Expand description
The capability vocabulary — the 12 facets of v1.4 §2.
A Capability is one point in facet-space; a Profile is the set of
capabilities a resolved command line exhibits. Nothing here makes a decision —
admissibility (a level predicate over profiles) arrives in a later commit.
Two kinds of facet term:
- ordinal — a severity/trust ladder;
#[derive(Ord)]gives declaration order = the ladder, so a level can ceiling it (facet <= term) or floor it (facet >= term). The first-declared variant is the least-severe zero term and theDefault. - categorical — a set with no severity ordering; admissibility is set
membership, never
<=. Deliberately notOrd, so a comparison can’t be written by accident (the R25 bug: never orderkernelvsremote).
Compound facets (locus, persistence, disclosure, secret, network) are
structs of independent axes, each its own term — never collapsed to one ordinal.
Structs§
- Capability
- One capability — a single point in facet-space (v1.4 §2.8). Facets left unset
default to their zero term.
becausecites the discriminator (§5); the nested delegate profile and supply-chain sub-facets arrive with the mechanisms that need them. - Disclosure
- Where disclosed output goes, over which channel, whose data (v1.4 §2.4).
- Execution
- Code provenance: the local-trust rung, plus supply-chain detail when the code is
network-sourced (v1.4 §2.6).
supply_chainis present only for network-sourced execution — a command running no downloaded code leaves itNone, and a level’s supply-chain constraints are then vacuously satisfied. - Locus
- Reach — two independent axes (v1.4 §2.2, R25).
- Network
- A network capability’s shape (v1.4 §2.5).
- Persistence
- What a capability leaves behind, and when it re-fires (v1.4 §2.3).
- Profile
- The set of capabilities a resolved command line exhibits (v1.4 §2.8, §4.1). A profile passes a level iff every capability is admissible.
- Secret
- A capability’s relationship to secrets, over which channel, whose (v1.4 §2.4).
- Supply
Chain - The provenance of network-sourced code (v1.4 §2.6).
- Trigger
- Durability trigger — how far execution escapes, and (if recurring) what kind.
Enums§
- Anchoring
- How firmly a LOCAL path is pinned to the place it names — the local counterpart to
Provenance, which grades the same question for remote targets. - Authority
- Privilege the capability runs with (v1.4 §2.2).
- Channel
- The channel a disclosure or secret flows over (v1.4 §2.4). An open set:
an unrecognized/covert channel is
Unknownand worst-cased by the resolver. - Cost
- Resource/billing cost (v1.4 §2.7). Populated for provisioning tools.
- Disclosure
Audience - Who ends up able to see disclosed output (v1.4 §2.4).
local-processis stdout → the agent/model provider — the HP-15 audience that gates secret reads. - Exec
Surface - When/what fetched code runs (v1.4 §2.6). Categorical — the risk order across install-hook / build-script / call-time / run-artifact is genuinely unclear, so a level lists the surfaces it accepts instead of ceiling-ing a false ladder.
- Execution
Trust - Where executed code comes from (v1.4 §2.6, local-trust ladder). When
NetworkSourced, the supply-chain sub-facets (SupplyChain) refine it. - Isolation
- Isolation strength of an enclosing frame (v1.4 §2.2). A frame clamps nested
locustosandbox-scope; breach flags re-add loci (§3.2). - Local
Locus - How deep into this host a capability reaches (v1.4 §2.2).
device/kernelvoid the abstractions the fs rungs assume and are deny-by-default everywhere. - NetDestination
- Network destination (v1.4 §2.5). Same axis as
locus.remotereach. - NetDirection
- Network direction (v1.4 §2.5).
- NetPayload
- What a network capability carries (v1.4 §2.5).
- Operation
- The operation a capability performs (v1.4 §2.1). One per capability.
- Persistence
Level - What the capability leaves behind (v1.4 §2.3, the level axis of
persistence). - Pinning
- How tightly a fetched artifact is pinned (v1.4 §2.6). A trust ladder: higher
is safer, so a level floors it (
>= version) rather than ceilings it. - Principal
- Whose data a read touches (v1.4 §2.4) — a read can cross a principal boundary on the same host (another process’s memory/argv) with no fs or network touch.
- Provenance
- How the acted-on remote target was DESIGNATED — a trust ladder, orthogonal to
RemoteReach(breadth: one host vs any) andRemoteBinding(visibility: on the CLI vs from session). Trust in a destination follows its provenance: what makesgit pushsafe is that the target is a pre-established root, not that data leaves. The destination-aware resolver assigns it from the target argument (we do not read.git/config); seebehavioral-taxonomy-exposure.md§4. - Remote
Binding - Whether a remote target is named on the command line or taken from session
state — the pinned-vs-ambient bit
infragates on (v1.4 §2.2, HP-12). - Remote
Reach - Which other host a capability reaches (v1.4 §2.2, the reach axis of
locus). - Retrieval
Granularity - Granularity of what a READ retrieves — orthogonal to
scale(which counts items) andsecret(which flags credentials). Distinguishes a metadata/descriptor read from the retrieval of opaque STORED CONTENT the classifier cannot assess.bulk-contentis a stored blob (an S3 object, an EBS block, a Glacier archive) — routinely a secrets file, private key, or DB dump, but unknowable statically — so it earns a proportionate tier (network-admin: elevated remote egress) WITHOUT being conflated with a credential read (secret = reads→ yolo).recordis structured data you asked for (query results, a db dump);metadatais a descriptor (describe/list/get-config). See docs/design/behavioral-taxonomy-archetypes.md §5 (#1). - Reversibility
- How hard the effect is to undo (v1.4 §2.3). Environment-dependent cases resolve worst-case (HP-8).
- Scale
- Breadth of effect (v1.4 §2.2). Modifies
destroyanddisclosure(R23). - Secret
Level - A capability’s relationship to secret material (v1.4 §2.4).
- Supply
Source - Where network-sourced code came from (v1.4 §2.6). Categorical — a level lists the sources it accepts rather than assuming a severity order.
- Trigger
Escape - How far execution escapes the check (v1.4 §2.3, R16/R24) — the part levels gate.
- Trigger
Kind - The kind of recurrence (v1.4 §2.3) — for the
becausestring, not a severity rung: a per-saveeventcan fire more often than a monthlyclock.
Traits§
- Facet
Term - A single facet term: the closed vocabulary of one axis, with its TOML spelling.