@ai-ecoverse/slicc-bios 1.54.11 → 1.55.0

package/README.md

@@ -358,7 +358,7 @@ Seven keeps its secrets in the vault, a separate origin (`@ai-ecoverse/slicc-vau
   - **Policy** (the vault refused, passed through only when its `cause` is one of these, otherwise `vault-refused`): `policy-paused`, `no-placeholder`, `no-rule`, `rule-domain`, `rule-request`, `rule-exit`, `mcp-server` (the placeholder isn't a sign-in of the MCP server at that URL), `record-removed`, `record-kind`, `record-expired`, `endpoint-protected`, `endpoint-model`, `url-credentials`, `insecure-destination`, `placeholder-in-url`, `placeholder-in-header-name`, `placeholder-repeated`, `value-overlaps`, `basic-invalid`, `basic-user`, `header-unsafe`, `path-ambiguous`, `url-invalid`.
   - **Precondition** (seven can't forward it here): `users-off`, `vault-unavailable`, `vault-locked`, `policy-syncing`, `policy-missing`, `policy-unaccepted`, `policy-unavailable`, `destination-protected` (seven's own, loopback, reserved or protected addresses), `exit-link` and `exit-tailnet` (the host goes through a linked device or the tailnet, which carry no credentialed request in this release), `extension-outdated` (slicc-extension before 7.11.0), `exit-not-credentialed` (any other route without manual redirects, decoded bodies and a body limit), `route-inactive`, `exit-encoded-bodies`, `exit-follows-redirects`, `body-too-large` (status `413`).
   - **Protocol**: `protocol-version`, `body-framing`, `mcp-body-framing`, `vault-reply` (an answer this seven doesn't take), `vault-error` (the vault's `forward` call failed; its errno is appended), `changed` (the route, the policy or the vault changed while the request was prepared; send it again).
-- **Policy:** with kernel users `enforce`, bios seeds missing policy files under trusted root-owned `/etc/fnox` and `/etc/slicc` directories, without overwriting existing contents or trusting writable, linked or mounted paths. The kernel attests the bytes on boot and change. A trusted missing-file attestation clears and pauses its policy; missing or untrusted ancestors hold protected operations until a trusted resync. Materialize, consume and session operations also require an unlocked, current-capability vault and an accepted trusted policy; an older vault stays refused until it updates. Processes keep `FNOX_CONFIG_DIR=/etc/fnox`; fnox uses placeholders and `/dev/sealed`. Named root MCP calls discover their Settings placeholder directly, without a jerk command. That is intentional, and the owner's decision: root is the owner, and sudoers decides who gets root, so a root process (including one a cone started through an approved `sudo`) discovers and uses the Settings MCP sign-ins. Discovery is the vault's `placeholder` op by server name, which answers only uid 0 under `enforce`, and only with a usable, addressable record that is the one match for that server name; process-sealed MCP bridge tokens and removed or expired records never answer. Using it, the record must be bound to the destination's server. bios's forwarder and the vault's `forward` check no uid or tag, so HTTP injection isn't partitioned by uid or tag (#1272).
+- **Policy:** with kernel users `enforce`, bios seeds missing policy files under trusted root-owned `/etc/fnox` and `/etc/slicc` directories, without overwriting existing contents or trusting writable, linked or mounted paths. The kernel attests the bytes on boot and change. A trusted missing-file attestation clears and pauses its policy; missing or untrusted ancestors hold protected operations until a trusted resync. HTTP placeholder forwarding is the exception when the last sync's `policy` reply was `accepted: true` and lists every missing file it sent as `absent`, `paused` and `accepted`: bios doesn't refuse on its own then but asks the vault, which, per its spec, refuses a secret (`policy-paused`) and lets an MCP sign-in through, since an MCP forward uses no rule. A secret answer in that state is refused by bios too (`policy-paused`). A rejected file (`accepted: false`) takes precedence over a missing one (`policy-unaccepted`), and a missing file the vault didn't confirm as paused (an untrusted attestation), and every other state where the policy isn't ready, still hold all forwarding (#1272). Materialize, consume and session operations also require an unlocked, current-capability vault and an accepted trusted policy; an older vault stays refused until it updates. Processes keep `FNOX_CONFIG_DIR=/etc/fnox`; fnox uses placeholders and `/dev/sealed`. Named root MCP calls discover their Settings placeholder directly, without a jerk command. That is intentional, and the owner's decision: root is the owner, and sudoers decides who gets root, so a root process (including one a cone started through an approved `sudo`) discovers and uses the Settings MCP sign-ins. Discovery is the vault's `placeholder` op by server name, which answers only uid 0 under `enforce`, and only with a usable, addressable record that is the one match for that server name; process-sealed MCP bridge tokens and removed or expired records never answer. Using it, the record must be bound to the destination's server. bios's forwarder and the vault's `forward` check no uid or tag, so HTTP injection isn't partitioned by uid or tag (#1272).
 - **Egress:** token refreshes use the same selected transport with a manual redirect policy, never a native-fetch fallback. An incapable route or redirect is refused; the response returns only to the vault. Request bodies are zeroed after use, and requests are not logged.
 - **Adobe IMS:** with agent ≥ 4.0.0, `login('adobe', …)` opens its popup before anything else, then seals the token as `{ kind: 'model', provider: 'adobe', name: 'ADOBE_IMS_TOKEN', source: 'oauth:adobe', expiresAt }` (the redirect's `expires_in` is in seconds, 86399 for a day) and resolves `{ sealed: true }`, so the token never reaches spectrum or the agent. IMS gives no refresh token: an expired token means signing in again, which replaces the record and keeps its placeholder. Agents before 4.0.0 get the token as before.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-bios",
-  "version": "1.54.11",
+  "version": "1.55.0",
   "description": "Slim loader that boots SLICC into OPFS and serves the UI from there",
   "type": "module",
   "license": "Apache-2.0",