Complete plugins and hooks: native enforcement, host protocol, callbacks and event producers #92

Complete the unfinished plugins/hooks portion of the approved goal from PRs #53/#54. Daily coding and the binary editor are tracked separately.

Baseline: main 6099e1327a79f32ed33fd5f418f1123f5ed0bded (2026-10-31). Authoritative task list · Design · Delivery rules.

Accepted work to preserve

• FileChanged task 5.2 is accepted through Verify FileChanged acceptance and specify directory admission #85, including bounded observation/reconciliation and native Windows alias/retarget coverage.
• CwdChanged implementation and accepted focused regressions exist (feat: emit hooks for committed Session Location changes #57, Test CwdChanged admission across failed idle-exit commits #87–Fence Store mutations after an unacknowledged commit #90). Fence Store mutations after an unacknowledged commit #90 fixes uncertain Store COMMIT handling and has source-bound Linux/macOS/Windows evidence.
• Native launch/confinement foundations and probes exist; Reject stale errno in native datagram confinement proof #84 accepts the send-result verifier correction. These do not complete production admission or enforcement.
• Record Store acceptance and propose legacy Setup owner resolution #91 publishes acceptance evidence and the legacy Setup review candidate; merging it does not select the proposed policy.

Decisions needed to unblock dependent implementation

These remain proposed at this baseline. Record explicit decisions in OpenSpec before dependent code; this issue does not approve them.

• R1 — Linux mediation/support direction: the current broker changes peer PID despite successful exchange. Review the proposed actual Landlock ABI-9/RESOLVE_UNIX dependency and isolated x64/arm64 evaluation. Hosted ABI-8 refusals are not positive acceptance. Full private IPC/network/runtime behavior stays required; R6 remains a separate support/activation review. Revision and evidence.
• S1 — Complete Setup policy: review Store-lifetime epoch, exact stored directory key, and legacy-deletion bootstrap together. The candidate requires owner choice for unproven legacy history (new attempt / explicit skip / cancel), while proven new Stores retain automatic first-root behavior. Marker/attempt/request ownership must survive Session deletion; no schema/init implementation before the complete decision. Setup design · Compatibility candidate.
• D1 — Additional-directory admission: review bounds, request identity/retries, idle Safe Boundary publication, and child/fork propagation. Add permissions/CLI/API deltas before code. One coherent scope revision must drive permissions, native roots and instruction sources; emitting a hook alone is insufficient. Admission design.

Remaining parent tasks

• 2.1 Prove a native enforcement mechanism and document runtime bootstrap, read roots, writes without implied broad reads, threads, exec/fork/descendant behavior and OS/runtime support. Present any required design revision before integration. Native CI at 59cae487 passed ten jobs (90 cases) covering Node/Python on macOS/Linux arm64/x86_64 and native Linux executables, including pre-main reads/forks and immutable one-shot exec filtering. Evidence and remaining runtime/platform/integration gates: native-proof.md; parent task stays open pending the complete support decisions and acceptance evidence.

• 2.2 Implement plugin-specific confinement, reviewed runtime resolution and descriptor/environment isolation without weakening ordinary tools or protected roots. The content-bound helper copy foundation is documented in image-preparation.md, with packaged macOS entry progress in packaged-native-entry.md and Linux entry progress in packaged-linux-entry.md; Generation-bound final commit adds synchronous revocation/start ordering, and host bootstrap environment replaces implicit environment inheritance; Runtime startup isolation adds package CWD/config selection and prepared workspace resources; Private-root inventory adds bounded metadata-only alias detection; Native policy composition adds the bounded Rust macOS filesystem/process builder and packaged-helper receipts; Linux protected mount ancestry records five passing primitive cases per Linux architecture, including actual ancestor-move counterexamples and regular-file masks, before Rust Linux composition, which supplies bounded arguments/profile and actual-helper regressions passing on Linux x64/arm64 at 546641f9; complete owner admission and production native launch integration remain open.

• 2.3 Enforce fs.read, fs.write, shell, network and secret intersections; refuse unsupported confinement with actionable plugin diagnostics. Linux IPC diagnostic proves fixture-owned host socket reachability through the composed production boundary; the isolated socket-family candidate passes its fixture matrix but restricts bind/listen, while the path-scoped ABI-9 alternative tests preserving private IP/UNIX functionality without production activation or an approved support-floor change. The descriptor-pinned broker experiment now attempts private IP bind/listen/connect with bounded workers and a one-use startup-exec decision. Native and runtime results plus the support/design gate remain required. None closes this task.

• 2.4 Add real-process positive/negative tests for native reads, home/Location/symlink bypass, spawning a shell/interpreter/native child, inherited restrictions, protected state, revocation and unsupported hosts. Obtain native macOS/Linux evidence and explicit Windows results/limits.

• 3.1 Validate initialize contributions and add plugin/digest/Location/generation ownership, collision handling, atomic replacement and late-result fences.

• 3.2 Dispatch runtime hooks through the existing scoped hook engine with decision validation, managed-only behavior, cancellation and bounded recursion.

• 3.3 Integrate plugin provider streams with adapter normalization, cancellation, usage/accounting, price uncertainty and refusal of untrusted reserved bounds.

• 3.4 Implement bounded deterministic catalog transforms and the missing TypeScript kit API; preserve configured/policy ceilings and last-valid catalog state.

• 3.5 Test host crash/restart, disable/update/trust loss, stale callbacks, malformed streams/transforms, duplicate contributions, cancellation and accounting through production paths.

• 4.1 Specify SDK request/result envelopes and live invocation ownership; implement generation/Session/Location-bound durable admission, retry identity and explicit refusals outside context.

• 4.2 Apply inbox, permissions, Mode, workspace trust, budget, recursion and non-interactive rules without manufacturing presence or blocking the actor needed to admit the prompt.

• 4.3 Test successful owned callback, duplicate delivery, cross-Session/stale-generation refusal, hook cycles, unattended approval, cancellation, deadlock prevention and crash recovery.

• 5.1 Implement committed DirectoryAdded/CwdChanged, complete existing Setup init/marker semantics and fill proven isolated-child WorktreeCreate coverage gaps without moving its pre-effect veto. Isolated-child creation/recreation admission is implemented with regression coverage in isolated_subagents.rs; at source commit b5ff9553, all 16 broad CI jobs and both Linux/macOS before/after regression jobs passed (broad CI, regressions). The parent task remains incomplete. Committed CwdChanged is implemented by PR feat: emit hooks for committed Session Location changes #57; code revision d993263 passed all 36 focused worktree tests on Linux/macOS plus broader CI. DirectoryAdded/Setup and combined event acceptance remain open.

• 5.3 Test no false post-effect success for refused/failed/unknown transitions, pre-effect WorktreeCreate veto/no Git mutation, stable event identity, correct scope/order, rename/delete, multiple Sessions, shutdown/restart and unknown handler outcomes.

• 6.1 Update plugin/hook guides, capability support matrix, API/SDK/schema artifacts and original extensibility task evidence without blanket-closing parent obligations.

• 6.2 Run relevant Rust tests, format/Clippy, plugin/SDK checks, native positive/denial tests, strict OpenSpec/lint and real-server acceptance; record configured skips explicitly.

• 6.3 Perform substantive code/security review using the code-review skill; resolve findings and obtain green relevant CI in reviewable PRs. Merge only when authorized.

• 6.4 Record accepted first-workstream evidence, then begin the reviewed Daily coding workstream. Archive only after accepted merge and reconcile overlapping deltas.

Expanded native ownership and proof tasks

• N2 Complete required native IPC/network compatibility and adversarial proof,
  including private UNIX behavior and proxy endpoint identity. Retain positive
  runtime controls and denied ambient access, not only refusal cases. The
  endpoint identity prerequisite tests the first
  pathname-object binding step; the private stream candidate integration
  applies that primitive in real connect notifications. The
  runtime API exchange extension requires real
  private pathname exchanges from each supported runtime. These increments do
  not complete this task. The alias extension covers
  safe symlinks and outside-scratch caller contexts through pinned mount identity.
  The kernel peer identity diagnostic separately
  checks the listener's view of a broker-emulated caller; data exchange alone
  cannot establish that compatibility.
  Independent macOS private runtime exchanges
  extend the pre-runtime signing candidate while the Linux revision awaits review.

• N3 Implement registry-owned generation admission and immutable resource
  binding with actual production startup, revocation and quarantine tests.

• N4 Integrate the native launch owner and independently intersect all
  filesystem/shell/network/secret capabilities. Remove the legacy plugin launch
  route when accepted native support replaces it; preserve ordinary tool policy.

• N5 Verify native, Node, Python, Bun and Deno on supported macOS/Linux x64
  and arm64 configurations. Record exact unsupported Windows results and
  actionable diagnostics; no universal-refusal acceptance.

• N6 Run real App/server tool-execution acceptance, malicious direct native
  API/constructor/descendant cases, aliases and concurrent replacement, startup
  cancellation, crash/restart, trust loss and resource settlement. Include precise
  missing-enforcement controls and relevant full CI plus code/security review.

• N7 Reconcile the support matrix, original parent tasks and public docs,
  then continue protocol operations, scoped callbacks and remaining producers.

Linux revision tasks (conditional on R1 selection)

• R1 Review this changed Linux dependency and direction with the user.

• R2 Provision isolated Linux x64 and arm64 test environments with actual
  required kernel/LSM features. Pin and record kernel/image inputs and verify
  their provenance. Record ABI and enabled features at execution; do not infer
  support from a version string. Do not replace the user's host kernel.

• R3 Require direct native positive exchanges for pathname and abstract
  stream/datagram/seqpacket sockets, pairs, named sendto/sendmsg, reconnect,
  relative and symlink forms, ancillary FD/credential passing and peer identity.
  Pair positive unconfined controls with denied actual host-listener delivery.

• R4 Add concurrent pathname/FD/address replacement and inherited descendant
  cases. The kernel must authorize the endpoint used by the actual operation.
  Omitting the exact UNIX policy must reach an owned host endpoint and fail its
  named isolation assertion; generic launch failure cannot satisfy the control.

• R5 Run Node, Python, Bun, Deno and native runtime capability matrices on
  both architectures, including real tool execution and private IPC. Verify
  independent read/write/shell grants, effective proxy/network/secret ceilings
  and resource settlement. Retain source-bound reports and exact controls.

• R6 Return complete evidence for support/activation review, then finish the
  existing N3–N7 production ownership, integration and acceptance tasks. Update
  README/support documentation in the same production behavior change.

Setup tasks

• S1 Review both epoch/key decisions and the legacy-deletion bootstrap requirement above, including the owner-resolution candidate; record the accepted complete migration/support decision before implementation.

• S2 Add bounded events, marker projection/migration and writer-atomic root
  Session admission across separate durable owners; cover concurrent creation,
  children, legacy/deleted history and rebuild after Session deletion with actual
  Store transactions. Extend checked append across the bounded owner aggregates;
  test late CAS/validation/projector failures, complete rollback, ordering and
  absence of uncommitted notifications through the actual writer.

• S3 Bind Setup receipts to the admitted attempt; test duplicate, moved,
  archived and forged/synthetic admission, empty-settlement versus lost-owner
  ambiguity, failed/unknown outcomes, cancellation
  and crash points before/after marker and handler acknowledgement.

• S4 Add the owner operation and top-level init CLI/API/SDK/schema artifacts;
  test transport retries, request-binding refusal, no model Turn/TUI and
  explicit/automatic coalescing and retry after Session deletion through the real
  App and CLI.

• S5 Verify unchanged hook trust/pure/managed rules and outcome reporting on
  Linux/macOS/Windows, including native command hooks and HTTP handlers where
  configured. Record unavailable checks explicitly.

• S6 Update public docs/roadmap and parent task evidence; run relevant checks
  and substantive code/security review before presenting implementation PRs.

DirectoryAdded tasks

• D1 Review this prerequisite, bounds, identity/deduplication, idle-boundary
  and child/fork semantics; add the permissions-modes/CLI/API deltas before code.

• D2 Add bounded pending/effective events and projections, request binding
  and writer-atomic revision checks. Test duplicate/conflicting/concurrent
  requests, archived Sessions, replay and transaction rollback with a real Store.

• D3 Integrate pinned native root preparation and one Safe Boundary snapshot
  into all ordinary file, attachment, sandbox and context paths. Test grants
  during held tool calls, root replacement/retarget, protected aliases, restart,
  failed instruction loading and preservation of Mode/managed/child ceilings.

• D4 Add CLI, slash/TUI and owner HTTP inputs plus generated schema/SDK
  artifacts. Exercise repeatable flags and actual owner requests, with no model
  Turn or manufactured user presence for idle publication.

• D5 Emit committed DirectoryAdded with stable source identity; verify scope,
  order, idempotency and unknown-handler no-replay through actual HTTP/command
  handlers. A control omitting effective publication must fail a named behavior
  assertion rather than succeeding because a hook was emitted.

• D6 Run native Linux/macOS/Windows checks and substantive security review;
  reconcile public docs and task 5.1 only after complete acceptance.

Completion evidence

Production-path native fs.read/fs.write/shell/network/secret enforcement; complete initialize contribution ownership, hook/provider/catalog operations and scoped prompt callbacks; complete Setup/DirectoryAdded/CwdChanged/WorktreeCreate producer acceptance; native positive and denial controls; host crash/restart/revocation and unknown-outcome handling; real App/server execution; supported platform/runtime matrix with explicit limits; current generated API/SDK/schema and public docs. Retain accepted FileChanged behavior and receipts. Close only after all linked requirements are satisfied and verified, then reconcile/archive overlapping specs.

Track the remaining approved implementation scope, not a new scope proposal. Delivery order remains plugins/hooks → daily coding → binary editor. Normally keep one implementation PR open (maximum two for independently reviewable work); merge ready PRs only under the existing user authorization with current-head CI and review. Preserve meaningful regressions, generated artifacts, documentation, substantive code/security review, and explicit native/design gates. Green probes, universal refusal, or a merged specification do not prove production completion.

Related workstreams

daily: #93 · binary: #94