Repository navigation
id: Phase 13 F13.7 client-side capability providers under the ceiling model #789
Description
What and why
Extend scopes, roles and ceilings to named, granted, ceilinged capability providers that run on the client for local resources (a bounded local file read, a GPU buffer, a native notification), keeping the Phase 12 rule that no authority path exists outside named ceilinged providers. The guest requests them through the existing capability protocol; the reply is a bounded capability reply, never a new host-authority path.
Source
- Phase 13 plan — F13.7
- id: write the Phase 13 plan: client shells and client capability providers #564 (Phase 13 plan task)
- id: native client shells and client capabilities #538 (native client shells and client capabilities) — D1-055
Current status
Not started. Capability execution is host-side only (pkgs/id/src/world/actor.rs); the catalog is hard-coded (the CATALOG constant in pkgs/id/src/world_caps.rs).
Acceptance criteria
- A client provider is added without editing the host
CATALOG(F12.4 manifest shape) - It appears under a ceiling, is refused when over it, and leaves an audit entry (F12.6 contract)
- It adds no Wasm import (the guest stays import-free, pkgs/id/src/sandbox.rs:1-8)
- The design answers "who grants" (world/admin vs the client's own user)
Size
XL
Prerequisites
- id: Phase 12 designs to run through the research workflow #534 (tracking) — D1-022 F12.4 capability provider registry (manifested components)
- id: Phase 12 designs to run through the research workflow #534 (tracking) — D1-024 F12.6 structured audit log with OpenTelemetry export
Metadata
Metadata
Assignees
Labels
Package/app: id (pkgs/ or apps/ in this repo)Large: multi-day or open-ended; expect staged check-insNew feature or requestNew feature or capability requestIntake review done: acceptance criteria, links, and normalized labels addedFully doable remotely: design, config, code, cloudNice to have; do when convenientFiled directly by a humanQueue or user escalation state
Activity
developing-today commentedon Oct 24, 2026
CODE-117
docs(id): Phase 14 plan — close-out: finish, measure, verify, open th…
docs(id): design client-side capability providers under the ceiling m…
dezren39 commentedon Oct 25, 2026
Design landed on PR #842: doc/2026-10-25T05-37-57Z_design_client_capability_providers/. Implementation remains gated on F12.4 + F12.6 (+ F11.12 for new frame kinds). Spun out #837, #838, #839, #840, #841 from the design pass.
dezren39 commentedon Oct 26, 2026
Intake review
Fleet monitor intake pass (protocol §5).
Related: Phase 13 sibling set — #785 (F13.3), #786 (F13.4), #787 (F13.5), #788 (F13.6), #789 (F13.7), #790 (F13.8); this issue is F13.7 client-side capability providers under the ceiling model. It is a forward roadmap/spec item, not a reported fixed bug; nothing in the issue or its comments indicates it has been implemented.
Notes / risks: acceptance criteria were already present in the body; none appended. Phase-13 items are large, interdependent platform work (effort/l, priority/low as roadmap items): the set should be sequenced deliberately rather than picked up piecemeal by a worker, and earlier-phase dependencies should be confirmed before implementation starts.
Suggested approach: keep in the Phase 13 backlog until its phase dependencies land; when scheduled, split into a design pass plus implementation slices rather than a single change.
Labels normalized by the monitor.
7 remaining items
docs(id): design F13.7 client capability providers (#789)
dezren39 commentedon Nov 1, 2026
Design summary
doc/2026-11-01_design_id789.md.side: clientprovider broker; the guest gains no Wasm import.client.file.readas the first provider; GPU and notification providers are deferred.PR: #3828
Phased plan, briefly: First clear #838, then land F12.4/#1061 and F12.6/#1063; also resolve session attribution #840 and restart semantics #839. After the F11.12 gate, land the manifest/protocol contract, broker with a fake adapter, client-local consent/audit, bounded file-read adapter, and end-to-end replay/security checks.
Questions that need Drew (recommendations are recorded in the note):
actor_denied/restarted; B) journal handled IDs for durable idempotency; C) re-run at least once. Recommend A.dezren39 commentedon Nov 1, 2026
Triage record — task 5763 (queue) for #789, F13.7 client-side capability providers
Verdict: triaged — decision-ready design record exists and is adopted; implementation is a gated build whose gate packets are already enqueued; three questions are escalated to Drew (non-blocking for the design, blocking for the named slices).
What already exists (verified fresh this run)
design/id-789, docs-only:doc/2026-11-01_design_id789.md), consolidating the earlier PR id: Phase 13 first slice — shell contract (F13.1), SSH transports (F13.2/F13.3), F13.7 design #842 design with current code. Its summary was posted on this issue at 2026-11-01T16:57Z, minutes before this triage was claimed — so this record verifies and wires it rather than writing a parallel one.side: clientprovider broker. The guest gains no Wasm import; requests travel the existing capability protocol and the reply is a bounded capability reply, never a new host-authority path. First provider: read-onlyclient.file.read; GPU and notification providers are explicitly deferred.origin/main73423be04: the catalog is still the hard-codedpub const CATALOGatpkgs/id/src/world_caps.rs:72(the thing criterion 1 stops editing);pkgs/id/src/sandbox.rs's module doc still states the guest receives no imports (no WASI/filesystem/sockets/clocks/random) — the import-free invariant the design preserves. Prior triage (task 2216, 2026-10-28) confirmed capability execution is host-side only (pkgs/id/src/world/actor.rs); nothing since has changed that.Invariants the implementation must hold (from the design, §5–§6)
CATALOG(F12.4 manifest shape); it appears under a ceiling, is refused when over it, and leaves an audit entry (F12.6 contract) — host-side audit covers allow/deny/completion with provider version and an opaque correlation ID; client-local enforcement keeps its own log.Phased packets — the gate chain is already enqueued; the F13.7 slices are gated on it
The design's six slices (contract/registry shape → protocol v2 types → host broker with fake adapter → client grant + local audit →
client.file.readadapter → end-to-end hardening) cannot start until Gates 1–4 land. Those gates are existing issues with live queue packets — they are the executable next steps, listed here with dedupe keys:repo-health:v1:triage:developing-today/code:issue:838repo-health:v1:fix:developing-today/code:issue:1061repo-health:v1:fix:developing-today/code:issue:1063repo-health:v1:fix:developing-today/code:issue:840repo-health:v1:triage:developing-today/code:issue:839Explicit statement per the triage packet: no fix packet for #789 itself is enqueued now, deliberately — every F13.7 slice depends on at least one unlanded gate, and a claimable packet whose work cannot start would be queue noise (same call as the earlier task 2216 triage of this issue and the gated-design precedent elsewhere in this batch). When Gates 1–4 land, the six slices are enqueued as phased fix packets under dedupe key
repo-health:v1:fix:developing-today/code:issue:789(one packet per slice, in the design's step order).Questions escalated to Drew (
user/escalatedadded; recommendations are the design's)These do not block the design record or the gate chain; they block the named slices from making an irreversible choice.
client.file.readbytes enter the guest result event and become journaled, replayable world history. (A) Accept that model with explicit consent disclosure; (B) require digest-only / non-journaled results (needs a separate data-model design); (C) drop file read from the first slice. Recommend A; B deferred to F12.13. Gates Step 5.actor_denied/restarteduntil new participant input; (B) journal handled IDs for durable idempotency; (C) re-run at least once. Recommend A — fail-closed, never attributes a device read to nobody, adds no journal state. Decided on id(world): capability requests in wants re-execute unattributed after a world reopen #839; gates Steps 3 and 6.Until Drew answers or accepts the recommendations, implementers should treat A/C/A above as the working defaults for design purposes only, and not land the irreversible parts of Steps 4–5.
dezren39 commentedon Nov 1, 2026
Agent note (task 5763, lane E): triage DONE — record at #789 (comment). Design record adopted from PR #3828; gate packets listed there; the three §9 questions carry
user/escalated(recommendations recorded; they gate implementation Steps 4–5 and the #839 decision, not the design or the gate chain). Claim labels removed; issue stays open.Merge pull request #3828 from developing-today/design/id-789