From b9f4c5886300e16bdc88a8f454b2af87eb17dd27 Mon Sep 17 00:00:00 2001 From: Affaan Mustafa Date: Sun, 26 Jul 2026 04:13:28 -0400 Subject: [PATCH] docs: harden control-plane execution gates --- docs/ECC-2.0-GA-ROADMAP.md | 44 ++++++++++++++++++++++++++------------ 1 file changed, 30 insertions(+), 14 deletions(-) diff --git a/docs/ECC-2.0-GA-ROADMAP.md b/docs/ECC-2.0-GA-ROADMAP.md index 858796806..86ab1863f 100644 --- a/docs/ECC-2.0-GA-ROADMAP.md +++ b/docs/ECC-2.0-GA-ROADMAP.md @@ -62,33 +62,47 @@ The execution sequence is deliberately read-only first and promotion-gated: 2. **ECC2 MCP read plane.** Add an opt-in MCP server over existing ECC2 stores with bounded, redacted `list_sessions`, `get_diff`, `worktree_status`, and `merge_queue` tools. This slice performs no task, - merge, approval, or filesystem mutation. + merge, approval, or filesystem mutation. Bind caller identity and a + canonical realpath workspace ID at server startup; expose only records owned + by that workspace/caller; deny undeclared read capabilities; and rate-limit + and audit every read without logging returned content. 3. **ECC2 MCP mutation plane.** Add `create_task`, `merge_task`, and `approve_tool` only after the read plane is stable. Require explicit capability gates, immutable audit receipts, dry-run previews, and the - existing risk/profile policy at every mutation boundary. + existing risk/profile policy at every mutation boundary. Caller identity, + workspace ownership, and per-tool authorization fail closed before inputs + reach the store or filesystem. 4. **Worktree lifecycle contract.** Define and schema-validate `ecc.worktree.yml`; specify `new`, `split`, `fork`, and `close` state transitions; define bounded context seeding and lifecycle hooks without copying secrets or raw harness transcripts. 5. **TCAS leases and merge serialization.** Derive touched paths from tool - activity, persist `{session, branch, touched_paths, heartbeat}` leases, show - overlap before blocking, then add queue serialization, lease expiry, and - human escalation records. -6. **Consent-gated OTLP v2.** Standardize `ecc.*` span names and redacted - attributes, propagate `TRACEPARENT`, and add an explicit opt-in live - exporter. Existing JSON export remains the offline fallback; no prompts, - secrets, or memory bodies enter telemetry. -7. **Skill-quality and promotion gates.** Stabilize invocation telemetry + activity and normalize each path against the canonical workspace. Persist + `{session, branch, touched_paths, heartbeat, owner, epoch}` leases with + transactional acquire/renew/release, unique overlap enforcement, and + compare-and-swap owner/epoch checks. Show overlap before blocking, then add + queue serialization, bounded lease expiry/recovery after heartbeat loss, + and human escalation records. +6. **Consent-gated telemetry schema.** Standardize `ecc.*` span names and + bounded attributes, define `TRACEPARENT` propagation, and require explicit + consent, schema validation, and deterministic redaction before any sink. + Missing or invalid consent fails closed. Prompts, secrets, memory bodies, + raw diffs, and unbounded error text are forbidden by schema and regression + tests for both offline and future live output. +7. **Consent-gated OTLP exporter.** Add the opt-in live exporter only after + the telemetry schema and redaction suite are stable. Existing JSON export + remains the offline fallback, but it passes through the same consent, + validation, redaction, and bounded-output gate as the live sink. +8. **Skill-quality and promotion gates.** Stabilize invocation telemetry before adding determinism and delta-value measures. Proposed skills live in a candidate area and may reach canonical surfaces only through a recorded eval result, human approval, append-only transition event, and reversible promotion. -8. **AgentShield v2 enforcement.** Introduce a versioned allow/approve/block +9. **AgentShield v2 enforcement.** Introduce a versioned allow/approve/block policy contract enforced by ECC2, followed by signed provenance, registry locks, and optional dual-engine scanning from [issue #2415](https://github.com/affaan-m/ECC/issues/2415). -9. **Distribution interop.** Add provenance-preserving npx-skills and ClawHub +10. **Distribution interop.** Add provenance-preserving npx-skills and ClawHub import/export only after the policy and promotion contracts are stable. Training or inference automation remains deferred until telemetry, evaluation, consent, and rollback gates are operational. @@ -96,8 +110,10 @@ The execution sequence is deliberately read-only first and promotion-gated: Each numbered item is a separate implementation lane. Do not combine the read-only MCP plane with mutations, the telemetry schema with live export, or candidate generation with promotion. Each lane requires unit and integration -coverage, adversarial boundary tests, a migration/rollback note, and fresh -Linux, macOS, and Windows evidence before the next dependent lane begins. +tests, end-to-end coverage for its critical operator flow, at least 80% line +and function coverage, adversarial boundary tests, a migration/rollback note, +and fresh Linux, macOS, and Windows evidence before the next dependent lane +begins. ## 2026-05-20 Delta