@crewhaus/boundary-classifier 0.5.8 → 0.6.0

package/dist/index.d.ts

@@ -8,12 +8,38 @@ export declare class BoundaryClassifierError extends CrewhausError {
 }
 /**
  * Where the content originated. Use the strongest applicable label.
- * Adding a new origin? Update `OriginDefaultSeverity` and the §41 doctor
- * check at the same time.
+ *
+ * Adding a new origin is a SIX-site change that lands in one PR (0.6.0
+ * design §10.1; the `memory` and `consult` precedents prove the count):
+ *   1. this union;
+ *   2. `ORIGIN_DEFAULT_POLICY` below (a `Record<TrustOrigin, …>`, so omission
+ *      is a compile error — but the tier is a real decision);
+ *   3. the deliberately MIRRORED union in `@crewhaus/run-context` (it carries
+ *      the metadata and must not depend on this package) — the
+ *      `origin-mirror.test.ts` bridge fails `tsc -b` when the two drift;
+ *   4. `@crewhaus/egress-classifier`'s sink-side severity matrix;
+ *   5. the §41 `crewhaus doctor --philosophy-alignment` boundary-site list
+ *      (and a drift-signal row) in `apps/cli`;
+ *   6. factory's own `AGENTS.md` (the verbatim union + the source-site
+ *      table). The test arrays derive from {@link TRUST_ORIGINS}, so they
+ *      never need a hand edit.
  */
-export type TrustOrigin = "user" | "mcp" | "subagent" | "channel" | "federation" | "skill" | "compaction" | "tool" | "chain" | "memory";
+export type TrustOrigin = "user" | "mcp" | "subagent" | "channel" | "federation" | "skill" | "compaction" | "tool" | "chain" | "memory" | "consult";
 export type BoundarySeverity = "block" | "warn" | "pass";
 export type BoundaryAction = "pass" | "warn" | "redact";
+/**
+ * Every declared origin, in declaration order — derived from the policy
+ * table so it can never disagree with the union. Test arrays and the
+ * run-context mirror bridge read this instead of hand-listing origins.
+ */
+export declare const TRUST_ORIGINS: ReadonlyArray<TrustOrigin>;
+/**
+ * The origin's default source-side severity — what `classifyBoundary`
+ * applies when the caller passes no `severity` override. Exposed read-only
+ * so tests and `doctor` can assert the tier of each origin without
+ * re-deriving the table.
+ */
+export declare function defaultBoundarySeverity(origin: TrustOrigin): BoundarySeverity;
 export type ClassifyBoundaryOptions = {
     /** Required: where the content came from. Drives the default policy. */
     readonly origin: TrustOrigin;

package/dist/index.js

@@ -78,7 +78,30 @@ const ORIGIN_DEFAULT_POLICY = {
     // read time. Block by default, same tier as "skill" (both are
     // disk-persisted instructions-adjacent content).
     memory: "block",
+    // Consult content (0.6.0 design §7.5, §10.1): the reply of a nested
+    // single-turn side call on a roster sibling (`Consult`), and the `<guide>`
+    // text a plan-execute strategy injects. The sibling is a model the spec
+    // trusts to SERVE, not content the run may trust to READ: its reply was
+    // shaped by whatever the question carried (tool output, channel text) and
+    // re-enters the parent's context verbatim, so it is classified exactly
+    // once, here, at the tool. Block by default, the "skill" / "memory" tier.
+    consult: "block",
 };
+/**
+ * Every declared origin, in declaration order — derived from the policy
+ * table so it can never disagree with the union. Test arrays and the
+ * run-context mirror bridge read this instead of hand-listing origins.
+ */
+export const TRUST_ORIGINS = Object.keys(ORIGIN_DEFAULT_POLICY);
+/**
+ * The origin's default source-side severity — what `classifyBoundary`
+ * applies when the caller passes no `severity` override. Exposed read-only
+ * so tests and `doctor` can assert the tier of each origin without
+ * re-deriving the table.
+ */
+export function defaultBoundarySeverity(origin) {
+    return ORIGIN_DEFAULT_POLICY[origin];
+}
 /**
  * In-process LRU cache over `(sha256(content), origin)` → result. The
  * cap is sized to handle the largest realistic working set (a long

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewhaus/boundary-classifier",
-  "version": "0.5.8",
+  "version": "0.6.0",
   "type": "module",
   "description": "Pillar-3 chokepoint — classify content crossing every trust boundary (MCP / sub-agent / channel / federation / skill / compaction / tool) with origin metadata and a content-hash LRU cache",
   "main": "dist/index.js",
@@ -15,8 +15,11 @@
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/errors": "0.5.8",
-    "@crewhaus/prompt-injection-detector": "0.5.8"
+    "@crewhaus/errors": "0.6.0",
+    "@crewhaus/prompt-injection-detector": "0.6.0"
+  },
+  "devDependencies": {
+    "@crewhaus/run-context": "workspace:*"
   },
   "license": "Apache-2.0",
   "author": {