Andy Dixon
937c5fb2ff
- Capabilities declare access (read/write, unknown fails closed as write), side effects, idempotency, timeout, cost estimate and the trust of their output (web content is low trust). A capability may derive its policy target from its parameters; a disagreeing target is refused, and approvals whose modified parameters change the target are refused. - The registry is frozen at start-up; registration afterwards panics. - Invocation.RequireApproval turns ALLOW into ASK for commitments; it can only tighten, and scoped grants never satisfy it. - Scoped grants (migration 0025): capability, target and parameter globs, access, expiry of at most seven days and an optional operation count consumed atomically; applied only where policy says ASK. A sweep marks lapsed grants and refreshes the self-model, which now lists live grants. - Capability requests carry scope, duration, operation cap, reason, evidence, risk, mitigation, fallback, alternatives and explicit decision history; they batch per intention, are capped per mind (operator attention budget) and can be decided only by a named person. Component names are refused as deciders, for approvals too, and as usernames. - API routes, OpenAPI entries, scheduler sweeps and approval-centre sections for requests and temporary grants.
58 lines
3.0 KiB
SQL
58 lines
3.0 KiB
SQL
-- Scoped temporary grants and structured capability requests (PLAN §8.2 item 9).
|
|
-- Grants are operator decisions: expiring, optionally counted, restricted by
|
|
-- target, parameters and access. Requests are what a mind asks for; only an
|
|
-- operator route can decide them.
|
|
|
|
CREATE TABLE capability_grants (
|
|
id uuid PRIMARY KEY,
|
|
mind_id uuid NOT NULL REFERENCES minds(id),
|
|
capability text NOT NULL,
|
|
target_pattern text NOT NULL DEFAULT '*',
|
|
param_constraints jsonb NOT NULL DEFAULT '{}'::jsonb, -- parameter name → glob the value must match
|
|
access text NOT NULL DEFAULT 'read' CHECK (access IN ('read','write')),
|
|
max_operations integer CHECK (max_operations IS NULL OR max_operations > 0),
|
|
used_operations integer NOT NULL DEFAULT 0 CHECK (used_operations >= 0),
|
|
expires_at timestamptz NOT NULL,
|
|
granted_by text NOT NULL,
|
|
request_id uuid,
|
|
note text NOT NULL DEFAULT '',
|
|
revoked_at timestamptz,
|
|
revoked_by text NOT NULL DEFAULT '',
|
|
expiry_notified_at timestamptz,
|
|
created_at timestamptz NOT NULL DEFAULT now(),
|
|
CHECK (max_operations IS NULL OR used_operations <= max_operations)
|
|
);
|
|
CREATE INDEX capability_grants_mind_idx ON capability_grants (mind_id, capability) WHERE revoked_at IS NULL;
|
|
|
|
CREATE TABLE capability_requests (
|
|
id uuid PRIMARY KEY,
|
|
mind_id uuid NOT NULL REFERENCES minds(id),
|
|
capability text NOT NULL,
|
|
target_pattern text NOT NULL DEFAULT '*',
|
|
param_constraints jsonb NOT NULL DEFAULT '{}'::jsonb,
|
|
access text NOT NULL DEFAULT 'read' CHECK (access IN ('read','write')),
|
|
duration_seconds integer NOT NULL CHECK (duration_seconds > 0 AND duration_seconds <= 604800),
|
|
max_operations integer CHECK (max_operations IS NULL OR max_operations > 0),
|
|
reason text NOT NULL,
|
|
evidence jsonb NOT NULL DEFAULT '[]'::jsonb,
|
|
risk text NOT NULL DEFAULT '',
|
|
mitigation text NOT NULL DEFAULT '',
|
|
fallback text NOT NULL DEFAULT '',
|
|
alternatives jsonb NOT NULL DEFAULT '[]'::jsonb,
|
|
history jsonb NOT NULL DEFAULT '{}'::jsonb, -- explicit past decisions on this capability, for the operator
|
|
intention_id uuid,
|
|
plan_id uuid,
|
|
step_id uuid,
|
|
batch_key text NOT NULL DEFAULT '',
|
|
status text NOT NULL DEFAULT 'pending' CHECK (status IN ('pending','granted','denied','expired','withdrawn')),
|
|
decided_by text NOT NULL DEFAULT '',
|
|
decision_note text NOT NULL DEFAULT '',
|
|
decided_at timestamptz,
|
|
grant_id uuid REFERENCES capability_grants(id),
|
|
event_id uuid,
|
|
expires_at timestamptz NOT NULL,
|
|
created_at timestamptz NOT NULL DEFAULT now()
|
|
);
|
|
CREATE INDEX capability_requests_status_idx ON capability_requests (status, created_at DESC);
|
|
CREATE INDEX capability_requests_mind_idx ON capability_requests (mind_id, created_at DESC);
|