Slice 022: Core tools: filesystem, web, shell - #30
Merged
Merged
Conversation
…pens ROADMAP row 022 to in_progress. NOTES.md takes the two decisions the spec asks for before the slice, both open to the owner's veto: the shell is POSIX-only (MuonTrap 2.0.0 is a C port wrapper with no Windows build and the kill guarantee has no Windows implementation; a fallback that can orphan a process is not offered), and the search provider is Brave. Then the ten-line build plan, the two-item manual queue, and five deviations stated before any code. plan_check: PASS. Signed-off-by: Ayla Croft <aylacroft@proton.me>
floki for web_fetch's HTML to text. muontrap for the shell tool, declared in mix.exs only on a Unix host: it is a C port built with elixir_make and does not build on Windows, where the shell tool answers available?/0 false (NOTES.md, the Windows decision taken at G1). VERSIONS rows regenerated with what 2.0.0's cmd/3 takes; hex.audit and deps.audit clean. Signed-off-by: Ayla Croft <aylacroft@proton.me>
…ll, and provenance Lines 2 to 8 of the G1 plan. Trinity.Content.Part (origin, source_ref, digest, taint; max_taint/1) and Trinity.Tools.Untrusted: every tool result from outside the app is an untrusted part on the tool row, the Session tracks the turn's maximum taint over its history and its results and writes it on the assistant row, and the prompt renders a tainted tool row inside <untrusted source= ref= digest=> with the rule stated in the system prompt (AC11). Tool.escalate/2 (a tier a tool raises a call to from its arguments; only up) and available?/0; the runner passes the escalation and the request carries the effective tier; Permissions.effective_tier/2. Trinity.Tools.FS: roots (config, TRINITY_FS_ROOTS, the data directory, the session's cwd), resolve/2 through symlinks and the nearest existing ancestor, atomic writes, a backup ring of five, restore/2; FS.Placeholders (the write-validation hook); fs_read, fs_write, fs_edit (unique search, a unified diff), fs_list, fs_glob, fs_grep, each escalating outside the roots to :ask. Web.Fetch (Req, 20 s, 1 MB, Floki extraction, no JavaScript, non-public hosts :ask, no retries), SearchProvider with Brave and Fake, web_search. Shell.Run under MuonTrap (/bin/sh -c, cwd inside the roots, the environment scrubbed by unsetting every name but seven, 120 s default, 600 s cap, 1 MB with head and tail), Shell.Dangerous escalating to :destructive, available?/0 false off POSIX; the shell is the catalog's first entry. The core toolsets in config; the approval card states the shell's guarantee for the platform; docs/01, 03 and 07 synced. Tests, 30 new: AC1 (inside answers, outside :ask, a symlink out resolves out, an escalation only raises), AC2 (markers refused naming the line; allow_placeholders is :destructive then writes), AC3 (atomic, no temp left, a backup, restore/2, a ring of five), AC4 (unique edit with a diff, absent and ambiguous refused), AC5 (a Plug stands in for the web: main text without chrome, the title, 1 MB cap, redirects, a binary type and a 500 as errors, non-public hosts :ask), AC6's fake half, AC7 (sleep 10 at 1 s killed, ps shows no orphan), AC8 (eight dangerous commands :destructive, a Mox policy sees escalate: :destructive), AC9 (a secret unset for the child), AC11 (the summary of a fetched page is untrusted, later turns too; the injected instruction sits only inside the block). Gate exit 0, 255 tests; credo --strict --all clean; the sobelow traversal findings carry scoped skips with their reason. Signed-off-by: Ayla Croft <aylacroft@proton.me>
PROOF.md with every criterion's evidence: AC1 to AC5, AC7 to AC9 and AC11 from the tests, AC6's fake half in the suite and its live half in the owner's queue, AC10 as a GIF and three stills from the scripted run (scripts/dev_chat_list_and_summarise.sh). NOTES.md carries the nine findings and the follow-ups. coverage.tsv: 022 at 74.85% from 72.45%. ROADMAP row 022 to done. Gate exit 0, 255 tests. Signed-off-by: Ayla Croft <aylacroft@proton.me>
Signed-off-by: Ayla Croft <aylacroft@proton.me>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Slice 022 per
slices/022-core-tools/SLICE.md. Evidence in itsPROOF.md; the two pre-slice decisions (POSIX-only shell, Brave), findings and follow-ups in itsNOTES.md.<untrusted>block; a turn's answer inherits the maximum taint. A tool can only raise its own tier.floki ~> 0.38;muontrap ~> 2.0declared on Unix hosts only.proof/).