@gmickel/gno 1.27.1 → 1.29.0

package/spec/output-schemas/search-results.schema.json

@@ -6,6 +6,35 @@
   "type": "object",
   "required": ["results", "meta"],
   "$defs": {
+    "egressLineage": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["effectivePolicy", "digest", "sources"],
+      "properties": {
+        "effectivePolicy": { "enum": ["local_only", "lan", "remote"] },
+        "digest": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "sources": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 128,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["collection", "policy", "source"],
+            "properties": {
+              "collection": {
+                "type": "string",
+                "pattern": "^[a-z0-9][a-z0-9_-]{0,63}$"
+              },
+              "policy": { "enum": ["local_only", "lan", "remote"] },
+              "source": {
+                "enum": ["explicit", "config_default", "legacy_default"]
+              }
+            }
+          }
+        }
+      }
+    },
     "searchResult": {
       "type": "object",
       "required": ["docid", "score", "uri", "snippet", "source"],
@@ -54,10 +83,136 @@
           "type": "string",
           "description": "Resolved user-configured retrieval guidance, ordered from global to collection to matching path prefixes"
         },
+        "egressLineage": { "$ref": "#/$defs/egressLineage" },
         "snippet": {
           "type": "string",
           "description": "Matching text snippet from document mirror"
         },
+        "record": {
+          "type": "object",
+          "additionalProperties": false,
+          "description": "Bounded logical-record provenance for a file/export source",
+          "required": ["recordKey", "sourceLocator", "anchors", "adapter"],
+          "properties": {
+            "recordKey": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+            "sourceLocator": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 512
+            },
+            "anchors": {
+              "type": "array",
+              "maxItems": 256,
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["kind", "value"],
+                "properties": {
+                  "kind": {
+                    "enum": [
+                      "line",
+                      "cue",
+                      "timestamp",
+                      "message",
+                      "event",
+                      "record"
+                    ]
+                  },
+                  "value": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 512
+                  },
+                  "endValue": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 512
+                  }
+                }
+              }
+            },
+            "adapter": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["id", "version", "fingerprint"],
+              "properties": {
+                "id": { "type": "string", "minLength": 1, "maxLength": 128 },
+                "version": {
+                  "type": "string",
+                  "minLength": 1,
+                  "maxLength": 64
+                },
+                "fingerprint": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+              }
+            },
+            "author": { "type": "string", "maxLength": 2048 },
+            "participants": {
+              "type": "array",
+              "maxItems": 256,
+              "items": { "type": "string", "minLength": 1, "maxLength": 2048 }
+            },
+            "categories": {
+              "type": "array",
+              "maxItems": 256,
+              "items": { "type": "string", "minLength": 1, "maxLength": 512 }
+            },
+            "dateFields": {
+              "type": "object",
+              "maxProperties": 256,
+              "propertyNames": { "type": "string", "maxLength": 128 },
+              "additionalProperties": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 256
+              }
+            },
+            "messageId": { "type": "string", "maxLength": 2048 },
+            "inReplyTo": { "type": "string", "maxLength": 2048 },
+            "references": {
+              "type": "array",
+              "maxItems": 256,
+              "items": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 2048
+              }
+            },
+            "threadId": { "type": "string", "maxLength": 2048 },
+            "eventId": { "type": "string", "maxLength": 2048 },
+            "sessionId": { "type": "string", "maxLength": 2048 },
+            "attachments": {
+              "type": "array",
+              "maxItems": 256,
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["name"],
+                "properties": {
+                  "name": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 512
+                  },
+                  "mime": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 256
+                  },
+                  "bytes": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 9007199254740991
+                  },
+                  "disposition": { "enum": ["inline", "attachment"] },
+                  "sha256": {
+                    "type": "string",
+                    "pattern": "^[a-f0-9]{64}$"
+                  }
+                }
+              }
+            }
+          }
+        },
         "snippetRange": {
           "type": "object",
           "description": "Line range of snippet in mirror content",

package/spec/project-profile.schema.json

@@ -186,6 +186,72 @@
         "modelPreset": {
           "type": "string",
           "pattern": "^[a-z0-9][a-z0-9_-]{0,63}$"
+        },
+        "recordAdapters": {
+          "$ref": "#/definitions/recordAdapters"
+        }
+      }
+    },
+    "jsonPointer": {
+      "type": "string",
+      "maxLength": 512,
+      "pattern": "^(?!.*(?:^|/)(?:__proto__|constructor|prototype)(?:/|$))(?:/(?:[^~/]|~[01])*){0,32}$"
+    },
+    "fieldSelector": {
+      "oneOf": [
+        { "$ref": "#/definitions/jsonPointer" },
+        {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 8,
+          "items": { "$ref": "#/definitions/jsonPointer" }
+        }
+      ]
+    },
+    "jsonlFieldMapping": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "id": { "$ref": "#/definitions/fieldSelector" },
+        "body": { "$ref": "#/definitions/fieldSelector" },
+        "title": { "$ref": "#/definitions/fieldSelector" },
+        "author": { "$ref": "#/definitions/fieldSelector" },
+        "participants": { "$ref": "#/definitions/fieldSelector" },
+        "categories": { "$ref": "#/definitions/fieldSelector" },
+        "sessionId": { "$ref": "#/definitions/fieldSelector" },
+        "threadId": { "$ref": "#/definitions/fieldSelector" },
+        "dateFields": {
+          "type": "object",
+          "maxProperties": 16,
+          "propertyNames": {
+            "pattern": "^[a-z][a-z0-9_-]{0,63}$"
+          },
+          "additionalProperties": {
+            "$ref": "#/definitions/fieldSelector"
+          }
+        }
+      }
+    },
+    "recordAdapters": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "jsonl": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "fieldMapping": {
+              "$ref": "#/definitions/jsonlFieldMapping"
+            }
+          }
+        },
+        "transcript": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["format"],
+          "properties": {
+            "format": { "enum": ["json", "srt", "text", "vtt"] }
+          }
         }
       }
     },

package/src/app/context-format.ts

@@ -80,7 +80,7 @@ const evidenceBlock = (
   item: ContextCapsuleV1["evidence"][number]
 ): string[] => {
   const metadata = [
-    `{"title":${json(item.title)},"heading":${json(item.heading)}}`,
+    `{"title":${json(item.title)},"heading":${json(item.heading)},"record":${json(item.record ?? null)}}`,
     "configuredContexts:",
     ...configuredContextLines(capsule, item.contextIds).map((line) =>
       line.startsWith("    ") ? line.slice(4) : line

package/src/app/context-runtime-contract.ts

@@ -3,7 +3,7 @@
 import type { ContextCanonicalProjection } from "../core/context-budget";
 import type { ContextCapsuleV1 } from "../core/context-capsule";
 import type { ContextCapabilityState } from "../core/context-capsule-retrieval-schema";
-import type { ContextCapsulePayloadV1 } from "../core/context-capsule-schema";
+import type { ContextCapsulePayloadV1_1 } from "../core/context-capsule-schema";
 import type { ContextCanonicalPlanDraft } from "../core/context-compiler";
 import type { ContextEvidenceValue } from "../core/context-evidence";
 import type { NormalizedContextBuildInput } from "./context-runtime-input";
@@ -19,6 +19,7 @@ import {
   toContextCapsuleEvidence,
 } from "../core/context-evidence";
 import { canonicalVerifierJson } from "../core/context-verifier-canonical";
+import { mergeEgressLineages } from "../core/egress-provenance";
 import { resolveModelUri } from "../llm/registry";
 
 const fingerprint = (value: unknown): string =>
@@ -104,13 +105,13 @@ const capsuleCapabilities = (
   graphExpansion: states.graphExpansion.outcome === "used",
   exactTokenCount: exactTokens,
   configuredContext,
-  egressPolicy: false,
+  egressPolicy: true,
 });
 
 const capsuleFallbacks = (
   capabilities: ReturnType<typeof capsuleCapabilities>,
   states: ReturnType<typeof capsuleCapabilityStates>
-): ContextCapsulePayloadV1["fallbacks"] => [
+): ContextCapsulePayloadV1_1["fallbacks"] => [
   ...(states.semanticSearch.outcome === "unavailable"
     ? [
         {
@@ -143,12 +144,15 @@ const capsuleFallbacks = (
           capability: "token_count" as const,
         },
       ]),
-  { code: "egress_policy_unavailable", capability: "egress_policy" },
 ];
 
 export const projectContextCapsule = (
   draft: ContextCanonicalPlanDraft<ContextEvidenceValue>,
-  snapshots: { indexFingerprint: string; contextFingerprint: string },
+  snapshots: {
+    indexFingerprint: string;
+    contextFingerprint: string;
+    egressLineage: ContextCapsulePayloadV1_1["egressLineage"];
+  },
   input: NormalizedContextBuildInput,
   deps: ContextCapsuleRuntimeDeps
 ): ContextCanonicalProjection<ContextCapsuleV1> | null => {
@@ -156,6 +160,10 @@ export const projectContextCapsule = (
   const evidence = draft.selection.selected.map((candidate, index) =>
     toContextCapsuleEvidence(candidate, index + 1)
   );
+  const egressLineage = mergeEgressLineages([
+    snapshots.egressLineage,
+    ...evidence.map((item) => item.egressLineage),
+  ]);
   const evidenceIdsByFacet = new Map<string, string[]>();
   for (const item of evidence) {
     for (const facet of item.facets) {
@@ -173,7 +181,7 @@ export const projectContextCapsule = (
     draft.configuredContexts.length > 0
   );
   const base = {
-    schemaVersion: "1.0" as const,
+    schemaVersion: "1.1" as const,
     coordinateSpace: "canonical_mirror" as const,
     goal: draft.goal,
     query: draft.query,
@@ -213,7 +221,7 @@ export const projectContextCapsule = (
     },
     capabilities,
   };
-  const payload: ContextCapsulePayloadV1 = {
+  const payload: ContextCapsulePayloadV1_1 = {
     ...base,
     budget: {
       authority: "canonical_json",
@@ -246,6 +254,7 @@ export const projectContextCapsule = (
       instructionBoundary: "hard_delimited",
       configuredContexts: draft.configuredContexts,
     },
+    egressLineage,
     evidence,
     coverage: {
       complete: draft.selection.coverage.unresolvedFacets.length === 0,

package/src/cli/commands/ask.ts

@@ -165,6 +165,9 @@ export async function ask(
     }
     traceSession = traceStart.value ?? undefined;
     const llm = new LlmAdapter(config);
+    const egressCollections = options.collection
+      ? [options.collection]
+      : ("all" as const);
 
     // Resolve download policy from env/flags
     const policy = resolveDownloadPolicy(process.env, {
@@ -179,6 +182,7 @@ export async function ask(
 
     // Create embedding port
     const embedResult = await llm.createEmbeddingPort(embedUri, {
+      egressCollections,
       policy,
       onProgress: downloadProgress
         ? (progress) => downloadProgress("embed", progress)
@@ -191,6 +195,7 @@ export async function ask(
     // Create expansion port when expansion is enabled.
     if (expandUri) {
       const genResult = await llm.createExpansionPort(expandUri, {
+        egressCollections,
         policy,
         onProgress: downloadProgress
           ? (progress) => downloadProgress("expand", progress)
@@ -204,6 +209,7 @@ export async function ask(
     // Create answer generation port when answers are requested.
     if (answerUri) {
       const genResult = await llm.createGenerationPort(answerUri, {
+        egressCollections,
         policy,
         onProgress: downloadProgress
           ? (progress) => downloadProgress("gen", progress)
@@ -217,6 +223,7 @@ export async function ask(
     // Create rerank port (unless --fast or --no-rerank)
     if (rerankUri) {
       const rerankResult = await llm.createRerankPort(rerankUri, {
+        egressCollections,
         policy,
         onProgress: downloadProgress
           ? (progress) => downloadProgress("rerank", progress)

package/src/cli/commands/collection/index.ts

@@ -7,5 +7,10 @@
 export { collectionAdd } from "./add";
 export { collectionClearEmbeddings } from "./clear-embeddings";
 export { collectionList } from "./list";
+export {
+  collectionPolicyCheck,
+  collectionPolicyGet,
+  collectionPolicySet,
+} from "./policy";
 export { collectionRemove } from "./remove";
 export { collectionRename } from "./rename";

package/src/cli/commands/collection/policy.ts

@@ -0,0 +1,126 @@
+/** Collection egress policy management commands. */
+
+import type { EgressPolicy } from "../../../config/types";
+import type {
+  EgressAction,
+  EgressContentClass,
+  EgressDestinationZone,
+} from "../../../core/egress-policy";
+
+import { loadConfig } from "../../../config";
+import { projectCollectionEgressPolicy } from "../../../core/collection-egress-policy-projection";
+import { CollectionEgressPolicyService } from "../../../core/collection-egress-policy-service";
+import { applyConfigChange } from "../../../core/config-mutation";
+import { CliError } from "../../errors";
+import { initStore } from "../shared";
+
+interface PolicyOptions {
+  configPath?: string;
+  indexName?: string;
+}
+
+const writeJson = (value: unknown): void => {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+};
+
+export const collectionPolicyGet = async (
+  name: string,
+  options: PolicyOptions = {}
+): Promise<void> => {
+  const loaded = await loadConfig(options.configPath);
+  if (!loaded.ok) throw new CliError("RUNTIME", loaded.error.message);
+  const state = new CollectionEgressPolicyService({
+    getConfig: () => loaded.value,
+  }).get(name);
+  if (!state.ok) throw new CliError("VALIDATION", state.error);
+  writeJson(state.value);
+};
+
+export const collectionPolicySet = async (
+  name: string,
+  policy: EgressPolicy,
+  options: PolicyOptions & { confirmRelaxation?: string } = {}
+): Promise<void> => {
+  const initialized = await initStore({
+    configPath: options.configPath,
+    indexName: options.indexName,
+  });
+  if (!initialized.ok) throw new CliError("RUNTIME", initialized.error);
+  let config = initialized.config;
+  try {
+    const currentResult = new CollectionEgressPolicyService({
+      getConfig: () => config,
+    }).get(name);
+    const service = new CollectionEgressPolicyService({
+      getConfig: () => config,
+      mutateConfig: async (mutate) => {
+        const result = await applyConfigChange(
+          {
+            store: initialized.store,
+            configPath: initialized.actualConfigPath,
+            onConfigUpdated: (next) => {
+              config = next;
+            },
+            projectStore: (store, next) =>
+              projectCollectionEgressPolicy(store, next, name),
+          },
+          mutate
+        );
+        return result;
+      },
+    });
+    const result = await service.set({
+      collection: name,
+      policy,
+      confirmation:
+        currentResult.ok && options.confirmRelaxation
+          ? {
+              collection: currentResult.value.collection,
+              currentPolicy: currentResult.value.effectivePolicy,
+              currentRevision: Number(options.confirmRelaxation),
+              targetPolicy: policy,
+              acknowledged: true,
+            }
+          : undefined,
+    });
+    if (!result.ok) {
+      throw new CliError("VALIDATION", result.error, {
+        details: { policyCode: result.code },
+      });
+    }
+    writeJson(result.value);
+  } finally {
+    await initialized.store.close();
+  }
+};
+
+export const collectionPolicyCheck = async (
+  input: {
+    collections?: string[];
+    action: EgressAction;
+    destinationZone: EgressDestinationZone;
+    contentClass: EgressContentClass;
+    authenticated: boolean;
+    authorized: boolean;
+    partial?: boolean;
+  },
+  options: PolicyOptions = {}
+): Promise<void> => {
+  const loaded = await loadConfig(options.configPath);
+  if (!loaded.ok) throw new CliError("RUNTIME", loaded.error.message);
+  const result = new CollectionEgressPolicyService({
+    getConfig: () => loaded.value,
+  }).explain({
+    collections: input.collections,
+    action: input.action,
+    destinationZone: input.destinationZone,
+    caller: {
+      authenticated: input.authenticated,
+      operationAuthorized: input.authorized,
+    },
+    contentClass: input.contentClass,
+    partialResults: input.partial ? "explicit" : "deny",
+  });
+  if (!result.ok) throw new CliError("VALIDATION", result.error);
+  writeJson(result.value);
+};

package/src/cli/commands/context-build.ts

@@ -149,7 +149,11 @@ export const contextBuild = async (
       const progress = showProgress
         ? createThrottledProgressRenderer(createProgressRenderer())
         : undefined;
+      const egressCollections = options.collections?.length
+        ? options.collections
+        : ("all" as const);
       const embedResult = await llm.createEmbeddingPort(embedUri, {
+        egressCollections,
         policy,
         onProgress: progress ? (value) => progress("embed", value) : undefined,
       });
@@ -165,6 +169,7 @@ export const contextBuild = async (
         }
       }
       const rerankResult = await llm.createRerankPort(rerankUri, {
+        egressCollections,
         policy,
         onProgress: progress ? (value) => progress("rerank", value) : undefined,
       });

package/src/cli/commands/daemon.ts

@@ -3,6 +3,11 @@ import type { HttpGatewayOverrides } from "../../mcp/http-security";
 import type { BackgroundRuntimeResult } from "../../serve/background-runtime";
 import type { ResidentRuntime } from "../../serve/resident-runtime";
 
+import {
+  enforceCollectionEgress,
+  EGRESS_DENIED_MESSAGE,
+  EgressDeniedError,
+} from "../../core/egress-enforcement";
 import {
   DEFAULT_HTTP_GATEWAY_PORT,
   isHttpGatewayLoopbackBind,
@@ -42,6 +47,40 @@ function formatCollectionSyncSummary(result: CollectionSyncResult): string {
   return `${result.collection}: ${result.filesAdded} added, ${result.filesUpdated} updated, ${result.filesUnchanged} unchanged, ${result.filesErrored} errors`;
 }
 
+export const authorizeDaemonStatus = async (
+  runtime: ResidentRuntime,
+  gateway: Awaited<ReturnType<typeof createMcpHttpGateway>>,
+  request: Request,
+  server: Parameters<typeof gateway.route>[1]
+): Promise<Response> => {
+  const authorization = await gateway.security.authorize(request, server);
+  if (!authorization.ok) return authorization.response;
+  try {
+    enforceCollectionEgress({
+      collections: runtime.config.collections,
+      action: "serve",
+      destinationZone: authorization.value.peerClassification.zone,
+      caller: {
+        authenticated: authorization.value.authenticated,
+        operationAuthorized: true,
+      },
+      contentClass: "metadata",
+    });
+    return handleResidentStatus(() => runtime.getStatus());
+  } catch (error) {
+    if (!(error instanceof EgressDeniedError)) throw error;
+    return Response.json(
+      {
+        error: "EGRESS_DENIED",
+        message: EGRESS_DENIED_MESSAGE,
+        reason: error.decision.reason,
+        audit: error.decision.audit,
+      },
+      { status: 403 }
+    );
+  }
+};
+
 export function handleDaemonAppStatus(
   runtime: ResidentRuntime,
   host: string
@@ -161,9 +200,12 @@ export async function daemon(
             ),
         },
         "/api/resident/status": {
-          GET: () =>
-            handleResidentStatus(() =>
-              (runtime as ResidentRuntime).getStatus()
+          GET: (request, peerServer) =>
+            authorizeDaemonStatus(
+              runtime as ResidentRuntime,
+              gateway as Awaited<ReturnType<typeof createMcpHttpGateway>>,
+              request,
+              peerServer
             ),
         },
       },

package/src/cli/commands/egress-audit.ts

@@ -0,0 +1,68 @@
+/** Local, content-free egress audit management commands. */
+
+import { EgressAuditService } from "../../core/egress-audit";
+import { CliError } from "../errors";
+import { initStore } from "./shared";
+
+interface AuditOptions {
+  configPath?: string;
+  indexName?: string;
+}
+
+const run = async (
+  options: AuditOptions,
+  operation: (service: EgressAuditService) => Promise<unknown>
+): Promise<void> => {
+  const initialized = await initStore({
+    configPath: options.configPath,
+    indexName: options.indexName,
+    syncConfig: false,
+    allowEmptyCollections: true,
+  });
+  if (!initialized.ok) throw new CliError("RUNTIME", initialized.error);
+  try {
+    const result = await operation(new EgressAuditService(initialized.store));
+    if (
+      typeof result === "object" &&
+      result !== null &&
+      "ok" in result &&
+      !(result as { ok: boolean }).ok
+    ) {
+      const failure = result as {
+        ok: false;
+        error: { code: string; message: string };
+      };
+      throw new CliError("RUNTIME", failure.error.message, {
+        details: { auditCode: failure.error.code },
+      });
+    }
+    const value =
+      typeof result === "object" && result !== null && "value" in result
+        ? (result as { value: unknown }).value
+        : result;
+    process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+  } finally {
+    await initialized.store.close();
+  }
+};
+
+export const egressAuditList = (
+  input: { limit?: number; cursor?: string },
+  options: AuditOptions = {}
+): Promise<void> => run(options, (service) => service.list(input));
+
+export const egressAuditShow = (
+  auditId: string,
+  options: AuditOptions = {}
+): Promise<void> => run(options, (service) => service.show(auditId));
+
+export const egressAuditStatus = (options: AuditOptions = {}): Promise<void> =>
+  run(options, (service) => service.status());
+
+export const egressAuditDelete = (
+  auditId: string,
+  options: AuditOptions = {}
+): Promise<void> => run(options, (service) => service.delete(auditId));
+
+export const egressAuditPurge = (options: AuditOptions = {}): Promise<void> =>
+  run(options, (service) => service.purge());