@guilz-dev/belay 0.3.0 → 0.6.0

package/dist/corpus/standing-allow-catalog.generated.js

@@ -0,0 +1,99 @@
+export const STANDING_ALLOW_CATALOG = {
+    version: 1,
+    shell: {
+        provablyBenign: [
+            {
+                command: 'git status',
+                normalizedCommand: 'git status',
+                runtimeKey: '37e6be21e63e6268ee6e4212ad811f6f48ab3c3c10ce1b971c1a90d92c753a2a',
+            },
+            {
+                command: 'git branch',
+                normalizedCommand: 'git branch',
+                runtimeKey: 'd7f8388c566e751503ab82ba1ed22787389803eb32d8b5f2294cc7ca448fa285',
+            },
+            {
+                command: 'git branch --show-current',
+                normalizedCommand: 'git branch --show-current',
+                runtimeKey: '98d585412d3cd7c3b5a87a417d91bc36d7b6791e11451b52ced7888e003d9d33',
+            },
+            {
+                command: 'rg plan src',
+                normalizedCommand: 'rg plan src',
+                runtimeKey: '68ae7a96158719235d9314da7b00a5f8b2f40668e5d4f7f02e91f22284140a68',
+            },
+            {
+                command: 'ls -la',
+                normalizedCommand: 'ls -la',
+                runtimeKey: '3a665991b52b5f18069889960b957ea37b087859c23e2c87b76ef8d2a1b338fe',
+            },
+            {
+                command: "find . -name '*.ts'",
+                normalizedCommand: "find . -name '*.ts'",
+                runtimeKey: '782298e3015fcb9c17bee2dad12a395a8859043481f93f0ca596499028bb8af2',
+            },
+            {
+                command: 'git -C /workspace/project status',
+                normalizedCommand: 'git -C /workspace/project status',
+                runtimeKey: '9f88bd017c52277f5dbfeafec7d845460035a7a14bfb37b55724d7e2a9fc238b',
+            },
+            {
+                command: 'git show-ref --heads',
+                normalizedCommand: 'git show-ref --heads',
+                runtimeKey: 'aa5aa0106dc7647003f254524becbf549673610d3672f28408ac0f60481124b7',
+            },
+            {
+                command: 'git reflog -5',
+                normalizedCommand: 'git reflog -5',
+                runtimeKey: '9213a9357953c24886a4e82c2c8cdc6db2d106c7ff98af525f7fbc2b70a58ff9',
+            },
+            {
+                command: 'grep -R pattern src',
+                normalizedCommand: 'grep -R pattern src',
+                runtimeKey: '40f5e0328e668909241aa0cd13ce2a51af269aa7ae600cc493dceae7b90dd9d8',
+            },
+            {
+                command: 'jq . package.json',
+                normalizedCommand: 'jq . package.json',
+                runtimeKey: 'dd7b14d350b84a41e0e73eae0d1a643c1b6c262df8d9007696987354f4f993e9',
+            },
+        ],
+        mustAllow: [
+            {
+                command: 'npm test',
+                normalizedCommand: 'npm test',
+                runtimeKey: '1bcafcfef8e1b0138297885032c5e222c4aed19bdcde00e2539aa397fdc877cb',
+            },
+            {
+                command: 'npm run build',
+                normalizedCommand: 'npm run build',
+                runtimeKey: '3138d8a3e9afb60574e29d16c2967f70bb42475e02eadb261f5f2340f376c188',
+            },
+            {
+                command: 'pnpm test',
+                normalizedCommand: 'pnpm test',
+                runtimeKey: 'eaecc988be421de36044932e32d4be807e45baccaa94c2d29d30a34204656551',
+            },
+            {
+                command: 'pnpm build',
+                normalizedCommand: 'pnpm build',
+                runtimeKey: 'a1ec94b6b1f7f17ab0fe468e41c6dc59e04266d34772abcaa9538123601cb46d',
+            },
+            {
+                command: 'pnpm vitest run src/example.test.ts',
+                normalizedCommand: 'pnpm vitest run src/example.test.ts',
+                runtimeKey: '011e12e902154e7cf598f390fc08a50e885b34893deb97d242cf7470e23e617e',
+            },
+            {
+                command: "bash -lc 'git status'",
+                normalizedCommand: "bash -lc 'git status'",
+                runtimeKey: 'dbcc63715f4a8cca2aff988470bb1d52a4841542af9c86776ff2414509508a1f',
+            },
+            {
+                command: 'belay approve belay_deadbeef1234',
+                normalizedCommand: 'belay approve belay_deadbeef1234',
+                runtimeKey: 'bb3f0f1dac3d6c4ef79e17ef4e36f9430195596490bb736cdb8b25a5944d6f81',
+            },
+        ],
+    },
+};

package/dist/corpus/types.d.ts

@@ -0,0 +1,47 @@
+import type { HookVerdict } from '../core/types.js';
+/** Action kinds in labeled corpus fixtures. Only `shell` is populated today. */
+export declare const CORPUS_ACTION_KINDS: readonly ["shell"];
+export type CorpusActionKind = (typeof CORPUS_ACTION_KINDS)[number];
+/**
+ * Corpus safety labels.
+ *
+ * - `must-ask`: irreversible or catastrophic — must never be silently allowed (hard gate).
+ * - `provably-benign`: structurally benign — must never be blocked (hard gate).
+ * - `accepted-benign`: operator-reviewed benign — not a hard gate; may graduate to
+ *   `provably-benign` after evidence review.
+ */
+export declare const CORPUS_CATEGORIES: readonly ["must-ask", "provably-benign", "accepted-benign"];
+export type CorpusCategory = (typeof CORPUS_CATEGORIES)[number];
+export declare const CORPUS_PROVENANCE_SOURCES: readonly ["manual", "mutation", "harvest", "redteam"];
+export type CorpusProvenanceSource = (typeof CORPUS_PROVENANCE_SOURCES)[number];
+export interface CorpusProvenance {
+    source: CorpusProvenanceSource;
+    sourceBatchId?: string;
+    sourceCaseId?: string;
+    reviewedBy?: string;
+    reviewedAt?: string;
+}
+export interface CorpusCase {
+    /** Fixture action kind. Reserved for future tool/subagent corpora. */
+    kind: CorpusActionKind;
+    category: CorpusCategory;
+    command: string;
+    verdict: HookVerdict;
+    reason?: string;
+    /**
+     * Stable runtime-facing key for `provably-benign` shell cases (verdict fingerprint).
+     * Offline fixtures may omit this; loaders derive it via `deriveShellCorpusRuntimeKey`.
+     * Consumed by future standing-allow / catalog code — not used by evaluation harness alone.
+     */
+    runtimeKey?: string;
+    /** Optional case origin metadata for quality-loop ratchet and harvest audit. */
+    provenance?: CorpusProvenance;
+}
+export declare class CorpusSchemaError extends Error {
+    constructor(message: string);
+}
+export declare function parseCorpusCases(raw: unknown): CorpusCase[];
+export declare function countByCategory(cases: CorpusCase[]): Record<CorpusCategory, number>;
+export type CorpusProvenanceCounts = Record<CorpusProvenanceSource | 'unspecified', number>;
+/** Count corpus cases by provenance.source; missing provenance counts as unspecified (legacy manual). */
+export declare function countProvenanceBySource(cases: CorpusCase[]): CorpusProvenanceCounts;

package/dist/corpus/types.js

@@ -0,0 +1,157 @@
+/** Action kinds in labeled corpus fixtures. Only `shell` is populated today. */
+export const CORPUS_ACTION_KINDS = ['shell'];
+/**
+ * Corpus safety labels.
+ *
+ * - `must-ask`: irreversible or catastrophic — must never be silently allowed (hard gate).
+ * - `provably-benign`: structurally benign — must never be blocked (hard gate).
+ * - `accepted-benign`: operator-reviewed benign — not a hard gate; may graduate to
+ *   `provably-benign` after evidence review.
+ */
+export const CORPUS_CATEGORIES = ['must-ask', 'provably-benign', 'accepted-benign'];
+export const CORPUS_PROVENANCE_SOURCES = ['manual', 'mutation', 'harvest', 'redteam'];
+export class CorpusSchemaError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CorpusSchemaError';
+    }
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function parseActionKind(value, index) {
+    if (value !== 'shell') {
+        throw new CorpusSchemaError(`case[${index}].kind must be "shell" (got ${JSON.stringify(value)})`);
+    }
+    return value;
+}
+function parseCategory(value, index) {
+    if (value !== 'must-ask' && value !== 'provably-benign' && value !== 'accepted-benign') {
+        throw new CorpusSchemaError(`case[${index}].category must be must-ask | provably-benign | accepted-benign (got ${JSON.stringify(value)})`);
+    }
+    return value;
+}
+function parseVerdict(value, index) {
+    if (value !== 'allow' && value !== 'allow_flagged' && value !== 'deny_pending_approval') {
+        throw new CorpusSchemaError(`case[${index}].verdict is invalid: ${JSON.stringify(value)}`);
+    }
+    return value;
+}
+function assertCategoryVerdictConsistency(category, verdict, index) {
+    if (category === 'must-ask' && verdict !== 'deny_pending_approval') {
+        throw new CorpusSchemaError(`case[${index}]: must-ask requires verdict deny_pending_approval (got ${verdict})`);
+    }
+    if (category === 'provably-benign' && verdict !== 'allow') {
+        throw new CorpusSchemaError(`case[${index}]: provably-benign requires verdict allow (got ${verdict})`);
+    }
+    if (category === 'accepted-benign' && verdict !== 'allow_flagged') {
+        throw new CorpusSchemaError(`case[${index}]: accepted-benign requires verdict allow_flagged (got ${verdict})`);
+    }
+}
+function parseProvenance(value, index) {
+    if (!isRecord(value)) {
+        throw new CorpusSchemaError(`case[${index}].provenance must be an object`);
+    }
+    const source = value.source;
+    if (source !== 'manual' &&
+        source !== 'mutation' &&
+        source !== 'harvest' &&
+        source !== 'redteam') {
+        throw new CorpusSchemaError(`case[${index}].provenance.source must be manual | mutation | harvest | redteam (got ${JSON.stringify(source)})`);
+    }
+    const provenance = { source };
+    if (value.sourceBatchId !== undefined) {
+        if (typeof value.sourceBatchId !== 'string' || value.sourceBatchId.trim() === '') {
+            throw new CorpusSchemaError(`case[${index}].provenance.sourceBatchId must be a non-empty string`);
+        }
+        provenance.sourceBatchId = value.sourceBatchId;
+    }
+    if (value.sourceCaseId !== undefined) {
+        if (typeof value.sourceCaseId !== 'string' || value.sourceCaseId.trim() === '') {
+            throw new CorpusSchemaError(`case[${index}].provenance.sourceCaseId must be a non-empty string`);
+        }
+        provenance.sourceCaseId = value.sourceCaseId;
+    }
+    if (value.reviewedBy !== undefined) {
+        if (typeof value.reviewedBy !== 'string' || value.reviewedBy.trim() === '') {
+            throw new CorpusSchemaError(`case[${index}].provenance.reviewedBy must be a non-empty string`);
+        }
+        provenance.reviewedBy = value.reviewedBy;
+    }
+    if (value.reviewedAt !== undefined) {
+        if (typeof value.reviewedAt !== 'string' || value.reviewedAt.trim() === '') {
+            throw new CorpusSchemaError(`case[${index}].provenance.reviewedAt must be a non-empty string`);
+        }
+        provenance.reviewedAt = value.reviewedAt;
+    }
+    return provenance;
+}
+export function parseCorpusCases(raw) {
+    if (!Array.isArray(raw)) {
+        throw new CorpusSchemaError('corpus must be a JSON array');
+    }
+    return raw.map((entry, index) => {
+        if (!isRecord(entry)) {
+            throw new CorpusSchemaError(`case[${index}] must be an object`);
+        }
+        const kind = parseActionKind(entry.kind, index);
+        const category = parseCategory(entry.category, index);
+        const command = entry.command;
+        if (typeof command !== 'string' || command.trim() === '') {
+            throw new CorpusSchemaError(`case[${index}].command must be a non-empty string`);
+        }
+        const verdict = parseVerdict(entry.verdict, index);
+        assertCategoryVerdictConsistency(category, verdict, index);
+        const testCase = { kind, category, command, verdict };
+        if (entry.reason !== undefined) {
+            if (typeof entry.reason !== 'string') {
+                throw new CorpusSchemaError(`case[${index}].reason must be a string`);
+            }
+            testCase.reason = entry.reason;
+        }
+        if (entry.runtimeKey !== undefined) {
+            if (typeof entry.runtimeKey !== 'string' || entry.runtimeKey.trim() === '') {
+                throw new CorpusSchemaError(`case[${index}].runtimeKey must be a non-empty string`);
+            }
+            if (category !== 'provably-benign') {
+                throw new CorpusSchemaError(`case[${index}].runtimeKey is only valid for provably-benign cases`);
+            }
+            testCase.runtimeKey = entry.runtimeKey;
+        }
+        if (entry.provenance !== undefined) {
+            testCase.provenance = parseProvenance(entry.provenance, index);
+        }
+        return testCase;
+    });
+}
+export function countByCategory(cases) {
+    const counts = {
+        'must-ask': 0,
+        'provably-benign': 0,
+        'accepted-benign': 0,
+    };
+    for (const testCase of cases) {
+        counts[testCase.category] += 1;
+    }
+    return counts;
+}
+/** Count corpus cases by provenance.source; missing provenance counts as unspecified (legacy manual). */
+export function countProvenanceBySource(cases) {
+    const counts = {
+        manual: 0,
+        mutation: 0,
+        harvest: 0,
+        redteam: 0,
+        unspecified: 0,
+    };
+    for (const testCase of cases) {
+        const source = testCase.provenance?.source;
+        if (!source) {
+            counts.unspecified += 1;
+        }
+        else {
+            counts[source] += 1;
+        }
+    }
+    return counts;
+}

package/dist/installer.js

@@ -11,6 +11,7 @@ import { appendCliAuditEvent } from './core/audit-io.js';
 import { isFreshConfigInput, mergeConfig, normalizeConfig, } from './core/config.js';
 import { runtimeIntegrityFiles, writeIntegrityManifest } from './core/integrity.js';
 import { hasValidCloudConsent, isCloudJudgeConfig, migrateImplicitLocalJudgeIfNeeded, resolveInitJudgeConfig, } from './core/judge-config.js';
+import { resolveJudgeTransport } from './core/judge-runtime-detection.js';
 import { bootstrapStateFiles, writeSkillArtifacts } from './installer/bootstrap.js';
 import { writeRuntimeArtifacts } from './installer/runtime-artifacts.js';
 import { applyInstallScope, resolveOperationScope } from './installer/scope-config.js';
@@ -154,7 +155,9 @@ async function applyInitJudgeConfig(repoRoot, adapterName, options, isFreshBefor
         };
     }
     const configWithJudge = normalizeConfig({ ...mergedConfig, version: 4, judge: finalJudge });
-    if (isCloudJudgeConfig(configWithJudge.judge) && !hasValidCloudConsent(configWithJudge.judge)) {
+    if (isCloudJudgeConfig(configWithJudge.judge) &&
+        resolveJudgeTransport(configWithJudge.judge) === 'http' &&
+        !hasValidCloudConsent(configWithJudge.judge)) {
         process.stderr.write('Warning: Cloud judge saved without recorded consent. Tier1 cloud judge will fail closed until consent is granted (belay judge consent + belay approve, or TTY --accept-cloud-judge).\n');
     }
     await writeConfigFile(repoRoot, configWithJudge, adapterName);

package/dist/judge-broker-daemon.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/judge-broker-daemon.js

@@ -0,0 +1,137 @@
+import { mkdir, readFile, unlink, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:net';
+import path from 'node:path';
+import { CursorAcpJudgeRunner } from './core/verdict/cursor-acp-client.js';
+import { cleanupJudgeBrokerArtifacts, JUDGE_BROKER_SESSION, judgeBrokerPaths, } from './core/verdict/judge-broker-service.js';
+import { runCliJsonWithTimeouts } from './core/verdict/judge-cli.js';
+import { DEFAULT_JUDGE_SESSION_CONFIG, normalizeJudgeSessionConfig, resolveSessionEvalTimeoutMs, } from './core/verdict/judge-runtime-config.js';
+import { JudgeSessionBroker, } from './core/verdict/judge-session-broker.js';
+async function loadBrokerSessionConfig(stateDir) {
+    const sessionConfigPath = path.join(stateDir, JUDGE_BROKER_SESSION);
+    try {
+        const raw = JSON.parse(await readFile(sessionConfigPath, 'utf8'));
+        return normalizeJudgeSessionConfig({ ...raw, enabled: true });
+    }
+    catch {
+        return normalizeJudgeSessionConfig({ ...DEFAULT_JUDGE_SESSION_CONFIG, enabled: true });
+    }
+}
+async function main() {
+    const repoRoot = process.env.BELAY_JUDGE_BROKER_REPO_ROOT;
+    const stateDir = process.env.BELAY_JUDGE_BROKER_STATE_DIR;
+    if (!repoRoot || !stateDir) {
+        process.stderr.write('BELAY_JUDGE_BROKER_REPO_ROOT and BELAY_JUDGE_BROKER_STATE_DIR are required.\n');
+        process.exitCode = 1;
+        return;
+    }
+    const paths = judgeBrokerPaths(stateDir);
+    await mkdir(stateDir, { recursive: true, mode: 0o700 });
+    const sessionConfig = await loadBrokerSessionConfig(stateDir);
+    const defaultEvalTimeoutMs = resolveSessionEvalTimeoutMs(sessionConfig, 25_000);
+    const judgeWorkspace = path.join(stateDir, 'judge-workspace');
+    await mkdir(judgeWorkspace, { recursive: true, mode: 0o700 });
+    const cursorAcp = new CursorAcpJudgeRunner({
+        cwd: judgeWorkspace,
+        connectTimeoutMs: sessionConfig.connectTimeoutMs,
+    });
+    const broker = new JudgeSessionBroker({
+        config: sessionConfig,
+        runCommand: (invocation, timeoutMs) => {
+            if (invocation.binary === 'cursor-agent') {
+                return cursorAcp.run(invocation, timeoutMs);
+            }
+            return runCliJsonWithTimeouts(invocation, { evalTimeoutMs: timeoutMs });
+        },
+        extractResumeId: (providerId) => (providerId === 'cursor' ? cursorAcp.sessionId : null),
+    });
+    let idleTimer = null;
+    let server;
+    const scheduleIdleShutdown = () => {
+        if (idleTimer) {
+            clearTimeout(idleTimer);
+        }
+        idleTimer = setTimeout(() => {
+            void shutdown('idle_timeout');
+        }, sessionConfig.maxIdleMs);
+    };
+    const shutdown = async (reason) => {
+        broker.stopAll('manual_stop');
+        await cursorAcp.stop();
+        server?.close();
+        await cleanupJudgeBrokerArtifacts(paths);
+        process.stderr.write(`judge broker stopped (${reason})\n`);
+        process.exit(0);
+    };
+    server = createServer((socket) => {
+        scheduleIdleShutdown();
+        let buffer = '';
+        socket.on('data', (chunk) => {
+            buffer += String(chunk);
+            const lines = buffer.split('\n');
+            buffer = lines.pop() ?? '';
+            for (const line of lines) {
+                if (!line.trim()) {
+                    continue;
+                }
+                void handleLine(line, socket, broker, defaultEvalTimeoutMs).catch((error) => {
+                    const id = safeMessageId(line);
+                    socket.write(`${JSON.stringify({
+                        type: 'error',
+                        id,
+                        error: error instanceof Error ? error.message : 'judge broker handler failed',
+                    })}\n`);
+                });
+            }
+        });
+    });
+    await unlink(paths.socketPath).catch(() => undefined);
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(paths.socketPath, () => resolve());
+    });
+    const status = {
+        pid: process.pid,
+        repoRoot: path.resolve(repoRoot),
+        socketPath: paths.socketPath,
+        startedAt: new Date().toISOString(),
+    };
+    await writeFile(paths.statusPath, JSON.stringify(status), { encoding: 'utf8', mode: 0o600 });
+    await writeFile(paths.pidPath, String(process.pid), { encoding: 'utf8', mode: 0o600 });
+    process.on('SIGTERM', () => {
+        void shutdown('sigterm');
+    });
+    process.on('SIGINT', () => {
+        void shutdown('sigint');
+    });
+    scheduleIdleShutdown();
+    process.stdout.write(`judge broker listening on ${paths.socketPath} for ${repoRoot}\n`);
+}
+function safeMessageId(line) {
+    try {
+        const parsed = JSON.parse(line);
+        return parsed.id ?? 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+async function handleLine(line, socket, broker, defaultEvalTimeoutMs) {
+    const message = JSON.parse(line);
+    if (message.type === 'stop') {
+        socket.write(`${JSON.stringify({ type: 'stopped', id: message.id })}\n`);
+        broker.stopAll('manual_stop');
+        return;
+    }
+    if (message.type === 'invalidate' && typeof message.sessionKey === 'string') {
+        broker.invalidateSession(message.sessionKey, message.reason ?? 'parse_failure');
+        socket.write(`${JSON.stringify({ type: 'invalidated', id: message.id })}\n`);
+        return;
+    }
+    if (message.type !== 'evaluate' || !message.request) {
+        socket.write(`${JSON.stringify({ type: 'error', id: message.id, error: 'unsupported message' })}\n`);
+        return;
+    }
+    const result = await broker.evaluate(message.request, message.timeoutMs ?? defaultEvalTimeoutMs);
+    socket.write(`${JSON.stringify({ type: 'result', id: message.id, result })}\n`);
+}
+await main();

package/dist/services/sandbox-service.d.ts

@@ -1,4 +1,5 @@
 import { loadConfigFile } from '../config-io.js';
+import { evaluateGuaranteePosture } from '../conformance/guarantee-posture.js';
 export interface SandboxServiceOptions {
     targetDir?: string;
 }
@@ -12,6 +13,7 @@ export interface SandboxStatusReport {
     controlPlaneIsolationMode: string;
     controlPlaneIsolationOk: boolean;
     l1FullActive: boolean;
+    guaranteePosture: ReturnType<typeof evaluateGuaranteePosture>;
     l1Full: {
         sandbox: boolean;
         egress: boolean;
@@ -20,10 +22,13 @@ export interface SandboxStatusReport {
         approvalSigningRequired: boolean;
     };
     issues: string[];
+    /** Quality-loop ratchet hints — do not affect sandbox status exit code. */
+    advisories: string[];
 }
 export declare function sandboxStatus(options?: SandboxServiceOptions): Promise<SandboxStatusReport>;
 export declare function createCapabilityApprovalStore(repoRoot: string, config: Awaited<ReturnType<typeof loadConfigFile>>): {
     allowlistPath: string;
+    trustedRootsPath: string;
     loadPending(): Promise<{
         filePath: string;
         state: import("../types.js").ApprovalStateFile;

package/dist/services/sandbox-service.js

@@ -1,8 +1,13 @@
 import path from 'node:path';
 import { loadConfigFile, repoLocalStateDirFor } from '../config-io.js';
+import { evaluateGuaranteePosture } from '../conformance/guarantee-posture.js';
 import { fsScopeAllowlistPath, loadFsScopeAllowlist } from '../core/capability/allowlist.js';
+import { boundaryAttestationPath, loadBoundaryAttestation, } from '../core/capability/boundary-session.js';
 import { evaluateL1FullStatus, isCapabilityBrokerDemotionActive, } from '../core/capability/broker.js';
-import { configuredControlPlaneDir } from '../core/config.js';
+import { evaluateGateLatencyRatchetAdvisories } from '../core/capability/gate-latency-ratchet.js';
+import { loadShadowRatchetWarnings } from '../core/capability/gate-shadow-ratchet.js';
+import { trustedWorkspaceRootsPath } from '../core/capability/trusted-workspace-roots.js';
+import { belayStateDir, configuredControlPlaneDir } from '../core/config.js';
 import { verifyControlPlaneIsolation } from '../core/control-plane-isolation.js';
 import { egressStatus } from './egress-service.js';
 export async function sandboxStatus(options = {}) {
@@ -13,10 +18,18 @@ export async function sandboxStatus(options = {}) {
     const allowlist = await loadFsScopeAllowlist(allowlistPath);
     const egress = await egressStatus({ targetDir: repoRoot });
     const isolation = verifyControlPlaneIsolation(configuredControlPlaneDir(config), config.controlPlane.isolation);
+    const egressProxyRunning = egress.running && !egress.foreignProxy && !egress.repoRootMismatch;
     const l1Full = evaluateL1FullStatus({
         config,
-        egressProxyRunning: egress.running && !egress.foreignProxy && !egress.repoRootMismatch,
+        egressProxyRunning,
     });
+    const attestation = await loadBoundaryAttestation(boundaryAttestationPath(repoRoot, config), repoRoot, configuredControlPlaneDir(config));
+    const guaranteePosture = evaluateGuaranteePosture({
+        config,
+        attestation,
+        egressProxyRunning,
+    });
+    const shadowRatchetWarnings = await loadShadowRatchetWarnings(belayStateDir(config, repoLocalStateDir));
     const issues = [...isolation.issues];
     if (config.sandbox.enabled && config.sandbox.runtime === 'none') {
         issues.push('sandbox.enabled is true but sandbox.runtime is none');
@@ -30,6 +43,10 @@ export async function sandboxStatus(options = {}) {
     if (l1Full.sandbox && !l1Full.approvalSigningRequired) {
         issues.push('L1-full requires approvalSigning.required=true');
     }
+    if (guaranteePosture.postureMismatch) {
+        issues.push(`L1-full is configured but attestation only supports ${guaranteePosture.attestedProfile} (run belay session start)`);
+    }
+    const advisories = [...evaluateGateLatencyRatchetAdvisories(), ...shadowRatchetWarnings];
     return {
         repoRoot,
         sandboxEnabled: config.sandbox.enabled,
@@ -40,14 +57,17 @@ export async function sandboxStatus(options = {}) {
         controlPlaneIsolationMode: config.controlPlane.isolation.mode,
         controlPlaneIsolationOk: isolation.ok,
         l1FullActive: l1Full.active,
+        guaranteePosture,
         l1Full,
         issues,
+        advisories,
     };
 }
 export function createCapabilityApprovalStore(repoRoot, config) {
     const repoLocalDir = repoLocalStateDirFor(repoRoot, config);
     return {
         allowlistPath: fsScopeAllowlistPath(config, repoLocalDir),
+        trustedRootsPath: trustedWorkspaceRootsPath(config, repoLocalDir),
         async loadPending() {
             const { loadApprovalState, pendingApprovalsPath } = await import('../config-io.js');
             const filePath = pendingApprovalsPath(repoRoot, config);
@@ -82,6 +102,8 @@ export function formatSandboxStatusReport(report) {
         `FS-scope allowlist entries: ${report.fsScopeAllowlistCount}`,
         `Control-plane isolation: ${report.controlPlaneIsolationMode} (ok=${report.controlPlaneIsolationOk})`,
         `L1-full active: ${report.l1FullActive}`,
+        `Guarantee posture: configured=${report.guaranteePosture.configuredProfile} attested=${report.guaranteePosture.attestedProfile}`,
+        `  attestationFresh=${report.guaranteePosture.attestationFresh} l1FullConfigured=${report.guaranteePosture.l1FullConfigured} l1FullAttested=${report.guaranteePosture.l1FullAttested}`,
         `  sandbox=${report.l1Full.sandbox} egress=${report.l1Full.egress} proxy=${report.l1Full.egressProxyRunning}`,
         `  isolation=${report.l1Full.controlPlaneIsolation} signing=${report.l1Full.approvalSigningRequired}`,
     ];
@@ -91,5 +113,11 @@ export function formatSandboxStatusReport(report) {
             lines.push(`  - ${issue}`);
         }
     }
+    if (report.advisories.length > 0) {
+        lines.push('Advisories:');
+        for (const advisory of report.advisories) {
+            lines.push(`  - ${advisory}`);
+        }
+    }
     return `${lines.join('\n')}\n`;
 }

package/dist/types.d.ts

@@ -1,5 +1,5 @@
-export type { BelayConfig, BelayConfigV1, BelayConfigV2, BelayConfigV3, BelayControlPlaneConfig, BelayEgressConfig, BelayMode, BelayOverridesConfig, BelayPolicyConfig, BelayRedactionConfig, BelaySandboxConfig, BelayTransactionalConfig, UnknownLocalEffectPolicy, } from './core/config.js';
-export type { ApprovalRecord, ApprovalStateFile, Assessment, ClassifyResult, HookVerdict, } from './core/types.js';
+export type { BelayConfig, BelayConfigV1, BelayConfigV2, BelayConfigV3, BelayControlPlaneConfig, BelayEgressConfig, BelayOverridesConfig, BelayPolicyConfig, BelayRedactionConfig, BelaySandboxConfig, BelayTransactionalConfig, UnknownLocalEffectPolicy, } from './core/config.js';
+export type { ApprovalRecord, ApprovalStateFile, Assessment, BelayMode, ClassifyResult, HookVerdict, } from './core/types.js';
 import type { InstallScope } from './adapters/layouts/scope.js';
 import type { RecentAskEntry } from './core/audit-summary.js';
 import type { BelayEgressConfig, BelayOverridesConfig, BelayPolicyConfig, BelaySandboxConfig } from './core/config.js';

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const PACKAGE_VERSION = "0.3.0";
+export declare const PACKAGE_VERSION = "0.6.0";

package/dist/version.js

@@ -1,2 +1,2 @@
 // Generated by scripts/sync-version.mjs — do not edit.
-export const PACKAGE_VERSION = '0.3.0';
+export const PACKAGE_VERSION = '0.6.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guilz-dev/belay",
-  "version": "0.3.0",
+  "version": "0.6.0",
   "description": "Belay-style approval and audit gating for agent runtimes.",
   "type": "module",
   "license": "MIT",
@@ -48,15 +48,19 @@
     "agent-belay-logo.png"
   ],
   "scripts": {
-    "build": "rm -rf dist && node scripts/sync-version.mjs && tsc -p tsconfig.build.json && node scripts/build-runtime.mjs",
+    "build": "rm -rf dist && node scripts/sync-version.mjs && tsc -p tsconfig.build.json && node scripts/generate-standing-allow-catalog.mjs && tsc -p tsconfig.build.json && node scripts/build-runtime.mjs",
     "check:version": "node scripts/check-cli-version.mjs",
+    "dogfood": "./scripts/dev-dogfood.sh",
+    "dev-refresh": "./scripts/dev-refresh.sh",
     "prepublishOnly": "pnpm build && node scripts/check-cli-version.mjs",
     "lint": "biome check src package.json README.md CHANGELOG.md CONTRIBUTING.md SECURITY.md tsconfig.json tsconfig.build.json vitest.config.ts scripts docs",
     "typecheck": "tsc --noEmit",
     "test": "pnpm build && vitest run",
     "test:structural": "pnpm build && vitest run src/__tests__/verdict/structural-suite.test.ts",
     "test:stable": "pnpm build && vitest run && vitest run && vitest run",
-    "corpus": "pnpm build && node scripts/corpus.mjs"
+    "corpus": "pnpm build && node scripts/corpus.mjs",
+    "probe:adversarial": "pnpm build && node scripts/adversarial-probe.mjs",
+    "corpus:ratchet": "pnpm build && node scripts/corpus-ratchet.mjs"
   },
   "devDependencies": {
     "@biomejs/biome": "2.4.15",

package/skills/belay/SKILL.md

@@ -38,7 +38,13 @@ setup (or `npx @guilz-dev/belay init` for non-interactive install). Run
 
 1. Read the approval ID in the deny message.
 2. Approve once with `/belay-approve <approval-id>` or `belay approve <approval-id>`.
-3. Retry the original action unchanged.
+3. Retry the original action unchanged (default `approval.flow` is `one_step` for shell — the
+   approval response includes a replay hint when auto-replay is enabled).
+
+For shell-only CLI replay after approval: `belay approve <approval-id> --replay`.
+
+To restore the legacy two-step UX (approve, then always retry manually), set
+`approval.flow` to `two_step` in `belay.config.json`.
 
 For why it was blocked, use `/belay why <command>` or `belay explain --command "<command>"`.
 For the latest pending ask, use `/belay explain` or `belay explain`.

package/skills/belay/belay-approve.md

@@ -5,3 +5,20 @@ belay approve <approval-id>
 ```
 
 Then retry the original action unchanged.
+
+With default `approval.flow: one_step`, shell approvals return a replay hint from editor
+hooks. Tool and subagent approvals still require a manual retry.
+
+To run a denied shell command from the CLI after approval (explicit opt-in; do not also retry via hooks):
+
+```bash
+belay approve <approval-id> --replay
+```
+
+Successful CLI replay consumes the one-shot grant. On failure, the approval stays active for one hook retry.
+
+Restore legacy two-step UX in `belay.config.json`:
+
+```json
+{ "approval": { "flow": "two_step" } }
+```