@gtrabanco/pi-agentic-workflow 0.11.1 → 0.12.0

package/README.md

@@ -103,6 +103,32 @@ The first workflow command you run after install says once that routing is
 configurable, then never again. That acknowledgement is stored in
 `~/.pi/agent/pi-agentic-workflow-state.json`, not in your config.
 
+## Path protection (optional)
+
+The Tier 2 preventive guard blocks a `write` / `edit` tool call to an existing
+protected path with no matching justification record. Its policy is the shipped
+`path-protection-policy@1` default, tightened by an optional `pathProtection`
+key in the same config files:
+
+```json
+{
+  "pathProtection": {
+    "protectedGlobs": ["secrets/**"],
+    "requirements": { "post-freeze": { "modify": "approval" } }
+  }
+}
+```
+
+The override is **tighten-only**: `protectedGlobs` are unioned with the shipped
+globs, and each `requirements` entry takes the stricter of the two — so a removal
+or a lowering is ignored (the shipped protection stays in force) and reported
+once per session as a `pi-agentic-workflow: path protection — <code>: <detail>`
+notification. `requirements` is keyed by phase state (`pre-freeze`, `post-freeze`,
+`always`) and operation (`create`, `modify`, `delete`, `rename`), with values
+`none` < `justification` < `approval`. To allow a protected edit, record the
+matching `path-protection-records@1` `justification` row in the unit's
+`decisions.md`.
+
 ## When a configured model is unavailable
 
 Default: the command **refuses to start** and tells you why — the model is not in

package/dist/config/defaults.js

@@ -1,3 +1,4 @@
+import { SHIPPED_PATH_POLICY, intersectPathPolicy } from "./path-policy.js";
 /**
  * The in-package default (SPEC S6, D-P6): a fresh install with no config file
  * anywhere routes every command on the session model, and the fail-closed
@@ -9,4 +10,5 @@ export const DEFAULT_CONFIG = {
     commands: {},
     onUnavailableRoute: "stop",
     onSettle: "keep",
+    pathProtection: intersectPathPolicy(SHIPPED_PATH_POLICY, {}),
 };

package/dist/config/load.d.ts

@@ -1,3 +1,4 @@
+import type { PathPolicyDegradation } from "./path-policy.js";
 import type { ConfigPaths, ConfigProblem, EffectiveConfig } from "./types.js";
 export declare function configFilePaths(agentDir: string, cwd: string): ConfigPaths;
 export interface LoadConfigInput {
@@ -15,5 +16,7 @@ export interface LoadedConfig {
     /** The merged configuration; the shipped default whenever `ok` is false. */
     config: EffectiveConfig;
     problems: ConfigProblem[];
+    /** The effective policy's tighten-only degradations (feature 60); empty when clean. */
+    pathProtectionDegradations: PathPolicyDegradation[];
 }
 export declare function loadConfig({ agentDir, cwd, projectTrusted, readFile }: LoadConfigInput): LoadedConfig;

package/dist/config/load.js

@@ -66,11 +66,13 @@ export function loadConfig({ agentDir, cwd, projectTrusted, readFile = readIfExi
     const problems = [];
     const globalFile = loadScope("global", paths.global, readFile, problems);
     const projectFile = projectTrusted ? loadScope("project", paths.project, readFile, problems) : {};
+    const config = problems.length === 0 ? mergeConfigs(globalFile, projectFile) : DEFAULT_CONFIG;
     return {
         ok: problems.length === 0,
         // Fail closed: a broken file hands the caller the unrouted default and the
         // problems that explain why dispatch is refused.
-        config: problems.length === 0 ? mergeConfigs(globalFile, projectFile) : DEFAULT_CONFIG,
+        config,
         problems,
+        pathProtectionDegradations: config.pathProtection.degradations,
     };
 }

package/dist/config/merge.js

@@ -1,4 +1,5 @@
 import { DEFAULT_CONFIG, DEFAULT_ROUTE } from "./defaults.js";
+import { SHIPPED_PATH_POLICY, intersectPathPolicy, mergePathProtectionOverrides } from "./path-policy.js";
 /**
  * Project-over-global merge (SPEC S5, S6).
  *
@@ -36,6 +37,7 @@ export function mergeConfigs(globalFile = {}, projectFile = {}) {
         commands,
         onUnavailableRoute: projectFile.onUnavailableRoute ?? globalFile.onUnavailableRoute ?? DEFAULT_CONFIG.onUnavailableRoute,
         onSettle: projectFile.onSettle ?? globalFile.onSettle ?? DEFAULT_CONFIG.onSettle,
+        pathProtection: intersectPathPolicy(SHIPPED_PATH_POLICY, mergePathProtectionOverrides(globalFile.pathProtection, projectFile.pathProtection)),
     };
 }
 /** The route a command runs under: its own resolved override, else the default route. */

package/dist/config/path-policy.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Pi-side path-protection policy: the shipped-default mirror (E-60-1), the
+ * tighten-only resolver (E-60-7), the record reader, and the pure Tier 2 tool
+ * call decision (E-60-5).
+ *
+ * The canonical shipped defaults live in the producer crate
+ * (`packages/agentic-workflow/src/path-policy.mjs`); this file embeds a copy
+ * whose parity is pinned by `test/path-protection.test.mjs`. The guard never
+ * weakens the shipped floor: an override may only union globs and raise a
+ * requirement, and a removal or a lowering is ignored and reported.
+ */
+export declare const PATH_POLICY_SCHEMA = "path-protection-policy@1";
+export declare const RECORDS_SCHEMA = "path-protection-records@1";
+/** Mirror of the crate's glob-length bound: a longer `protectedGlobs` entry is refused (F29). */
+export declare const PATH_GLOB_MAX_LENGTH = 512;
+export type PathRequirement = "none" | "justification" | "approval";
+export type PathOperation = "create" | "modify" | "delete" | "rename";
+export type PathPhaseState = "pre-freeze" | "post-freeze" | "always";
+export declare const REQUIREMENTS: readonly PathRequirement[];
+export declare const OPERATIONS: readonly PathOperation[];
+export declare const PHASE_STATES: readonly PathPhaseState[];
+export interface PathPolicyClass {
+    globs: string[];
+    freeze: boolean;
+}
+export type PathPolicyMatrix = Record<PathPhaseState, Record<PathOperation, PathRequirement>>;
+export interface PathPolicy {
+    schema: string;
+    classes: Record<string, PathPolicyClass>;
+    matrix: PathPolicyMatrix;
+}
+export interface PathProtectionOverride {
+    protectedGlobs?: string[];
+    requirements?: Partial<Record<PathPhaseState, Partial<Record<PathOperation, PathRequirement>>>>;
+}
+export type DegradationCode = "missing-config" | "malformed-config" | "ignored-removal" | "ignored-lowering";
+export interface PathPolicyDegradation {
+    code: DegradationCode;
+    detail: string;
+}
+export interface ResolvedPathPolicy extends PathPolicy {
+    degradations: PathPolicyDegradation[];
+}
+/** The shipped-default mirror, byte-for-byte the crate's projection. */
+export declare const SHIPPED_PATH_POLICY: PathPolicy;
+/** Convert a glob to an anchored regexp. `**` crosses `/`, `*`/`?` do not. */
+export declare function globToRegExp(glob: string): RegExp;
+/**
+ * Linear-time glob match with the same semantics as `globToRegExp` (`**` crosses
+ * `/`; `*` and `?` do not). Memoised so a star-chain glob cannot trigger the
+ * catastrophic backtracking the RegExp form suffers (F20).
+ */
+export declare function matchGlob(glob: string, target: string): boolean;
+export declare function pathMatchesGlob(target: string, glob: string): boolean;
+export declare function isProtectedPath(policy: PathPolicy, target: string): boolean;
+/** Merge two owner overrides before intersecting: globs union, requirements max. */
+export declare function mergePathProtectionOverrides(base: PathProtectionOverride | undefined, next: PathProtectionOverride | undefined): PathProtectionOverride;
+/**
+ * Tighten-only resolution (E-60-7). The shipped floor is always kept: globs
+ * union, requirements take the maximum, and a removal or a lowering appends a
+ * degradation record. When the override declares `protectedGlobs`, any shipped
+ * glob it omits is a rejected removal and is reported too.
+ */
+export declare function intersectPathPolicy(shipped: PathPolicy, override: PathProtectionOverride | undefined): ResolvedPathPolicy;
+/**
+ * Collapse `.`/`..` segments and normalise separators so equivalent spellings
+ * (`./tests/x`, `sub/../tests/x`) match the same glob. A leading `..` is kept:
+ * the caller refuses an out-of-root result before matching (E-60-5).
+ */
+export declare function normalizeTarget(target: string): string;
+/**
+ * Read the `path-protection-records@1` fenced blocks and report whether a
+ * `justification` row (authority `execute-phase`) matches `target`. A missing
+ * marker permits nothing; a malformed row voids only its own block. Every
+ * block is consulted, because the guard reads the ledgers of every unit.
+ */
+export declare function matchingJustification(target: string, recordsText: string): boolean;
+export type ToolCallGuardResult = {
+    block: false;
+} | {
+    block: true;
+    reason: string;
+};
+export interface ToolCallGuardInput {
+    toolName: string;
+    targetPath: string;
+    /** A new-file create is authoring, not modification, so it passes (E-60-5). */
+    targetExists: boolean;
+    policy: PathPolicy;
+    recordsText: string;
+}
+/**
+ * The pure Tier 2 decision: block a `write` / `edit` call to an existing
+ * protected path with no matching justification record; pass reads and
+ * new-file creates. The reason names the escape path.
+ */
+export declare function evaluateToolCall(input: ToolCallGuardInput): ToolCallGuardResult;

package/dist/config/path-policy.js

@@ -0,0 +1,301 @@
+/**
+ * Pi-side path-protection policy: the shipped-default mirror (E-60-1), the
+ * tighten-only resolver (E-60-7), the record reader, and the pure Tier 2 tool
+ * call decision (E-60-5).
+ *
+ * The canonical shipped defaults live in the producer crate
+ * (`packages/agentic-workflow/src/path-policy.mjs`); this file embeds a copy
+ * whose parity is pinned by `test/path-protection.test.mjs`. The guard never
+ * weakens the shipped floor: an override may only union globs and raise a
+ * requirement, and a removal or a lowering is ignored and reported.
+ */
+export const PATH_POLICY_SCHEMA = "path-protection-policy@1";
+export const RECORDS_SCHEMA = "path-protection-records@1";
+/** Mirror of the crate's glob-length bound: a longer `protectedGlobs` entry is refused (F29). */
+export const PATH_GLOB_MAX_LENGTH = 512;
+export const REQUIREMENTS = ["none", "justification", "approval"];
+export const OPERATIONS = ["create", "modify", "delete", "rename"];
+export const PHASE_STATES = ["pre-freeze", "post-freeze", "always"];
+/** The shipped-default mirror, byte-for-byte the crate's projection. */
+export const SHIPPED_PATH_POLICY = {
+    schema: PATH_POLICY_SCHEMA,
+    classes: {
+        tests: { globs: ["tests/**"], freeze: true },
+        e2e: { globs: ["e2e/**"], freeze: true },
+        "test-file": { globs: ["**/*.test.*"], freeze: true },
+        fixtures: { globs: ["fixtures/**", "**/fixtures/**"], freeze: true },
+        "policy-config": { globs: [".agentic-workflow/path-policy.json"], freeze: false },
+    },
+    matrix: {
+        "pre-freeze": { create: "none", modify: "justification", delete: "justification", rename: "justification" },
+        "post-freeze": { create: "justification", modify: "approval", delete: "approval", rename: "approval" },
+        always: { create: "approval", modify: "approval", delete: "approval", rename: "approval" },
+    },
+};
+function rank(requirement) {
+    return REQUIREMENTS.indexOf(requirement);
+}
+/** Convert a glob to an anchored regexp. `**` crosses `/`, `*`/`?` do not. */
+export function globToRegExp(glob) {
+    let out = "";
+    for (let index = 0; index < glob.length; index += 1) {
+        const char = glob[index];
+        if (char === "*") {
+            if (glob[index + 1] === "*") {
+                index += 1;
+                if (glob[index + 1] === "/") {
+                    index += 1;
+                    out += "(?:.*/)?";
+                }
+                else {
+                    out += ".*";
+                }
+            }
+            else {
+                out += "[^/]*";
+            }
+        }
+        else if (char === "?") {
+            out += "[^/]";
+        }
+        else {
+            out += char.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+        }
+    }
+    return new RegExp(`^${out}$`);
+}
+/**
+ * Linear-time glob match with the same semantics as `globToRegExp` (`**` crosses
+ * `/`; `*` and `?` do not). Memoised so a star-chain glob cannot trigger the
+ * catastrophic backtracking the RegExp form suffers (F20).
+ */
+export function matchGlob(glob, target) {
+    const glen = glob.length;
+    const plen = target.length;
+    const memo = new Int8Array((glen + 1) * (plen + 1)).fill(-1);
+    const at = (gi, pi) => {
+        if (gi === glen)
+            return pi === plen;
+        const key = gi * (plen + 1) + pi;
+        const cached = memo[key];
+        if (cached !== -1)
+            return cached === 1;
+        let result = false;
+        const char = glob[gi];
+        if (char === "?") {
+            result = pi < plen && target[pi] !== "/" && at(gi + 1, pi + 1);
+        }
+        else if (char === "*") {
+            if (glob[gi + 1] === "*") {
+                const after = gi + 2;
+                if (glob[after] === "/") {
+                    // `**/` matches zero or more characters ending in `/`.
+                    result = at(after + 1, pi);
+                    for (let index = pi; index < plen && !result; index += 1) {
+                        if (target[index] === "/")
+                            result = at(after + 1, index + 1);
+                    }
+                }
+                else {
+                    // `**` matches any sequence, crossing `/`.
+                    result = at(after, pi);
+                    for (let index = pi; index < plen && !result; index += 1) {
+                        result = at(after, index + 1);
+                    }
+                }
+            }
+            else {
+                // `*` matches any sequence within a path segment.
+                result = at(gi + 1, pi);
+                for (let index = pi; index < plen && !result && target[index] !== "/"; index += 1) {
+                    result = at(gi + 1, index + 1);
+                }
+            }
+        }
+        else {
+            result = pi < plen && target[pi] === char && at(gi + 1, pi + 1);
+        }
+        memo[key] = result ? 1 : 0;
+        return result;
+    };
+    return at(0, 0);
+}
+export function pathMatchesGlob(target, glob) {
+    return matchGlob(glob, target);
+}
+export function isProtectedPath(policy, target) {
+    return Object.values(policy.classes).some((cls) => cls.globs.some((glob) => pathMatchesGlob(target, glob)));
+}
+/** Merge two owner overrides before intersecting: globs union, requirements max. */
+export function mergePathProtectionOverrides(base, next) {
+    const result = {};
+    if (base?.protectedGlobs !== undefined || next?.protectedGlobs !== undefined) {
+        result.protectedGlobs = [...new Set([...(base?.protectedGlobs ?? []), ...(next?.protectedGlobs ?? [])])];
+    }
+    const requirements = {};
+    for (const state of PHASE_STATES) {
+        const row = {};
+        for (const operation of OPERATIONS) {
+            const a = base?.requirements?.[state]?.[operation];
+            const b = next?.requirements?.[state]?.[operation];
+            const best = a === undefined ? b : b === undefined ? a : rank(a) >= rank(b) ? a : b;
+            if (best !== undefined)
+                row[operation] = best;
+        }
+        if (Object.keys(row).length > 0)
+            requirements[state] = row;
+    }
+    if (Object.keys(requirements).length > 0)
+        result.requirements = requirements;
+    return result;
+}
+/**
+ * Tighten-only resolution (E-60-7). The shipped floor is always kept: globs
+ * union, requirements take the maximum, and a removal or a lowering appends a
+ * degradation record. When the override declares `protectedGlobs`, any shipped
+ * glob it omits is a rejected removal and is reported too.
+ */
+export function intersectPathPolicy(shipped, override) {
+    const degradations = [];
+    const classes = {};
+    for (const [name, cls] of Object.entries(shipped.classes)) {
+        classes[name] = { globs: [...cls.globs], freeze: cls.freeze };
+    }
+    if (override?.protectedGlobs !== undefined) {
+        for (const glob of override.protectedGlobs) {
+            if (!isProtectedGlob(classes, glob)) {
+                classes[`override:${glob}`] = { globs: [glob], freeze: true };
+            }
+        }
+        for (const cls of Object.values(shipped.classes)) {
+            for (const glob of cls.globs) {
+                if (!override.protectedGlobs.includes(glob)) {
+                    degradations.push({ code: "ignored-removal", detail: `the override omitted the shipped glob "${glob}"; kept` });
+                }
+            }
+        }
+    }
+    const matrix = {};
+    for (const state of PHASE_STATES) {
+        const row = {};
+        for (const operation of OPERATIONS) {
+            const floor = shipped.matrix[state][operation];
+            const wanted = override?.requirements?.[state]?.[operation];
+            if (wanted === undefined || rank(wanted) >= rank(floor)) {
+                row[operation] = wanted ?? floor;
+            }
+            else {
+                degradations.push({
+                    code: "ignored-lowering",
+                    detail: `matrix "${state}.${operation}" lowered to "${wanted}"; kept "${floor}"`,
+                });
+                row[operation] = floor;
+            }
+        }
+        matrix[state] = row;
+    }
+    return { schema: PATH_POLICY_SCHEMA, classes, matrix, degradations };
+}
+function isProtectedGlob(classes, glob) {
+    return Object.values(classes).some((cls) => cls.globs.includes(glob));
+}
+/**
+ * Collapse `.`/`..` segments and normalise separators so equivalent spellings
+ * (`./tests/x`, `sub/../tests/x`) match the same glob. A leading `..` is kept:
+ * the caller refuses an out-of-root result before matching (E-60-5).
+ */
+export function normalizeTarget(target) {
+    const out = [];
+    for (const part of target.replace(/\\/g, "/").split("/")) {
+        if (part === "" || part === ".")
+            continue;
+        if (part === "..") {
+            if (out.length > 0 && out[out.length - 1] !== "..")
+                out.pop();
+            else
+                out.push("..");
+            continue;
+        }
+        out.push(part);
+    }
+    return out.join("/");
+}
+/**
+ * Read the `path-protection-records@1` fenced blocks and report whether a
+ * `justification` row (authority `execute-phase`) matches `target`. A missing
+ * marker permits nothing; a malformed row voids only its own block. Every
+ * block is consulted, because the guard reads the ledgers of every unit.
+ */
+export function matchingJustification(target, recordsText) {
+    const normalized = normalizeTarget(target);
+    for (const block of recordsBlocks(recordsText)) {
+        let headerSeen = false;
+        for (const line of block) {
+            if (line === "kind | paths | phase | date | authority | justification") {
+                headerSeen = true;
+                continue;
+            }
+            if (!headerSeen)
+                continue;
+            const cells = line.split("|").map((cell) => cell.trim());
+            if (cells.length !== 6)
+                break;
+            const [kind, pathsCell, phase, date, authority, justification] = cells;
+            if (kind !== "justification" || authority !== "execute-phase")
+                continue;
+            if (!/^P\d+$/.test(phase) || !/^\d{4}-\d{2}-\d{2}$/.test(date) || justification === "")
+                continue;
+            const paths = pathsCell.split(",").map((entry) => entry.trim()).filter(Boolean);
+            if (paths.some((glob) => pathMatchesGlob(normalized, glob)))
+                return true;
+        }
+    }
+    return false;
+}
+/** Every marker-delimited block's non-empty lines, in file order. */
+function recordsBlocks(text) {
+    const lines = text.split(/\r?\n/);
+    const blocks = [];
+    let index = 0;
+    while (index < lines.length) {
+        if (lines[index].trim() !== RECORDS_SCHEMA) {
+            index += 1;
+            continue;
+        }
+        const body = [];
+        index += 1;
+        while (index < lines.length && !lines[index].trim().startsWith("```")) {
+            const trimmed = lines[index].trim();
+            if (trimmed !== "")
+                body.push(trimmed);
+            index += 1;
+        }
+        blocks.push(body);
+        index += 1;
+    }
+    return blocks;
+}
+const WRITE_TOOLS = new Set(["write", "edit"]);
+/**
+ * The pure Tier 2 decision: block a `write` / `edit` call to an existing
+ * protected path with no matching justification record; pass reads and
+ * new-file creates. The reason names the escape path.
+ */
+export function evaluateToolCall(input) {
+    if (!WRITE_TOOLS.has(input.toolName))
+        return { block: false };
+    if (!input.targetExists)
+        return { block: false };
+    const target = normalizeTarget(input.targetPath);
+    if (!isProtectedPath(input.policy, target))
+        return { block: false };
+    if (matchingJustification(target, input.recordsText))
+        return { block: false };
+    return {
+        block: true,
+        reason: `"${target}" is a protected path (path-protection policy) and no matching ` +
+            `justification record exists. Record a "${RECORDS_SCHEMA}" row ` +
+            `\`justification | ${target} | <P<n>> | <YYYY-MM-DD> | execute-phase | <reason>\` in the unit's ` +
+            `decisions.md, and for a post-freeze change ask the owner for the recorded approval the checkpoint gate requires.`,
+    };
+}

package/dist/config/schema.js

@@ -1,4 +1,5 @@
 import { MAX_MODEL_CHAIN, SETTLE_POLICIES, THINKING_LEVELS, UNAVAILABLE_ROUTE_POLICIES } from "./types.js";
+import { OPERATIONS, PATH_GLOB_MAX_LENGTH, PHASE_STATES, REQUIREMENTS } from "./path-policy.js";
 /**
  * Strict validator for one config file (SPEC S5-S8, D-E5).
  *
@@ -8,7 +9,7 @@ import { MAX_MODEL_CHAIN, SETTLE_POLICIES, THINKING_LEVELS, UNAVAILABLE_ROUTE_PO
  * strong model ran when it did not. Only a *missing* file resolves to the
  * default, and that decision belongs to the loader.
  */
-const ROOT_KEYS = new Set(["default", "commands", "onUnavailableRoute", "onSettle"]);
+const ROOT_KEYS = new Set(["default", "commands", "onUnavailableRoute", "onSettle", "pathProtection"]);
 const ROUTE_KEYS = new Set(["model", "thinking"]);
 const COMMAND_NAME = /^[a-z0-9][a-z0-9._-]*$/u;
 function isRecord(value) {
@@ -40,6 +41,63 @@ function isUnavailableRoutePolicy(value) {
 function isSettlePolicy(value) {
     return SETTLE_POLICIES.includes(value);
 }
+/** Strict validator for the optional `pathProtection` override (feature 60, AC10). */
+function checkPathProtection(value, path, issues) {
+    if (!isRecord(value)) {
+        issues.push({ path, message: "must be an object with optional protectedGlobs/requirements keys" });
+        return undefined;
+    }
+    const override = {};
+    for (const key of Object.keys(value)) {
+        if (key !== "protectedGlobs" && key !== "requirements") {
+            issues.push({ path: `${path}.${displayKey(key)}`, message: `unknown pathProtection key "${key}" (allowed: protectedGlobs, requirements)` });
+        }
+    }
+    if (value.protectedGlobs !== undefined) {
+        if (!Array.isArray(value.protectedGlobs) || value.protectedGlobs.some((glob) => typeof glob !== "string" || glob.trim() === "")) {
+            issues.push({ path: `${path}.protectedGlobs`, message: "must be an array of non-empty glob strings" });
+        }
+        else if (value.protectedGlobs.some((glob) => glob.length > PATH_GLOB_MAX_LENGTH)) {
+            issues.push({ path: `${path}.protectedGlobs`, message: `a glob must be at most ${PATH_GLOB_MAX_LENGTH} characters` });
+        }
+        else {
+            override.protectedGlobs = value.protectedGlobs;
+        }
+    }
+    if (value.requirements !== undefined) {
+        if (!isRecord(value.requirements)) {
+            issues.push({ path: `${path}.requirements`, message: "must be an object keyed by phase state" });
+        }
+        else {
+            const requirements = {};
+            for (const [state, raw] of Object.entries(value.requirements)) {
+                if (!PHASE_STATES.includes(state)) {
+                    issues.push({ path: `${path}.requirements.${displayKey(state)}`, message: `unknown phase state "${state}"` });
+                    continue;
+                }
+                if (!isRecord(raw)) {
+                    issues.push({ path: `${path}.requirements.${displayKey(state)}`, message: "must be an object keyed by operation" });
+                    continue;
+                }
+                const row = {};
+                for (const [operation, requirement] of Object.entries(raw)) {
+                    if (!OPERATIONS.includes(operation)) {
+                        issues.push({ path: `${path}.requirements.${displayKey(state)}.${displayKey(operation)}`, message: `unknown operation "${operation}"` });
+                        continue;
+                    }
+                    if (!REQUIREMENTS.includes(requirement)) {
+                        issues.push({ path: `${path}.requirements.${displayKey(state)}.${displayKey(operation)}`, message: `must be one of ${REQUIREMENTS.join(", ")}` });
+                        continue;
+                    }
+                    row[operation] = requirement;
+                }
+                requirements[state] = row;
+            }
+            override.requirements = requirements;
+        }
+    }
+    return override;
+}
 function describe(value) {
     return typeof value === "string" ? `"${value}"` : JSON.stringify(value) ?? String(value);
 }
@@ -118,7 +176,7 @@ function validateConfig(value) {
         if (!ROOT_KEYS.has(key)) {
             issues.push({
                 path: `$.${displayKey(key)}`,
-                message: `unknown config key "${key}" (allowed: default, commands, onUnavailableRoute, onSettle)`,
+                message: `unknown config key "${key}" (allowed: default, commands, onUnavailableRoute, onSettle, pathProtection)`,
             });
         }
     }
@@ -167,6 +225,11 @@ function validateConfig(value) {
             config.onSettle = value.onSettle;
         }
     }
+    if (value.pathProtection !== undefined) {
+        const override = checkPathProtection(value.pathProtection, "$.pathProtection", issues);
+        if (override)
+            config.pathProtection = override;
+    }
     return issues.length > 0 ? { ok: false, issues } : { ok: true, config };
 }
 /**

package/dist/config/types.d.ts

@@ -7,6 +7,7 @@
  *  - `EffectiveConfig` is what the extension READS after merge: every route
  *    fully resolved, so no downstream code has to reason about optionality.
  */
+import type { PathProtectionOverride, ResolvedPathPolicy } from "./path-policy.js";
 /** Pi's thinking levels, mirrored here so the domain layer stays Pi-free. */
 export declare const THINKING_LEVELS: readonly ["off", "minimal", "low", "medium", "high", "xhigh", "max"];
 export type ThinkingLevel = (typeof THINKING_LEVELS)[number];
@@ -39,6 +40,8 @@ export interface ConfigFile {
     onUnavailableRoute?: UnavailableRoutePolicy;
     /** What happens to the routed model and thinking level after the command settles. */
     onSettle?: SettlePolicy;
+    /** The tighten-only path-protection override (feature 60, AC10). */
+    pathProtection?: PathProtectionOverride;
 }
 export type UnavailableRoutePolicy = "stop" | "inherit";
 /**
@@ -60,6 +63,8 @@ export interface EffectiveConfig {
     commands: Record<string, Route>;
     onUnavailableRoute: UnavailableRoutePolicy;
     onSettle: SettlePolicy;
+    /** The effective path-protection policy: the shipped floor tightened by any override. */
+    pathProtection: ResolvedPathPolicy;
 }
 export interface ConfigProblem {
     scope: "global" | "project";