zeekayandHanzo Dev
7a9dcac628
An audit read the code and found the proposal that specifies it. Go reaches
all 122 capability proposals and 64 of the 121 other Standards Track ones;
Rust has 35, mostly the operator and the CLI; C++ has three, because the
complete original C++ in the estate is a ZAP handler, a bot nothing specifies,
and authored kernels inside forked CUDA and Metal crates.
| | shipped | partial | none | not assessed |
| Go | 146 | 33 | 1 | 80 |
| C++ | 1 | 2 | 0 | 257 |
| Rust | 10 | 25 | 1 | 224 |
The large "not assessed" columns are the point rather than a gap. The model and
training specs are Python, the frontend and design-system proposals are
TypeScript, and recording `none` against those would read as a search that
came up empty when the honest statement is that the runtime was never the
question. Governance, Meta and Process are not graded at all.
Six proposals are Final with nothing found in Go and are left unwritten rather
than demoted: 0065, 0089, 0098, 0103, 0521 and 0902. HIP-0521 answers itself,
its own section reading "Not yet implemented". Three of the others name a
canonical Go file in consensus/protocol/auth that nobody wrote, in a package
where the four neighbouring proposals' files all exist with tests beside them.
Co-authored-by: Hanzo Dev <[email protected]>
4.8 KiB
hip, title, author, type, category, capability, status, implementation-go, created, requires
| hip | title | author | type | category | capability | status | implementation-go | created | requires |
|---|---|---|---|---|---|---|---|---|---|
| 1131 | Help — The Support Desk | Hanzo AI | Standards Track | Interface | help | Final | shipped | 2026-08-20 | HIP-0106, HIP-0139 |
HIP-1131: Help — The Support Desk
Abstract
/v1/help is the public face of a support desk: an anonymous knowledge base and
a ticket intake. The desk itself — tickets, agents, teams, SLAs, canned
responses, the conversation thread — is a set of framework DocTypes (hd-*)
served by the generic role-gated framework surface; this capability adds only
the one plane that surface deliberately cannot serve, the unauthenticated help
center. It is implemented in hanzoai/cloud at apps/help (HIP-0106).
Motivation
The framework engine is secure by default: every read and write needs a
validated principal and a role, so there is no anonymous "read the public
knowledge base" or "a customer files a ticket" path. Building a second CRUD
stack for the public center would duplicate the store; adding an anonymous hole
to the generic engine would widen every module. The thin public plane is the
remaining shape (apps/help/help.go:1-40).
Specification
The key words MUST, MUST NOT, SHOULD, SHOULD NOT and MAY are to be interpreted as in RFC 2119.
§1 It owns no store
A ticket IS a framework document in module help; so are articles, categories,
agents, teams, SLAs and conversation messages. Every read and write on this
surface delegates to the framework in-process API, so there is one storage
engine and no duplicated CRUD (apps/help/help.go:20-26). The agent plane —
triage, authoring, threads — is the framework's generic surface at
/v1/framework/hd-* and needs no code here beyond the DocType fixtures
(apps/help/help.go:52-82).
§2 The address
Four operations, all typed: list the public articles, fetch one by slug, list
the categories, and file a ticket. Reads are gated to status=Published AND is_public=1, re-checked on a direct fetch, so a draft or an internal
(agent-only) article never leaks; a category fronting no public article is
invisible (apps/help/subsystem.go:6-18). The intake is bounded — 64 KiB body,
capped subject, message and sender fields — because it is the one anonymous
write (apps/help/subsystem.go:45-52).
§3 Tenancy is inverted: one org, server-fixed
This is an anonymous surface, so the tenant is not the caller's — it is the
deployment's. Every public endpoint serves exactly ONE org, resolved server-side
at mount: an explicit operator override, else the deployment brand. A request's
X-Org-Id is ignored here, so a caller can never read or write another tenant's
help center. With no brand and no override the plane fails closed: every
endpoint answers 404 until the operator names the org
(apps/help/subsystem.go:11-19).
Per-client rate limiting is left to the edge, which knows the client; behind the
ingress this app sees only the edge as socket peer, so an app-level per-IP
limiter would throttle every customer against one shared bucket
(apps/help/subsystem.go:20-24).
§4 Money, events, observability
Free (cloud.Free, plugin/help/main.go). It publishes nothing on the bus and
emits nothing beyond the request span every route gets.
§5 Stage
beta: a vertical application — a support product an org runs, not a core
plane. The manifest row (manifest/apps.go:182) does not yet declare it, so
today the operations serve as ga does; the row's Stage: Beta is the one
edit that closes the drift (HIP-0139 §8).
§6 Upstream
No upstream code is embedded. The DocType model is a native rebuild of the
Frappe Helpdesk shape — the model moved onto the native engine; no Frappe code,
Python, or frontend survives (apps/help/help.go:28-33).
Rationale
The alternative was a standalone helpdesk process with its own store and its own auth. Making the desk a framework module means the agent plane, its roles and its renderer already exist, and the only new code is the anonymous plane — which is also the only code that needed a different security posture.
Security Considerations
The wrong implementation leaks in two directions. Outward: a visibility filter applied on the list but not on the direct fetch serves drafts and internal articles by slug — which is why the Published/public predicate is server-set and re-checked per document. Across tenants: an org read from the request would let any caller browse any deployment's centers; the org is fixed at mount and no request field can move it. The intake is the abuse surface that remains, and it is bounded rather than authenticated, because requiring an account to file a ticket defeats a support desk.
References
- HIP-0106 — Hanzo Plugin Contract
- HIP-0139 — Capability
Copyright
Released under CC0 1.0 Universal Public Domain Dedication.