9219af3360
ADR-1244 Phase 4 (D5 trust + D6 upgrade/compat). capability-trust.cjs (disclosure/consent, strict_known_registries, engines+compatVersions, reserved namespace) + capability-lifecycle.cjs (install/upgrade/remove/reconcile; ledger-as-commit-point _pending intent; atomic stage-then-swap; surgical marker-isolated shared-edit strip; owner-token lock) + capability-source promote/skipEnginesGate seams + loader pending-skip + config keys. No sandbox re-derived (consent+integrity+reversibility). 6 Codex adversarial rounds + /security-review (no HIGH) + /code-review; gsd-test green both platforms; CI green. Phase 5 (#1434) wires the CLI dispatch. Closes #1433. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
946 B
type, pr
| type | pr |
|---|---|
| Security | 1449 |
Third-party capability trust gate (ADR-1244 Phase 4) — installing a capability from a git/npm/tarball/local source now discloses every executable surface it ships (hooks, command modules, MCP servers, with the actual commands) and requires explicit consent before anything is promoted; integrity (sha512) and engines.gsd are verified before any code is staged, install never executes capability code, and reserved gsd-/gsd-core-/anthropic- namespaces are refused. capabilities.strict_known_registries gates which sources may be installed ([] = local-only lockdown; host-based allowlist otherwise) and capabilities.auto_update is off by default, re-prompting whenever a new version's executable set changes. An install ledger makes remove surgical (strips only the capability's own shared-config entries, preserving your hand-edits) and update an atomic, crash-safe stage-then-swap. (#1449)