diff --git a/.yoi/tickets/00001KV5W3PJ3/artifacts/orchestration-plan.jsonl b/.yoi/tickets/00001KV5W3PJ3/artifacts/orchestration-plan.jsonl new file mode 100644 index 00000000..73de705c --- /dev/null +++ b/.yoi/tickets/00001KV5W3PJ3/artifacts/orchestration-plan.jsonl @@ -0,0 +1 @@ +{"id":"orch-plan-20260618-131145-1","ticket_id":"00001KV5W3PJ3","kind":"accepted_plan","accepted_plan":{"summary":"Accept Plugin permission grant enforcement work. Implement typed requested/granted permission matching for Plugin Tool registration/execution and future host API denial diagnostics, fail-closed without implementing fs/https APIs.","branch":"impl/00001KV5W3PJ3-plugin-permission-grants","worktree":"/home/hare/Projects/yoi/.worktree/00001KV5W3PJ3-plugin-permission-grants","role_plan":"Orchestrator creates dedicated implementation worktree and spawns Coder with write scope limited to that worktree. Reviewer will run read-only after implementation report. Dependency `00001KV5W3PHW` is done and workspace is clean."},"author":"yoi-orchestrator","at":"2026-06-18T13:11:45Z"} diff --git a/.yoi/tickets/00001KV5W3PJ3/item.md b/.yoi/tickets/00001KV5W3PJ3/item.md index 607a82f1..fcc0ff2e 100644 --- a/.yoi/tickets/00001KV5W3PJ3/item.md +++ b/.yoi/tickets/00001KV5W3PJ3/item.md @@ -1,8 +1,8 @@ --- title: 'Plugin: enforce Plugin permission grants' -state: 'queued' +state: 'inprogress' created_at: '2026-06-15T14:48:59Z' -updated_at: '2026-06-18T13:11:00Z' +updated_at: '2026-06-18T13:12:47Z' assignee: null readiness: 'implementation_ready' risk_flags: ['plugin', 'permission', 'grant-enforcement', 'capability-boundary', 'tool-execution'] diff --git a/.yoi/tickets/00001KV5W3PJ3/thread.md b/.yoi/tickets/00001KV5W3PJ3/thread.md index be89a8c7..91873588 100644 --- a/.yoi/tickets/00001KV5W3PJ3/thread.md +++ b/.yoi/tickets/00001KV5W3PJ3/thread.md @@ -13,4 +13,112 @@ LocalTicketBackend によって作成されました。 Ticket を `workspace-panel` が queued にしました。 +--- + + + +## Decision + +Routing decision: implementation_ready + +Reason: +- Panel Queue により routing が明示的に許可され、Ticket は `queued`。 +- Ticket body / thread / relations / OrchestrationPlan / Orchestrator workspace state を確認した。 +- `depends_on 00001KV5W3PHW` は done/closed 済みで、Plugin Tool execution path が存在するため typed relation blocker は解消済み。 +- 本 Ticket は Plugin manifest の requested permissions と Profile/config grants を照合し、enablement / Tool registration / Tool execution / future host API dispatch の enforcement points を明確にする実装であり、`https` / `fs` host API 実装や broad policy UI は non-goal として明確。 +- permission / grant-enforcement / capability-boundary / tool-execution risk は高いが、fail-closed conditions、diagnostics、PreToolCall alignment、external_write handling が Ticket に具体化されているため implementation-ready と判断する。 + +Evidence checked: +- Ticket body/thread: requirements、initial grant model、acceptance criteria、non-goals、related work を確認。 +- Ticket relations: outgoing `depends_on 00001KV5W3PHW` は done/closed。related design `00001KSXRQ4G8` は blocker ではない。 +- OrchestrationPlan: 既存 record なし。 +- Orchestrator workspace: `/home/hare/Projects/yoi/.worktree/orchestration` は clean、`b6685af3` 上。 +- Visible Pods/worktrees: active implementation child なし。 + +IntentPacket: + +Intent: +- Plugin requested permissions と explicit grants を typed model で照合し、Plugin Tool registration/execution と future host API dispatch が grant なしでは fail closed になる boundary を実装する。 + +Binding decisions / invariants: +- Package presence / discovery / Tool registration だけで execution authority を得ない。 +- Requested but not granted は fail closed。 +- Unknown permission kind / unsupported grant / overly broad ambiguous grant は fail closed または explicit diagnostic。 +- Grant は package ref / source-qualified identity / digest / version と結びつけ、mismatch grant は使わない。 +- Permission declarations/grants を ambient workspace FS/network authority として扱わない。 +- `https` / `fs` host API の実行実装は non-goal。ただし requested/granted 型と denial diagnostics は扱う。 +- Tool effect / external_write metadata は existing permission / PreToolCall path と矛盾させない。 +- Denial diagnostics は bounded/safe で、hidden model context injection しない。 + +Requirements / acceptance criteria: +- Grant なしの Plugin Tool は登録または実行されず safe diagnostic になる。 +- Granted Tool だけが登録または実行可能になる。 +- Requested surface missing、requested tool missing、external_write missing、host API missing、digest/version/source mismatch、unknown permission kind は fail closed。 +- Denied reason が diagnostic / trace で確認できる。 +- Existing PreToolCall / Tool permission path と矛盾しない。 +- Tests cover no grant denies Plugin Tool execution, grant allows specific Plugin Tool, unrelated package grant does not apply, digest mismatch denies, requested surface missing denies, external_write missing denies, unknown permission kind fails closed, bounded safe denial reason。 + +Implementation latitude: +- Initial grant model は `surfaces.tool`, tool names/namespaces, external_write flag, `host_api.https`, `host_api.fs` を狭く始める。 +- Enforcement point のうち Tool registration と Tool execution のどちらで落とすかは実装判断。ただし model-visible schema gating と runtime execution gating の境界を実装報告に明記する。 +- Existing Plugin resolver / Tool surface / WASM runtime code に合わせて typed structs / diagnostics を配置してよい。 + +Escalate if: +- PreToolCall / Tool metadata public API の broad redesign が必要。 +- Grants を安全に package digest/version/source と結合できない。 +- Future host API dispatch boundary を追加するには runtime executor redesign が必要。 +- Permission UI/policy semantics を product decision として固定する必要が出る。 + +Validation: +- focused plugin permission/grant tests。 +- relevant `cargo test` / `cargo check`。 +- `cargo fmt --check`。 +- `git diff --check`。 +- `nix build .#yoi` if dependencies/Cargo.lock/package changes occur。 + +Critical risks / reviewer focus: +- fail-closed grant enforcement at registration and execution。 +- source/digest/version binding。 +- no ambient authority accidentally granted。 +- external_write/effect metadata and PreToolCall consistency。 +- bounded safe diagnostics。 +- Plugin Tool execution path from `00001KV5W3PHW` is gated by grants。 + +--- + + + +## State changed + +Routing decision と accepted implementation plan を記録済み。dependency `00001KV5W3PHW` は done/closed で relation blocker は解消済み。Orchestrator workspace は clean。implementation side effects の前に `queued -> inprogress` acceptance を記録する。 + +--- + + + +## Implementation report + +Implementation start failure / recovery note: + +`queued -> inprogress` acceptance と worktree 作成は完了したが、Coder Pod spawn に失敗した。 + +Created worktree: +- `/home/hare/Projects/yoi/.worktree/00001KV5W3PJ3-plugin-permission-grants` +- branch: `impl/00001KV5W3PJ3-plugin-permission-grants` + +Failure: +- `SpawnPod` failed before child Pod creation. +- Error: `failed to spawn /home/hare/Projects/yoi/target/debug/yoi (deleted) pod: No such file or directory (os error 2)` + +Interpretation: +- Runtime binary path for this long-lived Orchestrator process again points at a deleted executable. This is an operational/runtime issue, not a Ticket requirement issue. +- No Coder Pod was started and no implementation commit exists in the child worktree yet. + +Recovery needed: +- Refresh/restart the Orchestrator runtime or provide a valid Pod runtime command so `SpawnPod` can launch children again. +- After recovery, reuse the existing clean child worktree/branch and resume Coder spawn for this in-progress Ticket. + +State handling: +- Ticket remains `inprogress` because acceptance and worktree side effects already happened; it is not silently returned to `queued`. + ---