@crewhaus/boundary-classifier 0.2.4 → 0.3.1

package/dist/index.d.ts

@@ -11,7 +11,7 @@ export declare class BoundaryClassifierError extends CrewhausError {
  * Adding a new origin? Update `OriginDefaultSeverity` and the §41 doctor
  * check at the same time.
  */
-export type TrustOrigin = "user" | "mcp" | "subagent" | "channel" | "federation" | "skill" | "compaction" | "tool" | "chain";
+export type TrustOrigin = "user" | "mcp" | "subagent" | "channel" | "federation" | "skill" | "compaction" | "tool" | "chain" | "memory";
 export type BoundarySeverity = "block" | "warn" | "pass";
 export type BoundaryAction = "pass" | "warn" | "redact";
 export type ClassifyBoundaryOptions = {

package/dist/index.js

@@ -70,6 +70,14 @@ const ORIGIN_DEFAULT_POLICY = {
     // or an event-emitting contract can plant malicious strings in event payloads
     // that get decoded and injected into the model's context. Block by default.
     chain: "block",
+    // Memory content (0.3.0 design §7.4): recalled wiki articles, recalled
+    // facts, and dream-synthesis output. A wiki article written in an earlier
+    // session may have absorbed attacker text (a poisoned web page STUDYed
+    // into an article, a malicious MCP response captured as a fact) — recall
+    // re-injects it across a session boundary, so it must be re-verified at
+    // read time. Block by default, same tier as "skill" (both are
+    // disk-persisted instructions-adjacent content).
+    memory: "block",
 };
 /**
  * In-process LRU cache over `(sha256(content), origin)` → result. The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewhaus/boundary-classifier",
-  "version": "0.2.4",
+  "version": "0.3.1",
   "type": "module",
   "description": "Pillar-3 chokepoint — classify content crossing every trust boundary (MCP / sub-agent / channel / federation / skill / compaction / tool) with origin metadata and a content-hash LRU cache",
   "main": "dist/index.js",
@@ -15,8 +15,8 @@
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/errors": "0.2.4",
-    "@crewhaus/prompt-injection-detector": "0.2.4"
+    "@crewhaus/errors": "0.3.1",
+    "@crewhaus/prompt-injection-detector": "0.3.1"
   },
   "license": "Apache-2.0",
   "author": {
@@ -36,5 +36,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "files": ["dist", "README.md", "LICENSE", "NOTICE"]
+  "files": ["dist", "templates", "README.md", "LICENSE", "NOTICE"]
 }

package/templates/README.md

@@ -0,0 +1,53 @@
+# boundary-classifier templates
+
+Copy-in starting points for operating the item 49 scope-audit drift watch in
+CI. These are **templates, not active workflows** — nothing in this directory
+runs from inside the factory repo.
+
+Why this package hosts the template: the drift watch exists to enforce THIS
+package's single-chokepoint invariant. The `boundary-classifier` header
+declares that every cross-trust-domain transition must route through
+`classifyBoundary`, and that "a new boundary that re-implements
+classification inline (or skips it) is a security regression, not a perf
+optimisation" — but until item 49, only the six canonical boundary sites
+were checked, print-only, run-and-forget. The drift watch turns that
+invariant into a baselined CI gate, so the workflow that wires it up lives
+next to the invariant it protects (following the `templates/` convention
+established by `compliance-controls` and `data-retention-engine`).
+
+- [`scope-audit-drift.yml`](scope-audit-drift.yml) — GitHub Actions
+  PR-trigger template. Copy it into the factory-shaped repository's
+  `.github/workflows/` (the audit reads `packages/*/src`, so it applies to
+  the factory repo, forks, and vendored monorepos with the same layout) and
+  edit the `<PLACEHOLDER>` comments. It runs:
+
+  ```
+  crewhaus doctor --philosophy-alignment --baseline
+  ```
+
+  on every PR that touches `packages/**` or a spec, which:
+
+  1. Re-audits the three pillars (boundary sites, tool scopes, package
+     presence) **plus** the boundary-drift detector — a conservative scan
+     for cross-trust ingress signals (raw MCP SDK imports, inbound channel
+     transports, federation peer payloads, chain content decoders) in
+     packages that never reference the classification fabric.
+  2. Diffs the findings (by stable id: hash of class + file + symbol)
+     against the last accepted baseline at
+     `.crewhaus/scope-audit/baseline.json`, and exits non-zero **only on
+     NEW findings** — legacy accepted findings never block, so the gate can
+     be adopted on a repo with known, deliberate downstream-classification
+     transports.
+
+  To (re)accept the baseline after reviewing findings:
+
+  ```
+  crewhaus doctor --philosophy-alignment --accept-baseline
+  git add -f .crewhaus/scope-audit/baseline.json   # -f: .crewhaus/ is gitignored
+  ```
+
+  **The baseline must be committed.** The factory `.gitignore` excludes
+  `.crewhaus/` (runtime artifacts), so the accepted baseline needs a
+  force-add — that is deliberate: accepting findings is a reviewed,
+  history-tracked act, not a runtime side effect. A PR whose only change is
+  the baseline file IS the review surface for newly accepted findings.

package/templates/scope-audit-drift.yml

@@ -0,0 +1,67 @@
+# scope-audit-drift.yml — PR-gated scope-audit drift watch TEMPLATE (item 49).
+#
+# This is a TEMPLATE, not an active workflow: copy it into your
+# factory-shaped repository's `.github/workflows/` and edit the
+# <PLACEHOLDER> comments. On every PR that touches package sources or a
+# spec, it re-runs `crewhaus doctor --philosophy-alignment --baseline`:
+# the three-pillar audit (boundary sites, tool scopes) PLUS the
+# boundary-drift detector, diffed against the committed baseline at
+# `.crewhaus/scope-audit/baseline.json`. The job fails ONLY on findings
+# that are NEW relative to the accepted baseline — a fresh cross-trust
+# ingress that skips classifyBoundary trips the PR; the known, deliberate
+# downstream-classified transports you already accepted do not.
+#
+# Prerequisites:
+#   - A committed baseline. `.crewhaus/` is gitignored in the factory repo,
+#     so accepting is an explicit, reviewed act:
+#       crewhaus doctor --philosophy-alignment --accept-baseline
+#       git add -f .crewhaus/scope-audit/baseline.json
+#     Without one, the gate fails whenever any finding exists (a gate nobody
+#     armed must not silently pass).
+#   - The audit is repo-shaped: it reads `packages/*/src`, so run it from
+#     the repository root of a factory-layout checkout.
+
+name: scope-audit-drift
+
+on:
+  pull_request:
+    paths:
+      # Package sources — where a new un-classified ingress would land.
+      - "packages/**"
+      # The CLI that hosts the audit itself.
+      - "apps/**"
+      # Specs: tool lists / scopes referenced by the pillar audit.
+      - "**/crewhaus.yaml"
+      # Baseline changes are exactly the review surface for accepted findings.
+      - ".crewhaus/scope-audit/baseline.json"
+  # Manual runs for baseline reviews outside a PR.
+  workflow_dispatch: {}
+
+jobs:
+  drift-watch:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          # <BUN-VERSION> Pin to the repo's toolchain if you pin elsewhere.
+          bun-version: latest
+
+      - name: Install workspace dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Scope-audit drift gate
+        # Exit non-zero ONLY on NEW findings vs .crewhaus/scope-audit/
+        # baseline.json (legacy accepted findings never block). Add --json
+        # to also persist/emit the machine-readable snapshot + gate verdict,
+        # e.g. for uploading as a build artifact:
+        #   bun apps/cli/src/index.ts doctor --philosophy-alignment --baseline --json > scope-audit.json
+        run: bun apps/cli/src/index.ts doctor --philosophy-alignment --baseline
+
+      # <ON-FAILURE> A red run means a NEW finding. Either fix the ingress
+      # (route it through classifyBoundary — see packages/boundary-classifier)
+      # or, if it is classified downstream by design, accept it in a
+      # reviewed commit:
+      #   crewhaus doctor --philosophy-alignment --accept-baseline
+      #   git add -f .crewhaus/scope-audit/baseline.json