@polycore/protocol 0.3.0 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polycore/protocol",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "private": false,
   "description": "Polycore control-plane and runner wire contract: message schemas and signed-envelope helpers. Pure (zod + node:crypto), no transport.",
   "type": "module",

package/src/messages.ts

@@ -3,7 +3,7 @@ import { z } from "zod";
 import { dispatchEnvelopeSchema } from "./envelope.js";
 
 /** Bumped on any breaking change to the wire messages. */
-export const PROTOCOL_VERSION = 3;
+export const PROTOCOL_VERSION = 4;
 
 /**
  * What a runner advertises about one connector at enrollment, so the
@@ -13,7 +13,15 @@ export const PROTOCOL_VERSION = 3;
 export const connectorDescriptorSchema = z.object({
   name: z.string().min(1),
   description: z.string(),
-  effect: z.string(),
+  /**
+   * How the capability must be gated, the honest description of what it can do:
+   * - `read`: no side effects, runs with no human approval.
+   * - `write`: a known, declared mutation, runs behind one human approval.
+   * - `unknown`: arbitrary code (a delegated workload) whose effect can't be
+   *   established from a declaration; a human reviews the code before it runs.
+   * Defaults to `write` (the safe default: an unclassified capability is gated).
+   */
+  hazard: z.enum(["read", "write", "unknown"]).default("write"),
   /**
    * Whether this is a built-in connector, a customer-authored action, or the
    * generic delegated-workload executor (`workload.execute`), which runs