@intutic/sync-daemon 2.2.0 → 2.4.0

package/dist/lib/mcpRegistryPy.js

@@ -0,0 +1,173 @@
+/**
+ * The MCP server registry and allowlist decisions in Python, for the bash
+ * gates (their extractor already requires python3).
+ *
+ * Byte-identical to `packages/intutic-clawde/intutic_clawde/gate/mcp_registry.py`,
+ * which a test compares; edit that file and copy it here. It is the
+ * transliteration of `@intutic/shared-types`'s mcpRegistryRecord.ts, and both
+ * run the shared vectors.
+ */
+export const MCP_REGISTRY_PY_SOURCE = String.raw `"""The MCP server registry and allowlist decisions, read from the policy snapshot.
+
+A transliteration of packages/shared-types/src/mcpRegistryRecord.ts: the
+registry decision (evaluateMcpRegistry), the allowlist decision
+(evaluateMcpAllowlist), and the snapshot's @mcp_registry and @mcp_allowlist
+records. The control plane's hook gate, the MCP proxy and the JavaScript hook
+gates run the TypeScript; the bash hook gates and this package run this file,
+and every one of them runs packages/shared-types/fixtures/mcp-registry-vectors.json,
+so all of them refuse a call with the same code, rule id and reason.
+
+The bash gates emit this file verbatim (services/sync-daemon/src/lib/mcpRegistryPy.ts
+holds a byte-identical copy, which a test compares). It must stay
+self-contained: the standard library only, no module state beyond the
+constants below, and no backtick or dollar-brace, which the TypeScript copy
+cannot hold.
+
+Both records sit inside the snapshot's digest. A gate that finds the snapshot
+unverified (its digest broken or missing, or another workspace's) trusts
+neither: it refuses every MCP call with unverified_refusal, at block, in an
+observe-only workspace too.
+"""
+
+import base64
+import json
+
+MCP_REGISTRY_RECORD_TAG = "@mcp_registry"
+MCP_ALLOWLIST_RECORD_TAG = "@mcp_allowlist"
+
+
+def split_mcp_tool_name(tool):
+    """(server, tool) for a harness name mcp__<server>__<tool>, else None.
+
+    The server is the part before the first double underscore; the tool, the
+    rest, may hold more of them.
+    """
+    if not isinstance(tool, str) or not tool.startswith("mcp__"):
+        return None
+    rest = tool[len("mcp__"):]
+    sep = rest.find("__")
+    if sep <= 0:
+        return None
+    return rest[:sep], rest[sep + 2:]
+
+
+def _strings(value):
+    return [v for v in value if isinstance(v, str)] if isinstance(value, list) else []
+
+
+def parse_registry(value):
+    """The registry as the control plane sends it, or None for a non-object.
+
+    Wrong-typed lists read as empty, and any default but deny as allow.
+    """
+    if not isinstance(value, dict):
+        return None
+    disabled = {}
+    if isinstance(value.get("disabledTools"), dict):
+        for server, tools in value["disabledTools"].items():
+            names = _strings(tools)
+            if names:
+                disabled[server] = names
+    return {
+        "defaultPolicy": "deny" if value.get("defaultPolicy") == "deny" else "allow",
+        "approvedServers": _strings(value.get("approvedServers")),
+        "blockedServers": _strings(value.get("blockedServers")),
+        "heldServers": _strings(value.get("heldServers")),
+        "disabledTools": disabled,
+    }
+
+
+def decode_registry_record(line):
+    """The @mcp_registry line's registry; None for another line or a damaged one."""
+    parts = line.split("\t")
+    if len(parts) != 2 or parts[0] != MCP_REGISTRY_RECORD_TAG or not parts[1]:
+        return None
+    try:
+        return parse_registry(json.loads(base64.b64decode(parts[1], validate=True).decode("utf-8")))
+    except Exception:
+        return None
+
+
+def evaluate_registry(registry, server, tool):
+    """(code, rule_id, reason) refusing one MCP call, or None to let it continue.
+
+    A blocked server, then a held one, then (under deny) one not approved,
+    then a disabled tool.
+    """
+    if server in registry["blockedServers"]:
+        return (
+            "SERVER_BLOCKED",
+            "mcp_registry." + server,
+            "MCP server \"" + server + "\" is blocked in this workspace's MCP server registry. "
+            "An owner or admin can change that on the MCP Servers page.",
+        )
+    if server in registry["heldServers"]:
+        return (
+            "SERVER_HELD",
+            "mcp_registry." + server,
+            "MCP server \"" + server + "\" changed its tools in a way scored high risk, and this workspace "
+            "holds such a server until it is approved again. It is waiting in the approval queue on the MCP "
+            "Servers page for an owner or admin.",
+        )
+    if registry["defaultPolicy"] == "deny" and server not in registry["approvedServers"]:
+        return (
+            "SERVER_NOT_APPROVED",
+            "mcpDefaultPolicy",
+            "MCP server \"" + server + "\" is not approved in this workspace's MCP server registry, "
+            "and the workspace refuses unapproved servers (mcpDefaultPolicy: deny). It is waiting in "
+            "the approval queue on the MCP Servers page for an owner or admin.",
+        )
+    if tool in registry["disabledTools"].get(server, []):
+        return (
+            "TOOL_DISABLED",
+            "mcp_registry." + server + "." + tool,
+            "Tool \"" + tool + "\" is disabled on MCP server \"" + server + "\" in this workspace's "
+            "MCP server registry. An owner or admin can re-enable it on the MCP Servers page.",
+        )
+    return None
+
+
+def decode_allowlist_record(line):
+    """The @mcp_allowlist line as {"severity", "servers"}; None for another line.
+
+    A severity other than shadow reads as block, so a damaged one refuses.
+    """
+    parts = line.split("\t")
+    if len(parts) != 3 or parts[0] != MCP_ALLOWLIST_RECORD_TAG:
+        return None
+    return {
+        "severity": "shadow" if parts[1] == "shadow" else "block",
+        "servers": [s for s in parts[2].split(",") if s],
+    }
+
+
+def evaluate_allowlist(allowlist, server):
+    """(code, rule_id, reason) for a server the allowlist does not name, else None.
+
+    Under shadow the caller records the refusal instead of enforcing it.
+    """
+    if server in allowlist["servers"]:
+        return None
+    return (
+        "SERVER_NOT_ALLOWED",
+        "mcp_allowlist",
+        "MCP server \"" + server + "\" is not on the MCP server allowlist for this workspace",
+    )
+
+
+def unverified_refusal(server):
+    """(code, rule_id, reason) refusing an MCP call on an unverified snapshot.
+
+    Neither the registry's approvals nor the allowlist's servers can be
+    vouched for, and a deleted record looks like one never set, so the
+    snapshot admits no MCP server at all.
+    """
+    return (
+        "POLICY_SNAPSHOT_UNVERIFIED",
+        "policy_snapshot",
+        "MCP server \"" + server + "\" is refused because the policy snapshot on this machine failed its "
+        "integrity check, so its MCP server registry and allowlist admit no server until the sync daemon "
+        "restores a verified snapshot",
+    )
+`;
+//# sourceMappingURL=mcpRegistryPy.js.map

package/dist/lib/mcpRegistryPy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpRegistryPy.js","sourceRoot":"","sources":["../../src/lib/mcpRegistryPy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkK/C,CAAA"}

package/dist/lib/phrasesPy.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The phrase matcher in Python, for the gates that run Python: the bash gates
+ * (their extractor already requires python3) and the Open WebUI filter.
+ *
+ * Byte-identical to `packages/intutic-clawde/intutic_clawde/gate/phrases.py`,
+ * which a test compares; edit that file and copy it here. It is the
+ * transliteration of `@intutic/shared-types`'s phrases.ts, and both run the
+ * shared vectors.
+ */
+export declare const PHRASES_PY_SOURCE: string;
+//# sourceMappingURL=phrasesPy.d.ts.map

package/dist/lib/phrasesPy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phrasesPy.d.ts","sourceRoot":"","sources":["../../src/lib/phrasesPy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,QAoV7B,CAAA"}

package/dist/lib/phrasesPy.js

@@ -0,0 +1,351 @@
+/**
+ * The phrase matcher in Python, for the gates that run Python: the bash gates
+ * (their extractor already requires python3) and the Open WebUI filter.
+ *
+ * Byte-identical to `packages/intutic-clawde/intutic_clawde/gate/phrases.py`,
+ * which a test compares; edit that file and copy it here. It is the
+ * transliteration of `@intutic/shared-types`'s phrases.ts, and both run the
+ * shared vectors.
+ */
+export const PHRASES_PY_SOURCE = String.raw `"""Phrase matching for shell commands and SQL in linear time.
+
+A transliteration of packages/shared-types/src/phrases.ts; read that module's
+docstring for what counts as a separator and why no regex searches the input.
+The rules are the same; the walk is organised for CPython, which is slow per
+step: runs of ordinary characters, spaces and backslashes are consumed by
+anchored character-class matches (one pass each, nothing to backtrack into),
+and a phrase is checked only at the words that can start it.
+
+Every classifier runs the shared vectors in
+packages/proxy/src/plugins/anomaly/action_vectors.json, and the hook gates
+emit this file verbatim (services/sync-daemon/src/lib/phrasesPy.ts holds a
+byte-identical copy, which a test compares). It must stay self-contained: the
+standard library only, no module state beyond the constants below, and no
+backtick or dollar-brace, which the TypeScript copy cannot hold.
+"""
+
+import re
+from bisect import bisect_left
+
+_SPACE_CHARS = (
+    " \t\n\r\v\f\u00a0\u1680\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007"
+    "\u2008\u2009\u200a\u2028\u2029\u202f\u205f\u3000\ufeff"
+)
+_SPACES = frozenset(_SPACE_CHARS)
+_WORD = frozenset("abcdefghijklmnopqrstuvwxyz0123456789_")
+# One anchored match per piece of the text. Every alternative starts with a
+# character no other alternative can start with, so exactly one can match at
+# a position and it matches one run of its class: nothing to backtrack into.
+_PIECE = re.compile(
+    "(?P<plain>[^" + _SPACE_CHARS + "\\\\/;&|-]+)"
+    "|(?P<space>[" + _SPACE_CHARS + "]+)"
+    "|(?P<dash>-+)"
+    "|(?P<backslash>\\\\+)"
+    "|(?P<other>[/;&|])"
+)
+# A run of words that need no decision, each followed by one plain space:
+# ordinary characters, after at most a leading run of dashes. Consumed in one
+# match and split in C — most of a long command is this.
+_BULK = re.compile("(?:(?:[^" + _SPACE_CHARS + "\\\\/;&|-]+|-+[^" + _SPACE_CHARS + "\\\\/;&|-]*) )+")
+_BULK_NO_COMMENT = re.compile("(?:(?:[^" + _SPACE_CHARS + "\\\\;&|-]+|-+[^" + _SPACE_CHARS + "\\\\;&|-]*) )+")
+# A run of line continuations or escaped spaces between words: one break.
+_CONTINUATIONS = re.compile("(?:\\\\[" + _SPACE_CHARS + "])+")
+# The same once no "*/" is left in the text: no "/*" can open a comment, so a
+# slash is an ordinary character.
+_PIECE_NO_COMMENT = re.compile(
+    "(?P<plain>[^" + _SPACE_CHARS + "\\\\;&|-]+)"
+    "|(?P<space>[" + _SPACE_CHARS + "]+)"
+    "|(?P<dash>-+)"
+    "|(?P<backslash>\\\\+)"
+    "|(?P<other>[;&|])"
+)
+
+
+class PhraseText:
+    """A text cut into words, ready for any number of has_phrase calls."""
+
+    __slots__ = ("raw", "joined", "toks", "sep", "nl", "eol", "dash", "bar", "tail", "memo")
+
+    def __init__(self):
+        self.raw = ""
+        self.joined = ""
+        self.toks = []
+        self.sep = []
+        self.nl = []
+        self.eol = []
+        self.dash = []
+        self.bar = []
+        self.tail = False
+        self.memo = {}
+
+
+def phrase_text(value):
+    """Cut value into words in one pass (see phraseText in phrases.ts)."""
+    s = ("" if value is None else str(value)).lower()
+    n = len(s)
+    t = PhraseText()
+    t.raw = s
+    toks, sep, nl, eol, dash, bar = t.toks, t.sep, t.nl, t.eol, t.dash, t.bar
+    start = -1
+    tok_bar = False
+    pend_sep = pend_nl = pend_eol = False
+    close = -2 if "*/" in s else -1  # the next "*/" at or after the last search; -1 once none is left
+    piece = _PIECE if close != -1 else _PIECE_NO_COMMENT
+    bulk = _BULK if close != -1 else _BULK_NO_COMMENT
+    i = 0
+    while i < n:
+        if start < 0:
+            m = bulk.match(s, i)
+            if m is not None:
+                words = m.group().split(" ")
+                words.pop()
+                rest = len(words) - 1
+                toks.extend(words)
+                sep.append(pend_sep)
+                sep.extend([True] * rest)
+                nl.append(pend_nl)
+                nl.extend([False] * rest)
+                eol.append(pend_eol)
+                eol.extend([False] * rest)
+                dash.extend([w.startswith("--") for w in words])
+                bar.extend([False] * (rest + 1))
+                pend_sep = True
+                pend_nl = pend_eol = False
+                i = m.end()
+                continue
+            m = _CONTINUATIONS.match(s, i)
+            if m is not None:
+                pend_sep = True
+                i = m.end()
+                continue
+        m = piece.match(s, i)
+        kind = m.lastgroup
+        j = m.end()
+        if kind == "plain":
+            if start < 0:
+                start = i
+            i = j
+            continue
+        word_break = False
+        newline = eol_here = False
+        nxt = j
+        if kind == "space":
+            newline = eol_here = "\n" in m.group()
+            word_break = True
+        elif kind == "dash":
+            # A "--" inside a word starts a new one, glued to it: it can open a
+            # comment or an option run but cannot stand for a plain gap.
+            if j - i > 1 and start >= 0:
+                toks.append(s[start:i])
+                sep.append(pend_sep)
+                nl.append(pend_nl)
+                eol.append(pend_eol)
+                dash.append(s.startswith("--", start))
+                bar.append(tok_bar)
+                start = -1
+                tok_bar = False
+                pend_sep = pend_nl = pend_eol = False
+            if start < 0:
+                start = i
+            i = j
+            continue
+        elif kind == "backslash":
+            # Every backslash but the last is followed by a backslash: a
+            # literal character. The last one decides.
+            last = j - 1
+            d = s[j] if j < n else ""
+            if d in ("n", "t", "r") or (d != "" and d in _SPACES):
+                if last > i and start < 0:
+                    start = i
+                word_break = True
+                eol_here = d == "n"
+                nxt = j + 1
+                if last > i:
+                    # the literal backslashes end the word before the escape
+                    toks.append(s[start:last])
+                    sep.append(pend_sep)
+                    nl.append(pend_nl)
+                    eol.append(pend_eol)
+                    dash.append(s.startswith("--", start))
+                    bar.append(tok_bar)
+                    start = -1
+                    tok_bar = False
+                    pend_sep = pend_nl = pend_eol = False
+            else:
+                if start < 0:
+                    start = i
+                i = j
+                continue
+        else:
+            c = s[i]
+            if c == "/" and j < n and s[j] == "*" and close != -1:
+                if close < i + 2:
+                    close = s.find("*/", i + 2)
+                    if close == -1:
+                        piece = _PIECE_NO_COMMENT
+                        bulk = _BULK_NO_COMMENT
+                if close != -1:
+                    word_break = True
+                    nxt = close + 2
+            if not word_break:
+                if start < 0:
+                    start = i
+                if c != "/":
+                    tok_bar = True
+                i = j
+                continue
+        if start >= 0:
+            toks.append(s[start:i])
+            sep.append(pend_sep)
+            nl.append(pend_nl)
+            eol.append(pend_eol)
+            dash.append(s.startswith("--", start))
+            bar.append(tok_bar)
+            start = -1
+            tok_bar = False
+            pend_sep = pend_nl = pend_eol = False
+        pend_sep = True
+        if newline:
+            pend_nl = True
+        if eol_here:
+            pend_eol = True
+        i = nxt
+    if start >= 0:
+        toks.append(s[start:n])
+        sep.append(pend_sep)
+        nl.append(pend_nl)
+        eol.append(pend_eol)
+        dash.append(s.startswith("--", start))
+        bar.append(tok_bar)
+        pend_sep = False
+    t.tail = pend_sep
+    t.joined = " ".join(toks)
+    return t
+
+
+def _next_index(t):
+    """Per word x: the first word at or after x containing ;&|, with a real
+    newline before it, and with any newline before it. Built once per text."""
+    ix = t.memo.get("#next")
+    if ix is None:
+        T = len(t.toks)
+        nb = [T] * (T + 1)
+        nn = [T] * (T + 1)
+        ne = [T] * (T + 1)
+        b = n_ = e = T
+        bar, nl, eol = t.bar, t.nl, t.eol
+        for x in range(T - 1, -1, -1):
+            if bar[x]:
+                b = x
+            if nl[x]:
+                n_ = x
+            if eol[x]:
+                e = x
+            nb[x] = b
+            nn[x] = n_
+            ne[x] = e
+        ix = (nb, nn, ne)
+        t.memo["#next"] = ix
+    return ix
+
+
+def has_phrase(t, needle, bounded=False):
+    """Whether t contains needle (see hasPhrase in phrases.ts)."""
+    words = needle.lower().split(" ")
+    if len(words) == 1:
+        return words[0] in t.raw
+    trailing_gap = words[-1] == ""
+    if trailing_gap:
+        words.pop()
+    for w in words:
+        if w == "" or w not in t.joined:
+            return False
+    toks, sep, dash, tail = t.toks, t.sep, t.dash, t.tail
+    T = len(toks)
+    k = len(words)
+
+    def positions(i):
+        """The words that word i of the phrase can be, by its position."""
+        w = words[i]
+        first = i == 0
+        last = i == k - 1 and not trailing_gap
+        key = ("f" if first else "") + ("l" if last else "") + ("b" if bounded else "") + ":" + w
+        hit = t.memo.get(key)
+        if hit is not None:
+            return hit
+        lw = len(w)
+        if first:
+            out = [q for q, tok in enumerate(toks) if tok.endswith(w)]
+        elif last:
+            out = [q for q, tok in enumerate(toks) if tok.startswith(w)]
+        else:
+            out = [q for q, tok in enumerate(toks) if tok == w]
+        if bounded:
+            kept = []
+            for q in out:
+                tok = toks[q]
+                if first and len(tok) > lw and tok[len(tok) - lw - 1] in _WORD:
+                    continue
+                if last and len(tok) > lw and (tok[lw] in _WORD or tok[lw] == "."):
+                    continue
+                kept.append(q)
+            out = kept
+        t.memo[key] = out
+        return out
+
+    # The words at which the rest of the phrase matches, ascending.
+    ok = positions(k - 1)
+    if trailing_gap:
+        kept = []
+        for q in ok:
+            r = q + 1
+            if r < T:
+                if sep[r] or (dash[r] and not t.bar[r] and (r + 1 < T or tail)):
+                    kept.append(q)
+            elif tail:
+                kept.append(q)
+        ok = kept
+    if k == 1:
+        return bool(ok)
+    nb, nn, ne = _next_index(t)
+    for i in range(k - 2, -1, -1):
+        ok_sep = [q for q in ok if sep[q]]
+        ok_set = set(ok_sep)
+        memo = {}
+
+        def option(r):
+            # An option run reaches any word before a ;&| word or a real newline.
+            j = bisect_left(ok_sep, r + 1)
+            return j < len(ok_sep) and ok_sep[j] <= min(nb[r], nn[r + 1], T - 1)
+
+        def reach(r):
+            # The gap that starts at word r leads into the rest of the phrase:
+            # directly, after an option run, or after -- comments, each of
+            # which runs to the next newline.
+            path = []
+            cur = r
+            while True:
+                if cur >= T:
+                    val = False
+                    break
+                if cur in memo:
+                    val = memo[cur]
+                    break
+                if cur in ok_set or (dash[cur] and option(cur)):
+                    val = memo[cur] = True
+                    break
+                if not dash[cur]:
+                    val = memo[cur] = False
+                    break
+                path.append(cur)
+                cur = ne[cur + 1]
+            for x in path:
+                memo[x] = val
+            return val
+
+        ok = [p for p in positions(i) if reach(p + 1)]
+        if not ok:
+            return False
+    return bool(ok)
+`;
+//# sourceMappingURL=phrasesPy.js.map

package/dist/lib/phrasesPy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"phrasesPy.js","sourceRoot":"","sources":["../../src/lib/phrasesPy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoV1C,CAAA"}

package/dist/lib/policySnapshot.d.ts

@@ -4,7 +4,7 @@
  *
  * # Why
  *
- * TD-307: `POST /api/v1/hook-gate` was called by two of thirteen gates, so DLP,
+ * `POST /api/v1/hook-gate` was called by two of thirteen gates, so DLP,
  * `BLOCK:` SOPs, SSO policy and promoted findings reached two of thirteen. The
  * obvious repair — route the other eleven through the gate — is the wrong one:
  * those eleven enforce locally and **fail closed**, the two network callers were
@@ -54,13 +54,28 @@
  *
  * @module
  */
-import { type SsoGroupPolicy } from '@intutic/shared-types';
+import { type McpRegistryRecord, type SsoGroupPolicy } from '@intutic/shared-types';
 import { type GuardPattern } from '../harness/protectedPaths.js';
 /** Directory every gate looks in. Inside `.intutic/hooks`, which is already
  *  protected — see the module note. */
 export declare const DEFAULT_SNAPSHOT_DIR: string;
 export declare const SNAPSHOT_JSON = "policy-snapshot.json";
 export declare const SNAPSHOT_RULES = "policy-snapshot.rules";
+/**
+ * The subdirectory of the snapshot directory holding the last snapshot the
+ * daemon wrote and so verified: both artifacts, byte for byte, read-only.
+ * Inside `.intutic/hooks`, which every gate refuses to touch. The settings
+ * guard compares the live snapshot with it and restores it when they differ
+ * ({@link restoreVerifiedSnapshot}), the way a policy agent keeps its last
+ * verified bundle active when a new one fails verification.
+ */
+export declare const VERIFIED_SNAPSHOT_DIR = "verified";
+/**
+ * Whether a `.rules` text verifies: it carries a `#digest` line, and the
+ * digest of its data lines matches it — the check every gate makes. A
+ * missing digest fails, since the writer always writes one.
+ */
+export declare function snapshotRulesVerify(text: string): boolean;
 /**
  * Whether the destructive tier ships as `block` or as `warn`.
  *
@@ -94,10 +109,9 @@ export declare const DESTRUCTIVE_TIER_SEVERITY: 'block' | 'warn';
  * is not that kind of rule: it does not run `scanSkillContent` or judge
  * anything about what a skill file says, only WHERE a write's target path
  * points — `.agents/skills/**` or `.claude/skills/**`, a deterministic,
- * zero-ambiguity match. TD-358 (`docs/TECH_DEBT.md`) says this about exactly
- * that distinction: "Path-matching is the one exception, and it is not
+ * zero-ambiguity match. Path-matching is the one exception, and it is not
  * actually an exception to the measurement requirement — it never needed
- * one." There is no false-positive rate to earn a promotion by measuring,
+ * one. There is no false-positive rate to earn a promotion by measuring,
  * because there is nothing probabilistic here to measure in the first place.
  *
  * The second half of the argument is what `warn` actually buys on this
@@ -132,7 +146,7 @@ export declare const SKILL_SURFACE_TIER_SEVERITY: 'block' | 'warn';
  * ships as `block` or as `warn`.
  *
  * `block`, licensed by a measurement rather than by argument, unlike
- * `SKILL_SURFACE_TIER_SEVERITY` above. TD-358 held content enforcement at warn
+ * `SKILL_SURFACE_TIER_SEVERITY` above. Content enforcement was held at warn
  * until `scanSkillContent`'s false-positive rate on real benign skills had been
  * measured. It now has: 350 vendored SKILL.md files
  * (`packages/shared-types/src/__tests__/corpus/skills/`), and the nine patterns
@@ -160,7 +174,7 @@ export interface ResolvedPolicy {
         action: string;
         reason: string;
         /**
-         * LLD #71: `'guardrail'` on rules the control plane projects from a cited
+         * `'guardrail'` on rules the control plane projects from a cited
          * policy guardrail. The only origin for which `action: 'warn'` is shipped
          * (at severity `warn`, report-only); every other warn rule is still
          * dropped, the HIGH/CRITICAL catch-all included.
@@ -175,9 +189,9 @@ export interface ResolvedPolicy {
      * this same field name off `workspaces.settings`, so this is not a new
      * name invented for the snapshot). Absent/empty means unrestricted — the
      * MCP proxy already reads it that way (`packages/mcp-proxy/src/policy.ts`),
-     * and the gate-side `#mcpservers` header this field feeds
+     * and the gate-side `@mcp_allowlist` record this field feeds
      * (`writePolicySnapshot` below) preserves the same convention: an empty
-     * list omits the header entirely rather than shipping a deny-everything one.
+     * list writes no record rather than a deny-everything one.
      */
     mcpAllowedServers: string[];
     /**
@@ -203,6 +217,14 @@ export interface ResolvedPolicy {
         memberId: string;
         ssoGroups: string[];
     } | null;
+    /**
+     * The workspace's MCP server registry decisions (`mcpRegistry`): blocked,
+     * held and approved servers, disabled tools and `mcpDefaultPolicy`. Written
+     * as an `@mcp_registry` record so the hook gates apply them to every
+     * `mcp__<server>__<tool>` call, not only the calls an MCP proxy fronts.
+     * Absent or null: an older control plane, and no record is written.
+     */
+    mcpRegistry?: McpRegistryRecord | null;
 }
 export interface PolicySnapshotOptions {
     controlPlaneUrl: string;
@@ -214,7 +236,7 @@ export interface PolicySnapshotOptions {
      * `review_before:` tokens from the workspace's local SOPs and settings
      * (`parseSopConstraints(...).reviewBefore`). Each becomes a `hold` rule,
      * `sop.local.review_before.<token>`, so every gate holds on them — not only
-     * the Claude Code hook that used to bake them in (TD-474 item 4).
+     * the Claude Code hook that used to bake them in.
      */
     localHoldTokens?: readonly string[];
 }
@@ -244,6 +266,20 @@ export declare function writePolicySnapshot(policy: ResolvedPolicy, snapshotDir?
     digest: string;
     ruleCount: number;
 }>;
+/**
+ * Puts the last verified snapshot back when the live one differs from it.
+ *
+ * `'intact'`: the live snapshot is the verified one, or there is nothing to
+ * compare (no snapshot written yet, or a live one from before the verified
+ * copy existed that still verifies). `'restored'`: either live artifact was
+ * edited, replaced or deleted, and both are the verified copy again.
+ * `'unverifiable'`: the live `.rules` fails its digest and there is no
+ * verified copy to restore, so the caller fetches a fresh snapshot. Any
+ * difference counts, a valid-looking one included: the daemon is the only
+ * writer of these files, so an older snapshot copied back in is tampering
+ * too. Never throws.
+ */
+export declare function restoreVerifiedSnapshot(snapshotDir?: string): Promise<'intact' | 'restored' | 'unverifiable'>;
 /**
  * Fetch and write in one call. Safe to run on every sync cycle.
  *