@miller-tech/uap 1.221.0 → 2.0.0

package/tools/agents/scripts/anthropic_proxy.py

@@ -1172,6 +1172,40 @@ PROXY_DISABLE_THINKING_ON_TOOL_TURNS = os.environ.get(
     "off",
     "no",
 }
+# Stream upstream `reasoning_content` deltas to the client as Anthropic
+# `thinking` blocks on the TRUE streaming path. Default off: reasoning is
+# chain-of-thought and the standing policy is not to leak it unless the
+# client opted in. Enable for clients whose stream watchdog disconnects on
+# silence (Factory Droid ~300 s): a slow-thinking model otherwise produces
+# zero client-visible events for minutes, the client aborts and retries, and
+# each retry regenerates the turn from scratch (observed 2026-09-05 with
+# Qwen3.8-27B on exllamav3: >4-min reasoning runs on tool turns, one
+# watchdog kill + full retry per long turn).
+PROXY_STREAM_THINKING_DELTAS = os.environ.get(
+    "PROXY_STREAM_THINKING_DELTAS", "off"
+).lower() not in {
+    "0",
+    "false",
+    "off",
+    "no",
+}
+# Emit a one-space thinking_delta every N seconds while the upstream stream
+# has produced no content yet (prompt prefill) or is idle before the first
+# text/tool block. Motivation (2026-09-09, Qwen3.8-Flash-Next 125B-A6B on a
+# single RTX 3090): a 64k-token session turn prefills at ~160-390 tok/s =
+# 170-400 s, past the Factory Droid ~242 s stream watchdog, and message_start
+# / ping events do NOT reset that watchdog — only content deltas do (verified
+# 2026-09-05). Each kill landed mid-prefill and the retry started from token
+# 0: a livelock. The space-only deltas keep the client alive without altering
+# visible output; the thinking block they open is the same block any real
+# leading reasoning then streams into. Requires PROXY_STREAM_THINKING_DELTAS
+# (the lazy block layout); 0 disables.
+try:
+    PROXY_PREFILL_HEARTBEAT_SECS = float(
+        os.environ.get("PROXY_PREFILL_HEARTBEAT_SECS", "0")
+    )
+except (TypeError, ValueError):
+    PROXY_PREFILL_HEARTBEAT_SECS = 0.0
 # Disable thinking on EVERY turn (not just tool turns). For models like Gemma 4
 # that emit ~100 thinking tokens for trivial replies, this halves output cost.
 PROXY_DISABLE_THINKING_ALWAYS = os.environ.get(
@@ -11815,6 +11849,16 @@ async def _heartbeat_then_buffered(produce_coro, model: str, input_tokens: int =
     a Starlette ``Response`` (the guarded path's error returns). Since the stream
     has already committed to HTTP 200, an error Response is re-emitted as an SSE
     ``error`` event rather than an HTTP status.
+
+    When PROXY_STREAM_THINKING_DELTAS and PROXY_PREFILL_HEARTBEAT_SECS are both
+    on, the keep-alive is a ``thinking`` block at index 0 fed with one-space
+    thinking_deltas instead of bare pings: pings and message_start do NOT reset
+    the Factory Droid ~242 s stream watchdog, only content deltas do
+    (2026-09-09: no-tool turns like session summarization — 51k-token prefill
+    plus up to 8000 buffered output tokens ≈ 470 s — livelocked on this path
+    while tool turns on the streaming relay stayed alive). The heartbeat block
+    is closed before the buffered content streams, which is then re-indexed
+    +1 via ``stream_anthropic_message(index_offset=1)``.
     """
     msg_id = f"msg_{uuid.uuid4().hex[:24]}"
     yield (
@@ -11822,6 +11866,8 @@ async def _heartbeat_then_buffered(produce_coro, model: str, input_tokens: int =
         f"data: {json.dumps({'type': 'message_start', 'message': {'id': msg_id, 'type': 'message', 'role': 'assistant', 'content': [], 'model': model, 'stop_reason': None, 'stop_sequence': None, 'usage': {'input_tokens': input_tokens, 'output_tokens': 0}}})}\n\n"
     )
     interval = PROXY_STREAM_HEARTBEAT_SECS if PROXY_STREAM_HEARTBEAT_SECS > 0 else 15.0
+    thinking_heartbeat = PROXY_STREAM_THINKING_DELTAS and PROXY_PREFILL_HEARTBEAT_SECS > 0
+    hb_thinking_open = False
     task = asyncio.ensure_future(produce_coro)
     try:
         while True:
@@ -11831,7 +11877,19 @@ async def _heartbeat_then_buffered(produce_coro, model: str, input_tokens: int =
                 produced = await asyncio.wait_for(asyncio.shield(task), timeout=interval)
                 break
             except asyncio.TimeoutError:
-                yield 'event: ping\ndata: {"type": "ping"}\n\n'
+                if thinking_heartbeat:
+                    if not hb_thinking_open:
+                        hb_thinking_open = True
+                        yield (
+                            f"event: content_block_start\n"
+                            f"data: {json.dumps({'type': 'content_block_start', 'index': 0, 'content_block': {'type': 'thinking', 'thinking': '', 'signature': ''}})}\n\n"
+                        )
+                    yield (
+                        f"event: content_block_delta\n"
+                        f"data: {json.dumps({'type': 'content_block_delta', 'index': 0, 'delta': {'type': 'thinking_delta', 'thinking': ' '}})}\n\n"
+                    )
+                else:
+                    yield 'event: ping\ndata: {"type": "ping"}\n\n'
     except asyncio.CancelledError:
         # Client disconnected — cancel the in-flight produce AND await its
         # cleanup so httpx returns/closes the upstream connection before we
@@ -11853,6 +11911,14 @@ async def _heartbeat_then_buffered(produce_coro, model: str, input_tokens: int =
         )
         return
 
+    # Close the heartbeat thinking block (if opened) before any terminal
+    # event so the stream stays well-formed.
+    if hb_thinking_open:
+        yield (
+            f"event: content_block_stop\n"
+            f"data: {json.dumps({'type': 'content_block_stop', 'index': 0})}\n\n"
+        )
+
     if isinstance(produced, Response):
         # Guarded path returned an error Response; re-emit as an SSE error event.
         try:
@@ -11866,16 +11932,23 @@ async def _heartbeat_then_buffered(produce_coro, model: str, input_tokens: int =
         return
 
     # produced is the finalized Anthropic response dict — stream its content
-    # without a second message_start (already sent above).
-    async for chunk in stream_anthropic_message(produced, emit_message_start=False):
+    # without a second message_start (already sent above). Blocks shift +1
+    # when the heartbeat thinking block occupies index 0.
+    async for chunk in stream_anthropic_message(
+        produced, emit_message_start=False, index_offset=1 if hb_thinking_open else 0
+    ):
         yield chunk
 
 
-async def stream_anthropic_message(anthropic_resp: dict, emit_message_start: bool = True):
+async def stream_anthropic_message(
+    anthropic_resp: dict, emit_message_start: bool = True, index_offset: int = 0
+):
     """Stream a finalized Anthropic message as SSE events.
 
     emit_message_start=False skips the leading message_start event for callers
     (the heartbeat wrapper) that have already emitted one to start the stream.
+    index_offset shifts every content block index — used when the caller has
+    already occupied index 0 (the prefill-heartbeat thinking block).
     """
     if emit_message_start:
         message = {
@@ -11897,7 +11970,7 @@ async def stream_anthropic_message(anthropic_resp: dict, emit_message_start: boo
         yield f"event: message_start\ndata: {json.dumps({'type': 'message_start', 'message': message})}\n\n"
 
     content_blocks = anthropic_resp.get("content", []) or [{"type": "text", "text": ""}]
-    block_index = 0
+    block_index = index_offset
     for block in content_blocks:
         btype = block.get("type", "text")
         if btype == "tool_use":
@@ -11976,11 +12049,24 @@ async def stream_anthropic_response(
         f"data: {json.dumps({'type': 'message_start', 'message': {'id': msg_id, 'type': 'message', 'role': 'assistant', 'content': [], 'model': model, 'stop_reason': None, 'stop_sequence': None, 'usage': {'input_tokens': _client_input_tokens(monitor), 'output_tokens': 0}}})}\n\n"
     )
 
-    # content_block_start for text (index 0)
-    yield (
-        f"event: content_block_start\n"
-        f"data: {json.dumps({'type': 'content_block_start', 'index': 0, 'content_block': {'type': 'text', 'text': ''}})}\n\n"
-    )
+    # Block bookkeeping. Two layouts:
+    #  - legacy (PROXY_STREAM_THINKING_DELTAS off): text block pre-opened at
+    #    index 0, tool blocks from 1. Reasoning deltas are collected but never
+    #    streamed, so a slow-thinking model is client-silent for minutes.
+    #  - lazy (flag on): blocks open in arrival order. A leading reasoning run
+    #    opens a `thinking` block and streams thinking_deltas, so the client
+    #    sees continuous activity instead of a silence its watchdog will kill.
+    stream_thinking = PROXY_STREAM_THINKING_DELTAS
+    next_block_index = 0  # lazy layout only; legacy uses fixed 0/1+
+    open_block: int | None = None  # currently open block (lazy layout)
+    text_block_index: int | None = None  # lazy layout; legacy hardcodes 0
+
+    if not stream_thinking:
+        # content_block_start for text (index 0)
+        yield (
+            f"event: content_block_start\n"
+            f"data: {json.dumps({'type': 'content_block_start', 'index': 0, 'content_block': {'type': 'text', 'text': ''}})}\n\n"
+        )
 
     yield 'event: ping\ndata: {"type": "ping"}\n\n'
 
@@ -11989,7 +12075,7 @@ async def stream_anthropic_response(
 
     # Track tool call state for streaming tool_calls
     tool_calls_by_index: dict[int, dict] = {}
-    tool_block_index = 1  # anthropic block index (0 = text)
+    tool_block_index = 1  # anthropic block index (0 = text) — legacy layout
     text_chunks: list[str] = []  # accumulate text for logging
     reasoning_chunks: list[str] = []  # accumulate reasoning for fallback
 
@@ -12007,8 +12093,42 @@ async def stream_anthropic_response(
     # upstream truth for telemetry and the session monitor.
     upstream_usage: dict = {}
 
+    # Heartbeat during upstream silence (prefill). aiter_lines() blocks with
+    # no idle callback, so each line read is a persistent Task raced against
+    # asyncio.wait — NOT wait_for, which cancels the inner read on timeout and
+    # would destroy the line iterator's state mid-stream. On timeout, emit a
+    # one-space thinking_delta (the only event class verified to reset the
+    # Droid stream watchdog) in the leading phase, else a ping.
+    _hb_secs = PROXY_PREFILL_HEARTBEAT_SECS if stream_thinking else 0.0
+    _line_iter = openai_stream.aiter_lines()
+    _pending_line: asyncio.Task | None = None
     try:
-        async for line in openai_stream.aiter_lines():
+        while True:
+            if _pending_line is None:
+                _pending_line = asyncio.ensure_future(_line_iter.__anext__())
+            if _hb_secs > 0:
+                _ready, _ = await asyncio.wait({_pending_line}, timeout=_hb_secs)
+                if not _ready:
+                    if text_block_index is None and not tool_calls_by_index:
+                        if open_block is None:
+                            open_block = next_block_index
+                            next_block_index += 1
+                            yield (
+                                f"event: content_block_start\n"
+                                f"data: {json.dumps({'type': 'content_block_start', 'index': open_block, 'content_block': {'type': 'thinking', 'thinking': '', 'signature': ''}})}\n\n"
+                            )
+                        yield (
+                            f"event: content_block_delta\n"
+                            f"data: {json.dumps({'type': 'content_block_delta', 'index': open_block, 'delta': {'type': 'thinking_delta', 'thinking': ' '}})}\n\n"
+                        )
+                    else:
+                        yield 'event: ping\ndata: {"type": "ping"}\n\n'
+                    continue
+            try:
+                line = await _pending_line
+            except StopAsyncIteration:
+                break
+            _pending_line = None
             if not line.startswith("data: "):
                 continue
             data = line[6:].strip()
@@ -12030,14 +12150,55 @@ async def stream_anthropic_response(
             reasoning = delta.get("reasoning_content", "")
             if reasoning:
                 reasoning_chunks.append(reasoning)
+                # Stream leading reasoning as a thinking block so the client's
+                # stream watchdog sees activity during long thinking runs.
+                # Only when it LEADS the turn (no text/tool output yet): late
+                # interleaved reasoning keeps the legacy collect-only path
+                # rather than churning block open/close per chunk.
+                thinking_open = (
+                    stream_thinking
+                    and text_block_index is None
+                    and not tool_calls_by_index
+                )
+                if thinking_open and open_block is None:
+                    open_block = next_block_index
+                    next_block_index += 1
+                    yield (
+                        f"event: content_block_start\n"
+                        f"data: {json.dumps({'type': 'content_block_start', 'index': open_block, 'content_block': {'type': 'thinking', 'thinking': '', 'signature': ''}})}\n\n"
+                    )
+                if thinking_open and open_block is not None:
+                    yield (
+                        f"event: content_block_delta\n"
+                        f"data: {json.dumps({'type': 'content_block_delta', 'index': open_block, 'delta': {'type': 'thinking_delta', 'thinking': reasoning}})}\n\n"
+                    )
 
             # Handle text content deltas
             if delta.get("content"):
                 output_tokens += 1  # rough token estimate
                 text_chunks.append(delta["content"])
+                text_idx = 0
+                if stream_thinking:
+                    # Close a leading thinking block before the text block.
+                    if open_block is not None and open_block != text_block_index:
+                        yield (
+                            f"event: content_block_stop\n"
+                            f"data: {json.dumps({'type': 'content_block_stop', 'index': open_block})}\n\n"
+                        )
+                        open_block = None
+                    if text_block_index is None:
+                        text_block_index = next_block_index
+                        next_block_index += 1
+                    if open_block is None:
+                        open_block = text_block_index
+                        yield (
+                            f"event: content_block_start\n"
+                            f"data: {json.dumps({'type': 'content_block_start', 'index': text_block_index, 'content_block': {'type': 'text', 'text': ''}})}\n\n"
+                        )
+                    text_idx = text_block_index
                 yield (
                     f"event: content_block_delta\n"
-                    f"data: {json.dumps({'type': 'content_block_delta', 'index': 0, 'delta': {'type': 'text_delta', 'text': delta['content']}})}\n\n"
+                    f"data: {json.dumps({'type': 'content_block_delta', 'index': text_idx, 'delta': {'type': 'text_delta', 'text': delta['content']}})}\n\n"
                 )
 
                 # Degenerate-repetition guard: stop a runaway while it is still
@@ -12077,15 +12238,28 @@ async def stream_anthropic_response(
                         tc_id = tc_delta.get("id", f"toolu_{uuid.uuid4().hex[:12]}")
                         fn = tc_delta.get("function", {})
                         initial_args = fn.get("arguments", "")
+                        if stream_thinking:
+                            this_block_index = next_block_index
+                            next_block_index += 1
+                        else:
+                            this_block_index = tool_block_index
                         tool_calls_by_index[tc_idx] = {
                             "id": tc_id,
                             "name": _restore_tool_name(fn.get("name", "")),
                             "arguments": initial_args,
-                            "block_index": tool_block_index,
+                            "block_index": this_block_index,
                         }
 
-                        # Close text block before first tool block
-                        if tool_block_index == 1:
+                        # Close the open text/thinking block before the first
+                        # tool block.
+                        if stream_thinking:
+                            if open_block is not None:
+                                yield (
+                                    f"event: content_block_stop\n"
+                                    f"data: {json.dumps({'type': 'content_block_stop', 'index': open_block})}\n\n"
+                                )
+                                open_block = None
+                        elif tool_block_index == 1:
                             yield (
                                 f"event: content_block_stop\n"
                                 f"data: {json.dumps({'type': 'content_block_stop', 'index': 0})}\n\n"
@@ -12094,7 +12268,7 @@ async def stream_anthropic_response(
                         # Emit content_block_start for this tool_use
                         yield (
                             f"event: content_block_start\n"
-                            f"data: {json.dumps({'type': 'content_block_start', 'index': tool_block_index, 'content_block': {'type': 'tool_use', 'id': tc_id, 'name': fn.get('name', '')}})}\n\n"
+                            f"data: {json.dumps({'type': 'content_block_start', 'index': this_block_index, 'content_block': {'type': 'tool_use', 'id': tc_id, 'name': fn.get('name', '')}})}\n\n"
                         )
 
                         # Emit initial arguments fragment (e.g. "{") that
@@ -12105,7 +12279,7 @@ async def stream_anthropic_response(
                         if initial_args:
                             yield (
                                 f"event: content_block_delta\n"
-                                f"data: {json.dumps({'type': 'content_block_delta', 'index': tool_block_index, 'delta': {'type': 'input_json_delta', 'partial_json': initial_args}})}\n\n"
+                                f"data: {json.dumps({'type': 'content_block_delta', 'index': this_block_index, 'delta': {'type': 'input_json_delta', 'partial_json': initial_args}})}\n\n"
                             )
 
                         tool_block_index += 1
@@ -12144,6 +12318,8 @@ async def stream_anthropic_response(
         logger.error("Unexpected stream error: %s: %s", type(exc).__name__, exc)
         finish_reason = "end_turn"
     finally:
+        if _pending_line is not None and not _pending_line.done():
+            _pending_line.cancel()
         if _sr_client is not None:
             _inflight_dec(_sr_client)
         # Detached close: a bare 'await aclose()' here is itself cancellable
@@ -12199,9 +12375,29 @@ async def stream_anthropic_response(
                     PROXY_STREAM_REASONING_FALLBACK,
                 )
                 text_chunks.append(fallback_text)
+                fallback_idx = 0
+                if stream_thinking:
+                    # The thinking block (if any) is still open: close it and
+                    # open the text block the fallback lands in.
+                    if open_block is not None and open_block != text_block_index:
+                        yield (
+                            f"event: content_block_stop\n"
+                            f"data: {json.dumps({'type': 'content_block_stop', 'index': open_block})}\n\n"
+                        )
+                        open_block = None
+                    if text_block_index is None:
+                        text_block_index = next_block_index
+                        next_block_index += 1
+                    if open_block is None:
+                        open_block = text_block_index
+                        yield (
+                            f"event: content_block_start\n"
+                            f"data: {json.dumps({'type': 'content_block_start', 'index': text_block_index, 'content_block': {'type': 'text', 'text': ''}})}\n\n"
+                        )
+                    fallback_idx = text_block_index
                 yield (
                     f"event: content_block_delta\n"
-                    f"data: {json.dumps({'type': 'content_block_delta', 'index': 0, 'delta': {'type': 'text_delta', 'text': fallback_text}})}\n\n"
+                    f"data: {json.dumps({'type': 'content_block_delta', 'index': fallback_idx, 'delta': {'type': 'text_delta', 'text': fallback_text}})}\n\n"
                 )
             else:
                 logger.warning(
@@ -12210,10 +12406,30 @@ async def stream_anthropic_response(
                     PROXY_STREAM_REASONING_FALLBACK,
                 )
 
-        yield (
-            f"event: content_block_stop\n"
-            f"data: {json.dumps({'type': 'content_block_stop', 'index': 0})}\n\n"
-        )
+        if stream_thinking:
+            if open_block is not None:
+                yield (
+                    f"event: content_block_stop\n"
+                    f"data: {json.dumps({'type': 'content_block_stop', 'index': open_block})}\n\n"
+                )
+                open_block = None
+            elif text_block_index is None and next_block_index == 0:
+                # Completely empty turn: keep the legacy guarantee of at least
+                # one (empty) text block so clients always see a well-formed
+                # message body.
+                yield (
+                    f"event: content_block_start\n"
+                    f"data: {json.dumps({'type': 'content_block_start', 'index': 0, 'content_block': {'type': 'text', 'text': ''}})}\n\n"
+                )
+                yield (
+                    f"event: content_block_stop\n"
+                    f"data: {json.dumps({'type': 'content_block_stop', 'index': 0})}\n\n"
+                )
+        else:
+            yield (
+                f"event: content_block_stop\n"
+                f"data: {json.dumps({'type': 'content_block_stop', 'index': 0})}\n\n"
+            )
 
     # Log response summary
     accumulated_text = "".join(text_chunks)
@@ -12267,11 +12483,21 @@ async def stream_anthropic_response(
             # We already streamed the text as-is.  We cannot un-stream it,
             # but we CAN close the text block, emit the recovered tool_use
             # blocks, and fix the finish_reason so Claude Code sees them.
-            yield (
-                f"event: content_block_stop\n"
-                f"data: {json.dumps({'type': 'content_block_stop', 'index': 0})}\n\n"
-            )
-            for idx, xtc in enumerate(xml_extracted, start=1):
+            if stream_thinking:
+                if open_block is not None:
+                    yield (
+                        f"event: content_block_stop\n"
+                        f"data: {json.dumps({'type': 'content_block_stop', 'index': open_block})}\n\n"
+                    )
+                    open_block = None
+                xml_base = next_block_index
+            else:
+                yield (
+                    f"event: content_block_stop\n"
+                    f"data: {json.dumps({'type': 'content_block_stop', 'index': 0})}\n\n"
+                )
+                xml_base = 1
+            for idx, xtc in enumerate(xml_extracted, start=xml_base):
                 fn = xtc.get("function", {})
                 tc_id = xtc.get("id", f"toolu_{uuid.uuid4().hex[:12]}")
                 tc_name = _restore_tool_name(fn.get("name", ""))

package/tools/agents/tests/test_enforcement_self_protect.py

@@ -41,6 +41,96 @@ class SelfProtectTest(unittest.TestCase):
         rc, out = run("Write", {"file_path": str(REPO / ".policy-tools/abc_delivery_enforcement.py")})
         self.assertEqual(rc, 2)
 
+    def test_blocks_edit_to_policies_db(self):
+        # The inversion fix (F2): the enforcement registry the gates READ must
+        # be at least as protected as the artifact paths the gates demand.
+        rc, out = run("Edit", {"file_path": str(REPO / "agents/data/memory/policies.db")})
+        self.assertEqual(rc, 2)
+        self.assertFalse(out["allowed"])
+
+    def test_blocks_bash_rm_policies_db(self):
+        rc, out = run("Bash", {"command": "rm -f agents/data/memory/policies.db"})
+        self.assertEqual(rc, 2)
+
+    def test_allows_uap_policy_cli_bash(self):
+        # Policy management goes through the CLI process, not direct file ops;
+        # a command that merely RUNS `uap policy` must not trip the DB guard.
+        rc, out = run("Bash", {"command": "uap policy list"})
+        self.assertEqual(rc, 0)
+
+    def test_blocks_edit_to_operator_overrides(self):
+        # F3: the signed override file is operator-only; the "/.uap/" marker
+        # already refuses Edit/Write. Pin it so a future carve-out cannot
+        # silently reopen the self-mint path.
+        rc, out = run("Write", {"file_path": str(REPO / ".uap/operator-overrides.json")})
+        self.assertEqual(rc, 2)
+
+    def test_blocks_bash_redirect_creating_operator_overrides(self):
+        # F3: the file-op marker does not cover shell redirects — without this
+        # target entry `echo …> .uap/operator-overrides.json` self-mints the
+        # bypass the file exists to restrict to the operator.
+        rc, out = run("Bash", {"command": 'echo "{}" > .uap/operator-overrides.json'})
+        self.assertEqual(rc, 2)
+
+    def test_blocks_bash_rm_operator_overrides(self):
+        rc, out = run("Bash", {"command": "rm -f .uap/operator-overrides.json"})
+        self.assertEqual(rc, 2)
+
+    def test_blocks_bash_forging_liveness_cache(self):
+        # F1: the degrade consult trusts this file — a forged entry downgrades
+        # a blocking policy to advisory, so writing it directly must be refused.
+        # The legitimate writer is `uap policy liveness`, whose command text
+        # never names the file.
+        rc, out = run("Bash", {"command": 'echo "{}" > .uap/policy-liveness.json'})
+        self.assertEqual(rc, 2)
+
+    def test_allows_uap_policy_liveness_cli(self):
+        rc, out = run("Bash", {"command": "uap policy liveness --quiet"})
+        self.assertEqual(rc, 0)
+
+    def test_allows_reading_operator_overrides(self):
+        rc, out = run("Bash", {"command": "cat .uap/operator-overrides.json"})
+        self.assertEqual(rc, 0)
+
+    def test_blocks_python_minting_operator_overrides(self):
+        # Security review (deliver-hardening, 2026-07-13): an interpreter-
+        # mediated write carries no destructive verb and no redirect, so the
+        # redirect/verb scans miss it — and before the root-ownership check
+        # this one command minted a full bypass. Blocked on sight now.
+        rc, out = run("Bash", {"command":
+            'python3 -c \'import json; json.dump({"deliverBypass": True}, open(".uap/operator-overrides.json", "w"))\''})
+        self.assertEqual(rc, 2)
+
+    def test_blocks_python_forging_liveness_cache(self):
+        rc, out = run("Bash", {"command":
+            'python3 -c \'open(".uap/policy-liveness.json", "w").write("{}")\''})
+        self.assertEqual(rc, 2)
+
+    def test_blocks_node_writing_trust_anchor(self):
+        rc, out = run("Bash", {"command":
+            'node -e \'require("fs").writeFileSync(".uap/operator-overrides.json", "{}")\''})
+        self.assertEqual(rc, 2)
+
+    def test_blocks_bash_c_wrapped_python_mint(self):
+        # The rule fires on the full command text, so a shell wrapper does not
+        # hide the write.
+        rc, out = run("Bash", {"command":
+            'bash -c "python3 -c \'open(".uap/operator-overrides.json", "w")\'"'})
+        self.assertEqual(rc, 2)
+
+    def test_allows_python_READING_a_trust_anchor(self):
+        # Reads must stay cheap: no write primitive, no interpreter-write rule.
+        rc, out = run("Bash", {"command":
+            'python3 -c \'import json; print(json.load(open(".uap/policy-liveness.json")))\''})
+        self.assertEqual(rc, 0)
+
+    def test_allows_python_write_to_ordinary_uap_state(self):
+        # The narrow list is deliberate: runtime state under .uap/ stays
+        # writable, only the two trust anchors get the interpreter rule.
+        rc, out = run("Bash", {"command":
+            'python3 -c \'open(".uap/verify-cadence", "w").write("0")\''})
+        self.assertEqual(rc, 0)
+
     def test_blocks_bash_setting_bypass(self):
         rc, out = run("Bash", {"command": "export UAP_DELIVER_BYPASS=1 && echo hi"})
         self.assertEqual(rc, 2)

package/tools/agents/tests/test_expert_review_pr_scope.py

@@ -207,9 +207,9 @@ class TestShipDetectionIsCommandPosition(unittest.TestCase):
     review artifact was refused because the notes described the bug being fixed.
 
     The risk in the fix is UNDER-detection, so the ship cases below matter more
-    than the prose ones. `rtk git push` especially: this repo requires git to be
-    invoked through rtk, so a verb check that stopped at the wrapper would miss
-    every real ship command in the codebase.
+    than the prose ones. The wrapper cases especially: rtk is no longer
+    integrated in UAP, but the binary can still exist on operator machines, so
+    a verb check that stopped at the wrapper would miss wrapped ship commands.
     """
 
     def setUp(self):
@@ -247,10 +247,18 @@ class TestShipDetectionIsCommandPosition(unittest.TestCase):
         self.assert_ship("git push origin master")
 
     def test_rtk_wrapped_git_is_a_ship_action(self):
-        # The mandated form in this repo. Missing it would silently ungate
-        # every push and commit made here.
+        # rtk is no longer a UAP integration, but the wrapper unwrap stays as
+        # defense-in-depth for machines where the binary remains installed.
         self.assert_ship("rtk git push origin master")
 
+    def test_rtk_wrapped_git_with_value_option_is_a_ship_action(self):
+        # The `-C <path>` form needs the wrapper unwrap — the raw prose
+        # patterns only catch adjacent `git push`. Regression guard.
+        self.assert_ship("rtk git -C /repo push origin master")
+
+    def test_rtk_wrapped_plumbing_is_a_ship_action(self):
+        self.assert_ship("rtk git send-pack origin master")
+
     def test_ship_action_after_a_chained_command(self):
         self.assert_ship("cd sub && git commit -m x")