Conversation
Delete the kernel PolicyExtension registry and route legacy kernel authorization through the existing PolicyPipeline grant path. Move deterministic test gates to PolicyAny/pre-policy registration so denial behavior is exercised through the same pipeline as typed actions. Keep FilePolicyExtension and ToolPolicyExtension only as app-side legacy direct preflight helpers, and register fs/tool policies explicitly at app bootstrap/test boundaries.
Stop routing workspace guidance and runtime-self live source reads through the read tool envelope. Build an AppExecutionContext from the existing KernelContext and perform the filesystem side effect through ctx.access().fs().read_file instead. Update audit expectations so runtime-source reads are treated as governed access, not typed or legacy tool invocations.
Record that unmigrated legacy tool code may remain only behind the fallback boundary. Clarify that old tool helpers must not be registered into the typed ToolPlane or pushed back into PolicyPipeline as faux typed policies.
Box the large provider terminal-phase variant so the enum stays small under all-target clippy. Keep the static app tool plane free of panic/expect registration paths, and make test-only registration APIs test-only. Use direct capability membership checks in kernel test support.
Remove the no-context live file read helper and stop direct/advisory prompt assembly from reading AGENTS.md, TOOLS.md, IDENTITY.md, and USER.md. Keep runtime-source reads on the provider binding path, where file bytes come through ctx.access().fs().read_file(...). Carry RuntimeSelfContinuity as structured assembled context into runtime merge and compaction persistence instead of re-reading config paths later. Reject nested workspace source roots that canonicalize outside the active workspace before source candidates are read.
Document that authorize_kernel_action and policy_engine_error are migration-only surfaces. Point maintainers toward typed PolicyEngine::grant plus Granted<ConcreteAction> consumption for new side-effect paths.
Document that live workspace/runtime-self files require governed execution context and ctx.access(). Record structured RuntimeSelfContinuity as the handoff from prompt assembly into runtime merge and compaction. Clarify that runtime-source reads are fs access evidence, not typed tool invocation audit events.
Replace the hand-written test Wake implementation with std::task::Waker::noop so all-target clippy stays clean.
Remove loong_contracts::ToolOutcome so erased typed tools return serde_json::Value success payloads instead of legacy ok/payload envelopes. Introduce ReadFileOutput for the concrete file read tool and move its JSON payload projection into Into<Value>. Keep ToolCoreOutcome construction only at app legacy bridge boundaries, including typed plane dispatch and direct-read compatibility routing. Preserve raw ToolExecutionError reasons when bridging to legacy string errors so policy_denied prefixes still classify correctly.
Drop the completed ToolOutcome migration item from the next-steps plan and renumber the remaining minimum-commit candidates.
Add slotmap as a workspace dependency and make AppToolPlane store ToolEntry values in private ToolSlot storage with a path-to-slot index. Keep ToolPath as the only public/audit identity; slots remain internal registration handles. Cover duplicate registration and missing-path invocation so path aliases do not create extra entries and missing slots do not execute tools.
Drop the completed ToolPlane slot registry item from the next-steps plan and renumber the remaining minimum-commit candidates.
PolicyContext now reads an explicit effective capability set instead of deriving authority directly from the issued token. Top-level contexts continue to initialize from token capabilities, while the new constructor accepts a narrowed set and rejects capabilities not present on the token. This prepares child tool invocation narrowing without changing token evidence used by KernelInvocationContext audit paths.
Move the file.read builtin setup through AppToolPlane::register_with_provenance instead of hand-writing slot and path maps. This keeps path composition at the plane registration boundary and leaves ToolSlot as a private storage detail. The static duplicate-path invariant is checked with debug_assert without adding a runtime panic to plane initialization.
Add AppExecutionContext::tool(path) as the app-owned typed invocation entry point and make ToolInvocation::invoke pair kernel grant, plane dispatch, and audit. Have the plane expose descriptor lookup so invocation required capabilities come from InvokeTool plus the registered tool spec instead of request-name helper code. Replace the file.read typed branch in execute_kernel_tool_request with ctx.tool(path)?.invoke(payload), leaving legacy fallback routing unchanged for unmigrated tools.
Add AppExecutionContext::narrow_capabilities so child invocation contexts inherit runtime references without regaining parent-removed authority. Run typed ToolInvocation grants, plane dispatch, and audit against the narrowed child context built from InvokeTool plus the registered tool descriptor capabilities. This makes access/action policy gates inside concrete tools read the child effective capability set instead of the parent token-wide set.
Remove completed ToolInvocationAction, ctx.tool invocation, and effective capability baseline work from the next-step queue. Keep only the remaining surfaces: child capability overrides, plane-driven catalog projection, trusted overlay cleanup, aggregate read migration, remaining side-effect tools, tests, and config-driven policy registration. This keeps future implementation aligned with the current app-owned ToolPlane and context-owned invocation shape.
Validate reserved internal context on the typed tool ingress before dispatching to concrete tools. When the payload is trusted, remove the reserved overlay after runtime config extraction so concrete typed tools parse only agent-facing payload fields. Add a file.read typed-path regression test for rejecting untrusted _loong payloads while keeping trusted workspace-root handling covered by existing tests.
Let ToolInvocation::invoke keep the descriptor default caps while adding invoke_with_capabilities for future tool-to-tool calls that need explicit narrowing. Reject overrides that add capabilities beyond the registered tool descriptor, while always preserving InvokeTool as the dispatch capability. Add tests that cover override expansion rejection and prove a narrowed file.read invocation loses FilesystemRead at the downstream fs action gate.
Record that ToolInvocation now supports descriptor-bounded capability overrides and child effective capability enforcement. Keep the remaining plan focused on wiring those overrides into a future tool-to-tool invocation payload rather than redoing the context-level machinery.
Simplify take_trusted_internal_tool_context to scan the reserved internal context key once. The behavior is unchanged; the existing extraction test continues to cover the trusted payload removal path.
Drop the typed trusted overlay item now that typed ingress rejects forged reserved payloads and strips trusted internal fields before concrete tool parsing. No wrapper type is introduced because the overlay has no independent behavior yet; app orchestration owns the stripping boundary.
Add a focused plane test for the slot storage plus path index shape.\n\nThe helper remains test-only so runtime surfaces do not grow a premature enumeration API before catalog projection is designed.
Let the typed file tool match FsAccessError directly when converting legacy string errors.\n\nThis keeps policy-denial display compatibility at the legacy response boundary and removes a kernel helper that only wrapped a single matches! expression.
Introduce FsGlobAction and FsAccess::glob_paths so path-listing reads can move behind the same resolve -> grant -> granted action execution boundary as file reads. Keep directory traversal, file-type inspection, and glob matching inside loong-access; callers receive only the granted result set. Re-export the fs-domain types through loong_kernel::access::fs and cover grant-required execution and policy-deny-before-read-dir behavior.
Move the workspace root into the test policy context after deriving the canonical policy root. This keeps the kernel/access clippy target clean without changing test behavior.
Record that FsGlobAction now exists only as an access-side primitive. Keep aggregate read marked incomplete until app policy registration, typed ReadTool wiring, and content-search action migration land.
Move the FsGlobAction execution, output types, and matcher into fs/glob.rs. Keep FsAccess as the facade layer so future fs actions can land without turning access.rs into another mixed helper file.
Introduce FsContentSearchAction and FsAccess::search_content so query-mode reads can move behind resolve -> grant -> granted action execution instead of reading files in app tool code. The action carries query, glob filter, limits, and case-sensitivity as policy-visible payload. The access execution boundary performs directory traversal, file reads, matching, and snippet construction, and tests cover granted execution plus denial before directory reads.
Update the read migration plan now that FsContentSearchAction exists beside FsGlobAction as an access-side primitive. Keep aggregate ReadTool, typed policy registration, and legacy bridge removal marked as remaining work.
Replace the PolicyId integer alias with a private-field newtype while preserving its pipeline-local sequence semantics and serialized representation.\n\nKeep registration ordering as a separate u64 counter so PolicyId does not expose arithmetic or raw-value access, and update direct test constructions to use PolicyId::new.
Move filesystem path resolution and authorization actions, context views, base policies, and the mandatory access grant chain into fs::path. Keep loong-kernel as the explicit access facade while removing path-specific policy ownership from the generic kernel pipeline. Preserve the resolve -> containment -> concrete action order and update callers to import path policy from the access domain.
Move the read action, configurable deny and terminal allow policies, access orchestration, granted execution boundary, and output type into fs::read. Keep file reads behind Granted<FsReadAction>, remove read-specific policy ownership from the generic kernel pipeline, and expose the operation only through the explicit kernel access facade.
Move ordinary and atomic write actions, terminal policies, access orchestration, granted execution boundaries, output types, and shared target classification into fs::write. Keep both persistence modes behind Granted<ConcreteAction>, remove write-specific policy ownership from the generic kernel pipeline, and expose the operation through the explicit kernel access facade.
Delete the unused FsAction family and its forwarding constructors so concrete filesystem actions remain the only policy and execution types. Remove wrapper-only tests while preserving each concrete action's metadata, payload, capability, and granted side-effect coverage.
Move FsCopyFileAction, its terminal policy, the FsAccess entry point, granted execution, and output into the copy module. Remove the copy policy from kernel ownership and update explicit facade imports without retaining compatibility aliases or forwarding helpers.
Document that TargetPath follows the final symlink while EntryPath preserves the final directory entry for unlink and rename operations. Record that file editing currently requires UTF-8 and that support for other encodings needs an explicit future decoding policy.
Move shared policy context, action, backend, and report fixtures into tests/test_support.rs while keeping grant and permission cases under the tests module. Replace inherited wildcard imports with explicit per-test dependencies and keep fixture visibility confined to the test module.
Move FsCreateDirAllAction, its terminal allow policy, FsAccess orchestration, granted execution, and output into fs::directory so the operation has one owner. Remove the migrated definitions from horizontal access/action and kernel policy modules, then expose the operation through the kernel fs facade while preserving the existing path-grant and deny-before-side-effect tests.
Move FsRemoveFileAction, its terminal allow policy, FsAccess orchestration, granted execution, and output types into fs::remove so unlink semantics have one owner. Keep final-component no-follow by consuming GrantedEntryPath, remove the migrated kernel policy definition, and update facade and test imports without aliases or forwarding helpers.
Use the workspace-managed uuid version and feature set instead of duplicating the dependency declaration in loong-app.\n\nThis keeps dependency governance at the workspace root and does not change runtime behavior.
Add an iterator over the intersection of two capability sets and cover its deterministic set semantics.\n\nRecursive execution contexts use this operation to derive child authority without allowing capabilities absent from either the parent scope or the invoked action.
Point the malformed-followup recovery fixture at its own TempDir instead of the process working directory.\n\nThis prevents full workspace runs from leaving recovered.txt in the crate tree while preserving the continuation behavior under test.
Move concrete tool erasure, capability narrowing, PolicyEngine grant, and granted dispatch behind the runtime-owned ToolInvocation boundary. Record grant-linked action execution evidence, including best-effort OutcomeUnknown on dropped futures, while keeping release panic abort semantics explicit. Preserve typed authorization, input, denial, dispatch, and audit failures through app orchestration; keep historical ToolInvocation records decode-only and remove the token-shaped grant_action path.
Update integration expectations after typed ToolInvocation stopped collapsing authorization and execution denials into legacy kernel policy errors. Assert capability failures at the typed authorization boundary and filesystem path rejection at the concrete tool execution boundary.
Make ToolSpec the concrete owner of orchestration scheduling metadata and classify typed file tools at their definitions.\n\nKeep scheduling explicitly separate from authorization, expose stable snake_case metadata, and update runtime fixtures so the contract remains construction-complete.
Resolve registered tools before consulting explicit legacy execution owners. Keep migrated lookup, parse, authorization, and dispatch failures on typed error and audit paths without fallback.\n\nPersist approval dispatch ownership, exact effective requests, capability narrowing, and trusted execution overlays so replay cannot reinterpret a prepared invocation against later registry or alias state.
Read scheduling metadata from the registered ToolSpec whenever the runtime owns a typed path. Keep legacy catalog scheduling only for explicitly selected legacy owners.\n\nRemove the duplicate app scheduling enum so contracts, registry metadata, batch planning, and telemetry share one type. Cover descriptorless typed registration to prove registry metadata controls execution ordering.
Store non-empty capability sets behind shared storage while preserving the opaque set API, const empty representation, and serialized wire shape. Add a focused test proving cloned capability collections share their backing storage so recursive Context clones remain cheap before the planned bitset migration.
InuDial
commented
Jul 18, 2026
| FsAccessError, | ||
| ), | ||
| #[error("failed to decode {path} as UTF-8: {source}", path = .path.display())] | ||
| InvalidUtf8 { |
Collaborator
Author
There was a problem hiding this comment.
Maybe other encoding methods needed?
Collaborator
Author
There was a problem hiding this comment.
This should be test_support.rs
|
|
||
| /// Source location where a policy entered its runtime pipeline. | ||
| #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)] | ||
| pub struct PolicyRegistrationSource { |
Collaborator
Author
There was a problem hiding this comment.
May be more graceful?
| pub after: String, | ||
| pub replacements_made: usize, | ||
| pub edit_blocks_applied: usize, | ||
| } |
Collaborator
Author
There was a problem hiding this comment.
Possibly different versions of this tool is needed.
Add the missing scheduling class required by the typed ToolSpec fixture. Make the dependency guard cover every workspace crate and fail when a new package has no registered architecture alias. Synchronize the current 15-crate DAG across maintainer and public architecture documentation.
Delete the one-shot, interactive, and task-status executor/projection APIs that had no durable runtime owner. Route daemon task status through its existing task-detail source, remove the fabricated spine payload and forwarding helpers, and drop the daemon protocol dependency. Narrow loong-app-protocol to core command/response contracts, remove unused dependencies, and synchronize the 15-crate DAG, architecture docs, and remaining convergence plan.
Move ToolPath ownership from loong-runtime to loong-contracts and make segment boundaries explicit, validated, and serialized as leading-slash canonical text. Remove plane-selected path types and generic lookup errors, migrate runtime and app callers without dotted splitting, and fail metadata, snapshot, and invocation boundaries closed on malformed identities or registry invariants. Update action and audit expectations, provider and search projections, tests, and architecture plans for the new identity contract.
github-actions
Bot
added
the
ci
Replace the redundant slot arena and path-to-slot index with one ordered ToolPath map. Duplicate registration remains lazy, so rejected tools are not observed or allowed to replace the original entry. Remove the impossible registry-invariant error, test-only count helpers, and the now-unused slotmap dependency. Update runtime plans to record the single-map identity and audit boundary.
Replace the benchmark-gated capability representation idea with an explicit contracts-owned, copyable value bitset goal. Require one private declaration source for variants, names, bits, and iteration so authorization identities cannot alias or drift. Make the cutover atomic across PolicyContext implementations and callers, remove Cow-backed compatibility surfaces, and preserve the existing named-array wire contract with full workspace verification.
Record CancellationToken ownership and propagation across recursive execution contexts. Keep ToolInvocation as the scope owner while ToolImpl, Policy, and Access borrow the context. Specify typed cancellation outcomes, pre-grant observation, batch sibling isolation, and finalization evidence.
Define Runtime supervisor, Session runner, recursive Context, and split legacy ingress ownership without introducing forwarding compatibility layers. Remove the completed live-source Access goal, stale history, broken TODO mappings, and contradictory permission registration guidance. Record governed Monty agent control as a deferred goal while leaving send, status, idle, redirect, and persistence semantics open until integration.
github-actions
Bot
added
the
browser
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Linked Issues
Change Type
Touched Areas
Risk Track
If Track B, fill these in:
Validation
cargo fmt --all -- --checkcargo clippy --workspace --all-targets --all-features -- -D warningscargo test --workspace --locked,cargo test --workspace --all-features --locked,task verify,task verify:changed, or equivalent exact commands documented below)Commands and evidence:
User-visible / Operator-visible Changes
Failure Recovery
Reviewer Focus