Initial commit: Hexis capability registry + execution service baseline

Go daemon (hexisd/hexisctl) implementing capability registry, guarded execution (confirmations, blessed-entity checks), systemd/workspace-mcp providers per ECOSYSTEM-SPEC.md. Snapshotting existing working state before further development.
2026-07-20 00:50:37 +04:00
commit cca63269e1
20 changed files with 2461 additions and 0 deletions
@@ -0,0 +1,107 @@
+tools:
+  # Docker
+  docker.list_containers:
+    capability: workspace.docker.list
+    risk: read
+    read_only: true
+
+  docker.inspect_container:
+    capability: workspace.docker.inspect
+    risk: read
+    read_only: true
+
+  docker.restart_container:
+    capability: workspace.docker.restart
+    risk: medium
+    target_type: container
+    side_effects: container restart
+
+  docker.start_container:
+    capability: workspace.docker.start
+    risk: medium
+    target_type: container
+    side_effects: container start
+
+  docker.stop_container:
+    capability: workspace.docker.stop
+    risk: medium
+    target_type: container
+    side_effects: container stop
+
+  # Git
+  git_summary:
+    capability: workspace.git.summary
+    risk: read
+    read_only: true
+
+  git_history:
+    capability: workspace.git.history
+    risk: read
+    read_only: true
+
+  git_diff:
+    capability: workspace.git.diff
+    risk: read
+    read_only: true
+
+  # Vikunja
+  task_list:
+    capability: workspace.vikunja.list_tasks
+    risk: read
+    read_only: true
+
+  task_get:
+    capability: workspace.vikunja.get_task
+    risk: read
+    read_only: true
+
+  task_create:
+    capability: workspace.vikunja.create_task
+    risk: low
+    side_effects: task created in Vikunja
+
+  # Host / metrics
+  host_info:
+    capability: workspace.host.info
+    risk: read
+    read_only: true
+
+  # Project context
+  project_overview:
+    capability: workspace.project.overview
+    risk: read
+    read_only: true
+
+  project_search:
+    capability: workspace.project.search
+    risk: read
+    read_only: true
+
+  # Knowledge
+  knowledge_search:
+    capability: workspace.knowledge.search
+    risk: read
+    read_only: true
+
+  # Logs
+  logs_search:
+    capability: workspace.logs.search
+    risk: read
+    read_only: true
+
+  # High-risk (off by default)
+  ssh.exec:
+    capability: workspace.ssh.exec
+    risk: high
+    enabled: false
+
+  # Metrics
+  metrics_query:
+    capability: workspace.metrics.query
+    risk: read
+    read_only: true
+
+  metrics_compare:
+    capability: workspace.metrics.compare
+    risk: read
+    read_only: true