V2 specs tour

The upstream OpenCode contracts underneath doc.haus: who owns what, how sessions admit and execute prompts, how tools are built and bounded, and the two accepted decisions on events and provider policy.

Evaluation

To evaluate an operation and resource:

Start with allow.
Consider every statement whose action and resource match the requested action and resource.
Each matching statement replaces the current decision with its effect.
The last matching statement determines the result.

Conceptually:

function evaluate(action: string, resource: string, fallback: Policy.Effect, statements: Policy.Info[]) {
  return (
    statements.findLast(
      (statement) => Wildcard.match(action, statement.action) && Wildcard.match(resource, statement.resource),
    )?.effect ?? fallback
  )
}

Each caller supplies the default effect appropriate for its operation. Catalog provider use supplies "allow", so no provider policy statements means normal behavior continues: otherwise usable providers are allowed.