@miller-tech/uap 1.148.2 → 1.148.5

package/src/policies/enforcers/delivery_enforcement.py

@@ -50,8 +50,74 @@ EXEMPT_PREFIXES = (
     "src/policies/", "scripts/", "docs/", "policies/", "test/", "tests/",
 )
 
-# Test files are protected by deliver itself; never gate them here.
-TEST_MARKERS = (".test.", ".spec.", "_test.", "/test/", "/tests/", "/__tests__/")
+# Test files are protected by deliver itself; never gate them here. Covers the
+# path markers AND a file whose basename IS a test (e.g. a root-level `test.js`,
+# `tests.py`, `spec.ts`, `test_foo.py`, `foo.test.tsx`) — those are the fast
+# feedback loop and must not each trigger a full deliver cycle.
+TEST_MARKERS = (".test.", ".spec.", "_test.", "test_", "/test/", "/tests/", "/__tests__/", "/spec/", "/specs/")
+_TEST_BASENAMES = ("test", "tests", "spec", "specs", "conftest")
+
+
+def _is_test_file(rel_posix: str) -> bool:
+    low = rel_posix.lower()
+    if any(m in "/" + low for m in TEST_MARKERS):
+        return True
+    stem = low.rsplit("/", 1)[-1].rsplit(".", 1)[0]
+    return stem in _TEST_BASENAMES or stem.startswith("test") or stem.endswith("test") or stem.endswith("spec")
+
+
+# Trivial-edit fast-path: a tiny change (a one-line tweak, a constant, a typo)
+# does not warrant a full deliver decompose→epics→gates cycle — on a slow local
+# executor that is ~10+ min per edit. Below this many changed characters the
+# edit is allowed directly (advisory nudge only). UAP_DELIVER_FASTPATH=off
+# disables; UAP_DELIVER_TRIVIAL_EDIT_CHARS tunes the threshold.
+def _fastpath_on() -> bool:
+    # The policy gate's cumulative fast-path (fastpath_gate.py) sets
+    # UAP_FASTPATH_ROUTED=1 when a trivial edit has crossed the per-file
+    # cumulative budget and must route through deliver. Honor it — otherwise the
+    # enforcer's own trivial allowance would independently re-approve the edit
+    # and defeat the budget (death-by-a-thousand-small-edits escape).
+    if os.environ.get("UAP_FASTPATH_ROUTED") == "1":
+        return False
+    return os.environ.get("UAP_DELIVER_FASTPATH", "on").lower() not in {"0", "off", "false", "no"}
+
+
+def _trivial_edit_chars() -> int:
+    try:
+        return max(0, int(os.environ.get("UAP_DELIVER_TRIVIAL_EDIT_CHARS", "240")))
+    except ValueError:
+        return 240
+
+
+def _changed_chars(args: dict) -> int | None:
+    """Total changed characters for an Edit/MultiEdit, or None when it can't be
+    measured (e.g. a whole-file Write) — None means 'not trivially small'."""
+    def pair(o: object, n: object) -> int:
+        return len(str(o or "")) + len(str(n or ""))
+    if "edits" in args and isinstance(args["edits"], list):
+        return sum(
+            pair(e.get("old_string") or e.get("oldString"), e.get("new_string") or e.get("newString"))
+            for e in args["edits"] if isinstance(e, dict)
+        )
+    old = args.get("old_string") or args.get("oldString")
+    new = args.get("new_string") or args.get("newString")
+    if old is not None or new is not None:
+        return pair(old, new)
+    return None  # Write (full content) — not a trivial edit
+
+
+def _deliver_lock_holder(root: Path) -> str | None:
+    """PID string of a LIVE deliver run holding the project lock, else None."""
+    lock = root / ".uap" / "deliver.lock"
+    try:
+        pid = int((lock.read_text().split("|")[0] or "").strip())
+    except (OSError, ValueError):
+        return None
+    try:
+        os.kill(pid, 0)
+        return str(pid)
+    except OSError:
+        return None
 
 
 def _is_local_model_session() -> bool:
@@ -115,8 +181,8 @@ def main() -> None:
     if any(rel_posix.startswith(p) for p in EXEMPT_PREFIXES):
         emit(True, f"exempt path: {rel_posix}")
         return
-    if any(m in "/" + low for m in TEST_MARKERS):
-        emit(True, "test file (protected by deliver itself)")
+    if _is_test_file(rel_posix):
+        emit(True, "test file (fast feedback loop; deliver protects it via gates)")
         return
 
     # Escape hatches.
@@ -127,6 +193,36 @@ def main() -> None:
         emit(True, "UAP_DELIVER_BYPASS override set")
         return
 
+    # A — trivial-edit fast-path: allow a tiny change directly (advisory) rather
+    # than paying a full deliver cycle for a one-liner.
+    if _fastpath_on():
+        changed = _changed_chars(args)
+        if changed is not None and changed <= _trivial_edit_chars():
+            print(
+                f"[delivery-enforcement] trivial edit to '{rel_posix}' "
+                f"({changed} chars) — allowed directly; route substantive changes through deliver.",
+                file=sys.stderr,
+            )
+            emit(True, f"trivial edit fast-path ({changed} <= {_trivial_edit_chars()} chars)")
+            return
+
+    # B — a deliver run is ALREADY working this project. Do NOT launch another
+    # (the lock would reject it anyway) and do NOT let the model keep editing/
+    # testing the same code underneath it — tell it to WAIT. route:wait so the
+    # autoroute stands down instead of enqueuing a duplicate.
+    holder = _deliver_lock_holder(root)
+    if holder is not None and os.environ.get("UAP_ENFORCE_DELIVERY", "block").lower() == "block":
+        emit(
+            False,
+            f"WAIT: a `uap deliver` run (pid {holder}) is ALREADY in progress for this project and is "
+            f"changing the code — do NOT edit '{rel_posix}', and do NOT re-run tests on it yet. "
+            "Let that run finish (check: uap deliver --resume latest / its output), THEN re-verify. "
+            "Launching or editing now only conflicts with the in-flight run.",
+            route="wait",
+            deliverHint="",
+        )
+        return
+
     # #3-F: terse, imperative, model-parseable. Weak local models otherwise
     # retry the blocked edit or hallucinate completion ("the files exist") when
     # the message is a passive explanation. State the exact next action.

package/src/policies/enforcers/enforcement_self_protect.py

@@ -24,7 +24,9 @@ import sys
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).parent))
-from _common import emit, parse_cli, repo_root  # noqa: E402
+from _common import (  # noqa: E402
+    emit, parse_cli, repo_root, REVIEW_ARTIFACT_DIR, REVIEW_WAIVER_DIR,
+)
 
 EDIT_OPS = {"Edit", "Write", "MultiEdit", "edit", "write", "multiedit"}
 
@@ -66,6 +68,17 @@ def _is_protected_path(rel_posix: str) -> bool:
     # "/src/policies/", …) match only a genuine path SEGMENT. Filename markers
     # ("uap-policy-gate.sh", "anthropic-proxy.env") still match as substrings.
     low = "/" + rel_posix.lower().lstrip("/")
+    # Designed-writable escape hatches that live UNDER a protected marker but are
+    # NOT part of the delivery-enforcement control surface: expert-review
+    # artifacts (.uap/reviews/) and the committable review waiver
+    # (policies/waivers/). Writing these satisfies the SEPARATE
+    # expert-review-required gate and cannot weaken delivery enforcement — the
+    # markers above still guard .uap.json, proxy env, enforcer code and hooks.
+    # Without this carve-out the two gates deadlock: expert-review demands an
+    # artifact that self-protect forbids writing.
+    allow = ("/" + REVIEW_ARTIFACT_DIR + "/", "/" + REVIEW_WAIVER_DIR + "/")
+    if any(a in low for a in allow):
+        return False
     return any(m in low for m in PROTECTED_MARKERS)
 
 
@@ -79,11 +92,15 @@ def main() -> None:
         target = args.get("file_path") or args.get("path") or args.get("target") or ""
         if not target:
             emit(True, "no file path in args")
+        rp = Path(target).resolve()
         try:
-            rel = str(Path(target).resolve().relative_to(repo_root()))
+            rel = str(rp.relative_to(repo_root()))
         except ValueError:
-            # Out-of-repo writes (e.g. the proxy env in ~/.config) — match by name.
-            rel = target
+            # Out-of-repo writes (e.g. the proxy env in ~/.config) — match by name
+            # against the RESOLVED path, never the raw arg: a raw
+            # ".uap/reviews/../../anthropic-proxy.env" would otherwise smuggle the
+            # allow-list carve-out to reach an out-of-repo control file.
+            rel = str(rp)
         rel_posix = rel.replace(os.sep, "/")
         if _is_protected_path(rel_posix):
             emit(

package/src/policies/enforcers/expert_review_required.py

@@ -24,7 +24,9 @@ import sys
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).parent))
-from _common import emit, parse_cli, worktree_root, run  # noqa: E402
+from _common import (  # noqa: E402
+    emit, parse_cli, worktree_root, run, REVIEW_ARTIFACT_DIR, REVIEW_WAIVER_DIR,
+)
 
 # Ship verbs are anchored to their tool prefix so that the bare tokens "merge"
 # or "signoff" inside read-only commands (git diff --merge-base, rg merge,
@@ -81,12 +83,12 @@ def _is_low_risk(f: str) -> bool:
 def _active_waiver(root: Path) -> bool:
     """A committable, env-free bypass: an active waiver file. Works in harnesses
     that strip env vars (where UAP_NO_REVIEW=1 cannot be set)."""
-    wdir = root / "policies" / "waivers"
+    wdir = root / REVIEW_WAIVER_DIR
     if wdir.exists():
         for w in wdir.glob("*expert-review*.md"):
             if w.is_file():
                 return True
-    return (root / ".uap" / "reviews" / "WAIVER").exists()
+    return (root / REVIEW_ARTIFACT_DIR / "WAIVER").exists()
 
 
 def current_branch(root: Path) -> str | None:
@@ -129,6 +131,13 @@ def main() -> None:
         emit(True, "not a ship operation")
 
     cmd = args.get("command") or args.get("cmd") or ""
+    # The policy-gate hook runs in the harness env, not the inline command env,
+    # so `UAP_NO_REVIEW=1 git commit ...` never reaches os.environ above. Honor
+    # an inline assignment parsed from the command string too.
+    # Anchored to a LEADING env-assignment run so an incidental mention in a
+    # quoted arg / commit message does NOT silently skip review.
+    if re.search(r"^\s*(?:[A-Za-z_]\w*=\S*\s+)*UAP_NO_REVIEW=['\"]?1\b", cmd):
+        emit(True, "UAP_NO_REVIEW inline override set")
     if not any(p.search(cmd) for p in SHIP_PATTERNS):
         emit(True, "not a ship action")
 
@@ -159,7 +168,7 @@ def main() -> None:
             "— parallel expert review not required",
         )
 
-    review = root / ".uap" / "reviews" / f"{slug}.json"
+    review = root / REVIEW_ARTIFACT_DIR / f"{slug}.json"
     if not review.exists():
         emit(
             False,

package/templates/hooks/fastpath_gate.py

@@ -0,0 +1,123 @@
+#!/usr/bin/env python3
+"""Edit fast-path decider with CUMULATIVE accounting.
+
+The policy gate lets test-file edits and TRIVIAL source edits (<= TRIVIAL chars
+changed) through directly, so iteration on a slow local executor stays fast
+instead of paying a full deliver cycle per keystroke. But an unbounded per-edit
+threshold is an escape hatch: a weak model can assemble a whole (broken) feature
+out of dozens of sub-threshold edits, none of which ever routes to deliver or
+gets validated ("death by a thousand small edits").
+
+This decider keeps the fast-path for genuinely small changes but BOUNDS how much
+un-routed change can accumulate per file. It tallies trivial-edit chars/count per
+file in .uap/fastpath-accum.json; once a file crosses CUM_CHARS total chars OR
+CUM_EDITS edits since it last routed, the NEXT edit is NOT fast-pathed — it falls
+through to the deliver-routing gate (which writes + validates), and the file's
+tally resets. So un-validated drift per file is bounded to ~CUM_CHARS.
+
+stdin: the tool_input JSON. exit 0 = fast-path (allow directly); exit 1 = route
+through deliver. On any parse/IO trouble it fails toward ROUTING (safe).
+
+env: TRIVIAL (per-edit trivial threshold, default 240), CUM_CHARS (cumulative
+budget, default 800), CUM_EDITS (cumulative edit-count budget, default 6),
+UAP_MAIN_ROOT (project root holding .uap/, default cwd). Test files always
+fast-path and never accumulate.
+"""
+import json
+import os
+import sys
+from pathlib import Path
+
+TEST_MARKERS = (
+    ".test.", ".spec.", "_test.", "test_", "/test/", "/tests/",
+    "/__tests__/", "/spec/", "/specs/",
+)
+
+
+def _is_test(target: str) -> bool:
+    base = target.rsplit("/", 1)[-1]
+    stem = base.rsplit(".", 1)[0]
+    return (
+        any(m in "/" + target for m in TEST_MARKERS)
+        or stem in ("test", "tests", "spec", "specs", "conftest")
+        or stem.startswith("test")
+        or stem.endswith("test")
+        or stem.endswith("spec")
+    )
+
+
+def _changed_chars(a: dict):
+    """Total chars touched by this edit, or None when the shape carries no diff
+    (e.g. a whole-file Write) — None => never trivial => route."""
+    edits = a.get("edits")
+    if isinstance(edits, list):
+        return sum(
+            len(str(e.get("old_string") or e.get("oldString") or ""))
+            + len(str(e.get("new_string") or e.get("newString") or ""))
+            for e in edits
+            if isinstance(e, dict)
+        )
+    o = a.get("old_string") or a.get("oldString")
+    n = a.get("new_string") or a.get("newString")
+    if o is None and n is None:
+        return None
+    return len(str(o or "")) + len(str(n or ""))
+
+
+def main() -> int:
+    try:
+        a = json.loads(sys.stdin.read() or "{}")
+    except Exception:
+        return 1  # unparseable → route (safe)
+
+    target = (
+        a.get("file_path") or a.get("filePath") or a.get("path")
+        or a.get("target") or a.get("filename") or a.get("file") or ""
+    ).lower()
+    if not target:
+        return 1
+
+    if _is_test(target):
+        return 0  # test files always fast-path, no accounting
+
+    c = _changed_chars(a)
+    trivial_threshold = int(os.environ.get("TRIVIAL", "240"))
+    if c is None or c > trivial_threshold:
+        return 1  # non-trivial (or no diff info) → route
+
+    # Trivial source edit: allow only while cumulative drift stays under budget.
+    cum_chars = int(os.environ.get("CUM_CHARS", "800"))
+    cum_edits = int(os.environ.get("CUM_EDITS", "6"))
+    root = os.environ.get("UAP_MAIN_ROOT") or "."
+    accum_file = Path(root) / ".uap" / "fastpath-accum.json"
+    try:
+        accum = json.loads(accum_file.read_text())
+        if not isinstance(accum, dict):
+            accum = {}
+    except Exception:
+        accum = {}
+
+    rec = accum.get(target) or {}
+    new_chars = int(rec.get("chars", 0)) + c
+    new_edits = int(rec.get("edits", 0)) + 1
+
+    if new_chars > cum_chars or new_edits > cum_edits:
+        # Budget crossed: this edit routes through deliver (which validates the
+        # accumulated change), and the file's tally resets for the next batch.
+        accum[target] = {"chars": 0, "edits": 0}
+        decision = 1
+    else:
+        accum[target] = {"chars": new_chars, "edits": new_edits}
+        decision = 0
+
+    try:
+        accum_file.parent.mkdir(parents=True, exist_ok=True)
+        accum_file.write_text(json.dumps(accum))
+    except Exception:
+        pass  # best-effort; a write failure must not change the verdict
+
+    return decision
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/templates/hooks/uap-policy-gate.sh

@@ -63,11 +63,37 @@ export UAP_REPO_ROOT="$MAIN_ROOT"
 # actual WORKING TREE, not the (possibly bare) MAIN_ROOT. Expose the current checkout
 # so _common.worktree_root() targets the worktree when an op runs from inside one.
 export UAP_WORKTREE_ROOT="$CHECKOUT_ROOT"
-# Delivery enforcement defaults to BLOCK for UAP-managed projects: substantive
-# source edits must route through `uap deliver` (verified completion against the
-# gates). The `:-` preserves any explicit operator/CI override (advisory|block).
-# Escape hatches still apply: UAP_DELIVER_ACTIVE=1 (inside deliver) / UAP_DELIVER_BYPASS=1.
-export UAP_ENFORCE_DELIVERY="${UAP_ENFORCE_DELIVERY:-block}"
+# Delivery enforcement posture. Precedence (highest first):
+#   1. .uap.json `delivery.enforcement` — the project's DECLARED posture is
+#      AUTHORITATIVE (deliberate, reproducible IaC), so a stale ambient
+#      UAP_ENFORCE_DELIVERY=advisory (leaked into a launching shell/session env,
+#      e.g. an opencode session started months ago when an env export was still
+#      in .bashrc) can NOT silently downgrade a project configured to `block`
+#      and let the agent bypass deliver. `delivery.localMode` is read the same
+#      authoritative way and selects how a local-model session resolves block
+#      (advisory|deliver|block — see delivery_enforcement.py).
+#   2. ambient UAP_ENFORCE_DELIVERY (operator/CI per-run override) when the
+#      project declares nothing.
+#   3. default: block.
+# Escape hatches always apply and are honored by the enforcer BEFORE mode:
+# UAP_DELIVER_ACTIVE=1 (inside a deliver run) / UAP_DELIVER_BYPASS=1 (sanctioned
+# manual edit) — so config-authoritative block never re-routes deliver's own edits.
+_DLV_CFG="$(python3 -c '
+import json, sys
+try:
+    d = (json.load(open(sys.argv[1])).get("delivery") or {})
+    e = str(d.get("enforcement", "")).lower()
+    print("%s|%s" % (e if e in ("block", "advisory", "off") else "", str(d.get("localMode", "")).lower()))
+except Exception:
+    print("|")
+' "$MAIN_ROOT/.uap.json" 2>/dev/null || echo "|")"
+_DLV_MODE="${_DLV_CFG%%|*}"; _DLV_LOCAL="${_DLV_CFG##*|}"
+if [[ -n "$_DLV_MODE" ]]; then
+  export UAP_ENFORCE_DELIVERY="$_DLV_MODE"          # config-authoritative: overrides stale ambient
+else
+  export UAP_ENFORCE_DELIVERY="${UAP_ENFORCE_DELIVERY:-block}"
+fi
+[[ -n "$_DLV_LOCAL" ]] && export UAP_DELIVER_LOCAL_MODE="$_DLV_LOCAL"
 cd "$MAIN_ROOT"
 
 TOOL="$(printf '%s' "$PAYLOAD" | python3 -c 'import json,sys; d=json.load(sys.stdin); print(d.get("tool_name") or d.get("tool") or "")' 2>/dev/null || true)"
@@ -103,6 +129,65 @@ print("1" if (hit or bypass) else "0")
 # Operator out-of-band override disables the fail-closed guard too.
 [[ "${UAP_SELF_PROTECT_OFF:-}" == "1" ]] && SEC_SENSITIVE=0
 
+# ── Edit fast-path (A) ───────────────────────────────────────────────────────
+# Test files and TRIVIAL edits (a one-liner, a constant, a typo) are the fast
+# feedback loop; routing each through the full worktree/task/deliver workflow
+# gates costs a ~10+ min deliver cycle on a slow local executor. Allow them
+# directly — BEFORE the workflow-gate loop — so iteration stays fast. This never
+# bypasses SAFETY: a sensitive control-surface path (SEC_SENSITIVE) is excluded,
+# and self/infra-protect gate bash, not these edits. UAP_DELIVER_FASTPATH=off
+# disables; UAP_DELIVER_TRIVIAL_EDIT_CHARS tunes the trivial threshold.
+if [[ "${UAP_DELIVER_FASTPATH:-on}" != "off" && "$SEC_SENSITIVE" != "1" ]]; then
+  case " Edit Write MultiEdit edit write multiedit " in
+    *" $TOOL "*)
+      # Prefer the cumulative-aware decider (fastpath_gate.py): it bounds how
+      # much un-routed trivial change can accumulate per file (CUM_CHARS/
+      # CUM_EDITS) so a weak model can't assemble a whole broken feature out of
+      # sub-threshold edits that never route to deliver. Fall back to the inline
+      # per-edit trivial check when the helper isn't deployed.
+      _fp_ok=0
+      if [[ -f "$HOOK_DIR/fastpath_gate.py" ]]; then
+        # `if <pipeline>; then` (not `<pipeline> && x=1`): a route verdict (exit 1)
+        # is a CONDITION here, so `set -e` doesn't abort — it just falls through
+        # to the enforcer loop, which blocks+routes.
+        if printf '%s' "$ARGS" | TRIVIAL="${UAP_DELIVER_TRIVIAL_EDIT_CHARS:-240}" \
+          CUM_CHARS="${UAP_DELIVER_CUMULATIVE_CHARS:-800}" \
+          CUM_EDITS="${UAP_DELIVER_CUMULATIVE_EDITS:-6}" \
+          UAP_MAIN_ROOT="$MAIN_ROOT" \
+          python3 "$HOOK_DIR/fastpath_gate.py" 2>/dev/null; then
+          _fp_ok=1
+        fi
+      elif printf '%s' "$ARGS" | TRIVIAL="${UAP_DELIVER_TRIVIAL_EDIT_CHARS:-240}" python3 -c '
+import json, os, sys
+try: a = json.loads(sys.stdin.read() or "{}")
+except Exception: sys.exit(1)
+target = (a.get("file_path") or a.get("filePath") or a.get("path") or a.get("target") or a.get("filename") or a.get("file") or "").lower()
+base = target.rsplit("/", 1)[-1]; stem = base.rsplit(".", 1)[0]
+markers = (".test.", ".spec.", "_test.", "test_", "/test/", "/tests/", "/__tests__/", "/spec/", "/specs/")
+is_test = any(m in "/" + target for m in markers) or stem in ("test","tests","spec","specs","conftest") or stem.startswith("test") or stem.endswith("test") or stem.endswith("spec")
+def changed(a):
+    if isinstance(a.get("edits"), list):
+        return sum(len(str(e.get("old_string") or e.get("oldString") or "")) + len(str(e.get("new_string") or e.get("newString") or "")) for e in a["edits"] if isinstance(e, dict))
+    o=a.get("old_string") or a.get("oldString"); n=a.get("new_string") or a.get("newString")
+    return (len(str(o or ""))+len(str(n or ""))) if (o is not None or n is not None) else None
+c = changed(a)
+trivial = c is not None and c <= int(os.environ.get("TRIVIAL","240"))
+sys.exit(0 if (is_test or trivial) else 1)
+' 2>/dev/null; then
+        _fp_ok=1
+      fi
+      if [[ "$_fp_ok" == "1" ]]; then
+        echo "[UAP policy gate] fast-path: test-file or trivial edit (within cumulative budget) — allowed directly (accumulated/substantive source changes route through deliver)." >&2
+        exit 0
+      fi
+      # The cumulative decider chose to ROUTE this edit (budget crossed, or
+      # non-trivial). Signal the delivery-enforcement enforcer to skip its OWN
+      # trivial allowance so it actually blocks+routes instead of re-approving.
+      export UAP_FASTPATH_ROUTED=1
+      ;;
+  esac
+fi
+
 fail_closed() {
   echo "[UAP policy gate] FAIL-CLOSED: this operation touches the enforcement control surface but the self-protect enforcer could not run (${1:-machinery unavailable}). Blocked so a broken/absent gate can't become a bypass. (Operator override: UAP_SELF_PROTECT_OFF=1.)" >&2
   exit 2
@@ -182,7 +267,14 @@ except: print("")' 2>/dev/null || echo "")"
     echo "$msg" >&2
     exit 2
   fi
-done < <(sqlite3 "$DB" "SELECT p.id, p.name, t.toolName FROM policies p JOIN executable_tools t ON t.policyId=p.id WHERE p.isActive=1;")
+# ORDER BY priority DESC: the policies table has a `priority` column but the
+# gate previously ignored it, iterating in rowid order — so a high-priority
+# routing/safety policy (e.g. delivery-enforcement, infra-protect) could be
+# pre-empted by a lower-priority edit-gate that happened to be registered
+# first, and the agent saw the wrong routing message. Honor priority now so
+# the intended policy fires first. (Blocking short-circuits at exit 2, so the
+# highest-priority applicable block wins.) Name is the stable tiebreak.
+done < <(sqlite3 "$DB" "SELECT p.id, p.name, t.toolName FROM policies p JOIN executable_tools t ON t.policyId=p.id WHERE p.isActive=1 ORDER BY p.priority DESC, p.name ASC;")
 
 # A sensitive op that no self-protect enforcer ever evaluated = the control
 # surface is unguarded (self-protect not registered/active). Fail closed.