@intutic/shared-types 1.10.0 → 1.10.1

package/dist/workspaceSettings.d.ts

@@ -19,7 +19,56 @@ export type { McpProxyFailBehavior, McpProxyMode, BypassEnforcementTier };
  * DEFAULT_WORKSPACE_SETTINGS by the control-plane GET handler and the
  * sync-daemon before writing runtime.env.
  */
+/** BYOC trace-storage configuration (mirrors the control plane's WorkspaceByocConfig). */
+export interface ByocStorageConfig {
+    provider: 'gcs' | 's3' | 'disabled';
+    bucketName?: string;
+    prefix?: string;
+    projectId?: string;
+    region?: string;
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    credentials?: string;
+    mode?: 'mirror' | 'primary';
+}
 export interface WorkspaceSettings {
+    /**
+     * Whether developers' local markdown vaults (Obsidian/Logseq/Foam) may feed
+     * the `/fix` command's Memory context on their machines.
+     *
+     * Enforced by the proxy at connect time via the sync channel. Vault content
+     * never reaches the control plane either way — this governs only whether
+     * the local search runs at all. Personal notes injected into prompts are a
+     * memory-poisoning surface (OWASP agentic T1), which is why the switch is a
+     * workspace policy rather than purely personal preference.
+     */
+    allowLocalMemoryVaults: boolean;
+    /**
+     * Days of SSO inactivity after which a member's API keys stop authenticating.
+     *
+     * `null` disables the gate. Defaults to 30 days. SCIM provisioning was removed,
+     * so nothing reconciles membership against the identity provider: without this,
+     * removing a developer at the IdP stops their dashboard login but not their
+     * agents, because API-key auth never consults SSO (TD-218). Setting it makes IdP
+     * removal expire the keys on its own.
+     *
+     * Opt-in on purpose — a CI key belongs to a member who may never log in
+     * interactively, and enabling this globally would break those pipelines.
+     */
+    ssoKeyMaxIdleDays: number | null;
+    /**
+     * ISO timestamp of when `ssoKeyMaxIdleDays` was switched on, set by the settings
+     * endpoint. The gate grants one full window from this point before it refuses
+     * anything, so enabling it ramps rather than cutting off members who have no
+     * recorded SSO login yet. Cleared when the gate is turned off.
+     */
+    ssoKeyGateEnabledAt: string | null;
+    /**
+     * Bring-your-own-cloud trace storage. Optional — absent means Intutic-managed
+     * storage. Previously accessed only through `as unknown as` casts; typed here
+     * so the settings UI and the control plane share one shape.
+     */
+    byocStorage?: ByocStorageConfig;
     /**
      * What the MCP governance proxy does when the Intutic control plane is
      * unreachable during a tool call interception attempt.
@@ -29,22 +78,25 @@ export interface WorkspaceSettings {
      *     "Governance check failed — Intutic control plane unreachable.
      *      Tool call blocked by workspace policy."
      *
-     * Applies to 13/17 harnesses (those with MCP proxy injection).
-     * See TD-151 for the 4 harnesses this does not reach.
+     * Applies to 8/19 harnesses (those with MCP proxy injection — 9 config
+     * paths across 8 harnesses, see sync-daemon mcpAutoWrite.ts).
+     * See TD-151 for the harnesses this does not reach.
      */
     mcpProxyFailBehavior: McpProxyFailBehavior;
     /**
      * MCP proxy deployment model.
      *
-     * - `'per-session'` (default, Phase 4): a new proxy process is spawned per
+     * - `'per-session'` (default): a new proxy process is spawned per
      *   MCP connection. Policy is fetched from control plane at startup with a
      *   60s in-process TTL.
-     * - `'daemon'` (Phase 5, stored but not yet active): a long-lived proxy
-     *   daemon shares policy cache across all MCP sessions. Requires macOS
-     *   notarization. See TD-153.
+     * - `'daemon'` (active): a long-lived proxy daemon shares its policy cache
+     *   across all MCP sessions. Requires macOS notarization. See TD-153.
      *
-     * In Phase 4, setting this to `'daemon'` is accepted and stored but the
-     * sync-daemon will log a warning and continue in per-session mode.
+     * The sync-daemon writes this value through verbatim to
+     * ~/.intutic/env/runtime.env (lib/runtimeEnv.ts) and the MCP proxy honours
+     * it: with `'daemon'` set, policy lookups go through the daemon's Unix
+     * socket. Caveat: daemon health telemetry is not reported — the
+     * health-snapshot route was removed and the dashboard flag is hardcoded off.
      */
     mcpProxyMode: McpProxyMode;
     /**
@@ -68,26 +120,81 @@ export interface WorkspaceSettings {
         ff_response_cache_semantic?: boolean;
         /** Phase 5 — MetaClaw prompt evolution engine (Enterprise only) */
         ff_metaclaw_evolution?: boolean;
+        /**
+         * Evaluate every detector, record what it would have done, and allow the
+         * request anyway. Read by the proxy from `workspace:feature_flags:{ws}`.
+         *
+         * Declaring it here is not enough on its own — the PUT schema in
+         * `routes/workspace.ts` must list it too, because that `z.object` strips
+         * unknown keys. `ff_metaclaw_evolution` above was declared here and omitted
+         * there, so it has never been settable either.
+         */
+        ff_shadow_enforcement?: boolean;
+        /**
+         * Let a MetaClaw evolution proposal auto-apply instead of waiting for
+         * human review. Read directly off raw settings JSON by
+         * `promptEvolutionService.runEvolutionCycle` — no Valkey mirror, since
+         * nothing else needs a hot-path read of it.
+         *
+         * Also declared here without being settable until now — same "declared,
+         * never added to the PUT schema" bug as `ff_shadow_enforcement` above.
+         */
+        ff_metaclaw_auto_apply?: boolean;
+        /**
+         * Let a high-confidence SkillOpt config-edit suggestion auto-apply
+         * instead of waiting for human review. Mirrored into Valkey
+         * (`ff:{workspaceId}:skillopt_auto_apply`) by `persistAndSyncSettings`,
+         * since `skillOptService.autoApplyIfEnabled` needs a hot-path read.
+         */
+        ff_skillopt_auto_apply?: boolean;
+        /**
+         * Promote `destructive.sql_drop` from `warn` to `block` on the sync
+         * daemon's hook-gate path (Wave 7, audit-remediation). Read by
+         * `GET /api/v1/policy/resolve` (`routes/evaluate.ts`), which surfaces it
+         * as `sqlDropStrictBlock` on the response; the sync daemon's
+         * `buildSnapshotRules` (`services/sync-daemon/src/lib/policySnapshot.ts`)
+         * applies it as a per-rule override on the next sync cycle — independent
+         * of `DESTRUCTIVE_TIER_SEVERITY`, the evidence-gated promotion ramp that
+         * governs the OTHER six `DESTRUCTIVE_COMMAND_PATTERNS` entries.
+         * `destructive.sql_drop` was never part of that ramp (its own static
+         * definition is `severity: 'warn'`, not `'block'`, so the ramp's ternary
+         * never reaches it) — its rationale is a genuinely different one
+         * (the gate cannot distinguish a dev DSN from a production one; the MCP
+         * path already blocks, because the proxy CAN make that distinction).
+         * This flag exists for a workspace that wants the hook path to match the
+         * MCP path anyway, accepting the dev-DSN false-positive risk explicitly.
+         * `false` by default; `true` in the `strict` security posture preset
+         * (`posturePresets.ts`) — never auto-promoted by traffic evidence the
+         * way the six-pattern ramp is.
+         */
+        ff_sql_drop_strict_block?: boolean;
     };
-    /**
-     * TD-126 — Autonomous Skill Transfer
-     *
-     * When `true`, this workspace participates in the cross-workspace SOP
-     * propagation system:
-     * - High-performing validated SOPs (Gödel score ≥ 0.85) from this workspace
-     *   may be cloned to other opt-in workspaces as DRAFT SOPs.
-     * - This workspace will receive propagated SOPs from other opt-in workspaces
-     *   provided no structurally similar SOP already exists (Jaccard ≥ 0.70).
-     *
-     * Defaults to `false` (opt-in only).
-     */
-    enableAutonomousSkillTransfer?: boolean;
     /**
      * Whether to automatically delete local skills/rules segments that fail
      * security audits (leakage of secrets or unsafe wildcard command patterns).
      * Defaults to `false`.
      */
     enableLocalSkillAuditDelete?: boolean;
+    /**
+     * Phase S3. Whether `intutic skill audit` should AUTOMATICALLY run the
+     * opt-in Cisco `skill-scanner` integration (`tools/cli/src/lib/ciscoScanner.ts`)
+     * alongside native scanning, when the `skill-scanner` binary happens to be
+     * on PATH. Off by default — a workspace that never configured this must
+     * not start shelling out to an external tool it never asked for.
+     *
+     * This is distinct from `--engine cisco` (an explicit, per-invocation
+     * request that fails loudly if the binary is absent): this setting gates
+     * a graceful, best-effort AUTO-run — when true but the binary is absent,
+     * the CLI logs an info-level skip and continues with native scanning
+     * only, exactly the "opt-in but gracefully degrading" contract this
+     * integration promises throughout.
+     *
+     * No Valkey projection, following the exact precedent
+     * `enableLocalSkillAuditDelete` sets immediately above: the CLI reads
+     * this straight off the synced `settings` object via `fetchConfig`, and
+     * nothing else needs a hot-path read of it.
+     */
+    ciscoSkillScannerEnabled?: boolean;
     /**
      * Configurable trigger keywords for classifying bandit task types.
      */
@@ -97,6 +204,331 @@ export interface WorkspaceSettings {
         review?: string[];
         debugging?: string[];
     };
+    /**
+     * Container-image provenance policy, enforced at the gate before a deploy
+     * runs. Off unless explicitly enabled — a workspace that never configured
+     * this must not start refusing deploys because a default changed.
+     *
+     * The control plane has no filesystem, so it can only verify images written
+     * into the tool call itself. `unverifiableAction` decides what happens to a
+     * `kubectl apply -f manifest.yaml`, and defaults to `allow`: refusing every
+     * file-based apply would refuse the correct ones too, and a control that
+     * broad gets switched off. See imageProvenanceService.ts.
+     */
+    imageProvenance?: {
+        enabled?: boolean;
+        /** Refuse any image not pinned to an `@sha256:` digest. */
+        requireDigest?: boolean;
+        /** Registry prefixes that may be pulled from. Empty means any. */
+        allowedRegistries?: string[];
+        /** `repository -> approved digests`. Empty means any digest satisfies pinning. */
+        approvedDigests?: Record<string, string[]>;
+        unverifiableAction?: 'allow' | 'warn' | 'block';
+    };
+    /**
+     * Whether an APPROVED `review_before` decision may let the *matching retried
+     * call* through the local gate, instead of only recording the decision.
+     *
+     * Off (undefined/false) by default. `POST /api/v1/decisions` and its Slack
+     * approve button have always recorded a decision — this flag governs a
+     * separate, additive effect: when true, approving a decision tied to a
+     * `review_before` hold writes a short-lived, exact-match bypass entry
+     * (workspace + SOP rule + normalised tool name + hashed target/command) to
+     * Valkey, synced to `.intutic/hooks/approved-bypasses.jsonl` and consulted by
+     * the gate immediately before it would otherwise block on that rule. It never
+     * relaxes the rule itself, never matches fuzzily, and never outlives
+     * {@link reviewHoldBypassTtlMinutes}.
+     */
+    reviewHoldBypassEnabled?: boolean;
+    /**
+     * Minutes an approved `review_before` bypass stays valid, when
+     * {@link reviewHoldBypassEnabled} is true. Defaults to 10 when the feature is
+     * on but this is unset; capped at 60 by the settings PUT schema — a bypass is
+     * meant to let one already-reviewed retry through, not to stand up a lasting
+     * exemption.
+     */
+    reviewHoldBypassTtlMinutes?: number;
+    /**
+     * Central egress-enforcement posture, distributed to this workspace's proxies
+     * (LLD #63 §4). One of `'off'` | `'monitor'` | `'enforce'`. When set, the
+     * sync-daemon writes it to `.intutic/hooks/egress-policy.json` and the proxy
+     * hot-reloads it, so an admin sets the mode once here rather than in each
+     * developer's local config. Undefined leaves the proxy on its local config /
+     * `INTUTIC_EGRESS_MODE` — central management is additive, never a silent
+     * override of a deployment that never opted in.
+     */
+    egressMode?: 'off' | 'monitor' | 'enforce';
+    /**
+     * Central egress allow policy: exact hosts, `.suffix` domains, or CIDRs the
+     * proxy permits in `enforce`/`monitor` mode, distributed alongside
+     * {@link egressMode}. UNIONed with the proxy's local allow entries so a
+     * developer's local infra allowances are never dropped by a central list.
+     */
+    egressAllow?: string[];
+    /**
+     * Approved-models allowlist: model ids the proxy will accept for this
+     * workspace's completions. Distributed to the proxy's control-plane cache
+     * under `workspace:allowed_models:{workspaceId}` (mirrors the `egressAllow`
+     * distribution pattern above).
+     *
+     * Absent or empty means UNRESTRICTED — matches `egressAllow`'s own
+     * backward-compatible default, so a workspace that never configured this
+     * must not start refusing completions because a default changed.
+     */
+    allowedModels?: string[];
+    /**
+     * Additive MCP server allowlist: server names the MCP governance proxy
+     * (`packages/mcp-proxy`) will proxy for this workspace, matched against
+     * the `--server-name` identity threaded through by
+     * `services/sync-daemon/src/harness/mcpAutoWrite.ts`'s `wrapWithProxy`.
+     * Delivered to the proxy the same way `mcpAllowedTools` already is — via
+     * `PolicyClient.absorbCuration` (`packages/mcp-proxy/src/policy.ts`),
+     * fed from `GET /api/v1/sop/rules` (`services/control-plane/src/routes/
+     * sops.ts`).
+     *
+     * Absent or empty means UNRESTRICTED — the exact same convention as
+     * `allowedModels` above: a workspace that never configured this must not
+     * start refusing every MCP server because a default changed.
+     */
+    mcpAllowedServers?: string[];
+    /**
+     * Workspace-supplied prompt-injection regex sources for the MCP governance
+     * proxy (TD-436), on top of its hardcoded floor. Delivered with the rest of
+     * the MCP curation; the proxy compiles them and drops one that does not.
+     * Absent or empty means the floor alone.
+     */
+    mcpInjectionPatterns?: string[];
+    /**
+     * Negotiated per-token rates, by model id, in USD per 1k tokens (TD-434).
+     * The `model_pricing` table is LIST price; a workspace paying below list
+     * had every savings figure skewed by the difference. Where a model is
+     * listed here it is priced at these rates in the routing shadow-savings
+     * report; anything else falls back to list. Absent or empty means list
+     * for everything.
+     */
+    contractedRates?: Record<string, {
+        inputCostPer1k: number;
+        outputCostPer1k: number;
+    }>;
+    /**
+     * Whether agents in this workspace must run inside a sandbox (LLD #63 §6).
+     * - `'off'` (default): `intutic exec` runs on the host as before.
+     * - `'warn'`: an un-sandboxed `intutic exec` runs but prints a warning.
+     * - `'require'`: `intutic exec` refuses to run un-sandboxed and tells the
+     *   developer to add `--sandbox`.
+     *
+     * Enforced client-side by the CLI (the natural point — only it knows whether
+     * `--sandbox` was passed), the same layer as the harness-config controls. A
+     * server-side attestation (the proxy refusing traffic that cannot prove it
+     * originated in a sandbox) is a stronger follow-on, noted in the LLD.
+     * `undefined` leaves it off; open core, which has no control plane to read
+     * this from, is therefore never affected.
+     */
+    sandboxRequirement?: 'off' | 'warn' | 'require';
+    /**
+     * Promotes REPEATED anomaly findings within one session into enforcement
+     * (HIJACK steers with a corrective card, KILL blocks outright) — on top
+     * of ordinary per-trace detection, which always runs regardless of this
+     * setting. See `anomalyEnforcementService.ts` for the full mechanism:
+     * off by default and a single false positive can never trigger it, only
+     * a sustained pattern within one session can.
+     *
+     * Stored under the snake_case key `anomaly_enforcement`, not
+     * `anomalyEnforcement` — deliberately inconsistent with every other
+     * field here, because that key is already the load-bearing contract
+     * `anomalyEnforcementService.ts` (and its tests) read and write
+     * directly; renaming it to match this file's camelCase convention would
+     * be a breaking migration for every already-stored workspace setting,
+     * for no behavioral benefit.
+     *
+     * This is the wire/stored shape, not the resolved one — the read side
+     * additionally floors `minRepeats` at 2 (a workspace cannot configure
+     * its way to blocking on a single finding) and falls back `action` to
+     * `HIJACK` for anything other than exactly `'KILL'`. The PUT schema
+     * mirrors that floor as a 400 at write time, so an operator who tries a
+     * lower value is told now rather than discovering later that it was
+     * silently clamped.
+     */
+    anomaly_enforcement?: {
+        enabled?: boolean;
+        minRepeats?: number;
+        minConfidence?: number;
+        action?: 'HIJACK' | 'KILL';
+        /** Categories eligible for promotion. Empty/absent means all of them. */
+        categories?: string[];
+    };
+    /**
+     * Server-side trajectory monitoring mode (LLD #52, parallel monitoring).
+     * Read by `services/control-plane/src/services/trajectoryAnalysisService.ts`'s
+     * `getWorkspaceMonitorMode` on every `/trajectory/analyze` call:
+     *
+     * - `'ACTIVE'`:  a CRITICAL/INTERVENE verdict can escalate into the
+     *   anomaly-enforcement occurrence counter (KILL/HIJACK promotion) in
+     *   addition to alerting.
+     * - `'PASSIVE'` (default): trajectories are analyzed and alerts are
+     *   recorded/dispatched, but nothing ever escalates to enforcement.
+     * - `'OFF'`:     trajectory analysis is skipped entirely for the workspace
+     *   (capability-miss production still runs — it is a separate feature).
+     *
+     * Stored under the snake_case key `trajectory_monitor_mode`, not
+     * `trajectoryMonitorMode` — deliberately inconsistent with this file's
+     * camelCase convention, following the exact precedent
+     * {@link WorkspaceSettings.anomaly_enforcement} documents below: that
+     * snake_case key is already the load-bearing contract the reading service
+     * consumes from raw jsonb, and renaming it would be a breaking migration
+     * for every already-stored workspace setting for no behavioral benefit.
+     *
+     * CONSTRAINT: the entry in {@link DEFAULT_WORKSPACE_SETTINGS} MUST stay
+     * `'PASSIVE'`, byte-for-byte matching `getWorkspaceMonitorMode`'s own
+     * absent-key fallback. The enforcement path reads the raw jsonb and applies
+     * its own fallback; the default here only affects GET/display resolution —
+     * if the two ever diverge, the UI would show a different mode than the one
+     * enforcement actually runs under.
+     */
+    trajectory_monitor_mode?: 'ACTIVE' | 'PASSIVE' | 'OFF';
+    /**
+     * Additive MCP tool allowlist, enforced by the MCP governance proxy
+     * (`packages/mcp-proxy`) and served to it by
+     * `services/control-plane/src/lib/mcpCuration.ts` (both the `/sop/rules`
+     * and `/policy/resolve` projections). Empty/absent means UNRESTRICTED —
+     * the same convention as {@link mcpAllowedServers} below, whose doc
+     * comment has referenced this field as its sibling since it was written.
+     * Was settable via the PUT schema but never declared here — the inverse
+     * of the usual both-places defect (schema-only instead of type-only),
+     * caught by the settingsKeyParity gate.
+     */
+    mcpAllowedTools?: string[];
+    /**
+     * Per-tool `tools/list` description overrides, curated by an operator and
+     * substituted by the MCP governance proxy before descriptions reach the
+     * model. Delivered alongside {@link mcpAllowedTools} via
+     * `lib/mcpCuration.ts`. Absent means no overrides. Declared here for the
+     * same reason as `mcpAllowedTools` immediately above.
+     */
+    mcpToolDescriptionOverrides?: Record<string, string>;
+    /**
+     * Governed decisions log: whether the sync-daemon writes a bounded,
+     * auto-maintained record of GOVERNANCE decisions (adjudications,
+     * approved/rejected decisions, SOP-related settings changes) as context
+     * files the coding agent's harness reads — `.intutic/DECISIONS.md` (the
+     * full bounded record) plus a marker-delimited section injected into the
+     * `claude-code` harness's own regenerated config file. See
+     * `services/control-plane/src/routes/workspace.ts`'s
+     * `GET /api/v1/workspace/decisions-digest` and
+     * `services/sync-daemon/src/lib/decisionsDigest.ts`.
+     *
+     * Deliberately narrow: this is governance-decision records only, never
+     * conversational memory or general context management (this repo pivoted
+     * away from that harness product — see this repo's own CLAUDE.md history).
+     *
+     * Off (undefined/false) by default — per the standing rule elsewhere in
+     * this file (see {@link imageProvenance}, {@link reviewHoldBypassEnabled}):
+     * a workspace that never configured this must not start seeing new files
+     * written into its tree, and a growing context file is token spend the
+     * product must not silently impose on every workspace.
+     */
+    decisionsLogEnabled?: boolean;
+    /**
+     * Opt-in LLM-based semantic analysis of skill files (Phase S5, TD-357),
+     * on top of the always-on deterministic `scanSkillContent` pattern scan.
+     * When true:
+     * - The CLI (`intutic skill audit`) attaches the FULL content of a
+     *   `SKILL.md` file (capped at 64 KiB) to its `/skills/report` entries —
+     *   never bundled scripts, which stay S2/S3/S4's domain.
+     * - The control plane judges that content once per distinct sha256 (a
+     *   30-day Valkey marker skips re-judging unchanged content), subject to
+     *   a per-workspace daily judge-call cap
+     *   (`SEMANTIC_SKILL_JUDGE_DAILY_CAP`), and strips `content` from what it
+     *   persists — only the verdict (`'clean' | 'suspicious' | 'malicious' |
+     *   'unjudged'`) is stored, never the judged text.
+     *
+     * Off (undefined/false) by default, per the standing rule elsewhere in
+     * this file: full skill content transiting the control plane is a real
+     * privacy/cost tradeoff a workspace must opt into, not one a default
+     * change should impose. See `apps/docs/guide/skill-scanning.md`'s
+     * "Semantic analysis (optional)" section for the full transit/retention
+     * statement.
+     */
+    semanticSkillAnalysisEnabled?: boolean;
+    /**
+     * BYO judge model for the MANAGED LLM-as-judge path (LLD #70).
+     *
+     * When set, chunk/finalize judge calls for this workspace run on this
+     * model, routed through the platform data-plane gateway with the
+     * workspace's own vk_ — so the completion is billed to the workspace's
+     * provider key (the key wizard), not the platform. Trade-offs, stated
+     * plainly rather than implied:
+     * - This REPLACES the platform's independent trusted monitor
+     *   (`INTUTIC_TRUSTED_MONITOR_MODEL`) for this workspace. Verdicts are
+     *   stamped `[workspace-judge]`; a judge equal to the monitored model is
+     *   additionally stamped `[self-graded]` — provenance stays visible, it
+     *   is never re-labelled as independent.
+     * - Judged content still transits the control plane and the platform
+     *   gateway to the workspace's provider. The self-hosted local judge
+     *   (`INTUTIC_GATEWAY_LOCAL_JUDGE`) remains the keep-content-in-org path.
+     * - Chunk judging fires per paragraph — that cost lands on the
+     *   workspace's provider key.
+     * - A workspace policy KILL (DLP, budget) on the judge call itself fails
+     *   safe to the standard judge-unavailable note, not a bypass.
+     *
+     * `null`/absent = the platform trusted monitor, exactly as before.
+     */
+    managedJudgeModel?: string | null;
+    /**
+     * Opt-in VirusTotal hash lookup for skill-bundled SCRIPTS (Phase S4,
+     * TD-361). When true, and only when a `connector_credentials` row for
+     * provider `'virustotal'` is also stored, `POST .../skills/report`
+     * fire-and-forget enqueues any reported script sha256 hashes for a
+     * `GET /api/v3/files/{sha256}` lookup — never an upload, never SKILL.md
+     * prose, see `virusTotalService.ts`'s own doc comment for the full
+     * hash-only doctrine. Off by default, per the standing rule elsewhere in
+     * this file: a workspace that never configured this must not start
+     * sending script hashes to a third party because a default changed.
+     *
+     * Distinct from, and narrower than, this product's standing decline of a
+     * global MCP-server-reputation/VirusTotal integration — see
+     * `apps/docs/guide/mcp-governance.md` and `docs/TECH_DEBT.md` TD-359 for
+     * that separate decision, which this setting does not reverse.
+     */
+    virusTotalSkillLookupEnabled?: boolean;
+    /**
+     * Fraction of ingested traces that receive the two heavier, LLM-adjacent
+     * security probes — `traceIngestClassifier.classifyTraceAtIngest`'s
+     * baseline/history-derived anomaly checks and `llmProbeService`'s
+     * output probe (Wave 7, audit-remediation). `1.0` (every trace) is the
+     * default and matches today's unconditional behavior exactly — setting
+     * this field at all is the opt-in, not any particular value.
+     *
+     * Exists to turn an informal "spot-check 1-in-N traces" practice into a
+     * config answer instead of a second, undocumented detection lane a
+     * workspace has no visibility into or control over. `0` disables both
+     * probes entirely (still runs the always-on deterministic checks
+     * elsewhere in the ingest path — this field only gates these two).
+     * Clamped to `[0, 1]` at the read site; an out-of-range stored value
+     * (there is no PUT-time validation preventing one) is treated as `1.0`,
+     * never as `0` — a malformed setting must not silently blind detection.
+     */
+    securityProbeSampleRate?: number;
+    /**
+     * Whether corrective governance cards accumulate adoption labels in
+     * `governance_card_labels` — the dataset a future judge fine-tune trains on.
+     *
+     * When true (the default), every corrective card queued for this workspace
+     * writes a row (card snapshot + queued_at), the proxy's delivery marker sets
+     * delivered_at, and the label sweep infers ADOPTED/NOT_ADOPTED from the
+     * session's subsequent traces unless a human has already ruled. Human labels
+     * (`label_source='human'`) always win over auto labels and are weighted
+     * higher when the dataset is used.
+     *
+     * When false, row creation and the auto-watcher stop, and the human labeling
+     * route refuses — data retention stops. Card generation, queueing, and
+     * delivery are UNCHANGED either way: opting out stops the dataset, not
+     * governance itself. On by default because the rows contain only what the
+     * workspace's own traces already persist (the card text the agent was shown),
+     * no third party is involved, and the aggregate is what makes the judge
+     * improve for everyone.
+     */
+    governanceCardLabelingEnabled: boolean;
 }
 /**
  * Default workspace settings.
@@ -109,4 +541,14 @@ export declare const DEFAULT_WORKSPACE_SETTINGS: WorkspaceSettings;
  * Ensures callers always receive a complete WorkspaceSettings object.
  */
 export declare function resolveWorkspaceSettings(stored: Partial<WorkspaceSettings> | null | undefined): WorkspaceSettings;
+/**
+ * Read `securityProbeSampleRate` off already-resolved settings, clamped to
+ * the safe (unblinded) side of any bad value. The PUT schema in
+ * `routes/workspace.ts` bounds new writes to `[0, 1]`, but this also covers
+ * a value written before that bound existed, or one that reached the row by
+ * a path other than that route (a script, a fixture) — `NaN`, `undefined`,
+ * negative or `>1` all resolve to `1.0`. Only a genuine finite value in
+ * range is trusted to lower the sample rate.
+ */
+export declare function resolveSecurityProbeSampleRate(settings: WorkspaceSettings): number;
 //# sourceMappingURL=workspaceSettings.d.ts.map

package/dist/workspaceSettings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspaceSettings.d.ts","sourceRoot":"","sources":["../src/workspaceSettings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAG3F,YAAY,EAAE,oBAAoB,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAA;AAEzE;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;;;OAWG;IACH,oBAAoB,EAAE,oBAAoB,CAAA;IAE1C;;;;;;;;;;;;OAYG;IACH,YAAY,EAAE,YAAY,CAAA;IAE1B;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C,yDAAyD;IACzD,YAAY,CAAC,EAAE;QACb,iBAAiB,CAAC,EAAE,OAAO,CAAA;QAC3B,uBAAuB,CAAC,EAAE,OAAO,CAAA;QACjC,0BAA0B,CAAC,EAAE,OAAO,CAAA;QACpC,mEAAmE;QACnE,qBAAqB,CAAC,EAAE,OAAO,CAAA;KAChC,CAAA;IAED;;;;;;;;;;;OAWG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAA;IAEvC;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAA;IAErC;;OAEG;IACH,cAAc,CAAC,EAAE;QACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;QACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;QACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;KACrB,CAAA;CACF;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,iBAiBxC,CAAA;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,GAAG,SAAS,GACpD,iBAAiB,CAKnB"}
+{"version":3,"file":"workspaceSettings.d.ts","sourceRoot":"","sources":["../src/workspaceSettings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAG3F,YAAY,EAAE,oBAAoB,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAA;AAEzE;;;;;;GAMG;AACH,0FAA0F;AAC1F,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,KAAK,GAAG,IAAI,GAAG,UAAU,CAAA;IACnC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;OASG;IACH,sBAAsB,EAAE,OAAO,CAAA;IAE/B;;;;;;;;;;;OAWG;IACH,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAEhC;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAA;IAElC;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAE/B;;;;;;;;;;;;OAYG;IACH,oBAAoB,EAAE,oBAAoB,CAAA;IAE1C;;;;;;;;;;;;;;OAcG;IACH,YAAY,EAAE,YAAY,CAAA;IAE1B;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C,yDAAyD;IACzD,YAAY,CAAC,EAAE;QACb,iBAAiB,CAAC,EAAE,OAAO,CAAA;QAC3B,uBAAuB,CAAC,EAAE,OAAO,CAAA;QACjC,0BAA0B,CAAC,EAAE,OAAO,CAAA;QACpC,mEAAmE;QACnE,qBAAqB,CAAC,EAAE,OAAO,CAAA;QAC/B;;;;;;;;WAQG;QACH,qBAAqB,CAAC,EAAE,OAAO,CAAA;QAC/B;;;;;;;;WAQG;QACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;QAChC;;;;;WAKG;QACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;QAChC;;;;;;;;;;;;;;;;;;;WAmBG;QACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;KACnC,CAAA;IAGD;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,OAAO,CAAA;IAErC;;;;;;;;;;;;;;;;;;OAkBG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAElC;;OAEG;IACH,cAAc,CAAC,EAAE;QACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;QACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;QACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;KACrB,CAAA;IAED;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE;QAChB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,2DAA2D;QAC3D,aAAa,CAAC,EAAE,OAAO,CAAA;QACvB,kEAAkE;QAClE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;QAC5B,kFAAkF;QAClF,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC1C,kBAAkB,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAA;KAChD,CAAA;IAED;;;;;;;;;;;;;OAaG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IAEjC;;;;;;OAMG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAA;IAEnC;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,SAAS,CAAA;IAE1C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IAEtB;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IAExB;;;;;;;;;;;;;OAaG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAE5B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAA;IAE/B;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAErF;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;IAE/C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,mBAAmB,CAAC,EAAE;QACpB,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,MAAM,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAA;QAC1B,yEAAyE;QACzE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;KACtB,CAAA;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,uBAAuB,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAA;IAEtD;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAE1B;;;;;;OAMG;IACH,2BAA2B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAEpD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAE7B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,4BAA4B,CAAC,EAAE,OAAO,CAAA;IAEtC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEjC;;;;;;;;;;;;;;;OAeG;IACH,4BAA4B,CAAC,EAAE,OAAO,CAAA;IAEtC;;;;;;;;;;;;;;;;OAgBG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAEhC;;;;;;;;;;;;;;;;;;OAkBG;IACH,6BAA6B,EAAE,OAAO,CAAA;CACvC;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,iBAsFxC,CAAA;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,GAAG,SAAS,GACpD,iBAAiB,CAKnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAIlF"}

package/dist/workspaceSettings.js

@@ -14,6 +14,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_WORKSPACE_SETTINGS = void 0;
 exports.resolveWorkspaceSettings = resolveWorkspaceSettings;
+exports.resolveSecurityProbeSampleRate = resolveSecurityProbeSampleRate;
 /**
  * Default workspace settings.
  * Applied when a workspace has no explicit settings (new workspaces)
@@ -21,21 +22,90 @@ exports.resolveWorkspaceSettings = resolveWorkspaceSettings;
  */
 exports.DEFAULT_WORKSPACE_SETTINGS = {
     mcpProxyFailBehavior: 'open',
+    allowLocalMemoryVaults: true,
+    // ON by default. Without it, removing a developer at the identity provider stops
+    // their dashboard login but not their agents, and nothing reconciles membership.
+    // 30 days is long enough that an ordinary working month keeps a key alive, and
+    // short enough that an offboarded developer's agents stop within a sprint. Set to
+    // null to disable. Automation keys are exempt (api_keys.is_service_account), and
+    // the gate only applies to workspaces that actually have an SSO provider.
+    ssoKeyMaxIdleDays: 30,
+    ssoKeyGateEnabledAt: null,
     mcpProxyMode: 'per-session',
     bypassEnforcementTier: 'rewrite',
     featureFlags: {
         ff_bandit_routing: false,
         ff_response_cache_exact: false,
         ff_response_cache_semantic: false,
+        ff_metaclaw_evolution: false,
+        // Off by default, and the proxy resolves an absent flag to false as well —
+        // an unreachable flag service must never silently disable enforcement.
+        ff_shadow_enforcement: false,
+        ff_metaclaw_auto_apply: false,
+        ff_skillopt_auto_apply: false,
+        // Off by default — see the field doc. The `strict` security posture
+        // preset turns it on; nothing else does.
+        ff_sql_drop_strict_block: false,
     },
-    enableAutonomousSkillTransfer: false,
     enableLocalSkillAuditDelete: false,
+    // Off by default — see the field doc above. A workspace must explicitly
+    // opt in before the CLI shells out to any externally-installed tool.
+    ciscoSkillScannerEnabled: false,
+    // Off by default — full skill content transiting the control plane for
+    // semantic judging is opt-in. See the field doc for the full statement.
+    semanticSkillAnalysisEnabled: false,
     banditKeywords: {
         testing: ['test', 'spec', 'assert', 'vitest', 'jest', 'unittest'],
         deployment: ['deploy', 'release', 'kubernetes', 'docker', 'gke', 'pipeline', 'ci/cd'],
         review: ['review', 'audit', 'lint', 'eslint', 'pr'],
         debugging: ['fix', 'bug', 'issue', 'error', 'crash', 'debug'],
     },
+    // Off, and `enabled` must be literally true to turn it on. A workspace that
+    // never configured image provenance must not begin refusing deploys.
+    imageProvenance: {
+        enabled: false,
+        requireDigest: true,
+        allowedRegistries: [],
+        approvedDigests: {},
+        unverifiableAction: 'allow',
+    },
+    // Off by default — approving a review_before decision is observation-only
+    // until a workspace opts in. See the field doc for what turning it on does.
+    reviewHoldBypassEnabled: false,
+    // Only load-bearing once reviewHoldBypassEnabled is true; the value here is
+    // what "enabled but unset" resolves to.
+    reviewHoldBypassTtlMinutes: 10,
+    // Platform trusted monitor judges by default — see the field doc for what
+    // setting a workspace's own model trades away.
+    managedJudgeModel: null,
+    // Off by default — see the field doc for why a growing auto-written
+    // context file must be opt-in.
+    decisionsLogEnabled: false,
+    // MUST match getWorkspaceMonitorMode's absent-key fallback in
+    // trajectoryAnalysisService.ts exactly ('PASSIVE'): the enforcement path
+    // reads the raw jsonb with its own fallback, so this default is display
+    // resolution only — a different value here would make the UI show a mode
+    // enforcement does not actually run under. See the field doc.
+    trajectory_monitor_mode: 'PASSIVE',
+    // Off by default — mirrors anomalyEnforcementService.ts's own DISABLED
+    // default exactly, so a workspace that never configures this sees the
+    // identical values whether resolved here or read directly from the DB.
+    anomaly_enforcement: {
+        enabled: false,
+        minRepeats: 3,
+        minConfidence: 0.8,
+        action: 'HIJACK',
+        categories: [],
+    },
+    // Off by default — see the field doc for the hash-only doctrine and why
+    // this must never turn on for a workspace that never configured it.
+    virusTotalSkillLookupEnabled: false,
+    // ON by default — see the field doc. Opting out stops label retention for
+    // the judge fine-tuning dataset, never card delivery itself.
+    governanceCardLabelingEnabled: true,
+    // 1.0 = every trace, matching the unconditional behavior this knob
+    // replaces exactly. See the field doc for what a lower value gates.
+    securityProbeSampleRate: 1.0,
 };
 /**
  * Merge partial stored settings with defaults.
@@ -47,4 +117,19 @@ function resolveWorkspaceSettings(stored) {
         ...(stored ?? {}),
     };
 }
+/**
+ * Read `securityProbeSampleRate` off already-resolved settings, clamped to
+ * the safe (unblinded) side of any bad value. The PUT schema in
+ * `routes/workspace.ts` bounds new writes to `[0, 1]`, but this also covers
+ * a value written before that bound existed, or one that reached the row by
+ * a path other than that route (a script, a fixture) — `NaN`, `undefined`,
+ * negative or `>1` all resolve to `1.0`. Only a genuine finite value in
+ * range is trusted to lower the sample rate.
+ */
+function resolveSecurityProbeSampleRate(settings) {
+    const rate = settings.securityProbeSampleRate;
+    if (typeof rate !== 'number' || !Number.isFinite(rate) || rate < 0 || rate > 1)
+        return 1.0;
+    return rate;
+}
 //# sourceMappingURL=workspaceSettings.js.map