Expand description
Plugin authority / capability isolation (ADR-162, P5).
Wasmtime already gives a plugin memory isolation — it cannot read
another plugin’s linear memory. It does NOT, by itself, stop a plugin
from using a host import to write any entity it likes. Before this fix
hc_state_set happily let any plugin write lock.front_door or
alarm_control_panel.*, and the manifest’s homecore_permissions
claims were parsed but never consulted (ADR-161 deferred P5).
This module adds authority isolation: a plugin may only write
entities its manifest declared. The host import consults a
PermissionSet before applying any state write and returns a typed
error to the guest (it does not panic the host) on a violation.
§Permission grammar
Each entry in homecore_permissions is one of:
- a bare entity glob —
"light.*","light.kitchen","*"; - the explicit capability form
"state:write:<glob>"(the form the ADR-128 manifest doc shows), e.g."state:write:sensor.*".
A glob supports a single trailing * (HA-style domain wildcards:
light.* matches every light entity) and a leading-or-bare *
(* = everything). Exact strings match exactly. A plugin with no
state:write entries can write nothing — the secure default.
Structs§
- Permission
Set - The set of entity-write permissions a plugin holds, distilled from its
manifest
homecore_permissionsat load time.