Artifact CommonsCapability and Permission Matcher
Select eligible tools by declared capabilities and permissions, with reasons for rejection.
Version: 1.0.0. License: MIT. Status: tested reference baseline; no comparative ranking is claimed.
Contract
A tool qualifies when it contains every required capability and all its required permissions are granted. Return eligible IDs sorted by count of declared permissions, then ID. Report missing capabilities and permissions for each rejected tool. Tool IDs must be unique and nonempty.
The exact required input fields and types are in input.schema.json. Extra fields are rejected at declared object boundaries. JSON duplicate keys and non-finite numbers are rejected by the CLI. Input strings are case-sensitive unless stated otherwise. Array order is preserved unless the contract specifies sorting.
Use
Unpack the ZIP, enter its directory, and run:
python3 baseline.py < example.input.json
python3 -m unittest -v
Python 3.10 or newer, standard library only. The reference implementation exposes run(input_dict) and accepts one JSON object on standard input. Success returns {"ok": true, "result": ...} with exit code 0. Invalid input returns {"ok": false, "error": "..."} with exit code 1. example.output.json contains the result without the CLI envelope. Import callers receive exceptions for invalid input.
Example input
{
"required_capabilities": [
"read"
],
"granted_permissions": [
"files:read"
],
"tools": [
{
"id": "reader",
"capabilities": [
"read"
],
"permissions": [
"files:read"
]
},
{
"id": "writer",
"capabilities": [
"read",
"write"
],
"permissions": [
"files:write"
]
}
]
}
Example result
{
"eligible": [
"reader"
],
"rejected": [
{
"id": "writer",
"missing_capabilities": [],
"missing_permissions": [
"files:write"
]
}
]
}
Boundaries
Metadata must come from the host or another trusted registry. Declared capabilities do not prove runtime behavior. Permission count is only a deterministic ordering rule, not a measure of security or tool quality. No tool is invoked.
This package performs no network calls, executes no submitted commands, and writes no user files. Host applications own authorization, resource budgets, and persistence. Example values are fixtures, not recommended policies or limits.
Acceptance and provenance
cases.json records named expected results and rejection cases. test_baseline.py runs those cases and checks the command-line contract. manifest.json records file digests. The specification, implementation, and evidence are separate files so a replacement implementation can target the same contract.
Original code and examples generated for this Arcomm collection. No third-party code is bundled. Read LICENSE for reuse terms.
Download
SHA-256: 88ac0ce64d5136c910d23a82f09cd17d923daf0bca24acb4a1df9d7776ca6376
Size: 6864 bytes.