Skip to content
HUEHUE Docs

HUE-010 — Implement trusted Space resource roots and filesystem boundary validation

Canonical source: docs/roadmap/issues.json · HUE-010

Specification status: TBI · Readiness: agent:blocked

Goal

Section titled “Goal”

Enforce resource-root policy for Projects and Areas outside model prompts.

Scope

Section titled “Scope”
  • Register primary/additional roots and repositories
  • Canonicalize and check symlink/path traversal
  • Separate read/write grants and health

Acceptance criteria

Section titled “Acceptance criteria”
  • Escapes and unauthorized roots are denied
  • Moved/missing roots enter degraded state
  • Effective access is inspectable
  • Adversarial path tests pass

Dependencies

Section titled “Dependencies”
  • HUE-005
  • HUE-009

Non-goals

Section titled “Non-goals”
  • None beyond the documented scope.

Product contract

Section titled “Product contract”
  • Follow the milestone and repository product contract.

Implementation handoff requirements

Section titled “Implementation handoff requirements”
  • Preserve the documented security, project, memory and event boundaries.
  • Add or update automated tests for every observable acceptance criterion.
  • Provide real verification output; do not rely on a worker/agent self-report.
  • Update only the exact documentation sections whose status changed.
  • Include screenshots or a recording for user-interface changes.
  • Include migration, rollback and recovery notes for data/state changes.
  • Link the pull request to this issue with Closes #<issue-number>.