50 lines
3.8 KiB
Markdown
50 lines
3.8 KiB
Markdown
# Glove future work
|
||
|
||
This file lists unresolved engineering work. Implemented history belongs in
|
||
version control, tests, and architecture documentation.
|
||
|
||
## P0: remote-launch gates
|
||
|
||
| Work | Completion condition |
|
||
|---|---|
|
||
| Direct-write approval | A distinct authenticated local-consent record is persisted with approval class, actor identity, plan/session digests, scope, and expiry; start verifies it before any retained host write. |
|
||
| Prompt-library expansion | A verified Sage bundle is parsed and projected into a bounded harness-native directory; launch binding and receipts commit every derived input. |
|
||
| Runtime adapter integration | Harness-native bundle projection and exact initial context are committed to the launch profile and receipt for every supported adapter. |
|
||
| Service ownership | Sage can activate the same-UID user-service templates. Production is complete when `gloved` uses a dedicated least-privilege identity, protected key rotation, and documented upgrade/recovery procedures. |
|
||
| macOS resource contract | CPU, memory, PID, wall-time, disk, and terminal-output limits are enforced and represented in authenticated receipts, or managed remote launch remains unavailable on macOS. |
|
||
| Exposure lifecycle hardening | Add explicit renewal and revocation CLI/UX plus lifecycle receipts without accepting remote host paths. |
|
||
|
||
## P1: protocol and integrity hardening
|
||
|
||
| Work | Completion condition |
|
||
|---|---|
|
||
| JSON-RPC correlation | Duplicate and unknown IDs cannot replace pending requests or disconnect the original caller; concurrent response routing has regression tests. |
|
||
| Transport deadlines | Partial frames and stalled peers have bounded receive deadlines; newline framing is asserted on every write path. |
|
||
| Capability change notification | Long-lived clients can detect effective capability changes without reconnect races. |
|
||
| Durable-state authentication | Session state and general activity logs are keyed or asymmetrically signed, with explicit recovery and key-rotation rules. |
|
||
| Immutable dependency pinning | Glaze and CI actions are pinned to immutable revisions with recorded provenance and verification. |
|
||
| Upstream containment | MCP upstream processes receive a separate sandbox profile or a documented isolated service boundary. |
|
||
|
||
## P2: validation evidence
|
||
|
||
| Work | Completion condition |
|
||
|---|---|
|
||
| Bundle parser fuzzing | The derived prompt-library bundle decoder has a sanitizer-backed target and checked adversarial corpus. |
|
||
| Remaining fault injection | Persisted journals share short-write/disk-full seams, and every lifecycle transition has crash/replay coverage. |
|
||
| Multi-agent matrix | Complete every required row in [`client-adoption-matrix.md`](client-adoption-matrix.md): all five built-in adapters share filesystem, environment, tool-policy binding, terminal, cleanup, and recovery evidence; the installed-client lane includes Codex and reports missing distributions as skips rather than silently passing. |
|
||
| Performance characterization | Startup cost, request latency, throughput, and memory overhead are measured with reproducible workloads and confidence intervals. |
|
||
| Comparative evaluation | Claims are evaluated against comparable containment and gateway designs using the same threat model and workload. |
|
||
|
||
## P3: packaging and extensibility
|
||
|
||
- Add exported CMake package targets and a stable `find_package(glove)` surface.
|
||
- Add SPDX headers and contributor/release documentation.
|
||
- Track MCP protocol changes, including HTTP transport and authentication,
|
||
without weakening stdio framing or policy behavior.
|
||
- Revisit compile-time reflection when the required C++ support is available.
|
||
- Add optional content-addressed audit export without making it part of the
|
||
enforcement path.
|
||
|
||
Public readiness requires the P0 gates and a security review of their composed
|
||
behavior. P1–P3 items may independently block a deployment based on its threat
|
||
model.
|