@guilz-dev/belay 0.3.0 → 0.6.0

package/dist/core/classify-tool.js

@@ -1,11 +1,14 @@
 import path from 'node:path';
+import { BOUNDARY_PROFILE_L3_L4_ONLY } from './capability/boundary-profile.js';
+import { policyReasonToLegacyReason } from './capability/policy-bridge.js';
+import { evaluateFileMutationPolicy, policyDecisionRequiresAsk, } from './capability/policy-engine.js';
 import { canonicalStringify, toolFingerprint } from './fingerprint.js';
 import { matchesSensitivePath } from './glob.js';
-import { pathWithinRoot, relativeWithinRepo } from './path-utils.js';
+import { pathWithinRoot, resolveWorkspaceRootMatch } from './path-utils.js';
 import { scrubValue } from './scrub.js';
 import { classifyShell, resolveClassifierTrustedCwd } from './verdict/adapter.js';
-import { mutationPrescanRequiresAsk, tier1RequiresAsk } from './verdict/judge.js';
-import { createJudgeFromConfig } from './verdict/judge-factory.js';
+import { isGitPath } from './verdict/containment.js';
+import { mutationPrescanRequiresAsk } from './verdict/prescan.js';
 const DEFAULT_SENSITIVE_PATHS = ['.env', '.env.*', '**/credentials/**'];
 const FILE_WRITE_TOOL_NAMES = new Set(['write']);
 const FILE_EDIT_TOOL_NAMES = new Set([
@@ -18,6 +21,19 @@ const FILE_EDIT_TOOL_NAMES = new Set([
 ]);
 const FILE_DELETE_TOOL_NAMES = new Set(['delete']);
 const APPLY_PATCH_TOOL_NAMES = new Set(['apply_patch', 'applypatch']);
+function policyAuth(options) {
+    if (!options.grants &&
+        options.attestation === undefined &&
+        options.egressProxyActive === undefined) {
+        return undefined;
+    }
+    return {
+        grants: options.grants,
+        attestation: options.attestation,
+        egressProxyActive: options.egressProxyActive,
+        sensitivePaths: options.sensitivePaths,
+    };
+}
 function scrubPayload(value, options) {
     return scrubValue(value, options.scrubOptions);
 }
@@ -76,25 +92,40 @@ function applyPatchTargets(patch) {
 function normalizedToolName(toolName) {
     return toolName.trim().toLowerCase();
 }
-function resolveFileTier1Judge(config, options, repoRoot) {
-    return options.tier1Judge ?? createJudgeFromConfig(config, { repoRoot });
-}
-async function classifyFileMutationWithTier1(params) {
-    const judge = resolveFileTier1Judge(params.config, params.options, params.repoRoot);
+function classifyFileMutationWithPolicy(params) {
     const trustedCwd = resolveClassifierTrustedCwd(params.cwd, params.options);
     const prescan = mutationPrescanRequiresAsk({
         targets: [params.filePath],
         cwd: params.cwd,
         repoRoot: params.repoRoot,
         trustedCwd,
+        trustedWorkspaceRoots: params.options.trustedWorkspaceRoots,
         sensitivePaths: params.options.sensitivePaths ?? params.config.classifier.sensitivePaths,
     });
     if (prescan) {
+        const fingerprint = toolFingerprint(params.toolName, { path: params.filePath }, params.repoRoot);
+        const { request, decision } = evaluateFileMutationPolicy({
+            hookKind: 'tool',
+            toolKind: params.toolKind,
+            filePath: params.filePath,
+            resolvedPath: params.resolvedPath,
+            repoRoot: params.repoRoot,
+            cwd: params.cwd,
+            inputFingerprint: fingerprint,
+            signals: [...params.signals, 'tier1_catastrophic', prescan.reason],
+            isDelete: params.isDelete,
+            locationLabel: params.locationLabel,
+            trustedWorkspaceRoots: params.options.trustedWorkspaceRoots,
+            sensitivePaths: params.options.sensitivePaths ?? params.config.classifier.sensitivePaths,
+        }, params.config, policyAuth(params.options));
+        const legacyReason = policyDecisionRequiresAsk(decision)
+            ? policyReasonToLegacyReason(decision)
+            : 'tier1_catastrophic';
         return {
             verdict: 'deny_pending_approval',
-            reason: 'tier1_catastrophic',
+            reason: legacyReason,
             summary: params.filePath,
-            fingerprint: toolFingerprint(params.toolName, { path: params.filePath }, params.repoRoot),
+            fingerprint,
             assessment: {
                 reversibility: 'irreversible',
                 external: params.locationLabel === 'outside_repo',
@@ -102,20 +133,32 @@ async function classifyFileMutationWithTier1(params) {
                     ? 'outside the repository'
                     : 'sensitive repository file',
                 confidence: 0.95,
-                signals: [...params.signals, 'tier1_catastrophic', prescan.reason],
+                signals: [...params.signals, 'tier1_catastrophic', prescan.reason, ...decision.signals],
             },
+            capabilityRequests: [request],
+            authorizationDecision: decision,
+            boundaryProfile: params.options.boundaryProfile ?? BOUNDARY_PROFILE_L3_L4_ONLY,
         };
     }
-    const tier1Text = `file_mutation: ${params.toolKind} path=${params.resolvedPath} location=${params.locationLabel}`;
-    const tier1 = await judge.evaluate({
-        text: tier1Text,
-        context: { cwd: params.cwd, repoRoot: params.repoRoot },
-    });
     const fingerprint = toolFingerprint(params.toolName, { path: params.filePath }, params.repoRoot);
-    if (tier1RequiresAsk(tier1)) {
+    const { request, decision } = evaluateFileMutationPolicy({
+        hookKind: 'tool',
+        toolKind: params.toolKind,
+        filePath: params.filePath,
+        resolvedPath: params.resolvedPath,
+        repoRoot: params.repoRoot,
+        cwd: params.cwd,
+        inputFingerprint: fingerprint,
+        signals: params.signals,
+        isDelete: params.isDelete,
+        locationLabel: params.locationLabel,
+        trustedWorkspaceRoots: params.options.trustedWorkspaceRoots,
+        sensitivePaths: params.options.sensitivePaths ?? params.config.classifier.sensitivePaths,
+    }, params.config, policyAuth(params.options));
+    if (policyDecisionRequiresAsk(decision)) {
         return {
             verdict: 'deny_pending_approval',
-            reason: 'tier1_catastrophic',
+            reason: policyReasonToLegacyReason(decision),
             summary: params.filePath,
             fingerprint,
             assessment: {
@@ -124,9 +167,12 @@ async function classifyFileMutationWithTier1(params) {
                 blastRadius: params.locationLabel === 'outside_repo'
                     ? 'outside the repository'
                     : 'sensitive repository file',
-                confidence: 0.82,
-                signals: [...params.signals, 'tier1_catastrophic', tier1.reason],
+                confidence: 0.95,
+                signals: [...params.signals, ...decision.signals],
             },
+            capabilityRequests: [request],
+            authorizationDecision: decision,
+            boundaryProfile: params.options.boundaryProfile ?? BOUNDARY_PROFILE_L3_L4_ONLY,
         };
     }
     const reason = params.isDelete ? 'file_delete' : 'file_mutation';
@@ -140,8 +186,11 @@ async function classifyFileMutationWithTier1(params) {
             external: params.locationLabel === 'outside_repo',
             blastRadius: params.locationLabel === 'outside_repo' ? 'outside the repository' : 'this repository',
             confidence: 0.72,
-            signals: [...params.signals, 'tier1_restorable', tier1.reason],
+            signals: [...params.signals, ...decision.signals],
         },
+        capabilityRequests: [request],
+        authorizationDecision: decision,
+        boundaryProfile: params.options.boundaryProfile ?? BOUNDARY_PROFILE_L3_L4_ONLY,
     };
 }
 export async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
@@ -229,24 +278,24 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
         const hitsProtectedRoot = protectedRoots.some((root) => pathWithinRoot(root, resolvedPath));
         if (hitsProtectedRoot) {
             signals.push('control_plane_path');
-            return {
-                verdict: 'deny_pending_approval',
-                reason: 'control_plane_mutation',
-                summary: filePath,
-                fingerprint: toolFingerprint(toolName, { path: filePath }, repoRoot),
-                assessment: {
-                    reversibility: 'irreversible',
-                    external: false,
-                    blastRadius: 'agent-belay control plane',
-                    confidence: 0.97,
-                    signals,
-                },
-            };
+            return classifyFileMutationWithPolicy({
+                toolName,
+                toolKind,
+                filePath,
+                resolvedPath,
+                repoRoot,
+                cwd,
+                config,
+                options,
+                signals,
+                isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
+                locationLabel: 'control_plane',
+            });
         }
-        const relativePath = relativeWithinRepo(repoRoot, resolvedPath);
-        if (relativePath === null) {
+        const workspaceMatch = resolveWorkspaceRootMatch(repoRoot, options.trustedWorkspaceRoots, resolvedPath);
+        if (workspaceMatch === null) {
             signals.push('outside_repo_path');
-            return classifyFileMutationWithTier1({
+            return classifyFileMutationWithPolicy({
                 toolName,
                 toolKind,
                 filePath,
@@ -260,9 +309,37 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
                 locationLabel: 'outside_repo',
             });
         }
+        if (workspaceMatch.kind === 'trusted') {
+            signals.push('trusted_workspace_root');
+        }
+        const trustedCwd = resolveClassifierTrustedCwd(cwd, options);
+        const workspacePrescan = mutationPrescanRequiresAsk({
+            targets: [filePath],
+            cwd,
+            repoRoot,
+            trustedCwd,
+            trustedWorkspaceRoots: options.trustedWorkspaceRoots,
+            sensitivePaths,
+        });
+        if (workspacePrescan) {
+            return classifyFileMutationWithPolicy({
+                toolName,
+                toolKind,
+                filePath,
+                resolvedPath,
+                repoRoot,
+                cwd,
+                config,
+                options,
+                signals,
+                isDelete: FILE_DELETE_TOOL_NAMES.has(toolKind),
+                locationLabel: 'sensitive_path',
+            });
+        }
+        const relativePath = workspaceMatch.relativePath;
         if (matchesSensitivePath(relativePath, sensitivePaths)) {
             signals.push('sensitive_path');
-            return classifyFileMutationWithTier1({
+            return classifyFileMutationWithPolicy({
                 toolName,
                 toolKind,
                 filePath,
@@ -277,35 +354,51 @@ export async function classifyToolUse(payload, repoRoot, cwd, config, options =
             });
         }
         if (FILE_DELETE_TOOL_NAMES.has(toolKind)) {
-            signals.push('file_delete');
-            return {
-                verdict: 'allow_flagged',
-                reason: 'file_delete',
-                summary: filePath,
-                fingerprint: toolFingerprint(toolName, { path: filePath }, repoRoot),
-                assessment: {
-                    reversibility: 'recoverable_with_cost',
-                    external: false,
-                    blastRadius: 'this repository',
-                    confidence: 0.7,
+            if (isGitPath(resolvedPath, repoRoot)) {
+                signals.push('protected_artifact');
+                return classifyFileMutationWithPolicy({
+                    toolName,
+                    toolKind,
+                    filePath,
+                    resolvedPath,
+                    repoRoot,
+                    cwd,
+                    config,
+                    options,
                     signals,
-                },
-            };
+                    isDelete: true,
+                    locationLabel: 'sensitive_path',
+                });
+            }
+            signals.push('file_delete');
+            return classifyFileMutationWithPolicy({
+                toolName,
+                toolKind,
+                filePath,
+                resolvedPath,
+                repoRoot,
+                cwd,
+                config,
+                options,
+                signals,
+                isDelete: true,
+                locationLabel: 'repo_local',
+            });
         }
         signals.push('file_mutation');
-        return {
-            verdict: 'allow_flagged',
-            reason: 'file_mutation',
-            summary: filePath,
-            fingerprint: toolFingerprint(toolName, { path: filePath }, repoRoot),
-            assessment: {
-                reversibility: 'recoverable_with_cost',
-                external: false,
-                blastRadius: 'this repository',
-                confidence: 0.68,
-                signals,
-            },
-        };
+        return classifyFileMutationWithPolicy({
+            toolName,
+            toolKind,
+            filePath,
+            resolvedPath,
+            repoRoot,
+            cwd,
+            config,
+            options,
+            signals,
+            isDelete: false,
+            locationLabel: 'repo_local',
+        });
     }
     if (APPLY_PATCH_TOOL_NAMES.has(toolKind)) {
         const patch = extractPatch(payload);

package/dist/core/config.d.ts

@@ -1,5 +1,6 @@
-import type { ClassifierOptions, ControlPlaneIntegrity, ScrubOptions, UnknownLocalEffectPolicy, UnparseableShellPolicy } from './types.js';
-export type BelayMode = 'enforce' | 'audit';
+import type { BoundaryDriverId } from './capability/attestation.js';
+import type { BelayMode, ClassifierOptions, ControlPlaneIntegrity, ScrubOptions, UnknownLocalEffectPolicy, UnparseableShellPolicy } from './types.js';
+import { type BelayJudgeRuntimeConfig } from './verdict/judge-runtime-config.js';
 export type { UnknownLocalEffectPolicy };
 export interface BelayConfigV1 {
     version: 1;
@@ -93,7 +94,10 @@ export interface JudgeCloudConsent {
     endpoint: string;
     by: string;
 }
+export type BelayJudgeMode = 'shadow' | 'off';
 export interface BelayJudgeConfig {
+    /** Gate uses PolicyEngine; judge runs async shadow/compare only. */
+    mode?: BelayJudgeMode;
     provider: JudgeProvider;
     providerId?: JudgeProviderId | DeprecatedJudgeProviderId;
     model: string;
@@ -102,6 +106,7 @@ export interface BelayJudgeConfig {
     keepAlive: string | null;
     cloudConsent?: JudgeCloudConsent;
     credential?: JudgeCredentialConfig;
+    runtime?: BelayJudgeRuntimeConfig;
 }
 export declare const DEFAULT_JUDGE_LOCAL_OLLAMA: BelayJudgeConfig;
 export declare const DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE: BelayJudgeConfig;
@@ -137,6 +142,17 @@ export interface BelayApprovalSigningConfig {
     /** When true, out-of-band approvals must present a signed token. */
     required: boolean;
 }
+export type ApprovalFlow = 'one_step' | 'two_step';
+export interface BelayApprovalAutoReplayScopes {
+    shell: boolean;
+    tool: boolean;
+    subagent: boolean;
+}
+export interface BelayApprovalConfig {
+    flow: ApprovalFlow;
+    autoReplayScopes: BelayApprovalAutoReplayScopes;
+    executionLeaseMs: number;
+}
 export interface BelayEgressConfig {
     enabled: boolean;
     listenHost: string;
@@ -144,8 +160,14 @@ export interface BelayEgressConfig {
     /** When true with egress enabled, L3 external command lists become hints only. */
     demoteL3External: boolean;
 }
+export interface BelayCapabilityConfig {
+    grantsEnabled?: boolean;
+    boundaryDriver?: BoundaryDriverId;
+    attestationRelPath?: string;
+}
+export declare const DEFAULT_CAPABILITY_V5: BelayCapabilityConfig;
 export interface BelayConfigV4 {
-    version: 4;
+    version: 4 | 5;
     adapter?: 'cursor' | 'claude' | 'codex';
     /** Where hooks/runtime/skill artifacts are installed. Defaults to project. */
     installScope?: 'project' | 'global';
@@ -160,10 +182,12 @@ export interface BelayConfigV4 {
     controlPlane: BelayControlPlaneConfig;
     notifications: BelayNotificationsConfig;
     approvalSigning: BelayApprovalSigningConfig;
+    approval: BelayApprovalConfig;
     egress: BelayEgressConfig;
     sandbox: BelaySandboxConfig;
     audit: BelayConfigV2['audit'];
     judge: BelayJudgeConfig;
+    capability?: BelayCapabilityConfig;
 }
 /** @deprecated Use BelayConfigV4 */
 export type BelayConfigV3 = BelayConfigV4;
@@ -184,6 +208,7 @@ export declare const DEFAULT_CONTROL_PLANE_V3: BelayControlPlaneConfig;
 export declare const DEFAULT_SANDBOX_V3: BelaySandboxConfig;
 export declare const DEFAULT_NOTIFICATIONS_V3: BelayNotificationsConfig;
 export declare const DEFAULT_APPROVAL_SIGNING_V3: BelayApprovalSigningConfig;
+export declare const DEFAULT_APPROVAL_CONFIG: BelayApprovalConfig;
 export declare const DEFAULT_EGRESS_V3: BelayEgressConfig;
 export declare function normalizeEgressListenHost(host: string): string;
 export declare const DEFAULT_CONFIG_V2: BelayConfigV2;
@@ -217,10 +242,14 @@ type RawConfigInput = Partial<{
     controlPlane: Partial<BelayControlPlaneConfig>;
     notifications: Partial<BelayNotificationsConfig>;
     approvalSigning: Partial<BelayApprovalSigningConfig>;
+    approval: Partial<BelayApprovalConfig> & {
+        autoReplayScopes?: Partial<BelayApprovalAutoReplayScopes>;
+    };
     egress: Partial<BelayEgressConfig>;
     sandbox: Partial<BelaySandboxConfig>;
     audit: Partial<BelayConfigV2['audit']>;
     installScope: 'project' | 'global';
+    capability: Partial<BelayCapabilityConfig>;
 }>;
 export declare function migrateConfig(loaded: unknown): BelayConfigV4;
 export declare function normalizeConfigV2(config: BelayConfigV2): BelayConfigV2;

package/dist/core/config.js

@@ -1,7 +1,9 @@
 import path from 'node:path';
 import { warnDeprecatedJudgeModelAuto } from './judge-model-policy.js';
 import { getJudgeProviderSpec, inferProviderIdFromConfig, isRemovedProviderId, normalizeLegacyProviderId, warnRemovedProviderId, } from './verdict/judge-catalog.js';
+import { normalizeJudgeRuntimeConfig, } from './verdict/judge-runtime-config.js';
 export const DEFAULT_JUDGE_LOCAL_OLLAMA = {
+    mode: 'shadow',
     provider: 'ollama',
     providerId: 'ollama',
     model: 'gemma4:e2b',
@@ -10,6 +12,7 @@ export const DEFAULT_JUDGE_LOCAL_OLLAMA = {
     keepAlive: '30m',
 };
 export const DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE = {
+    mode: 'shadow',
     provider: 'openai-compatible',
     providerId: 'codex',
     model: 'gpt-5.3-codex-high',
@@ -19,6 +22,23 @@ export const DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE = {
 };
 /** @deprecated Use DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE */
 export const DEFAULT_JUDGE_CURSOR_COMPOSER = DEFAULT_JUDGE_OPENAI_COMPATIBLE_TEMPLATE;
+export const DEFAULT_CAPABILITY_V5 = {
+    grantsEnabled: true,
+    boundaryDriver: 'host-integration',
+    attestationRelPath: '.belay/attestation.json',
+};
+function normalizeCapabilityConfig(capability) {
+    if (!capability) {
+        return undefined;
+    }
+    return {
+        ...DEFAULT_CAPABILITY_V5,
+        ...capability,
+        grantsEnabled: capability.grantsEnabled !== false,
+        boundaryDriver: capability.boundaryDriver ?? DEFAULT_CAPABILITY_V5.boundaryDriver,
+        attestationRelPath: capability.attestationRelPath ?? DEFAULT_CAPABILITY_V5.attestationRelPath,
+    };
+}
 /** Pre-v0.4 defaults preserved when migrating existing v1/v2/v3 configs. */
 import { DEFAULT_SILENT_PASS_THRESHOLD } from './audit-summary.js';
 /** @deprecated Use DEFAULT_SILENT_PASS_THRESHOLD from audit-summary.js */
@@ -95,6 +115,15 @@ export const DEFAULT_NOTIFICATIONS_V3 = {};
 export const DEFAULT_APPROVAL_SIGNING_V3 = {
     required: false,
 };
+export const DEFAULT_APPROVAL_CONFIG = {
+    flow: 'one_step',
+    autoReplayScopes: {
+        shell: true,
+        tool: false,
+        subagent: false,
+    },
+    executionLeaseMs: 60_000,
+};
 export const DEFAULT_EGRESS_V3 = {
     enabled: false,
     listenHost: '127.0.0.1',
@@ -148,6 +177,7 @@ export const DEFAULT_CONFIG_V4 = {
     controlPlane: { ...DEFAULT_CONTROL_PLANE_V3 },
     notifications: { ...DEFAULT_NOTIFICATIONS_V3 },
     approvalSigning: { ...DEFAULT_APPROVAL_SIGNING_V3 },
+    approval: { ...DEFAULT_APPROVAL_CONFIG },
     egress: { ...DEFAULT_EGRESS_V3 },
     sandbox: { ...DEFAULT_SANDBOX_V3 },
     audit: { ...DEFAULT_CONFIG_V2.audit },
@@ -190,6 +220,7 @@ export function migrateV2ToV3(v2, rawOverrides) {
         controlPlane: { ...LEGACY_CONTROL_PLANE_V3 },
         notifications: { ...DEFAULT_NOTIFICATIONS_V3 },
         approvalSigning: { ...DEFAULT_APPROVAL_SIGNING_V3 },
+        approval: { ...DEFAULT_APPROVAL_CONFIG },
         egress: { ...DEFAULT_EGRESS_V3 },
         sandbox: { ...DEFAULT_SANDBOX_V3 },
         audit: v2.audit,
@@ -210,7 +241,8 @@ export function isConfigV3(value) {
     return version === 3 || version === 4;
 }
 export function isConfigV4(value) {
-    return typeof value === 'object' && value !== null && value.version === 4;
+    const version = typeof value === 'object' && value !== null ? value.version : null;
+    return version === 4 || version === 5;
 }
 export function normalizeJudgeProvider(provider) {
     if (provider === 'anthropic') {
@@ -227,6 +259,7 @@ function defaultJudgeTemplateForProvider(provider) {
     }
     if (provider === 'anthropic') {
         return {
+            mode: 'shadow',
             provider: 'anthropic',
             providerId: 'claude',
             model: 'claude-sonnet-4-6',
@@ -271,6 +304,7 @@ export function normalizeJudgeConfig(judge) {
         const timeoutMs = typeof judge.timeoutMs === 'number' && judge.timeoutMs > 0 ? judge.timeoutMs : base.timeoutMs;
         const endpoint = typeof judge.endpoint === 'string' && judge.endpoint.trim() ? judge.endpoint.trim() : null;
         return {
+            mode: judge.mode === 'off' ? 'off' : 'shadow',
             provider,
             providerId: rawProviderId,
             model,
@@ -283,6 +317,7 @@ export function normalizeJudgeConfig(judge) {
                     : null,
             ...(judge.cloudConsent ? { cloudConsent: judge.cloudConsent } : {}),
             ...(judge.credential ? { credential: judge.credential } : {}),
+            runtime: normalizeJudgeRuntimeConfig(judge.runtime),
         };
     }
     let providerId = rawProviderId && normalizeLegacyProviderId(rawProviderId)
@@ -307,6 +342,7 @@ export function normalizeJudgeConfig(judge) {
         endpoint = catalogSpec.defaultEndpoint;
     }
     const normalized = {
+        mode: judge.mode === 'off' ? 'off' : 'shadow',
         provider,
         providerId,
         model,
@@ -333,6 +369,7 @@ export function normalizeJudgeConfig(judge) {
             ...(judge.credential.ref ? { ref: judge.credential.ref } : {}),
         };
     }
+    normalized.runtime = normalizeJudgeRuntimeConfig(judge.runtime);
     return normalized;
 }
 export function rejectTeamLayerJudgeSecrets(judge, source) {
@@ -395,6 +432,14 @@ function mergeV3FromRaw(base, raw) {
             ...base.approvalSigning,
             ...(raw.approvalSigning ?? {}),
         },
+        approval: {
+            ...base.approval,
+            ...(raw.approval ?? {}),
+            autoReplayScopes: {
+                ...base.approval.autoReplayScopes,
+                ...(raw.approval?.autoReplayScopes ?? {}),
+            },
+        },
         egress: {
             ...base.egress,
             ...(raw.egress ?? {}),
@@ -446,6 +491,14 @@ function normalizeV3Raw(raw) {
         approvalSigning: {
             required: raw.approvalSigning?.required === true,
         },
+        approval: {
+            ...DEFAULT_APPROVAL_CONFIG,
+            ...(raw.approval ?? {}),
+            autoReplayScopes: {
+                ...DEFAULT_APPROVAL_CONFIG.autoReplayScopes,
+                ...(raw.approval?.autoReplayScopes ?? {}),
+            },
+        },
         egress: {
             ...DEFAULT_EGRESS_V3,
             ...(raw.egress ?? {}),
@@ -460,6 +513,19 @@ function normalizeV3Raw(raw) {
         },
     });
 }
+function normalizeV5Raw(raw) {
+    const base = normalizeV3Raw({ ...raw, version: 4 });
+    return {
+        ...base,
+        version: 5,
+        capability: {
+            grantsEnabled: raw.capability?.grantsEnabled !== false,
+            boundaryDriver: raw.capability?.boundaryDriver ?? 'host-integration',
+            attestationRelPath: raw.capability?.attestationRelPath ?? '.belay/attestation.json',
+            ...(raw.capability ?? {}),
+        },
+    };
+}
 export function migrateConfig(loaded) {
     if (typeof loaded !== 'object' || loaded === null) {
         return { ...DEFAULT_CONFIG_V4 };
@@ -468,6 +534,9 @@ export function migrateConfig(loaded) {
     if (raw.version === 4) {
         return normalizeV3Raw(raw);
     }
+    if (raw.version === 5) {
+        return normalizeV5Raw(raw);
+    }
     if (raw.version === 3 || (raw.version === undefined && hasV3Sections(raw))) {
         return normalizeV3Raw(raw);
     }
@@ -546,8 +615,9 @@ export function normalizeConfig(config) {
         return normalizeConfigV2(config);
     }
     const v4 = config;
-    return {
-        version: 4,
+    const version = v4.version === 5 ? 5 : 4;
+    const normalized = {
+        version,
         ...(v4.installScope === 'global' || v4.installScope === 'project'
             ? { installScope: v4.installScope }
             : {}),
@@ -676,6 +746,17 @@ export function normalizeConfig(config) {
         approvalSigning: {
             required: v4.approvalSigning?.required === true,
         },
+        approval: {
+            flow: v4.approval?.flow === 'two_step' ? 'two_step' : DEFAULT_APPROVAL_CONFIG.flow,
+            autoReplayScopes: {
+                shell: v4.approval?.autoReplayScopes?.shell !== false,
+                tool: v4.approval?.autoReplayScopes?.tool === true,
+                subagent: v4.approval?.autoReplayScopes?.subagent === true,
+            },
+            executionLeaseMs: typeof v4.approval?.executionLeaseMs === 'number' && v4.approval.executionLeaseMs > 0
+                ? v4.approval.executionLeaseMs
+                : DEFAULT_APPROVAL_CONFIG.executionLeaseMs,
+        },
         egress: {
             enabled: v4.egress?.enabled === true,
             listenHost: normalizeEgressListenHost(typeof v4.egress?.listenHost === 'string' && v4.egress.listenHost.trim()
@@ -702,6 +783,10 @@ export function normalizeConfig(config) {
         },
         judge: normalizeJudgeConfig(v4.judge ?? DEFAULT_JUDGE_LOCAL_OLLAMA),
     };
+    if (version === 5 || v4.capability) {
+        normalized.capability = normalizeCapabilityConfig(v4.capability ?? DEFAULT_CAPABILITY_V5);
+    }
+    return normalized;
 }
 export function isFreshConfigInput(loaded) {
     if (loaded === null || loaded === undefined) {
@@ -752,6 +837,14 @@ export function mergeConfig(existing, defaults = DEFAULT_CONFIG_V4) {
             ...defaults.approvalSigning,
             ...migrated.approvalSigning,
         },
+        approval: {
+            ...defaults.approval,
+            ...migrated.approval,
+            autoReplayScopes: {
+                ...defaults.approval.autoReplayScopes,
+                ...migrated.approval.autoReplayScopes,
+            },
+        },
         egress: {
             ...defaults.egress,
             ...migrated.egress,
@@ -765,6 +858,15 @@ export function mergeConfig(existing, defaults = DEFAULT_CONFIG_V4) {
             ...migrated.audit,
         },
         ...(migrated.installScope ? { installScope: migrated.installScope } : {}),
+        ...(migrated.version === 5 || migrated.capability
+            ? {
+                version: migrated.version === 5 ? 5 : 4,
+                capability: normalizeCapabilityConfig({
+                    ...DEFAULT_CAPABILITY_V5,
+                    ...migrated.capability,
+                }),
+            }
+            : {}),
     });
 }
 export function scrubOptionsFromConfig(config) {

package/dist/core/gate-contract.d.ts

@@ -29,6 +29,9 @@ export interface GateVerdict extends GatePermissionResponse {
     wouldBlock: boolean;
     mode: 'enforce' | 'audit';
     axes?: ClassifyResult['axes'];
+    capabilityRequests?: ClassifyResult['capabilityRequests'];
+    authorizationDecision?: ClassifyResult['authorizationDecision'];
+    boundaryProfile?: string;
 }
 export declare function isGatedAction(value: unknown): value is GatedAction;
 export declare function classifyResultToGateVerdict(params: {

package/dist/core/gate-contract.js

@@ -26,6 +26,9 @@ export function classifyResultToGateVerdict(params) {
         user_message,
         agent_message,
         axes: result.axes,
+        capabilityRequests: result.capabilityRequests,
+        authorizationDecision: result.authorizationDecision,
+        boundaryProfile: result.boundaryProfile,
     };
 }
 export function unnormalizedGateVerdict(params) {