@guilz-dev/belay 0.4.0 → 0.6.0

package/dist/core/capability/boundary-driver.d.ts

@@ -0,0 +1,29 @@
+import { type ShellRunResult } from '../transactional/git-worktree.js';
+import type { BoundaryAttestation, BoundaryDriverId } from './attestation.js';
+import type { BoundaryPrepareContext, BoundaryRunOptions } from './boundary-run.js';
+import type { CapabilityGrantV1 } from './grant.js';
+import type { CapabilityRequestV1 } from './request.js';
+export type { ShellRunResult as BoundaryRunResult };
+export interface BoundaryMaterializeContext {
+    attestation: BoundaryAttestation;
+    mountRoot: string;
+    egressProxyActive: boolean;
+    existingGrants?: CapabilityGrantV1[];
+    sensitivePaths?: string[];
+}
+export type { BoundaryRunOptions } from './boundary-run.js';
+export { boundaryMountReadOnlyFromPrediction } from './boundary-run.js';
+export interface BoundaryDriver {
+    id: BoundaryDriverId;
+    probe(): Promise<BoundaryAttestation>;
+    prepare?(context: BoundaryPrepareContext): Promise<void>;
+    run(command: string, cwd: string, timeoutMs: number, options?: BoundaryRunOptions): Promise<ShellRunResult>;
+    materializeGrant(request: CapabilityRequestV1, context: BoundaryMaterializeContext): CapabilityGrantV1 | null;
+}
+export interface BoundaryDriverOptions {
+    egressProxyEnv?: Record<string, string>;
+    image?: string;
+    repoRoot?: string;
+}
+export declare function createHostIntegrationDriver(): BoundaryDriver;
+export declare function getDefaultBoundaryDriver(driverId?: BoundaryDriverId, options?: BoundaryDriverOptions): BoundaryDriver;

package/dist/core/capability/boundary-driver.js

@@ -0,0 +1,43 @@
+import { runShellCommand } from '../transactional/git-worktree.js';
+import { createContainerBoundaryDriver } from './boundary-driver-container.js';
+export { boundaryMountReadOnlyFromPrediction } from './boundary-run.js';
+const ATTESTATION_TTL_MS = 15 * 60_000;
+function hostIntegrationAttestation(driver) {
+    const probedAt = new Date().toISOString();
+    return {
+        version: 1,
+        driver,
+        probedAt,
+        expiresAt: new Date(Date.now() + ATTESTATION_TTL_MS).toISOString(),
+        deniesUngrantedEffects: false,
+        materializesGrants: false,
+        probeSignals: ['host-integration', 'l3-policy-only'],
+    };
+}
+export function createHostIntegrationDriver() {
+    return {
+        id: 'host-integration',
+        async probe() {
+            return hostIntegrationAttestation('host-integration');
+        },
+        async prepare() {
+            // L3 host path has no runtime preparation.
+        },
+        run(command, cwd, timeoutMs) {
+            return runShellCommand(command, cwd, timeoutMs);
+        },
+        materializeGrant() {
+            return null;
+        },
+    };
+}
+export function getDefaultBoundaryDriver(driverId = 'host-integration', options = {}) {
+    if (driverId === 'container') {
+        return createContainerBoundaryDriver({
+            image: options.image,
+            egressProxyEnv: options.egressProxyEnv,
+            repoRoot: options.repoRoot,
+        });
+    }
+    return createHostIntegrationDriver();
+}

package/dist/core/capability/boundary-egress.d.ts

@@ -0,0 +1,21 @@
+import type { BelayConfigV4 } from '../config.js';
+import type { BoundaryDriverId } from './attestation.js';
+export declare function isEgressProxyActive(params: {
+    config: BelayConfigV4;
+    running: boolean;
+    foreignProxy?: boolean;
+    repoRootMismatch?: boolean;
+}): boolean;
+export declare function egressProxyEnvFromConfig(config: BelayConfigV4, proxyActive: boolean): Record<string, string>;
+/** Container workloads cannot reach 127.0.0.1 on the host; route via host.docker.internal. */
+export declare function egressProxyEnvForContainer(config: BelayConfigV4, proxyActive: boolean): Record<string, string>;
+export declare function resolveBoundaryEgressProxyEnv(params: {
+    driverId: BoundaryDriverId;
+    config: BelayConfigV4;
+    proxyActive: boolean;
+}): Record<string, string>;
+export declare function belayContainerNetworkName(repoRoot: string): string;
+export declare function isBelayContainerNetworkReady(repoRoot: string): Promise<boolean>;
+export declare function ensureBelayContainerNetwork(repoRoot: string): Promise<string>;
+export declare function dockerNetworkArgs(proxyActive: boolean, repoRoot?: string): string[];
+export declare function dockerEnvArgs(proxyEnv: Record<string, string>): string[];

package/dist/core/capability/boundary-egress.js

@@ -0,0 +1,109 @@
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { recommendedProxyEnv } from '../egress/env.js';
+import { canonicalPath } from '../path-utils.js';
+export function isEgressProxyActive(params) {
+    if (!params.config.egress.enabled) {
+        return false;
+    }
+    return params.running && !params.foreignProxy && !params.repoRootMismatch;
+}
+function proxyHostForContainer(listenHost) {
+    if (listenHost === '127.0.0.1' || listenHost === 'localhost' || listenHost === '::1') {
+        return 'host.docker.internal';
+    }
+    return listenHost;
+}
+export function egressProxyEnvFromConfig(config, proxyActive) {
+    if (!proxyActive || !config.egress.enabled) {
+        return {};
+    }
+    return recommendedProxyEnv(config.egress);
+}
+/** Container workloads cannot reach 127.0.0.1 on the host; route via host.docker.internal. */
+export function egressProxyEnvForContainer(config, proxyActive) {
+    if (!proxyActive || !config.egress.enabled) {
+        return {};
+    }
+    const host = proxyHostForContainer(config.egress.listenHost);
+    const proxyUrl = `http://${host}:${config.egress.listenPort}`;
+    return {
+        HTTP_PROXY: proxyUrl,
+        HTTPS_PROXY: proxyUrl,
+        http_proxy: proxyUrl,
+        https_proxy: proxyUrl,
+        NO_PROXY: '127.0.0.1,localhost',
+        no_proxy: '127.0.0.1,localhost',
+    };
+}
+export function resolveBoundaryEgressProxyEnv(params) {
+    if (params.driverId === 'container') {
+        return egressProxyEnvForContainer(params.config, params.proxyActive);
+    }
+    return egressProxyEnvFromConfig(params.config, params.proxyActive);
+}
+export function belayContainerNetworkName(repoRoot) {
+    const hash = createHash('sha256').update(canonicalPath(repoRoot)).digest('hex').slice(0, 12);
+    return `belay-int-${hash}`;
+}
+function dockerNetworkInspect(name) {
+    return new Promise((resolve) => {
+        const child = spawn('docker', ['network', 'inspect', name], { stdio: 'ignore' });
+        child.on('error', () => resolve(false));
+        child.on('close', (code) => resolve(code === 0));
+    });
+}
+export async function isBelayContainerNetworkReady(repoRoot) {
+    return dockerNetworkInspect(belayContainerNetworkName(repoRoot));
+}
+function dockerNetworkCreateInternal(name) {
+    return new Promise((resolve, reject) => {
+        const child = spawn('docker', ['network', 'create', '--internal', '--label', 'belay=1', name], {
+            stdio: 'ignore',
+        });
+        child.on('error', reject);
+        child.on('close', (code) => {
+            if (code === 0) {
+                resolve();
+                return;
+            }
+            reject(new Error(`Failed to create internal docker network ${name}`));
+        });
+    });
+}
+export async function ensureBelayContainerNetwork(repoRoot) {
+    const name = belayContainerNetworkName(repoRoot);
+    if (await dockerNetworkInspect(name)) {
+        return name;
+    }
+    try {
+        await dockerNetworkCreateInternal(name);
+    }
+    catch (error) {
+        if (await dockerNetworkInspect(name)) {
+            return name;
+        }
+        throw error;
+    }
+    return name;
+}
+export function dockerNetworkArgs(proxyActive, repoRoot) {
+    if (!proxyActive) {
+        return ['--network', 'none'];
+    }
+    if (!repoRoot) {
+        return ['--network', 'none'];
+    }
+    return [
+        '--add-host=host.docker.internal:host-gateway',
+        '--network',
+        belayContainerNetworkName(repoRoot),
+    ];
+}
+export function dockerEnvArgs(proxyEnv) {
+    const args = [];
+    for (const [key, value] of Object.entries(proxyEnv)) {
+        args.push('-e', `${key}=${value}`);
+    }
+    return args;
+}

package/dist/core/capability/boundary-grant-materialize.d.ts

@@ -0,0 +1,13 @@
+import type { BoundaryAttestation } from './attestation.js';
+import { type CapabilityGrantV1 } from './grant.js';
+import type { CapabilityRequestV1 } from './request.js';
+export declare const BOUNDARY_GRANT_ISSUER_CONTAINER: "boundary:container";
+export declare function isPathWithinBoundaryMount(request: CapabilityRequestV1): boolean;
+export interface MaterializeBoundaryGrantParams {
+    attestation: BoundaryAttestation;
+    mountRoot: string;
+    egressProxyActive: boolean;
+    existingGrants?: CapabilityGrantV1[];
+    sensitivePaths?: string[];
+}
+export declare function materializeContainerBoundaryGrant(request: CapabilityRequestV1, params: MaterializeBoundaryGrantParams): CapabilityGrantV1 | null;

package/dist/core/capability/boundary-grant-materialize.js

@@ -0,0 +1,78 @@
+import path from 'node:path';
+import { matchesSensitivePath } from '../glob.js';
+import { canonicalPath, pathWithinRoot } from '../path-utils.js';
+import { newGrantId } from './approval-v3.js';
+import { isAttestationFresh } from './attestation.js';
+import { CAPABILITY_GRANT_VERSION } from './grant.js';
+import { grantMatchesRequest } from './grant-match.js';
+const BOUNDARY_GRANT_TTL_MS = 15 * 60_000;
+export const BOUNDARY_GRANT_ISSUER_CONTAINER = 'boundary:container';
+function resolveCapabilityPath(targetPath, cwd) {
+    const joined = path.isAbsolute(targetPath) ? targetPath : path.join(cwd, targetPath);
+    return canonicalPath(joined);
+}
+export function isPathWithinBoundaryMount(request) {
+    if (request.resource.kind !== 'path') {
+        return true;
+    }
+    const mountRoot = canonicalPath(request.context.cwd);
+    const resolved = resolveCapabilityPath(request.resource.path, request.context.cwd);
+    return pathWithinRoot(mountRoot, resolved);
+}
+function mintBoundaryGrant(request, attestation, issuer) {
+    const now = Date.now();
+    const attestationExpiry = Date.parse(attestation.expiresAt);
+    const grantExpiry = now + BOUNDARY_GRANT_TTL_MS;
+    const expiresAt = new Date(Number.isFinite(attestationExpiry) ? Math.min(attestationExpiry, grantExpiry) : grantExpiry).toISOString();
+    return {
+        version: CAPABILITY_GRANT_VERSION,
+        grantId: newGrantId(),
+        principal: request.principal,
+        action: request.action,
+        resource: request.resource,
+        inputFingerprint: request.context.inputFingerprint,
+        issuedAt: new Date(now).toISOString(),
+        expiresAt,
+        maxUses: 1,
+        usesRemaining: 1,
+        issuer,
+    };
+}
+export function materializeContainerBoundaryGrant(request, params) {
+    if (!isAttestationFresh(params.attestation)) {
+        return null;
+    }
+    if (!params.attestation.materializesGrants || params.attestation.driver !== 'container') {
+        return null;
+    }
+    if (request.evidence.level !== 'certain') {
+        return null;
+    }
+    const repoRoot = canonicalPath(request.principal.repoRoot);
+    const mountRoot = canonicalPath(params.mountRoot);
+    if (request.action === 'fs.read' || request.action === 'fs.write') {
+        if (request.resource.kind !== 'path') {
+            return null;
+        }
+        const resolved = resolveCapabilityPath(request.resource.path, request.context.cwd);
+        if (!pathWithinRoot(repoRoot, resolved) || !pathWithinRoot(mountRoot, resolved)) {
+            return null;
+        }
+        const relative = resolved.slice(repoRoot.length).replace(/^[/\\]/, '');
+        if (params.sensitivePaths?.length && matchesSensitivePath(relative, params.sensitivePaths)) {
+            return null;
+        }
+        return mintBoundaryGrant(request, params.attestation, BOUNDARY_GRANT_ISSUER_CONTAINER);
+    }
+    if (request.action === 'network.connect' && request.resource.kind === 'network') {
+        if (!params.egressProxyActive) {
+            return null;
+        }
+        const approved = params.existingGrants?.some((grant) => grant.issuer !== BOUNDARY_GRANT_ISSUER_CONTAINER && grantMatchesRequest(grant, request));
+        if (!approved) {
+            return null;
+        }
+        return mintBoundaryGrant(request, params.attestation, BOUNDARY_GRANT_ISSUER_CONTAINER);
+    }
+    return null;
+}

package/dist/core/capability/boundary-profile.d.ts

@@ -0,0 +1,15 @@
+import type { BelayConfigV4 } from '../config.js';
+import type { BoundaryAttestation } from './attestation.js';
+/** Policy-only boundary (L3/L4). No attested L1 enforcement. */
+export declare const BOUNDARY_PROFILE_L3_POLICY: "l3-policy-engine";
+/** Editor-facing label when only prediction + approval layers are active. */
+export declare const BOUNDARY_PROFILE_L3_L4_ONLY: "l3-l4-only";
+/** Attested container / sandbox boundary with grant materialization. */
+export declare const BOUNDARY_PROFILE_L1_ATTESTED: "l1-attested-boundary";
+export type BoundaryProfileId = typeof BOUNDARY_PROFILE_L3_POLICY | typeof BOUNDARY_PROFILE_L3_L4_ONLY | typeof BOUNDARY_PROFILE_L1_ATTESTED;
+export declare function isAttestedBoundary(attestation: BoundaryAttestation | null | undefined): boolean;
+export declare function resolveBoundaryProfile(params: {
+    config: BelayConfigV4;
+    attestation?: BoundaryAttestation | null;
+}): BoundaryProfileId;
+export declare function boundaryVerifiedAllowEnabled(attestation: BoundaryAttestation | null | undefined): boolean;

package/dist/core/capability/boundary-profile.js

@@ -0,0 +1,25 @@
+import { isAttestationFresh } from './attestation.js';
+/** Policy-only boundary (L3/L4). No attested L1 enforcement. */
+export const BOUNDARY_PROFILE_L3_POLICY = 'l3-policy-engine';
+/** Editor-facing label when only prediction + approval layers are active. */
+export const BOUNDARY_PROFILE_L3_L4_ONLY = 'l3-l4-only';
+/** Attested container / sandbox boundary with grant materialization. */
+export const BOUNDARY_PROFILE_L1_ATTESTED = 'l1-attested-boundary';
+export function isAttestedBoundary(attestation) {
+    if (!attestation || !isAttestationFresh(attestation)) {
+        return false;
+    }
+    return attestation.deniesUngrantedEffects && attestation.materializesGrants;
+}
+export function resolveBoundaryProfile(params) {
+    if (!isAttestedBoundary(params.attestation)) {
+        return BOUNDARY_PROFILE_L3_L4_ONLY;
+    }
+    if (params.attestation?.driver === 'container') {
+        return BOUNDARY_PROFILE_L1_ATTESTED;
+    }
+    return BOUNDARY_PROFILE_L3_POLICY;
+}
+export function boundaryVerifiedAllowEnabled(attestation) {
+    return isAttestedBoundary(attestation);
+}

package/dist/core/capability/boundary-run.d.ts

@@ -0,0 +1,23 @@
+import type { ShellRunResult } from '../transactional/git-worktree.js';
+import type { ClassifyResult } from '../types.js';
+export interface BoundaryRunOptions {
+    /** When true, container driver mounts the working directory read-only. */
+    mountReadOnly?: boolean;
+}
+export interface BoundaryPrepareContext {
+    repoRoot?: string;
+    egressProxyActive: boolean;
+    proxyEnv: Record<string, string>;
+}
+export interface BoundaryRunnable {
+    prepare?(context: BoundaryPrepareContext): Promise<void>;
+    run(command: string, cwd: string, timeoutMs: number, options?: BoundaryRunOptions): Promise<ShellRunResult>;
+}
+export declare function boundaryMountReadOnlyFromPrediction(predicted: ClassifyResult): boolean;
+export declare function runWithBoundaryRunnable(target: BoundaryRunnable, params: {
+    prepareContext: BoundaryPrepareContext;
+    command: string;
+    cwd: string;
+    timeoutMs: number;
+    runOptions?: BoundaryRunOptions;
+}): Promise<ShellRunResult>;

package/dist/core/capability/boundary-run.js

@@ -0,0 +1,23 @@
+export function boundaryMountReadOnlyFromPrediction(predicted) {
+    const effect = predicted.axes?.effect;
+    if (effect === 'local_mutation' || effect === 'remote_mutation') {
+        return false;
+    }
+    const action = predicted.capabilityRequests?.[0]?.action;
+    if (action === 'fs.write' || action === 'git.ref.write' || action === 'control_plane.write') {
+        return false;
+    }
+    if (action === 'fs.read') {
+        return true;
+    }
+    if (action === 'network.connect' || action === 'process.exec' || action === 'indeterminate') {
+        return true;
+    }
+    return true;
+}
+export async function runWithBoundaryRunnable(target, params) {
+    if (target.prepare) {
+        await target.prepare(params.prepareContext);
+    }
+    return target.run(params.command, params.cwd, params.timeoutMs, params.runOptions);
+}

package/dist/core/capability/boundary-session.d.ts

@@ -0,0 +1,57 @@
+import type { BelayConfigV4 } from '../config.js';
+import type { BoundaryAttestation, BoundaryDriverId } from './attestation.js';
+import { type BoundaryDriver } from './boundary-driver.js';
+import { dockerNetworkArgs } from './boundary-egress.js';
+import { type BoundaryPrepareContext, type BoundaryRunOptions } from './boundary-run.js';
+export interface BoundarySessionOptions {
+    egressProxyRunning?: boolean;
+}
+export interface ResolvedBoundaryDriverContext {
+    driver: BoundaryDriver;
+    driverId: BoundaryDriverId;
+    proxyActive: boolean;
+    proxyEnv: Record<string, string>;
+    prepareContext: BoundaryPrepareContext;
+}
+export declare function boundaryAttestationPath(repoRoot: string, config: BelayConfigV4): string;
+export declare function loadBoundaryAttestation(filePath: string, expectedRepoRoot?: string, controlPlaneDir?: string): Promise<BoundaryAttestation | null>;
+export declare function saveBoundaryAttestation(filePath: string, attestation: BoundaryAttestation, repoRoot: string, controlPlaneDir: string): Promise<void>;
+export declare function hostIntegrationBoundaryContext(repoRoot: string): ResolvedBoundaryDriverContext;
+export declare function resolveBoundaryDriverContext(params: {
+    repoRoot: string;
+    config: BelayConfigV4;
+    driverId?: BoundaryDriverId;
+    egressProxyRunning?: boolean;
+}): Promise<ResolvedBoundaryDriverContext>;
+export declare function runWithBoundaryDriver(params: {
+    context: ResolvedBoundaryDriverContext;
+    command: string;
+    cwd: string;
+    timeoutMs: number;
+    runOptions?: BoundaryRunOptions;
+}): Promise<Awaited<ReturnType<BoundaryDriver['run']>>>;
+export declare function startBoundarySession(params: {
+    repoRoot: string;
+    config: BelayConfigV4;
+    driverId?: BoundaryDriverId;
+    egressProxyRunning?: boolean;
+}): Promise<{
+    attestation: BoundaryAttestation;
+    attestationPath: string;
+}>;
+export declare function boundarySessionStatus(params: {
+    repoRoot: string;
+    config: BelayConfigV4;
+}): Promise<{
+    attestationPath: string;
+    attestation: BoundaryAttestation | null;
+    fresh: boolean;
+}>;
+export declare function runBoundaryAgentCommand(params: {
+    repoRoot: string;
+    config: BelayConfigV4;
+    command: string;
+    cwd?: string;
+    timeoutMs?: number;
+}): Promise<Awaited<ReturnType<BoundaryDriver['run']>>>;
+export { dockerNetworkArgs };

package/dist/core/capability/boundary-session.js

@@ -0,0 +1,129 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { egressStatus } from '../../services/egress-service.js';
+import { configuredControlPlaneDir } from '../config.js';
+import { isAttestationFresh } from './attestation.js';
+import { readSignedAttestationFile, signBoundaryAttestation, verifySignedBoundaryAttestation, } from './boundary-attestation-sign.js';
+import { getDefaultBoundaryDriver } from './boundary-driver.js';
+import { dockerNetworkArgs, isEgressProxyActive, resolveBoundaryEgressProxyEnv, } from './boundary-egress.js';
+import { runWithBoundaryRunnable, } from './boundary-run.js';
+export function boundaryAttestationPath(repoRoot, config) {
+    const rel = config.capability?.attestationRelPath ?? '.belay/attestation.json';
+    return path.isAbsolute(rel) ? rel : path.join(repoRoot, rel);
+}
+export async function loadBoundaryAttestation(filePath, expectedRepoRoot, controlPlaneDir) {
+    try {
+        const raw = await readSignedAttestationFile(filePath);
+        if (expectedRepoRoot && controlPlaneDir) {
+            return verifySignedBoundaryAttestation({
+                file: raw,
+                expectedRepoRoot,
+                controlPlaneDir,
+            });
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+export async function saveBoundaryAttestation(filePath, attestation, repoRoot, controlPlaneDir) {
+    const signed = await signBoundaryAttestation({
+        repoRoot,
+        attestation,
+        controlPlaneDir,
+    });
+    await mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    await writeFile(filePath, `${JSON.stringify(signed, null, 2)}\n`, {
+        encoding: 'utf8',
+        mode: 0o600,
+    });
+}
+export function hostIntegrationBoundaryContext(repoRoot) {
+    const driver = getDefaultBoundaryDriver('host-integration', { repoRoot });
+    return {
+        driver,
+        driverId: 'host-integration',
+        proxyActive: false,
+        proxyEnv: {},
+        prepareContext: {
+            repoRoot,
+            egressProxyActive: false,
+            proxyEnv: {},
+        },
+    };
+}
+export async function resolveBoundaryDriverContext(params) {
+    const driverId = params.driverId ?? params.config.capability?.boundaryDriver ?? 'host-integration';
+    let proxyActive = params.egressProxyRunning === true;
+    if (params.egressProxyRunning === undefined) {
+        const egress = await egressStatus({ targetDir: params.repoRoot });
+        proxyActive = isEgressProxyActive({
+            config: params.config,
+            running: egress.running,
+            foreignProxy: egress.foreignProxy,
+            repoRootMismatch: egress.repoRootMismatch,
+        });
+    }
+    const proxyEnv = resolveBoundaryEgressProxyEnv({
+        driverId,
+        config: params.config,
+        proxyActive,
+    });
+    const driver = getDefaultBoundaryDriver(driverId, {
+        egressProxyEnv: proxyEnv,
+        repoRoot: params.repoRoot,
+    });
+    return {
+        driver,
+        driverId,
+        proxyActive,
+        proxyEnv,
+        prepareContext: {
+            repoRoot: params.repoRoot,
+            egressProxyActive: proxyActive,
+            proxyEnv,
+        },
+    };
+}
+export async function runWithBoundaryDriver(params) {
+    return runWithBoundaryRunnable(params.context.driver, {
+        prepareContext: params.context.prepareContext,
+        command: params.command,
+        cwd: params.cwd,
+        timeoutMs: params.timeoutMs,
+        runOptions: params.runOptions,
+    });
+}
+export async function startBoundarySession(params) {
+    const resolved = await resolveBoundaryDriverContext(params);
+    const attestation = await resolved.driver.probe();
+    if (resolved.driver.prepare) {
+        await resolved.driver.prepare(resolved.prepareContext);
+    }
+    const attestationPath = boundaryAttestationPath(params.repoRoot, params.config);
+    await saveBoundaryAttestation(attestationPath, attestation, params.repoRoot, configuredControlPlaneDir(params.config));
+    return { attestation, attestationPath };
+}
+export async function boundarySessionStatus(params) {
+    const attestationPath = boundaryAttestationPath(params.repoRoot, params.config);
+    const attestation = await loadBoundaryAttestation(attestationPath, params.repoRoot, configuredControlPlaneDir(params.config));
+    return {
+        attestationPath,
+        attestation,
+        fresh: attestation ? isAttestationFresh(attestation) : false,
+    };
+}
+export async function runBoundaryAgentCommand(params) {
+    const context = await resolveBoundaryDriverContext({
+        repoRoot: params.repoRoot,
+        config: params.config,
+    });
+    return runWithBoundaryDriver({
+        context,
+        command: params.command,
+        cwd: params.cwd ?? params.repoRoot,
+        timeoutMs: params.timeoutMs ?? 30 * 60_000,
+    });
+}
+export { dockerNetworkArgs };

package/dist/core/capability/capability-request-hash.d.ts

@@ -0,0 +1,2 @@
+import type { CapabilityRequestV1 } from './request.js';
+export declare function hashCapabilityRequests(requests: CapabilityRequestV1[]): string;

package/dist/core/capability/capability-request-hash.js

@@ -0,0 +1,8 @@
+import { canonicalStringify, hashValue } from '../fingerprint.js';
+export function hashCapabilityRequests(requests) {
+    if (requests.length === 0) {
+        return '';
+    }
+    const normalized = [...requests].sort((left, right) => canonicalStringify(left).localeCompare(canonicalStringify(right)));
+    return hashValue(`capability-requests:v1:${canonicalStringify(normalized)}`);
+}

package/dist/core/capability/gate-latency-ratchet.d.ts

@@ -0,0 +1,7 @@
+import { GATE_LATENCY_BUDGET } from '../../corpus/gate-latency-budget.js';
+export type GateLatencyKind = keyof typeof GATE_LATENCY_BUDGET;
+/**
+ * Advisory warnings when CI budgets still exceed PLAN acceptance targets.
+ * Surfaced via sandbox status `advisories` and doctor warnings — not `issues` or gate exit codes.
+ */
+export declare function evaluateGateLatencyRatchetAdvisories(): string[];

package/dist/core/capability/gate-latency-ratchet.js

@@ -0,0 +1,18 @@
+import { GATE_LATENCY_BUDGET, GATE_LATENCY_PLAN_TARGET } from '../../corpus/gate-latency-budget.js';
+/**
+ * Advisory warnings when CI budgets still exceed PLAN acceptance targets.
+ * Surfaced via sandbox status `advisories` and doctor warnings — not `issues` or gate exit codes.
+ */
+export function evaluateGateLatencyRatchetAdvisories() {
+    const warnings = [];
+    for (const kind of Object.keys(GATE_LATENCY_BUDGET)) {
+        const budget = GATE_LATENCY_BUDGET[kind];
+        if (budget.p95Ms > GATE_LATENCY_PLAN_TARGET.p95Ms) {
+            warnings.push(`Gate ${kind} p95 CI budget ${budget.p95Ms}ms exceeds PLAN target ${GATE_LATENCY_PLAN_TARGET.p95Ms}ms — tighten via quality-loop ratchet.`);
+        }
+        if (budget.maxMs > GATE_LATENCY_PLAN_TARGET.maxMs) {
+            warnings.push(`Gate ${kind} max CI budget ${budget.maxMs}ms exceeds PLAN target ${GATE_LATENCY_PLAN_TARGET.maxMs}ms — tighten via quality-loop ratchet.`);
+        }
+    }
+    return warnings;
+}

package/dist/core/capability/gate-policy-shadow.d.ts

@@ -0,0 +1,25 @@
+import type { BelayConfigV4 } from '../config.js';
+import type { ClassifyResult } from '../types.js';
+import type { JudgeProviderId } from '../verdict/judge-catalog.js';
+import type { Tier1Verdict } from '../verdict/types.js';
+export { recordGateApprovalAsk } from './gate-shadow-ratchet.js';
+export declare function capabilityDecisionAuditFields(result: ClassifyResult): Record<string, unknown>;
+export declare function policyWouldBlock(result: ClassifyResult): boolean;
+export declare function judgeWouldBlock(verdict: Tier1Verdict): boolean;
+export declare function policyJudgeMismatch(result: ClassifyResult, judgeVerdict: Tier1Verdict): boolean;
+export declare function scheduleGateShadowAudit(params: {
+    repoRoot: string;
+    config: BelayConfigV4;
+    providerId: string;
+    result: ClassifyResult;
+    command?: string;
+    stateDir?: string;
+}): Record<string, unknown>;
+export declare function runGatePolicyShadowComparison(params: {
+    repoRoot: string;
+    config: BelayConfigV4;
+    providerId: Exclude<JudgeProviderId, 'ollama'>;
+    command: string;
+    result: ClassifyResult;
+    stateDir?: string;
+}): Promise<void>;