@astram/guide 0.2.24 → 0.2.25

package/CAPABILITIES.md

@@ -857,6 +857,28 @@ upload(@Req() req: Record<string, unknown>) {
 - **Migrations** 111–113 (identity) add `agent_task`, `agent_action`, `agent_tenant_setting` to
   `<ns>_identity`. Single layout: re-run `db-provision --layout single` after migrating; check with
   `db-verify-grants` and the app's layout flags.
+- **Reading attached files (G-037 D2a, opt-in).** `AgentModule.forRoot({ files: { enabled: true } })`
+  registers framework capabilities `files.read_sheet@1` (xlsx/csv, ≤ 200 rows a call), `files.profile_sheet@1`
+  (per-column type, empty and distinct counts, min/max, top values, computed in code),
+  `files.read_pdf_text@1` (text layer, ≤ 10 pages), `files.read_doc_text@1` (docx text, ≤ 20000 chars) and
+  `schema.describe@1` (the object types the user can read, never rows). Requires `identity:stored_file:read`.
+  - Files enter a conversation as `attachments` (0–8 `stored_file` uuids your own `FileIntake` route returned)
+    on `POST /agent/tasks` and on `continue` with a message. The runtime only ever gets task handles; any file
+    the user cannot open answers one `404 attachment_unavailable`; a bad list `400 invalid_request`.
+  - Every byte is parsed by the isolated analyser `@astram/file-analyser` (Python): never formulas, macros,
+    links or embedded objects. Run it as the sidecar container (`docker-compose.analyser.yml` in the
+    scaffold: no network, read-only, non-root) or as the hardened systemd unit in the package's `deploy/`.
+    Env (read only when `files` is on): `AGENT_FILE_ANALYSER_SOCKET` (required),
+    `AGENT_FILE_ANALYSER_TIMEOUT_MS` (12000, 1000–60000).
+  - File content is `confidential` and goes only to a model provider the company lists for file content:
+    org bootstrap `agent: { mode, fileProviders: [...] }` (migration 114, audited
+    `agent.tenant_file_providers.set`). Empty (default) ⇒ no file capability in the manifest. A non-empty
+    list is refused outside development/test while the synthetic-data rule stands, and personal-data
+    masking (not built yet) is a prerequisite before real data.
+  - Totals the assistant states come from `profile_sheet` or `aggregate`, never from adding rows it read.
+    Ids inside file content reach the model as `[id]`.
+  - Not yet: the attach control in the scaffold UI (the client service supports `attachments`), the
+    workbook map (D2b), marking an upload `restricted`.
 
 ## Available, but NOT wired to a data path (do not assume they protect data yet)
 - **Envelope encryption / per-tenant DEKs** (`createEncryptionService`, `LocalKekCrypto`): the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/guide",
-  "version": "0.2.24",
+  "version": "0.2.25",
   "license": "MIT",
   "description": "Astram framework — the AI/dev GUIDE layer (ADR-0025). Ships the framework's hard rules + capabilities manifest as installed, upgrade-refreshed docs. A consumer app's CLAUDE.md references FRAMEWORK_RULES.md from this package; `npm update` replaces it wholesale so new rules arrive cleanly, while the app's own .astram/guide/ layer is never touched. This is the framework-owned FLOOR: an app rule may tighten it, never weaken it.",
   "type": "commonjs",