Skip to content
Snug Protocol
Specification 1.0 — normative. One section (§17, standing approvals) is explicitly provisional and so marked.

Part VI — Conformance

An implementation may claim conformance with the parts it implements; Part I is the minimum. Each item below is asserted by the reference implementation’s test suite.

Hosts (wire):

  • Validate every inbound frame against the published schemas, accepting unknown fields (R2) and rejecting unsupported versions (R1); strict net/open-url frames refuse unknown keys.
  • Mint instanceId, deliver it in snug:host-ready, route by message source, never by appId (R4).
  • Emit exactly one terminal snug:app-response per accepted requestId (R3).
  • Enforce the size classes, string caps, parse budget, and backoff of R6.
  • Push hints, never content, on host-initiated events (R7).
  • Strip the five credential headers at the envelope boundary (C1); run app frames sandbox="allow-scripts" only with connect-src blocked (C2); advertise only the capabilities actually mediated.
  • Parse agent replies with graduated tolerance; convert failure to PARSE_FAILED with rawExcerpt and attemptsRemaining.
  • Execute app code with no configured model for apps that request none.

Apps and SDKs:

  • Announce on mount; wait for snug:host-ready; echo instanceId; unique requestId per instance; ignore unknown frames and fields; treat streaming frames as provisional; never assume storage or network APIs — use the frames; feature-detect net/openUrl from capabilities and render honest fallbacks.

Hubs (Part II):

  • Carry the schema version in PRAGMA user_version, migrate forward-only, refuse newer-stamped files, self-heal the table set, and run the legacy-slice wipe once.
  • Compute namespace tokens with the normative function; refuse violating object names (fail closed); materialize per-app runtimes so isolation is physical; store DDL verbatim.
  • Offer export/import per §9; strip secrets and VACUUM by default; re-confirm imported endpoint settings; reconcile imported connections per §12.4 and contracts per §18.2.
  • Retain ≥5 unpinned versions; never prune a pinned version (reset targets the newest pinned row).
  • Decide file format by leading bytes; read-and-adopt legacy names (§10); honor every SNUGENC1 rule of §11, including locked-vs-corrupt reporting.
  • Never require the backend for app execution.

Hosts (connected apps, Part III):

  • Persist requirements and grants only through the five writers; enforce the slot cap; derive ceilings with stable output; freeze at approval; stage edits; disclose diffs.
  • Apply the full validation stack before a requirement is shown, stored, or acted on: schema bounds → template lint (one field-key resolution for both templates) → registry-borrow ban → provider-name guard.
  • Render every re-admitted seat verbatim in the approval review — fields, walkthrough, templates uncollapsed, the complete host list, the freeze disclosure. This contract trades “the channel cannot express it” for “the user sees exactly what it expresses”; a review that truncates voids the trade.
  • Run the ten-gate executor in order; confirm before credential read on every mutating call, local transports included; never follow a redirect; never expose a credentialed URL; scrub per §14.1–§14.3.
  • Disclose provenance honestly; disclose prior revocations keyed by provider/host, not by slot name.

Hosts (linked-device, Part V):

  • Never admit a loopback address into a ceiling; reach helpers through a dedicated OS-scoped transport behind the symbolic-host pattern; enforce the custody split, the closed route table with derived subsets, decoded-form admission, refuse-don’t-truncate caps, single-writer lifecycle, graceful-first termination, and the pseudonymisation backstop with its honest class statement and disclosures.