← Back to Daily Builds

Daily build note · August 10, 2026

Plugin Permission Change Gate

An offline, deterministic pre-install and refresh gate that compares approved and candidate plugin/app snapshots, explains capability and permission drift, and produces a least-privilege...

AI Tools Build note published Public demo coming soon

What shipped

A runnable Python 3.11+ standard-library CLI now provides the complete offline review loop:

  • sample-review creates four strict fictional inputs plus complete approval, remediation, and rejection proposals.
  • review-change validates references, computes semantic permission drift, reconciles recorded decisions, renders nine deterministic artifacts, validates staging, and atomically replaces outputs/.
  • record-decision validates a fully supplied hash-bound envelope and atomically replaces only inputs/review-decisions.json.
  • validate-review independently recomputes and reconciles every artifact; --require-approved is the CI-style pilot approval gate.

The seeded candidate exposes required-app availability, optional-to-required dependency, role expansion, added write, weakened confirmation, widened sync, new domain, changed authentication, MCP schema drift, and a fictional sibling-plugin blast radius. The default receipt remains honestly pending.

Architecture

  • Exact input bytes are SHA-256 bound; normalized structures are used only for comparison and output.
  • JSON contracts use duplicate-key rejection, exact field sets, typed enums, safe text, stable IDs, and full reference resolution before diffing.
  • Observed before/after facts remain separate from policy severity, blocking state, and next action.
  • Review and finding IDs are derived from canonical content. Findings include approved/candidate/policy hashes and deliberately exclude the decisions hash.
  • Human outcomes deterministically derive status; contradictory claimed status is rejected.
  • Generation uses validated staging plus directory replacement. Validation reloads inputs and compares recomputed canonical artifact bytes rather than trusting the manifest.
  • The canonical manifest hashes the other eight outputs and explicitly excludes only itself.
  • The earlier SkillSafe Registry contributed only small ideas by value: hashing, stable IDs, evidence/judgment separation, queue ordering, paired reports, and least-privilege review ownership. There is no runtime parent dependency.

Trimmed scope

The build is a single-plugin local evidence and decision engine. It has no live export adapter, plugin installer, workspace mutation, OAuth, API, browser, model call, daemon, database, UI, notification, generic policy language, code scanner, or fleet view. The graph is deterministic Markdown rather than an interactive visualization. JSON 1.0 is the only accepted schema version.

Limitations

  • Results are only as complete as the declared snapshot metadata.
  • Shared-app blast radius covers declared consumer plugin IDs, not discovered consumers.
  • The tool does not inspect runtime behavior, source-system permissions, source code, package vulnerabilities, malware, prompt injection, compliance, or security posture.
  • Real platform exports need a separate, read-only mapping step outside this MVP.
  • Atomic directory replacement assumes the workspace and its temporary sibling are on the same local filesystem.
  • The optional packaging metadata exists, but the supported and verified path is direct execution from the build root.

Suggested next steps

  1. Run one paid, bounded review using manually mapped buyer-authorized exports and record which fields are hardest to obtain.
  2. Add a read-only adapter only after two reviews expose the same stable export format.
  3. Add schema migration tooling if a real consumer needs a 1.1 contract; keep 1.0 strict.
  4. Add signed reviewer identity only if an organization supplies a concrete identity and key-management boundary.
  5. Add a downstream export only after a named system requests the current canonical receipt or manifest.