capability-use

Three host capabilities, one handler. Designed as the reference for the audit-trail page: every invocation produces a non-trivial set of PluginCapabilityUse rows you can browse from /app/:tenant/settings/plugins/:id/audit.

Capabilities used

Capability	Used for
`log`	Structured logging through `ctx.log`
`storage.read`	Look up the tenant's Slack webhook URL
`http.outbound`	POST a notification to `hooks.slack.com`

The manifest restricts http.outbound via allowedHosts = ["hooks.slack.com"] — any other host triggers a denied row instead of egress.

Why each call shows up in the audit trail

The capability gateway emits an onCall event per host-fn call. The runtime wires that to PluginCapabilityUseRecorder, which buffers entries per invocation then flushes one outbox batch at sandbox close. The worker plugin-capability-use job persists each row. The audit page filters by capability + UTC date and pages by keyset cursor.

Tenant-admin pre-requisites

Before this plugin can post:

Install + enable the plugin via the plugins settings page.
Write the Slack webhook URL under storage key slack:<tenantId>:webhook-url (operator action — see docs/plugins/security-best-practices.md).