@guilz-dev/belay 0.3.0 → 0.6.0

package/dist/core/standing-allow.d.ts

@@ -0,0 +1,50 @@
+import type { BelayConfigV4 } from './config.js';
+import type { GatedActionKind } from './gate-contract.js';
+import type { ClassifyResult } from './types.js';
+export type StandingAllowSource = 'provably-benign-corpus' | 'must-allow-catalog' | 'operator' | 'availability-reconfirmed';
+export interface StandingAllowEntry {
+    kind: GatedActionKind;
+    fingerprint: string;
+    source: StandingAllowSource;
+    reason: string;
+    summary?: string;
+    createdAt: string;
+    expiresAt: string;
+    repoRoot?: string;
+}
+export interface StandingAllowFile {
+    version: 1;
+    entries: StandingAllowEntry[];
+}
+export interface StandingAllowMatch {
+    source: StandingAllowSource;
+    catalogCommand?: string;
+    entryId?: string;
+}
+/** Default TTL for operator / availability-reconfirmed standing-allow entries. */
+export declare const DEFAULT_STANDING_ALLOW_TTL_MS: number;
+export declare function standingAllowFile(config: BelayConfigV4, repoLocalStateDir: string): string;
+export declare function isTier0StandingAllowBlocked(result: ClassifyResult): boolean;
+export declare function compactStandingAllow(state: StandingAllowFile, now?: number): StandingAllowFile;
+export declare function loadStandingAllow(filePath: string): Promise<StandingAllowFile>;
+export declare function saveStandingAllow(filePath: string, state: StandingAllowFile): Promise<void>;
+export declare function resolveStandingAllowMatch(params: {
+    kind: GatedActionKind;
+    result: ClassifyResult;
+    repoRoot: string;
+    state: StandingAllowFile;
+    now?: number;
+}): StandingAllowMatch | null;
+export declare function addStandingAllowEntry(state: StandingAllowFile, entry: Omit<StandingAllowEntry, 'createdAt' | 'expiresAt'> & {
+    createdAt?: string;
+    expiresAt?: string;
+    ttlMs?: number;
+}): StandingAllowFile;
+export declare function revokeStandingAllowEntry(state: StandingAllowFile, params: {
+    kind: GatedActionKind;
+    fingerprint: string;
+    repoRoot?: string;
+}): {
+    state: StandingAllowFile;
+    removed: boolean;
+};

package/dist/core/standing-allow.js

@@ -0,0 +1,178 @@
+import { existsSync } from 'node:fs';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { STANDING_ALLOW_CATALOG } from '../corpus/standing-allow-catalog.generated.js';
+import { belayStateDir } from './config.js';
+const EMPTY_STANDING_ALLOW = {
+    version: 1,
+    entries: [],
+};
+/** Default TTL for operator / availability-reconfirmed standing-allow entries. */
+export const DEFAULT_STANDING_ALLOW_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+const PROVABLY_BENIGN_COMMANDS = new Set(STANDING_ALLOW_CATALOG.shell.provablyBenign.map((entry) => entry.normalizedCommand));
+const MUST_ALLOW_COMMANDS = new Set(STANDING_ALLOW_CATALOG.shell.mustAllow.map((entry) => entry.normalizedCommand));
+/** Reasons that must never be silenced via standing-allow (defense in depth with signal checks). */
+const STANDING_ALLOW_BLOCKED_REASONS = new Set([
+    'external_effect',
+    'tier1_catastrophic',
+    'protected_artifact',
+    'pipe_to_shell',
+    'command_substitution',
+    'outside_repo_mutation',
+    'outside_repo_redirect',
+    'control_plane_mutation',
+]);
+export function standingAllowFile(config, repoLocalStateDir) {
+    return `${belayStateDir(config, repoLocalStateDir)}/standing-allow.json`;
+}
+export function isTier0StandingAllowBlocked(result) {
+    if (result.reason.startsWith('tier0_') || STANDING_ALLOW_BLOCKED_REASONS.has(result.reason)) {
+        return true;
+    }
+    const signals = result.assessment?.signals ?? [];
+    return signals.some((signal) => signal === 'tier0_external' || signal === 'tier1_catastrophic');
+}
+function isExpired(iso, now = Date.now()) {
+    const parsed = Date.parse(iso);
+    return Number.isNaN(parsed) || parsed <= now;
+}
+export function compactStandingAllow(state, now = Date.now()) {
+    return {
+        version: 1,
+        entries: state.entries.filter((entry) => !isExpired(entry.expiresAt, now)),
+    };
+}
+function sanitizeStandingAllowEntries(input) {
+    if (!Array.isArray(input)) {
+        return [];
+    }
+    return input.flatMap((entry) => {
+        if (!entry || typeof entry !== 'object') {
+            return [];
+        }
+        const record = entry;
+        if ((record.kind !== 'shell' && record.kind !== 'tool' && record.kind !== 'subagent') ||
+            typeof record.fingerprint !== 'string' ||
+            !record.fingerprint.trim() ||
+            typeof record.expiresAt !== 'string' ||
+            typeof record.createdAt !== 'string' ||
+            typeof record.reason !== 'string') {
+            return [];
+        }
+        const source = record.source;
+        if (source !== 'operator' && source !== 'availability-reconfirmed') {
+            return [];
+        }
+        return [
+            {
+                kind: record.kind,
+                fingerprint: record.fingerprint,
+                source,
+                reason: record.reason,
+                createdAt: record.createdAt,
+                expiresAt: record.expiresAt,
+                ...(typeof record.summary === 'string' ? { summary: record.summary } : {}),
+                ...(typeof record.repoRoot === 'string' ? { repoRoot: record.repoRoot } : {}),
+            },
+        ];
+    });
+}
+export async function loadStandingAllow(filePath) {
+    if (!existsSync(filePath)) {
+        return { ...EMPTY_STANDING_ALLOW };
+    }
+    const raw = JSON.parse(await readFile(filePath, 'utf8'));
+    const rawCount = Array.isArray(raw.entries) ? raw.entries.length : 0;
+    const entries = sanitizeStandingAllowEntries(raw.entries);
+    const compacted = compactStandingAllow({ version: 1, entries });
+    if (rawCount !== compacted.entries.length || entries.length !== compacted.entries.length) {
+        await saveStandingAllow(filePath, compacted);
+    }
+    return compacted;
+}
+export async function saveStandingAllow(filePath, state) {
+    await mkdir(path.dirname(filePath), { recursive: true });
+    const compacted = compactStandingAllow(state);
+    await writeFile(filePath, `${JSON.stringify(compacted, null, 2)}\n`, 'utf8');
+}
+function matchBundledCatalog(kind, normalizedCommand) {
+    if (kind !== 'shell' || !normalizedCommand) {
+        return null;
+    }
+    if (PROVABLY_BENIGN_COMMANDS.has(normalizedCommand)) {
+        return { source: 'provably-benign-corpus', catalogCommand: normalizedCommand };
+    }
+    if (MUST_ALLOW_COMMANDS.has(normalizedCommand)) {
+        return { source: 'must-allow-catalog', catalogCommand: normalizedCommand };
+    }
+    return null;
+}
+function matchStateEntry(params) {
+    const now = params.now ?? Date.now();
+    const match = params.state.entries.find((entry) => entry.kind === params.kind &&
+        entry.fingerprint === params.fingerprint &&
+        !isExpired(entry.expiresAt, now) &&
+        (entry.repoRoot === undefined || entry.repoRoot === params.repoRoot));
+    if (!match) {
+        return null;
+    }
+    return { source: match.source, entryId: match.fingerprint };
+}
+export function resolveStandingAllowMatch(params) {
+    if (params.result.verdict !== 'deny_pending_approval') {
+        return null;
+    }
+    if (isTier0StandingAllowBlocked(params.result)) {
+        return null;
+    }
+    const normalizedCommand = params.result.normalizedCommand ?? params.result.summary ?? '';
+    const catalogMatch = matchBundledCatalog(params.kind, normalizedCommand);
+    if (catalogMatch) {
+        return catalogMatch;
+    }
+    return matchStateEntry({
+        kind: params.kind,
+        fingerprint: params.result.fingerprint,
+        repoRoot: params.repoRoot,
+        state: params.state,
+        now: params.now,
+    });
+}
+export function addStandingAllowEntry(state, entry) {
+    const createdAt = entry.createdAt ?? new Date().toISOString();
+    const ttlMs = entry.ttlMs ?? DEFAULT_STANDING_ALLOW_TTL_MS;
+    const expiresAt = entry.expiresAt ?? new Date(Date.parse(createdAt) + ttlMs).toISOString();
+    const next = {
+        kind: entry.kind,
+        fingerprint: entry.fingerprint,
+        source: entry.source,
+        reason: entry.reason,
+        createdAt,
+        expiresAt,
+        ...(entry.summary ? { summary: entry.summary } : {}),
+        ...(entry.repoRoot ? { repoRoot: entry.repoRoot } : {}),
+    };
+    const filtered = state.entries.filter((existing) => !(existing.kind === next.kind &&
+        existing.fingerprint === next.fingerprint &&
+        existing.repoRoot === next.repoRoot));
+    return compactStandingAllow({
+        version: 1,
+        entries: [...filtered, next],
+    });
+}
+export function revokeStandingAllowEntry(state, params) {
+    const before = state.entries.length;
+    const entries = state.entries.filter((entry) => {
+        if (entry.kind !== params.kind || entry.fingerprint !== params.fingerprint) {
+            return true;
+        }
+        if (params.repoRoot && entry.repoRoot && entry.repoRoot !== params.repoRoot) {
+            return true;
+        }
+        return false;
+    });
+    return {
+        state: { version: 1, entries },
+        removed: entries.length < before,
+    };
+}

package/dist/core/transactional/diff-evaluator.js

@@ -51,7 +51,10 @@ export function evaluateTransactionalDiff(changes, ctx) {
         categories.add('large_deletion');
     }
     const categoryList = [...categories];
-    const dangerous = categoryList.includes('large_deletion');
+    const dangerous = categoryList.includes('large_deletion') ||
+        categoryList.includes('repo_outside') ||
+        categoryList.includes('sensitive_path') ||
+        categoryList.includes('control_plane');
     const base = {
         categories: categoryList,
         changes,

package/dist/core/transactional/eligibility.js

@@ -1,3 +1,4 @@
+import { capabilityRequestsBlockRecovery } from '../recovery/capability.js';
 const EXCLUDED_REASONS = new Set([
     'unparseable_shell',
     'external_effect',
@@ -26,6 +27,9 @@ export function isTransactionalEligible(config, kind, result) {
     if (EXCLUDED_REASONS.has(result.reason)) {
         return false;
     }
+    if (capabilityRequestsBlockRecovery(result.capabilityRequests)) {
+        return false;
+    }
     const { assessment } = result;
     if (assessment.external) {
         return false;

package/dist/core/transactional/git-worktree.d.ts

@@ -1,7 +1,12 @@
 import type { TransactionalFileChange, TransactionalSnapshot } from './types.js';
+export declare const TRANSACTIONAL_APPLY_TOCTOU = "transactional_apply_toctou";
+export declare function hashRepoFile(filePath: string): Promise<string>;
+export declare function captureRepoFileHashes(repoRoot: string, changes: TransactionalFileChange[]): Promise<Map<string, string | null>>;
 export declare function isGitWorktreeAvailable(repoRoot: string): Promise<boolean>;
-export declare function isDirtyWorktree(repoRoot: string): Promise<boolean>;
-export declare function createGitWorktreeSnapshot(repoRoot: string, stateDir: string): Promise<TransactionalSnapshot>;
+export declare function isDirtyWorktree(repoRoot: string, options?: {
+    ignoreRoots?: string[];
+}): Promise<boolean>;
+export declare function createGitWorktreeSnapshot(repoRoot: string, _stateDir: string): Promise<TransactionalSnapshot>;
 export declare function resolveWorktreeCwd(repoRoot: string, worktreePath: string, cwd: string): string;
 export interface ShellRunResult {
     exitCode: number | null;
@@ -10,4 +15,6 @@ export interface ShellRunResult {
 }
 export declare function runShellCommand(command: string, cwd: string, timeoutMs: number): Promise<ShellRunResult>;
 export declare function collectWorktreeChanges(worktreePath: string): Promise<TransactionalFileChange[]>;
-export declare function applyWorktreeChanges(worktreePath: string, repoRoot: string, changes: TransactionalFileChange[]): Promise<void>;
+export declare function applyWorktreeChanges(worktreePath: string, repoRoot: string, changes: TransactionalFileChange[], options?: {
+    baseHashes?: Map<string, string | null>;
+}): Promise<void>;

package/dist/core/transactional/git-worktree.js

@@ -1,10 +1,11 @@
 import { spawn } from 'node:child_process';
-import { randomUUID } from 'node:crypto';
+import { createHash } from 'node:crypto';
 import { existsSync } from 'node:fs';
-import { copyFile, mkdir, mkdtemp, rm } from 'node:fs/promises';
+import { copyFile, mkdir, mkdtemp, readFile, rm } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { canonicalPath } from '../path-utils.js';
+import { canonicalPath, isPathOutsideRoot, pathWithinRoot } from '../path-utils.js';
+export const TRANSACTIONAL_APPLY_TOCTOU = 'transactional_apply_toctou';
 function execGit(repoRoot, args) {
     return new Promise((resolve, reject) => {
         const child = spawn('git', ['-C', repoRoot, ...args], {
@@ -24,6 +25,38 @@ function execGit(repoRoot, args) {
         });
     });
 }
+function porcelainRelativePath(line) {
+    if (line.length < 4) {
+        return null;
+    }
+    const relativePath = line.slice(3).trim();
+    return relativePath || null;
+}
+function isIgnoredDirtyPath(repoRoot, relativePath, ignoreRoots) {
+    if (ignoreRoots.length === 0) {
+        return false;
+    }
+    const absolutePath = canonicalPath(path.join(repoRoot, relativePath));
+    return ignoreRoots.some((root) => pathWithinRoot(root, absolutePath) ||
+        root === absolutePath ||
+        pathWithinRoot(absolutePath, root));
+}
+export async function hashRepoFile(filePath) {
+    const content = await readFile(filePath);
+    return createHash('sha256').update(content).digest('hex');
+}
+export async function captureRepoFileHashes(repoRoot, changes) {
+    const hashes = new Map();
+    for (const change of changes) {
+        const target = path.join(repoRoot, change.relativePath);
+        if (!existsSync(target)) {
+            hashes.set(change.relativePath, null);
+            continue;
+        }
+        hashes.set(change.relativePath, await hashRepoFile(target));
+    }
+    return hashes;
+}
 export async function isGitWorktreeAvailable(repoRoot) {
     try {
         await execGit(repoRoot, ['rev-parse', '--git-dir']);
@@ -33,18 +66,32 @@ export async function isGitWorktreeAvailable(repoRoot) {
         return false;
     }
 }
-export async function isDirtyWorktree(repoRoot) {
+export async function isDirtyWorktree(repoRoot, options) {
     try {
-        const status = await execGit(repoRoot, ['status', '--porcelain', '--untracked-files=no']);
-        return status.trim().length > 0;
+        const status = await execGit(repoRoot, ['status', '--porcelain']);
+        const ignoreRoots = (options?.ignoreRoots ?? []).map((root) => canonicalPath(root));
+        const repoRootCanonical = canonicalPath(repoRoot);
+        for (const line of status.split('\n')) {
+            if (!line.trim()) {
+                continue;
+            }
+            const relativePath = porcelainRelativePath(line);
+            if (!relativePath) {
+                continue;
+            }
+            if (isIgnoredDirtyPath(repoRootCanonical, relativePath, ignoreRoots)) {
+                continue;
+            }
+            return true;
+        }
+        return false;
     }
     catch {
         return true;
     }
 }
-export async function createGitWorktreeSnapshot(repoRoot, stateDir) {
-    const worktreePath = path.join(stateDir, `tx-${randomUUID().replaceAll('-', '')}`);
-    await mkdir(stateDir, { recursive: true });
+export async function createGitWorktreeSnapshot(repoRoot, _stateDir) {
+    const worktreePath = await mkdtemp(path.join(os.tmpdir(), 'belay-tx-'));
     await execGit(repoRoot, ['worktree', 'add', '--detach', worktreePath, 'HEAD']);
     return {
         worktreePath,
@@ -67,7 +114,7 @@ export async function createGitWorktreeSnapshot(repoRoot, stateDir) {
 export function resolveWorktreeCwd(repoRoot, worktreePath, cwd) {
     const resolvedCwd = canonicalPath(cwd);
     const relative = path.relative(canonicalPath(repoRoot), resolvedCwd);
-    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+    if (isPathOutsideRoot(relative) || path.isAbsolute(relative)) {
         return worktreePath;
     }
     if (relative === '') {
@@ -155,7 +202,30 @@ async function rollbackAppliedChanges(actions) {
         }
     }
 }
-export async function applyWorktreeChanges(worktreePath, repoRoot, changes) {
+async function assertRepoFilesUnchanged(repoRoot, changes, baseHashes) {
+    for (const change of changes) {
+        const target = path.join(repoRoot, change.relativePath);
+        const expected = baseHashes.get(change.relativePath);
+        const exists = existsSync(target);
+        if (expected === null) {
+            if (exists) {
+                throw new Error(TRANSACTIONAL_APPLY_TOCTOU);
+            }
+            continue;
+        }
+        if (!exists) {
+            throw new Error(TRANSACTIONAL_APPLY_TOCTOU);
+        }
+        const current = await hashRepoFile(target);
+        if (current !== expected) {
+            throw new Error(TRANSACTIONAL_APPLY_TOCTOU);
+        }
+    }
+}
+export async function applyWorktreeChanges(worktreePath, repoRoot, changes, options) {
+    if (options?.baseHashes) {
+        await assertRepoFilesUnchanged(repoRoot, changes, options.baseHashes);
+    }
     const backupRoot = await mkdtemp(path.join(os.tmpdir(), 'belay-tx-rollback-'));
     const rollbackActions = [];
     try {

package/dist/core/transactional/reasons.d.ts

@@ -1,4 +1,5 @@
 export declare const TRANSACTIONAL_ALREADY_APPLIED = "transactional_already_applied";
 export declare const TRANSACTIONAL_OBSERVED_RISK = "transactional_observed_risk";
 export declare const TRANSACTIONAL_APPLY_FAILED = "transactional_apply_failed";
+export { RECOVERY_DIRTY_WORKTREE, RECOVERY_EXECUTION_FAILED, RECOVERY_SUBSTRATE_UNAVAILABLE, } from '../recovery/fail-closed.js';
 export declare const TRANSACTIONAL_APPROVAL_BYPASS_REASONS: Set<string>;

package/dist/core/transactional/reasons.js

@@ -1,8 +1,12 @@
 export const TRANSACTIONAL_ALREADY_APPLIED = 'transactional_already_applied';
 export const TRANSACTIONAL_OBSERVED_RISK = 'transactional_observed_risk';
 export const TRANSACTIONAL_APPLY_FAILED = 'transactional_apply_failed';
+export { RECOVERY_DIRTY_WORKTREE, RECOVERY_EXECUTION_FAILED, RECOVERY_SUBSTRATE_UNAVAILABLE, } from '../recovery/fail-closed.js';
 export const TRANSACTIONAL_APPROVAL_BYPASS_REASONS = new Set([
     TRANSACTIONAL_OBSERVED_RISK,
     TRANSACTIONAL_ALREADY_APPLIED,
     TRANSACTIONAL_APPLY_FAILED,
+    'recovery_substrate_unavailable',
+    'recovery_execution_failed',
+    'recovery_dirty_worktree',
 ]);

package/dist/core/transactional/runner.js

@@ -1,5 +1,7 @@
+import { boundaryMountReadOnlyFromPrediction, runWithBoundaryRunnable, } from '../capability/boundary-run.js';
+import { hostIntegrationBoundaryContext } from '../capability/boundary-session.js';
 import { evaluateTransactionalDiff } from './diff-evaluator.js';
-import { applyWorktreeChanges, collectWorktreeChanges, createGitWorktreeSnapshot, isDirtyWorktree, isGitWorktreeAvailable, resolveWorktreeCwd, runShellCommand, } from './git-worktree.js';
+import { applyWorktreeChanges, captureRepoFileHashes, collectWorktreeChanges, createGitWorktreeSnapshot, isDirtyWorktree, isGitWorktreeAvailable, resolveWorktreeCwd, TRANSACTIONAL_APPLY_TOCTOU, } from './git-worktree.js';
 import { TRANSACTIONAL_ALREADY_APPLIED, TRANSACTIONAL_APPLY_FAILED, TRANSACTIONAL_OBSERVED_RISK, } from './reasons.js';
 export async function runTransactionalExecution(params) {
     const { predicted, repoRoot, stateDir, command, cwd, timeoutMs, diffContext } = params;
@@ -12,7 +14,7 @@ export async function runTransactionalExecution(params) {
             result: predicted,
         };
     }
-    if (await isDirtyWorktree(repoRoot)) {
+    if (await isDirtyWorktree(repoRoot, { ignoreRoots: params.dirtyIgnoreRoots })) {
         return {
             ok: false,
             skipped: true,
@@ -25,7 +27,16 @@ export async function runTransactionalExecution(params) {
     try {
         snapshot = await createGitWorktreeSnapshot(repoRoot, stateDir);
         const execCwd = resolveWorktreeCwd(repoRoot, snapshot.worktreePath, cwd);
-        const shellResult = await runShellCommand(command, execCwd, timeoutMs);
+        const boundaryContext = params.boundaryContext ?? hostIntegrationBoundaryContext(params.repoRoot);
+        const shellResult = await runWithBoundaryRunnable(boundaryContext.driver, {
+            prepareContext: boundaryContext.prepareContext,
+            command,
+            cwd: execCwd,
+            timeoutMs,
+            runOptions: {
+                mountReadOnly: boundaryMountReadOnlyFromPrediction(predicted),
+            },
+        });
         if (shellResult.timedOut) {
             return {
                 ok: false,
@@ -52,10 +63,12 @@ export async function runTransactionalExecution(params) {
         const changes = await collectWorktreeChanges(snapshot.worktreePath);
         const observed = evaluateTransactionalDiff(changes, diffContext);
         if (observed.verdict === 'allow') {
+            const baseHashes = await captureRepoFileHashes(repoRoot, changes);
             try {
-                await applyWorktreeChanges(snapshot.worktreePath, repoRoot, changes);
+                await applyWorktreeChanges(snapshot.worktreePath, repoRoot, changes, { baseHashes });
             }
-            catch {
+            catch (error) {
+                const toctou = error instanceof Error && error.message === TRANSACTIONAL_APPLY_TOCTOU;
                 const result = {
                     ...predicted,
                     verdict: 'deny_pending_approval',
@@ -64,7 +77,10 @@ export async function runTransactionalExecution(params) {
                         ...observed.assessment,
                         reversibility: 'irreversible',
                         confidence: 1,
-                        signals: [...observed.assessment.signals, 'transactional_apply_failed'],
+                        signals: [
+                            ...observed.assessment.signals,
+                            toctou ? 'transactional_apply_toctou' : 'transactional_apply_failed',
+                        ],
                     },
                 };
                 return {

package/dist/core/transactional/types.d.ts

@@ -1,3 +1,4 @@
+import type { ResolvedBoundaryDriverContext } from '../capability/boundary-session.js';
 import type { Assessment, ClassifyResult, HookVerdict } from '../types.js';
 export type TransactionalFileChangeKind = 'added' | 'modified' | 'deleted';
 export interface TransactionalFileChange {
@@ -43,4 +44,7 @@ export interface TransactionalRunnerParams {
     timeoutMs: number;
     predicted: ClassifyResult;
     diffContext: TransactionalDiffContext;
+    boundaryContext?: ResolvedBoundaryDriverContext;
+    /** Repo-local Belay paths excluded from dirty-worktree gating (init artifacts). */
+    dirtyIgnoreRoots?: string[];
 }

package/dist/core/types.d.ts

@@ -1,3 +1,7 @@
+import type { BoundaryAttestation } from './capability/attestation.js';
+import type { CapabilityGrantV1 } from './capability/grant.js';
+import type { PolicyDecision } from './capability/policy-types.js';
+import type { CapabilityRequestV1 } from './capability/request.js';
 import type { FsScopeAllowlistFile } from './capability/types.js';
 export type BelayMode = 'enforce' | 'audit';
 export type HookVerdict = 'allow' | 'allow_flagged' | 'deny_pending_approval';
@@ -34,6 +38,9 @@ export interface ClassifyResult {
     normalizedCommand?: string;
     summary?: string;
     axes?: VerdictAxes;
+    capabilityRequests?: CapabilityRequestV1[];
+    authorizationDecision?: PolicyDecision;
+    boundaryProfile?: string;
 }
 export type UnknownLocalEffectPolicy = 'allow_flagged' | 'deny';
 export type UnparseableShellPolicy = 'allow_flagged' | 'deny';
@@ -67,10 +74,18 @@ export interface ClassifierOptions {
     /** When true with sandbox enabled, outside-repo rules defer to fs-scope allowlist. */
     brokerFsScope?: boolean;
     fsScopeAllowlist?: FsScopeAllowlistFile;
-    /** Test override: inject Tier1 judge without changing config.judge. */
-    tier1Judge?: import('./verdict/types.js').Tier1Judge;
+    trustedWorkspaceRoots?: string[];
     /** When false, path resolution stays fail-closed (opaque cd chains). Default: Boolean(cwd). */
     trustedCwd?: boolean;
+    grants?: CapabilityGrantV1[];
+    attestation?: BoundaryAttestation | null;
+    boundaryProfile?: string;
+    /** True when egress proxy is running and bound to this repository. */
+    egressProxyActive?: boolean;
+}
+export interface ApprovalScopeHint {
+    scope: 'workspace-root';
+    path: string;
 }
 export interface ApprovalRecord {
     approvalId: string;
@@ -87,8 +102,26 @@ export interface ApprovalRecord {
     /** Original gated input for explain-last-ask (ApprovalState v2). */
     input?: string;
     inputKind?: 'shell' | 'tool' | 'subagent';
+    /** Replay envelope: working directory when the action was gated. */
+    cwd?: string;
+    /** Replay envelope: tool name for tool/subagent actions. */
+    toolName?: string;
+    /** Replay envelope: canonical payload hash for strict replay validation. */
+    payloadHash?: string;
+    /** Replay envelope: scrubbed payload JSON for explain (size-capped at write time). */
+    payloadJson?: string;
+    /** Optional scope hint for structured capability approvals. */
+    scopeHint?: ApprovalScopeHint;
+    /** Approval state v3: normalized capability requests at ask time. */
+    capabilityRequests?: CapabilityRequestV1[];
+    /** Approval state v3: hash of capabilityRequests for replay binding. */
+    capabilityRequestHash?: string;
+    /** Approval state v3: minted grant after human approval. */
+    grant?: CapabilityGrantV1;
 }
 export interface ApprovalStateFile {
-    version: 1 | 2;
+    version: 1 | 2 | 3;
+    /** Optimistic concurrency revision (v3). */
+    revision?: number;
     approvals: ApprovalRecord[];
 }

package/dist/core/verdict/adapter.d.ts

@@ -1,15 +1,14 @@
 import type { BelayConfigV4 } from '../config.js';
 import type { ClassifierOptions, ClassifyResult } from '../types.js';
-import type { Tier1Judge, VerdictContext, VerdictResult } from './types.js';
+import type { VerdictContext, VerdictResult } from './types.js';
 export declare function resolveClassifierTrustedCwd(cwd: string, options?: Pick<ClassifierOptions, 'trustedCwd'>, explicit?: boolean): boolean;
 export declare function buildVerdictContext(params: {
     cwd: string;
     repoRoot: string;
     config: BelayConfigV4;
     options?: ClassifierOptions;
-    judge?: Tier1Judge;
     trustedCwd?: boolean;
 }): VerdictContext;
-export declare function classifyShell(command: string, cwd: string, repoRoot: string, config: BelayConfigV4, options?: ClassifierOptions, judge?: Tier1Judge): Promise<ClassifyResult>;
-export declare function verdictToClassifyResult(result: VerdictResult): ClassifyResult;
+export declare function classifyShell(command: string, cwd: string, repoRoot: string, config: BelayConfigV4, options?: ClassifierOptions): Promise<ClassifyResult>;
+export declare function verdictToClassifyResult(result: VerdictResult, config?: BelayConfigV4, options?: ClassifierOptions): ClassifyResult;
 export declare function verdictAuditFields(result: VerdictResult): Record<string, unknown>;

package/dist/core/verdict/adapter.js

@@ -1,5 +1,6 @@
+import { BOUNDARY_PROFILE_L3_L4_ONLY, resolveBoundaryProfile, } from '../capability/boundary-profile.js';
 import { judgeTraceAuditFields } from './judge-audit.js';
-import { createJudgeFromConfig } from './judge-factory.js';
+import { recordJudgeLatency } from './judge-baseline.js';
 import { verdict } from './verdict.js';
 export function resolveClassifierTrustedCwd(cwd, options, explicit) {
     if (explicit !== undefined) {
@@ -15,21 +16,27 @@ export function buildVerdictContext(params) {
     return {
         cwd: params.cwd,
         repoRoot: params.repoRoot,
+        config: params.config,
         trustedCwd: resolveClassifierTrustedCwd(params.cwd, params.options, params.trustedCwd),
+        trustedWorkspaceRoots: params.options?.trustedWorkspaceRoots ?? [],
         sensitivePaths: params.options?.sensitivePaths ?? params.config.classifier.sensitivePaths,
         protectedArtifactRoots: protectedArtifactRoots.length > 0 ? [...new Set(protectedArtifactRoots)] : undefined,
         customAllowCommands: params.options?.customAllowCommands ?? params.config.overrides.allow,
         customExternalCommands: params.options?.customExternalCommands ?? params.config.overrides.external,
-        judge: params.judge ?? params.options?.tier1Judge ?? createJudgeFromConfig(params.config),
         mode: params.config.mode,
         unknownLocalEffect: params.options?.unknownLocalEffect ?? params.config.policy.unknownLocalEffect,
         unparseableShell: params.options?.unparseableShell ?? params.config.policy.unparseableShell,
+        grants: params.options?.grants,
+        attestation: params.options?.attestation,
+        egressProxyActive: params.options?.egressProxyActive,
     };
 }
-export async function classifyShell(command, cwd, repoRoot, config, options = {}, judge) {
-    const context = buildVerdictContext({ cwd, repoRoot, config, options, judge });
+export async function classifyShell(command, cwd, repoRoot, config, options = {}) {
+    const context = buildVerdictContext({ cwd, repoRoot, config, options });
+    const started = Date.now();
     const result = await verdict(command, context);
-    return verdictToClassifyResult(result);
+    recordJudgeLatency('gate', Date.now() - started);
+    return verdictToClassifyResult(result, config, options);
 }
 function mapLegacyReason(result) {
     if (result.reason === 'repo_outside_mutation') {
@@ -62,7 +69,7 @@ function mapLegacyReason(result) {
     }
     return result.reason;
 }
-export function verdictToClassifyResult(result) {
+export function verdictToClassifyResult(result, config, options = {}) {
     const external = result.location === 'external' ||
         result.location === 'repo_outside' ||
         result.effect === 'remote_mutation';
@@ -111,6 +118,12 @@ export function verdictToClassifyResult(result) {
             signals: result.signals,
             ...judgeTraceAuditFields(result.judgeTrace),
         },
+        capabilityRequests: result.capabilityRequests,
+        authorizationDecision: result.authorizationDecision,
+        boundaryProfile: options.boundaryProfile ??
+            (config
+                ? resolveBoundaryProfile({ config, attestation: options.attestation })
+                : BOUNDARY_PROFILE_L3_L4_ONLY),
     };
 }
 export function verdictAuditFields(result) {