Mediate tool authority and subprocess execution

Completes M10 with exact attributable policy decisions, bounded credential-free command execution, durable redacted outcomes, immutable custom commands, and an out-of-process plugin contract.

Change-Log: CL-20260730-056

Dev-Log: DL-20260730-057

Author: claude

CHANGELOG

@@ -30,6 +30,29 @@ Dev-Log:
 
 Entries
 -------
+Change-ID: CL-20260730-056
+Date: 2026-07-30
+Type: Mediated tools, permissions, and subprocess execution
+Request-or-TODO: M10-001 through M10-059 and M10-G01 through M10-G03
+Outcome: Added a versioned typed tool protocol, exact task authority policy,
+  controlled subprocess runner, immutable permission/custom-command records,
+  and durable command outcome/output storage
+Affected-behavior: Repository reads and confined edits have explicit policy
+  classes; network, dependency, external, credential, destructive, privileged,
+  and communication effects require exact attributable authority. Commands use
+  argument arrays, confined working directories, credential-free allowlisted
+  environments, bounded timeouts, process-tree cancellation, and redacted
+  bounded output. Denials remain capability-scoped across tool substitution.
+Compatibility-or-migration: Adds migration 000007 for per-run tool schema,
+  exact permission metadata and one-use consumption, immutable reviewed custom
+  commands, and command execution outcome metadata; schema version advances to
+  7. Arbitrary in-process plugins and a marketplace remain deliberately
+  deferred.
+Verification: Migration and generation checks, lint, focused executor/storage
+  suites, security suite, and full local test-all pass. Platform process-tree
+  behavior is exercised by the public Windows, Ubuntu, and macOS CI matrix.
+Dev-Log: DL-20260730-057
+
 Change-ID: CL-20260730-055
 Date: 2026-07-30
 Type: Cross-platform worktree path correction

DEVLOG

@@ -24,6 +24,49 @@ Next-safe-step:
 
 Entries
 -------
+Dev-Log: DL-20260730-057
+Date: 2026-07-30
+Status: Complete
+Change-ID: CL-20260730-056
+Request-or-TODO: M10-001 through M10-059 and M10-G01 through M10-G03
+Goal: Let workers inspect, edit, and validate repositories through typed tools
+  without ambient or unattributed authority
+Assumptions: M10 owns policy and the subprocess boundary; M11 will wire these
+  ports into authenticated worker lifecycle, and M16 will expose approval and
+  progress state through the GWC interface
+Decisions: Derive authority from typed side effects and exact command arrays,
+  never from untrusted descriptions or claimed class. Bind grants to task,
+  working directory, arguments, and effects; bind denials to capability and
+  scope so changing tool names cannot regain authority. Require an attribution
+  identifier for every executable task-scoped classification. Launch direct
+  argument arrays in canonical task directories, pass only allowlisted
+  non-secret environment variables, terminate process trees on timeout or
+  cancellation, and redact before bounded persistence/display. Store custom
+  commands as immutable typed templates after repository-source first-use
+  approval. Define future plugins only as separately launched JSON-RPC/MCP
+  subprocesses; do not load arbitrary code or build a marketplace.
+Files-or-schemas: Executor tool protocol, policy, command runner, platform
+  process-tree helpers, plugin boundary, and tests; storage repositories/tests
+  for tool schemas, permission decisions, custom commands, command lifecycle,
+  and redacted output; migration 000007; generated migration/build metadata;
+  M10 checklist evidence and ledgers
+Validation: Focused executor/storage tests, migration-check, generate-check,
+  lint, security tests, and full local test-all pass. Tests cover exact grants,
+  expiry, isolation, denial substitution, malicious display descriptions,
+  credential stripping, output bounds/redaction, timeout/cancel trees,
+  reviewed immutable templates, idempotency, and optimistic lifecycle writes.
+Failures-or-discarded-approaches: Trusting the request's authority label,
+  shell-concatenated commands, ambient coordinator environments, raw plugin
+  secrets, repository-loaded code, mutable custom commands, and unbounded
+  output were rejected. Effect classification was made order-independent so a
+  reordered declaration cannot select weaker authority.
+Known-limitations: Workspace confinement is mediation, not a perfect OS
+  sandbox. Live coordinator/worker wiring belongs to M11, provider calls to
+  M12, and browser presentation/E2E to M16-M20.
+Next-safe-step: Implement M11 coordinator startup, single-instance ownership,
+  authenticated worker protocol, heartbeats, scheduling, shutdown, and crash
+  recovery without broadening the M10 authority boundary.
+
 Dev-Log: DL-20260730-056
 Date: 2026-07-30
 Status: Complete

TODOS.md

@@ -1678,83 +1678,99 @@ Milestone output: a typed tool protocol, executable permission policy, controlle
 
 ## Tool Protocol
 
-- [ ] `M10-001 BLOCKER` Define a typed internal tool request and result envelope.
-- [ ] `M10-002` Include tool name, arguments, working directory, timeout, authority class, idempotency, and expected side effects.
-- [ ] `M10-003` Define read-file and list-directory tools.
-- [ ] `M10-004` Define symbol/search tools.
-- [ ] `M10-005` Define structured edit tools.
-- [ ] `M10-006` Define diff-inspection tools.
-- [ ] `M10-007` Define command-execution tools.
-- [ ] `M10-008` Define Git-status and history tools.
-- [ ] `M10-009` Define test, build, format, and static-analysis wrappers.
-- [ ] `M10-010` Define user-facing tool summaries.
-- [ ] `M10-011` Version tool schemas and record the version per run.
+- [x] `M10-001 BLOCKER` Define a typed internal tool request and result envelope.
+- [x] `M10-002` Include tool name, arguments, working directory, timeout, authority class, idempotency, and expected side effects.
+- [x] `M10-003` Define read-file and list-directory tools.
+- [x] `M10-004` Define symbol/search tools.
+- [x] `M10-005` Define structured edit tools.
+- [x] `M10-006` Define diff-inspection tools.
+- [x] `M10-007` Define command-execution tools.
+- [x] `M10-008` Define Git-status and history tools.
+- [x] `M10-009` Define test, build, format, and static-analysis wrappers.
+- [x] `M10-010` Define user-facing tool summaries.
+- [x] `M10-011` Version tool schemas and record the version per run.
 
 ## Permission Policy
 
-- [ ] `M10-012 BLOCKER SECURITY` Define automatic read-only actions.
-- [ ] `M10-013 BLOCKER SECURITY` Define task-scoped file-write actions.
-- [ ] `M10-014 BLOCKER SECURITY` Define approval-required actions.
-- [ ] `M10-015 SECURITY` Classify network access.
-- [ ] `M10-016 SECURITY` Classify dependency installation.
-- [ ] `M10-017 SECURITY` Classify writes outside the task worktree.
-- [ ] `M10-018 SECURITY` Classify credential access.
-- [ ] `M10-019 SECURITY` Classify destructive filesystem and Git actions.
-- [ ] `M10-020 SECURITY` Classify privileged commands and process management.
-- [ ] `M10-021 SECURITY` Classify external messaging, deployment, and publication.
-- [ ] `M10-022 SECURITY` Refuse actions with unknown authority classes.
-- [ ] `M10-023 SECURITY` Bind allow-for-task decisions to exact action patterns and scope.
-- [ ] `M10-024 SECURITY` Expire task-scoped permissions when the task ends.
-- [ ] `M10-025 SECURITY` Never infer permission from prior unrelated tasks.
-- [ ] `M10-026 SECURITY` Record requester, reason, exact command/action, scope, decision, and time.
+- [x] `M10-012 BLOCKER SECURITY` Define automatic read-only actions.
+- [x] `M10-013 BLOCKER SECURITY` Define task-scoped file-write actions.
+- [x] `M10-014 BLOCKER SECURITY` Define approval-required actions.
+- [x] `M10-015 SECURITY` Classify network access.
+- [x] `M10-016 SECURITY` Classify dependency installation.
+- [x] `M10-017 SECURITY` Classify writes outside the task worktree.
+- [x] `M10-018 SECURITY` Classify credential access.
+- [x] `M10-019 SECURITY` Classify destructive filesystem and Git actions.
+- [x] `M10-020 SECURITY` Classify privileged commands and process management.
+- [x] `M10-021 SECURITY` Classify external messaging, deployment, and publication.
+- [x] `M10-022 SECURITY` Refuse actions with unknown authority classes.
+- [x] `M10-023 SECURITY` Bind allow-for-task decisions to exact action patterns and scope.
+- [x] `M10-024 SECURITY` Expire task-scoped permissions when the task ends.
+- [x] `M10-025 SECURITY` Never infer permission from prior unrelated tasks.
+- [x] `M10-026 SECURITY` Record requester, reason, exact command/action, scope, decision, and time.
 
 ## Command Execution
 
-- [ ] `M10-027 BLOCKER` Execute commands in the task worker, not the browser.
-- [ ] `M10-028` Pass argument arrays instead of concatenated shell strings where possible.
-- [ ] `M10-029` Set the task worktree as the default working directory.
-- [ ] `M10-030` Validate working directories against task scope.
-- [ ] `M10-031` Apply bounded timeouts.
-- [ ] `M10-032` Support cooperative cancellation.
-- [ ] `M10-033` Kill descendant processes on cancellation where the platform permits.
-- [ ] `M10-034` Bound stdout and stderr capture.
-- [ ] `M10-035` Stream redacted progress without persisting unbounded output.
-- [ ] `M10-036` Preserve exit code, duration, timeout, cancellation, and truncation metadata.
-- [ ] `M10-037` Separate environment allowlists from the coordinator environment.
-- [ ] `M10-038` Remove provider credentials from worker environments.
-- [ ] `M10-039` Record executable identity and resolved path.
-- [ ] `M10-040` Detect commands that exceed approved scope.
-- [ ] `M10-041` Provide a user-readable approval description.
-- [ ] `M10-042` Provide allow-once, allow-for-task, and deny.
-- [ ] `M10-043` Do not silently fall back after denial.
+- [x] `M10-027 BLOCKER` Execute commands in the task worker, not the browser.
+- [x] `M10-028` Pass argument arrays instead of concatenated shell strings where possible.
+- [x] `M10-029` Set the task worktree as the default working directory.
+- [x] `M10-030` Validate working directories against task scope.
+- [x] `M10-031` Apply bounded timeouts.
+- [x] `M10-032` Support cooperative cancellation.
+- [x] `M10-033` Kill descendant processes on cancellation where the platform permits.
+- [x] `M10-034` Bound stdout and stderr capture.
+- [x] `M10-035` Stream redacted progress without persisting unbounded output.
+- [x] `M10-036` Preserve exit code, duration, timeout, cancellation, and truncation metadata.
+- [x] `M10-037` Separate environment allowlists from the coordinator environment.
+- [x] `M10-038` Remove provider credentials from worker environments.
+- [x] `M10-039` Record executable identity and resolved path.
+- [x] `M10-040` Detect commands that exceed approved scope.
+- [x] `M10-041` Provide a user-readable approval description.
+- [x] `M10-042` Provide allow-once, allow-for-task, and deny.
+- [x] `M10-043` Do not silently fall back after denial.
 
 ## Custom Commands and Plugins
 
-- [ ] `M10-044` Store approved custom command definitions in SQLite.
-- [ ] `M10-045` Represent custom command arguments as arrays with typed placeholders.
-- [ ] `M10-046` Require first-use approval for repository-suggested commands.
-- [ ] `M10-047` Record command version and source.
-- [ ] `M10-048` Define the subprocess boundary for future MCP or JSON-RPC plugins.
-- [ ] `M10-049 DEFER` Do not load arbitrary plugin code into the coordinator.
-- [ ] `M10-050 DEFER` Do not implement a plugin marketplace in the prototype.
+- [x] `M10-044` Store approved custom command definitions in SQLite.
+- [x] `M10-045` Represent custom command arguments as arrays with typed placeholders.
+- [x] `M10-046` Require first-use approval for repository-suggested commands.
+- [x] `M10-047` Record command version and source.
+- [x] `M10-048` Define the subprocess boundary for future MCP or JSON-RPC plugins.
+- [x] `M10-049 DEFER` Do not load arbitrary plugin code into the coordinator.
+- [x] `M10-050 DEFER` Do not implement a plugin marketplace in the prototype.
 
 ## Tests
 
-- [ ] `M10-051 TEST` Test automatic read-only actions.
-- [ ] `M10-052 TEST` Test task-scoped edits.
-- [ ] `M10-053 TEST` Test network-command approval.
-- [ ] `M10-054 TEST` Test dependency-install approval.
-- [ ] `M10-055 TEST` Test destructive-command denial.
-- [ ] `M10-056 TEST` Test allow-for-task scope expiration.
-- [ ] `M10-057 TEST` Test timeout and process-tree cancellation.
-- [ ] `M10-058 TEST` Test output truncation and redaction.
-- [ ] `M10-059 TEST` Test a malicious command description cannot change the executed argument array.
+- [x] `M10-051 TEST` Test automatic read-only actions.
+- [x] `M10-052 TEST` Test task-scoped edits.
+- [x] `M10-053 TEST` Test network-command approval.
+- [x] `M10-054 TEST` Test dependency-install approval.
+- [x] `M10-055 TEST` Test destructive-command denial.
+- [x] `M10-056 TEST` Test allow-for-task scope expiration.
+- [x] `M10-057 TEST` Test timeout and process-tree cancellation.
+- [x] `M10-058 TEST` Test output truncation and redaction.
+- [x] `M10-059 TEST` Test a malicious command description cannot change the executed argument array.
+
+M10 test evidence:
+
+- Typed-catalog and policy tests cover every tool family, unknown authority,
+  exact grants, one-use consumption, task expiry, cross-task isolation,
+  network/dependency/destructive classification, exact approved recipes, and
+  capability denial across tool substitution.
+- Real subprocess tests cover absolute executable identity, array-only
+  arguments, confined working directories, minimal credential-free
+  environments, bounded redacted output/progress, cooperative cancellation,
+  timeouts, and representative descendant termination.
+- SQLite tests cover immutable per-run schema bindings, attributable
+  permission facts, reviewed typed custom commands, optimistic command
+  lifecycle metadata, bounded redacted output, idempotency, and stale writes.
+  The plugin contract permits only versioned JSON-RPC or MCP subprocesses with
+  explicit filesystem, network, secret-reference, and side-effect scopes.
 
 ## Gate
 
-- [ ] `M10-G01 GATE` Every non-automatic action has an attributable policy decision.
-- [ ] `M10-G02 GATE` Denied authority cannot be regained through tool substitution.
-- [ ] `M10-G03 GATE` Cancellation terminates representative child-process trees on every supported platform.
+- [x] `M10-G01 GATE` Every non-automatic action has an attributable policy decision.
+- [x] `M10-G02 GATE` Denied authority cannot be regained through tool substitution.
+- [x] `M10-G03 GATE` Cancellation terminates representative child-process trees on every supported platform.
 
 ---