@christang/keel 5.6.0 → 5.14.0

package/src/core/projection.js

@@ -2,6 +2,10 @@
 
 // Keel 4.1.0 one-way native projection contract.
 
+const fs = require("fs");
+const path = require("path");
+
+const { readDelegationPolicy } = require("./config");
 const { resolveContext } = require("./context");
 const { loadTaskContract } = require("./task-contract");
 const { probeCapabilities } = require("./capabilities");
@@ -34,6 +38,39 @@ function blocked(target, event, reason, warnings = []) {
   };
 }
 
+// Both refusals are decided before a delegate starts, never inferred from what
+// it did. An absent manifest passes every write through silently, so a delegate
+// that wrote successfully under one proves nothing about having been checked —
+// there is no observable difference afterwards, which is why the condition has
+// to be answered here.
+function delegationRefusal(repo, delegation) {
+  // The policy is read directly rather than through the capsule, because the
+  // capsule cannot express the difference this refusal turns on. A tier outside
+  // the vocabulary fails closed at the config layer and reaches the capsule as
+  // no delegation at all — identical to a repository that declared nothing. One
+  // of those should proceed silently and the other must be reported, so the
+  // unresolved declaration has to be seen where it still exists.
+  const { unknown, accepted } = readDelegationPolicy(repo);
+  if (unknown.length > 0) {
+    return (
+      `Delegation declares tier "${unknown.join(", ")}", which this target `
+      + `does not provide. Accepted: ${accepted.join(", ")}. Keel refuses `
+      + "rather than substituting a tier, because work would otherwise run at "
+      + "a capability nobody declared while reporting success."
+    );
+  }
+  if (!delegation) return null;
+  if (!fs.existsSync(path.join(repo, "keel", "guard.json"))) {
+    return (
+      "Delegation requires an active write guard, and keel/guard.json is "
+      + "absent. Without it every write passes through unchecked and looks "
+      + "identical to a write the guard allowed. Run `keel gate task-start` "
+      + "for the selected task, then delegate."
+    );
+  }
+  return null;
+}
+
 function capabilityKey(event) {
   if (event === "startup") return "continuity.start";
   if (["resume", "compaction"].includes(event)) return "continuity.reinject";
@@ -157,6 +194,24 @@ function projectRuntime(repo, options) {
   if (event === "subagent-stop") {
     projection.returnAuthority = "report-and-evidence-only";
   }
+  // Delegation extends the brief Keel already publishes rather than adding a
+  // carrier beside the host's own agent interface. The host spawns; this is the
+  // one-way view of OpenSpec it is handed.
+  if (event === "subagent-start") {
+    const refusal = delegationRefusal(repo, capsule.delegation);
+    if (refusal) return blocked(options.target, event, refusal, warnings);
+  }
+  if (event === "subagent-start" && capsule.delegation) {
+    projection.delegation = {
+      tier: capsule.delegation.tier,
+      source: capsule.delegation.source,
+      writeBoundary: capsule.touch,
+      note:
+        "Keel carries the declared tier and does not select a model; the "
+        + "target resolves it. Keel cannot observe which model executed, so "
+        + "the tier is what is recorded and never a claim about what ran.",
+    };
+  }
 
   return {
     schemaVersion: 1,

package/src/core/task-contract.js

@@ -6,6 +6,7 @@ const path = require("path");
 
 const {
   CONFIG_RELATIVE_PATH,
+  readDelegationPolicy,
   readStandingAuthorization,
 } = require("./config");
 
@@ -866,6 +867,24 @@ function compileTaskContract(repo, change, task) {
   if (!autonomy.some((item) => /^Pre-authorized fallback:/i.test(item))) {
     autonomy.push("Pre-authorized fallback: none");
   }
+  // Who runs this task, resolved exactly as the autonomy boundary above is: the
+  // task keeps whatever it authored, the repository declaration supplies only
+  // what the task left silent, and the entry names its source. A declaration
+  // that could overwrite an authored tier would make the capsule unreadable on
+  // its own — you could not tell what this task decided from what the file did.
+  const authoredTier = normalizeText(field(task, "Delegation")).toLowerCase();
+  let delegation = { tier: null, source: null };
+  if (authoredTier) {
+    delegation = { tier: authoredTier, source: "task" };
+  } else {
+    const { tier } = readDelegationPolicy(repo);
+    if (tier) {
+      delegation = {
+        tier,
+        source: CONFIG_RELATIVE_PATH.split(path.sep).join("/"),
+      };
+    }
+  }
   // A question is unresolved authority when it is the subject of its Covers
   // entry. Scanning the whole field also matched a resolved question named as
   // supporting detail beside the fact that closed it, and the only fix
@@ -940,7 +959,18 @@ function compileTaskContract(repo, change, task) {
         couplingMode === "required" ? candidateBoundary : [],
       designContract: coupledContract,
     },
+    // A helper and a delegate are different roles. A helper is never a second
+    // writer and this stays true whatever the repository declares; delegation
+    // is a separate entry beside it, never a helper with the guard removed.
     helperAuthority: "read-only-evidence-only",
+    // Present only when a tier actually resolved. An unconditional field would
+    // change the compiled capsule for every task everywhere, moving every
+    // recorded anchor and drifting every live change in every consumer repo on
+    // upgrade — for repositories that declared nothing and asked for nothing.
+    // Omission keeps this release's invariant: no behavior change without a
+    // declaration. A repository that does declare gets a different capsule,
+    // which is honest, because its execution genuinely differs.
+    ...(delegation.tier ? { delegation } : {}),
     prohibitions: [
       "must not change Acceptance",
       // repo-action is the one mode whose authorized effect is the repository