vaultkit 1.3.0 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 17014258d6102f66c5d3479d541fbc2540f5f4b988c87c46c0bf8a7d17340043
-  data.tar.gz: 83c4694cc2efd7bc579c2fbc29bf2f556fd22539ffae1a23f52ce741b55f126e
+  metadata.gz: e2eb23b9fcb727367f905e2d62f8b9de36e23cf9a00f54e067f92d6caff9b282
+  data.tar.gz: 8d125c6b810953abd5c0976fe18b2add1c65781431e9a3b2e147d6253fe968bb
 SHA512:
-  metadata.gz: 452fad9cc3ed91570302342f4e319c26cf62c3446bb008f225719f01487731de5f953046ce67b8dbe0b33e6cad6406fa36d1b6e35cb1092a12bb7826e8999fa0
-  data.tar.gz: c6ec74cacd3cc839ff3160413c86513f5f3a0d8a036f6a6bb938bfc56bc473215583dd9e63414c05c83710ba1c2d6d9a8c70dccd57fde6760e9f125058f6d34e
+  metadata.gz: f1780712e8c30407ad5b3319f0df166ba391deff62d79b5e89176867ca4a2d2e8e65b2ec8a4769f28ccd73133bb3e72a87bdf2de3c7ca37ecb79d54ed26ddfba
+  data.tar.gz: b6891fd707489ac9ad584459e1a89dcc9eefaa8eb1a73e19b5b93666bceb34c4cbd84246a1b67eede91453c9da94010f875611b35d09e4441dd11695ca93cdf1

data/README.md

@@ -740,6 +740,26 @@ vkit scan production_pg
 
 To accept a suggestion, change the field's sensitivity and tags in `datasets/registry.yaml`, then build and deploy the bundle. Control planes that predate suggestions don't send them, and the output is unchanged.
 
+**Unreviewed Columns:**
+
+Columns the classifier couldn't place keep the `unknown` sensitivity until someone reviews them. The `starter` pack (2.1.0 and later) masks them for agents, so the scan lists them under their dataset, marked `!`, and counts them:
+
+```bash
+vkit scan production_pg
+
+# Output:
+#   customers                ✓
+#     ! unreviewed: notes, meta
+#
+#   No changes detected
+#
+#   ⚠️  2 columns are unreviewed and masked until you review them
+#      (for agents, under the starter pack). To review, set each one's sensitivity
+#      in datasets/registry.yaml, then run: vkit policy bundle && vkit policy deploy
+```
+
+Older control planes don't send unreviewed columns, and the output is unchanged.
+
 **Apply Changes:**
 ```bash
 vkit scan production_pg --mode apply

data/lib/vkit/cli/base_cli.rb

@@ -299,11 +299,14 @@ module Vkit
           desc "upgrade [NAME]", "Upgrade installed policy packs (all if NAME omitted)"
           option :dir, type: :string, default: "."
           option :force, type: :boolean, default: false
+          option :restore, type: :boolean, default: false,
+                           desc: "Restore an up-to-date pack's missing files without asking"
           def upgrade(name = nil)
             Commands::PolicyPackUpgradeCommand.new.call(
               pack_name: name,
               dir: options[:dir],
-              force: options[:force]
+              force: options[:force],
+              restore: options[:restore]
             )
           end
         }

data/lib/vkit/cli/commands/policy_bundle_command.rb

@@ -58,6 +58,7 @@ module Vkit
             puts "   Version:  #{bundle.dig("bundle", "bundle_version")}"
             puts "   Checksum: #{bundle.dig("bundle", "checksum")}"
             puts "   Output:   #{out}"
+            print_policy_summary(bundle, policies_dir)
           end
         rescue Vkit::Policy::ValidationError => e
           puts e.message
@@ -66,6 +67,24 @@ module Vkit
 
         private
 
+        # Per-pack counts on every bundle, so a pack that contributes nothing
+        # is visible even when nothing errors.
+        def print_policy_summary(bundle, policies_dir)
+          total = bundle["policies"].length
+          packs = Array(bundle.dig("bundle", "installed_packs"))
+          from_packs = packs.sum { |p| Array(p["policy_ids"]).length }
+          rows = packs.map { |p| ["#{p["name"]} #{p["version"]}", Array(p["policy_ids"]).length] }
+          rows << ["repo (#{relative(policies_dir)})", total - from_packs]
+          width = rows.map { |label, _| label.length }.max
+
+          puts "   Policies: #{total}"
+          rows.each { |label, count| puts "     #{label.ljust(width)}  #{count}" }
+        end
+
+        def relative(path)
+          path.delete_prefix(Dir.pwd + File::SEPARATOR)
+        end
+
         def git_sha
           out = `git rev-parse HEAD 2>/dev/null`.strip
           return nil if out.empty?

data/lib/vkit/cli/commands/policy_deploy_command.rb

@@ -1,6 +1,9 @@
 # frozen_string_literal: true
 
 require "json"
+require "digest"
+require_relative "../../policy/pack_integrity"
+require_relative "../../policy/bundle_compiler"
 
 module Vkit
   module CLI
@@ -30,20 +33,50 @@ module Vkit
             org_slug = org || derived_org
 
             bundle = JSON.parse(File.read(bundle_path))
+            Vkit::Policy::PackIntegrity.check_bundle!(bundle)
 
-            response = authenticated_client.post(
-              "/api/v1/orgs/#{org_slug}/policy_bundles",
-              body: {
-                bundle: bundle,
-                activate: activate
-              }
-            )
+            response = upload(org_slug, bundle, activate)
 
             puts "🚀 Policy bundle deployed"
             puts "   Org:     #{org_slug}"
             puts "   Version: #{response['bundle_version']}"
             puts "   State:   #{response['state']}"
           end
+        rescue Vkit::Policy::ValidationError => e
+          puts e.message
+          exit 1
+        end
+
+        private
+
+        # A control plane from before vaultkitcli#47 doesn't know installed_packs'
+        # policy_ids and rejects the bundle on schema. The ids were checked
+        # above, so send the bundle without them (re-checksummed) instead.
+        def upload(org_slug, bundle, activate)
+          post_bundle(org_slug, bundle, activate)
+        rescue Vkit::CLI::API::APIError => e
+          raise unless e.status == 422 && e.error.to_s.match?(%r{installed_packs/\d+/policy_ids})
+
+          warn "ℹ️  This control plane predates per-pack policy checks; deploying without them."
+          post_bundle(org_slug, without_policy_ids(bundle), activate)
+        end
+
+        def post_bundle(org_slug, bundle, activate)
+          authenticated_client.post(
+            "/api/v1/orgs/#{org_slug}/policy_bundles",
+            body: {
+              bundle: bundle,
+              activate: activate
+            }
+          )
+        end
+
+        def without_policy_ids(bundle)
+          copy = JSON.parse(JSON.generate(bundle))
+          Array(copy.dig("bundle", "installed_packs")).each { |p| p.delete("policy_ids") }
+          copy["bundle"]["checksum"] = ""
+          copy["bundle"]["checksum"] = Digest::SHA256.hexdigest(Vkit::Policy::BundleCompiler.canonical_json(copy))
+          copy
         end
       end
     end

data/lib/vkit/cli/commands/policy_pack_upgrade_command.rb

@@ -6,7 +6,9 @@ module Vkit
   module CLI
     module Commands
       class PolicyPackUpgradeCommand < BaseCommand
-        def call(pack_name:, dir:, force: false)
+        # restore: rewrite an up-to-date pack's missing files without asking.
+        # Without it, a terminal is asked; anything else is told to rerun.
+        def call(pack_name:, dir:, force: false, restore: false, input: $stdin)
           ensure_project!(dir)
 
           manager = Vkit::CLI::PolicyPack::Manager.new(
@@ -22,8 +24,20 @@ module Vkit
               end
             end
 
+          results.each do |r|
+            restore_missing(manager, r, restore, input) if r[:status] == :missing
+          end
+
           print_summary(results)
 
+          if results.any? { |r| %i[failed missing].include?(r[:status]) }
+            if results.any? { |r| r[:status] == :missing }
+              puts "\nRestore them with 'vkit policy pack upgrade #{pack_name || "<pack>"} --restore'. " \
+                   "Until then 'vkit policy bundle' fails."
+            end
+            exit 1
+          end
+
           puts "\nRun 'vkit policy bundle' to recompile."
         rescue StandardError => e
           puts "❌ Error: #{e.message}"
@@ -41,6 +55,8 @@ module Vkit
         def summarize(pack, result)
           if result == :up_to_date
             { name: pack, status: :up_to_date }
+          elsif result[:status] == :missing
+            { name: pack, status: :missing, version: result[:version], files: result[:files] }
           else
             {
               name: pack,
@@ -52,6 +68,26 @@ module Vkit
           end
         end
 
+        def restore_missing(manager, r, restore, input)
+          puts "⚠️  #{r[:name]} #{r[:version]} is installed, but #{r[:files].length} of its files are missing:"
+          r[:files].each { |f| puts "   #{f["path"]} (#{f["policy_id"]})" }
+
+          return unless restore || confirm?(input, "Restore them from the pack? [Y/n] ")
+
+          manager.restore!(r[:name])
+          r[:status] = :restored
+        rescue => e
+          r.merge!(status: :failed, error: e.message)
+        end
+
+        def confirm?(input, prompt)
+          return false unless input.respond_to?(:tty?) && input.tty?
+
+          print prompt
+          answer = input.gets.to_s.strip.downcase
+          answer.empty? || answer.start_with?("y")
+        end
+
         def print_summary(results)
           return if results.empty?
 
@@ -68,6 +104,12 @@ module Vkit
               puts "   To:   v#{r[:new]}"
               puts "   Policies updated: #{r[:policies]}"
 
+            when :restored
+              puts "✅ #{r[:name]}: restored #{r[:files].length} missing file(s) at v#{r[:version]}"
+
+            when :missing
+              puts "❌ #{r[:name]}: #{r[:files].length} file(s) missing, not restored"
+
             when :failed
               puts "❌ #{r[:name]}: #{r[:error]}"
             end

data/lib/vkit/cli/commands/policy_validate_command.rb

@@ -1,4 +1,6 @@
+require "json"
 require_relative "../policy_bundle_validator"
+require_relative "../../policy/pack_integrity"
 
 module Vkit
   module CLI
@@ -16,8 +18,12 @@ module Vkit
           )
         
           validator.validate!(bundle_path)
+          Vkit::Policy::PackIntegrity.check_bundle!(JSON.parse(File.read(bundle_path)))
         
           puts "✅ Policy bundle is valid"
+        rescue Vkit::Policy::ValidationError => e
+          puts e.message
+          exit 1
         end        
 
         private

data/lib/vkit/cli/commands/scan_command.rb

@@ -60,6 +60,7 @@ module Vkit
               end
 
               print_suggestions(dataset)
+              print_unreviewed(dataset)
 
               puts
             end
@@ -78,6 +79,8 @@ module Vkit
             puts "    datasets/registry.yaml and redeploy the bundle."
           end
 
+          print_unreviewed_note(datasets)
+
           puts
           puts "  ✅ Applied" if response["applied"]
         end
@@ -85,6 +88,28 @@ module Vkit
         def print_clean(dataset)
           puts "  #{dataset["name"].ljust(24)} ✓"
           print_suggestions(dataset)
+          print_unreviewed(dataset)
+        end
+
+        # Columns still labelled unknown. Older control planes don't send them.
+        # The starter pack masks them for agents until someone reviews them.
+        def print_unreviewed(dataset)
+          names = unreviewed_for(dataset)
+          puts "    ! unreviewed: #{names.join(", ")}" if names.any?
+        end
+
+        def print_unreviewed_note(datasets)
+          count = datasets.sum { |d| unreviewed_for(d).size }
+          return if count.zero?
+
+          puts
+          puts "  ⚠️  #{count} #{count == 1 ? "column is" : "columns are"} unreviewed and masked until you review them"
+          puts "     (for agents, under the starter pack). To review, set each one's sensitivity"
+          puts "     in datasets/registry.yaml, then run: vkit policy bundle && vkit policy deploy"
+        end
+
+        def unreviewed_for(dataset)
+          Array(dataset["unreviewed"])
         end
 
         def print_suggestions(dataset)

data/lib/vkit/cli/policy_pack/manager.rb

@@ -185,10 +185,15 @@ module Vkit
           shipped_version = shipped_meta["version"]
         
           if installed_version == shipped_version
-            return :up_to_date
+            missing = missing_files(pack_name)
+            return :up_to_date if missing.empty?
+
+            return { status: :missing, version: installed_version, files: missing }
           end
         
-          remove!(pack_name, force: force) unless dry_run
+          # Every file is rewritten at the new version, so old ones that are
+          # already gone don't matter.
+          remove!(pack_name, force: true) unless dry_run
         
           count = install!(pack_name, force: force, dry_run: dry_run)
         
@@ -199,6 +204,39 @@ module Vkit
           }
         end
 
+        # Recorded files of an installed pack that are no longer on disk.
+        def missing_files(pack_name)
+          raise PackNotInstalled, "Pack '#{pack_name}' is not installed" unless installed?(pack_name)
+
+          Array(installed_packs[pack_name]["files"]).reject do |f|
+            File.exist?(File.expand_path(f.fetch("path"), @project_root))
+          end
+        end
+
+        # Rewrites an installed pack's missing files from the shipped pack,
+        # leaving the ones still present (and any edits to them) alone.
+        # Returns the restored file entries.
+        def restore!(pack_name)
+          meta, policies = read_pack!(pack_name)
+          installed_version = installed_packs.dig(pack_name, "version")
+
+          if installed_version != meta["version"]
+            raise Error, "Pack '#{pack_name}' #{installed_version} is installed but this CLI ships " \
+                         "#{meta["version"]}; upgrade it instead"
+          end
+
+          by_id = policies.to_h { |p| [p.fetch("id"), p] }
+
+          missing_files(pack_name).each do |f|
+            policy = by_id[f["policy_id"]]
+            raise InvalidPack, "Pack '#{pack_name}' no longer ships policy '#{f["policy_id"]}'" unless policy
+
+            dest = File.expand_path(f.fetch("path"), @project_root)
+            FileUtils.mkdir_p(File.dirname(dest))
+            File.write(dest, render_policy_file(pack_name, meta, policy))
+          end
+        end
+
         def upgrade_all!(force: false, dry_run: false)
           # installed packs ordered by layer (low -> high)
           packs = installed_packs.keys.sort_by { |name| safe_pack_metadata(name)["layer"].to_i }

data/lib/vkit/policy/bundle_compiler.rb

@@ -6,15 +6,18 @@ require_relative "policy_validator"
 require_relative "match_check"
 require_relative "tenancy_check"
 require_relative "validation_error"
+require_relative "pack_integrity"
 
 module Vkit
   module Policy
     class BundleCompiler
       FORMAT_VERSION = "v1"
 
-      # Raises if a policy can never match (see MatchCheck).
-      def self.compile!(org_slug:, bundle_version:, policies_dir:, registry_dir:, source: {})
+      # Raises if a policy can never match (see MatchCheck), or if an
+      # installed pack is missing policies (see PackIntegrity).
+      def self.compile!(org_slug:, bundle_version:, policies_dir:, registry_dir:, source: {}, project_root: Dir.pwd)
         policies = load_policies(policies_dir)
+        installed_packs = PackIntegrity.check!(project_root: project_root, policies_dir: policies_dir, policies: policies)
         raw_registry = load_raw_registry(registry_dir)
         registry = normalize_registry(raw_registry)
         check_matches!(policies, registry, raw_registry)
@@ -33,7 +36,7 @@ module Vkit
           "signing" => nil
         }
 
-        bundle["bundle"]["installed_packs"] = load_installed_packs
+        bundle["bundle"]["installed_packs"] = installed_packs
         canonical = canonical_json(bundle)
         bundle["bundle"]["checksum"] = Digest::SHA256.hexdigest(canonical)
 
@@ -51,7 +54,7 @@ module Vkit
 
           PolicyValidator.validate!(data, file: File.basename(f))
 
-          data.merge("__file" => File.basename(f))
+          data.merge("__file" => File.basename(f), "__path" => File.expand_path(f))
         end
       end
 
@@ -212,23 +215,6 @@ module Vkit
           value
         end
       end
-
-      def self.load_installed_packs
-        tracking_path = File.join(".vkit", "packs.yaml")
-        return [] unless File.exist?(tracking_path)
-      
-        data = YAML.safe_load(File.read(tracking_path), permitted_classes: [], permitted_symbols: [], aliases: true)
-        packs = data["installed_packs"] || {}
-      
-        packs.map do |name, meta|
-          {
-            "name" => name,
-            "version" => meta["version"]
-          }
-        end
-      rescue
-        []
-      end      
     end
   end
 end

data/lib/vkit/policy/pack_integrity.rb

@@ -0,0 +1,157 @@
+# frozen_string_literal: true
+
+require "yaml"
+require_relative "validation_error"
+
+module Vkit
+  module Policy
+    # Checks that every pack recorded in .vkit/packs.yaml still contributes
+    # all of its policies, so a bundle can't quietly lose one (vaultkitcli#47).
+    module PackIntegrity
+      PACKS_DIR = File.expand_path("packs", __dir__)
+      TRACKING_PATH = File.join(".vkit", "packs.yaml")
+      VERSION_HEADER = /^# Pack Version: (.+)$/
+
+      module_function
+
+      # Installed packs as recorded, { name => entry }. A missing file means no
+      # packs; an unreadable one is an error, since it would hide every pack.
+      def installed_packs(project_root)
+        path = File.join(project_root, TRACKING_PATH)
+        return {} unless File.exist?(path)
+
+        data = YAML.safe_load(File.read(path), permitted_classes: [], permitted_symbols: [], aliases: true) || {}
+        raise ValidationError, "#{TRACKING_PATH} is not a mapping" unless data.is_a?(Hash)
+
+        packs = data["installed_packs"] || {}
+        raise ValidationError, "#{TRACKING_PATH}: installed_packs is not a mapping" unless packs.is_a?(Hash)
+
+        packs
+      rescue Psych::Exception => e
+        raise ValidationError, "Can't read #{TRACKING_PATH}: #{e.message}"
+      end
+
+      # Raises unless each installed pack's recorded files are all present in
+      # policies_dir, at the recorded version, with the recorded policy ids.
+      # `policies` are the loaded policy files, each with "__path".
+      # Returns [{ "name", "version", "policy_ids" }] for the bundle.
+      def check!(project_root:, policies_dir:, policies:)
+        by_path = policies.to_h { |p| [real(p["__path"]), p] }
+        problems = []
+
+        packs = installed_packs(project_root).map do |name, entry|
+          entry ||= {}
+          version = entry["version"].to_s
+          files = Array(entry["files"])
+          pack_problems = []
+
+          pack_problems << "no files recorded in #{TRACKING_PATH}" if files.empty?
+
+          shipped = shipped_policy_ids(name, version)
+          if shipped && files.length < shipped.length
+            recorded = files.map { |f| f["policy_id"] }
+            pack_problems << "#{TRACKING_PATH} records #{files.length} of the pack's #{shipped.length} policies " \
+                             "(not recorded: #{(shipped - recorded).join(", ")})"
+          end
+
+          files.each do |f|
+            rel = f["path"].to_s
+            abs = File.expand_path(rel, project_root)
+            expected_id = f["policy_id"].to_s
+
+            unless File.exist?(abs)
+              pack_problems << "missing #{rel} (#{expected_id})"
+              next
+            end
+
+            policy = by_path[real(abs)]
+            unless policy
+              pack_problems << "#{rel} (#{expected_id}) is not in the policies directory #{policies_dir}"
+              next
+            end
+
+            if policy["id"].to_s != expected_id
+              pack_problems << "#{rel} has policy id #{policy["id"].inspect}, recorded as #{expected_id.inspect}"
+            end
+
+            file_version = File.read(abs)[VERSION_HEADER, 1]&.strip&.delete('"')
+            if file_version && file_version != version
+              pack_problems << "#{rel} is from version #{file_version}, but #{version} is installed"
+            end
+          end
+
+          problems << [name, version, pack_problems] if pack_problems.any?
+
+          { "name" => name.to_s, "version" => version, "policy_ids" => files.map { |f| f["policy_id"].to_s } }
+        end
+
+        raise ValidationError, problems_message(problems, restore: true) if problems.any?
+
+        packs
+      end
+
+      # Raises unless every policy a bundle's installed_packs lists is in the
+      # bundle. Bundles from vkit 1.3.0 and older record only name and
+      # version: those are checked against the pack this CLI ships, when it
+      # ships that version.
+      def check_bundle!(bundle)
+        bundled = Array(bundle["policies"]).map { |p| p["id"].to_s }
+        problems = []
+
+        Array(bundle.dig("bundle", "installed_packs")).each do |pack|
+          name = pack["name"].to_s
+          version = pack["version"].to_s
+          expected = pack["policy_ids"] || shipped_policy_ids(name, version)
+          next unless expected
+
+          missing = expected - bundled
+          problems << [name, version, ["missing policies: #{missing.join(", ")}"]] if missing.any?
+        end
+
+        raise ValidationError, problems_message(problems, restore: false) if problems.any?
+      end
+
+      def real(path)
+        File.realpath(path)
+      rescue SystemCallError
+        path
+      end
+
+      # Policy ids of the pack this CLI ships, or nil if it ships another version.
+      def shipped_policy_ids(name, version)
+        root = File.join(PACKS_DIR, name.to_s)
+        meta_path = File.join(root, "metadata.yaml")
+        return unless File.exist?(meta_path)
+
+        meta = (YAML.safe_load(File.read(meta_path), aliases: true) || {})["__pack_meta"] || {}
+        return unless meta["version"].to_s == version.to_s
+
+        Dir.glob(File.join(root, "policies", "*.yaml")).sort.map do |file|
+          (YAML.safe_load(File.read(file), aliases: true) || {})["id"].to_s
+        end
+      end
+
+      def problems_message(problems, restore:)
+        lines = problems.map do |name, version, list|
+          "  #{name} #{version}:\n#{list.map { |p| "    - #{p}" }.join("\n")}"
+        end
+
+        hint =
+          if restore
+            "Restore the files with `vkit policy pack upgrade <pack>`, or remove the pack with " \
+              "`vkit policy pack remove <pack> --force` if you no longer want it."
+          else
+            "Rebuild the bundle with `vkit policy bundle`, which checks the installed packs."
+          end
+
+        <<~MSG
+          ❌ Installed policy packs are incomplete; the bundle would leave out their policies:
+
+          #{lines.join("\n")}
+
+          #{hint}
+        MSG
+      end
+    end
+  end
+end

data/lib/vkit/policy/packs/starter/metadata.yaml

@@ -1,8 +1,8 @@
 __pack_meta:
   name: starter
-  version: "2.0.0"
+  version: "2.1.0"
   layer: 10
-  description: "Secure defaults: secrets denied, PII and high-sensitivity fields masked, approval for high-sensitivity data in production, unreviewed columns flagged."
+  description: "Secure defaults: secrets denied, PII and high-sensitivity fields masked, approval for high-sensitivity data in production, unreviewed columns flagged, and masked for agents."
   dependencies: []
   priority_band:
     min: 0

data/lib/vkit/policy/packs/starter/policies/06_flag_unknown.yaml

@@ -1,5 +1,5 @@
 id: flag_unknown_sensitivity
-description: Allow columns nobody has reviewed yet, and record why, so they show up in the audit log.
+description: Allow people to read columns nobody has reviewed yet, and record why, so they show up in the audit log. Agents get them masked (mask_unknown_for_agents).
 priority: 20
 
 match:

data/lib/vkit/policy/packs/starter/policies/07_mask_unknown_for_agents.yaml

@@ -0,0 +1,18 @@
+id: mask_unknown_for_agents
+description: Mask columns nobody has reviewed yet when an agent reads them, in every environment, until someone gives them a real label.
+priority: 84
+
+match:
+  fields:
+    sensitivity: unknown
+
+context:
+  requester_role: agent
+
+action:
+  mask: true
+  reason: This column hasn't been reviewed, so it's masked for agents. Give it a sensitivity in datasets/registry.yaml and redeploy the bundle.
+  ttl: 1h
+
+masking:
+  default_method: full

data/lib/vkit/policy/schema/policy_bundle.schema.json

@@ -78,7 +78,13 @@
             "additionalProperties": false,
             "properties": {
               "name": { "type": "string" },
-              "version": { "type": "string" }
+              "version": { "type": "string" },
+              "policy_ids": {
+                "type": "array",
+                "minItems": 1,
+                "description": "Ids of the policies this pack contributes. Every one must be in policies.",
+                "items": { "type": "string", "minLength": 1 }
+              }
             }
           }
         }

data/lib/vkit/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Vkit
-  VERSION = "1.3.0"
+  VERSION = "1.4.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: vaultkit
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 1.4.0
 platform: ruby
 authors:
 - Nnamdi Ogundu
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-11-05 00:00:00.000000000 Z
+date: 2026-11-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -96,6 +96,7 @@ files:
 - lib/vkit/core/table_formatter.rb
 - lib/vkit/policy/bundle_compiler.rb
 - lib/vkit/policy/match_check.rb
+- lib/vkit/policy/pack_integrity.rb
 - lib/vkit/policy/packs/ai_safety/metadata.yaml
 - lib/vkit/policy/packs/ai_safety/policies/01_require_approval_agents_sensitive_prod.yaml
 - lib/vkit/policy/packs/ai_safety/policies/02_require_approval_agents_high_sensitivity.yaml
@@ -110,6 +111,7 @@ files:
 - lib/vkit/policy/packs/starter/policies/04_require_approval_high_sensitivity.yaml
 - lib/vkit/policy/packs/starter/policies/05_default_ttl.yaml
 - lib/vkit/policy/packs/starter/policies/06_flag_unknown.yaml
+- lib/vkit/policy/packs/starter/policies/07_mask_unknown_for_agents.yaml
 - lib/vkit/policy/policy_validator.rb
 - lib/vkit/policy/schema/policy_bundle.schema.json
 - lib/vkit/policy/tenancy_check.rb