Repository navigation
Phase 3 RFC: Trusted executable provider runtime and sandbox #1105
Description
Goal
Design and implement a trusted executable provider runtime only after an explicit RFC/security gate. This is the track for plugins that need real code, tools, assemblies, package installs, or supervised MCP processes.
Non-negotiable guardrails
- Trust tiers: executable plugins must be local/trusted only; community executables rejected initially.
- Explicit permissions: binaries, network domains, filesystem reads/writes, timeouts, and concurrency are declared and enforced.
- No wildcard allowlists.
- Sandbox/isolation before first executable runs.
- Two-step approval: dry-run disclosure plus explicit
--approve/grant. - Artifact provenance: generated artifacts record plugin id, timestamp, SHA-256, and stale status.
- Full audit for every execution attempt, denial, timeout, artifact write, and provider call.
Acceptance criteria
- RFC documents trust model, permission schema, sandbox strategy, and rollback behavior.
- Manifest validator rejects executable capability without trust tier and explicit grants.
- Runtime blocks enable/start without user approval.
- Negative tests cover untrusted executables, wildcard grants, forbidden binaries, path escape, network escape, timeout, and artifact tampering.
- Worf security review and Picard architecture review are required before implementation merge.
Explicitly out of scope until approved
- Silent package installs.
- Arbitrary plugin scripts.
- Dynamic provider assemblies.
- Unsandboxed MCP server startup.
- Network access not declared in grants.
Depends on #1092 and should not block the MVP PR.
Parent epic: https://github.com/bradygaster/squad/issues/1102
Activity
github-actions commentedon Sep 10, 2026
🔄 Ralph — Auto-Triage
Assigned to: Flight
Reason: No module, routing, or role keyword match — routed to Lead/Architect
Source: lead-fallback
github-actions commentedon Sep 10, 2026
🔄 Ralph — Auto-Triage
Assigned to: Flight
Reason: No module, routing, or role keyword match — routed to Lead/Architect
Source: lead-fallback
github-actions commentedon Sep 11, 2026
🔄 Ralph — Auto-Triage
Assigned to: Flight
Reason: No module, routing, or role keyword match — routed to Lead/Architect
Source: lead-fallback
github-actions commentedon Sep 11, 2026
🔄 Ralph — Auto-Triage
Assigned to: Flight
Reason: No module, routing, or role keyword match — routed to Lead/Architect
Source: lead-fallback
github-actions commentedon Sep 11, 2026
🔄 Ralph — Auto-Triage
Assigned to: Flight
Reason: No module, routing, or role keyword match — routed to Lead/Architect
Source: lead-fallback
github-actions commentedon Sep 11, 2026
🔄 Ralph — Auto-Triage
Assigned to: Flight
Reason: No module, routing, or role keyword match — routed to Lead/Architect
Source: lead-fallback
github-actions commentedon Sep 13, 2026
🔄 Ralph — Auto-Triage
Assigned to: security-reviewer
Reason: Matched routing keyword(s): Security review, security, review
Source: routing-rule
bradygaster commentedon Nov 5, 2026
Closing as not planned for the 2.0 line during board triage (owner decision). Plugin extensibility phase 2 is out of scope for 2.0; reopen if it returns to the roadmap.