@intutic/sync-daemon 2.9.0 → 3.0.0

package/dist/lib/policySnapshot.js

@@ -55,11 +55,13 @@
  * @module
  */
 import * as fs from 'node:fs/promises';
+import { existsSync } from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
 import { createHash } from 'node:crypto';
 import { createLogger } from '@intutic/logger';
-import { encodeInterventionModeRecord, encodeMcpAllowlistRecord, isOpaqueInterventionMode, encodeMcpRegistryRecord, encodeSsoGroupRecord, evaluateSsoGroupClearance, isUnrestrictedMcpRegistry, parseMcpRegistryRecord, parseSsoGroupPolicy, } from '@intutic/shared-types';
+import { DECIDE_FALLBACK_PREFIX, DECIDE_SOP_TITLE_MAX_CHARS, TOOL_TOKEN_RE, decideFallbackId, decideFallbackReason, decideRuleHash, decideRuleRef, decideRuleText, encodeDecideRecord, SNAPSHOT_FORMAT_RECORD_TAG, parseDecideLine, parseDecideLines, parseDecidePin, scrubReason, splitFrontMatter, parseFrontMatterEnforcing, encodeInterventionModeRecord, encodeMcpAllowlistRecord, isOpaqueInterventionMode, encodeMcpRegistryRecord, encodeSsoGroupRecord, evaluateSsoGroupClearance, isUnrestrictedMcpRegistry, parseMcpRegistryRecord, parseSsoGroupPolicy, } from '@intutic/shared-types';
+import { RULE_SNAPSHOT_FORMAT, compileSopGateRecords, encodeGateRuleRecord, fromServedGateRecord, gateRuleFallback, laneHoldPatterns as laneHoldPatternSpecs, laneHoldRuleId, laneHoldTokens, toServedGateRecord, tokenLane, } from '@intutic/shared-types';
 import { toRulesLine, GATE_VERSION, RULES_COLUMNS } from '../harness/gateBody.js';
 import { writeFileAtomic } from './atomicWrite.js';
 import { DESTRUCTIVE_COMMAND_PATTERNS, SKILL_CONTENT_PATTERNS, SKILL_SURFACE_PATTERNS, assertPortableEre, } from '../harness/protectedPaths.js';
@@ -368,6 +370,261 @@ function parsePrincipal(value) {
         ssoGroups: Array.isArray(p.ssoGroups) ? p.ssoGroups.filter((g) => typeof g === 'string') : [],
     };
 }
+/**
+ * The `decideRules` of a resolve response, or of a snapshot's JSON. Every
+ * object is kept, with its wrongly-typed fields defaulted: a rule dropped
+ * here would be a rule no gate refuses for. Invalid pins are dropped, which
+ * can only stamp a rule shadow.
+ */
+function parseServedDecideRules(value) {
+    if (!Array.isArray(value))
+        return [];
+    const text = (v) => (typeof v === 'string' ? v : '');
+    return value
+        .filter((r) => typeof r === 'object' && r !== null && !Array.isArray(r))
+        .map((r) => ({
+        sopId: text(r.sopId),
+        sopTitle: text(r.sopTitle),
+        ruleText: text(r.ruleText),
+        ir: r.ir,
+        ...(r.rollout === 'shadow' || r.rollout === 'enforce' ? { rollout: r.rollout } : {}),
+        ...(typeof r.ruleHash === 'string' ? { ruleHash: r.ruleHash } : {}),
+        pins: Array.isArray(r.pins) ? r.pins.filter((p) => parseDecidePin(p) !== null) : [],
+    }));
+}
+/**
+ * The `gateRecords` of a resolve response, or of a snapshot's JSON, in the
+ * served shape (`ServedGateRecord`, `@intutic/shared-types`). A record is
+ * kept when it has that shape; one that then does not decode is not written
+ * as an `@rule` line, and its fallback line refuses in its place
+ * ({@link compileGateRecords}). A record without a `sopId` takes its ref's.
+ */
+export function parseServedGateRecords(value) {
+    if (!Array.isArray(value))
+        return [];
+    const out = [];
+    for (const r of value) {
+        if (typeof r !== 'object' || r === null)
+            continue;
+        const x = r;
+        if ((x.kind === 'requires_outcome' || x.kind === 'scope_paths' || x.kind === 'plan_approval') &&
+            (x.rollout === 'shadow' || x.rollout === 'enforce') &&
+            (x.fallbackId === null || typeof x.fallbackId === 'string') &&
+            typeof x.payload === 'object' && x.payload !== null && !Array.isArray(x.payload)) {
+            const payload = x.payload;
+            const ref = typeof payload.ref === 'string' ? payload.ref : '';
+            const sopId = typeof x.sopId === 'string' ? x.sopId : ref.slice(0, Math.max(0, ref.lastIndexOf('#')));
+            out.push({ sopId, kind: x.kind, rollout: x.rollout, fallbackId: x.fallbackId, payload });
+        }
+    }
+    return out;
+}
+/**
+ * The `holdRules` of a resolve response: only hold ids this batch defines
+ * (`sop.lane.*`, `revert.*`), on the `phrase` or `action` subject, at `hold`
+ * or `shadow`. Anything else is dropped with a log line: a served rule is
+ * never a way to put another kind of rule on the blocking path.
+ */
+function parseServedHoldRules(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((r) => {
+        if (typeof r !== 'object' || r === null)
+            return false;
+        const x = r;
+        const ok = typeof x.id === 'string' && /^(sop\.lane\.(irreversible|reversible_wide)\.|revert\.)action:[a-z_]+$/.test(x.id) &&
+            typeof x.source === 'string' && x.source !== '' && !/[\t\n\r]/.test(x.source) &&
+            (x.subject === 'phrase' || x.subject === 'action') &&
+            (x.severity === 'hold' || x.severity === 'shadow') &&
+            typeof x.reason === 'string';
+        if (!ok)
+            log.warn({ action: 'served_hold_rule_rejected', id: x.id }, 'A served hold rule is not one a gate takes — not shipped');
+        return ok;
+    });
+}
+function parseServedRevertHolds(value) {
+    if (!Array.isArray(value))
+        return [];
+    const rate = (v) => (typeof v === 'number' && isFinite(v) ? v : null);
+    return value
+        .filter((r) => typeof r === 'object' && r !== null && typeof r.subject === 'string')
+        .map((r) => ({
+        subject: r.subject,
+        revertRate: rate(r.revertRate),
+        rejectionRate: rate(r.rejectionRate),
+    }));
+}
+const sha256Hex = (text) => createHash('sha256').update(text, 'utf8').digest('hex');
+function jsonOrNull(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+/** A reason, scrubbed for the `.rules` projection and at most `max` characters. */
+function boundedText(text, max) {
+    return Array.from(scrubReason(text)).slice(0, max).join('');
+}
+/** A fallback line refusing `tools`, or every tool when none could be read. */
+function decideFallbackPattern(id, tools, severity, reason) {
+    const names = [...new Set(tools)].sort().map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+    const source = names.length > 0 ? ` (${names.join('|')}) ` : ' [^ ]+ ';
+    assertPortableEre(source, id);
+    return {
+        id,
+        source,
+        subject: 'tool',
+        severity: severity,
+        reason: boundedText(reason, 300),
+        rationale: 'A decide rule a gate that cannot evaluate it refuses: it covers these tools.',
+        matches: [],
+        notMatches: [],
+    };
+}
+/**
+ * Why a readable rule is stamped as it is: its own
+ * rollout, then `intutic decide disable` on this machine, then the policy
+ * source's shadow stamp (the server's kill switch, a SHADOW guardrail, or an
+ * SOP in `mode: shadow`), then SILENT_LOG, then pins. Only a
+ * rule that clears all of them is stamped `enforce`.
+ */
+function stampDecideRule(rollout, served, silentLog, pins, localDisable) {
+    if (rollout !== 'enforce')
+        return { rollout: 'shadow', stampedBy: 'rule' };
+    if (localDisable)
+        return { rollout: 'shadow', stampedBy: 'local-disable' };
+    if (served === 'shadow')
+        return { rollout: 'shadow', stampedBy: 'server-shadow' };
+    if (silentLog)
+        return { rollout: 'shadow', stampedBy: 'silent-log' };
+    if (pins.length === 0)
+        return { rollout: 'shadow', stampedBy: 'no-pins' };
+    return { rollout: 'enforce', stampedBy: 'rule' };
+}
+/**
+ * Compiles the policy's decide rules, in order. A readable `on: tool_call`
+ * rule becomes a record, and a fallback line when it is stamped `enforce`;
+ * an `on: response` rule is the gateway's and is not written. A line that
+ * does not read (or reuses an earlier line's id in its SOP) gets a fallback
+ * line and no record, so every gate refuses the tools it names, or every
+ * tool when it names none it can read; `unreadable.<n>` (its place among the
+ * SOP's decide lines) keeps that id apart from any rule's.
+ */
+function compileDecideRules(policy) {
+    const served = policy.decideRules ?? [];
+    const silentLog = isSilentLogMode(policy);
+    const localDisable = served.length > 0 && decideLocallyDisabled();
+    // Each SOP's lines parsed together, so an id used twice is caught as the
+    // proxy catches it.
+    const bySop = new Map();
+    served.forEach((r, i) => bySop.set(r.sopId, [...(bySop.get(r.sopId) ?? []), i]));
+    const decls = new Map();
+    for (const indices of bySop.values()) {
+        const parsed = parseDecideLines(indices.map((i) => {
+            const ir = served[i].ir;
+            return typeof ir === 'string' ? ir : (JSON.stringify(ir) ?? '');
+        }));
+        indices.forEach((i, k) => decls.set(i, { decl: parsed[k], line: k + 1 }));
+    }
+    const out = { records: [], fallbacks: [] };
+    served.forEach((r, i) => {
+        const { decl, line } = decls.get(i);
+        const sopTitle = boundedText(r.sopTitle, DECIDE_SOP_TITLE_MAX_CHARS);
+        if (decl.kind === 'unreadable') {
+            log.warn({ action: 'decide_rule_unreadable', sopId: r.sopId, ruleId: decl.id, error: decl.error }, 'A decide rule does not read; the snapshot refuses the tools it names until it is fixed');
+            const raw = typeof r.ir === 'string' ? jsonOrNull(r.ir) : r.ir;
+            const named = raw !== null && typeof raw === 'object' && Array.isArray(raw.tools) ? raw.tools : [];
+            const tools = named.filter((t) => typeof t === 'string' && TOOL_TOKEN_RE.test(t));
+            out.fallbacks.push(decideFallbackPattern(`${DECIDE_FALLBACK_PREFIX}unreadable.${line}@${sha256Hex(r.sopId).slice(0, 12)}`, tools, silentLog ? 'shadow' : 'block', `Decide rule ${decl.id ?? `on decide line ${line}`} (${sopTitle}) does not read, so the calls it covers are refused: ${decl.error}`));
+            return;
+        }
+        const rule = decl.rule;
+        if (rule.on !== 'tool_call')
+            return;
+        const ruleHash = decideRuleHash(rule, sha256Hex);
+        const pins = r.ruleHash !== undefined && r.ruleHash !== ruleHash ? [] : r.pins;
+        const stamp = stampDecideRule(rule.rollout, r.rollout, silentLog, pins, localDisable);
+        const fallbackId = stamp.rollout === 'enforce' ? decideFallbackId(rule.id, r.sopId, sha256Hex) : null;
+        out.records.push({
+            v: 1,
+            ref: decideRuleRef(r.sopId, rule.id),
+            ruleHash,
+            fallbackId,
+            rollout: stamp.rollout,
+            stampedBy: stamp.stampedBy,
+            ir: rule,
+            sopTitle,
+            ruleText: decideRuleText(r.ruleText),
+            pins,
+        });
+        if (fallbackId)
+            out.fallbacks.push(decideFallbackPattern(fallbackId, rule.tools ?? [], 'block', decideFallbackReason(rule.id, sopTitle)));
+    });
+    return out;
+}
+/**
+ * The marker `intutic decide disable` leaves in `~/.intutic/decide/`: while
+ * it exists, every decide rule this machine writes into a snapshot is
+ * stamped `local-disable`, so it runs as shadow and gets no fallback line.
+ * A line that does not read still refuses: that refusal is not the engine's.
+ */
+export const DECIDE_DISABLED_FILE = 'disabled';
+/** Whether `intutic decide disable` is in force on this machine. Read at each write, from the home directory then. */
+export function decideLocallyDisabled() {
+    return existsSync(path.join(os.homedir(), '.intutic', 'decide', DECIDE_DISABLED_FILE));
+}
+/** Where an `intutic decide eval` pass leaves the pins it earned: `evals/<ruleHash>/<digest>.json`, each a pin. */
+export const DEFAULT_DECIDE_DIR = path.join(os.homedir(), '.intutic', 'decide');
+/**
+ * The `decide:` lines of the workspace's local SOPs, for a snapshot written
+ * with no control plane. Each line's text is kept as written, so the writer
+ * reads it exactly as the proxy does, unreadable lines included. A readable
+ * rule's pins are the ones `decideDir/evals/<ruleHash>/` holds; a file that is
+ * not a pin is ignored. An SOP whose front matter says `mode: shadow` has its
+ * rules stamped shadow, as the control plane's resolve stamps them
+ * (`listServedDecideRules`): the record says `server-shadow`, and no fallback
+ * line is written.
+ */
+export async function localDecideRules(entries, opts = {}) {
+    const dir = opts.decideDir ?? DEFAULT_DECIDE_DIR;
+    const out = [];
+    for (const entry of entries) {
+        const { front, body } = splitFrontMatter(entry.content);
+        const lines = front
+            .split('\n')
+            .map((l) => l.trim())
+            .filter((l) => l.startsWith('decide:'))
+            .map((l) => l.slice('decide:'.length));
+        if (lines.length === 0)
+            continue;
+        const heading = body.split('\n').find((l) => l.startsWith('# '));
+        const sopTitle = heading ? heading.slice(2) : entry.title;
+        const sopShadow = parseFrontMatterEnforcing(front).mode === 'shadow';
+        for (const line of lines) {
+            const decl = parseDecideLine(line);
+            const pins = decl.kind === 'rule' ? await readLocalPins(path.join(dir, 'evals', decideRuleHash(decl.rule, sha256Hex))) : [];
+            out.push({ sopId: entry.sopId, sopTitle, ruleText: body, ir: line, ...(sopShadow ? { rollout: 'shadow' } : {}), pins });
+        }
+    }
+    return out;
+}
+async function readLocalPins(dir) {
+    const names = await fs.readdir(dir).catch(() => []);
+    const pins = [];
+    for (const name of names.filter((n) => n.endsWith('.json')).sort()) {
+        try {
+            const pin = parseDecidePin(JSON.parse(await fs.readFile(path.join(dir, name), 'utf-8')));
+            if (pin)
+                pins.push(pin);
+        }
+        catch {
+            // Not a pin: the rule runs as shadow without it, which refuses nothing new.
+        }
+    }
+    return pins;
+}
 /** Fetches resolved policy for the workspace. Returns null on any failure —
  *  the caller keeps the previous snapshot rather than replacing it with nothing. */
 export async function fetchResolvedPolicy(opts) {
@@ -418,6 +675,10 @@ async function requestResolvedPolicy(opts) {
             ssoGroupPolicy: parseSsoGroupPolicy(rec.ssoGroupPolicy),
             principal: parsePrincipal(rec.principal),
             mcpRegistry: parseMcpRegistryRecord(rec.mcpRegistry),
+            decideRules: parseServedDecideRules(body.decideRules),
+            gateRecords: parseServedGateRecords(body.gateRecords),
+            holdRules: parseServedHoldRules(body.holdRules),
+            revertHolds: parseServedRevertHolds(body.revertHolds),
         };
     }
     catch (err) {
@@ -479,7 +740,160 @@ function sanitizeMcpServerNames(names) {
 }
 /** Builds the rule set a snapshot would carry, without writing it. Exported so
  *  a test can assert the contents rather than re-deriving them. */
-export function buildSnapshotRules(policy, localHoldTokens = [], localHoldMode = 'hold') {
+export function buildSnapshotRules(policy, localHoldTokens = [], localHoldMode = 'hold', localSops = []) {
+    const rules = compileGateRecords(policy, localSops);
+    return snapshotRules(policy, localHoldTokens, localHoldMode, compileDecideRules(policy).fallbacks, {
+        ruleFallbacks: rules.fallbacks,
+        holds: laneHoldPatterns(policy, localSops, localHoldMode),
+    });
+}
+/** One local SOP's front matter, parsed once for its records and its lanes; parse errors are logged. */
+function localSopFrontMatter(entry) {
+    const fm = parseFrontMatterEnforcing(splitFrontMatter(entry.content).front);
+    for (const error of fm.errors) {
+        log.warn({ action: 'sop_rule_error', sopId: entry.sopId, error }, 'A local SOP rule does not read; it is enforced as written, which refuses');
+    }
+    return fm;
+}
+/** A shared fallback line (`gateRuleFallback`) as a snapshot rule. */
+function fallbackPattern(f) {
+    let match = { subject: f.subject, source: f.source, ignoreCase: f.ignoreCase };
+    try {
+        assertPortableEre(match.subject === 'phrase' ? ' x ' : match.source, f.id);
+    }
+    catch {
+        match = { subject: 'tool', source: ' [^ ]+ ', ignoreCase: false };
+    }
+    return {
+        id: f.id,
+        source: match.source,
+        subject: match.subject,
+        ...(match.ignoreCase ? { ignoreCase: true } : {}),
+        severity: 'block',
+        reason: boundedText(f.reason, 300),
+        rationale: 'A rule record a gate that cannot evaluate it refuses: it covers these calls.',
+        matches: [],
+        notMatches: [],
+    };
+}
+/**
+ * The fallback line of a served, enforcing record that does not decode: no
+ * `@rule` line is written for it, so nothing stands in for its line, which
+ * refuses every call until the record is fixed. A record that cannot be read
+ * is no reason to let what it covers through.
+ */
+function unreadableRecordFallback(r) {
+    if (r.rollout !== 'enforce')
+        return null;
+    const id = r.fallbackId && /^[a-z_]+-fallback:[1-9][0-9]{0,5}@[0-9a-f]{12}$/.test(r.fallbackId)
+        ? r.fallbackId
+        : `${r.kind}-fallback:1@${sha256Hex(r.sopId).slice(0, 12)}`;
+    const title = boundedText(typeof r.payload.sopTitle === 'string' ? r.payload.sopTitle : r.sopId, 80);
+    return {
+        id,
+        source: ' [^ ]+ ',
+        subject: 'tool',
+        severity: 'block',
+        reason: boundedText(`A ${r.kind} rule of ${title} could not be read, so every call is refused until the SOP is fixed`, 300),
+        rationale: 'A rule record a gate that cannot evaluate it refuses: it covers these calls.',
+        matches: [],
+        notMatches: [],
+    };
+}
+/**
+ * The policy's `@rule` records, served ones first and then the local SOPs'
+ * (`compileSopGateRecords`, `@intutic/shared-types`), and the fallback line
+ * of each enforcing one (`gateRuleFallback`). Under SILENT_LOG every record
+ * is stamped shadow and has no fallback line, as decide rules are.
+ */
+export function compileGateRecords(policy, localSops = []) {
+    const silentLog = isSilentLogMode(policy);
+    const records = [];
+    const fallbacks = [];
+    const seen = new Set();
+    const addFallback = (f) => {
+        if (!f || seen.has(f.id))
+            return;
+        seen.add(f.id);
+        fallbacks.push(f);
+    };
+    for (const served of parseServedGateRecords(policy.gateRecords ?? [])) {
+        const stamped = silentLog ? { ...served, rollout: 'shadow', fallbackId: null } : served;
+        const r = fromServedGateRecord(stamped);
+        if (r === null) {
+            log.warn({ action: 'served_gate_record_unreadable', sopId: served.sopId, kind: served.kind }, 'A served rule record does not decode; its fallback line refuses in its place');
+            addFallback(unreadableRecordFallback(stamped));
+            continue;
+        }
+        records.push(r);
+    }
+    for (const entry of localSops) {
+        records.push(...compileSopGateRecords({ sopId: entry.sopId, sopTitle: entry.title, shadow: silentLog }, localSopFrontMatter(entry), sha256Hex).records);
+    }
+    for (const r of records) {
+        const f = gateRuleFallback(r);
+        if (f)
+            addFallback(fallbackPattern(f));
+    }
+    return { records, fallbacks };
+}
+/**
+ * The hold rules of a local SOP's closed lanes, in the shape
+ * resolve serves the workspace's (`laneHoldPatterns`, `@intutic/shared-types`):
+ * per token, a `sop.lane.<class>.<token>` rule on the `phrase` subject,
+ * which a gate whose classifier predates the token still holds, and for
+ * force_push and destroy also one on the `action` subject, under the same
+ * id, so one approval releases the call whichever rule held it. Only SOPs
+ * with no `roles:` (a gate knows no role). With no control plane (`block`) a
+ * lane hold refuses.
+ */
+export function localLaneHoldRules(localSops, mode) {
+    const sops = localSops.map(localSopFrontMatter).filter((fm) => fm.roles.length === 0);
+    const out = [];
+    for (const token of laneHoldTokens({ sops })) {
+        const laneClass = tokenLane(token);
+        const offline = mode === 'block';
+        const base = {
+            id: laneHoldRuleId(token),
+            severity: 'hold',
+            reason: offline
+                ? `Refused: ${token} is in the closed ${laneClass} lane, and holding it for approval needs a control plane — run it yourself, or open the lane.`
+                : `Held for human review: ${token} is in the closed ${laneClass} lane`,
+            rationale: 'A SOP closed this reversibility lane: a person signs off each call in it.',
+        };
+        for (const p of laneHoldPatternSpecs(token))
+            out.push({ ...base, source: p.source, subject: p.subject, ...(p.ignoreCase ? { ignoreCase: true } : {}) });
+    }
+    return out;
+}
+/**
+ * The lane and revert hold rules: resolve's (`holdRules`), then the local
+ * SOPs' lanes for an id resolve did not serve. Shadow under SILENT_LOG; a
+ * local hold refuses (`block`) with no control plane.
+ */
+function laneHoldPatterns(policy, localSops, mode) {
+    const shadow = isSilentLogMode(policy);
+    // Validated here as well as at the fetch: a policy rebuilt from a
+    // snapshot's JSON, or built by a caller, takes the same check.
+    const served = parseServedHoldRules(policy.holdRules ?? []);
+    const ids = new Set(served.map((r) => r.id));
+    const local = localLaneHoldRules(localSops, mode).filter((r) => !ids.has(r.id));
+    return [
+        ...served.map((r) => ({ r, offline: false })),
+        ...local.map((r) => ({ r, offline: mode === 'block' })),
+    ].map(({ r, offline }) => ({
+        id: r.id,
+        source: r.source,
+        subject: r.subject,
+        ...(r.ignoreCase ? { ignoreCase: true } : {}),
+        severity: (shadow || r.severity === 'shadow' ? 'shadow' : offline ? 'block' : 'hold'),
+        reason: boundedText(r.reason, 300),
+        rationale: r.rationale ?? 'A closed reversibility lane or the revert lane holds this action.',
+        matches: [],
+        notMatches: [],
+    }));
+}
+function snapshotRules(policy, localHoldTokens, localHoldMode, decideFallbacks, extra = { ruleFallbacks: [], holds: [] }) {
     // `shadow` names the advisory GuardPattern severity these rules are demoted
     // to; the workspace-level trigger is intervention mode SILENT_LOG.
     const shadow = isSilentLogMode(policy);
@@ -538,8 +952,23 @@ export function buildSnapshotRules(policy, localHoldTokens = [], localHoldMode =
     }));
     // SSO-group refusals first. Every gate stops at the first rule that refuses,
     // and a `hold` rule earlier in the list could otherwise let an approved
-    // bypass through a call the group policy refuses outright.
-    return [...ssoGroupPatterns(policy), ...sopRules, ...localHolds, ...destructive, ...skillSurface, ...skillContent];
+    // bypass through a call the group policy refuses outright. The decide
+    // fallback lines next, ahead of every shadow and warn rule: a 2.9.0 SDK
+    // gate returns at the first of those that matches, and would never reach a
+    // fallback line after one.
+    // The rule records' fallback lines right after the decide ones, for the
+    // same reason; the lane and revert holds after the local review holds.
+    return [
+        ...ssoGroupPatterns(policy),
+        ...decideFallbacks,
+        ...extra.ruleFallbacks,
+        ...sopRules,
+        ...localHolds,
+        ...extra.holds,
+        ...destructive,
+        ...skillSurface,
+        ...skillContent,
+    ];
 }
 /**
  * The workspace's SSO-group policy, decided for the member this snapshot is
@@ -655,11 +1084,25 @@ function localHoldPattern(token, shadow, mode) {
  * path. Both carry the same digest, so a test — and the gate — can tell that the
  * projection really came from the JSON.
  */
-export async function writePolicySnapshot(policy, snapshotDir = DEFAULT_SNAPSHOT_DIR, localHoldTokens = [], localHolds = 'hold') {
-    return oneAtATime(() => writeSnapshotFiles(policy, snapshotDir, localHoldTokens, { localHolds }));
+export async function writePolicySnapshot(policy, snapshotDir = DEFAULT_SNAPSHOT_DIR, localHoldTokens = [], localHolds = 'hold', localSops = []) {
+    return oneAtATime(() => writeSnapshotFiles(policy, snapshotDir, localHoldTokens, { localHolds, localSops }));
 }
 async function writeSnapshotFiles(policy, snapshotDir, localHoldTokens, opts = {}) {
-    const rules = buildSnapshotRules(policy, localHoldTokens, opts.localHolds);
+    const decide = compileDecideRules(policy);
+    const gateRules = compileGateRecords(policy, opts.localSops ?? []);
+    const rules = snapshotRules(policy, localHoldTokens, opts.localHolds ?? 'hold', decide.fallbacks, {
+        ruleFallbacks: gateRules.fallbacks,
+        holds: laneHoldPatterns(policy, opts.localSops ?? [], opts.localHolds ?? 'hold'),
+    });
+    // Format 2 once any decide line is written: an `@decide` record, or a
+    // fallback line. Without one the snapshot stays byte-identical to format 1.
+    // Format 3 once any `@rule` record is; a snapshot with
+    // decide lines and no rule record stays format 2, byte for byte. The
+    // record is written here rather than by `encodeSnapshotFormatRecord`, whose
+    // format moves with the newest one.
+    const decideFormat = decide.records.length > 0 || decide.fallbacks.length > 0;
+    const ruleFormat = gateRules.records.length > 0;
+    const format = ruleFormat ? RULE_SNAPSHOT_FORMAT : decideFormat ? 2 : 1;
     // One timestamp shared by both artifacts. Two `new Date()` calls would put
     // different values in the JSON and the .rules, so a reader comparing them
     // would see drift that is not there.
@@ -694,18 +1137,25 @@ async function writeSnapshotFiles(policy, snapshotDir, localHoldTokens, opts = {
     // existed. Unlike SILENT_LOG it changes no rule's severity: what is refused
     // is unchanged, only what the agent is told.
     const opaque = isOpaqueInterventionMode(policy.interventionMode);
+    // Each decide rule's record rides inside the digest too, in SOP order: an
+    // edited record fails the check, and an invalid snapshot drops the records
+    // with the fallback lines, as it drops the rest of the dynamic tier.
     const lines = [
+        ...(format > 1 ? [`${SNAPSHOT_FORMAT_RECORD_TAG}\t${format}`] : []),
         ...(opaque ? [encodeInterventionModeRecord()] : []),
         ...(ssoGroups ? [encodeSsoGroupRecord(ssoGroups)] : []),
         ...(mcpRegistry ? [encodeMcpRegistryRecord(mcpRegistry)] : []),
         ...(mcpServers.length > 0 ? [encodeMcpAllowlistRecord({ severity: mcpSeverity, servers: mcpServers })] : []),
+        ...decide.records.map(encodeDecideRecord),
+        // Each rule record rides inside the digest too, after the decide records.
+        ...gateRules.records.map(encodeGateRuleRecord),
         ...rules.map(toRulesLine),
     ];
     const digest = createHash('sha256').update(lines.join('\n')).digest('hex').slice(0, 32);
     await fs.mkdir(snapshotDir, { recursive: true });
     const json = JSON.stringify({
         _comment: 'Intutic policy snapshot — auto-generated. DO NOT EDIT.',
-        version: 1,
+        version: format,
         /**
          * Which emitted evaluator these rules were compiled for.
          *
@@ -734,9 +1184,18 @@ async function writeSnapshotFiles(policy, snapshotDir, localHoldTokens, opts = {
         ...(ssoGroups ? { ssoGroups } : {}),
         // The same record as the `.rules` file's `@mcp_registry` line.
         ...(mcpRegistry ? { mcpRegistry } : {}),
-        // With `sopRules`, `interventionMode`, `mcpAllowedServers` and
-        // `mcpRegistry`, enough to rebuild this snapshot without the control
-        // plane (`forgetSnapshotMember`).
+        // The decide rules as resolve served them (or the local SOPs held
+        // them), which the `@decide` records and fallback lines were compiled
+        // from: readable, and enough to compile them again.
+        ...(policy.decideRules && policy.decideRules.length > 0 ? { decideRules: policy.decideRules } : {}),
+        // The rule records as written (served and local), and the lane and
+        // revert holds resolve served: enough to compile them again.
+        ...(gateRules.records.length > 0 ? { gateRecords: gateRules.records.map((r) => toServedGateRecord(r, r.ref.slice(0, r.ref.lastIndexOf('#')))) } : {}),
+        ...(policy.holdRules && policy.holdRules.length > 0 ? { holdRules: policy.holdRules } : {}),
+        ...(policy.revertHolds && policy.revertHolds.length > 0 ? { revertHolds: policy.revertHolds } : {}),
+        // With `sopRules`, `interventionMode`, `mcpAllowedServers`,
+        // `mcpRegistry` and `decideRules`, enough to rebuild this snapshot
+        // without the control plane (`forgetSnapshotMember`).
         sqlDropStrictBlock: policy.sqlDropStrictBlock,
         /**
          * The resolve response verbatim, alongside the gate projection below.
@@ -834,13 +1293,15 @@ export function localResolvedPolicy() {
     };
 }
 /**
- * Writes the snapshot of {@link localResolvedPolicy}, marked `source: local`.
+ * Writes the snapshot of {@link localResolvedPolicy}, marked `source: local`,
+ * with the local SOPs' decide rules ({@link localDecideRules}) when given.
  * The local holds refuse (`block`) rather than hold: with no control plane
  * nothing could approve them. Never fetches.
  */
 export async function writeLocalPolicySnapshot(opts = {}) {
     const dir = opts.snapshotDir ?? DEFAULT_SNAPSHOT_DIR;
-    return oneAtATime(() => writeSnapshotFiles(localResolvedPolicy(), dir, opts.localHoldTokens ?? [], { localHolds: 'block', source: 'local' }));
+    const policy = { ...localResolvedPolicy(), ...(opts.decideRules ? { decideRules: opts.decideRules } : {}) };
+    return oneAtATime(() => writeSnapshotFiles(policy, dir, opts.localHoldTokens ?? [], { localHolds: 'block', source: 'local', localSops: opts.localSops ?? [] }));
 }
 /**
  * Puts the last verified snapshot back when the live one differs from it.
@@ -903,7 +1364,7 @@ export async function refreshPolicySnapshot(opts) {
     if (!result)
         return null;
     try {
-        return await writePolicySnapshot(result, dir, opts.localHoldTokens ?? []);
+        return await writePolicySnapshot(result, dir, opts.localHoldTokens ?? [], 'hold', opts.localSops ?? []);
     }
     catch (err) {
         log.warn({ action: 'policy_snapshot_write_failed', err }, 'Could not write policy snapshot');
@@ -945,6 +1406,11 @@ async function forgetSnapshotMember(dir, localHoldTokens) {
             ssoGroupPolicy,
             principal: null,
             mcpRegistry: parseMcpRegistryRecord(doc.mcpRegistry),
+            decideRules: parseServedDecideRules(doc.decideRules),
+            // The records as the last write compiled them, local ones included.
+            gateRecords: parseServedGateRecords(doc.gateRecords),
+            holdRules: parseServedHoldRules(doc.holdRules),
+            revertHolds: parseServedRevertHolds(doc.revertHolds),
         }, dir, localHoldTokens);
         log.warn({ action: 'policy_snapshot_member_forgotten', workspaceId: doc.workspaceId }, "The control plane refused this machine's key; the snapshot now treats the member's SSO groups as unknown");
     }