NS6 slice: Guard local socket scope and not-built diagnostics #36

New Issue

2026-06-20T23:28:20Z

tmk241 commented

2026-06-20 23:28:20 +00:00

OBJECTIVE: Make socket access local/session-scoped and ensure excluded profile capabilities fail with not built in this profile diagnostics.

AUTHORITY: Parent #6 NS6: Pi and local tool bridge; PRODUCT.md; REQUIREMENTS.md (PRODUCT.md; req: session/002; req: session/004; req: governance/002-003).

AGENT AUTHORITY:

Delivery authority: local-commit
Tracker authority: this issue may be commented and closed when acceptance passes.
Handoff state: committed clean, tracker commented/closed.

PARENT: #6 via explicit issue link and parent checklist.

SCOPE: The smallest source/docs/tests needed to make this behavior real and verified.

BOUNDARIES: No remote network control plane.

ACCEPTANCE: Tests verify socket path scope/permissions where possible and profile stubs return clear messages.

VERIFICATION: Run the cheapest command that proves acceptance. Include regular tests for the intended payoff and adversarial tests for realistic failure, boundary, or regression cases. If no implementation test command exists yet, create/record the canonical command in AGENTS.md as part of the slice.

BLOCKERS: none

GOAL: Implement this vertical slice to the ACCEPTANCE above, keep the repo clean, cite relevant req: anchors in code/tests where applicable, and close only after verification passes.

OBJECTIVE: Make socket access local/session-scoped and ensure excluded profile capabilities fail with `not built in this profile` diagnostics. AUTHORITY: Parent #6 `NS6: Pi and local tool bridge`; PRODUCT.md; REQUIREMENTS.md (PRODUCT.md; req: session/002; req: session/004; req: governance/002-003). AGENT AUTHORITY: - Delivery authority: local-commit - Tracker authority: this issue may be commented and closed when acceptance passes. - Handoff state: committed clean, tracker commented/closed. PARENT: #6 via explicit issue link and parent checklist. SCOPE: The smallest source/docs/tests needed to make this behavior real and verified. BOUNDARIES: No remote network control plane. ACCEPTANCE: Tests verify socket path scope/permissions where possible and profile stubs return clear messages. VERIFICATION: Run the cheapest command that proves acceptance. Include regular tests for the intended payoff and adversarial tests for realistic failure, boundary, or regression cases. If no implementation test command exists yet, create/record the canonical command in AGENTS.md as part of the slice. BLOCKERS: none GOAL: Implement this vertical slice to the ACCEPTANCE above, keep the repo clean, cite relevant `req:` anchors in code/tests where applicable, and close only after verification passes.

tmk241 added this to the v1 milestone 2026-06-20 23:28:20 +00:00

tmk241 added the slice ready-for-agent goal labels 2026-06-20 23:28:20 +00:00

tmk241 referenced this issue

2026-06-20 23:28:20 +00:00

NS6: Pi and local tool bridge #6

tmk241 commented

2026-06-21 03:15:21 +00:00

Implemented in commit fb68747848 (Fence local profile capabilities).

Verification:

zig fmt src/profile.zig src/socket.zig src/main.zig: pass
zig build test: pass
zig build: pass
zig build run -- --help: pass
zig build run -- profile: pass
zig build run -- remote: exits with explicit not-built-in-this-profile diagnostic
redgate lint / health: pass

Regular tests: profile status reports profile:v1, active dev-local, local-only socket, and not-built fences for remote transport, plugin host, bundled Pi, and background agent. CLI exposes mim profile. Local socket validation accepts only /tmp/ and /var/tmp/ socket paths and rejects relative/home/newline paths. Socket listen now binds under restrictive umask for owner-only socket permissions.
Adversarial tests: excluded capabilities (remote, plugin, background-agent, bundled-pi) route to explicit not built in this profile stubs instead of silently no-oping or implying unavailable features exist.

Boundary: profile/status fences and local socket hardening only. No sandbox framework, remote auth, plugin runtime, capability negotiation service, or alternate build matrix added.

Implemented in commit fb687478484d (Fence local profile capabilities). Verification: - zig fmt src/profile.zig src/socket.zig src/main.zig: pass - zig build test: pass - zig build: pass - zig build run -- --help: pass - zig build run -- profile: pass - zig build run -- remote: exits with explicit not-built-in-this-profile diagnostic - redgate lint / health: pass Regular tests: profile status reports `profile:v1`, active `dev-local`, local-only socket, and not-built fences for remote transport, plugin host, bundled Pi, and background agent. CLI exposes `mim profile`. Local socket validation accepts only `/tmp/` and `/var/tmp/` socket paths and rejects relative/home/newline paths. Socket listen now binds under restrictive umask for owner-only socket permissions. Adversarial tests: excluded capabilities (`remote`, `plugin`, `background-agent`, `bundled-pi`) route to explicit `not built in this profile` stubs instead of silently no-oping or implying unavailable features exist. Boundary: profile/status fences and local socket hardening only. No sandbox framework, remote auth, plugin runtime, capability negotiation service, or alternate build matrix added.

tmk241 closed this issue

2026-06-21 03:15:21 +00:00

tmk241 referenced this issue

2026-06-21 03:45:28 +00:00

NS6: Pi and local tool bridge #6

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: tmk241/mim#36