@securecoms/agent-runtime 0.12.1 → 0.13.0

package/README.md

@@ -207,9 +207,13 @@ the runtime works as follows in the owner's private chat:
   recalls memories.
 - **The memory tool gate.** On every owner private-chat turn, and on any turn
   that carries memories, the gate checks each tool call before it runs:
+  <!-- [COPY, approved by Eric 2026-10-12] skills spec 2026-10-12 section 7 C-3. -->
+  - What a tool may do is decided by its handler, not its name. A skill file
+    that reuses a built-in's name with a different handler is not loaded.
   - `current_time`, `echo` and `memory_note` run as usual.
-  - `web_search`, `fetch_url`, `http_request` and `sql_query` run only when
-    their arguments pass the gate. The gate refuses an argument that holds a
+  - Network reads (`web_search`, `fetch_url`, `sql_query`, `http_request` GET)
+    run only when the values they will send pass the gate. Numbers are checked
+    too. The gate refuses an argument that holds a
     number the owner did not type in this message (digits, number words, and
     Roman numerals longer than one letter); a URL, an e-mail address or a
     base64-like token longer than 24 characters that is not in the owner's
@@ -222,9 +226,14 @@ the runtime works as follows in the owner's private chat:
     number (`YEAR_WINDOW` = 1). It still counts toward the 3-word runs and the
     200-character budget.
   - `http_request` sends only GET on these turns. Any other method is refused.
-  - Every other tool, skills included, is refused on these turns.
-  - The gate stops copying of numbers, links and exact wording. It does not
-    stop the model from rewording a memory, and it binds only this runtime.
+  - Anything that sends, changes or deletes something is refused on these
+    turns.
+  - The bridge decides which tools a turn may use. Today it allows only
+    `current_time` and `web_search` in the owner's private chat, and no custom
+    skill on any turn.
+  - The gate stops a model from pasting numbers, links and exact wording from
+    memory into a tool. It does not stop a model that rewords a memory or
+    deliberately encodes it in other words, and it binds only this runtime.
 
 **With bridge 0.28 or older.** A turn without the bridge's `memory_unified`
 reply works as in runtime 0.11.0: `memory_note` saves, replaces or forgets a
@@ -233,6 +242,11 @@ not run.
 
 ## Adding a skill
 
+<!-- [COPY, approved by Eric 2026-10-12] skills spec 2026-10-12 section 7 C-3. -->
+Note: a skill you add here is loaded but not offered to the model yet. The
+bridge grants tools per turn, and it does not grant custom skills on any turn.
+The six built-ins below are the tools agents use today.
+
 A skill is either a JSON manifest or a `SKILL.md` file, dropped under
 `SECURECOMS_SKILLS_DIR` in one of three layouts:
 
@@ -513,6 +527,29 @@ The paragraph is therefore an advisory configuration summary, not an authority
 claim. Channel authorization and the local gate are both enforced at call
 time, so a configured but ungranted or denied tool is still refused.
 
+## Release notes: 0.13.0
+
+<!-- [COPY, approved by Eric 2026-10-12] -->
+
+0.13.0 applies owner-signed tool settings. Install it together with
+`@securecoms/agent-bridge` 0.30.0 and restart both. The bridge decides which
+tools a turn may use. This runtime repeats the check before each call.
+
+- **Hello.** The runtime now reports `manifest_grants_v1`. A bridge that does
+  not see it uses the fallback in every place.
+- **Room web search.** In rooms the runtime offers `web_search` only when the
+  bridge grants it. It counts each call that runs, for each room and each UTC
+  day, in a file on disk, so a restart does not reset the count. At the limit
+  it refuses the call. The limit is 50 for each room and 200 for each agent.
+- **Strict secret paths.** For each tool that holds an owner-signed grant, the
+  runtime reads `manifest-policy.json` (written by the bridge) and confines the
+  tool's secret paths in `enforce` mode.
+- **`sqlite` databases.** `sql_query` opens a `sqlite` database only when its
+  real path equals the path the owner signed. Otherwise the call is refused.
+- **Operator caps.** `SECURECOMS_ROOM_SEARCH_DAILY_CAP` and
+  `SECURECOMS_AGENT_ROOM_SEARCH_DAILY_CAP` lower the two limits. See the bridge
+  README, "Room tool rule".
+
 ## Provenance
 
 See [PROVENANCE.md](./PROVENANCE.md) for which files were ported from