Practical guide
Use a development-only restricted command
Exercise an explicitly restricted owner command during development without exposing it to standard packages.
Procedure
- Declare the package origin as development and validate that the restricted namespace is present.
- Query current target and authority revisions.
- Submit only a registered restricted command through restricted.command.submit.
- Observe the receipt and post-commit completion event through the normal evidence path.
- Handle error.restricted-command if the host origin does not authorize the call.
Example
local receipt = restricted.command.submit(
"restricted.actor.crisis-override",
{
actor_id = actor.actor_id,
expected_actor_revision = actor.revision,
expected_authority_revision = actor.authority_revision
},
1
)Constraints and recovery
- The host creates and validates package origin; Lua cannot promote itself.
- Restricted commands still route through typed validation, budgets, receipts, fixed ticks, and authoritative owners.
- Phase 14 permits development packages globally; a later end-user policy may narrow this authority without changing command ownership.