Repository navigation
id: design: output safety beyond plain text — HTML/JS output modes, safe-plain as a user choice, ingest without execution (follow-on to #3455) #5785
Description
Summary
Design the output-safety contract beyond plain terminal text: HTML/JS-bearing output modes, safe-plain rendering as a user choice, and servers ingesting arbitrary data without executing it. This is the follow-on #3455's own record flags as not covered.
Motivation
#3455 (closed, sub-issues 4/4) settled the plain-output contract: a value cannot act on the terminal — one Cf/Cc set, escape-at-render, printer-not-ingest. But the answers review (PR #5707, §10) records three extensions Drew raised that the filed contract explicitly does not cover, plus one open question the design doc itself left filed-nowhere:
"Explicitly NOT covered by #3455: ANSI/OSC terminal sequences — 'no filed instance,' listed in the design doc's open questions." And Drew's extensions: "HTML/JS-bearing output modes that some applications require; safe-plain rendering offered as a user choice; servers ingesting arbitrary data without executing it" — "flagged as a candidate follow-on design, not as part of #3455."
This issue is that follow-on. The risk shape is the same one #3455 named — a value acts on its consumer — with the consumer changed: a browser DOM, a rendering mode the user picked, or a server process that stores and forwards data it must never execute.
Sketch
- HTML/JS-bearing output modes: which ID surfaces may emit markup at all (programs-as-websites, id(serve): design — how does a program appear as a website? (program-only ports, mixed ports, path mounts) #2146/id: design: Markup & styling model for programs-as-websites — semantic markup, style-override mapping #5679, is the obvious one), and under what contract a data value may enter markup — escaping contexts (text, attribute, URL, script), the equivalent of Design: a value cannot act on the terminal — one format-character (Cf) contract for pkgs/id plain output #3455's "one shared set" for markup contexts, and who owns the set.
- Safe-plain as a user choice: rendering offered as a user-selected mode (plain-safe vs rich) per surface — what the choice means, its default, and whether it is per-client, per-world, or per-field; the plain mode's contract is Design: a value cannot act on the terminal — one format-character (Cf) contract for pkgs/id plain output #3455's, this design covers the choice and the rich side.
- Ingest without execution: servers (and bridges/relays) that ingest arbitrary data — the guarantees that stored data is never evaluated anywhere downstream: no template evaluation, no markup rendering without the contract above, no terminal emission without Design: a value cannot act on the terminal — one format-character (Cf) contract for pkgs/id plain output #3455 — stated as one ingest-side rule composing the two render-side contracts.
- ANSI/OSC: disposition the open question — are terminal escape sequences a Design: a value cannot act on the terminal — one format-character (Cf) contract for pkgs/id plain output #3455-class problem (values acting on the terminal through a second channel), and if so which surfaces refuse, escape, or pass them?
Open questions
- Does the markup contract live beside the Cf set as a sibling shared definition, or is one "output safety" module the home for both?
- Is safe-plain a rendering mode or a data classification (sensitivity-style, per id: design: Querying local and remote ID servers v1 #5675's model)?
- Which existing surfaces already emit markup with data values in them today — the audit list is a deliverable.
Relations
Parent: epic #2056. Relations: #3455 (the plain contract this extends; its open questions and Drew's extensions are the source), #2146 + #5679 (markup-emitting surfaces), #5675 (classification model), #3231 (receipt-side sibling: values validated as strictly as built — this is the emission-side counterpart). Filed in the 2026-11-04 gap pass (WS-F).
Activity
developing-today commentedon Nov 5, 2026
CODE-1468
developing-today commentedon Nov 5, 2026
🤖 Agent note · handed off
dezren39 commentedon Nov 5, 2026
🤖 Agent note · state: handed off
dezren39 commentedon Nov 5, 2026
🤖 Agent note · handed off
23 remaining items
dezren39 commentedon Nov 5, 2026
🤖 Agent note · handed off
developing-today commentedon Nov 5, 2026
🤖 Agent note · handed off
opencodebyfleet queue lane; handed off to the opencode claimant, which launches the bound session. This lane does not work the task directly.developing-today commentedon Nov 5, 2026
🤖 Agent note · handed off
opencode