@a5c-ai/babysitter-sdk 6.0.2 → 6.0.3-staging.032e07a1ffa0

package/dist/breakpoints/attestation-attribution.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Milestone C — ATTRIBUTION: correlation metadata on the effect result (AC-14, §6.3).
+ *
+ * Records `{ sessionId, modelId, attestationRequestId }` (and, where present,
+ * `toolCallId` + the attestation `producer` marker) on the effect-result metadata
+ * (serializer `StoredTaskResult.metadata`) so an auditor can correlate a resolved
+ * effect back to the exact model turn — and the exact producer (authoritative proxy
+ * vs. correlation-grade in-process) — that authorized it.
+ *
+ * The proxy attestation sidecar is keyed by request id (AC-14) and indexed by
+ * tool-call id (AC-16); recording those ids here threads the correlation through to
+ * the persisted effect result.
+ */
+/**
+ * The producer that emitted the model-decision attestation this effect correlates
+ * to: the AUTHORITATIVE out-of-agent `'proxy'` variant, or the correlation-grade
+ * in-agent `'in-process'` variant (AC-39). Distinguishing them in the audit record
+ * is load-bearing: only the proxy variant is authoritative.
+ */
+export type AttestationProducer = "proxy" | "in-process";
+export interface AttestationAttribution {
+    /** The session that produced the model turn. */
+    sessionId: string;
+    /** The model id that drove the turn (`endpoint.model`). */
+    modelId: string;
+    /** The proxy sidecar request id keying the attestation (AC-14). */
+    attestationRequestId: string;
+    /** The bound tool-call id, when the effect correlates to a specific call (AC-16). */
+    toolCallId?: string;
+    /** Which producer signed the attestation (AC-39 correlation-grade distinction). */
+    producer?: AttestationProducer;
+}
+/**
+ * The shape recorded on `StoredTaskResult.metadata`. A plain JSON record (no
+ * undefined values) so it survives `stableClone` + serialization + disk round-trip.
+ */
+export interface AttestationAttributionMetadata {
+    sessionId: string;
+    modelId: string;
+    attestationRequestId: string;
+    toolCallId?: string;
+    producer?: AttestationProducer;
+}
+/**
+ * Build the correlation metadata block for an effect result from an attestation
+ * attribution. Only defined fields are included so the persisted metadata stays a
+ * clean JSON record.
+ */
+export declare function buildAttestationAttributionMetadata(attribution: AttestationAttribution): AttestationAttributionMetadata;
+//# sourceMappingURL=attestation-attribution.d.ts.map

package/dist/breakpoints/attestation-attribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation-attribution.d.ts","sourceRoot":"","sources":["../../src/breakpoints/attestation-attribution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,YAAY,CAAC;AAEzD,MAAM,WAAW,sBAAsB;IACrC,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,WAAW,8BAA8B;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAgB,mCAAmC,CACjD,WAAW,EAAE,sBAAsB,GAClC,8BAA8B,CAahC"}

package/dist/breakpoints/attestation-attribution.js

@@ -0,0 +1,35 @@
+"use strict";
+/**
+ * Milestone C — ATTRIBUTION: correlation metadata on the effect result (AC-14, §6.3).
+ *
+ * Records `{ sessionId, modelId, attestationRequestId }` (and, where present,
+ * `toolCallId` + the attestation `producer` marker) on the effect-result metadata
+ * (serializer `StoredTaskResult.metadata`) so an auditor can correlate a resolved
+ * effect back to the exact model turn — and the exact producer (authoritative proxy
+ * vs. correlation-grade in-process) — that authorized it.
+ *
+ * The proxy attestation sidecar is keyed by request id (AC-14) and indexed by
+ * tool-call id (AC-16); recording those ids here threads the correlation through to
+ * the persisted effect result.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAttestationAttributionMetadata = buildAttestationAttributionMetadata;
+/**
+ * Build the correlation metadata block for an effect result from an attestation
+ * attribution. Only defined fields are included so the persisted metadata stays a
+ * clean JSON record.
+ */
+function buildAttestationAttributionMetadata(attribution) {
+    const meta = {
+        sessionId: attribution.sessionId,
+        modelId: attribution.modelId,
+        attestationRequestId: attribution.attestationRequestId,
+    };
+    if (typeof attribution.toolCallId === "string" && attribution.toolCallId.length > 0) {
+        meta.toolCallId = attribution.toolCallId;
+    }
+    if (attribution.producer === "proxy" || attribution.producer === "in-process") {
+        meta.producer = attribution.producer;
+    }
+    return meta;
+}

package/dist/breakpoints/enforce-signed-breakpoint.d.ts

@@ -0,0 +1,31 @@
+export interface SignedBreakpointEnforcementConfig {
+    /** Whether a valid human signature is REQUIRED for this breakpoint answer. */
+    signatureRequired: boolean;
+    /** Directory of trusted public keys, forwarded to proven `verifyAnswer`. */
+    trustedKeysDir?: string;
+    /**
+     * The set of trusted `human` root fingerprints (AC-35), sourced ONLY from the
+     * integrity-protected, manifest-verified trust-roots config (never task.json). When
+     * provided (non-undefined), the answer's raw signature MUST resolve to a fingerprint
+     * in THIS set, else the answer is rejected — so a key an attacker drops into a run-dir
+     * directory is not trusted even if the raw signature otherwise verifies (defect 2).
+     * When `undefined`, no membership check is applied (legacy pure-decision callers /
+     * unit tests that assert only the raw-verify + completeness behavior).
+     */
+    trustedHumanFingerprints?: string[];
+}
+export interface SignedBreakpointEnforcementDecision {
+    /** True iff the answer may be committed (resolve the effect); false → reject. */
+    accepted: boolean;
+    /** Human-readable reason (always set when rejected; fail-closed diagnostics). */
+    reason?: string;
+    /** The resolved human fingerprint, on a verified accept (for attribution). */
+    publicKeyFingerprint?: string;
+}
+/**
+ * Decide whether a breakpoint answer may be committed under the signed-breakpoint
+ * enforcement policy. Fail-closed for every adversarial / error case when a signature
+ * is required.
+ */
+export declare function enforceSignedBreakpointAnswer(answer: Record<string, unknown>, config: SignedBreakpointEnforcementConfig): Promise<SignedBreakpointEnforcementDecision>;
+//# sourceMappingURL=enforce-signed-breakpoint.d.ts.map

package/dist/breakpoints/enforce-signed-breakpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforce-signed-breakpoint.d.ts","sourceRoot":"","sources":["../../src/breakpoints/enforce-signed-breakpoint.ts"],"names":[],"mappings":"AAmCA,MAAM,WAAW,iCAAiC;IAChD,8EAA8E;IAC9E,iBAAiB,EAAE,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;OAQG;IACH,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,mCAAmC;IAClD,iFAAiF;IACjF,QAAQ,EAAE,OAAO,CAAC;IAClB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAkBD;;;;GAIG;AACH,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,iCAAiC,GACxC,OAAO,CAAC,mCAAmC,CAAC,CAqE9C"}

package/dist/breakpoints/enforce-signed-breakpoint.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enforceSignedBreakpointAnswer = enforceSignedBreakpointAnswer;
+/**
+ * Milestone C — ENFORCED signed human breakpoints (SDK).
+ *
+ * The enforcement DECISION for a breakpoint answer when the policy requires a
+ * signature. Wired into the task_post / commitEffectResult path (see
+ * `runtime/commitEffectResult.ts`) so that:
+ *   - when a signature is REQUIRED, an UNSIGNED / invalid / wrong-key / tampered /
+ *     unsigned-`approved` answer is REJECTED fail-closed (the commit is refused, the
+ *     effect stays PENDING, no EFFECT_RESOLVED is emitted); a validly-signed answer is
+ *     ACCEPTED (AC-28, AC-4, §5 step 7, AC-48);
+ *   - when a signature is NOT required (the pre-Milestone-C default), an unsigned
+ *     answer is UNAFFECTED — existing runs do not break (back-compat).
+ *
+ * This is a PURE decision function (no filesystem / run wiring) so it is unit-testable;
+ * it reuses the shipped `proven-verification.ts` (which does the optional dynamic import
+ * of `@a5c-ai/tasks-adapter/proven` and the raw signature check).
+ *
+ * OVERRIDING RULE: fail closed. When a signature is required, ANY error during
+ * verification — verifier throws, the proven module is not installed, an exception in
+ * the completeness check — is a REJECTION, never a silent accept. No fallbacks.
+ */
+const proven_verification_1 = require("./proven-verification");
+/**
+ * The security-critical fields that MUST be inside the human-signed set for an
+ * `approved` bit to be honored as a human approval (AC-48 / AC-2 completeness rule
+ * applied to the legacy proven answer). An answer whose `signedFields` omits any of
+ * these — or names one that is absent from the answer — is treated as UNSIGNED for
+ * that field and rejected, even if the raw signature otherwise verifies.
+ */
+const REQUIRED_SIGNED_FIELDS = ["breakpointId", "approved", "responderId"];
+/**
+ * AC-48 completeness: every REQUIRED_SIGNED_FIELDS entry must appear in the answer's
+ * `signedFields` AND be present on the answer object. Returns a deny-reason string, or
+ * null when the answer's signed set is complete.
+ */
+function completenessDenyReason(answer) {
+    const signedFields = answer.signedFields;
+    if (!Array.isArray(signedFields))
+        return "signedFields is not an array";
+    const signed = new Set(signedFields.map((f) => String(f)));
+    for (const field of REQUIRED_SIGNED_FIELDS) {
+        if (!signed.has(field))
+            return `required field not signed: ${field}`;
+        if (!(field in answer))
+            return `signed field absent from answer: ${field}`;
+    }
+    return null;
+}
+/**
+ * Decide whether a breakpoint answer may be committed under the signed-breakpoint
+ * enforcement policy. Fail-closed for every adversarial / error case when a signature
+ * is required.
+ */
+async function enforceSignedBreakpointAnswer(answer, config) {
+    // Back-compat: no signature required → the answer is unaffected (accept).
+    if (!config || config.signatureRequired !== true) {
+        return { accepted: true };
+    }
+    try {
+        // An unsigned answer (missing signature fields) can NEVER satisfy a signature
+        // requirement — reject before touching the verifier (AC-28 spoofed approval).
+        if (!(0, proven_verification_1.hasSignatureFields)(answer)) {
+            return { accepted: false, reason: "signature required but answer is unsigned" };
+        }
+        // AC-48: the `approved`/identity/target fields MUST be inside the signed set, else
+        // the `approved` bit is unsigned and must not be honored — reject.
+        const completenessDeny = completenessDenyReason(answer);
+        if (completenessDeny) {
+            return { accepted: false, reason: `signed set incomplete: ${completenessDeny}` };
+        }
+        // Raw signature verification via the proven subsystem (optional dynamic import).
+        // Any thrown exception / module-not-found is caught below → reject (fail closed).
+        const verification = await (0, proven_verification_1.verifyBreakpointResult)(answer, {
+            enabled: true,
+            trustedKeysDir: config.trustedKeysDir,
+        });
+        if (!verification.verified) {
+            return {
+                accepted: false,
+                reason: verification.reason ?? "signature verification failed",
+            };
+        }
+        // AC-35 (defect 2): WHICH keys are trusted must come from the integrity-protected
+        // trust-roots config, NOT from wherever proven happened to resolve a key. Even
+        // though the raw signature verified, require the resolving fingerprint to be a
+        // trusted `human` root — so a self-signed answer using a key the attacker dropped
+        // into a run-dir directory is rejected.
+        if (config.trustedHumanFingerprints !== undefined) {
+            const resolvedFp = verification.verificationResult?.publicKeyFingerprint;
+            if (typeof resolvedFp !== "string" || resolvedFp.length === 0) {
+                return { accepted: false, reason: "signer fingerprint could not be resolved" };
+            }
+            if (!config.trustedHumanFingerprints.includes(resolvedFp)) {
+                return {
+                    accepted: false,
+                    reason: `signer ${resolvedFp} is not a trusted human root`,
+                };
+            }
+        }
+        // The signature verified AND the security-critical fields were signed; only honor
+        // an actual approval (a signed rejection never yields an accepted approval).
+        if (answer.approved !== true) {
+            return { accepted: false, reason: "answer is not an approval (approved !== true)" };
+        }
+        return {
+            accepted: true,
+            publicKeyFingerprint: verification.verificationResult?.publicKeyFingerprint,
+        };
+    }
+    catch (err) {
+        // Fail closed: never a pass-through on error.
+        return {
+            accepted: false,
+            reason: `enforcement error: ${err?.message ?? String(err)}`,
+        };
+    }
+}

package/dist/breakpoints/trusted-breakpoint-policy.d.ts

@@ -0,0 +1,38 @@
+export interface TrustedBreakpointPolicy {
+    /**
+     * True when a config anchor is pinned (enforcement is a live requirement for this
+     * deployment). When false, enforcement is inactive (back-compat) and the caller
+     * leaves unsigned breakpoint answers unaffected.
+     */
+    enforcementActive: boolean;
+    /**
+     * Set ONLY when `enforcementActive` is true and the trust anchor could NOT be
+     * established (missing/edited/corrupt/untrusted config). The caller MUST treat every
+     * breakpoint that the (trusted, when readable) policy marks as requiring a signature
+     * as a REJECT — the requirement cannot be trustworthily determined ⇒ deny.
+     */
+    configError?: string;
+    /**
+     * Decide whether the given breakpoint requires a signature. When the trusted policy is
+     * unreadable this is a FAIL-CLOSED default (returns true) so a config error denies.
+     */
+    requiresSignature(breakpointId: string | undefined): boolean;
+    /** The trusted `human` root fingerprints from the manifest-verified trust-roots (AC-35). */
+    trustedHumanFingerprints: string[];
+    /**
+     * The trust-anchored base dir handed to proven `verifyAnswer` for raw-signature
+     * checking. This is the manifest-verified `.policy` dir's key store — NOT any
+     * task.json-supplied directory (defect 2). The gate ALSO checks the resolved
+     * fingerprint is in `trustedHumanFingerprints`, so a raw verify against a stray key
+     * is still rejected.
+     */
+    trustedKeysBaseDir?: string;
+}
+/**
+ * Load + verify the trust-anchored breakpoint policy for a run/project.
+ *
+ * `projectRoot` is the anchor for the default `.policy` location (typically the run's
+ * project root, resolvable from the run dir). It is NOT the per-effect task dir.
+ */
+export declare function loadTrustedBreakpointPolicy(projectRoot: string): Promise<TrustedBreakpointPolicy>;
+//# sourceMappingURL=trusted-breakpoint-policy.d.ts.map

package/dist/breakpoints/trusted-breakpoint-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-breakpoint-policy.d.ts","sourceRoot":"","sources":["../../src/breakpoints/trusted-breakpoint-policy.ts"],"names":[],"mappings":"AA8FA,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;IAC7D,4FAA4F;IAC5F,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AA+BD;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,uBAAuB,CAAC,CA+HlC"}

package/dist/breakpoints/trusted-breakpoint-policy.js

@@ -0,0 +1,264 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadTrustedBreakpointPolicy = loadTrustedBreakpointPolicy;
+/**
+ * Milestone C (AC-7 / AC-28 / AC-35 / AC-36 / AC-37 / AC-46 / AC-47 / AC-48) —
+ * the TRUST-ANCHORED source of the signed-breakpoint requirement + trusted human roots.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * WHY THIS EXISTS (the two closed defects).
+ *
+ * The prior wiring sourced BOTH the `signatureRequired` flag AND the `trustedKeysDir`
+ * from the per-effect `tasks/<effectId>/task.json` — a file the (in-scope, §11 AC-33)
+ * workspace-writable agent can freely DELETE, CORRUPT, or rewrite. That gave the
+ * adversary two trivial escapes:
+ *   (defect 1) delete/corrupt task.json so the gate could not read `signatureRequired`
+ *     and FAILED OPEN — an unsigned `{approved:true}` then committed; and
+ *   (defect 2) point `trustedKeysDir` at a directory holding the AGENT's own public
+ *     key, so a self-signed "human approval" verified.
+ *
+ * This module makes BOTH un-attacker-controllable by sourcing them ONLY from the
+ * out-of-agent, integrity-protected trust anchor the design §10 defines:
+ *
+ *   pinned config root FP + pinned min-epoch floor (OFF the workspace — env/deploy)
+ *     → `.policy/config-manifest.json` (one signed `SignedEnvelope<ConfigManifestPayload>`,
+ *        AC-36/AC-46, verified by `verifyConfigManifest` against the pinned root)
+ *        → covers `.policy/trust-roots.json` (the trusted `human` roots, AC-35) and
+ *          `.policy/breakpoint-policy.json` (which breakpoints require a signature).
+ *
+ * A config file whose sha256 is not the one bound in the current-epoch signed manifest,
+ * or a manifest signed by anything other than the pinned config root, or an epoch below
+ * the pinned floor, is REJECTED (deny-all) — so editing any of these files on the
+ * workspace cannot forge a lower requirement or inject a trusted key. The trust source
+ * is therefore the signed manifest, NEVER the mutable per-effect task.json.
+ *
+ * FAIL CLOSED. When the pinned config anchor is present (a policy-enforced deployment),
+ * ANY failure to establish trust — missing/edited/corrupt manifest or config file, wrong
+ * signer, below-floor epoch, unreadable trust-roots — is surfaced as
+ * `{ enforcementActive: true, configError: ... }`, and the caller MUST reject the post
+ * for any breakpoint the trusted policy marks as requiring a signature (the requirement
+ * cannot be trustworthily determined ⇒ deny). It is NEVER silently skipped.
+ *
+ * BACK-COMPAT. When NO config anchor is pinned (`POLICY_CONFIG_ROOT_FP` unset — the
+ * pre-Milestone-C default deployment), enforcement is inactive and unsigned breakpoint
+ * answers are unaffected, exactly as before. Opting in is a deploy operation (pinning the
+ * off-workspace root + floor), which an in-workspace agent cannot do.
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+// ── Config anchor pins (OFF the workspace: env / deploy image, AC-37/AC-47) ──────
+const CONFIG_ROOT_FP_ENV = "POLICY_CONFIG_ROOT_FP";
+const CONFIG_MIN_EPOCH_ENV = "POLICY_CONFIG_MIN_EPOCH";
+/** The config-root PUBLIC key material (PEM/DER-base64), or a path to it. Pinned off-workspace. */
+const CONFIG_ROOT_KEY_ENV = "POLICY_CONFIG_ROOT_KEY";
+const CONFIG_ROOT_KEY_PATH_ENV = "POLICY_CONFIG_ROOT_KEY_PATH";
+/** The `.policy` config directory. Off-workspace by default; env override for tests/deploys. */
+const CONFIG_DIR_ENV = "POLICY_CONFIG_DIR";
+const MANIFEST_FILE = "config-manifest.json";
+const TRUST_ROOTS_FILE = "trust-roots.json";
+const BREAKPOINT_POLICY_FILE = "breakpoint-policy.json";
+function readEnv(name) {
+    const v = process.env[name];
+    return typeof v === "string" && v.length > 0 ? v : undefined;
+}
+/** Resolve the `.policy` config dir: explicit env pin, else `<projectRoot>/.policy`. */
+function resolveConfigDir(projectRoot) {
+    return readEnv(CONFIG_DIR_ENV) ?? node_path_1.default.join(projectRoot, ".policy");
+}
+async function readFileOrUndefined(file) {
+    try {
+        return await node_fs_1.promises.readFile(file, "utf8");
+    }
+    catch (err) {
+        const e = err;
+        if (e.code === "ENOENT")
+            return undefined;
+        throw err;
+    }
+}
+/**
+ * Load + verify the trust-anchored breakpoint policy for a run/project.
+ *
+ * `projectRoot` is the anchor for the default `.policy` location (typically the run's
+ * project root, resolvable from the run dir). It is NOT the per-effect task dir.
+ */
+async function loadTrustedBreakpointPolicy(projectRoot) {
+    const pinnedConfigRootFp = readEnv(CONFIG_ROOT_FP_ENV);
+    // No off-workspace anchor pinned → enforcement inactive (pre-Milestone-C default).
+    if (!pinnedConfigRootFp) {
+        return {
+            enforcementActive: false,
+            requiresSignature: () => false,
+            trustedHumanFingerprints: [],
+        };
+    }
+    // Anchor IS pinned: any failure below is a fail-closed config error (deny), never skip.
+    const denied = (reason) => ({
+        enforcementActive: true,
+        configError: reason,
+        // Fail closed: with no trusted policy readable, treat every breakpoint as requiring
+        // a signature so the caller denies (a config error must never let an unsigned answer
+        // through).
+        requiresSignature: () => true,
+        trustedHumanFingerprints: [],
+    });
+    try {
+        const minEpoch = Number(readEnv(CONFIG_MIN_EPOCH_ENV) ?? "1");
+        if (!Number.isFinite(minEpoch))
+            return denied("POLICY_CONFIG_MIN_EPOCH is not a number");
+        // Resolve the config-root PUBLIC key material from the off-workspace pin.
+        let configRootKey = readEnv(CONFIG_ROOT_KEY_ENV);
+        if (!configRootKey) {
+            const keyPath = readEnv(CONFIG_ROOT_KEY_PATH_ENV);
+            if (keyPath)
+                configRootKey = await readFileOrUndefined(keyPath);
+        }
+        if (!configRootKey)
+            return denied("config-root key material is not pinned");
+        const configDir = resolveConfigDir(projectRoot);
+        const manifestRaw = await readFileOrUndefined(node_path_1.default.join(configDir, MANIFEST_FILE));
+        if (manifestRaw === undefined)
+            return denied(`missing ${MANIFEST_FILE}`);
+        let manifest;
+        try {
+            manifest = JSON.parse(manifestRaw);
+        }
+        catch {
+            return denied(`corrupt ${MANIFEST_FILE}`);
+        }
+        // Read every config file the manifest could cover; the verifier requires each
+        // on-disk file to be listed in the manifest with a matching hash (AC-36 step 3).
+        const files = {};
+        for (const name of [TRUST_ROOTS_FILE, BREAKPOINT_POLICY_FILE]) {
+            const bytes = await readFileOrUndefined(node_path_1.default.join(configDir, name));
+            if (bytes !== undefined)
+                files[name] = bytes;
+        }
+        if (files[TRUST_ROOTS_FILE] === undefined)
+            return denied(`missing ${TRUST_ROOTS_FILE}`);
+        // Dynamically import the ESM policy-adapter (same pattern as proven-verification.ts).
+        let adapter;
+        try {
+            const mod = "@a5c-ai/policy-adapter";
+            adapter = (await Promise.resolve(`${mod}`).then(s => __importStar(require(s))));
+        }
+        catch (err) {
+            // The trust core is REQUIRED to establish the anchor; if it cannot load, deny.
+            return denied(`policy-adapter unavailable: ${err?.message ?? String(err)}`);
+        }
+        if (typeof adapter.verifyConfigManifest !== "function") {
+            return denied("policy-adapter.verifyConfigManifest missing");
+        }
+        const configRoot = {
+            fingerprint: pinnedConfigRootFp,
+            kind: "config",
+            publicKey: configRootKey,
+            label: "pinned-config-root",
+        };
+        const verification = adapter.verifyConfigManifest(manifest, {
+            pinnedConfigRootFp,
+            configRoot,
+            minEpoch,
+            files,
+        });
+        if (!verification.valid) {
+            return denied(`config manifest not trusted: ${verification.reason ?? "invalid"}`);
+        }
+        // The manifest verified: trust-roots.json + breakpoint-policy.json are now
+        // integrity-anchored. Parse the trusted human roots (AC-35).
+        let trustRootsDoc;
+        try {
+            trustRootsDoc = JSON.parse(files[TRUST_ROOTS_FILE]);
+        }
+        catch {
+            return denied(`corrupt ${TRUST_ROOTS_FILE}`);
+        }
+        const trustedHumanFingerprints = extractHumanFingerprints(trustRootsDoc);
+        // Parse the (now-trusted) breakpoint policy. Absent → default: every breakpoint
+        // requires a signature (fail-closed default when the anchor is active).
+        let policyDoc = { requireSignatureForAllBreakpoints: true };
+        if (files[BREAKPOINT_POLICY_FILE] !== undefined) {
+            try {
+                policyDoc = JSON.parse(files[BREAKPOINT_POLICY_FILE]);
+            }
+            catch {
+                return denied(`corrupt ${BREAKPOINT_POLICY_FILE}`);
+            }
+        }
+        const requiresSignature = (breakpointId) => {
+            const signed = new Set(policyDoc.signedBreakpointIds ?? []);
+            const exempt = new Set(policyDoc.exemptBreakpointIds ?? []);
+            if (policyDoc.requireSignatureForAllBreakpoints === true) {
+                return breakpointId === undefined ? true : !exempt.has(breakpointId);
+            }
+            return breakpointId !== undefined && signed.has(breakpointId);
+        };
+        return {
+            enforcementActive: true,
+            requiresSignature,
+            trustedHumanFingerprints,
+            // proven verifyAnswer resolves trusted keys from `<baseDir>/.keys/trusted`; anchor
+            // it at the manifest-verified config dir so the key store is trust-anchored, not
+            // task.json-supplied. The gate ALSO checks the resolved fingerprint membership.
+            trustedKeysBaseDir: configDir,
+        };
+    }
+    catch (err) {
+        return denied(`enforcement config error: ${err?.message ?? String(err)}`);
+    }
+}
+/** Extract the fingerprints of every non-revoked `human` trust root. */
+function extractHumanFingerprints(doc) {
+    const roots = extractTrustRoots(doc);
+    return roots
+        .filter((r) => r.kind === "human" && r.revoked !== true && typeof r.fingerprint === "string")
+        .map((r) => r.fingerprint);
+}
+function extractTrustRoots(doc) {
+    if (Array.isArray(doc))
+        return doc;
+    if (doc && typeof doc === "object") {
+        const d = doc;
+        if (Array.isArray(d.trustRoots))
+            return d.trustRoots;
+        if (Array.isArray(d.roots))
+            return d.roots;
+    }
+    return [];
+}

package/dist/runtime/commitEffectResult.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commitEffectResult.d.ts","sourceRoot":"","sources":["../../src/runtime/commitEffectResult.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EAG1B,MAAM,SAAS,CAAC;AAYjB,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAsGjH;AAED,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,SAAS,EAAE,aAAa,CAAC;CAC1C;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAqDhC"}
+{"version":3,"file":"commitEffectResult.d.ts","sourceRoot":"","sources":["../../src/runtime/commitEffectResult.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EAG1B,MAAM,SAAS,CAAC;AAcjB,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAuGjH;AAED,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,SAAS,EAAE,aAAa,CAAC;CAC1C;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAqDhC"}

package/dist/runtime/commitEffectResult.js

@@ -19,6 +19,8 @@ const stateCache_1 = require("./replay/stateCache");
 const workDirLeak_1 = require("./workDirLeak");
 const runtime_1 = require("./hooks/runtime");
 const schemaValidator_1 = require("./schemaValidator");
+const enforce_signed_breakpoint_1 = require("../breakpoints/enforce-signed-breakpoint");
+const trusted_breakpoint_policy_1 = require("../breakpoints/trusted-breakpoint-policy");
 async function commitEffectResult(options) {
     return await (0, lock_1.withRunLock)(options.runDir, "runtime:commitEffectResult", async () => {
         guardResultPayload(options);
@@ -34,6 +36,7 @@ async function commitEffectResult(options) {
         }
         ensureInvocationKeyMatches(options, record);
         await validateTaskResultOutputSchema(options, record);
+        await enforceSignedBreakpointGate(options, record);
         const resultPayload = buildResultPayload(options);
         const taskCompletedHookResult = await (0, runtime_1.callRuntimeHook)("task.completed", {
             runId: node_path_1.default.basename(options.runDir),
@@ -157,6 +160,133 @@ async function commitEffectCancellation(options) {
         return { resultRef };
     });
 }
+/**
+ * Milestone C (AC-4 / AC-7 / AC-28 / AC-35 / AC-36 / AC-48) — enforced signed human
+ * breakpoints, anchored to the INTEGRITY-PROTECTED trust config (never task.json).
+ *
+ * TRUST SOURCE. The signature REQUIREMENT and the set of trusted `human` keys are
+ * sourced ONLY from the out-of-agent trust anchor the design §10 defines — the pinned
+ * config root (`POLICY_CONFIG_ROOT_FP`, off-workspace) → the signed
+ * `.policy/config-manifest.json` (monotonic-epoch, AC-46) → `.policy/trust-roots.json`
+ * + `.policy/breakpoint-policy.json` — via `loadTrustedBreakpointPolicy`
+ * (breakpoints/trusted-breakpoint-policy.ts). The per-effect `tasks/<id>/task.json` —
+ * which the workspace-writable agent can delete/corrupt/rewrite — is NEVER the source
+ * of the requirement or the trusted keys. The breakpoint IDENTITY is taken from the
+ * append-only JOURNAL (the effect's `invocationKey`, recorded at breakpoint-creation),
+ * not task.json.
+ *
+ * FAIL CLOSED (defect 1). When the config anchor is pinned but cannot be trustworthily
+ * established (missing/edited/corrupt/untrusted manifest or config, below-floor epoch),
+ * a breakpoint the trusted policy marks as requiring a signature is REJECTED — never
+ * skipped. When NO anchor is pinned (pre-Milestone-C default), enforcement is inactive
+ * and unsigned answers are unaffected (back-compat).
+ *
+ * DEFECT 2. The trusted human root set is passed to the enforcement decision, which
+ * additionally requires the raw-verified signer fingerprint to be a member — so a key
+ * the attacker drops into a run-dir directory is not trusted even if proven's raw
+ * verify succeeds.
+ *
+ * This runs BEFORE the result is written / EFFECT_RESOLVED is emitted, so a rejected
+ * answer leaves the effect PENDING. Non-breakpoint effects / non-`ok` statuses are
+ * unaffected.
+ */
+async function enforceSignedBreakpointGate(options, record) {
+    if (record.kind !== "breakpoint" && record.taskId !== "__sdk.breakpoint")
+        return;
+    if (options.result.status !== "ok")
+        return;
+    // Load the trust-anchored policy. projectRoot is the base for the default `.policy`
+    // location; the real off-workspace pin is POLICY_CONFIG_DIR / the env pins. This is
+    // NOT the per-effect task dir.
+    const policy = await (0, trusted_breakpoint_policy_1.loadTrustedBreakpointPolicy)(process.cwd());
+    // No anchor pinned → enforcement inactive → back-compat pass-through.
+    if (!policy.enforcementActive)
+        return;
+    // The breakpoint id comes from the append-only journal (the effect's invocationKey),
+    // NOT task.json — so the adversary cannot erase the requirement by editing task.json.
+    const breakpointId = deriveBreakpointIdFromRecord(record);
+    const requiresSignature = policy.requiresSignature(breakpointId);
+    if (!requiresSignature)
+        return;
+    // A signature IS required for this breakpoint. If the trust anchor could not be
+    // established, we fail CLOSED (deny) — the requirement cannot be trustworthily
+    // determined, so the post is rejected and the effect stays pending.
+    if (policy.configError) {
+        logCommitFailure(options, "signed_breakpoint_rejected", {
+            taskId: record.taskId,
+            kind: record.kind,
+            reason: `trusted config unavailable: ${policy.configError}`,
+        });
+        throw new exceptions_1.RunFailedError(`Signed-breakpoint enforcement could not establish trust for effect ${options.effectId}: ${policy.configError}`, {
+            details: {
+                reason: "signed_breakpoint_rejected",
+                effectId: options.effectId,
+                taskId: record.taskId,
+                kind: record.kind,
+            },
+        });
+    }
+    // Extract the answer object from the committed value and enforce, anchoring WHICH
+    // keys are trusted to the manifest-verified trust-roots (defect 2).
+    const answer = extractBreakpointAnswer(options.result.value);
+    const decision = await (0, enforce_signed_breakpoint_1.enforceSignedBreakpointAnswer)(answer, {
+        signatureRequired: true,
+        trustedKeysDir: policy.trustedKeysBaseDir,
+        trustedHumanFingerprints: policy.trustedHumanFingerprints,
+    });
+    if (!decision.accepted) {
+        logCommitFailure(options, "signed_breakpoint_rejected", {
+            taskId: record.taskId,
+            kind: record.kind,
+            reason: decision.reason,
+        });
+        throw new exceptions_1.RunFailedError(`Signed-breakpoint enforcement rejected the answer for effect ${options.effectId}: ${decision.reason ?? "unsigned or invalid"}`, {
+            details: {
+                reason: "signed_breakpoint_rejected",
+                effectId: options.effectId,
+                taskId: record.taskId,
+                kind: record.kind,
+            },
+        });
+    }
+}
+/**
+ * Derive the breakpointId from the effect's JOURNAL-recorded invocation key (never
+ * task.json). Breakpoint effects use `__sdk.breakpoint.<breakpointId>` (with an optional
+ * `.<n>` occurrence suffix for repeated breakpoints, see intrinsics/breakpoint.ts).
+ * Returns undefined when the shape does not match — the trusted policy then applies its
+ * fail-closed default (an unidentifiable breakpoint under an active anchor requires a
+ * signature).
+ */
+function deriveBreakpointIdFromRecord(record) {
+    const key = record.invocationKey;
+    const prefix = "__sdk.breakpoint.";
+    if (typeof key !== "string" || !key.startsWith(prefix))
+        return undefined;
+    let rest = key.slice(prefix.length);
+    // Strip a trailing numeric occurrence suffix (".1", ".2", …) added for repeats.
+    const suffixMatch = rest.match(/\.(\d+)$/);
+    if (suffixMatch)
+        rest = rest.slice(0, rest.length - suffixMatch[0].length);
+    return rest.length > 0 ? rest : undefined;
+}
+/**
+ * Extract the breakpoint answer record from a committed effect value. The value may
+ * BE the answer, or wrap it under `answer` / `result`.
+ */
+function extractBreakpointAnswer(value) {
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+        const v = value;
+        if (v.answer && typeof v.answer === "object" && !Array.isArray(v.answer)) {
+            return v.answer;
+        }
+        if (v.result && typeof v.result === "object" && !Array.isArray(v.result) && ("approved" in v.result || "signature" in v.result)) {
+            return v.result;
+        }
+        return v;
+    }
+    return {};
+}
 async function validateTaskResultOutputSchema(options, record) {
     if (record.kind !== "shell" || options.result.status !== "ok") {
         return;

package/dist/session/parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/session/parse.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAGzD;;GAEG;AACH,eAAO,MAAM,qBAAqB,EAAE,YASnC,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAuC3G;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,YAAY,CAgDnF;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA4B5E;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO1E;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAgB9D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE9E"}
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/session/parse.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAGzD;;GAEG;AACH,eAAO,MAAM,qBAAqB,EAAE,YASnC,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAuC3G;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,YAAY,CAgDnF;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA4B5E;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO1E;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAgB9D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE9E"}

package/dist/session/parse.js

@@ -3,6 +3,9 @@
  * Session state file parsing utilities.
  * Parses markdown files with YAML frontmatter for session state.
  */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_SESSION_STATE = void 0;
 exports.parseYamlFrontmatter = parseYamlFrontmatter;
@@ -12,6 +15,7 @@ exports.sessionFileExists = sessionFileExists;
 exports.validateSessionState = validateSessionState;
 exports.getSessionFilePath = getSessionFilePath;
 const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
 const types_1 = require("./types");
 /**
  * Default session state values.
@@ -172,5 +176,5 @@ function validateSessionState(state) {
  * Get the state file path for a session.
  */
 function getSessionFilePath(stateDir, sessionId) {
-    return `${stateDir}/${sessionId}.md`;
+    return node_path_1.default.join(stateDir, `${sessionId}.md`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@a5c-ai/babysitter-sdk",
-  "version": "6.0.2",
+  "version": "6.0.3-staging.032e07a1ffa0",
   "description": "Storage and run-registry primitives for event-sourced babysitter workflows.",
   "license": "MIT",
   "type": "commonjs",
@@ -42,9 +42,9 @@
     "verify:package-health": "node scripts/verify-package-health.cjs"
   },
   "dependencies": {
-    "@a5c-ai/atlas": "6.0.2",
-    "@a5c-ai/adapters": "6.0.2",
-    "@a5c-ai/hooks-adapter-cli": "6.0.2",
+    "@a5c-ai/atlas": "6.0.3-staging.032e07a1ffa0",
+    "@a5c-ai/adapters": "6.0.3-staging.032e07a1ffa0",
+    "@a5c-ai/hooks-adapter-cli": "6.0.3-staging.032e07a1ffa0",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "@sinclair/typebox": "^0.34.48",
     "fs-extra": "^11.2.0",
@@ -57,7 +57,7 @@
     "puppeteer": "^24.0.0"
   },
   "peerDependencies": {
-    "@a5c-ai/tasks-adapter": "6.0.2"
+    "@a5c-ai/tasks-adapter": "6.0.3-staging.032e07a1ffa0"
   },
   "peerDependenciesMeta": {
     "@a5c-ai/tasks-adapter": {
@@ -65,7 +65,7 @@
     }
   },
   "devDependencies": {
-    "@a5c-ai/tasks-adapter": "6.0.2",
+    "@a5c-ai/tasks-adapter": "6.0.3-staging.032e07a1ffa0",
     "@eslint/js": "^9.39.4",
     "@types/fs-extra": "^11.0.4",
     "@types/node": "^20.11.30",