2 Commits

Author	SHA1	Message	Date
khyari hamza	493e5cf8a1	fix(security): wire read_only through ExecuteStubActor and replace stubs with real tests ... - Add read_only kwarg to ExecuteStubActor.execute(), propagated to ChangeSetCapture; PlanExecutor._run_execute_with_stub passes plan.read_only through the execution path (P1 #2 fix) - Replace CLI fail-fast and Action-Skill stub scenarios with real ExecuteStubActor spy test and SkillContext.enforce_write_guard integration tests (P2 #1 fix) - Update docs: remove unimplemented Layer 5 (Action-Skill), add ExecuteStubActor wiring description, fix test command (P2 #2 fix) ISSUES CLOSED: #322	2026-02-26 20:33:20 +00:00
khyari hamza	2b09568cfa	feat(security): enforce read-only actions ... Tighten ToolRuntime._enforce_capabilities() to block ANY tool with writes=True when plan_read_only is set, removing the not-cap.read_only loophole that allowed certain write tools through. Tool name is now always included in the ToolAccessDeniedError message. Add read_only flag to ChangeSetCapture with ReadOnlyViolationError raised when write-capable tools are wrapped on a read-only plan. Add CLI fail-fast guards on plan execute and plan apply commands that abort before calling the service layer if plan.read_only is True. SkillContext.enforce_write_guard() already included tool name correctly and required no changes. Includes 18 Behave scenarios (90 steps), Robot integration tests, ASV benchmarks, and docs/reference/read_only_actions.md. ISSUES CLOSED: #322	2026-02-26 20:33:20 +00:00