kyleandClaude Opus 5.5
de1032157b
memoryd (files, the check, edits, journal, index, recall, serving), the memory tools and built-in grants in brokerd, the memory block in loopd, bxctl reindex and memory, and the device checks with memoryd. Each task was built as a reference and gated. Each was replayed on its own at its end state (854 to 936 tests) and mutation-checked. Each skeleton compiles and fails its tests. Every todo comment was read beside its signature. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
27 lines
1.5 KiB
Rust
27 lines
1.5 KiB
Rust
//! The built-in grants of `recall` and `memory` (M5a spec, section 8). Reading and writing memory
|
|
//! is what an agent is, so no grant file can turn it off or put questions in front of it; the
|
|
//! prompt is protected by `memoryd`, which lets only clean sessions edit identity.
|
|
|
|
use proto::{Grant, GrantProblem, sha256};
|
|
|
|
use crate::grants::LoadedGrant;
|
|
|
|
/// Ids starting with this are the built-ins'; an owner's grant file may not use one.
|
|
pub const RESERVED: &str = "builtin-";
|
|
|
|
/// The built-in grants' text, hashed for the audit log like a grant file's bytes.
|
|
pub const RECALL: &str = "tool = \"recall\"\nmode = \"auto\"\nmax_taint = \"secret\"\nresult_class = \"private\"\nuntrusted = false\n";
|
|
pub const MEMORY: &str = "tool = \"memory\"\nmode = \"auto\"\nmax_taint = \"secret\"\nresult_class = \"private\"\nuntrusted = false\n";
|
|
|
|
/// The sentence for an owner's grant naming a memory tool.
|
|
pub const BUILT_IN: &str = "the policy of recall and memory is built in; remove this grant";
|
|
|
|
/// The two built-in grants, `builtin-memory` and `builtin-recall`.
|
|
pub fn grants() -> Result<Vec<LoadedGrant>, GrantProblem> {
|
|
// For each (id, text) of [("builtin-memory", MEMORY), ("builtin-recall", RECALL)]:
|
|
// `toml::from_str::<Grant>(text)` and `sha256(text.as_bytes())`, each error as a GrantProblem {
|
|
// file: id, line: None, problem: e.to_string() }; build LoadedGrant { id, grant, sha256 }.
|
|
// Collect into Result<Vec<LoadedGrant>, GrantProblem> (the first error wins).
|
|
todo!()
|
|
}
|