Owner (2026-10-13): set a name, personality and extra skills for the
assistant, and the assistant stays limited to the UI API and to what the
signed-in user could do through it.
- assistant_profile (persona: display name, icon, bounded personality,
greeting, starter prompts; default, app- or permission-scoped) and
assistant_skill (admin Markdown instruction packs, read only when
relevant, bounded) linked by assistant_profile_skill. Text only: it
goes into the per-user system block and never reaches tool code.
- Explain access: GET /assistant/access and the assistantAccess home
widget, per table and tool: allowed or why not, from GET /metaData with
the user's own session plus data access and policy.
- Recent denials card on the Assistant home.
- Hard guarantee: ArchUnit forbids the tool / UI API / access packages
from QQQ actions, the AI kernel and the profile/skill classes, and the
store refuses any non-assistant_ table. A denial matrix proves query,
get, insert, update and delete are denied identically via the UI API
and via the assistant.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner decisions (2026-10-13): tools via the UI API, configurable and
verifiable data access, and confirmation for writes.
- Every data tool runs a spec'd /qqq/v1 operation (UiApiGateway, a
loopback request carrying the user's own sessionUUID cookie), so it
passes the UI's authentication, permissions, record locks, validation,
audit and error mapping. LoopbackUiApiGateway is a stand-in for core's
UiApiInvoker (QRun-IO/qqq#1128). navigate and search_help (no records)
stay on the core kernel.
- Data access (assistant_data_access): NONE / READ / READ_WRITE per table
or process; sensitive tables NONE and cannot be raised; it only narrows.
- Writes (create/update/delete_record) propose a pending action
(assistant_pending_action) the owner confirms; confirm runs it once
through the UI API with the confirming request's session.
- Policy: writesRequireConfirmation, allowedTools, maxRowsPerCall,
redactPii. Tool-call log: UI API operation, HTTP status, audit link,
pending action; inputs stored with secrets redacted.
- UiApiToolsSecurityTest proves a user without a permission gets the same
denial through the assistant as through the UI; golden and red-team
evals run through a real application server.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- assistant_provider: type (registered AssistantProviderType; Anthropic),
model, enabled/default, base URL override, cost cap, output and
concurrency limits, last connection test. The key is never stored: the
row names an allow-listed environment variable; apiKeyStatus is
computed on read (last 4 at most) and dropped on save.
- Test connection: a record action (standard streamed ETL Review/Result)
making one short live call; result saved on the row and as a TEST
usage row.
- assistant_usage: one row per model call (turn steps and tests);
assistant_model_price: editable USD/MTok used for every call's cost.
- The Assistant app home (health, providers, usage by day, costs vs caps,
by user, top tools, recent failures); nav = home + main tables.
- AI exposure NONE on every assistant_* table.
- Tests, README, DESIGN, UPGRADE, CHANGELOG, reference DDL with the
Anthropic price seed, demo server and screenshots.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- ArchUnit rules: no system session, no QSession construction, data actions
only in the persistence package.
- Permission red team (build gate): no-permission denial without leaks,
other users' conversations, kill switch mid-turn, hard budget, hidden and
password sentinels never sent, enveloped tool results, no thinking in SSE,
cancel stops pending tools.
- Golden evals v1 (scripted faithful model) incl. example D and the read
half of example A, plus an opt-in live run against Claude.
- Record Developer screen Assistant panel on the core developer-panel
contract (QRun-IO/qqq#1076) fed by AiToolKernel.describeAccess, with the
ask-the-assistant deep link.
- README, CLAUDE.md, CHANGELOG, reference DDL, CircleCI (qqq-orb 0.6.8).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
james.maesandClaude Opus 5.5