Per thing2:ruling:eve-dashboards-quarantined. Removes eveSurfaces from the provider advertisement and its schema, the two surface URIs, the eve.gui/eve.tui publish capabilities, and Eve wording in docs.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Eyes pass 2026-10-10: tools, limits and security posture of the official
Blender Lab MCP, the community BlenderMCP and Blender Agent.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
editor.assets.refresh, editor.lifecycle.write and editor.view.capture join
the Unity surface, in the provider contract and the advertisement test. The
donor's prefab mirror rows are not taken; that pipeline is parked.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
BrokkrCommandPolicy (Runtime, pure, tested outside Unity) is consulted by
BrokkrEditorService before every BrokkrUnityCommandExecutor.Execute; it is the
only call path into the executor. The per-project allowed-action list defaults
to scene mutation plus lifecycle; createScriptableObject, createPrefabVariant
and saveScene are shipped denied (parked Q4 = A), and an action the list does
not name is denied. A denial gets a receipt with status denied and a reason.
The window's buttons write intents like any other caller, so operator and
agent share the gate.
Re-landed from the donor as fresh code: refreshAssets, setEditorPlayState,
setEditorPaused, captureEditorView, and the play-state fields on the host
snapshot (keys 14-17). The donor's captureEditorView wrote to any rooted
outputPath; it now resolves the path through one function that accepts only a
plain relative .png path under <project>/.brokkr/captures and refuses drive
letters, rooted or UNC paths, stream suffixes and any .. segment on every host
OS, and dimensions are bounded to 8192. requestedBy joins the intent (key 17)
and is echoed on the receipt (key 6). saveScene is new.
The window gains an Allowed Actions field bound to a per-project preference.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Re-landed from the donor as a fresh file (read with git show, not merged).
Changes from the donor: the CultLibRoot default is ..\..\CultLib instead of a
directory that does not exist; every field of brokkr.unity.command_intent.v0
has a --kebab option (the donor mapped six of seventeen), and unknown options
are refused before anything is written; keys come from BrokkrCommandLedger;
exit is 0 accepted, 1 other receipt, 2 usage error or timeout; readHost opens
the store read-only and prints the agent-commands flag; a timeout says when
the editor reports the sink off. The intent gains the capture fields at keys
13-16, which the CLI needs and A4's executor will read.
Tests run the built CLI as a process against the editor probe: field mapping,
fresh id per invocation, exit code from the receipt, timeout leaves only the
intent, unknown option writes nothing, and every action name reaches the
editor once with one receipt.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The dedup already retired an id once any receipt answered it. What changes
is that this is now the stated contract (docs/provider-contract.md, Unity
Command Transport) and two tests name it, so a later move to reusable
desired-state slots (F6=B) has to break them.
The Rust sync's stable_id slots are not touched here; see the report.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Maintenance (drop 27 vendored DLLs for org.gamecult.cultlib 1.0.60, cut stale
claims) is split from the parked editor-control capability and an unread prefab
CDN pipeline. F1-F6 open.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
