P1 — compile user-authored command definitions into validated `IntentFrame`/capability plans #163

New issue

Closed

opened 2026-08-22 21:53:52 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-08-22 21:53:52 +00:00

(Migrated from github.com)

Parent epic: #151
Depends on: #162, #157

Goal

Create a deterministic compiler/validator from persisted user-command definitions into the same semantic trigger/slot/capability structures used by built-ins. No second macro interpreter.

Requirements

validate trigger grammar/aliases and typed slot schemas;
resolve action capability ids only against registered semantic capabilities;
validate bound/default arguments against capability schemas;
forbid raw shell, dynamic Python/Prolog, arbitrary executable/import/provider names;
deterministic diagnostics with source definition id/field;
compilation is side-effect free;
atomic registry replacement/hot reload after all definitions validate;
invalid one-command policy researched: fail that definition vs fail whole reload, but never expose partial inconsistent registry;
preserve principal/device target policy without accepting client-authoritative owner ids.

Tests

Simple work mode -> two open-app semantic actions; parameterized timer command; unknown capability; invalid slot type/default; trigger ambiguity; built-in collision; malicious shell/import/Prolog-looking payload; provider removed after compile; reload while turns execute; deterministic normalized compiled representation.

Acceptance

User definitions become ordinary validated semantic inputs to #150, with no alternate execution language or bypass.

Parent epic: #151 Depends on: #162, #157 ## Goal Create a deterministic compiler/validator from persisted user-command definitions into the same semantic trigger/slot/capability structures used by built-ins. No second macro interpreter. ## Requirements - validate trigger grammar/aliases and typed slot schemas; - resolve action capability ids only against registered semantic capabilities; - validate bound/default arguments against capability schemas; - forbid raw shell, dynamic Python/Prolog, arbitrary executable/import/provider names; - deterministic diagnostics with source definition id/field; - compilation is side-effect free; - atomic registry replacement/hot reload after all definitions validate; - invalid one-command policy researched: fail that definition vs fail whole reload, but never expose partial inconsistent registry; - preserve principal/device target policy without accepting client-authoritative owner ids. ## Tests Simple `work mode` -> two open-app semantic actions; parameterized timer command; unknown capability; invalid slot type/default; trigger ambiguity; built-in collision; malicious shell/import/Prolog-looking payload; provider removed after compile; reload while turns execute; deterministic normalized compiled representation. ## Acceptance User definitions become ordinary validated semantic inputs to #150, with no alternate execution language or bypass.