feat(cave): add the privileged authority tier behind capability gates - #82
Open
CompleteDotTech wants to merge 2 commits into
Open
feat(cave): add the privileged authority tier behind capability gates#82CompleteDotTech wants to merge 2 commits into
CompleteDotTech wants to merge 2 commits into
Conversation
…rity Implement the SDK-owned half of the approved conversational-control design (docs/superpowers/specs/2026-08-28-sdk-conversational-control-design.md): - typed create/send/retry requests with one caller-visible operation UUID, validated against the existing Client v1 36-character UUID contract and normalized to the lowercase idempotency key form; - non-content operation records, create/send result envelopes, and a single event translator shared by initial and resumed streams (contiguity, duplicate suppression, terminal-sequence refusal, reconcile reasons); - six CaveClient methods backed by optional CaveTransport methods: create, send, retry, read, stream, stop - one-shot dispatch, no automatic replay after ambiguous transport completion, operation ID attached to every post-acceptance error, abort closes the read without Stop or resend; - one total stream budget across long polls; duplicate suppression at or below the accepted cursor; reconcile_required exposed as a reload instruction with its reason. Upstream-contract gap (stated, not invented): the five Client v1 operations (conversations.create, messages.send, operations.read, operations.events, operations.stop) are not declared by the authoritative fixture pinned at Cave 4adc97b1, so no transport binding or route path ships; every call reports unsupported_operation until the producer contract lands and pnpm sync:contracts imports it. Private-CLI streaming renderers follow in a separate PR per the design's PR plan.
Implement the SDK-owned half of issue OpenCoven#43 as far as the authoritative Cave contract allows, stacked on the conversational-control tier: - a capability registry derived from the verified contract fixture that resolves every privileged action class (attachment-transfer, rich-content, attention-response, task-handoff, github-action) against the live operation table per call - frozen descriptors, no cached capability objects; the default snapshot mirrors the pinned fixture and is test-locked to it; - bounded attachment transfer validated fail closed (file count, file size, request size, MIME allowlist with magic-byte signature agreement, filename, traversal, symlink) with the atomic uploader-credential-plus- conversation binding and metadata-only records, so attachment bytes never enter canonical conversation JSON, browser storage, profile config, or diagnostic bundles; the canonical byte digest stays Cave's; - a passive rich-content AST over a closed non-executable node vocabulary: no HTML node type, no event-handler fields, markup-looking text preserved inertly byte for byte, link targets restricted to https:/mailto: with userinfo refused, node-count, depth, and character limits failing closed; - task handoffs with proposed/pending/completed/rejected/failed kept strictly distinct behind a declared transition map, and attention responses over a closed kind union with a bounded note; - the confirmed GitHub action envelope with an intentionally EMPTY curated union typed readonly never[], so no request is constructible - fail closed by construction - with confirmation, operation-UUID idempotency, and bounded-input validation shipping ready for the curated union; - five optional unbound CaveTransport methods and five CaveClient methods that validate requests, resolve the capability gate, and report unsupported_operation with zero transport dispatch under the pinned contract; the operation UUID is attached to every privileged client error. Upstream-contract gap (stated, not invented): the fixture pinned at Cave 4adc97b1 declares the privileged pairing scopes but no attachment, rich-content, attention, task, or GitHub operations and no such capability families, so no route, scope mapping, capability family, or GitHub action kind ships; no CLI command ships for unsupported privileged actions. Changeset targets the release after 0.1.0.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Recreated from CompleteDotTech/sdk#7 against current upstream
main(66edd4d). Because the source PR was stacked on conversational-control, this upstream branch contains the recreated #6 commit followed by the privileged-authority commit; it must merge after upstream #81, then be rebased/retargeted to leave only the #7 delta. The fork-only runner bootstrap was omitted.Advances #43 with capability-gated, fail-closed attachment validation, passive rich content, attention/task handoff DTOs, and the intentionally empty GitHub-action union. Cave remains the sole executor and canonical owner. The current fixture declares no privileged operations, so every binding reports
unsupported_operation; no routes, action kinds, or capability families are fabricated.The changeset targets the post-0.1 release. No external mutation or release authorization is implied.
Validation: the combined conversation-control and privileged-tier focused suites pass 111/111 locally; the source fork PR's full Node 24.18.1 verification passed.