md", + PLUGIN / "README.md", + ROOT / "skill-specs" / "worker.md", + ROOT / "skill-specs" / "dev-delegate.md", + ROOT / "skill-specs" / "route.md", + PLUGIN / "skills" / "worker" / "SKILL.md", + PLUGIN / "skills" / "dev-delegate" / "SKILL.md", + PLUGIN / "skills" / "route" / "SKILL.md", + ) + combined = "\n".join(path.read_text(encoding="utf-8") for path in paths) + normalized = " ".join(combined.split()).lower() + self.assertIn("private temporary workspace", normalized) + self.assertIn("output-only", normalized) + self.assertNotIn("opencode build is mutation-capable workspace-write", normalized) + self.assertNotIn("opencode build with exact workspace-write authority", normalized) + + def test_public_docs_define_structural_rare_containment_failure(self) -> None: + combined = "\n".join( + path.read_text(encoding="utf-8") + for path in (ROOT / "README.md", PLUGIN / "README.md") + ) + normalized = " ".join(combined.split()).lower() + for phrase in ( + "canonical user home", + "blocked access attempt", + "containment success", + "structural containment failure", + "authentication, protocol/output, timeout, provider, teardown, and cleanup", + "direct cli", + ): + with self.subTest(phrase=phrase): + self.assertIn(phrase, normalized) + + +if __name__ == "__main__": + unittest.main() From 5c783dbf217695af16feb0a6fa2c63fb5154a01a Mon Sep 17 00:00:00 2001 From: John Osumi <931193+sumitake@users.noreply.github.com> Date: Sat, 25 Jul 2026 22:32:44 -0700 Subject: [PATCH 2/2] docs: state managed same-UID read boundary --- README.md | 5 +++++ plugins/agent-collab/README.md | 5 +++++ tests/test_structural_containment_authority_contract.py | 2 ++ 3 files changed, 12 insertions(+) diff --git a/README.md b/README.md index a992e3c..a4d35cf 100644 --- a/README.md +++ b/README.md @@ -285,6 +285,11 @@ binary auto-update is disabled, execution is bounded, descendants are reaped, and temporary cleanup is positively verified. OpenCode build is sealed output-only: its private-workspace changes are returned for trusted-primary review and application rather than written into the caller checkout. +Canonical HOME is not a deny-all-read confidentiality boundary: providers +operate under explicit same-UID read trust so authenticated CLIs, +loaders, and tools remain reliable. The structural boundary confines writes, +execution/lifecycle, provider-state access, protected paths, and request +cleanup; provider-specific overlays may narrow reads further. A blocked access attempt inside an established boundary is containment success and does not by itself fail an invocation. A structural containment failure is diff --git a/plugins/agent-collab/README.md b/plugins/agent-collab/README.md index 0c1001a..864218e 100644 --- a/plugins/agent-collab/README.md +++ b/plugins/agent-collab/README.md @@ -134,6 +134,11 @@ auto-update is disabled, execution is bounded, descendants are reaped, and temporary cleanup is positively verified. OpenCode build is sealed output-only: its private-workspace changes are returned for trusted-primary review and application rather than written into the caller checkout. +Canonical HOME is not a deny-all-read confidentiality boundary: providers +operate under explicit same-UID read trust so authenticated CLIs, +loaders, and tools remain reliable. The structural boundary confines writes, +execution/lifecycle, provider-state access, protected paths, and request +cleanup; provider-specific overlays may narrow reads further. A blocked access attempt inside an established boundary is containment success, not an invocation failure. Structural containment failure is reserved for a diff --git a/tests/test_structural_containment_authority_contract.py b/tests/test_structural_containment_authority_contract.py index 4ce9f7d..5272ac9 100644 --- a/tests/test_structural_containment_authority_contract.py +++ b/tests/test_structural_containment_authority_contract.py @@ -62,6 +62,8 @@ def test_public_docs_define_structural_rare_containment_failure(self) -> None: normalized = " ".join(combined.split()).lower() for phrase in ( "canonical user home", + "same-uid read trust", + "not a deny-all-read confidentiality boundary", "blocked access attempt", "containment success", "structural containment failure",