Claude Fable 5
9b7acab294
All checks were successful
CI / Lint, typecheck, test (pull_request) Successful in 6m21s
CI / Build container images (pull_request) Successful in 3m59s
CI / Auth e2e pack (pull_request) Successful in 8m35s
CI / Import/export fidelity gate (pull_request) Successful in 1m1s
CD / Build and push images (push) Successful in 17s
CD / Deploy to Test (push) Successful in 14s
CD / Smoke tests against Test (push) Successful in 1m17s
CD / Promote to Int (push) Successful in 12s
CI / Build container images (push) Has been skipped
CI / Auth e2e pack (push) Successful in 8m27s
CI / Import/export fidelity gate (push) Successful in 58s
CI / Lint, typecheck, test (push) Successful in 6m30s
The install path records the SHA-256 of the delivered bundle ZIP (plugins.bundle_hash; pre-#232 installs show it as unknown until reinstalled). plugins.allowlist in instance_settings names permitted ids with their pinned hashes: empty (default) = not enforced, existing instances unchanged; non-empty = installs of unlisted or deviating bundles are rejected (plugin_not_pinned / plugin_hash_mismatch, 403), and an installed plugin outside the list or with a deviating hash does not load — absent from pond mount lists, frame/assets 404. Every rejection is audited (plugin.rejected, catalogue v1.5). A version bump changes the hash and therefore requires an explicit re-pin — the intended friction (ADR 0025). Admin UI shows observed vs pinned hash per plugin with pin/re-pin/unpin. Scope stated honestly in plugin-architecture.md: the pin answers "is this the reviewed bundle"; post-install disk tampering is platform integrity (ADR 0019), sandbox containment stays the sandbox's job. Hardening guide row + catalog advisory triage; residual risk R-03 resolved. e2e: empty-allowlist compatibility, pinned load, unpinned and tampered installs rejected and audited, pin drift blocks loading while the admin still sees the mismatch, version bump needs re-pin. Full api suite 101 files / 561 green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8
69 lines
2.7 KiB
JSON
69 lines
2.7 KiB
JSON
{
|
|
"frame": {
|
|
"loading": "Plugin wird geladen …",
|
|
"failed": "Das Plugin „{{name}}“ konnte nicht geladen werden."
|
|
},
|
|
"block": {
|
|
"edit": "Bearbeiten",
|
|
"done": "Fertig",
|
|
"inactive": "Das Plugin „{{name}}“ ist für diesen Teich nicht aktiv."
|
|
},
|
|
"tools": {
|
|
"title": "Seiten-Werkzeuge"
|
|
},
|
|
"preview": {
|
|
"loading": "Plugins werden geladen …",
|
|
"loadFailed": "Die Plugin-Liste konnte nicht geladen werden.",
|
|
"notFound": "Dieses Plugin ist nicht installiert.",
|
|
"title": "Vorschau: {{name}}",
|
|
"permissions": "Angeforderte Berechtigungen",
|
|
"noPermissions": "Dieses Plugin fordert keine Berechtigungen an.",
|
|
"surface": "Oberfläche",
|
|
"noSurfaces": "Dieses Plugin stellt keine Oberflächen bereit."
|
|
},
|
|
"admin": {
|
|
"title": "Plugins",
|
|
"intro": "Installierte Plugins laufen isoliert (Sandbox). Prüfe die angeforderten Berechtigungen, bevor du ein Plugin aktivierst.",
|
|
"upload": "Plugin hochladen (.zip)",
|
|
"empty": "Noch keine Plugins installiert.",
|
|
"permissions": "Berechtigungen",
|
|
"noPermissions": "keine",
|
|
"mode": "Modus",
|
|
"preview": "Vorschau",
|
|
"uninstall": "Deinstallieren",
|
|
"requiredLocked": "Ein erforderliches Plugin kann nicht deinstalliert werden.",
|
|
"pinning": {
|
|
"state": "Hash-Pinning",
|
|
"verdict": {
|
|
"not_enforced": "nicht erzwungen (Allowlist leer)",
|
|
"pinned": "gepinnt — Bundle entspricht dem geprüften Stand",
|
|
"unpinned": "NICHT auf der Allowlist — lädt nicht",
|
|
"mismatch": "HASH WEICHT AB — lädt nicht"
|
|
},
|
|
"observed": "Gesehener Bundle-Hash (SHA-256)",
|
|
"pinnedHash": "Gepinnter Hash",
|
|
"unknownHash": "unbekannt (vor der Hash-Erfassung installiert — neu installieren, um ihn zu erfassen)",
|
|
"pin": "Diesen Hash pinnen",
|
|
"repin": "Pin auf diesen Hash aktualisieren",
|
|
"unpin": "Pin entfernen",
|
|
"hintOff": "Hash-Pinning ist aus (Allowlist leer): Plugins laden wie bisher. Das Pinnen des ersten Plugins schaltet die Durchsetzung für ALLE Plugins ein.",
|
|
"hintOn": "Hash-Pinning aktiv: Nur gepinnte Plugins mit übereinstimmendem Bundle-Hash werden installiert und geladen; jede Abweisung wird auditiert. Ein Versions-Update braucht ein explizites Re-Pin."
|
|
}
|
|
},
|
|
"mode": {
|
|
"disabled": "Deaktiviert",
|
|
"optional": "Optional",
|
|
"required": "Erforderlich",
|
|
"hint": {
|
|
"disabled": "Installiert, aber überall inaktiv.",
|
|
"optional": "Teich-Admins können es pro Teich aktivieren.",
|
|
"required": "In jedem Teich immer aktiv."
|
|
}
|
|
},
|
|
"pond": {
|
|
"title": "Plugins",
|
|
"hint": "Aktiviere optionale Plugins für diesen Teich.",
|
|
"empty": "Es sind keine optionalen Plugins verfügbar."
|
|
}
|
|
}
|