2 Commits

Include renames

Author	SHA1	Message	Date
marcopanandClaude Sonnet 4.6	59bd6135e2	spike(harness): probe gate behavior in pi --mode rpc + findings ... Static analysis of Pi runtime (rpc-mode.js, agent-session.js, runner.js) confirms all 4 decisive questions: - Q1 kickoff: NO — source:"rpc" bypasses the "interactive" guard (agent-session.js:720) - Q2 widget emission: NO — ctx.sendRaw does not exist, crashes (0 refs in core/extensions/) - Q3 response routing: NO — rpc-mode.js returns after consuming extension_ui_response; pi.on("extension_ui_response") never fires (not in runner.js) - Q4 steering: YES — steer() bypasses emitInput entirely Decision: both Task 3 (kickoff guard) and Task 4 (emitAndWait → ctx.ui.* / Variant A) require gate adaptation. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-27 19:38:04 +02:00
marcopan	796a39d893	feat(harness): port vectorstore dual-key + reader RPC (D11, §5.4) ... Ports vectorstore/{rest_client,rest_writer,store,reader,embeddings,records}, evidence/model (leaf dep of records), and cli/_guards (require_vector_write_allowed workstation write-guard). Renamed psdwp3->nsp, verbatim. VectorRestClient gains an api_key property so reader/writer clients carry their distinct keys visibly (spec D11: vector_reader / vector_writer on the same endpoint). scripts/create_vector_reader_rpc.sql is NEW: the reader RPCs (search_similar, list_tables) lived server-side in Supabase and were never versioned. Authored now mirroring the writer allowlist pattern (table allowlist, security definer, revoke from anon/authenticated, grant to vector_reader only). Writer RPC ported verbatim. L1: test_vector_dual_key (7 tests) pins the dual-key construction + the workstation write-guard (exit 4 without writer key).	2026-06-26 22:55:40 +02:00