[csdev19]

Refs NIW2-310. Spec: design/module-execution-trust.md. ADR: 0016 (running project code needs a decision made outside the channel that asked).

Decisions

• Panel approval needs the HTTP token plus an approval code that is printed only in laqi's terminal.
• Agent approval needs the module to be listed in mcp.modules and approved on this machine with laqi trust. The approval is stored in $XDG_CONFIG_HOME/laqi/trusted-modules.json.
  • Trust is keyed by real path, export, side and the sha256 of the file. Any edit revokes it.
  • The store is refused if it sits inside the project or is group- or world-accessible.
• Tokens and codes come from a CSPRNG and are single-use. Three wrong codes trigger a 60 s lockout, and at most 3 approvals can be pending.
• MCP tools: a new tool, generate_from_module, is not read-only. generate_data stays truly read-only.
• Child process: it gets an env allowlist and 64 KiB stdout/stderr caps, returns its verdict on fd 3, and is killed as a process group. It checks the file hash before importing.
• Sandbox: there is no runtime sandbox. This is a documented non-goal with a reopen condition.

Breaking for users

• Existing mcp.modules entries stop running until each developer runs laqi trust on their machine.
• Headless laqi mcp cannot run modules.
• Agents that call generate_data with project-module get an error that names the new tool.

Open questions

1. Add a TTY y accelerator besides the code? Recommendation: not now.
2. Use MCP elicitation as a session-only agent approval? Recommendation: defer.
   • Note: this conflicts with NIW2-314, whose spec uses elicitation for overwrites. Decide both together.
3. Should a panel approval offer "also trust for agents"? Recommendation: no.
4. The lockout, pending and TTL numbers are judgement calls. Accept them?
5. Tool name: generate_from_module or load_project_module?

Order: rebase on NIW2-309, which touches the same files.

Status

This PR contains only the design spec and ADR drafts. It is opened as a draft so the design is not lost. The implementation will land on this same branch after the open questions are answered. Everything is "proposed, not implemented".

Part of the 2026-10-12 audit, umbrella NIW2-302. Specs were written by Fable agents against a read-only export of main at ee34302. The ADR numbers (0014–0026) are assigned across all eight audit PRs. decisions/index.md is not edited in these PRs, to avoid eight-way conflicts; add the index rows when each PR is promoted.

🤖 Generated with Claude Code