[blindzero]

Closes #322

Summary

Enforces a single namespace scheme for step types and capabilities:

	First-party (IdLE bundle)	Extensions (third-party, host, tests)
Step type	IdLE.Step.*	<Owner>.IdLE.Step.<...>
Capability	fixed list in src/IdLE.Core/Data/ReservedNamespaces.psd1 (+ deprecated alias IdLE.Mailbox.Read)	<Owner>.IdLE.<Domain>.<Verb>

Error codes: ReservedNamespace, InvalidExtensionNamespace, UnknownCapability (messages include a corrected example).

Changes

• Single source of rules: Data/ReservedNamespaces.psd1 holds the reserved prefix, extension patterns, defined capabilities and deprecated aliases (ConvertTo-IdleNormalizedCapability now reads aliases from there).
• First-party detection: a module is first-party only if its ModuleBase is a folder of the loaded IdLE bundle (same rule as the mixed-version guard). Module names alone never grant first-party status.
• Discovery: step packs are discovered via the manifest marker only; the name-based IdLE.Steps.* fallback is removed.
• Host extension points supplement only: Providers.StepRegistry can no longer replace a step pack step type, including IdLE.Step.EmitEvent (DuplicateStepHandler). Providers.StepMetadata already behaved this way (DuplicateStepTypeMetadata).
• Provider capabilities are validated on every plan build, not only when a step requires capabilities.
• IdLE.Step.AcquireAuthSession: the execution-time special case in Invoke-IdlePlanObject is removed.

Breaking changes

• Host or third-party IdLE.* step types, non-<Owner>.IdLE.* step types/capabilities and unknown IdLE.* capabilities are now hard errors.
• Modules named IdLE.Steps.* without the PrivateData.IdLE marker are no longer discovered.
• Providers.StepRegistry entries for step pack step types are rejected.

Tests

• New tests/Core/IdentifierNamespaces.Tests.ps1: rule matrix, provider capabilities, host extension points, first-party detection, and a sync check between ReservedNamespaces.psd1 and docs/reference/capabilities.md.
• StepPackHandlerRegistration.Tests.ps1: impostor module, module without marker, duplicates, unknown capability, reserved/invalid namespaces.
• Test step types/capabilities renamed to Test.IdLE.* / Custom.IdLE.*; tests that replaced EmitEvent now use the real step or Test.IdLE.Step.Emit; the two tests for the removed AcquireAuthSession special case are dropped.

Results: Pester 929 passed / 0 failed; PSScriptAnalyzer 0 errors (17 pre-existing warnings, unchanged from main); step reference generator leaves docs/reference unchanged.

Docs

• docs/reference/capabilities.md: naming rules; adds the missing IdLE.Identity.RevokeSessions and IdLE.Mailbox.Permissions.Ensure.
• docs/extend/steps.md: new "Step type names" section; step pack rules updated.
• docs/extend/extensibility.md, docs/about/security.md (trust levels), AGENTS.md 4.2.1.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-31T23:21:09.353293Z	ffc26b3	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Verdict: PASS

The namespace enforcement is consistent with AGENTS.md 4.2.1 and the trust boundaries. First-party status comes from the bundle path rather than the module name, and host registries can no longer replace step pack handlers. Tests and docs are included.

Findings: none (no CRITICAL, MAJOR or MINOR).

I read the core private helpers and the ReservedNamespaces.psd1 data file, and skimmed the diff. I did not run the test suite.

[github-actions]

Code Coverage Report

Overall Project	74.67%	🍏

There is no coverage information present for the Files changed

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ffc26b3981

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Verdict: PASS — No critical issues found. The namespace rules are enforced consistently, and the tests and docs are updated.

• CRITICAL: none
• MAJOR: none
• MINOR: first-party bundle detection in Test-IdleFirstPartyModule takes the first IdLE module returned by Get-Module -All, so the result is ambiguous if several instances are loaded (inline comment).

I reviewed this from the diff plus a spot-check of the namespace code and capability list. I did not run the Pester suite.

[claude]

Verdict: PASS

Namespace enforcement is centralized in ReservedNamespaces.psd1, first-party detection is based on module location rather than name, and the host StepRegistry can no longer replace step pack handlers. I found no blocking issues.

Findings:

• CRITICAL: none
• MAJOR: none
• MINOR: none

Limits of this review: I read the core namespace helpers, the data file and the step registry. I did not read every test file or run the Pester suite.