Story
As a workflow author, I want a read-only Agent to propose changes as XMD that the host can validate and execute, so Agent judgment can compose durable effects without granting the Agent write authority.
Contract
The Agent returns exact XMD source as structured output. Before the first generated effect runs, the host parses and expands the entire fragment and admits only an explicit allowlist of pinned component identities and expression forms.
The initial evaluator refuses imports, eval/exec blocks, native execution, arbitrary JavaScript expressions, unpinned component identities, and components whose authority exceeds the workflow host's allowlist. Admitted components execute through the normal durable engine; they do not receive a special mutation path.
The already-filtered generated source and its authorization decision are retained for replay, history, audit, and deliberate future training use. The public component name and exact response schema remain part of the implementation design; this issue does not invent them independently of the specification.
Acceptance
- Agent execution remains read-only before and after generated-XMD evaluation.
- The complete fragment is preflighted before its first effect.
- Only explicitly allowed, pinned component identities can execute.
- Rejected syntax or capability produces no partial effect.
- Admitted File, Git, and other components use their ordinary contextual providers and durability contracts.
- Replay restores the exact admitted filtered source and does not ask the Agent to regenerate it.
- Secret detection runs before generated source enters the journal.
- Diagnostics identify the rejected construct without retaining rejected secret material.
- Tests cover mixed safe/unsafe fragments, identity substitution, expressions, imports, native execution, interruption, and replay.
Dependencies
Story
As a workflow author, I want a read-only Agent to propose changes as XMD that the host can validate and execute, so Agent judgment can compose durable effects without granting the Agent write authority.
Contract
The Agent returns exact XMD source as structured output. Before the first generated effect runs, the host parses and expands the entire fragment and admits only an explicit allowlist of pinned component identities and expression forms.
The initial evaluator refuses imports, eval/exec blocks, native execution, arbitrary JavaScript expressions, unpinned component identities, and components whose authority exceeds the workflow host's allowlist. Admitted components execute through the normal durable engine; they do not receive a special mutation path.
The already-filtered generated source and its authorization decision are retained for replay, history, audit, and deliberate future training use. The public component name and exact response schema remain part of the implementation design; this issue does not invent them independently of the specification.
Acceptance
Dependencies