Skip to content

Verified acquisition, process sandboxing, and transactional commit for the npx-distributed metaharness CLI (ADR-0026b) #65

Description

@ruvnet

Milestone: M4 | Mission: Cognitum Agentic SDK Integration

Implement the distribution contract/resolution modes, verified acquisition and cache, process environment/limits/ownership, repository acquisition, workspace policy with non-mutating plans, and transactional commit/recovery.

Python and Rust need to replicate npm-ecosystem verified-acquisition/checksum logic without Node's package manager -- this is the highest-risk implementation task in the whole mission; do NOT let it get mechanically delegated to codex (see mission plan section 5). One security-auditor should own this logic's design across all 3 languages rather than three subtly-different independently-derived implementations.

Governing ADR: 0026b (D1-D8). Blocked on #1.


Filed from the reviewed mission plan. Routes to Project #6 (Security & Compliance), cross-linked to #1.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions