# capability-use

Three host capabilities, one handler. Designed as the reference for
the audit-trail page: every invocation produces a non-trivial set of
`PluginCapabilityUse` rows you can browse from
`/app/:tenant/settings/plugins/:id/audit`.

## Capabilities used

| Capability      | Used for                                        |
| --------------- | ----------------------------------------------- |
| `log`           | Structured logging through `ctx.log`            |
| `storage.read`  | Look up the tenant's Slack webhook URL          |
| `http.outbound` | POST a notification to `hooks.slack.com`        |

The manifest restricts `http.outbound` via `allowedHosts =
["hooks.slack.com"]` — any other host triggers a denied row instead of
egress.

## Why each call shows up in the audit trail

The capability gateway emits an `onCall` event per host-fn call. The
runtime wires that to `PluginCapabilityUseRecorder`, which buffers
entries per invocation then flushes one outbox batch at sandbox close.
The worker `plugin-capability-use` job persists each row. The audit
page filters by capability + UTC date and pages by keyset cursor.

## Tenant-admin pre-requisites

Before this plugin can post:

1. Install + enable the plugin via the plugins settings page.
2. Write the Slack webhook URL under storage key
   `slack:<tenantId>:webhook-url` (operator action — see
   `docs/plugins/security-best-practices.md`).