@miller-tech/uap 1.221.0 → 2.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.221.0",
+  "version": "2.0.0",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,7 @@
     "start": "node dist/bin/cli.js",
     "test": "vitest",
     "test:ci": "vitest run",
-    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_conditional_destructive_verbs tools.agents.tests.test_live_deliver_kill tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_schema_diff_inline tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_repeat_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_gate_failclosed_schema_diff tools.agents.tests.test_rtk_wrap tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_fastpath_config tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_stuck_break_hard tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window tools.agents.tests.test_thinking_template_kwargs tools.agents.tests.test_cycle_break_wait_poll tools.agents.tests.test_upstream_model_aliases",
+    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_conditional_destructive_verbs tools.agents.tests.test_live_deliver_kill tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_schema_diff_inline tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_repeat_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_gate_failclosed_schema_diff tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_fastpath_config tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_stuck_break_hard tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window tools.agents.tests.test_thinking_template_kwargs tools.agents.tests.test_cycle_break_wait_poll tools.agents.tests.test_upstream_model_aliases tools.agents.tests.test_stream_thinking_deltas",
     "test:coverage": "vitest --coverage",
     "bench": "vitest --config vitest.bench.config.ts",
     "lint": "eslint src --ext .ts",

package/scripts/maintenance/update-skills.py

@@ -28,27 +28,6 @@ skills_to_update = {
 }
 
 
-def add_rtk_header(content, skill_name):
-    rtk_addition = f"""---
-name: {skill_name}
-version: "2.0.0"
-compatibility: CLAUDE.md v2.3.0+
----
-
-> **RTK Integration**: Supports `@hooks-session-start.md`, `@PreCompact.md`
-
-"""
-    if content.startswith("---"):
-        end_frontmatter = content.find("---", 3)
-        if end_frontmatter > 0:
-            return (
-                content[: end_frontmatter + 3]
-                + rtk_addition
-                + content[end_frontmatter + 3 :]
-            )
-    return rtk_addition + content
-
-
 def add_decision_loop_ref(content, skill_name):
     decision_loop = f"""
 ## Protocol Integration
@@ -117,7 +96,6 @@ def update_skill_file(skill_dir, skill_name):
         content = f.read()
 
     original_content = content
-    content = add_rtk_header(content, skill_name)
     content = add_decision_loop_ref(content, skill_name)
     content = add_uam_compliance(content)
 

package/scripts/maintenance/verify-compliance.sh

@@ -79,12 +79,12 @@ else
     echo "✗ Pattern Router MISSING"
 fi
 
-# 10. RTK includes
+# 10. Session-hook includes
 if grep -q "@hooks-session-start.md\|@PreCompact.md" CLAUDE.md; then
     score=$((score + 1))
-    echo "✓ RTK includes (@hooks-session-start, @PreCompact)"
+    echo "✓ Session-hook includes (@hooks-session-start, @PreCompact)"
 else
-    echo "✗ RTK includes MISSING"
+    echo "✗ Session-hook includes MISSING"
 fi
 
 # 11. Verifier loop enforcement (min 3 runs)

package/src/policies/enforcers/enforcement_self_protect.py

@@ -39,6 +39,11 @@ PROTECTED_MARKERS = (
     "/.policy-tools/",
     "/src/policies/",
     "/policies/",            # the policy-definition markdown dir
+    # The policies DB the gates read. Compliance artifact paths are carved out
+    # below, so without this the enforcement registry itself was the soft spot:
+    # rewrite the DB and every downstream gate grades a forgery (the pay2u
+    # inversion the operator patch fixed out-of-tree).
+    "/agents/data/memory/policies.db",
     "/.uap.json",
     "/.uap/",
     "anthropic-proxy.env",
@@ -62,6 +67,10 @@ BYPASS_PATTERNS = (
     # agent writes its own command strings, so an inline form waives its own
     # review. Refuse it here so the attempt is visible rather than silent.
     re.compile(r"UAP_NO_REVIEW\s*=\s*['\"]?1", re.I),
+    # quality-metrics gate hatch, same operator-only shape: the enforcer reads
+    # the launch env, so the only agent-reachable move is PERSISTING the flag
+    # (rc files, proxy env) — which is exactly what this pattern refuses.
+    re.compile(r"UAP_QUALITY_GATE_OFF\s*=\s*['\"]?1", re.I),
     re.compile(r"UAP_USER_VALIDATION\s*=\s*['\"]?0", re.I),
     # Single-flight is a DATA-SAFETY control, not a policy preference: deliver
     # runs each candidate in a git worktree, and two runs against one repo are
@@ -246,8 +255,33 @@ PROTECTED_TARGETS = (
     # (test_gate_evidence), which asserts that exact append stays allowed.
     # Guarding it needs a rule that tells `>>` from `>`; blocking the queue's
     # own writes to protect it is not that rule.
+    #
+    # The policies DB the gates READ. The inversion this closes: compliance
+    # artifact paths (.uap/reviews/) were agent-locked while the DB that
+    # decides what is enforced sat unprotected — an agent could delete or
+    # rewrite the policy registry instead of complying with it (pay2u operator
+    # patch uap-policy-fix-APPLY.sh, upstreamed here). The CLI's own writes go
+    # through the `uap policy` process, not agent Edit/Write tools, so policy
+    # management is unaffected; what this refuses is the agent deleting or
+    # editing the DB directly.
+    "agents/data/memory/policies.db",
     ".uap.json",
     "anthropic-proxy.env",
+    # F3 (deliver-hardening 2026-07-13): the signed operator-override file.
+    # Edit/Write to it is already refused via the "/.uap/" marker, but the
+    # destructive check treats every redirect alike and this directory is
+    # otherwise permissive — `echo '{deliverBypass:true…}' >
+    # .uap/operator-overrides.json` would self-mint the bypass the file exists
+    # to restrict to the operator. Only an out-of-band operator writes it; the
+    # hook additionally verifies uid/mode/expiresAt before honoring it.
+    ".uap/operator-overrides.json",
+    # F1: the liveness cache the gate's degrade consult trusts. A forged entry
+    # ({healthy:false, degradable:true}) would downgrade a BLOCKING policy to
+    # advisory — exactly the sabotage the degrade guard exists to refuse — so
+    # the cache must be as unwritable as the verdicts it carries. Legitimate
+    # writes go through `uap policy liveness`/`status`, whose command text
+    # never names the file (same shape as the policies.db guard).
+    ".uap/policy-liveness.json",
 )
 
 _SEGMENT_SPLIT = re.compile(r"(?:\|\||&&|[;\n|&])")
@@ -525,6 +559,37 @@ def _kills_live_deliver_run(command: str, root) -> str:
     return ""
 
 
+# The two files the gate's TRUST decisions rest on: the signed operator
+# override and the liveness cache the degrade consult reads. They get a rule
+# the rest of the protected surface does not (deliver-hardening security
+# review, 2026-07-13): an INTERPRETER-MEDIATED write —
+#   python3 -c 'import json; json.dump({...}, open(".uap/operator-overrides.json","w"))'
+# carries no destructive verb, no shell redirect and no UAP_* bypass text, so
+# every other scan here walks straight past it — yet a successful write used
+# to mint a full bypass. The hook now also requires these files ROOT-owned
+# before trusting them, which is the load-bearing fix; this rule is the
+# defense-in-depth that stops the write from landing at all. Root ownership
+# is what makes this narrow list sufficient — anything else the agent writes
+# is distrusted on READ, so it need not be write-blocked here.
+_TRUST_ANCHORS = (".uap/operator-overrides.json", ".uap/policy-liveness.json")
+_INTERPRETER_RE = re.compile(r"(?:^|[\s;|&('\"`])(?:python\d*(?:\.\d+)?|perl|ruby|node)(?:\s|$)")
+# A write primitive in interpreter code: open(…, "w"/"a"/"x"/"+"), or a
+# mutating method call. Reads (open without a mode, json.load, print) match
+# neither and stay allowed.
+_INTERPRETER_WRITE_RE = re.compile(
+    r"open\s*\([^)]*[\"'][wax+]|"
+    r"\.\s*(?:write\w*|writelines|dump|rename|replace|unlink|remove|removedirs|"
+    r"chmod|chown|rmtree|move|copy\w*)\s*\(")
+
+
+def _interpreter_write_to_anchor(command: str) -> bool:
+    """True when an interpreter command names a trust anchor with write intent."""
+    lowered = command.lower()
+    if not any(anchor in lowered for anchor in _TRUST_ANCHORS):
+        return False
+    return bool(_INTERPRETER_RE.search(command) and _INTERPRETER_WRITE_RE.search(command))
+
+
 def _direct_destructive(command: str) -> bool:
     """Destructive op naming a protected path, judged per command segment."""
     cd_into_protected = False
@@ -586,6 +651,11 @@ def _bash_destructive(command: str, _depth: int = 0) -> bool:
         return False
     if _direct_destructive(command):
         return True
+    # Checked at EVERY depth (an interpreter write inside `bash -c "..."` is
+    # still one) and BEFORE the intent gate below — that gate reads shell
+    # verbs, and an interpreter-mediated write to a trust anchor carries none.
+    if _interpreter_write_to_anchor(command):
+        return True
     if _depth < 2:                       # bounded: `bash -c "bash -c ..."`
         for inner in _inner_commands(command):
             if _bash_destructive(inner, _depth + 1):

package/src/policies/enforcers/expert_review_required.py

@@ -63,6 +63,9 @@ GH_API_SHIP_RE = re.compile(
 )
 GIT_VALUE_OPTIONS = frozenset({"-C", "-c", "--git-dir", "--work-tree", "--namespace"})
 WRAPPER_VERBS = frozenset({
+    # "rtk" stays even though UAP no longer integrates the rtk CLI: the binary
+    # can still exist on operator machines, and without the unwrap, forms like
+    # `rtk git -C /repo push` would slip past the ship gate (fail-open).
     "rtk", "env", "nohup", "sudo", "time", "command", "timeout", "stdbuf",
 })
 _SEGMENT_SPLIT = re.compile(r"(?:\|\||&&|[;\n|&])")
@@ -481,6 +484,25 @@ def main() -> None:
             "Override: UAP_NO_REVIEW=1.",
         )
 
+    # Quality-metrics fusion: when the review artifact carries a `quality`
+    # block (written from `uap quality check --json` by the
+    # parallel-expert-review flow), a failing machine report vetoes the
+    # approval — reviewers adjudicate the numbers, they cannot outvote them.
+    # Absent block -> fail-open (repos without .uap/quality-metrics.json and
+    # pre-existing artifacts keep working).
+    quality = data.get("quality") if isinstance(data, dict) else None
+    if isinstance(quality, dict) and quality.get("pass") is False:
+        blocking = quality.get("blocking")
+        detail = f" ({blocking} blocking violation(s))" if isinstance(blocking, int) else ""
+        emit(
+            False,
+            f"expert-review-required: the review's quality gate FAILED{detail}. "
+            "Run `uap quality check`, fix the blocking violations (or regenerate the "
+            "baseline deliberately with `uap quality baseline --update`), refresh the "
+            "artifact's quality block, and re-record the review. "
+            "Override: UAP_NO_REVIEW=1.",
+        )
+
     emit(
         True,
         f"expert-review satisfied (.uap/reviews/{slug}.json"