58 lines
2.7 KiB
Markdown
58 lines
2.7 KiB
Markdown
|
---
|
||
|
|
kind: task
|
||
|
|
slug: agent-builder-review-sandbox
|
||
|
|
title: Review, test, and activate agent drafts
|
||
|
|
plan_slug: workspace-communications
|
||
|
|
epic_slug: agent-participation
|
||
|
|
status: ready
|
||
|
|
priority: P1
|
||
|
|
tenant_id: global
|
||
|
|
owner: unassigned
|
||
|
|
cursor_todo_id: null
|
||
|
|
updated_at: "2026-10-22"
|
||
|
|
---
|
||
|
|
|
||
|
|
# Task summary
|
||
|
|
|
||
|
|
Add permission review, constrained sandbox testing, and explicit publish/activate flows for generated or manually edited agent drafts.
|
||
|
|
|
||
|
|
## Description
|
||
|
|
|
||
|
|
Turn a private draft into a trusted workspace agent through a structured review of instructions, requested tools, context/channel access, model role, harness route, budget, and provenance. Sandbox runs default to read-only/non-mutating tools, bounded context, timeout, and cost limits. Members may test their drafts read-only; `admin`/`owner` approve shared publication and normal tool grants; only `owner` approves mutating sandbox policy or workspace-wide sensitive tools.
|
||
|
|
|
||
|
|
## Subtasks
|
||
|
|
|
||
|
|
- [ ] Build normalized draft diff and permission review UI with validation warnings.
|
||
|
|
- [ ] Add bounded sandbox-run service/state with cancellation and auditable results.
|
||
|
|
- [ ] Wire review UI to canonical `Task-agent-install-lifecycle.md` publish/install/activate procedures and `Task-agent-registry-api.md` draft discard; do not duplicate lifecycle endpoints. Requested context access remains ungranted until separately authorized.
|
||
|
|
- [ ] Add tests for privilege escalation, mutating tool denial, budget enforcement, stale versions, and audit records.
|
||
|
|
|
||
|
|
## Owner or assignee
|
||
|
|
|
||
|
|
`unassigned`
|
||
|
|
|
||
|
|
## Status
|
||
|
|
|
||
|
|
`ready`
|
||
|
|
|
||
|
|
## Estimation
|
||
|
|
|
||
|
|
`M`
|
||
|
|
|
||
|
|
## Acceptance criteria
|
||
|
|
|
||
|
|
- [ ] Members can run read-only bounded tests for their own drafts but cannot publish, activate, or grant tools.
|
||
|
|
- [ ] `admin`/`owner` can approve workspace publication and ordinary allowlisted tools; only `owner` can approve mutating sandbox policy or sensitive workspace-wide grants.
|
||
|
|
- [ ] Every activation references an immutable reviewed version and records actor, diff, grants, budget, and test result.
|
||
|
|
- [ ] Invalid/stale drafts cannot be activated, and no test leaks provider credentials or bypasses tenant-scoped tools.
|
||
|
|
- [ ] `pnpm lint && pnpm type-check && pnpm test` pass.
|
||
|
|
|
||
|
|
## Dependencies and access boundary
|
||
|
|
|
||
|
|
`Task-agent-builder-editor-drafts.md`, `Task-agent-install-lifecycle.md`, and the bounded execution contract in `Task-agent-harness-chat-streaming.md`. Review UI consumes canonical lifecycle APIs; sandbox context/tool reads also enforce actual context authority, never workspace role alone. Test data defaults to caller-supplied or explicitly authorized context, not arbitrary private project content.
|
||
|
|
|
||
|
|
## Links to related Epic / Plan
|
||
|
|
|
||
|
|
- Epic: `./Epic-agent-participation.md`
|
||
|
|
- Plan: `../Plan-workspace-communications.md`
|