Open Questions (Remaining)

1. Sandboxing / Permissions (Future)

Question: Should extensions declare required permissions?

Options:

• A) No sandboxing (current): Extensions run with same privileges as AI agent
• B) Permission declarations: Extensions declare filesystem:read, network:external, etc.
• C) Opt-in sandboxing: Organizations can enable permission enforcement

Status: Deferred to future version. Currently using trust-based model where users trust extension authors.

---

2. Package Signatures (Future)

Question: Should extensions be cryptographically signed?

Options:

• A) No signatures (current): Trust based on catalog source
• B) GPG/Sigstore signatures: Verify package integrity
• C) Catalog-level verification: Catalog maintainers verify packages

Status: Deferred to future version. checksum field is available in catalog schema but not enforced.