khyari hamza 2b09568cfa feat(security): enforce read-only actions ...

Tighten ToolRuntime._enforce_capabilities() to block ANY tool with
writes=True when plan_read_only is set, removing the not-cap.read_only
loophole that allowed certain write tools through. Tool name is now
always included in the ToolAccessDeniedError message.

Add read_only flag to ChangeSetCapture with ReadOnlyViolationError
raised when write-capable tools are wrapped on a read-only plan.

Add CLI fail-fast guards on plan execute and plan apply commands that
abort before calling the service layer if plan.read_only is True.

SkillContext.enforce_write_guard() already included tool name
correctly and required no changes.

Includes 18 Behave scenarios (90 steps), Robot integration tests,
ASV benchmarks, and docs/reference/read_only_actions.md.

ISSUES CLOSED: #322

2026-02-26 20:33:20 +00:00

..

acp.md

feat(M6.1): ACP facade stubs with transport, events, and versioning

2026-02-22 15:02:19 +00:00

action_cli.md

feat(cli): add action and plan CLI extensions

2026-02-23 10:46:53 +00:00

actor_cli.md

feat(cli): align actor commands to YAML

2026-02-24 19:12:01 +00:00

actor_compiler.md

feat(actor): compile hierarchical actor configs to LangGraph

2026-02-24 17:57:18 +00:00

actor_config.md

feat(actor): extend hierarchical actor YAML schema and loader

2026-02-25 10:30:42 +00:00

actor_hierarchy.md

feat(actor): extend hierarchical actor YAML schema and loader

2026-02-25 10:30:42 +00:00

actor_runtime.md

feat(actor): add tool-calling runtime for execution actors

2026-02-22 08:31:45 +00:00

actors_examples.md

Docs: Add resource DAG operational semantics, tool reachability, cross-mechanism coordination, container, and LSP resource type ADRs (036-040)

2026-02-21 19:51:28 -05:00

actors_loading.md

feat(actor): add actor registry and loader

2026-02-19 11:29:34 +00:00

actors_schema.md

docs(actor): add comprehensive actor schema reference documentation

2026-02-17 13:26:15 +00:00

async_safety.md

fix(security): address PR #435 review feedback

2026-02-26 14:30:43 +00:00

audit_logging.md

feat(security): add audit logging for apply

2026-02-19 19:23:30 +00:00

automation_profile_service.md

Merge branch 'master' into develop-20260217

2026-02-18 03:27:00 +00:00

automation_profiles.md

feat(automation): add automation profiles and guards

2026-02-22 10:19:43 +00:00

change_tracking.md

feat(change): add ChangeSet models and invocation tracker

2026-02-21 16:27:40 +00:00

changeset_model.md

Merge branch 'master' into develop-20260217

2026-02-18 03:27:00 +00:00

changeset.md

feat(changeset): persist changesets and diff artifacts

2026-02-26 02:47:14 +00:00

cleanup.md

feat(ops): add cleanup commands

2026-02-19 13:46:48 +00:00

cli_system_commands.md

docs(cli): add system command reference and diagnostics check list

2026-02-18 12:18:42 +00:00

concurrency.md

feat(concurrency): add plan and project locks

2026-02-25 10:48:05 -05:00

config_cli.md

feat(cli): add config get/set/list commands

2026-02-19 23:48:40 +00:00

config_resolution.md

feat(config): add config service with multi-level resolution

2026-02-23 10:44:58 +00:00

cost_controls.md

feat(provider): add cost controls and fallback

2026-02-25 12:08:01 -05:00

database_schema.md

feat(decision): add decision persistence

2026-02-26 13:40:07 +00:00

decision_correction.md

feat(M4.2): Correction service with revert/append BFS + dry-run

2026-02-22 16:40:06 +00:00

decision_model.md

feat(decision): add decision domain and context snapshots

2026-02-23 22:19:19 +00:00

definition_of_done.md

feat(dod): enforce definition-of-done gating

2026-02-25 10:04:31 +00:00

diagnostics_checks.md

docs: Moved the last elements from implementation plan to their respective locations and deleted the plan from the repo

2026-02-23 17:53:26 -05:00

diff_review.md

feat(change): add diff review artifacts

2026-02-25 10:02:38 +00:00

error_handling.md

fix(security): enforce explicit exception handling

2026-02-25 10:05:57 +00:00

error_recovery.md

feat(plan): add error recovery patterns and CLI hints

2026-02-25 10:05:10 +00:00

invariants.md

feat(invariant): add invariant models and enforcement

2026-02-22 09:23:35 +00:00

lsp.md

feat(lsp): add registry and runtime stubs

2026-02-22 10:15:25 +00:00

output_rendering.md

feat(cli): add output rendering framework with materialization strategies

2026-02-21 10:19:45 -05:00

phase_reversion.md

feat(plan): add phase reversion state machine

2026-02-23 10:45:01 +00:00

plan_apply.md

feat(plan): add error recovery patterns and CLI hints

2026-02-25 10:05:10 +00:00

plan_cli.md

feat(cli): add action and plan CLI extensions

2026-02-23 10:46:53 +00:00

plan_execute.md

feat(plan): add error recovery patterns and CLI hints

2026-02-25 10:05:10 +00:00

project_context_cli.md

Merge branch 'master' into develop-20260217

2026-02-18 03:27:00 +00:00

project_context_policy.md

Merge branch 'master' into develop-20260217

2026-02-18 03:27:00 +00:00

read_only_actions.md

feat(security): enforce read-only actions

2026-02-26 20:33:20 +00:00

repl.md

feat(cli): add interactive repl

2026-02-23 03:11:12 +00:00

resource_cli.md

feat(cli): add resource tree and inspect commands

2026-02-20 08:48:33 -05:00

resource_dag.md

Docs: Add resource DAG operational semantics, tool reachability, cross-mechanism coordination, container, and LSP resource type ADRs (036-040)

2026-02-21 19:51:28 -05:00

resource_handlers.md

feat(resource): add handler runtime for git-checkout and fs-directory

2026-02-23 22:20:44 +00:00

resource_types_builtin.md

Merge branch 'master' into develop-20260217

2026-02-18 03:27:00 +00:00

resources.md

feat(resource): add resource registry and DAG metadata

2026-02-23 22:20:44 +00:00

secrets_handling.md

feat(security): add secrets masking and validation (H-21/SEC5)

2026-02-19 11:15:18 +00:00

security_eval.md

fix(security): remove eval-based config parsing

2026-02-21 16:32:03 +00:00

session_cli.md

feat(cli): add session commands

2026-02-20 01:10:19 +00:00

session_model.md

test(session): add robot session model smoke tests

2026-02-17 20:33:53 +00:00

skill_cli.md

feat(cli): add skill commands

2026-02-17 14:44:40 +00:00

skill_registry.md

feat(apply): run validation attachments

2026-02-25 10:03:21 +00:00

skill_resolution.md

test(skill): add robot skill resolver smoke tests

2026-02-17 19:58:15 +00:00

skills_context.md

feat(skill): add skill context and registry

2026-02-20 08:50:08 -05:00

skills_file.md

feat(skill): add file operation skills

2026-02-21 10:18:26 -05:00

skills_git.md

feat(skill): add git operation skills

2026-02-21 16:30:33 +00:00

skills_inline.md

feat(skill): add inline tool executor

2026-02-20 08:50:08 -05:00

skills_protocol.md

feat(skill): add skill protocol and metadata

2026-02-20 08:50:08 -05:00

skills_search.md

feat(skill): add directory and search skills

2026-02-21 10:18:26 -05:00

template_security.md

fix(security): harden template rendering

2026-02-25 10:06:27 +00:00

tool_bindings.md

Docs: Added JINJA2 details to docs

2026-02-20 15:57:21 +00:00

tool_cli.md

feat(cli): add tool and validation commands

2026-02-20 08:49:30 -05:00

tool_model.md

test(tool): add robot tool model smoke tests

2026-02-17 21:14:46 +00:00

tool_router.md

feat(change): add tool router for providers

2026-02-21 10:23:31 -05:00

validation_pipeline.md

feat(validation): add validation pipeline and results model

2026-02-25 10:03:57 +00:00