Preserve protected Syntax authority through generated XMD

[taras]

Why

Issue #762 will allow a planning agent to ask XMD for documentation using <Syntax names={...} />.

This PR ensures that when an agent requests documentation with <Syntax names={...} />, only XMD’s approved Syntax component can handle the request. Middleware may observe or delegate component lookup, but it cannot substitute a different component under the Syntax name.

This is a core prerequisite. It does not yet add the information-request conversation to xmd plan.

What changes

Before:

<Evaluate> could be told that Syntax was available, but it could not safely run XMD’s protected Syntax component inside the XMD text it evaluated.

After:

<Evaluate> can safely run the approved Syntax component and return its documentation. The permission applies only to that approved component and ends when the evaluation ends.

For example, this core path can now support:

<Evaluate text={'<Syntax names={["Elicit", "File"]} />'} allow={["read"]} />

The later Plan PR will use this behavior to return the requested documentation to the planning agent’s next turn.

How it remains safe

• Permission is tied to the exact approved component, not just the name Syntax.
• The evaluated text receives only the components explicitly made available to it.
• A nested evaluation cannot add permissions that its parent did not have.
• A copied, renamed, or substituted component cannot inherit Syntax permission.
• Permission is revoked when the evaluation or its parent execution ends.
• Saved history contains descriptions of the approved components, not executable functions or permission handles.
• Continuing a saved run verifies the currently installed component again before using it.

Review guide

The remaining details describe the internal implementation for code reviewers.

Start with: ProtectedBodies in packages/core/src/invocation-identity.ts

Then review:

1. packages/core/src/evaluation-profile.ts records which verified protected component is available.
2. packages/core/src/components/Evaluate.ts gives each evaluation its own narrower permission route.
3. packages/core/src/generated-xmd.ts and packages/core/src/expand.ts use that route while preserving form checks and captured results.
4. The focused tests try substitutions, copied functions, expired permissions, saved-run continuation, and a separately loaded copy of core.

Look carefully at:

• A child route must never add authority to its parent.
• Middleware must still resolve an authored component exactly once.
• Public generated-XMD requests must not be able to supply or forge protected-component authority.
• Saved records must never contain functions or permission handles.

How to verify it

deno task test packages/core/tests/generated-xmd.test.ts packages/core/tests/evaluate-component.test.ts packages/core/tests/syntax-component.test.ts packages/core/tests/evaluation-profile.test.ts packages/core/tests/evaluate-provider-lifetime.test.ts packages/core/tests/evaluate-loaded-copy.test.ts packages/core/tests/syntax-loaded-copy.test.ts
deno task check
deno task lint
git diff --check d56d5ba016150b7750384ba4a2ba81f56a5b1ab9..33a45a31558765ed9a647bd4a5add4c6c6b200e9

The final focused run passed 41 suites / 315 steps. Typecheck, repository lint/format, and diff checks passed. Required CI remains the delivery gate and has not been inspected.

Scope

Included

• Safe use of the approved protected Syntax component inside generated XMD
• Narrowing and revoking the permission used to call that component
• Checks against substitution, permission widening, expired access, unsafe saved state, and incompatible loaded copies
• Matching architecture and executable-MDX specification amendments

Intentionally unchanged

• The xmd plan response classifier and information-request conversation
• Plan-specific limits, progress messages, prompts, journals, replay policy, and packaged behavior
• The public generated-XMD request and host APIs

Those Plan product changes begin only after this prerequisite is accepted. This PR does not close #762.

Risks and limitations

• This changes a security-sensitive component lookup and lifetime boundary, so the tests include deliberately hostile extensions and saved-run scenarios.
• An existing timing-sensitive Syntax cancellation test failed once and then passed unchanged in isolation and in the complete focused rerun. It is tracked separately as Make <Syntax> cancellation always release its reference #775 and was judged non-blocking by both reviewers.

Scope confirmation

• Every changed file supports the purpose described above.
• Unrelated cleanup and formatting changes are excluded.
• The description matches the final diff and test results.

[github-actions]

Found 1 redundant comment. Inline suggestions to remove them below.

[github-actions]

Redundant comment — restates what the code does.

Suggested change

// minted the bodies is gone.

[github-actions]

PR #776: Preserve protected Syntax authority through generated XMD

14 files, +795 / -76

Scope

🔴 PR has 871 lines changed. Split into focused PRs.

🟡 871 lines changed. PRs under 400 receive more thorough review.

Structural

Oxlint structural signals:

• no-unused-vars ×10: packages/core/src/components/Evaluate.ts, packages/core/src/execute.ts, packages/core/src/expand.ts
• no-unnecessary-type-assertion ×6: packages/core/src/expand.ts, packages/core/src/execute.ts

Slop

• packages/core/src/invocation-identity.ts:1190 — // minted the bodies is gone.

Oxlint slop signals:

• no-inferrable-types ×2: packages/core/src/expand.ts

Static Analysis

Oxlint: 58 diagnostics across 7 files (14 rules)
Density: 0.073 violations/added-line

no-unsafe-type-assertion (14): packages/core/src/invocation-identity.ts, packages/core/src/expand.ts, packages/core/src/execute.ts
no-unused-vars (10): packages/core/src/components/Evaluate.ts, packages/core/src/execute.ts, packages/core/src/expand.ts
no-shadow (6): packages/core/src/execute.ts, packages/core/src/generated-xmd.ts, packages/core/src/expand.ts
no-unnecessary-type-assertion (6): packages/core/src/expand.ts, packages/core/src/execute.ts
unbound-method (5): packages/core/src/invocation-identity.ts, packages/core/src/expand.ts, packages/core/src/execute.ts
no-base-to-string (4): packages/core/src/expand.ts
consistent-return (3): packages/core/src/execute.ts, packages/core/src/invocation-identity.ts
no-this-alias (2): packages/core/src/components/import-authority.ts
no-array-sort (2): packages/core/src/execute.ts, packages/core/src/evaluation-profile.ts
no-inferrable-types (2): packages/core/src/expand.ts
restrict-template-expressions (1): packages/core/src/expand.ts
no-implied-eval (1): packages/core/src/expand.ts
no-floating-promises (1): packages/core/src/execute.ts
no-duplicate-type-constituents (1): packages/core/src/execute.ts

Correctness

No extraneous code patterns detected.