markitect-quarkdown/docs/permissions-and-runtime.md

Permissions And Runtime

Quarkdown 2.x introduced compile-time permissions. The Markitect adapter treats those as renderer-local execution controls, not as enterprise authorization.

Permission Mapping

The adapter recognizes Quarkdown permission names as CLI flags:

• project-read
• global-read
• network
• native-content
• all

The default allow-list is:

project-read

The adapter denies network by default unless callers explicitly opt out with deny_network: false.

Runtime Dependencies

The descriptor declares these optional runtime assumptions:

• Quarkdown 2.x CLI
• Java 17+
• Node.js, npm, and Puppeteer for PDF export

The test suite does not require those tools. It uses a fake runner for command boundary tests and skips the real-runtime smoke check when quarkdown is not available on PATH.

Output Conventions

The default output directory is quarkdown-output. Expected artifact names are derived from artifact_stem plus the profile extension, for example demo.pdf for profile=pdf.

This repository owns those conventions and compatibility monitoring. Core markitect-tool only sees RenderExportResult, RenderArtifact, diagnostics, and provenance.