Repository navigation
feat(session): plugin-origin session turns with operator-only approval (RIG-8011) - #35
Merged
Merged
Conversation
Adds plugin_origin_turn and is_plugin_origin_turn, shared by the three tasks in docs/designs/hermes-agent/plugin-origin-sessions.md. Refs RIG-8011 Co-authored-by: Matt Wilkinson <matt@rigel.build>
Allow explicitly configured core Discord tools on cotal and enforce the frozen peer-mesh/plugin-origin scope for reads, searches, and writes. Add tests and update toolset/tool references. Refs RIG-8136 Co-authored-by: Matt Wilkinson <matt@rigel.build>
Refs RIG-8137 Co-authored-by: Matt Wilkinson <matt@rigel.build>
Admits an allowed plugin's turn to a bot-owned Discord thread with no human envelope, authorized by _plugin_origin_authorized; revalidates at claim and recovery; refused rows settle cancelled. Refs RIG-8137 Co-authored-by: Matt Wilkinson <matt@rigel.build>
Route keyed notes into a plugin-only session through plugin_origin_v1, and authorize later notes against the committed human source. Keep the no-authority origin path. Recovery binds the restarting source once check pins each queued descriptor. Fix test isolation and coordination, and cover the remaining Task 2 cases. Refs RIG-8137 Co-authored-by: Matt Wilkinson <matt@rigel.build>
…/deny cards (RIG-8138) Route plugin-origin approvals through the operator while preserving operator and peer-mesh behavior. Add gateway coverage and document Discord approval cards. Spec-impact: none Refs RIG-8138 Co-authored-by: Matt Wilkinson <matt@rigel.build>
…olsets (RIG-8011)
Refs RIG-8011 Co-authored-by: Matt Wilkinson <matt@rigel.build>
rigel-mintaka
changed the title
Collaborator
Author
Review roundsRound 1 (review-lead, head
Head check 1 ( Head check 2 ( All clearReviewed head |
rigel-mintaka
marked this pull request as ready for review
November 6, 2026 04:50
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Plugin-origin session turns (rows admitted by
plugin_origin_v1, such as Cotal peer DMs) now run as first-class gateway sessions with the same safety posture as operator turns, or stricter. Design record: RigelBuild/docsdocs/designs/hermes/(RIG-8011, merged in RigelBuild/docs#67).plugin_origin_turnContextVar marks a turn as plugin-origin.plugin_origin_v1admission. Rows are authorized only by_plugin_origin_authorized, never by a human principal. Each claimed row runs in a fresh context.approvals.mode: off, permanent allowlist, grants, smart approve and codex auto-approve cannot bypass it. A guardian denial blocks. Operator turns are unchanged. Peer-mesh deny still runs first.turn_v1.plugin_originplus the child marker), revocation of claimed rows, and context leakage.Preserved unchanged:
committed_route_envelope,snapshot_automation,_event_clause,check_native_route. No plugin check passesallow_adapter_delegation=True.Decisions
Open Questions
None.
Implementation note
The review-fix slice first went to
implement-hard. It stopped on a 429 rate limit after it had partly fixed two findings. A Lunaimplementagent finished the rest (bd100a82). Not a Luna failure.Tests
scripts/run_tests.shon 8 files (plugin-origin session/approval, managed turn contract, codex handoff, yolo, discord tool, tools config, approval): 403 passed, 0 failed, 6 skipped.ruff checkon touched files: clean.Spec-impact: none in this repo. orion repin plus
platform_toolsets.cotalwiring follows in RIG-8003.Refs RIG-8011, RIG-8136, RIG-8137, RIG-8138