Embed fixed files in specgen-generated exec commands #272

New issue

Closed

opened 2026-08-06 06:28:28 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-06 06:28:28 +00:00

Member

Add a specgen-owned way for an exec grant to include reviewed complex logic without relying on a runtime repository path.

Proposed contract:

wrap example ops measure {
    exec python3
    can run storage {
        argv "-I"
        embed "scripts/storage_measure.py"
        sealed
    }
}

Acceptance criteria:

Treat embed as a typed fixed argv element at its declaration position.
Resolve source paths relative to the declaring guardfile at build time.
Reject absolute paths, traversal, symlink escapes, duplicate or conflicting artifacts, missing files, and non-regular files.
Include embedded bytes and identities in generated source and cache staleness.
Materialize files into a private runtime directory and pass absolute paths to the wrapped binary.
Remove the runtime directory after command completion, including failures.
Keep caller arguments unable to select or replace an embedded file.
Render embedded argv symbolically in help and describe output rather than exposing an invocation-specific temporary path.
Cover merged projects, source changes, argument ordering, sealed grants, cleanup, and failure behavior.
Document the build-time and runtime trust boundaries.

Add a specgen-owned way for an exec grant to include reviewed complex logic without relying on a runtime repository path. Proposed contract: ```kdl wrap example ops measure { exec python3 can run storage { argv "-I" embed "scripts/storage_measure.py" sealed } } ``` Acceptance criteria: * Treat `embed` as a typed fixed argv element at its declaration position. * Resolve source paths relative to the declaring guardfile at build time. * Reject absolute paths, traversal, symlink escapes, duplicate or conflicting artifacts, missing files, and non-regular files. * Include embedded bytes and identities in generated source and cache staleness. * Materialize files into a private runtime directory and pass absolute paths to the wrapped binary. * Remove the runtime directory after command completion, including failures. * Keep caller arguments unable to select or replace an embedded file. * Render embedded argv symbolically in help and describe output rather than exposing an invocation-specific temporary path. * Cover merged projects, source changes, argument ordering, sealed grants, cleanup, and failure behavior. * Document the build-time and runtime trust boundaries.

coilyco-ops referenced this issue from a commit

2026-08-06 06:50:00 +00:00

feat: embed fixed files in generated exec commands

coilyco-ops referenced this issue from a pull request that will close it,

2026-08-06 06:50:18 +00:00

feat: embed fixed files in generated exec commands #273