ADR-0008: Programs declare what they need; sessions grant permissions; every host call is checked

Status: accepted (2026-10-09)

Context#

Being logged into TTT must not give every script every capability. TTT has no per-feature permission model today. Compilation must not grant anything.

Decision#

• A program lists every contract it uses (requires "backtest" ">=0.1.0, <0.2.0";). Using an operation of an undeclared contract is a compile error. The permissions a program needs are therefore known before it runs: the union of the permissions of the operations it calls.
• A session (the T0 window in TTT, or a CLI invocation) holds a set of granted permissions chosen by the user. Grants are never stored with a script and never survive a restart.
• Before an execution starts, its needed permissions are compared with the grants; a missing one refuses the run with E-PERM-DENIED naming each. During the run, every host call checks again (the artifact could have been altered after validation; grants can be revoked mid-run).
• Permissions in v0: market.read, analytics.run, research.submit, backtest.run, workspace.read, workspace.write, account.read, orders.prepare, orders.submit, risk.modify, external.access. No v0 contract offers an operation needing orders.submit or risk.modify (Phase 10).
• An automatic code fix never adds a requires line or a grant.