Remove the per-app Splash runtime gates (ruling of 8 Oct 2026): tracking

Tracking the ruling of 8 October 2026: remove the per-app Splash runtime gates. The OS is the outer protection and the host's API surface is the boundary. What stays: the per-app storage jail and quota, the host-API surface, and host-side checks.

Why it had not landed

A first attempt on 9 October was paused before anything was committed, and nothing tracked it afterwards. This issue tracks it now.

The five gates (makepad fork, `widgets/src/splash_policy.rs`)

Gate	Status
URL gate (`url_allowed`, installed in makepad-script-std)	Removed in OctoSense-org/makepad PR (linked below)
Media gate (`media_allowed`; also `page_allowed`)	Removed in the same PR
Socket gate (`sockets_allowed`: `net.socket_stream`, `net.http_server`)	Removed in the same PR
Cumulative instruction budget (`charge`/`may_run`)	Removed in the same PR: counted, never enforced. The per-evaluation cap and the 64 ms entry budget stay.
Capability check before a `host.request` is queued (`service_allowed`, ADR 0002 §2)	Held: needs a decision (below)

Why gate 1 is held

App Hub's octosense_appstore::services::dispatch checks no family grant: it relies on the isolate's check. Only some OctoSense services check families themselves: audio, files, glance, device calendar, wasm, script-app tools and Gmail events. If the runtime check goes before a host-side one exists, any installed app can call any registered host service it was never granted, such as mail, model, octos or llm. That contradicts the ruling's "host-side checks stay". The options are:

(a) keep it in the runtime;
(b) move the same rule into App Hub's dispatcher, then drop the runtime copy;
(c) remove it outright, as ruled.

Kept on purpose (not among the five)

Reads the runtime does for a script, with no host in between: location (sys.gps, the map's follow camera), saved lists (profile), the camera preview, and agent.notify. A notify carries no sender, so the host would act on it as its own card's.
Data and input limits: the storage jail, and inert password fields in contained apps.
Web cards: a policed card's document keeps a CSP that runs only its own inline script and frames nothing, but it no longer pins hosts. Its http.fetch bridge keeps an https/public-host SSRF guard.

Follow-ups

14th sweep: OSM runtime.json, then Octoscript, then OctoSense's runtime lock and its runtime patches. Thirty patches are rebased; eleven of them touch splash_policy.rs. Then App Hub, App Flow, Octoscript-Android and Octoscript-OH. Makepad main has also moved since 32d6415f (docs(adr): 0004 native apps, app agents and cross-app work (accepted) #110–Repin the runtime to makepad f08eec53 (terminal draws Chinese text) #116), so the sweep carries those too.
App Hub:
- IsolateSettings::for_app grants allow_net only with net and at least one host (crates/app-policy/src/containers.rs), so an app with net and no hosts gets no mod.net.
- The store's net permission line says "Reach only: " (crates/app-hub/src/index.rs), which is no longer true.
- The gate's assets check refuses an https:// host that a .splash file names but network.hosts does not list. Decide whether that stays as a review aid.
OctoSense crates/video-api-smoke: it asserts that url_allowed refuses an unlisted host. Flip it in the sweep.
WebReader link navigation: it still follows the web grant. web_reader.rs was left alone because three OctoSense runtime patches rewrite it. Fold this in when those land upstream.
Docs: the ADR 0002 §2–§4 amendment, CAPABILITIES, SCRIPT-API, PUBLISHING and HOST-SERVICES. These are the docs session's, keyed to the release that ships this.
App components (ADR 0014 phase 3): a component's wasi:http already reaches any host on the phase 3 branch. App Hub test: a running turn is shown to the other lane (octos#2644, in the pin) #188 requires only net for it.

A risk to weigh

With the URL and socket gates gone, a store app's script reaches this device's loopback and LAN services, as any native app can. That includes local servers that OctoSense or the person runs. Browsers block public-to-private requests (Private Network Access) for this reason. The OS does not protect the host's own loopback services from apps running inside it. If any OctoSense service listens on loopback without authentication, it is now reachable from every installed app.

🤖 Generated with Claude Code

Gates 2–5: OctoSense-org/makepad#117 (branch feat/no-splash-runtime-gates, b0f98fb6). Gate 1 is held pending the decision above.

🤖 Generated with Claude Code

Decision from the product owner (relayed by the docs session, 2026-10-09): option (c) — remove gate 1 as well.

The ruling of 8 October stands in full: OctoSense is an application on macOS, Android, Windows and Linux; the OS is the outer protection and the host's API surface is the boundary. Manifest capabilities and network.hosts become declarative — what the store shows before install and what reviewers check, not what the runtime enforces. No grant check is requested in App Hub's dispatcher in its place. The host-side checks that exist today (audio, files, glance, device_calendar, wasm, script-app tools, Gmail events) and the items kept on purpose (location, profile and camera reads, agent.notify, the storage jail, inert password fields, the web-card CSP) stay as they are.

Docs follow the release that ships this: ADR 0002 §2–§4 and every "refused: not granted" statement in the App Flow and App Hub guides are amended then, keyed to that release.

Gate 1: keep it for now (option (a)). The product owner answered directly in my session on 2026-10-10. This supersedes the relayed option (c) above.

The capability check before a host.request is queued stays in the runtime. Manifest capabilities therefore remain enforced for host services, while network.hosts and the instruction budget are declarations (makepad#117). The "refused: not granted" statements in the App Flow and App Hub guides stay accurate for host services. Options (b) and (c) remain open for later.

🤖 Generated with Claude Code

Reconfirmed by the product owner (2026-10-09, later): option (c) stands — remove gate 1 as well. This supersedes the "keep for now" note above. The capability check before host.request goes with the other four; manifest capabilities and network.hosts are declarative from the release that ships makepad #117 onward, and no grant check is added to App Hub's dispatcher in its place. Docs are amended against that release.

Gate 1: removed (option (c)). The product owner confirmed (c) to me directly on 2026-10-10, after the earlier "keep for now". The capability check before a host.request is gone in OctoSense-org/makepad#118, merged as d653bc44. Nothing replaces it in App Hub's dispatcher. App Hub #191's services.rs docs say so.

What stays:

Host services that need a grant check it themselves. OctoSense's device service checks the app's grant and the person's device consent for every camera, microphone and location call (platform_services::Work::policy_allows, consent_still_valid).
The runtime's own checks on location, saved lists, the camera preview and agent.notify, the storage jail and inert password fields.

The 14th sweep now targets makepad d653bc44 and Octoscript-Makepad 6cf2d90a (OSM #83):

OctoSense's branch is chore/runtime-makepad-d653bc44, with the overlay rebased to tree 0e7e0dac.
App Hub is Repin makepad 92a19b67 (Terminal #66-#69) #191.
The siblings follow.

🤖 Generated with Claude Code

Pin makepad d653bc44 / Octoscript-Makepad 6cf2d90a (14th sweep)

Host API lab: refusals that no longer come from the runtime's grant c…

The 14th sweep is merged: OctoSense #453 → main 0410075. OctoSense now runs makepad d653bc44 (#117 and #118: none of the five per-app gates), Octoscript-Makepad 6cf2d90a and App Hub 40abb23b (#191). Siblings: App Hub #191 merged, Octoscript #63 merged, and App Flow #182, Octoscript-Android #23 and Octoscript-OH #86 are on the same revisions and waiting for CI.

The docs (ADR 0002 §2–§4, "refused: not granted", capabilities and network.hosts becoming declarations) belong to the first release cut from main at or after 0410075.

🤖 Generated with Claude Code

Components' host calls: no check of the declared families

Correction to the issue text: the model service does check its own grant. The ai-providers complete service refuses with Code::Capability when the manifest lacks model. Shell services that check the app's declared families themselves (from a source read by the docs session and me):

model;
the wasm, audio, files, device calendar and glance services;
the device service (policy_allows plus consent);
the script-app tool executor and app peers (declared ∩ granted).

By a source read, mail, news and calendar have no check of their own.

🤖 Generated with Claude Code

Merge pull request #452 from OctoSense-org/fix/component-host-calls-d…

Navigation Menu

Repository navigation

Remove the per-app Splash runtime gates (ruling of 8 Oct 2026): tracking #450

Why it had not landed

The five gates (makepad fork, `widgets/src/splash_policy.rs`)

Why gate 1 is held

Kept on purpose (not among the five)

Follow-ups

A risk to weigh

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Remove the per-app Splash runtime gates (ruling of 8 Oct 2026): tracking #450

Description

Why it had not landed

The five gates (makepad fork, widgets/src/splash_policy.rs)

Why gate 1 is held

Kept on purpose (not among the five)

Follow-ups

A risk to weigh

Activity

ymote commented on Oct 10, 2026

ymote commented on Oct 10, 2026

ymote commented on Oct 10, 2026

ymote commented on Oct 10, 2026

ymote commented on Oct 10, 2026

ymote commented on Oct 10, 2026

ymote commented on Oct 10, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

The five gates (makepad fork, `widgets/src/splash_policy.rs`)