@deftai/directive-core 0.88.0 → 0.89.0

package/dist/authz/closed-verb.js

@@ -0,0 +1,279 @@
+/**
+ * Closed-verb evaluator for release-class high-blast verbs (#1095 Wave 4 / #2948).
+ *
+ * Allow only when:
+ *   (a) DEFT_ALLOW_<VERB>=1 ephemeral env bypass, OR
+ *   (b) a matching human-origin grant whose operations cover the verb and
+ *       surfaces cover the target (empty surfaces = any target).
+ *
+ * Agent-authored / rejected-origin grants never satisfy. Does not invent a
+ * second mint path — grants come from Wave 1 mintHumanOriginGrant / authz:grant.
+ */
+import { evidenceSatisfiesImplementationApproval, isHumanOriginGrant, isRejectedOriginKind, } from "./origin.js";
+import { builtinReleaseVerbClassification, getVerbRow, loadVerbClassification, } from "./verb-classification.js";
+function sanitize(text) {
+    return text.replace(/[\r\n]+/g, " ");
+}
+function deny(code, reason, input, extra = {}) {
+    return {
+        allowed: false,
+        code,
+        reason: sanitize(reason),
+        verb: sanitize(input.verb),
+        target: input.target === null ? null : sanitize(input.target),
+        humanApprovalRef: extra.humanApprovalRef ?? null,
+        envBypassKey: extra.envBypassKey ?? null,
+        skillPointer: extra.skillPointer ?? null,
+    };
+}
+function allow(code, reason, input, extra = {}) {
+    return {
+        allowed: true,
+        code,
+        reason: sanitize(reason),
+        verb: sanitize(input.verb),
+        target: input.target === null ? null : sanitize(input.target),
+        humanApprovalRef: extra.humanApprovalRef ?? null,
+        envBypassKey: extra.envBypassKey ?? null,
+        skillPointer: extra.skillPointer ?? null,
+    };
+}
+/** Normalise version/target for surface matching (strip leading v, lower-case). */
+export function normaliseClosedVerbTarget(target) {
+    if (target === null || target === undefined)
+        return null;
+    let t = target.trim();
+    if (t.length === 0)
+        return null;
+    if (t.startsWith("v") || t.startsWith("V"))
+        t = t.slice(1);
+    return t.toLowerCase();
+}
+/** Surface forms that match a target (version, v-version, raw). */
+export function targetSurfaceCandidates(target) {
+    if (target === null)
+        return [];
+    const raw = target.trim();
+    const norm = normaliseClosedVerbTarget(target);
+    const out = new Set();
+    if (raw.length > 0)
+        out.add(raw);
+    if (norm !== null) {
+        out.add(norm);
+        out.add(`v${norm}`);
+    }
+    return [...out];
+}
+function envTruthy(value) {
+    if (value === undefined)
+        return false;
+    const v = value.trim().toLowerCase();
+    return v === "1" || v === "true" || v === "yes";
+}
+function grantCoversOperation(grant, acceptedOps) {
+    const want = new Set(acceptedOps.map((o) => o.toLowerCase()));
+    return grant.scope.operations.some((op) => want.has(op.toLowerCase()));
+}
+/**
+ * Target match: empty surfaces = unrestricted targets for this closed verb.
+ * Non-empty: any surface must equal a candidate form of the target (exact).
+ * Wildcard `*` is rejected for release-class (wildcard_allowed=false) unless
+ * the classification row allows it (Wave 4 rows do not).
+ */
+function grantCoversTarget(grant, target, wildcardAllowed) {
+    if (grant.scope.surfaces.length === 0)
+        return true;
+    if (target === null)
+        return false;
+    const candidates = new Set(targetSurfaceCandidates(target).map((c) => c.toLowerCase()));
+    for (const surface of grant.scope.surfaces) {
+        const s = surface.trim();
+        if (s === "*") {
+            if (wildcardAllowed)
+                return true;
+            continue;
+        }
+        if (candidates.has(s.toLowerCase()))
+            return true;
+        const sn = normaliseClosedVerbTarget(s);
+        if (sn !== null && candidates.has(sn))
+            return true;
+    }
+    return false;
+}
+/** When a grant pins repo/branch, the attempt must supply a matching value. */
+function grantContextMatches(grant, input) {
+    const s = grant.scope;
+    if (s.repo !== null) {
+        if (input.repo === null || input.repo === undefined)
+            return false;
+        if (s.repo.toLowerCase() !== input.repo.toLowerCase())
+            return false;
+    }
+    if (s.branch !== null) {
+        if (input.branch === null || input.branch === undefined)
+            return false;
+        if (s.branch !== input.branch)
+            return false;
+    }
+    return true;
+}
+function grantValidity(grant, now) {
+    if (!isHumanOriginGrant(grant)) {
+        const kind = grant.origin.kind;
+        if (isRejectedOriginKind(kind)) {
+            return {
+                ok: false,
+                code: "closed-verb-deny-origin",
+                reason: `Directive denied closed verb: grant ${grant.id} origin.kind=${kind} is ` +
+                    "agent/self-authored and cannot authorize release-class verbs. " +
+                    "Human action required: `deft authz:grant -- --template <release-*> --target <ver>`.",
+            };
+        }
+        return {
+            ok: false,
+            code: "closed-verb-deny-origin",
+            reason: `Directive denied closed verb: grant ${grant.id} lacks human-origin provenance. ` +
+                "Human action required: mint via `deft authz:grant` (operator-cli).",
+        };
+    }
+    if (grant.semantics.revokedAt !== null) {
+        return {
+            ok: false,
+            code: "closed-verb-deny-revoked",
+            reason: `Directive denied closed verb: grant ${grant.id} was revoked at ${grant.semantics.revokedAt}.`,
+        };
+    }
+    if (grant.semantics.singleUse && grant.semantics.usedAt !== null) {
+        return {
+            ok: false,
+            code: "closed-verb-deny-spent",
+            reason: `Directive denied closed verb: single-use grant ${grant.id} already spent at ${grant.semantics.usedAt}.`,
+        };
+    }
+    if (grant.semantics.expiresAt !== null) {
+        const exp = Date.parse(grant.semantics.expiresAt);
+        // Fail closed on unparseable expiresAt (malformed must not count as forever-valid).
+        if (Number.isNaN(exp) || exp <= now.getTime()) {
+            return {
+                ok: false,
+                code: "closed-verb-deny-expired",
+                reason: `Directive denied closed verb: grant ${grant.id} expired or has unparseable expiresAt ` +
+                    `(${grant.semantics.expiresAt}). Human action required: mint a fresh grant via \`deft authz:grant\`.`,
+            };
+        }
+    }
+    return { ok: true };
+}
+function resolveClassification(input) {
+    if (input.classification !== undefined)
+        return input.classification;
+    if (input.projectRoot !== null &&
+        input.projectRoot !== undefined &&
+        input.projectRoot.length > 0) {
+        return loadVerbClassification(input.projectRoot);
+    }
+    return builtinReleaseVerbClassification();
+}
+/**
+ * Closed-verb gate. Fail closed for unknown verbs and missing grants.
+ * Loads conventions/verb-classification.json when projectRoot is provided.
+ */
+export function evaluateClosedVerb(input) {
+    const table = resolveClassification(input);
+    const verbKey = sanitize(input.verb.trim().toLowerCase());
+    const row = getVerbRow(table, verbKey);
+    if (row === null) {
+        return deny("closed-verb-unknown", `Directive denied closed verb: unknown verb '${input.verb}'. ` +
+            "Known Wave 4 release-class verbs: release-cut, release-publish, release-rollback.", input);
+    }
+    const skillPointer = sanitize(`${row.skill} ${row.phase}`);
+    const envBypassKey = row.env_bypass;
+    const env = input.env ?? process.env;
+    if (envTruthy(env[envBypassKey])) {
+        return allow("closed-verb-env-bypass", `Directive allowed ${verbKey} via ephemeral env bypass ${envBypassKey}=1 ` +
+            `(precondition: ${skillPointer}).`, input, { envBypassKey, skillPointer });
+    }
+    const now = input.now ?? new Date();
+    let lastReject = null;
+    for (const grant of input.grants) {
+        // evidenceSatisfiesImplementationApproval and grantValidity both reject
+        // non-human origins; run full validity (origin + expiry + single-use + revoked).
+        if (!evidenceSatisfiesImplementationApproval({ grant })) {
+            const validity = grantValidity(grant, now);
+            lastReject = validity.ok
+                ? {
+                    code: "closed-verb-deny-origin",
+                    reason: `Directive denied closed verb: grant ${grant.id} does not satisfy human-origin ` +
+                        "implementation approval (self-authored lifecycle/dispatch tokens never count).",
+                    id: grant.id,
+                }
+                : { code: validity.code, reason: validity.reason, id: grant.id };
+            continue;
+        }
+        const validity = grantValidity(grant, now);
+        if (!validity.ok) {
+            lastReject = { code: validity.code, reason: validity.reason, id: grant.id };
+            continue;
+        }
+        if (!grantCoversOperation(grant, row.authz_operations)) {
+            lastReject = {
+                code: "closed-verb-deny-scope",
+                reason: `Directive denied closed verb: grant ${grant.id} operations ` +
+                    `[${grant.scope.operations.join(",")}] do not cover '${verbKey}' ` +
+                    `(need one of: ${row.authz_operations.join(", ")}). ` +
+                    `Human action required: \`deft authz:grant -- --template ${verbKey} --target <ver>\`.`,
+                id: grant.id,
+            };
+            continue;
+        }
+        if (!grantCoversTarget(grant, input.target, row.wildcard_allowed)) {
+            lastReject = {
+                code: "closed-verb-deny-scope",
+                reason: `Directive denied closed verb: grant ${grant.id} surfaces ` +
+                    `[${grant.scope.surfaces.join("|") || "*"}] do not cover target ` +
+                    `'${input.target ?? "(none)"}'. Human action required: remint with ` +
+                    `\`--template ${verbKey} --target ${input.target ?? "<ver>"}\`.`,
+                id: grant.id,
+            };
+            continue;
+        }
+        if (!grantContextMatches(grant, input)) {
+            lastReject = {
+                code: "closed-verb-deny-scope",
+                reason: `Directive denied closed verb: grant ${grant.id} is bound to a different ` +
+                    "repo/branch context than the attempted operation.",
+                id: grant.id,
+            };
+            continue;
+        }
+        return allow("closed-verb-allow", `Directive allowed ${verbKey}` +
+            (input.target !== null ? ` target=${input.target}` : "") +
+            ` via human-origin grant ${grant.id} (precondition: ${skillPointer}).`, input, { humanApprovalRef: grant.id, skillPointer });
+    }
+    if (lastReject !== null) {
+        return deny(lastReject.code, lastReject.reason, input, {
+            humanApprovalRef: lastReject.id ?? null,
+            envBypassKey,
+            skillPointer,
+        });
+    }
+    return deny("closed-verb-deny-missing", `Directive denied closed verb '${verbKey}'` +
+        (input.target !== null ? ` target=${input.target}` : "") +
+        `: no human-origin grant covers this verb/target and ${envBypassKey} is not set. ` +
+        `Human action required: \`deft authz:grant -- --template ${verbKey}` +
+        (input.target !== null ? ` --target ${input.target}` : " --target <ver>") +
+        `\` or set ${envBypassKey}=1 for a single-shell ephemeral bypass. ` +
+        `Skill precondition: ${skillPointer}. ` +
+        "Note: walk-away finish-loop uses `authz:grant --template finish-loop` (#871), " +
+        "not this release-class closed-verb template.", input, { envBypassKey, skillPointer });
+}
+/** Map verb name → DEFT_ALLOW_* key (from loaded/builtin table). */
+export function closedVerbEnvBypassKey(verb, projectRoot) {
+    const table = projectRoot !== null && projectRoot !== undefined && projectRoot.length > 0
+        ? loadVerbClassification(projectRoot)
+        : builtinReleaseVerbClassification();
+    const row = getVerbRow(table, verb);
+    return row?.env_bypass ?? null;
+}
+//# sourceMappingURL=closed-verb.js.map

package/dist/authz/evaluate.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Authz mutation evaluation: UAT lease + human-origin grant gates (#2944).
+ *
+ * Composes with runtimeAuthority (#1394 / #2711): this layer answers "did a
+ * human authorize this cohort/op/surface?" — not path capability policy.
+ */
+import type { AuthzDecision, AuthzOperation, AuthzState, GrantScope, HumanOriginGrant } from "./types.js";
+/** Paths that remain writable under UAT without a fix-cohort grant (evidence / defect capture). */
+export declare const UAT_SAFE_WRITE_GLOBS: readonly string[];
+export interface EvaluateAuthzInput {
+    readonly state: AuthzState;
+    readonly grants: readonly HumanOriginGrant[];
+    readonly op: AuthzOperation | "test" | "evidence" | "unknown";
+    /** Project-relative POSIX path for edit ops; null when unclassifiable. */
+    readonly path: string | null;
+    readonly now?: Date;
+    /** Optional structural context the grant may bind to. */
+    readonly repo?: string | null;
+    readonly branch?: string | null;
+    readonly worktree?: string | null;
+    readonly planRef?: string | null;
+    readonly storyIds?: readonly string[];
+    readonly issueIds?: readonly number[];
+}
+/**
+ * Evaluate a mutation under UAT lease + human-origin grants.
+ *
+ * When UAT is inactive, returns allow/authz-inactive (no new denials) so Wave 1
+ * does not break non-UAT workflows. When UAT is active, product mutations fail
+ * closed unless a named fix-cohort human-origin grant covers the op/surface.
+ * Test / evidence / issue_mutation ops stay allowed under UAT without a grant.
+ */
+export declare function evaluateAuthzMutation(input: EvaluateAuthzInput): AuthzDecision;
+/**
+ * Whether a decision should mark a single-use grant spent after allow.
+ * Callers (dispatcher) persist via markGrantUsed.
+ */
+export declare function shouldConsumeSingleUseGrant(decision: AuthzDecision): boolean;
+/** Snapshot of approved scope for audit/deny messages. */
+export declare function describeScope(scope: GrantScope | null): string;
+//# sourceMappingURL=evaluate.d.ts.map

package/dist/authz/evaluate.js

@@ -0,0 +1,298 @@
+/**
+ * Authz mutation evaluation: UAT lease + human-origin grant gates (#2944).
+ *
+ * Composes with runtimeAuthority (#1394 / #2711): this layer answers "did a
+ * human authorize this cohort/op/surface?" — not path capability policy.
+ */
+import { matchAny } from "../orchestration/pathspec.js";
+import { evidenceSatisfiesImplementationApproval, isHumanOrigin, isHumanOriginGrant, isRejectedOriginKind, } from "./origin.js";
+/** Paths that remain writable under UAT without a fix-cohort grant (evidence / defect capture). */
+export const UAT_SAFE_WRITE_GLOBS = [
+    "xbrief/proposed/**",
+    "vbrief/proposed/**",
+    "**/evidence/**",
+    "**/uat-evidence/**",
+    "incidents/**",
+];
+function deny(code, reason, input, grant = null) {
+    return {
+        allowed: false,
+        code,
+        reason,
+        humanApprovalRef: grant?.id ?? null,
+        approvedScope: grant?.scope ?? null,
+        attemptedOp: input.op,
+        path: input.path,
+    };
+}
+function allow(code, reason, input, grant = null) {
+    return {
+        allowed: true,
+        code,
+        reason,
+        humanApprovalRef: grant?.id ?? null,
+        approvedScope: grant?.scope ?? null,
+        attemptedOp: input.op,
+        path: input.path,
+    };
+}
+function activeUat(state) {
+    const uat = state.uat;
+    if (uat === null || !uat.active)
+        return null;
+    // startedBy must itself be human-origin — agent-minted UAT start is ignored.
+    if (!isHumanOrigin(uat.startedBy))
+        return null;
+    return uat;
+}
+function isUatSafeWritePath(path) {
+    if (path === null)
+        return false;
+    return matchAny(UAT_SAFE_WRITE_GLOBS, path);
+}
+function grantCoversOp(grant, op) {
+    return grant.scope.operations.includes(op);
+}
+function grantCoversSurface(grant, path) {
+    if (path === null) {
+        // Unclassifiable path: require empty surfaces (unrestricted) to allow.
+        return grant.scope.surfaces.length === 0;
+    }
+    if (grant.scope.surfaces.length === 0)
+        return true;
+    return matchAny(grant.scope.surfaces, path);
+}
+/**
+ * Structural context binding: when a grant pins a field, the attempt must supply
+ * a matching value. Missing attempt context does NOT skip the check (fail closed).
+ */
+function grantContextMatches(grant, input) {
+    const s = grant.scope;
+    if (s.repo !== null) {
+        if (input.repo === null || input.repo === undefined)
+            return false;
+        if (s.repo.toLowerCase() !== input.repo.toLowerCase())
+            return false;
+    }
+    if (s.branch !== null) {
+        if (input.branch === null || input.branch === undefined)
+            return false;
+        if (s.branch !== input.branch)
+            return false;
+    }
+    if (s.worktree !== null) {
+        if (input.worktree === null || input.worktree === undefined)
+            return false;
+        if (s.worktree !== input.worktree)
+            return false;
+    }
+    if (s.planRef !== null) {
+        if (input.planRef === null || input.planRef === undefined)
+            return false;
+        if (s.planRef !== input.planRef)
+            return false;
+    }
+    if (s.storyIds.length > 0) {
+        const attempt = input.storyIds ?? [];
+        if (attempt.length === 0)
+            return false;
+        const want = new Set(s.storyIds);
+        if (!attempt.some((id) => want.has(id)))
+            return false;
+    }
+    if (s.issueIds.length > 0) {
+        const attempt = input.issueIds ?? [];
+        if (attempt.length === 0)
+            return false;
+        const want = new Set(s.issueIds);
+        if (!attempt.some((id) => want.has(id)))
+            return false;
+    }
+    return true;
+}
+function grantValidity(grant, now) {
+    if (!isHumanOriginGrant(grant)) {
+        const kind = grant.origin.kind;
+        if (isRejectedOriginKind(kind)) {
+            return {
+                ok: false,
+                code: "authz-grant-origin-reject",
+                reason: `Directive denied this mutation: grant ${grant.id} origin.kind=${kind} is ` +
+                    "agent/self-authored and cannot satisfy an implementation-approval gate. " +
+                    "Human action required: run `deft authz:grant` (operator-cli) for the approved cohort.",
+            };
+        }
+        return {
+            ok: false,
+            code: "authz-grant-origin-reject",
+            reason: `Directive denied this mutation: grant ${grant.id} lacks human-origin provenance. ` +
+                "Human action required: mint a grant via `deft authz:grant` with operator-cli origin.",
+        };
+    }
+    if (grant.semantics.revokedAt !== null) {
+        return {
+            ok: false,
+            code: "authz-grant-revoked",
+            reason: `Directive denied this mutation: grant ${grant.id} was revoked at ${grant.semantics.revokedAt}.`,
+        };
+    }
+    if (grant.semantics.singleUse && grant.semantics.usedAt !== null) {
+        return {
+            ok: false,
+            code: "authz-grant-single-use-spent",
+            reason: `Directive denied this mutation: single-use grant ${grant.id} already spent at ${grant.semantics.usedAt}.`,
+        };
+    }
+    if (grant.semantics.expiresAt !== null) {
+        const exp = Date.parse(grant.semantics.expiresAt);
+        if (!Number.isNaN(exp) && exp <= now.getTime()) {
+            return {
+                ok: false,
+                code: "authz-grant-expired",
+                reason: `Directive denied this mutation: grant ${grant.id} expired at ${grant.semantics.expiresAt}. ` +
+                    "Human action required: mint a fresh grant via `deft authz:grant`.",
+            };
+        }
+    }
+    return { ok: true };
+}
+/**
+ * Find a live human-origin grant that structurally covers the attempted op/surface.
+ * Returns the first matching grant, or the best rejection reason if none match.
+ */
+function findCoveringGrant(input, op) {
+    const now = input.now ?? new Date();
+    let lastReject = null;
+    for (const grant of input.grants) {
+        // Production path: only human-origin grants satisfy implementation approval (#2944).
+        if (!evidenceSatisfiesImplementationApproval({ grant })) {
+            const validity = grantValidity(grant, now);
+            if (!validity.ok) {
+                lastReject = { code: validity.code, reason: validity.reason };
+                continue;
+            }
+            lastReject = {
+                code: "authz-grant-origin-reject",
+                reason: `Directive denied this mutation: grant ${grant.id} does not satisfy human-origin ` +
+                    "implementation approval (self-authored lifecycle/dispatch tokens never count). " +
+                    "Human action required: run `deft authz:grant`.",
+            };
+            continue;
+        }
+        const validity = grantValidity(grant, now);
+        if (!validity.ok) {
+            lastReject = { code: validity.code, reason: validity.reason };
+            continue;
+        }
+        // Under active UAT, product mutations require a named fix cohort.
+        if (grant.scope.cohortId === null || grant.scope.cohortId.length === 0) {
+            lastReject = {
+                code: "authz-grant-scope-deny",
+                reason: `Directive denied this mutation under active UAT: grant ${grant.id} has no named ` +
+                    "fix cohort (cohortId). Approving product changes during UAT requires a named " +
+                    "cohort via `deft authz:grant -- --cohort <id> ...`.",
+            };
+            continue;
+        }
+        if (!grantCoversOp(grant, op)) {
+            lastReject = {
+                code: "authz-grant-scope-deny",
+                reason: `Directive denied this mutation: grant ${grant.id} does not include operation ` +
+                    `'${String(op).replace(/[\r\n]/g, " ")}'. Human action required: mint/extend a grant ` +
+                    `with operations including ${String(op).replace(/[\r\n]/g, " ")} ` +
+                    `(\`deft authz:grant -- --operations ${String(op).replace(/[\r\n]/g, " ")},...\`).`,
+            };
+            continue;
+        }
+        if (op === "edit" && !grantCoversSurface(grant, input.path)) {
+            lastReject = {
+                code: "authz-grant-scope-deny",
+                reason: `Directive denied this mutation: path ${input.path ?? "(unknown)"} is outside ` +
+                    `grant ${grant.id} surfaces. Human action required: include the surface in the ` +
+                    "approved grant (`deft authz:grant -- --surfaces <glob>`).",
+            };
+            continue;
+        }
+        if (!grantContextMatches(grant, input)) {
+            lastReject = {
+                code: "authz-grant-scope-deny",
+                reason: `Directive denied this mutation: grant ${grant.id} is bound to a different ` +
+                    "repo/branch/plan/story context than the attempted operation.",
+            };
+            continue;
+        }
+        return { grant };
+    }
+    if (lastReject !== null)
+        return { grant: null, ...lastReject };
+    return {
+        grant: null,
+        code: "authz-grant-missing",
+        reason: "Directive denied this mutation: no human-origin approval grant covers the attempted " +
+            `operation '${op}'. Human action required: run \`deft authz:grant\` for the approved ` +
+            "cohort (self-authored xBRIEF/lifecycle/dispatch tokens do not count).",
+    };
+}
+/**
+ * Evaluate a mutation under UAT lease + human-origin grants.
+ *
+ * When UAT is inactive, returns allow/authz-inactive (no new denials) so Wave 1
+ * does not break non-UAT workflows. When UAT is active, product mutations fail
+ * closed unless a named fix-cohort human-origin grant covers the op/surface.
+ * Test / evidence / issue_mutation ops stay allowed under UAT without a grant.
+ */
+export function evaluateAuthzMutation(input) {
+    const uat = activeUat(input.state);
+    // Always-allowed under UAT (and outside UAT): tests, evidence, issue filing.
+    if (input.op === "test" || input.op === "evidence" || input.op === "issue_mutation") {
+        return allow(uat !== null ? "authz-allow" : "authz-inactive", uat !== null
+            ? `Directive allowed ${input.op} under active UAT campaign ${uat.campaignId}.`
+            : `Directive authz inactive; ${input.op} unrestricted by Wave 1 gates.`, input);
+    }
+    if (uat === null) {
+        // Outside UAT: Wave 1 does not require grants for every edit (that would
+        // break normal implement sessions). Self-authored evidence still never
+        // counts if a caller asks isHumanOriginGrant / evidenceSatisfies… —
+        // the hard fail-closed posture is the active UAT lease.
+        return allow("authz-inactive", "Directive authz UAT lease inactive; mutation not gated by Wave 1 UAT fail-closed path.", input);
+    }
+    // Active UAT: product mutations require a named fix-cohort human-origin grant.
+    if (input.op === "unknown") {
+        return deny("authz-uat-deny", `Directive denied unclassifiable mutation under active UAT campaign ${uat.campaignId}. ` +
+            "Fail closed: classify the operation or suspend UAT (`deft authz:uat-suspend`) / " +
+            "mint a named fix cohort (`deft authz:grant -- --cohort <id>`).", input);
+    }
+    // Safe write paths (defect capture / evidence) stay open without a cohort grant.
+    if (input.op === "edit" && isUatSafeWritePath(input.path)) {
+        return allow("authz-allow", `Directive allowed UAT-safe write to ${input.path} (evidence/defect capture) ` +
+            `under campaign ${uat.campaignId}.`, input);
+    }
+    const covered = findCoveringGrant(input, input.op);
+    if (covered.grant === null) {
+        return deny(covered.code, covered.reason.includes("active UAT")
+            ? covered.reason
+            : `${covered.reason} Active UAT campaign: ${uat.campaignId}.`, input);
+    }
+    return allow("authz-allow", `Directive allowed ${input.op} under UAT campaign ${uat.campaignId} via human-origin ` +
+        `grant ${covered.grant.id} (cohort ${covered.grant.scope.cohortId ?? "n/a"}).`, input, covered.grant);
+}
+/**
+ * Whether a decision should mark a single-use grant spent after allow.
+ * Callers (dispatcher) persist via markGrantUsed.
+ */
+export function shouldConsumeSingleUseGrant(decision) {
+    return decision.allowed && decision.humanApprovalRef !== null && decision.code === "authz-allow";
+}
+/** Snapshot of approved scope for audit/deny messages. */
+export function describeScope(scope) {
+    if (scope === null)
+        return "(none)";
+    const parts = [
+        `ops=[${scope.operations.join(",")}]`,
+        `surfaces=${scope.surfaces.length === 0 ? "*" : scope.surfaces.join("|")}`,
+        scope.cohortId === null ? null : `cohort=${scope.cohortId}`,
+        scope.planRef === null ? null : `plan=${scope.planRef}`,
+    ].filter((p) => p !== null);
+    return parts.join(" ");
+}
+//# sourceMappingURL=evaluate.js.map

package/dist/authz/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Human-origin approval grants + UAT mutation lease (#2944 Wave 1)
+ * + closed-verb release gates / AFK templates (#1095 Wave 4).
+ */
+export * from "./actions.js";
+export * from "./classify.js";
+export * from "./closed-verb.js";
+export * from "./evaluate.js";
+export * from "./origin.js";
+export * from "./paths.js";
+export * from "./store.js";
+export * from "./templates.js";
+export * from "./types.js";
+export * from "./verb-classification.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/authz/index.js

@@ -0,0 +1,15 @@
+/**
+ * Human-origin approval grants + UAT mutation lease (#2944 Wave 1)
+ * + closed-verb release gates / AFK templates (#1095 Wave 4).
+ */
+export * from "./actions.js";
+export * from "./classify.js";
+export * from "./closed-verb.js";
+export * from "./evaluate.js";
+export * from "./origin.js";
+export * from "./paths.js";
+export * from "./store.js";
+export * from "./templates.js";
+export * from "./types.js";
+export * from "./verb-classification.js";
+//# sourceMappingURL=index.js.map

package/dist/authz/origin.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Human-origin provenance predicates (#2944).
+ * Self-authored lifecycle / dispatch / xBRIEF state never counts as approval.
+ */
+import { type GrantOrigin, type HumanOriginGrant, type HumanOriginKind } from "./types.js";
+/** True when origin.kind is an accepted human-origin kind. */
+export declare function isHumanOriginKind(kind: string | null | undefined): kind is HumanOriginKind;
+/** True when origin.kind is explicitly agent/self-authored (always reject). */
+export declare function isRejectedOriginKind(kind: string | null | undefined): boolean;
+/**
+ * Structural human-origin check for a grant record.
+ * Rejects missing kind, rejected kinds, empty actor, and agent-like actors.
+ */
+export declare function isHumanOriginGrant(grant: HumanOriginGrant | null | undefined): boolean;
+export declare function isHumanOrigin(origin: GrantOrigin | null | undefined): boolean;
+/**
+ * Reject evidence shapes agents commonly invent as consent:
+ * allocation_context free-text, xBRIEF status, lifecycle flags, dispatch envelopes.
+ * These never independently satisfy an implementation-approval gate.
+ */
+export declare function evidenceSatisfiesImplementationApproval(evidence: {
+    readonly grant?: HumanOriginGrant | null;
+    readonly xbriefStatus?: string | null;
+    readonly allocationContext?: Record<string, unknown> | null;
+    readonly dispatchEnvelope?: string | null;
+    readonly lifecycleAdvancedBy?: string | null;
+}): boolean;
+//# sourceMappingURL=origin.d.ts.map