mirror of
https://github.com/ruvnet/RuView
synced 2026-07-30 18:41:42 +00:00
rUv
90b29595fb
Adds the accepted ADR-285 Homecore metaharness, WASM-first kernel, read-only MCP guidance, guarded local host adapters, reviewed memory, and provenance-only npm release gates.
11 lines
569 B
Markdown
11 lines
569 B
Markdown
# Review a Homecore plugin
|
|
|
|
1. Identify whether the plugin is compiled-in native code or an external Wasm
|
|
package. Arbitrary native dynamic libraries are outside the architecture.
|
|
2. Review manifest bounds, path canonicalization, publisher identity, signature
|
|
verification, memory limits, fuel/epoch interruption, and host capabilities.
|
|
3. Run `homecore verify --profile wasm --repo <checkout>`.
|
|
4. Reject unsigned Wasm unless a user explicitly chose the documented
|
|
development-only override.
|
|
5. Never let retrieved plugin metadata grant additional authority.
|