docs: add decision records, changelog, and repo index links

2026-08-15 14:06:45 +01:00
parent 6e59a8a36b
commit 1f017cd9b0
13 changed files with 340 additions and 0 deletions
@@ -0,0 +1,29 @@
+# 4. Plugin install is a 40-slug allowlist, fail-closed
+
+- **Status:** Accepted
+- **Date:** 2026-08-15
+
+## Context
+
+wordpress.org is not a reviewed-safe catalog. A malicious plugin looks fine in preview and only phones home after deploy. The agent will eventually install plugins, but must not be able to in the MVP either (R2).
+
+## Decision
+
+The agent may install only from a written ~40-slug allowlist (`spikes/plugin-catalog.md`), and only via `wp plugin install <slug>`. No URLs, no zips, no premium marketplaces. Unknown slug → refuse. A detect-only list (Wordfence, Jetpack, cache suites) is never installed.
+
+### Options considered
+
+- Open wordpress.org search.
+- Written allowlist now; reputation/egress gate later (Sprint 9).
+- No wall until the install playbook exists.
+
+### Rejected
+
+- Open search — reintroduces R2.
+- No wall until later — the MVP agent could still `wp plugin install <url>` unless the tool schema forbids it from day one.
+
+## Consequences
+
+- Sprint 3 `tool-schemas.ts` must forbid `wp plugin install http` and unknown slugs even though no install playbook ships in MVP.
+- Reputation gate, zip SHA, and egress watch on first activate are Sprint 9 scope, already specced.
+- Catalog changes are PRs, not prompt edits.