26 lines
1.4 KiB
Markdown
26 lines
1.4 KiB
Markdown
# 0006: Every workspace controller uses one typed command plane
|
|
|
|
Status: accepted for implementation.
|
|
|
|
Human UI, CLI automation, remote clients, and agents submit the same typed
|
|
workspace commands. Stable request IDs make retries idempotent. Pane IDs, split
|
|
ratios, surfaces, launch intents, and close dispositions are validated before
|
|
state changes, and a multi-command setup plan is applied atomically. Reusing an
|
|
ID with a different origin or command is a conflict, not a silent duplicate.
|
|
|
|
Each request has an origin and an explicit Observe, Configure, or Execute grant.
|
|
The command declares the minimum capability it needs. Creating or terminating a
|
|
process requires Execute; layout-only changes require Configure. Launch intents
|
|
refer to a user shell or an approved harness profile and working directory, not
|
|
arbitrary executable arguments or secret values.
|
|
|
|
Detaching and reattaching an existing pane are layout-only Configure operations.
|
|
Detached pane definitions remain outside the layout tree so reattachment does
|
|
not imply a new launch. Terminating either an attached or detached session
|
|
remains an Execute operation. See decision 0010.
|
|
|
|
This reducer is not an authorization bypass. The future IPC layer authenticates
|
|
the caller and supplies its granted capability; the reducer rechecks it before
|
|
mutation. Durable audit events record request and object identities, never
|
|
terminal input, transcript content, provider keys, or pane titles by default.
|