← 1.0.0 scope SAPE-11

List the external operations installed on a server, with the envelope each one declared

Status
To do
Component
server
Priority
Medium
Blocked by
SAPE-8, SAPE-14
Blocks
—

Description

Let an operator ask a running server which external operations are installed on it, and get back, for each one, its name, its version, the identity that signed its bundle, and the cost envelope from SAPE-8. The answer comes from the server's own state, not from a manifest file next to it, so it reports what is loaded rather than what somebody intended to load.

Revised 2026-09-20 — "external" no longer means "binary"

pipelines/tasks/0071 settled what an external operation runs on for v1: a signed OperationBundle of declarations (SAPE-10), installed through the same Declare path SAPE-19 already shipped, plus (once SAPE-14 lands) the collections the bundle needs. This changes what "listing external operations" means: they are not a second registry alongside Catalogue, they are declared operations that also carry a signer identity. What this ticket lists is the same store data WhatIsHere already returns, joined against which entries came from a signed bundle and who signed it — not a parallel inventory of loaded code, because in v1 there is no loaded code to inventory.

Why now

Installing a stranger's declarations is only reversible if you can find out that you did it. An operator who inherits a server, or who returns to one after six months, currently has no way to ask what came from a signed bundle versus what they typed themselves — and the answer matters most in the situation where nobody remembers. It is small, and it is the difference between a feature that can be audited and one that can only be trusted.

Measured 2026-09-20. The catalogue surface exists but it is about a different thing. internal/store/explore.go:195 declares Catalogue{ Collections []Spec; Operations []Operation }, and WhatIsHere at explore.go:207 fills it — every declared operation is already listable this way. What it does not carry is signer identity: store.Operation has no field recording who signed the bundle it arrived in, and the catalogue carries no cost information at all, which is why this ticket waits on SAPE-8 rather than shipping a bare list of names. It also waits on SAPE-14: without collections travelling over the wire too, a "server with an external operation installed" is a server somebody also had to stop and apply against by hand, which is the exact outage this group exists to remove.

Acceptance criteria

  1. Install two external operations (two signed bundles), list them, and get exactly those two back — name, version, signing identity, and envelope for each.
  2. The list reflects reality after a change: remove one, list again, one remains. A list that is correct only immediately after installation is a manifest, not a listing.
  3. The listing distinguishes external operations from ones an operator typed directly. An operator on a server with both can tell which entries carry a signer identity and which do not, asserted by a case that has both.
  4. The envelope in the listing is the same envelope SAPE-8 reports for the same operation — compared as values, so the two paths cannot drift apart.
  5. The listing requires the same proof as Explore: a connection that has not proved the server's secret is refused. Asserted as a refusal, with the operation names absent from the response.
  6. On a server with no external operations installed, the answer is an empty list rather than an error or a null.

Out of scope