Owner decisions (2026-10-13): tools via the UI API, configurable and
verifiable data access, and confirmation for writes.
- Every data tool runs a spec'd /qqq/v1 operation (UiApiGateway, a
loopback request carrying the user's own sessionUUID cookie), so it
passes the UI's authentication, permissions, record locks, validation,
audit and error mapping. LoopbackUiApiGateway is a stand-in for core's
UiApiInvoker (QRun-IO/qqq#1128). navigate and search_help (no records)
stay on the core kernel.
- Data access (assistant_data_access): NONE / READ / READ_WRITE per table
or process; sensitive tables NONE and cannot be raised; it only narrows.
- Writes (create/update/delete_record) propose a pending action
(assistant_pending_action) the owner confirms; confirm runs it once
through the UI API with the confirming request's session.
- Policy: writesRequireConfirmation, allowedTools, maxRowsPerCall,
redactPii. Tool-call log: UI API operation, HTTP status, audit link,
pending action; inputs stored with secrets redacted.
- UiApiToolsSecurityTest proves a user without a permission gets the same
denial through the assistant as through the UI; golden and red-team
evals run through a real application server.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- assistant_provider: type (registered AssistantProviderType; Anthropic),
model, enabled/default, base URL override, cost cap, output and
concurrency limits, last connection test. The key is never stored: the
row names an allow-listed environment variable; apiKeyStatus is
computed on read (last 4 at most) and dropped on save.
- Test connection: a record action (standard streamed ETL Review/Result)
making one short live call; result saved on the row and as a TEST
usage row.
- assistant_usage: one row per model call (turn steps and tests);
assistant_model_price: editable USD/MTok used for every call's cost.
- The Assistant app home (health, providers, usage by day, costs vs caps,
by user, top tools, recent failures); nav = home + main tables.
- AI exposure NONE on every assistant_* table.
- Tests, README, DESIGN, UPGRADE, CHANGELOG, reference DDL with the
Anthropic price seed, demo server and screenshots.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- ArchUnit rules: no system session, no QSession construction, data actions
only in the persistence package.
- Permission red team (build gate): no-permission denial without leaks,
other users' conversations, kill switch mid-turn, hard budget, hidden and
password sentinels never sent, enveloped tool results, no thinking in SSE,
cancel stops pending tools.
- Golden evals v1 (scripted faithful model) incl. example D and the read
half of example A, plus an opt-in live run against Claude.
- Record Developer screen Assistant panel on the core developer-panel
contract (QRun-IO/qqq#1076) fed by AiToolKernel.describeAccess, with the
ask-the-assistant deep link.
- README, CLAUDE.md, CHANGELOG, reference DDL, CircleCI (qqq-orb 0.6.8).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
james.maesandClaude Opus 5.5