@muxoai/platform 1.3.1 → 1.3.3

package/dist/providers/microsoft-governance.js

@@ -1,7 +1,28 @@
 import crypto from "node:crypto";
-import { AgentIdentity, AuditLogger, McpSecurityScanner, PolicyEngine, } from "../../vendor/microsoft-governance/dist/index.js";
+import { AgentIdentity, AuditLogger, ContextPoisoningDetector, ExecutionRing, FacetRegistry, KillSwitch, McpSecurityScanner, PolicyEngine, RingEnforcer, TrustManager, extractK8sFacets, extractProtocolFacets, extractSqlFacets, } from "../../vendor/microsoft-governance/dist/index.js";
 const SDK_VERSION = "5.0.0";
 const POLICY_ID = "muxo-microsoft-agent-governance-v5";
+export const RING_LABELS = {
+    [ExecutionRing.Ring0]: "Ring 0 (Kernel / Destructive & Root Boundary)",
+    [ExecutionRing.Ring1]: "Ring 1 (Supervisor / Provisioning, Financial & Admin)",
+    [ExecutionRing.Ring2]: "Ring 2 (Standard Agent / Governed Write)",
+    [ExecutionRing.Ring3]: "Ring 3 (Unprivileged Sandbox / Read-Only)",
+};
+function requiredRingForRisk(riskLevel) {
+    switch (riskLevel) {
+        case "destructive":
+            return ExecutionRing.Ring0;
+        case "admin":
+        case "financial":
+        case "provisioning":
+            return ExecutionRing.Ring1;
+        case "write":
+            return ExecutionRing.Ring2;
+        case "read":
+        default:
+            return ExecutionRing.Ring3;
+    }
+}
 // PKCS#8 DER prefix for a 32-byte Ed25519 private key seed (OID 1.3.101.112)
 const ED25519_PKCS8_PREFIX = Buffer.from([
     0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70,
@@ -39,12 +60,41 @@ function deriveDeterministicIdentity(seedMaterial, agentId, capabilities, opts)
 }
 export class MicrosoftGovernanceAdapter {
     scanner;
+    contextPoisoningDetector;
+    facetRegistry;
+    trustManager;
+    killSwitch;
+    activeKillSwitches = new Map();
     seedMaterial;
     auditLoggers = new Map();
     identities = new Map();
     defaultIdentity;
     constructor(seed) {
         this.scanner = new McpSecurityScanner();
+        this.contextPoisoningDetector = new ContextPoisoningDetector({
+            maxContextSizeBytes: 100_000,
+            maxEntriesPerSession: 250,
+            entropyThreshold: 5.5,
+            similarityThreshold: 0.92,
+            enableIsolation: true,
+        });
+        this.facetRegistry = new FacetRegistry();
+        this.facetRegistry.register("sql", extractSqlFacets);
+        this.facetRegistry.register("k8s", extractK8sFacets);
+        this.facetRegistry.register("infra", (sub) => ({
+            provider: String(sub.provider ?? "").toLowerCase(),
+            service: String(sub.service ?? "").toLowerCase(),
+            action: String(sub.action ?? "read").toLowerCase(),
+            destructive: Boolean(sub.destructive),
+        }));
+        this.trustManager = new TrustManager({
+            initialScore: 0.75,
+            decayFactor: 0.98,
+        });
+        this.killSwitch = new KillSwitch({
+            enabled: true,
+            defaultSubstituteAgentId: "muxo-safe-mode-guardian",
+        });
         this.seedMaterial = Buffer.isBuffer(seed)
             ? seed
             : Buffer.from(String(seed ||
@@ -94,12 +144,273 @@ export class MicrosoftGovernanceAdapter {
         }
         return logger;
     }
+    /**
+     * Scans memory or prompt context for OWASP ASI-06 Context Poisoning (prompt injection,
+     * roleplay overrides, delimiter injection, high-entropy exfiltration payloads, and session isolation).
+     */
+    scanMemoryContent(params) {
+        const safeAgentKey = params.workspaceId.replace(/[^a-zA-Z0-9_-]/g, "_");
+        const safeSessionKey = (params.sessionId || "default").replace(/[^a-zA-Z0-9_-]/g, "_");
+        const entryId = params.entryId || `mem_${crypto.randomBytes(6).toString("hex")}`;
+        const entry = {
+            id: entryId,
+            entryId,
+            agentId: safeAgentKey,
+            sessionId: safeSessionKey,
+            role: params.role || "user",
+            content: String(params.content || ""),
+            timestamp: new Date().toISOString(),
+        };
+        const findings = this.contextPoisoningDetector.scanEntry(entry);
+        // Augment with credential/secret exfiltration detection in memory content
+        if (/(cat|curl|wget)\s+.*(\/etc\/passwd|\.env|id_rsa|AWS_SECRET_ACCESS_KEY)/i.test(entry.content) ||
+            /send\s+(all\s+)?(api\s+keys|secrets|tokens|credentials)\s+to\s+https?:\/\//i.test(entry.content)) {
+            findings.push({
+                entryId: entry.id,
+                patternId: "MEMORY_EXFILTRATION_DIRECTIVE",
+                patternName: "Persistent Memory Credential Exfiltration Directive",
+                severity: "critical",
+                description: "Memory payload attempts to persist credential or file exfiltration instructions across agent runs",
+                matchedText: entry.content.slice(0, 100),
+                timestamp: Date.now(),
+            });
+        }
+        const hasCritical = findings.some((f) => f.severity === "critical");
+        const hasHigh = findings.some((f) => f.severity === "high");
+        const hasMedium = findings.some((f) => f.severity === "medium");
+        const riskLevel = hasCritical
+            ? "critical"
+            : hasHigh
+                ? "high"
+                : hasMedium
+                    ? "medium"
+                    : findings.length > 0
+                        ? "low"
+                        : "none";
+        const safe = !hasCritical && !hasHigh;
+        if (params.recordInDetector !== false && safe) {
+            try {
+                this.contextPoisoningDetector.addEntry(entry);
+            }
+            catch {
+                // Ignore session capacity overflow in long-running processes
+            }
+        }
+        const integrity = this.contextPoisoningDetector.verifyIntegrity(safeAgentKey, safeSessionKey);
+        const integrityValid = typeof integrity === "boolean" ? integrity : Boolean(integrity?.valid ?? true);
+        return {
+            safe,
+            riskLevel,
+            findingsCount: findings.length,
+            findings: findings.map((f) => ({
+                patternId: String(f.patternId || ""),
+                patternName: String(f.patternName || ""),
+                severity: String(f.severity || ""),
+                description: String(f.description || ""),
+            })),
+            integrityValid,
+        };
+    }
+    getContextPoisoningReport(workspaceId, sessionId = "default") {
+        const safeAgentKey = workspaceId.replace(/[^a-zA-Z0-9_-]/g, "_");
+        const safeSessionKey = sessionId.replace(/[^a-zA-Z0-9_-]/g, "_");
+        return this.contextPoisoningDetector.scan(safeAgentKey, safeSessionKey);
+    }
+    /**
+     * Extracts structured SQL, Kubernetes, and Infrastructure protocol facets from tool input.
+     */
+    extractActionFacets(tool, input) {
+        const rawContext = {};
+        // Detect SQL payload in input
+        const candidateSql = typeof input.sql === "string"
+            ? input.sql
+            : typeof input.statement === "string"
+                ? input.statement
+                : typeof input.query === "string" &&
+                    (tool.slug.includes("sql") ||
+                        tool.slug.includes("postgres") ||
+                        tool.slug.includes("neon") ||
+                        tool.slug.includes("turso") ||
+                        tool.slug.includes("supabase") ||
+                        tool.slug.includes("db") ||
+                        /^\s*(SELECT|INSERT|UPDATE|DELETE|DROP|TRUNCATE|ALTER|CREATE|WITH)\b/i.test(input.query))
+                    ? input.query
+                    : null;
+        if (candidateSql) {
+            rawContext.sql = { query: candidateSql };
+        }
+        // Detect Kubernetes payload in input
+        const candidateK8sPath = typeof input.k8s_path === "string"
+            ? input.k8s_path
+            : typeof input.path === "string" &&
+                (input.path.startsWith("/api/v1/") ||
+                    input.path.startsWith("/apis/"))
+                ? input.path
+                : null;
+        if (candidateK8sPath) {
+            rawContext.k8s = {
+                method: typeof input.method === "string" ? input.method : "GET",
+                path: candidateK8sPath,
+            };
+        }
+        else if (input.k8s &&
+            typeof input.k8s === "object" &&
+            !Array.isArray(input.k8s)) {
+            rawContext.k8s = input.k8s;
+        }
+        // Detect Infrastructure / Resource provisioning facets
+        if (tool.lane === "stripe_projects" ||
+            tool.slug.startsWith("resource.") ||
+            tool.riskLevel === "provisioning" ||
+            tool.riskLevel === "destructive") {
+            rawContext.infra = {
+                provider: tool.providerSlug,
+                service: tool.upstreamSlug,
+                action: tool.riskLevel,
+                destructive: tool.riskLevel === "destructive" ||
+                    tool.slug.includes("delete") ||
+                    tool.slug.includes("destroy"),
+            };
+        }
+        const extracted = extractProtocolFacets(rawContext, this.facetRegistry);
+        const result = {};
+        if (extracted.sql) {
+            const sqlVerb = String(extracted.sql.verb || "UNKNOWN").toUpperCase();
+            const isDestructiveSql = sqlVerb === "DROP" ||
+                sqlVerb === "TRUNCATE" ||
+                (sqlVerb === "UNKNOWN" && Boolean(candidateSql?.includes(";"))) ||
+                (sqlVerb === "DELETE" &&
+                    Boolean(candidateSql) &&
+                    !/\bWHERE\b/i.test(candidateSql || ""));
+            result.sql = {
+                verb: sqlVerb,
+                target: String(extracted.sql.target || ""),
+                tables: String(extracted.sql.tables || ""),
+                functions: String(extracted.sql.functions || ""),
+                destructive: isDestructiveSql,
+            };
+        }
+        if (extracted.k8s) {
+            result.k8s = {
+                verb: String(extracted.k8s.verb || ""),
+                resource: String(extracted.k8s.resource || ""),
+                namespace: String(extracted.k8s.namespace || ""),
+                name: String(extracted.k8s.name || ""),
+                subresource: String(extracted.k8s.subresource || ""),
+            };
+        }
+        if (extracted.infra) {
+            result.infra = {
+                provider: String(extracted.infra.provider || tool.providerSlug),
+                service: String(extracted.infra.service || tool.upstreamSlug),
+                action: String(extracted.infra.action || tool.riskLevel),
+                destructive: Boolean(extracted.infra.destructive),
+            };
+        }
+        return result;
+    }
+    /**
+     * Evaluates hardware-style privilege rings (Ring 0..Ring 3) via Microsoft RingEnforcer.
+     */
+    evaluateRingEnforcement(workspace, tool, ownerApproved) {
+        const requiredRing = requiredRingForRisk(tool.riskLevel);
+        const policy = workspace.policy;
+        const requiresApproval = policy.mode === "enforce" &&
+            (policy.requireApprovalFor || []).includes(tool.riskLevel);
+        const agentRing = ownerApproved
+            ? ExecutionRing.Ring0
+            : policy.executionRing !== undefined
+                ? policy.executionRing
+                : requiresApproval
+                    ? ExecutionRing.Ring2
+                    : requiredRing;
+        const enforcer = new RingEnforcer({
+            agentRing,
+            defaultRing: ExecutionRing.Ring3,
+            actionRings: {
+                "read:*": ExecutionRing.Ring3,
+                "write:*": ExecutionRing.Ring2,
+                "admin:*": ExecutionRing.Ring1,
+                "financial:*": ExecutionRing.Ring1,
+                "provisioning:*": ExecutionRing.Ring1,
+                "destructive:*": ExecutionRing.Ring0,
+            },
+        });
+        const actionKey = `${tool.riskLevel}:${tool.slug}`;
+        const allowed = enforcer.canExecute(actionKey);
+        return {
+            agentRing,
+            requiredRing,
+            allowed,
+            ringLabel: RING_LABELS[requiredRing] || `Ring ${requiredRing}`,
+        };
+    }
+    /**
+     * Records an agent execution outcome in the Bayesian TrustManager and returns the updated TrustScore.
+     */
+    recordAgentOutcome(workspaceId, succeeded, weight = 0.05) {
+        if (succeeded) {
+            this.trustManager.recordSuccess(workspaceId, weight);
+        }
+        else {
+            this.trustManager.recordFailure(workspaceId, weight * 2);
+        }
+        return this.trustManager.getTrustScore(workspaceId);
+    }
+    /**
+     * Returns the current Bayesian TrustScore for a workspace agent boundary.
+     */
+    getWorkspaceTrustScore(workspaceId) {
+        const score = this.trustManager.getTrustScore(workspaceId);
+        return {
+            overall: Number(score.overall.toFixed(4)),
+            tier: score.tier,
+            reliability: Number(score.dimensions.reliability.toFixed(4)),
+            consistency: Number(score.dimensions.consistency.toFixed(4)),
+        };
+    }
+    /**
+     * Activates the emergency KillSwitch for a workspace agent boundary.
+     */
+    async activateKillSwitch(workspaceId, reason, action = "quarantine") {
+        const result = await this.killSwitch.kill(workspaceId, {
+            action,
+            reason: reason || "Emergency kill-switch activated by workspace operator",
+        });
+        this.activeKillSwitches.set(workspaceId, result);
+        this.trustManager.recordFailure(workspaceId, 0.25);
+        return result;
+    }
+    /**
+     * Resumes a workspace agent boundary after a KillSwitch quarantine/suspension.
+     */
+    resumeKillSwitch(workspaceId) {
+        const existed = this.activeKillSwitches.delete(workspaceId);
+        return {
+            resumed: existed,
+            workspaceId,
+            resumedAt: new Date().toISOString(),
+        };
+    }
+    isKillSwitchActive(workspaceId) {
+        return this.activeKillSwitches.get(workspaceId) || null;
+    }
     /**
      * Compiles the workspace's GovernancePolicy into a declarative Microsoft PolicyEngine instance.
      */
     createPolicyEngine(policy) {
         const engine = new PolicyEngine();
         const rules = [];
+        if (policy.killSwitchActive) {
+            rules.push({
+                name: "deny-kill-switch-active",
+                ruleAction: "deny",
+                priority: 200,
+                condition: {
+                    workspace_active: true,
+                },
+            });
+        }
         for (const blockedSlug of policy.blockedToolSlugs || []) {
             const normalized = blockedSlug.trim();
             if (!normalized)
@@ -113,6 +424,44 @@ export class MicrosoftGovernanceAdapter {
                 },
             });
         }
+        if (policy.mode === "enforce" && policy.blockDestructiveSql !== false) {
+            rules.push({
+                name: "deny-multi-statement-sql-injection",
+                ruleAction: "deny",
+                priority: 96,
+                condition: {
+                    "sql.verb": "UNKNOWN",
+                    "sql.destructive": true,
+                },
+            });
+            rules.push({
+                name: "require-approval-destructive-sql-drop",
+                ruleAction: "require_approval",
+                priority: 94,
+                condition: {
+                    "sql.verb": "DROP",
+                    owner_approved: false,
+                },
+            });
+            rules.push({
+                name: "require-approval-destructive-sql-truncate",
+                ruleAction: "require_approval",
+                priority: 94,
+                condition: {
+                    "sql.verb": "TRUNCATE",
+                    owner_approved: false,
+                },
+            });
+            rules.push({
+                name: "deny-k8s-delete-kube-system",
+                ruleAction: "deny",
+                priority: 95,
+                condition: {
+                    "k8s.verb": "delete",
+                    "k8s.namespace": "kube-system",
+                },
+            });
+        }
         if (policy.mode === "enforce") {
             for (const risk of policy.requireApprovalFor || []) {
                 rules.push({
@@ -147,24 +496,38 @@ export class MicrosoftGovernanceAdapter {
     }
     /**
      * Runs the full Microsoft Agent Governance pipeline:
-     * Agent ──► McpSecurityScanner ──► PolicyEngine ──► AgentIdentity (Ed25519 DID) ──► AuditLogger ──► DecisionRecord
+     * Agent ──► KillSwitch ──► McpSecurityScanner & ContextPoisoningDetector (ASI-06) ──► ProtocolFacets (SQL/K8s/Infra) ──► RingEnforcer ──► PolicyEngine ──► TrustManager ──► AgentIdentity (Ed25519 DID) ──► AuditLogger ──► DecisionRecord
      */
     evaluateAction(params) {
         const { workspace, actorId, tool, input, reason, stage } = params;
         const ownerApproved = Boolean(params.ownerApproved);
         const decidedAt = new Date().toISOString();
-        // 1. McpSecurityScanner: inspect tool definition + input arguments for prompt injection / exfiltration
+        // 1. McpSecurityScanner + ContextPoisoningDetector (OWASP ASI-06): inspect tool definition + input arguments
         const serializedInput = JSON.stringify(input || {});
         const scanResult = this.scanner.scan({
             name: tool.slug,
             description: `${tool.description}\nReason: ${reason}\nArgs: ${serializedInput}`,
             parameters: tool.inputSchema,
         });
-        const extraFindings = (scanResult.threats || []).map((t) => ({
-            category: String(t.type || "mcp_scan"),
-            severity: String(t.severity || "medium"),
-            description: String(t.description || "Security scanner finding"),
-        }));
+        const contextPoisoning = this.scanMemoryContent({
+            workspaceId: workspace.id,
+            sessionId: stage,
+            role: "user",
+            content: `${reason}\n${serializedInput}`,
+            recordInDetector: false,
+        });
+        const extraFindings = [
+            ...(scanResult.threats || []).map((t) => ({
+                category: String(t.type || "mcp_scan"),
+                severity: String(t.severity || "medium"),
+                description: String(t.description || "Security scanner finding"),
+            })),
+            ...contextPoisoning.findings.map((f) => ({
+                category: `asi06_${f.patternId.toLowerCase()}`,
+                severity: f.severity,
+                description: `${f.patternName}: ${f.description}`,
+            })),
+        ];
         // Additional argument-level prompt-injection / secret-exfiltration heuristics
         const suspiciousPatterns = [
             {
@@ -190,8 +553,15 @@ export class MicrosoftGovernanceAdapter {
             }
         }
         const highSeverityFinding = extraFindings.some((f) => f.severity === "high" || f.severity === "critical");
-        // 2. PolicyEngine: evaluate declarative rules against tool slug, risk level, and approval state
+        // 2. Protocol Facets Extraction (SQL, Kubernetes, Infrastructure)
+        const protocolFacets = this.extractActionFacets(tool, input);
+        // 3. Hardware-style Execution Ring Enforcement (Ring 0..Ring 3)
+        const ringEnforcement = this.evaluateRingEnforcement(workspace, tool, ownerApproved);
+        // 4. PolicyEngine + KillSwitch evaluation
         const policy = workspace.policy;
+        const activeKill = this.isKillSwitchActive(workspace.id);
+        const killSwitchActive = Boolean(activeKill || policy.killSwitchActive);
+        const killSwitchReason = activeKill?.reason || policy.killSwitchReason || null;
         const policyEngine = this.createPolicyEngine(policy);
         const identity = this.getWorkspaceIdentity(workspace);
         const policyDecision = policyEngine.evaluatePolicy(identity.did, {
@@ -201,18 +571,36 @@ export class MicrosoftGovernanceAdapter {
             stage,
             owner_approved: ownerApproved,
             workspace_active: true,
+            ...(protocolFacets.sql ? { sql: protocolFacets.sql } : {}),
+            ...(protocolFacets.k8s ? { k8s: protocolFacets.k8s } : {}),
+            ...(protocolFacets.infra ? { infra: protocolFacets.infra } : {}),
         });
         let finalDecision = policyDecision.action === "deny"
             ? "deny"
             : policyDecision.action === "require_approval"
                 ? "require_approval"
                 : "allow";
-        // Block explicitly blocked tools even in monitor mode, or high-severity injection findings in enforce mode
-        if ((policy.blockedToolSlugs || []).includes(tool.slug) ||
-            (highSeverityFinding && policy.mode === "enforce")) {
+        let matchedRule = policyDecision.matchedRule ?? null;
+        // Enforce KillSwitch, blocked tools, high-severity scanner/context-poisoning findings, or Ring breach
+        if (killSwitchActive) {
+            finalDecision = "deny";
+            matchedRule = "kill-switch-emergency-quarantine";
+        }
+        else if ((policy.blockedToolSlugs || []).includes(tool.slug)) {
             finalDecision = "deny";
+            matchedRule = matchedRule || `deny-blocked-tool-${tool.slug}`;
+        }
+        else if (highSeverityFinding && policy.mode === "enforce") {
+            finalDecision = "deny";
+            matchedRule = "mcp-security-scanner-high-severity";
+            this.trustManager.recordFailure(workspace.id, 0.1);
+        }
+        else if (!ringEnforcement.allowed && finalDecision === "allow" && policy.mode === "enforce") {
+            finalDecision = "require_approval";
+            matchedRule = `ring-enforcer-requires-ring-${ringEnforcement.requiredRing}`;
         }
-        // 3. AuditLogger: append tamper-evident SHA-256 hash-chained log entry
+        const trustScore = this.getWorkspaceTrustScore(workspace.id);
+        // 5. AuditLogger: append tamper-evident SHA-256 hash-chained log entry
         const auditLogger = this.getWorkspaceAuditLogger(workspace.id);
         const auditDecision = finalDecision === "deny" ? "deny" : "allow";
         const auditEntry = auditLogger.log({
@@ -222,11 +610,13 @@ export class MicrosoftGovernanceAdapter {
             skillAuditMetadata: {
                 skillName: tool.slug,
                 skillOrigin: tool.lane,
-                provenanceSourceTrust: "trusted",
+                provenanceSourceTrust: trustScore.tier === "Verified" || trustScore.tier === "Trusted"
+                    ? "trusted"
+                    : undefined,
             },
         });
         const chainVerified = auditLogger.verify();
-        // 4. AgentIdentity (Ed25519 DID): cryptographically sign the decision record
+        // 6. AgentIdentity (Ed25519 DID): cryptographically sign the decision record
         const bindingHash = crypto
             .createHash("sha256")
             .update(JSON.stringify({
@@ -259,12 +649,14 @@ export class MicrosoftGovernanceAdapter {
         const publicKeyHex = Buffer.from(identity.publicKey).toString("hex");
         const verdict = finalDecision === "require_approval" ? "escalate" : finalDecision;
         const decisionReason = finalDecision === "deny"
-            ? highSeverityFinding
-                ? `Blocked by McpSecurityScanner: ${extraFindings.map((f) => f.description).join("; ")}`
-                : `Denied by policy rule ${policyDecision.matchedRule || "default"}`
+            ? killSwitchActive
+                ? `Blocked by Emergency KillSwitch: ${killSwitchReason || "Workspace agent boundary is quarantined"}`
+                : highSeverityFinding
+                    ? `Blocked by McpSecurityScanner / ContextPoisoningDetector: ${extraFindings.map((f) => f.description).join("; ")}`
+                    : `Denied by policy rule ${matchedRule || "default"}`
             : finalDecision === "require_approval"
-                ? `Escalated for human owner approval (${tool.riskLevel} risk lane)`
-                : `Allowed by Microsoft Agent Governance (${policyDecision.matchedRule || "allow-governed-action"})`;
+                ? `Escalated for human owner approval (${tool.riskLevel} risk lane, ${ringEnforcement.ringLabel})`
+                : `Allowed by Microsoft Agent Governance (${matchedRule || "allow-governed-action"})`;
         return {
             id: `dec_${crypto.randomBytes(8).toString("hex")}`,
             sdk: "@microsoft/agent-governance-sdk",
@@ -280,12 +672,12 @@ export class MicrosoftGovernanceAdapter {
             decision: finalDecision,
             verdict,
             reason: decisionReason,
-            matchedRule: policyDecision.matchedRule ?? null,
+            matchedRule,
             securityScan: {
-                safe: scanResult.safe && !highSeverityFinding,
+                safe: scanResult.safe && !highSeverityFinding && contextPoisoning.safe,
                 riskLevel: highSeverityFinding
                     ? "high"
-                    : scanResult.risk_score > 50
+                    : scanResult.risk_score > 50 || contextPoisoning.findingsCount > 0
                         ? "medium"
                         : "low",
                 findingsCount: extraFindings.length,
@@ -300,6 +692,20 @@ export class MicrosoftGovernanceAdapter {
                 previousHash: auditEntry.previousHash,
                 chainVerified,
             },
+            protocolFacets,
+            ringEnforcement,
+            trustScore,
+            contextPoisoning: {
+                safe: contextPoisoning.safe,
+                riskLevel: contextPoisoning.riskLevel,
+                findingsCount: contextPoisoning.findingsCount,
+                findings: contextPoisoning.findings,
+            },
+            killSwitch: {
+                active: killSwitchActive,
+                killedAt: activeKill?.killedAt || null,
+                reason: killSwitchReason,
+            },
             ed25519Signature,
             signature: ed25519Signature,
             bindingHash,
@@ -398,13 +804,41 @@ export class MicrosoftGovernanceAdapter {
         const identity = this.getWorkspaceIdentity(workspace);
         const auditLogger = this.getWorkspaceAuditLogger(workspace.id);
         const entries = auditLogger.getEntries();
+        const activeKill = this.isKillSwitchActive(workspace.id);
+        const killSwitchActive = Boolean(activeKill || workspace.policy.killSwitchActive);
+        const contextPoisoningReport = this.getContextPoisoningReport(workspace.id, "default");
         return {
             sdk: "@microsoft/agent-governance-sdk",
             sdkVersion: SDK_VERSION,
             policyId: POLICY_ID,
-            pipeline: "Agent ──► McpSecurityScanner ──► PolicyEngine ──► AgentIdentity (Ed25519 DID) ──► AuditLogger ──► DecisionRecord",
+            pipeline: "Agent ──► KillSwitch ──► McpSecurityScanner & ContextPoisoningDetector (ASI-06) ──► ProtocolFacets (SQL/K8s/Infra) ──► RingEnforcer ──► PolicyEngine ──► TrustManager ──► AgentIdentity (Ed25519 DID) ──► AuditLogger ──► DecisionRecord",
+            modules: [
+                "McpSecurityScanner",
+                "ContextPoisoningDetector",
+                "ProtocolFacets",
+                "RingEnforcer",
+                "PolicyEngine",
+                "TrustManager",
+                "KillSwitch",
+                "AgentIdentity",
+                "AuditLogger",
+            ],
             agentIdentity: identity.toJSON(),
             policy: workspace.policy,
+            trustScore: this.getWorkspaceTrustScore(workspace.id),
+            killSwitch: {
+                active: killSwitchActive,
+                killedAt: activeKill?.killedAt || null,
+                reason: activeKill?.reason || workspace.policy.killSwitchReason || null,
+                historyCount: this.killSwitch.getHistory().length,
+            },
+            contextPoisoning: {
+                poisoned: Boolean(contextPoisoningReport.poisoned ??
+                    (contextPoisoningReport.findings?.length > 0)),
+                riskScore: Number(contextPoisoningReport.riskScore ?? 0),
+                findingsCount: contextPoisoningReport.findings.length,
+                findings: contextPoisoningReport.findings.slice(-10),
+            },
             auditChain: {
                 entriesCount: entries.length,
                 chainVerified: auditLogger.verify(),

package/dist/providers/stripe-projects.d.ts

@@ -1,5 +1,6 @@
 import { type MuxoConfig } from "../config.js";
 import type { MuxoTool } from "../types.js";
+export declare function isPaidCloudProvisioning(tool: MuxoTool, input?: Record<string, unknown>): boolean;
 export declare class StripeProjectsAdapter {
     private readonly config;
     private readonly tools;
@@ -32,11 +33,13 @@ export declare class StripeProjectsAdapter {
         redirectUrl: string | null;
         message: string;
     }>;
-    pullEnvVarsFromWorkdir(): Promise<Record<string, string>>;
+    pullEnvVarsFromWorkdir(syncFromCli?: boolean): Promise<Record<string, string>>;
     executeTool(params: {
         workspaceId: string;
         tool: MuxoTool;
         input: Record<string, unknown>;
+        stripeApiKey?: string | null;
+        masterWalletDepleted?: boolean;
     }): Promise<{
         output: Record<string, unknown>;
         provisionedResource?: {