Octoscript accepts changes to the language core, capability host, or workflow engine only when the security boundary remains explicit.
- Do not register filesystem, subprocess, raw socket, or HTTP server modules
in
octoscript-core. - Add effects as reviewed tool adapters in
octoscript-capabilitieswith limits, audit coverage, and a documented containment strategy. - Do not patch the VM here.
makepad-scriptis a pinned git dependency on theoctoscriptbranch ofOctoSense-org/makepad; VM changes land there first and reach this repository through a rev bump (seeUPSTREAM.md). - Keep new language behavior in an executable fixture or regression test.
Before opening a change, run the checks in docs/development.md.