@a5c-ai/comm-adapter 6.0.2 → 6.0.3-staging.032e07a1ffa0

package/dist/policy-credential-gate.js

@@ -0,0 +1,141 @@
+/**
+ * Milestone D — GATE 3: credential-injection backstop (§9.3 / AC-23a / AC-40 /
+ * AC-40a / AC-50 / AC-55).
+ *
+ * Before env / credential injection, GATE 3 verifies a credential attestation: a
+ * policy-bound (scoped) credential is delivered ONLY when a valid
+ * CommandAuthorization covers its scope. It mediates every credential-delivery
+ * channel `spawn-invocation.ts` constructs:
+ *   - env injection: docker `-e`, ssh `K=V`, k8s `env` / `--env`  (`*-env`);
+ *   - docker `-v` file mounts                                     (`docker-mount`);
+ *   - k8s secret / serviceaccount references                     (`k8s-secret`,
+ *                                                                  `k8s-serviceaccount`).
+ * With NO valid authorization the channel is OMITTED (env dropped, mount omitted,
+ * secret/serviceaccount ref stripped); if the policy marks the credential REQUIRED,
+ * the spawn is DENIED.
+ *
+ * The credential→scope tag comes from a TRUSTED, out-of-agent source (AC-40) keyed
+ * by a COLLISION-RESISTANT identity (AC-40a); aliases of one physical credential
+ * canonicalize to one identity (AC-55). An absent / ambiguous identity, or no
+ * mediated scope, → deny (fail closed) — never inject an untagged credential, never
+ * pick the narrower of two candidate scopes.
+ *
+ * GATE 3 is the LAST point before exec, so it RECOMPUTES argsHash / commandHash from
+ * the exact spawn (TOCTOU, AC-32) and re-checks them against the authorization.
+ *
+ * BOUNDED, WARNED NON-GOAL (AC-50): credentials the process obtains WITHOUT
+ * spawn-invocation constructing the delivery — IMDS / IRSA / workload-identity,
+ * pre-existing mounts, image creds — cannot be gated. For a scoped credential with
+ * no GATE-3-mediated scope, the gate fails closed (does not inject) and surfaces a
+ * warning; it does NOT claim a backstop for such an action.
+ *
+ * OVERRIDING RULE: fail closed. Any verification / parse / resolution error, or any
+ * thrown exception, is a deny / no-injection. No fallbacks.
+ */
+import { verifyCommandAuthorization, resolveCredentialScope, argsHash as computeArgsHash, commandHash as computeCommandHash, } from '@a5c-ai/policy-adapter';
+/**
+ * Gate credential injection at the last point before exec (AC-23a). Returns the
+ * credentials that may be delivered, those dropped, whether the spawn is denied, and
+ * any bounded-non-goal warnings.
+ */
+export function gateCredentialInjection(input) {
+    const injected = [];
+    const dropped = [];
+    const warnings = [];
+    try {
+        if (!input || typeof input !== 'object') {
+            return { denied: true, injected, dropped, warnings, reason: 'missing gate input' };
+        }
+        if (!Array.isArray(input.credentials)) {
+            return { denied: true, injected, dropped, warnings, reason: 'missing credentials' };
+        }
+        if (!input.credentialSource || typeof input.credentialSource !== 'object') {
+            // No trusted source → cannot tag ANY scoped credential → drop all, fail closed.
+            for (const cred of input.credentials)
+                dropped.push(cred);
+            return {
+                denied: input.credentials.some((c) => c?.required === true),
+                injected,
+                dropped,
+                warnings,
+                reason: 'missing trusted credential scope source',
+            };
+        }
+        // Recompute the authorization binding hashes from the EXACT spawn (TOCTOU, AC-32).
+        const argsHash = computeArgsHash(input.args);
+        const commandHash = computeCommandHash(input.command ?? '');
+        // Resolve + verify the authorization ONCE per spawn against the recomputed binding.
+        const authorization = input.resolveAuthorization?.();
+        let denied = false;
+        const denyReasons = [];
+        for (const cred of input.credentials) {
+            // (AC-40 / AC-40a / AC-55) Resolve the credential's scope from the trusted source
+            // keyed by the collision-resistant canonical identity of its alias. An absent /
+            // ambiguous alias, or an identity with no mediated scope → no scope.
+            const scopeResolution = resolveCredentialScope(cred.alias, input.credentialSource);
+            if (!scopeResolution.resolved || typeof scopeResolution.scope !== 'string') {
+                // No GATE-3-mediated scope for a scoped credential: fail closed (do NOT inject
+                // an untagged credential, AC-40) and surface the bounded-non-goal warning (AC-50)
+                // — the credential may be substrate-delivered (IMDS/IRSA/pre-mount), which GATE 3
+                // cannot mediate.
+                dropped.push(cred);
+                warnings.push(`credential '${cred.name}' (alias '${cred.alias}') has no GATE-3-mediated scope: ` +
+                    `${scopeResolution.reason ?? 'unresolved'} — not injected (bounded non-goal, AC-50)`);
+                if (cred.required === true) {
+                    denied = true;
+                    denyReasons.push(`required credential '${cred.name}' has no mediated scope`);
+                }
+                continue;
+            }
+            const scope = scopeResolution.scope;
+            // A valid CommandAuthorization whose credentialScope matches is REQUIRED before
+            // the credential may be delivered by its channel (AC-23a).
+            let authorized = false;
+            if (authorization) {
+                const verification = verifyCommandAuthorization(authorization, {
+                    now: input.now,
+                    toolName: input.toolName,
+                    toolCallId: input.toolCallId,
+                    commandHash,
+                    argsHash,
+                    credentialScope: scope,
+                    policyDocHash: input.policyDocHash,
+                    currentConfigEpoch: input.currentConfigEpoch,
+                    minEpochFloor: input.minEpochFloor,
+                    issuerRoots: input.issuerRoots,
+                });
+                authorized = verification.valid;
+            }
+            if (authorized) {
+                injected.push(cred);
+            }
+            else {
+                // No valid authorization → the channel is OMITTED (env dropped, -v mount
+                // omitted, secret/serviceaccount ref stripped). If required, deny the spawn.
+                dropped.push(cred);
+                if (cred.required === true) {
+                    denied = true;
+                    denyReasons.push(`required credential '${cred.name}' lacks a valid authorization for scope '${scope}'`);
+                }
+            }
+        }
+        return {
+            denied,
+            injected,
+            dropped,
+            warnings,
+            reason: denyReasons.length > 0 ? denyReasons.join('; ') : undefined,
+        };
+    }
+    catch (err) {
+        // Fail closed — any exception is a deny / no-injection, never a pass.
+        return {
+            denied: true,
+            injected: [],
+            dropped: [...injected, ...dropped],
+            warnings,
+            reason: `exception during GATE 3 evaluation: ${err?.message ?? String(err)}`,
+        };
+    }
+}
+//# sourceMappingURL=policy-credential-gate.js.map

package/dist/policy-credential-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-credential-gate.js","sourceRoot":"","sources":["../src/policy-credential-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,QAAQ,IAAI,eAAe,EAC3B,WAAW,IAAI,kBAAkB,GAIlC,MAAM,wBAAwB,CAAC;AAyDhC;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAmC;IAEnC,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACtF,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;YAC1E,gFAAgF;YAChF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzD,OAAO;gBACL,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,CAAC;gBAC3D,QAAQ;gBACR,OAAO;gBACP,QAAQ;gBACR,MAAM,EAAE,yCAAyC;aAClD,CAAC;QACJ,CAAC;QAED,mFAAmF;QACnF,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAE5D,oFAAoF;QACpF,MAAM,aAAa,GAAG,KAAK,CAAC,oBAAoB,EAAE,EAAE,CAAC;QAErD,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,MAAM,WAAW,GAAa,EAAE,CAAC;QAEjC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACrC,kFAAkF;YAClF,gFAAgF;YAChF,qEAAqE;YACrE,MAAM,eAAe,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACnF,IAAI,CAAC,eAAe,CAAC,QAAQ,IAAI,OAAO,eAAe,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC3E,+EAA+E;gBAC/E,kFAAkF;gBAClF,kFAAkF;gBAClF,kBAAkB;gBAClB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,QAAQ,CAAC,IAAI,CACX,eAAe,IAAI,CAAC,IAAI,aAAa,IAAI,CAAC,KAAK,mCAAmC;oBAChF,GAAG,eAAe,CAAC,MAAM,IAAI,YAAY,2CAA2C,CACvF,CAAC;gBACF,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;oBAC3B,MAAM,GAAG,IAAI,CAAC;oBACd,WAAW,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,IAAI,yBAAyB,CAAC,CAAC;gBAC/E,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC;YAEpC,gFAAgF;YAChF,2DAA2D;YAC3D,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,YAAY,GAAG,0BAA0B,CAAC,aAAa,EAAE;oBAC7D,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,WAAW;oBACX,QAAQ;oBACR,eAAe,EAAE,KAAK;oBACtB,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;oBAC5C,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,WAAW,EAAE,KAAK,CAAC,WAAW;iBAC/B,CAAC,CAAC;gBACH,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC;YAClC,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,6EAA6E;gBAC7E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;oBAC3B,MAAM,GAAG,IAAI,CAAC;oBACd,WAAW,CAAC,IAAI,CACd,wBAAwB,IAAI,CAAC,IAAI,4CAA4C,KAAK,GAAG,CACtF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,MAAM;YACN,QAAQ;YACR,OAAO;YACP,QAAQ;YACR,MAAM,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SACpE,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC;YAClC,QAAQ;YACR,MAAM,EAAE,uCAAwC,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE;SACxF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/policy-pretooluse-hook.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Milestone D — GATE 2: runtime preToolUse policy handler (§9.2 / AC-23b / AC-49 /
+ * AC-44).
+ *
+ * The runtime preToolUse BLOCKING dispatch (spawn-runtime-hooks.ts) gates spawned
+ * harnesses. This factory produces a `PreToolUseHook` that returns
+ * `{ decision: 'deny', reason }` for a covered call that lacks a valid
+ * CommandAuthorization. The proof context (the exact toolCallId / argsHash /
+ * commandHash / credentialScope about to execute) is recomputed HERE from the
+ * preToolUse payload and bound to the authorization (AC-23b).
+ *
+ * Enforcement note (AC-49 / AC-44): only `mode === 'blocking'` adapters convert a
+ * deny into a swallowed tool event (spawn-runtime-hooks.ts). For non-blocking
+ * (advisory) adapters GATE 1 / GATE 3 are the enforcing gates — GATE 2 is
+ * defense-in-depth, never the sole line. This handler always RETURNS the correct
+ * decision; whether it hard-enforces is the runtime's mode decision.
+ *
+ * OVERRIDING RULE: fail closed. Any verification / parse / binding error, or any
+ * thrown exception, is a `{ decision: 'deny' }`. No fallbacks.
+ */
+import { type CommandAuthorizationPayload, type TrustRoot } from '@a5c-ai/policy-adapter';
+import type { SignedEnvelope } from '@a5c-ai/trust-core';
+import type { PreToolUseHook } from './runtime-hooks.js';
+/**
+ * The preToolUse payload shape the runtime dispatches (spawn-runtime-hooks.ts),
+ * EXTENDED by Milestone D to carry the proof context (AC-23b).
+ */
+export interface PolicyPreToolUsePayload {
+    sessionId?: string;
+    toolCallId: string;
+    toolName: string;
+    input: unknown;
+}
+export interface CreatePolicyPreToolUseHookOptions {
+    /** Issuer trust roots (kind `engine`) that may sign a CommandAuthorization. */
+    issuerRoots: TrustRoot[];
+    /** sha256 of the integrity-verified policy document governing this action. */
+    policyDocHash: string;
+    /** The config epoch of the currently-honored signed manifest (AC-46). */
+    currentConfigEpoch: number;
+    /** The off-workspace pinned minimum-epoch floor (AC-47). */
+    minEpochFloor: number;
+    /** Coverage predicate: is this action policy-covered? */
+    isCovered: (payload: PolicyPreToolUsePayload) => boolean;
+    /** The credential scope for the executing action (from the trusted source, AC-40). */
+    credentialScopeFor: (payload: PolicyPreToolUsePayload) => string;
+    /** Resolve the CommandAuthorization bound to this exact tool call (or none). */
+    resolveAuthorization: (payload: PolicyPreToolUsePayload) => SignedEnvelope<CommandAuthorizationPayload> | undefined;
+}
+/**
+ * Build a GATE-2 preToolUse policy handler (AC-23b). For a covered call the handler
+ * REQUIRES a valid CommandAuthorization bound to the exact toolCallId / argsHash /
+ * commandHash / credentialScope in the payload; otherwise it denies (fail closed).
+ */
+export declare function createPolicyPreToolUseHook(options: CreatePolicyPreToolUseHookOptions): PreToolUseHook<PolicyPreToolUsePayload>;

package/dist/policy-pretooluse-hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-pretooluse-hook.d.ts","sourceRoot":"","sources":["../src/policy-pretooluse-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAIL,KAAK,2BAA2B,EAChC,KAAK,SAAS,EACf,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,KAAK,EAA6B,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpF;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,iCAAiC;IAChD,+EAA+E;IAC/E,WAAW,EAAE,SAAS,EAAE,CAAC;IACzB,8EAA8E;IAC9E,aAAa,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,4DAA4D;IAC5D,aAAa,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,SAAS,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC;IACzD,sFAAsF;IACtF,kBAAkB,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,MAAM,CAAC;IACjE,gFAAgF;IAChF,oBAAoB,EAAE,CACpB,OAAO,EAAE,uBAAuB,KAC7B,cAAc,CAAC,2BAA2B,CAAC,GAAG,SAAS,CAAC;CAC9D;AAcD;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,iCAAiC,GACzC,cAAc,CAAC,uBAAuB,CAAC,CAgDzC"}

package/dist/policy-pretooluse-hook.js

@@ -0,0 +1,80 @@
+/**
+ * Milestone D — GATE 2: runtime preToolUse policy handler (§9.2 / AC-23b / AC-49 /
+ * AC-44).
+ *
+ * The runtime preToolUse BLOCKING dispatch (spawn-runtime-hooks.ts) gates spawned
+ * harnesses. This factory produces a `PreToolUseHook` that returns
+ * `{ decision: 'deny', reason }` for a covered call that lacks a valid
+ * CommandAuthorization. The proof context (the exact toolCallId / argsHash /
+ * commandHash / credentialScope about to execute) is recomputed HERE from the
+ * preToolUse payload and bound to the authorization (AC-23b).
+ *
+ * Enforcement note (AC-49 / AC-44): only `mode === 'blocking'` adapters convert a
+ * deny into a swallowed tool event (spawn-runtime-hooks.ts). For non-blocking
+ * (advisory) adapters GATE 1 / GATE 3 are the enforcing gates — GATE 2 is
+ * defense-in-depth, never the sole line. This handler always RETURNS the correct
+ * decision; whether it hard-enforces is the runtime's mode decision.
+ *
+ * OVERRIDING RULE: fail closed. Any verification / parse / binding error, or any
+ * thrown exception, is a `{ decision: 'deny' }`. No fallbacks.
+ */
+import { verifyCommandAuthorization, argsHash as computeArgsHash, commandHash as computeCommandHash, } from '@a5c-ai/policy-adapter';
+const deny = (reason) => ({ decision: 'deny', reason });
+const allow = () => ({ decision: 'allow' });
+/** Extract the command STRING for command-bearing tools (`{ command: "..." }`). */
+function commandStringOf(input) {
+    if (input && typeof input === 'object') {
+        const cmd = input.command;
+        if (typeof cmd === 'string')
+            return cmd;
+    }
+    return '';
+}
+/**
+ * Build a GATE-2 preToolUse policy handler (AC-23b). For a covered call the handler
+ * REQUIRES a valid CommandAuthorization bound to the exact toolCallId / argsHash /
+ * commandHash / credentialScope in the payload; otherwise it denies (fail closed).
+ */
+export function createPolicyPreToolUseHook(options) {
+    return function policyPreToolUse(payload, _context) {
+        try {
+            if (!payload || typeof payload !== 'object') {
+                return deny('missing preToolUse payload');
+            }
+            const covered = options.isCovered(payload) === true;
+            if (!covered) {
+                // Uncovered actions are handled by GATE 1's coverage/default logic; GATE 2
+                // does not re-derive default-allow — it only enforces covered actions.
+                return allow();
+            }
+            const authorization = options.resolveAuthorization(payload);
+            if (!authorization) {
+                return deny('covered action has no CommandAuthorization — deny');
+            }
+            const credentialScope = options.credentialScopeFor(payload) ?? '';
+            const commandString = commandStringOf(payload.input);
+            const commandHash = computeCommandHash(commandString);
+            const argsHash = computeArgsHash(payload.input);
+            const verification = verifyCommandAuthorization(authorization, {
+                now: Date.now(),
+                toolName: payload.toolName,
+                toolCallId: payload.toolCallId,
+                commandHash,
+                argsHash,
+                credentialScope,
+                policyDocHash: options.policyDocHash,
+                currentConfigEpoch: options.currentConfigEpoch,
+                minEpochFloor: options.minEpochFloor,
+                issuerRoots: options.issuerRoots,
+            });
+            if (!verification.valid) {
+                return deny(`authorization verification failed: ${verification.reason}`);
+            }
+            return allow();
+        }
+        catch (err) {
+            return deny(`exception during GATE 2 verification: ${err?.message ?? String(err)}`);
+        }
+    };
+}
+//# sourceMappingURL=policy-pretooluse-hook.js.map

package/dist/policy-pretooluse-hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-pretooluse-hook.js","sourceRoot":"","sources":["../src/policy-pretooluse-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACL,0BAA0B,EAC1B,QAAQ,IAAI,eAAe,EAC3B,WAAW,IAAI,kBAAkB,GAGlC,MAAM,wBAAwB,CAAC;AAmChC,MAAM,IAAI,GAAG,CAAC,MAAc,EAAgB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAC9E,MAAM,KAAK,GAAG,GAAiB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;AAE1D,mFAAmF;AACnF,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAAI,KAAiC,CAAC,OAAO,CAAC;QACvD,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAA0C;IAE1C,OAAO,SAAS,gBAAgB,CAC9B,OAAgC,EAChC,QAAqB;QAErB,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,OAAO,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC5C,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;YACpD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,2EAA2E;gBAC3E,uEAAuE;gBACvE,OAAO,KAAK,EAAE,CAAC;YACjB,CAAC;YAED,MAAM,aAAa,GAAG,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC5D,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAC,mDAAmD,CAAC,CAAC;YACnE,CAAC;YAED,MAAM,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClE,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,WAAW,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;YACtD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAEhD,MAAM,YAAY,GAAG,0BAA0B,CAAC,aAAa,EAAE;gBAC7D,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;gBACf,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,WAAW;gBACX,QAAQ;gBACR,eAAe;gBACf,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;gBAC9C,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,CAAC,CAAC;YAEH,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC,sCAAsC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO,KAAK,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,yCAA0C,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/policy-spawn-gate.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Milestone D — PRODUCTION wiring of GATE 3 (§9.3 / AC-23a / AC-40 / AC-50) into the
+ * adapters spawn path (`spawn-runner.ts` → `buildInvocationCommand`).
+ *
+ * GATE 3's PRIMITIVE (`gateCredentialInjection` + `applyGate3ToEnv/Mounts/ServiceAccount`)
+ * was shipped and fail-closed, but `spawn-runner.ts` called `buildInvocationCommand` with
+ * only 3 args, so `gate3` was `undefined` and every credential channel emitted
+ * unconditionally. This module resolves a `Gate3Options` from the SAME manifest-verified
+ * config that drives GATE 1 / the session gate (via `loadPolicyEnforcementGate`), so the
+ * production spawn path actually gates scoped-credential delivery.
+ *
+ * POSTURE (mirrors resolveRunPolicyGates):
+ *   - Anchor pinned (`POLICY_CONFIG_ROOT_FP` set) → a Gate3Context is resolved from the
+ *     verified config; a scoped credential with no valid CommandAuthorization is DROPPED
+ *     (channel omitted) and, if required, the spawn is denied.
+ *   - Anchor NOT pinned, OR no scoped credentials declared for this spawn → `undefined`;
+ *     `buildInvocationCommand` runs with no gate (back-compat, channels emit as before).
+ *
+ * FAIL CLOSED: with the anchor pinned but the adapter unloadable / config untrusted, the
+ * resolved context has NO issuer roots, so every scoped credential fails authorization and
+ * is dropped (required → denied). No fallbacks — any thrown error yields no injection.
+ */
+import type { Gate3Options } from './spawn-invocation.js';
+/** Per-spawn declaration of which delivery-channel credentials are SCOPED (from AC-40 source). */
+export interface SpawnScopedCredentials {
+    /** env-var key → trusted alias (ARN/key-id/secret-name) + required flag. */
+    scopedEnvKeys?: Record<string, {
+        alias: string;
+        required?: boolean;
+    }>;
+    /** docker `-v` mount spec → trusted alias + required flag (AC-50). */
+    scopedMounts?: Record<string, {
+        alias: string;
+        required?: boolean;
+    }>;
+    /** k8s `--serviceaccount` name → trusted alias + required flag (AC-50). */
+    scopedServiceAccount?: {
+        name: string;
+        alias: string;
+        required?: boolean;
+    };
+}
+/** The per-spawn binding context GATE 3 recomputes the authorization hash against (AC-32). */
+export interface SpawnGateBinding {
+    toolName: string;
+    toolCallId: string;
+    /** The exact command about to be spawned. */
+    command: string;
+    /** The exact args about to be spawned. */
+    args: unknown;
+    /** Resolve the CommandAuthorization for this spawn (or none → drop scoped creds). */
+    resolveAuthorization: () => unknown;
+}
+/** Test-only: clear the memo so a test can re-resolve with a fresh env. */
+export declare function __resetSpawnGateCache(): void;
+/**
+ * Build a `Gate3Options` for a spawn, or `undefined` when GATE 3 should not gate this
+ * spawn (anchor unpinned, or no scoped credentials declared). When the anchor is pinned and
+ * this spawn declares scoped credentials, the returned options make `buildInvocationCommand`
+ * gate every credential channel it constructs against a valid CommandAuthorization.
+ */
+export declare function resolveSpawnGate3(projectRoot: string, scoped: SpawnScopedCredentials, binding: SpawnGateBinding): Promise<Gate3Options | undefined>;
+/**
+ * Milestone E — AUTO-ACTIVATE GATE 3 from the SIGNED config (§9.3 / AC-23a / AC-40 / AC-50).
+ *
+ * The scoped-credential DECLARATION (which env keys / mounts / serviceaccount are scoped, and
+ * to which trusted alias) is DEPLOYMENT CONFIGURATION, not agent-writable input. It lives in
+ * the manifest-verified `credential-scope-source.json` (`scopedCredentials`), so a real spawn
+ * is gated end-to-end WITHOUT a caller passing `RunOptions.policyGate3` and WITHOUT the agent
+ * being able to declare its own scoping.
+ *
+ * When the anchor is pinned AND the signed source declares scoped credentials, this returns a
+ * `Gate3Options` built from the SAME manifest-verified config that drives GATE 1 / the session
+ * gate. When the anchor is unpinned, or the signed source declares no scoped credentials, this
+ * returns `undefined` (GATE 3 gates only what a caller explicitly declared, back-compat).
+ *
+ * `resolveAuthorization` is the run's authorization-store resolver (the ALLOW path); with none,
+ * a scoped credential fails authorization and its channel is dropped (fail closed).
+ */
+export declare function resolveSpawnGate3FromConfig(projectRoot: string, binding: Omit<SpawnGateBinding, 'resolveAuthorization'> & {
+    resolveAuthorization?: () => unknown;
+}): Promise<Gate3Options | undefined>;

package/dist/policy-spawn-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-spawn-gate.d.ts","sourceRoot":"","sources":["../src/policy-spawn-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D,kGAAkG;AAClG,MAAM,WAAW,sBAAsB;IACrC,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACtE,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACrE,2EAA2E;IAC3E,oBAAoB,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC5E;AAED,8FAA8F;AAC9F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,IAAI,EAAE,OAAO,CAAC;IACd,qFAAqF;IACrF,oBAAoB,EAAE,MAAM,OAAO,CAAC;CACrC;AAqDD,2EAA2E;AAC3E,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CA4BnC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,2BAA2B,CAC/C,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,sBAAsB,CAAC,GAAG;IACxD,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC;CACtC,GACA,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAmBnC"}

package/dist/policy-spawn-gate.js

@@ -0,0 +1,115 @@
+// Memoize the resolved Gate3Context per project root so repeated spawns in one run do not
+// re-verify the manifest.
+const cache = new Map();
+function anchorPinned() {
+    const v = process.env.POLICY_CONFIG_ROOT_FP;
+    return typeof v === 'string' && v.length > 0;
+}
+async function resolveGate3Context(projectRoot) {
+    const key = projectRoot;
+    const existing = cache.get(key);
+    if (existing)
+        return existing;
+    const built = (async () => {
+        try {
+            const mod = await import('@a5c-ai/policy-adapter');
+            const result = await mod.loadPolicyEnforcementGate(projectRoot);
+            if (result.enforcementActive !== true)
+                return undefined;
+            return result.gate3Context;
+        }
+        catch {
+            // Anchor pinned but adapter unloadable → return a trust-empty context so scoped creds
+            // fail authorization (fail closed). Unpinned → undefined (no gating).
+            if (anchorPinned()) {
+                return {
+                    issuerRoots: [],
+                    currentConfigEpoch: 0,
+                    minEpochFloor: Number(process.env.POLICY_CONFIG_MIN_EPOCH ?? '1') || 1,
+                    policyDocHashFor: () => '',
+                };
+            }
+            return undefined;
+        }
+    })();
+    cache.set(key, built);
+    return built;
+}
+/** Test-only: clear the memo so a test can re-resolve with a fresh env. */
+export function __resetSpawnGateCache() {
+    cache.clear();
+}
+/**
+ * Build a `Gate3Options` for a spawn, or `undefined` when GATE 3 should not gate this
+ * spawn (anchor unpinned, or no scoped credentials declared). When the anchor is pinned and
+ * this spawn declares scoped credentials, the returned options make `buildInvocationCommand`
+ * gate every credential channel it constructs against a valid CommandAuthorization.
+ */
+export async function resolveSpawnGate3(projectRoot, scoped, binding) {
+    const hasScoped = (scoped.scopedEnvKeys && Object.keys(scoped.scopedEnvKeys).length > 0) ||
+        (scoped.scopedMounts && Object.keys(scoped.scopedMounts).length > 0) ||
+        scoped.scopedServiceAccount !== undefined;
+    // Nothing scoped for this spawn → no gate needed (env/mounts/SA pass through unchanged).
+    if (!hasScoped)
+        return undefined;
+    const ctx = await resolveGate3Context(projectRoot);
+    if (!ctx)
+        return undefined;
+    const credentialSource = ctx.credentialSource;
+    return {
+        issuerRoots: ctx.issuerRoots,
+        policyDocHash: ctx.policyDocHashFor(binding.toolName, binding.command),
+        currentConfigEpoch: ctx.currentConfigEpoch,
+        minEpochFloor: ctx.minEpochFloor,
+        now: Date.now(),
+        toolName: binding.toolName,
+        toolCallId: binding.toolCallId,
+        command: binding.command,
+        args: binding.args,
+        credentialSource,
+        resolveAuthorization: binding.resolveAuthorization,
+        scopedEnvKeys: scoped.scopedEnvKeys ?? {},
+        ...(scoped.scopedMounts ? { scopedMounts: scoped.scopedMounts } : {}),
+        ...(scoped.scopedServiceAccount ? { scopedServiceAccount: scoped.scopedServiceAccount } : {}),
+    };
+}
+/**
+ * Milestone E — AUTO-ACTIVATE GATE 3 from the SIGNED config (§9.3 / AC-23a / AC-40 / AC-50).
+ *
+ * The scoped-credential DECLARATION (which env keys / mounts / serviceaccount are scoped, and
+ * to which trusted alias) is DEPLOYMENT CONFIGURATION, not agent-writable input. It lives in
+ * the manifest-verified `credential-scope-source.json` (`scopedCredentials`), so a real spawn
+ * is gated end-to-end WITHOUT a caller passing `RunOptions.policyGate3` and WITHOUT the agent
+ * being able to declare its own scoping.
+ *
+ * When the anchor is pinned AND the signed source declares scoped credentials, this returns a
+ * `Gate3Options` built from the SAME manifest-verified config that drives GATE 1 / the session
+ * gate. When the anchor is unpinned, or the signed source declares no scoped credentials, this
+ * returns `undefined` (GATE 3 gates only what a caller explicitly declared, back-compat).
+ *
+ * `resolveAuthorization` is the run's authorization-store resolver (the ALLOW path); with none,
+ * a scoped credential fails authorization and its channel is dropped (fail closed).
+ */
+export async function resolveSpawnGate3FromConfig(projectRoot, binding) {
+    if (!anchorPinned())
+        return undefined;
+    const ctx = await resolveGate3Context(projectRoot);
+    if (!ctx)
+        return undefined;
+    const declared = ctx.credentialSource?.scopedCredentials;
+    if (!declared)
+        return undefined;
+    const scoped = {
+        ...(declared.scopedEnvKeys ? { scopedEnvKeys: declared.scopedEnvKeys } : {}),
+        ...(declared.scopedMounts ? { scopedMounts: declared.scopedMounts } : {}),
+        ...(declared.scopedServiceAccount ? { scopedServiceAccount: declared.scopedServiceAccount } : {}),
+    };
+    return resolveSpawnGate3(projectRoot, scoped, {
+        toolName: binding.toolName,
+        toolCallId: binding.toolCallId,
+        command: binding.command,
+        args: binding.args,
+        resolveAuthorization: binding.resolveAuthorization ?? (() => undefined),
+    });
+}
+//# sourceMappingURL=policy-spawn-gate.js.map

package/dist/policy-spawn-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-spawn-gate.js","sourceRoot":"","sources":["../src/policy-spawn-gate.ts"],"names":[],"mappings":"AA8CA,0FAA0F;AAC1F,0BAA0B;AAC1B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwC,CAAC;AAE9D,SAAS,YAAY;IACnB,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAC5C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/C,CAAC;AAgBD,KAAK,UAAU,mBAAmB,CAAC,WAAmB;IACpD,MAAM,GAAG,GAAG,WAAW,CAAC;IACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ;QAAE,OAAO,QAA0B,CAAC;IAChD,MAAM,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;YAChE,IAAI,MAAM,CAAC,iBAAiB,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACxD,OAAO,MAAM,CAAC,YAA4C,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;YACtF,sEAAsE;YACtE,IAAI,YAAY,EAAE,EAAE,CAAC;gBACnB,OAAO;oBACL,WAAW,EAAE,EAAE;oBACf,kBAAkB,EAAE,CAAC;oBACrB,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,GAAG,CAAC,IAAI,CAAC;oBACtE,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE;iBAC3B,CAAC;YACJ,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,OAAO,KAAuB,CAAC;AACjC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB;IACnC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAmB,EACnB,MAA8B,EAC9B,OAAyB;IAEzB,MAAM,SAAS,GACb,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACtE,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACpE,MAAM,CAAC,oBAAoB,KAAK,SAAS,CAAC;IAC5C,yFAAyF;IACzF,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAEjC,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAE3B,MAAM,gBAAgB,GAAG,GAAG,CAAC,gBAAyB,CAAC;IACvD,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,WAAoB;QACrC,aAAa,EAAE,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC;QACtE,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;QAC1C,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;QACf,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,gBAAgB;QAChB,oBAAoB,EAAE,OAAO,CAAC,oBAA6B;QAC3D,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;QACzC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,WAAmB,EACnB,OAEC;IAED,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IACzD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEhC,MAAM,MAAM,GAA2B;QACrC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClG,CAAC;IACF,OAAO,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE;QAC5C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;KACxE,CAAC,CAAC;AACL,CAAC"}

package/dist/run-options.d.ts

@@ -101,6 +101,46 @@ export interface RunOptions {
     gracePeriodMs?: number;
     /** Invocation mode — how to spawn the underlying process (local, docker, ssh, k8s). */
     invocation?: InvocationMode;
+    /**
+     * Milestone D (§9.3 / AC-23a / AC-50) — GATE 3 credential-injection enforcement for the
+     * spawn path. When set AND the off-workspace config anchor (`POLICY_CONFIG_ROOT_FP`) is
+     * pinned, each declared scoped credential (env / docker `-v` / k8s serviceaccount) is
+     * delivered ONLY with a valid CommandAuthorization; otherwise the channel is omitted (and
+     * if required, the spawn is denied). When unset the spawn path is unchanged (back-compat).
+     */
+    policyGate3?: {
+        /** The project root anchoring the `.policy` config dir (defaults to `cwd`). */
+        projectRoot?: string;
+        /** env-var key → trusted alias (ARN/key-id/secret-name) + required flag (AC-40). */
+        scopedEnvKeys?: Record<string, {
+            alias: string;
+            required?: boolean;
+        }>;
+        /** docker `-v` mount spec → trusted alias + required flag (AC-50). */
+        scopedMounts?: Record<string, {
+            alias: string;
+            required?: boolean;
+        }>;
+        /** k8s `--serviceaccount` name → trusted alias + required flag (AC-50). */
+        scopedServiceAccount?: {
+            name: string;
+            alias: string;
+            required?: boolean;
+        };
+        /** The bound tool identity for the authorization recheck (AC-32). */
+        toolName?: string;
+        toolCallId?: string;
+        /** Resolve the CommandAuthorization for this spawn (or none → drop scoped creds). */
+        resolveAuthorization?: () => unknown;
+    };
+    /**
+     * Milestone E (ALLOW path, §5 / AC-9 / AC-50) — the run's authorization-store resolver,
+     * threaded into GATE 3 when it AUTO-ACTIVATES from the signed credential-scope source (i.e.
+     * when the anchor is pinned and the signed source declares scoped credentials, without an
+     * explicit `policyGate3`). With none, an auto-gated scoped credential fails authorization and
+     * its channel is dropped (fail closed). Ignored when `policyGate3.resolveAuthorization` is set.
+     */
+    policyResolveAuthorization?: () => unknown;
     /** Provider configuration for model/provider selection. */
     providerConfig?: import('./provider-config.js').ProviderConfig;
     /** Named provider profile from ~/.adapters/providers.json. */

package/dist/run-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-options.d.ts","sourceRoot":"","sources":["../src/run-options.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EACV,SAAS,EACT,UAAU,EAEV,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,WAAW,EAEZ,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAQtD,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAMrC;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IAGzB,2BAA2B;IAC3B,KAAK,EAAE,SAAS,CAAC;IAEjB,uCAAuC;IACvC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAI1B,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,iEAAiE;IACjE,gBAAgB,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IAIpD,2DAA2D;IAC3D,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAI3B,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IAIf,6BAA6B;IAC7B,cAAc,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,CAAC;IAEnD,kDAAkD;IAClD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAI3C,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,+CAA+C;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,mDAAmD;IACnD,eAAe,CAAC,EAAE,MAAM,CAAC;IAIzB,6FAA6F;IAC7F,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,0FAA0F;IAC1F,SAAS,CAAC,EAAE,OAAO,CAAC;IAIpB,wBAAwB;IACxB,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAE1B,qBAAqB;IACrB,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAEzC,6FAA6F;IAC7F,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAItB,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAI7B,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAIlB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;IAE1C,mFAAmF;IACnF,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAEjE,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;IAIjF,kDAAkD;IAClD,KAAK,CAAC,EAAE,YAAY,CAAC;IAErB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,8CAA8C;IAC9C,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAE/B,2CAA2C;IAC3C,WAAW,CAAC,EAAE,WAAW,CAAC;IAI1B,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC;IAIjB,+CAA+C;IAC/C,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB,yDAAyD;IACzD,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,uFAAuF;IACvF,UAAU,CAAC,EAAE,cAAc,CAAC;IAI5B,2DAA2D;IAC3D,cAAc,CAAC,EAAE,OAAO,sBAAsB,EAAE,cAAc,CAAC;IAE/D,8DAA8D;IAC9D,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAMD;;;;;GAKG;AACH,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAMjD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CA8T5D"}
+{"version":3,"file":"run-options.d.ts","sourceRoot":"","sources":["../src/run-options.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EACV,SAAS,EACT,UAAU,EAEV,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,WAAW,EAEZ,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAQtD,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAMrC;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IAGzB,2BAA2B;IAC3B,KAAK,EAAE,SAAS,CAAC;IAEjB,uCAAuC;IACvC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAI1B,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,iEAAiE;IACjE,gBAAgB,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IAIpD,2DAA2D;IAC3D,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAI3B,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IAIf,6BAA6B;IAC7B,cAAc,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,CAAC;IAEnD,kDAAkD;IAClD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAI3C,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,+CAA+C;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,mDAAmD;IACnD,eAAe,CAAC,EAAE,MAAM,CAAC;IAIzB,6FAA6F;IAC7F,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,0FAA0F;IAC1F,SAAS,CAAC,EAAE,OAAO,CAAC;IAIpB,wBAAwB;IACxB,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAE1B,qBAAqB;IACrB,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAEzC,6FAA6F;IAC7F,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAItB,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAI7B,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAIlB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;IAE1C,mFAAmF;IACnF,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAEjE,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC;IAIjF,kDAAkD;IAClD,KAAK,CAAC,EAAE,YAAY,CAAC;IAErB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,8CAA8C;IAC9C,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAE/B,2CAA2C;IAC3C,WAAW,CAAC,EAAE,WAAW,CAAC;IAI1B,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC;IAIjB,+CAA+C;IAC/C,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB,yDAAyD;IACzD,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,uFAAuF;IACvF,UAAU,CAAC,EAAE,cAAc,CAAC;IAE5B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE;QACZ,+EAA+E;QAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,oFAAoF;QACpF,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QACtE,sEAAsE;QACtE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QACrE,2EAA2E;QAC3E,oBAAoB,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QAC3E,qEAAqE;QACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,qFAAqF;QACrF,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC;KACtC,CAAC;IAEF;;;;;;OAMG;IACH,0BAA0B,CAAC,EAAE,MAAM,OAAO,CAAC;IAI3C,2DAA2D;IAC3D,cAAc,CAAC,EAAE,OAAO,sBAAsB,EAAE,cAAc,CAAC;IAE/D,8DAA8D;IAC9D,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAMD;;;;;GAKG;AACH,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAMjD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,UAAU,GAAG,IAAI,CA8T5D"}