@guilz-dev/belay 0.7.0 → 0.8.1

package/dist/core/audit-metrics.js

@@ -30,6 +30,7 @@ export function computeAuditMetrics(records, options = {}) {
     const byOpacity = {};
     const byEffect = {};
     const byConfidence = {};
+    const gateEventsByRuntime = {};
     const summaryCounts = new Map();
     let gateEvents = 0;
     let wouldBlockCount = 0;
@@ -44,6 +45,12 @@ export function computeAuditMetrics(records, options = {}) {
             continue;
         }
         gateEvents += 1;
+        const runtimeBuild = typeof record.runtimeBuildStamp === 'string'
+            ? record.runtimeBuildStamp
+            : typeof record.runtimeVersion === 'string'
+                ? record.runtimeVersion
+                : 'unrecorded';
+        increment(gateEventsByRuntime, runtimeBuild);
         const reason = typeof record.reason === 'string' ? record.reason : 'unknown';
         const kind = typeof record.kind === 'string' ? record.kind : 'unknown';
         increment(byReason, reason);
@@ -88,33 +95,90 @@ export function computeAuditMetrics(records, options = {}) {
     const topWouldBlockSummaries = [...summaryCounts.values()]
         .sort((left, right) => right.count - left.count)
         .slice(0, 10);
+    const activeCohort = options.activeCohort ?? null;
+    const cohortRecords = activeCohort
+        ? auditRecords.filter((record) => record.runtimeBuildStamp === activeCohort.runtimeBuildStamp &&
+            record.configFingerprint === activeCohort.configFingerprint)
+        : [];
+    const cohortGateRecords = cohortRecords.filter((record) => {
+        const event = typeof record.event === 'string' ? record.event : '';
+        return GATE_EVENTS.has(event) && !isApprovalRecorded(record);
+    });
+    const cohortGateEvents = cohortGateRecords.length;
+    const cohortWouldBlockCount = cohortGateRecords.filter(inferWouldBlock).length;
+    const cohortWouldBlockRate = cohortGateEvents > 0 ? cohortWouldBlockCount / cohortGateEvents : 0;
+    const cohortApprovalRecordedCount = cohortRecords.filter(isApprovalRecorded).length;
+    const cohortAvailabilityAsks = computeAvailabilityAskCounts(cohortRecords);
+    const cohortClassifierWouldBlockCount = Math.max(0, cohortWouldBlockCount - cohortAvailabilityAsks.total);
+    const cohortClassifierWouldBlockRate = cohortGateEvents > 0 ? cohortClassifierWouldBlockCount / cohortGateEvents : 0;
+    const cohortRoundTrips = buildApprovalRoundTrips(cohortRecords);
+    const cohortRepeatedFingerprintAsks = computeRepeatedFingerprintAsks(cohortRecords);
+    const cohortNoisyRuleCandidates = detectNoisyRules(cohortRecords, cohortRoundTrips);
+    const cohortWouldBlockByReason = computeWouldBlockByReason(cohortRecords);
+    const cohortSummaryCounts = new Map();
+    for (const record of cohortGateRecords) {
+        if (!inferWouldBlock(record)) {
+            continue;
+        }
+        const reason = typeof record.reason === 'string' ? record.reason : 'unknown';
+        const summary = typeof record.summary === 'string' ? record.summary : '';
+        const key = `${reason}::${summary}`;
+        const existing = cohortSummaryCounts.get(key);
+        if (existing) {
+            existing.count += 1;
+        }
+        else {
+            cohortSummaryCounts.set(key, { summary, reason, count: 1 });
+        }
+    }
+    const cohortTopWouldBlockSummaries = [...cohortSummaryCounts.values()]
+        .sort((left, right) => right.count - left.count)
+        .slice(0, 10);
+    const currentCohort = {
+        identity: activeCohort,
+        gateEvents: cohortGateEvents,
+        excludedGateEvents: gateEvents - cohortGateEvents,
+        wouldBlockCount: cohortWouldBlockCount,
+        wouldBlockRate: cohortWouldBlockRate,
+        classifierWouldBlockCount: cohortClassifierWouldBlockCount,
+        classifierWouldBlockRate: cohortClassifierWouldBlockRate,
+        approvalRecordedCount: cohortApprovalRecordedCount,
+        availabilityAsks: cohortAvailabilityAsks,
+        wouldBlockByReason: cohortWouldBlockByReason,
+        topWouldBlockSummaries: cohortTopWouldBlockSummaries,
+    };
     const mode = options.mode ?? null;
     const unknownLocalEffect = options.unknownLocalEffect ?? null;
     const notes = [];
     let readyForEnforce = false;
     if (mode === 'audit' && unknownLocalEffect === 'deny') {
         notes.push('Dogfood config detected: audit mode with fail-closed shell policy.');
-        if (gateEvents === 0) {
-            notes.push('No gate events yet — run normal agent work, then re-check metrics.');
+        if (!activeCohort) {
+            notes.push('Active runtime provenance is unavailable — readiness cannot use historical audit evidence.');
+        }
+        else if (cohortGateEvents === 0) {
+            notes.push('No gate events for the active runtime/config cohort — run normal agent work, then re-check metrics.');
         }
-        else if (wouldBlockRate === 0) {
-            if (gateEvents >= MIN_GATE_EVENTS_FOR_ENFORCE) {
+        else if (cohortWouldBlockRate === 0) {
+            if (cohortGateEvents >= MIN_GATE_EVENTS_FOR_ENFORCE) {
                 readyForEnforce = true;
                 notes.push('No would-block events recorded — safe to try mode: "enforce".');
             }
             else {
-                notes.push(`Only ${gateEvents} gate event(s) recorded — collect at least ${MIN_GATE_EVENTS_FOR_ENFORCE} before enforce.`);
+                notes.push(`Only ${cohortGateEvents} active-cohort gate event(s) recorded — collect at least ${MIN_GATE_EVENTS_FOR_ENFORCE} before enforce.`);
             }
         }
         else {
-            notes.push(`${wouldBlockCount} would-block event(s) (${(wouldBlockRate * 100).toFixed(1)}% of gate traffic; classifier-quality ${(classifierWouldBlockRate * 100).toFixed(1)}%). Review top summaries and add overrides.allow where appropriate.`);
-            if (approvalRecordedCount > 0) {
-                notes.push(`${approvalRecordedCount} approval(s) recorded — these likely indicate actions operators wanted.`);
+            notes.push(`${cohortWouldBlockCount} active-cohort would-block event(s) (${(cohortWouldBlockRate * 100).toFixed(1)}% of gate traffic; classifier-quality ${(cohortClassifierWouldBlockRate * 100).toFixed(1)}%). Review top summaries and correct EffectPlan semantics or resource scope; use exact approval only when the modeled effects are correct.`);
+            if (cohortApprovalRecordedCount > 0) {
+                notes.push(`${cohortApprovalRecordedCount} active-cohort approval(s) recorded — these likely indicate actions operators wanted.`);
             }
             else {
-                notes.push('Review top would-block summaries and add overrides.allow for legitimate commands before switching to enforce.');
+                notes.push('Review top would-block summaries and correct EffectPlan semantics or resource scope before switching to enforce.');
             }
-            if (classifierWouldBlockRate < 0.05 && gateEvents >= 20 && availabilityAsks.total === 0) {
+            if (cohortClassifierWouldBlockRate < 0.05 &&
+                cohortGateEvents >= 20 &&
+                cohortAvailabilityAsks.total === 0) {
                 readyForEnforce = true;
                 notes.push('Classifier-quality would-block rate is below 5% with sufficient sample size — consider enforce mode.');
             }
@@ -126,16 +190,16 @@ export function computeAuditMetrics(records, options = {}) {
     else {
         notes.push('Set policy.unknownLocalEffect to "deny" to dogfood fail-closed defaults.');
     }
-    if (availabilityAsks.total > 0) {
+    if (cohortAvailabilityAsks.total > 0) {
         readyForEnforce = false;
-        notes.push(`${availabilityAsks.total} availability-caused ask(s) — tune infrastructure before corpus overrides.`);
+        notes.push(`${cohortAvailabilityAsks.total} active-cohort availability-caused ask(s) — tune infrastructure before changing Effect semantics.`);
         notes.push('Ready for enforce withheld while availability-caused asks are present.');
     }
-    if (repeatedFingerprintAsks.length > 0) {
-        notes.push(`${repeatedFingerprintAsks.length} repeated fingerprint ask pattern(s) — review standing-allow / cache candidates.`);
+    if (cohortRepeatedFingerprintAsks.length > 0) {
+        notes.push(`${cohortRepeatedFingerprintAsks.length} active-cohort repeated fingerprint ask pattern(s) — review EffectPlan semantics and exact approval history.`);
     }
-    if (noisyRuleCandidates.length > 0) {
-        notes.push(`${noisyRuleCandidates.length} noisy rule candidate(s) — high deny-then-approve rate.`);
+    if (cohortNoisyRuleCandidates.length > 0) {
+        notes.push(`${cohortNoisyRuleCandidates.length} active-cohort noisy rule candidate(s) — high deny-then-approve rate.`);
     }
     return {
         schemaVersion: AUDIT_METRICS_SCHEMA_VERSION,
@@ -158,6 +222,8 @@ export function computeAuditMetrics(records, options = {}) {
         byOpacity,
         byEffect,
         byConfidence,
+        gateEventsByRuntime,
+        currentCohort,
         approvalRecordedCount,
         topWouldBlockSummaries,
         approvalLatency,

package/dist/core/audit-types.d.ts

@@ -16,6 +16,9 @@ export interface AuditRecord {
     judgeFallbackReason?: string;
     permission?: string;
     mode?: string;
+    runtimeVersion?: string;
+    runtimeBuildStamp?: string;
+    configFingerprint?: string;
     assessment?: Assessment;
     predictedAssessment?: Assessment;
     observedAssessment?: Assessment;

package/dist/core/capability/index.d.ts

@@ -9,6 +9,6 @@ export { type CapabilityAuthorizationMetadata, type PolicyLegacyReasonHints, pol
 export { buildFileMutationCapabilityRequest, buildShellCapabilityRequest, createTypeScriptPolicyEngine, evaluateFileMutationPolicy, evaluateShellPolicy, evaluateSubagentPolicy, type FileMutationCapabilityAnalysis, getDefaultPolicyEngine, policyDecisionRequiresAsk, type ShellCapabilityAnalysis, type SubagentCapabilityAnalysis, } from './policy-engine.js';
 export type { AuthorizationContext, PolicyDecision, PolicyEngine, PolicyOutcome, } from './policy-types.js';
 export { FS_SCOPE_REASONS, shouldSkipBrokerApprovedOnce, shouldSkipBrokerApprovedRecord, } from './reasons.js';
-export { CAPABILITY_REQUEST_VERSION, type CapabilityAction, type CapabilityEvidence, type CapabilityEvidenceLevel, type CapabilityHookKind, type CapabilityPrincipal, type CapabilityRequestContext, type CapabilityRequestV1, type CapabilityResource, } from './request.js';
+export { CAPABILITY_REQUEST_VERSION, type CapabilityAction, type CapabilityEvidence, type CapabilityEvidenceLevel, type CapabilityHookKind, type CapabilityPrincipal, type CapabilityRequestContext, type CapabilityRequestV1, type CapabilityResource, type GitRefScope, type NetworkMode, type NetworkPayload, type ProcessOperation, } from './request.js';
 export { addTrustedWorkspaceRoot, isBroadTrustedWorkspaceRoot, isHighStakesTrustedWorkspaceRoot, isPathWithinTrustedWorkspaceRoots, loadTrustedWorkspaceRoots, loadTrustedWorkspaceRootsSync, normalizeTrustedWorkspaceRootPath, saveTrustedWorkspaceRoots, trustedWorkspaceRootsPath, validateTrustedWorkspaceRootCandidate, } from './trusted-workspace-roots.js';
 export type { CapabilityApprovalScope, FsScopeAllowlistEntry, FsScopeAllowlistFile, TrustedWorkspaceRootEntry, TrustedWorkspaceRootsFile, } from './types.js';

package/dist/core/capability/policy-engine.d.ts

@@ -1,11 +1,41 @@
 import type { BelayConfigV4 } from '../config.js';
 import type { VerdictEffect, VerdictLocation, VerdictOpacity } from '../verdict/types.js';
+import type { CapabilityGrantV1 } from './grant.js';
 import type { AuthorizationContext, PolicyDecision, PolicyEngine } from './policy-types.js';
-import { type CapabilityHookKind, type CapabilityRequestV1 } from './request.js';
+import { type CapabilityAction, type CapabilityEvidenceLevel, type CapabilityHookKind, type CapabilityRequestV1, type CapabilityResource } from './request.js';
 export type PolicyAuthExtras = Pick<AuthorizationContext, 'grants' | 'attestation'> & {
     egressProxyActive?: boolean;
     sensitivePaths?: string[];
 };
+export type EffectPolicyDisposition = 'allow' | 'allow_flagged' | 'ask';
+export interface EffectRequirementPolicyInput {
+    tag: string;
+    action: CapabilityAction;
+    resource: CapabilityResource;
+    evidence: {
+        level: CapabilityEvidenceLevel;
+        signals: readonly string[];
+        basis: readonly string[];
+    };
+    provenance?: unknown;
+}
+export interface EffectRequirementPolicyContext {
+    cwd: string;
+    repoRoot: string;
+    trustedWorkspaceRoots?: readonly string[];
+    sensitivePaths?: readonly string[];
+    protectedArtifactRoots?: readonly string[];
+    grants?: readonly CapabilityGrantV1[];
+    capabilityRequest?: CapabilityRequestV1;
+}
+export interface EffectRequirementPolicyDecision extends PolicyDecision {
+    effectDisposition: EffectPolicyDisposition;
+}
+/**
+ * Policy for a lowered shell effect. It intentionally ignores executable
+ * command names, segment heads, command text, and config allowlists.
+ */
+export declare function evaluateEffectRequirementPolicy(requirement: EffectRequirementPolicyInput, context: EffectRequirementPolicyContext): EffectRequirementPolicyDecision;
 export interface ShellCapabilityAnalysis {
     command: string;
     hookKind: CapabilityHookKind;

package/dist/core/capability/policy-engine.js

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
 import path from 'node:path';
+import { isGitMetadataPath } from '../git-resource-identity.js';
 import { matchesSensitivePath } from '../glob.js';
 import { parseNetworkEndpoint } from '../network-endpoint.js';
 import { canonicalPath, pathWithinRoot, resolveWorkspaceRootMatch } from '../path-utils.js';
@@ -9,6 +10,191 @@ import { boundaryVerifiedAllowEnabled } from './boundary-profile.js';
 import { isGrantScopeTooBroad } from './grant.js';
 import { broadGrantTargetsRequest, grantMatchesRequest } from './grant-match.js';
 import { CAPABILITY_REQUEST_VERSION, } from './request.js';
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '::1', '0:0:0:0:0:0:0:1']);
+const DESTRUCTIVE_EFFECT_SIGNALS = new Set([
+    'git_history_destructive',
+    'git.destructive_history_write',
+    'git.destructive_worktree_write',
+]);
+const HIGH_STAKES_EFFECT_PATHS = [
+    /(?:^|[/\\])(?:\.env(?:\..*)?|credentials?(?:\.json)?|secrets?|authorized_keys|id_(?:rsa|dsa|ecdsa|ed25519)|[^/\\]+\.pem|\.ssh[/\\]config|\.zshrc|\.bashrc|\.git-credentials|\.npmrc|\.netrc|\.kube[/\\]config|\.docker[/\\]config\.json|\.gnupg(?:[/\\].*)?|\.pypirc)(?:$|[/\\])/i,
+    /(?:^|[/\\])application_default_credentials\.json$/i,
+    /(?:^|[/\\])\.config[/\\]gcloud[/\\](?:application_default_credentials\.json|credentials\.db|access_tokens\.db|legacy_credentials(?:[/\\].*)?)$/i,
+    /(?:^|[/\\])\.aws[/\\](?:credentials|config)$/i,
+    /(?:^|[/\\])\.azure[/\\](?:accessTokens\.json|azureProfile\.json|msal_token_cache\.(?:bin|json)|service_principal_entries\.json)$/i,
+    /(?:^|[/\\])\.terraform\.d[/\\]credentials\.tfrc\.json$/i,
+    /(?:^|[/\\])\.config[/\\]gh[/\\]hosts\.ya?ml$/i,
+    /(?:^|[/\\])\.oci[/\\]config$/i,
+    /(?:^|[/\\])\.config[/\\]doctl[/\\]config\.ya?ml$/i,
+];
+function effectDecision(effectDisposition, reason, matchedRule, signals) {
+    return {
+        effectDisposition,
+        outcome: effectDisposition === 'ask' ? 'require_approval' : 'allow',
+        reason,
+        signals: [...signals],
+        matchedRule,
+    };
+}
+function effectPathIsLocal(target, context) {
+    const resolved = resolveCapabilityPath(target, context.cwd);
+    return (resolveWorkspaceRootMatch(context.repoRoot, [...(context.trustedWorkspaceRoots ?? [])], resolved) !== null);
+}
+function effectPathIsHighStakes(target, context) {
+    const resolved = resolveCapabilityPath(target, context.cwd);
+    if (HIGH_STAKES_EFFECT_PATHS.some((pattern) => pattern.test(resolved))) {
+        return true;
+    }
+    if (context.protectedArtifactRoots?.some((root) => pathWithinRoot(canonicalPath(root), resolved))) {
+        return true;
+    }
+    if (isGitMetadataPath(resolved, context.repoRoot)) {
+        return true;
+    }
+    const workspaceMatch = resolveWorkspaceRootMatch(context.repoRoot, [...(context.trustedWorkspaceRoots ?? [])], resolved);
+    if (!workspaceMatch) {
+        return false;
+    }
+    return matchesSensitivePath(workspaceMatch.relativePath.replaceAll('\\', '/'), [
+        ...(context.sensitivePaths ?? []),
+    ]);
+}
+/**
+ * Policy for a lowered shell effect. It intentionally ignores executable
+ * command names, segment heads, command text, and config allowlists.
+ */
+export function evaluateEffectRequirementPolicy(requirement, context) {
+    const signals = [...requirement.evidence.signals];
+    const capabilityRequest = context.capabilityRequest ?? {
+        version: CAPABILITY_REQUEST_VERSION,
+        principal: { repoRoot: context.repoRoot },
+        action: requirement.action,
+        resource: requirement.resource,
+        context: {
+            cwd: context.cwd,
+            inputFingerprint: 'effect-plan',
+            hookKind: 'shell',
+            analysisBasis: [...requirement.evidence.basis],
+        },
+        evidence: {
+            level: requirement.evidence.level,
+            signals,
+        },
+    };
+    if (signals.includes('forged_grant')) {
+        return effectDecision('ask', 'grant_forgery', 'forbid.grant_forgery', [
+            ...signals,
+            'grant_forgery',
+        ]);
+    }
+    if (context.grants?.some((grant) => isGrantScopeTooBroad(grant) && broadGrantTargetsRequest(grant, capabilityRequest))) {
+        return effectDecision('ask', 'grant_scope_too_broad', 'forbid.broad_grant', [
+            ...signals,
+            'grant_scope_too_broad',
+        ]);
+    }
+    const matchedGrant = requirement.resource.kind === 'executable'
+        ? null
+        : findFreshGrant(capabilityRequest, [...(context.grants ?? [])]);
+    if (matchedGrant) {
+        return effectDecision('allow', 'capability_grant', 'grant.exact', grantDecisionSignals(capabilityRequest, matchedGrant));
+    }
+    if (requirement.evidence.level === 'indeterminate' ||
+        requirement.action === 'indeterminate' ||
+        requirement.tag === 'indeterminate') {
+        return effectDecision('ask', 'indeterminate_effect', 'effect.indeterminate', [
+            ...signals,
+            'indeterminate',
+        ]);
+    }
+    if (signals.some((signal) => DESTRUCTIVE_EFFECT_SIGNALS.has(signal))) {
+        return effectDecision('ask', 'git_history_destructive', 'effect.destructive', signals);
+    }
+    if (signals.includes('belay_control_plane_command')) {
+        return effectDecision('allow', 'belay_control_plane_command', 'effect.belay_control_plane_command', signals);
+    }
+    switch (requirement.action) {
+        case 'fs.read':
+            if (requirement.resource.kind === 'path' &&
+                effectPathIsHighStakes(requirement.resource.path, context)) {
+                return effectDecision('ask', 'high_stakes_path', 'effect.fs_read_high_stakes', [
+                    ...signals,
+                    'sensitive_path_read',
+                ]);
+            }
+            return effectDecision('allow', 'read_only', 'effect.fs_read', signals);
+        case 'fs.write':
+            if (requirement.resource.kind === 'package-cache') {
+                return effectDecision('allow_flagged', 'repo_local_mutation', 'effect.package_cache_write', signals);
+            }
+            if (requirement.resource.kind !== 'path') {
+                return effectDecision('ask', 'indeterminate_effect', 'effect.fs_write_unknown', signals);
+            }
+            if (effectPathIsHighStakes(requirement.resource.path, context)) {
+                return effectDecision('ask', 'high_stakes_path', 'effect.fs_write_high_stakes', [
+                    ...signals,
+                    'tier1_catastrophic',
+                    ...(!effectPathIsLocal(requirement.resource.path, context)
+                        ? ['outside_repo_secret_credential_path']
+                        : []),
+                ]);
+            }
+            return effectPathIsLocal(requirement.resource.path, context)
+                ? effectDecision('allow_flagged', 'repo_local_mutation', 'effect.fs_write_local', signals)
+                : effectDecision('ask', 'outside_repo_mutation', 'effect.fs_write_outside', signals);
+        case 'process.exec':
+            if (requirement.resource.kind !== 'executable') {
+                return effectDecision('ask', 'indeterminate_effect', 'effect.process_unknown', signals);
+            }
+            if (requirement.resource.operation === 'inspect') {
+                return effectDecision('allow', 'read_only', 'effect.process_inspect', signals);
+            }
+            if (requirement.resource.operation === 'spawn') {
+                return effectDecision('allow_flagged', 'repo_local_mutation', 'effect.process_spawn', signals);
+            }
+            return effectDecision('ask', 'high_stakes_path', 'effect.process_signal', signals);
+        case 'network.connect': {
+            if (requirement.tag === 'network.acquire' ||
+                requirement.resource.kind !== 'network' ||
+                !requirement.resource.mode ||
+                !requirement.resource.payload) {
+                return effectDecision('ask', 'external_effect', 'effect.network_unknown', signals);
+            }
+            const loopback = LOOPBACK_HOSTS.has(requirement.resource.host.replace(/^\[|\]$/g, '').toLowerCase());
+            if (requirement.resource.payload === 'secret') {
+                return effectDecision('ask', 'high_stakes_path', 'effect.network_secret_payload', [
+                    ...signals,
+                    'secret_payload_send',
+                ]);
+            }
+            if (loopback && requirement.resource.mode === 'mutate') {
+                return effectDecision('allow_flagged', 'repo_local_mutation', 'effect.network_loopback_mutation', signals);
+            }
+            if (requirement.resource.mode === 'read' && requirement.resource.payload === 'none') {
+                return effectDecision('allow', 'read_only', 'effect.network_read', signals);
+            }
+            return effectDecision('ask', 'external_effect', 'effect.network_remote_mutation', signals);
+        }
+        case 'git.ref.write':
+            if (requirement.resource.kind !== 'git-ref' || !requirement.resource.scope) {
+                return effectDecision('ask', 'indeterminate_effect', 'effect.git_ref_unknown', signals);
+            }
+            if (requirement.resource.scope === 'remote') {
+                return effectDecision('ask', 'external_effect', 'effect.git_ref_remote', signals);
+            }
+            if (requirement.resource.repoPath &&
+                !effectPathIsLocal(requirement.resource.repoPath, context)) {
+                return effectDecision('ask', 'outside_repo_mutation', 'effect.git_ref_outside', signals);
+            }
+            return effectDecision('allow_flagged', 'repo_local_mutation', 'effect.git_ref_local', signals);
+        case 'secret.read':
+            return effectDecision('ask', 'high_stakes_path', 'effect.secret_read', signals);
+        case 'control_plane.write':
+            return effectDecision('ask', 'control_plane_mutation', 'effect.control_plane_write', signals);
+        default:
+            return effectDecision('ask', 'indeterminate_effect', 'effect.unknown', signals);
+    }
+}
 function enrichAuthWithMaterializedGrants(request, config, auth) {
     if (!auth?.attestation || !boundaryVerifiedAllowEnabled(auth.attestation)) {
         return auth;

package/dist/core/capability/request.d.ts

@@ -2,6 +2,10 @@ export declare const CAPABILITY_REQUEST_VERSION: 1;
 export type CapabilityAction = 'fs.read' | 'fs.write' | 'process.exec' | 'network.connect' | 'secret.read' | 'git.ref.write' | 'control_plane.write' | 'indeterminate';
 export type CapabilityEvidenceLevel = 'certain' | 'possible' | 'indeterminate';
 export type CapabilityHookKind = 'shell' | 'tool' | 'subagent';
+export type NetworkMode = 'read' | 'mutate' | 'ambiguous';
+export type NetworkPayload = 'none' | 'present' | 'secret';
+export type ProcessOperation = 'inspect' | 'spawn' | 'signal';
+export type GitRefScope = 'local' | 'remote';
 export interface CapabilityPrincipal {
     adapter?: string;
     repoRoot: string;
@@ -15,15 +19,20 @@ export type CapabilityResource = {
     host: string;
     port?: number;
     protocol?: string;
+    mode?: NetworkMode;
+    payload?: NetworkPayload;
 } | {
     kind: 'executable';
     command: string;
+    operation?: ProcessOperation;
 } | {
     kind: 'package-cache';
     manager: 'npm' | 'pnpm';
 } | {
     kind: 'git-ref';
     ref: string;
+    scope?: GitRefScope;
+    repoPath?: string;
 } | {
     kind: 'unknown';
 };

package/dist/core/capability/resolver.d.ts

@@ -1,4 +1,3 @@
-export { evaluateSegmentShellPolicy, type SegmentShellPolicyInput, } from '../verdict/shell-policy.js';
 export { BOUNDARY_PROFILE_L3_POLICY, checkGatedActionLimits } from './limits.js';
 export { type CapabilityAuthorizationMetadata, policyReasonToLegacyReason, singleCapabilityMetadata, } from './policy-bridge.js';
 export { buildFileMutationCapabilityRequest, buildShellCapabilityRequest, buildSubagentCapabilityRequest, evaluateFileMutationPolicy, evaluateShellPolicy, evaluateSubagentPolicy, type FileMutationCapabilityAnalysis, policyDecisionRequiresAsk, type ShellCapabilityAnalysis, type SubagentCapabilityAnalysis, } from './policy-engine.js';

package/dist/core/capability/resolver.js

@@ -1,4 +1,3 @@
-export { evaluateSegmentShellPolicy, } from '../verdict/shell-policy.js';
 export { BOUNDARY_PROFILE_L3_POLICY, checkGatedActionLimits } from './limits.js';
 export { policyReasonToLegacyReason, singleCapabilityMetadata, } from './policy-bridge.js';
 export { buildFileMutationCapabilityRequest, buildShellCapabilityRequest, buildSubagentCapabilityRequest, evaluateFileMutationPolicy, evaluateShellPolicy, evaluateSubagentPolicy, policyDecisionRequiresAsk, } from './policy-engine.js';

package/dist/core/config.js

@@ -937,8 +937,6 @@ export function scrubOptionsFromConfig(config) {
 export function classifierOptionsFromConfig(config) {
     return {
         strictChains: config.classifier.strictChains,
-        customExternalCommands: config.overrides.external,
-        customAllowCommands: config.overrides.allow,
         sensitivePaths: config.classifier.sensitivePaths,
         unknownLocalEffect: config.policy.unknownLocalEffect,
         unparseableShell: config.policy.unparseableShell,

package/dist/core/effect-ir/audit.js

@@ -12,6 +12,7 @@ function auditableResource(resource) {
         return {
             kind: 'executable',
             commandHash: hashValue(resource.command),
+            ...(resource.operation ? { operation: resource.operation } : {}),
         };
     }
     return resource;

package/dist/core/effect-ir/build.js

@@ -72,7 +72,11 @@ function delegateExecNode(peel, innerRecipe, segmentHead, resolvedLocalPath) {
                     {
                         tag: 'process.exec',
                         action: 'process.exec',
-                        resource: { kind: 'executable', command: resolvedLocalPath ?? segmentHead },
+                        resource: {
+                            kind: 'executable',
+                            command: resolvedLocalPath ?? segmentHead,
+                            operation: 'spawn',
+                        },
                         evidence: {
                             level: resolvedLocalPath ? 'certain' : peel.forceAcquire ? 'possible' : 'certain',
                             signals: [

package/dist/core/effect-ir/index.d.ts

@@ -1,8 +1,13 @@
+export type { GitRefScope, NetworkMode, NetworkPayload, ProcessOperation, } from '../capability/request.js';
 export { effectPlanAuditFields, hashEffectPlan } from './audit.js';
 export { buildCapabilityEffectPlan, buildEffectPlan, buildPackageExecEffectNode, collectRequirements, flattenRequirementsToCapabilityRequests, } from './build.js';
 export { mergeEffectPlans, mergeRequirements, normalizeEffectTags } from './normalize.js';
 export { innerRecipeFromPeel, isPackageExecLauncher, peelPackageExecArgv, resolveLocalBin, } from './package-exec.js';
 export { evaluatePackageExecSegment } from './package-exec-eval.js';
 export { capabilityRequestsFromEffectPlan, capabilityRequestsToEffectRequirements, effectPlanPolicyLegacyReason, effectPlanPolicyRequiresAsk, evaluateEffectPlanPolicy, } from './policy.js';
-export type { EffectEvidence, EffectNode, EffectPlan, EffectProvenance, EffectRequirement, EffectTag, ExecEffectNode, LauncherEffectNode, LauncherPhase, MergeEffectNode, PackageExecLauncher, } from './types.js';
+export type { BuildShellEffectPlanParams, ShellEffectRequirement, ShellEffectResource, ShellEffectSegment, } from './shell-build.js';
+export { buildShellEffectPlan } from './shell-build.js';
+export type { LowerShellEffectPlanParams } from './shell-lower.js';
+export { lowerShellEffectPlan } from './shell-lower.js';
+export type { AnalysisCompleteness, EffectEvidence, EffectNode, EffectPlan, EffectPlanDisposition, EffectPlanPolicyProjection, EffectProvenance, EffectRequirement, EffectTag, ExecEffectNode, LauncherEffectNode, LauncherPhase, MergeEffectNode, PackageExecLauncher, } from './types.js';
 export { EFFECT_PLAN_VERSION } from './types.js';

package/dist/core/effect-ir/index.js

@@ -4,4 +4,6 @@ export { mergeEffectPlans, mergeRequirements, normalizeEffectTags } from './norm
 export { innerRecipeFromPeel, isPackageExecLauncher, peelPackageExecArgv, resolveLocalBin, } from './package-exec.js';
 export { evaluatePackageExecSegment } from './package-exec-eval.js';
 export { capabilityRequestsFromEffectPlan, capabilityRequestsToEffectRequirements, effectPlanPolicyLegacyReason, effectPlanPolicyRequiresAsk, evaluateEffectPlanPolicy, } from './policy.js';
+export { buildShellEffectPlan } from './shell-build.js';
+export { lowerShellEffectPlan } from './shell-lower.js';
 export { EFFECT_PLAN_VERSION } from './types.js';

package/dist/core/effect-ir/normalize.js

@@ -77,13 +77,19 @@ function resourceKey(resource) {
         case 'path':
             return resource.path;
         case 'network':
-            return `${resource.host}:${resource.port ?? ''}:${resource.protocol ?? ''}`;
+            return [
+                resource.host,
+                resource.port ?? '',
+                resource.protocol ?? '',
+                resource.mode ?? '',
+                resource.payload ?? '',
+            ].join(':');
         case 'executable':
-            return resource.command;
+            return `${resource.command}:${resource.operation ?? ''}`;
         case 'package-cache':
             return resource.manager;
         case 'git-ref':
-            return resource.ref;
+            return `${resource.ref}:${resource.scope ?? ''}:${resource.repoPath ?? ''}`;
         case 'unknown':
             return 'unknown';
         default:

package/dist/core/effect-ir/policy.d.ts

@@ -1,13 +1,14 @@
 import type { PolicyDecision } from '../capability/policy-types.js';
 import type { CapabilityRequestV1 } from '../capability/request.js';
 import type { VerdictContext } from '../verdict/types.js';
-import type { EffectPlan, EffectRequirement } from './types.js';
+import type { EffectPlan, EffectPlanPolicyProjection, EffectRequirement } from './types.js';
 export declare function capabilityRequestsToEffectRequirements(requests: readonly CapabilityRequestV1[]): EffectRequirement[];
 export declare function capabilityRequestsFromEffectPlan(plan: EffectPlan, context: VerdictContext): CapabilityRequestV1[];
 export declare function evaluateEffectPlanPolicy(plan: EffectPlan, context: VerdictContext): {
     capabilityRequests: CapabilityRequestV1[];
     decisions: PolicyDecision[];
     authorizationDecision: PolicyDecision;
+    projection: EffectPlanPolicyProjection;
 };
 export declare function effectPlanPolicyRequiresAsk(decision: PolicyDecision): boolean;
 export declare function effectPlanPolicyLegacyReason(decision: PolicyDecision): string;