[SDK post-0.1] Ship rich content, attachments, and explicitly confirmed privileged actions

[BunsDev]

Blocked by:

• [SDK post-0.1] Ship conversational control: create, send, stream, stop, retry, reconcile #42

Outcome

Add the next authority tier only after conversational control is stable: bounded attachment transfer, passive rich semantics, attention responses, task handoffs, and explicitly confirmed GitHub mutations through capability-gated typed APIs.

Scope

• strict capability helpers tied to live operations;
• bounded attachment upload/download with canonical Cave ownership;
• approved MIME/signature validation and byte limits;
• passive rich-content AST with no executable markup;
• attention response and task handoff operations;
• curated GitHub action union with confirmed: true and UUID idempotency;
• deterministic CLI commands for explicitly supported actions;
• real-authority audit/conformance for every mutation class.

Architectural invariants

• Cave remains authoritative for storage, grants, confirmation, idempotency, audit, and domain mutations.
• The SDK never exposes arbitrary Cave paths, arbitrary GitHub requests, raw socket handles, or private route escape hatches.
• Client confirmation improves UX but Cave revalidates confirmation, scope, repository/project grant, and input bounds.
• Attachment bytes never enter browser storage, profile config, diagnostic bundles, or canonical conversation JSON.
• Rich content parses into a strict non-executable AST; raw HTML/script/unsafe URLs remain inert or rejected.

Dependencies and blockers

• Stable mutation/idempotency/stream foundation from [SDK post-0.1] Ship conversational control: create, send, stream, stop, retry, reconcile #42
• Cave canonical attachment and action services
• Approved capability and scope additions
• Consent UX and audit semantics
• Separate security review for privileged authority

Acceptance criteria

• File count, file size, request size, MIME/signature, filename, traversal, symlink, and ownership limits fail closed.
• Attachment records bind uploader credential and conversation atomically.
• Rich-content hostile fixtures execute no script and open no unsafe target.
• Every privileged action requires exact scope, grant, direct confirmation, bounded input, and idempotency.
• Validation failure performs zero domain mutation.
• Proposed, pending, completed, rejected, and failed remain distinct states.
• Human/JSON output contains no credentials, private causes, attachment bytes, tool secrets, or unredacted action payloads.
• Private Cave routes and Client v1 routes delegate to the same extracted domain services.
• Packed consumers and real-authority conformance pass for every supported action kind.

Validation

Hostile content and filename fixtures, attachment signature/boundary tests, action mutation/idempotency matrix, confirmation bypass attempts, domain-call zero-count assertions, packed consumer tests, and a release-scope security review.

Non-goals

Arbitrary HTTP, arbitrary GitHub GraphQL/REST, arbitrary shell/tool execution, unconfirmed mutations, SVG/archive/executable upload, or offline privileged queues.