@saulwade/swl-ses 2.6.0 → 2.8.0

package/schemas/legacy-gates.schema.json

@@ -0,0 +1,45 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://swl-ses.dev/schemas/legacy-gates.schema.json",
+  "title": "Manifiesto firmado de migración de gates legacy",
+  "$comment": "El runtime también exige NFC y texto sin controles; evidenceDigests ordenados; phaseId ligado a ambos paths y al flag CLI; createdAt, issuedAt y expiresAt no posteriores al cutoff; issuedAt < expiresAt y vigencia al tiempo confiable.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "kind", "schemaVersion", "capability", "migrationId", "phaseId",
+    "planPath", "contextPath", "planDigest", "contextDigest", "createdAt",
+    "reason", "evidenceDigests", "cutoff", "issuedAt", "expiresAt", "nonce"
+  ],
+  "properties": {
+    "kind": { "const": "legacy-gate-migration" },
+    "schemaVersion": { "const": "1.0.0" },
+    "capability": { "const": "migrate_legacy_gate" },
+    "migrationId": { "$ref": "#/$defs/identifier" },
+    "phaseId": { "type": "string", "pattern": "^0[1-8]$" },
+    "planPath": { "type": "string", "pattern": "^\\.planning/fases/0[1-8]-PLAN\\.md$" },
+    "contextPath": { "type": "string", "pattern": "^\\.planning/fases/0[1-8]-CONTEXTO\\.md$" },
+    "planDigest": { "$ref": "#/$defs/sha256" },
+    "contextDigest": { "$ref": "#/$defs/sha256" },
+    "createdAt": { "$ref": "#/$defs/timestamp" },
+    "reason": { "type": "string", "minLength": 1, "maxLength": 512 },
+    "evidenceDigests": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 64,
+      "uniqueItems": true,
+      "items": { "$ref": "#/$defs/sha256" }
+    },
+    "cutoff": { "const": "2027-01-15T00:00:00.000Z" },
+    "issuedAt": { "$ref": "#/$defs/timestamp" },
+    "expiresAt": { "$ref": "#/$defs/timestamp" },
+    "nonce": { "$ref": "#/$defs/identifier" }
+  },
+  "$defs": {
+    "identifier": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$"
+    },
+    "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "timestamp": { "type": "string", "format": "date-time" }
+  }
+}

package/schemas/modulos.schema.json

@@ -1,38 +1,38 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://swl-ses.dev/schemas/modulos.json",
-  "$schemaVersion": "1.0.0",
-  "title": "SWL Modulos",
-  "description": "Schema para modulos.json del sistema SWL",
-  "type": "object",
-  "required": [
-    "version",
-    "modulos"
-  ],
-  "properties": {
-    "version": {
-      "type": "string"
-    },
-    "modulos": {
-      "type": "object",
-      "additionalProperties": {
-        "type": "object",
-        "required": [
-          "descripcion",
-          "componentes"
-        ],
-        "properties": {
-          "descripcion": {
-            "type": "string"
-          },
-          "componentes": {
-            "type": "array",
-            "items": {
-              "type": "string"
-            }
-          }
-        }
-      }
-    }
-  }
-}
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://swl-ses.dev/schemas/modulos.json",
+  "$schemaVersion": "1.0.0",
+  "title": "SWL Modulos",
+  "description": "Schema para modulos.json del sistema SWL",
+  "type": "object",
+  "required": [
+    "version",
+    "modulos"
+  ],
+  "properties": {
+    "version": {
+      "type": "string"
+    },
+    "modulos": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "object",
+        "required": [
+          "descripcion",
+          "componentes"
+        ],
+        "properties": {
+          "descripcion": {
+            "type": "string"
+          },
+          "componentes": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/schemas/perfiles.schema.json

@@ -1,36 +1,36 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://swl-ses.dev/schemas/perfiles.json",
-  "$schemaVersion": "1.0.0",
-  "title": "SWL Perfiles de Instalacion",
-  "description": "Schema para perfiles.json del sistema SWL",
-  "type": "object",
-  "required": [
-    "perfiles"
-  ],
-  "properties": {
-    "perfiles": {
-      "type": "object",
-      "additionalProperties": {
-        "type": "object",
-        "required": [
-          "descripcion",
-          "modulos"
-        ],
-        "properties": {
-          "descripcion": {
-            "type": "string",
-            "minLength": 10
-          },
-          "modulos": {
-            "type": "array",
-            "items": {
-              "type": "string"
-            },
-            "minItems": 1
-          }
-        }
-      }
-    }
-  }
-}
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://swl-ses.dev/schemas/perfiles.json",
+  "$schemaVersion": "1.0.0",
+  "title": "SWL Perfiles de Instalacion",
+  "description": "Schema para perfiles.json del sistema SWL",
+  "type": "object",
+  "required": [
+    "perfiles"
+  ],
+  "properties": {
+    "perfiles": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "object",
+        "required": [
+          "descripcion",
+          "modulos"
+        ],
+        "properties": {
+          "descripcion": {
+            "type": "string",
+            "minLength": 10
+          },
+          "modulos": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "minItems": 1
+          }
+        }
+      }
+    }
+  }
+}

package/schemas/plugin.schema.json

@@ -1,77 +1,77 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://swl-ses.dev/schemas/plugin.json",
-  "$schemaVersion": "1.0.0",
-  "title": "SWL Plugin Manifest",
-  "description": "Schema para plugin.json de plugins SWL instalables en _userland/",
-  "type": "object",
-  "required": [
-    "name",
-    "version",
-    "description"
-  ],
-  "properties": {
-    "name": {
-      "type": "string",
-      "pattern": "^[a-z][a-z0-9-]+$",
-      "maxLength": 64,
-      "description": "Nombre en kebab-case, sin prefijo reservado anthropic/claude/swl"
-    },
-    "version": {
-      "type": "string",
-      "pattern": "^\\d+\\.\\d+\\.\\d+$",
-      "description": "Version semantica del plugin (SemVer)"
-    },
-    "description": {
-      "type": "string",
-      "minLength": 10,
-      "maxLength": 500,
-      "description": "Descripcion del plugin: que hace y cuando usarlo"
-    },
-    "author": {
-      "type": "string",
-      "description": "Nombre o email del autor del plugin"
-    },
-    "license": {
-      "type": "string",
-      "description": "Licencia SPDX (ej: MIT, Apache-2.0, proprietary)"
-    },
-    "agents": {
-      "type": "array",
-      "items": {
-        "type": "string"
-      },
-      "description": "Rutas relativas a archivos de agentes (.md con frontmatter YAML)"
-    },
-    "skills": {
-      "type": "array",
-      "items": {
-        "type": "string"
-      },
-      "description": "Rutas relativas a directorios de skills (cada uno con SKILL.md)"
-    },
-    "rules": {
-      "type": "array",
-      "items": {
-        "type": "string"
-      },
-      "description": "Rutas relativas a archivos de reglas (.md)"
-    },
-    "hooks": {
-      "type": "array",
-      "items": {
-        "type": "string"
-      },
-      "description": "Rutas relativas a archivos de hooks (.js)"
-    },
-    "dependencies": {
-      "type": "object",
-      "description": "Dependencias de otros plugins: { nombre: version-semver }",
-      "additionalProperties": {
-        "type": "string",
-        "pattern": "^\\d+\\.\\d+\\.\\d+$"
-      }
-    }
-  },
-  "additionalProperties": false
-}
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://swl-ses.dev/schemas/plugin.json",
+  "$schemaVersion": "1.0.0",
+  "title": "SWL Plugin Manifest",
+  "description": "Schema para plugin.json de plugins SWL instalables en _userland/",
+  "type": "object",
+  "required": [
+    "name",
+    "version",
+    "description"
+  ],
+  "properties": {
+    "name": {
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9-]+$",
+      "maxLength": 64,
+      "description": "Nombre en kebab-case, sin prefijo reservado anthropic/claude/swl"
+    },
+    "version": {
+      "type": "string",
+      "pattern": "^\\d+\\.\\d+\\.\\d+$",
+      "description": "Version semantica del plugin (SemVer)"
+    },
+    "description": {
+      "type": "string",
+      "minLength": 10,
+      "maxLength": 500,
+      "description": "Descripcion del plugin: que hace y cuando usarlo"
+    },
+    "author": {
+      "type": "string",
+      "description": "Nombre o email del autor del plugin"
+    },
+    "license": {
+      "type": "string",
+      "description": "Licencia SPDX (ej: MIT, Apache-2.0, proprietary)"
+    },
+    "agents": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "Rutas relativas a archivos de agentes (.md con frontmatter YAML)"
+    },
+    "skills": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "Rutas relativas a directorios de skills (cada uno con SKILL.md)"
+    },
+    "rules": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "Rutas relativas a archivos de reglas (.md)"
+    },
+    "hooks": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "Rutas relativas a archivos de hooks (.js)"
+    },
+    "dependencies": {
+      "type": "object",
+      "description": "Dependencias de otros plugins: { nombre: version-semver }",
+      "additionalProperties": {
+        "type": "string",
+        "pattern": "^\\d+\\.\\d+\\.\\d+$"
+      }
+    }
+  },
+  "additionalProperties": false
+}

package/schemas/policy-bundle.schema.json

@@ -0,0 +1,140 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://swl-ses.dev/schemas/policy-bundle.schema.json",
+  "title": "SWL PolicyBundle v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["kind", "schemaVersion", "policyVersion", "corpusDigest", "globalPolicy", "policies"],
+  "properties": {
+    "kind": { "const": "policy-bundle" },
+    "schemaVersion": { "const": "1.0.0" },
+    "policyVersion": { "const": "3.0.0" },
+    "corpusDigest": { "$ref": "#/$defs/sha256" },
+    "globalPolicy": { "$ref": "#/$defs/globalPolicy" },
+    "policies": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/policy" }
+    }
+  },
+  "$defs": {
+    "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "capability": {
+      "enum": [
+        "delegate",
+        "filesystem.mutate",
+        "filesystem.read",
+        "memory.read",
+        "memory.write",
+        "network.access",
+        "shell.exec",
+        "skill.invoke"
+      ]
+    },
+    "toolBudget": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["simple", "standard", "complex"],
+      "properties": {
+        "simple": { "type": "integer", "minimum": 1 },
+        "standard": { "type": "integer", "minimum": 1 },
+        "complex": { "type": "integer", "minimum": 1 }
+      }
+    },
+    "riskThresholds": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["allow", "review", "confirm"],
+      "properties": {
+        "allow": { "type": "number", "minimum": 0, "maximum": 1 },
+        "review": { "type": "number", "minimum": 0, "maximum": 1 },
+        "confirm": { "type": "number", "minimum": 0, "maximum": 1 }
+      }
+    },
+    "costBudget": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["maxUsd", "maxTokens", "alertAt"],
+      "properties": {
+        "maxUsd": { "type": "number", "minimum": 0 },
+        "maxTokens": { "type": "integer", "minimum": 0 },
+        "alertAt": { "type": "number", "minimum": 0, "maximum": 1 }
+      }
+    },
+    "circuitBreaker": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["maxConsecutiveFailures", "halfOpenCooldownMs", "auditThreshold"],
+      "properties": {
+        "maxConsecutiveFailures": { "type": "integer", "minimum": 1 },
+        "halfOpenCooldownMs": { "type": "integer", "minimum": 1 },
+        "auditThreshold": { "type": "integer", "minimum": 1 }
+      }
+    },
+    "globalPolicy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["riskThresholds", "costBudget", "circuitBreaker", "defaultMaxTurns", "defaultToolBudget"],
+      "properties": {
+        "riskThresholds": { "$ref": "#/$defs/riskThresholds" },
+        "costBudget": { "$ref": "#/$defs/costBudget" },
+        "circuitBreaker": { "$ref": "#/$defs/circuitBreaker" },
+        "defaultMaxTurns": { "type": "integer", "minimum": 1 },
+        "defaultToolBudget": { "$ref": "#/$defs/toolBudget" }
+      }
+    },
+    "policy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "nodeId",
+        "kind",
+        "sourceDigest",
+        "disposition",
+        "reasonCodes",
+        "declaredCapabilities",
+        "allowedCapabilities",
+        "filesystemMutationAllowed",
+        "networkAllowed",
+        "shellAllowed",
+        "allowedSkillNodeIds",
+        "deniedSkillNodeIds",
+        "risk",
+        "maxTurns",
+        "toolBudget"
+      ],
+      "properties": {
+        "nodeId": { "type": "string", "pattern": "^agent:[a-f0-9]{64}$" },
+        "kind": { "const": "agent" },
+        "sourceDigest": { "$ref": "#/$defs/sha256" },
+        "disposition": { "enum": ["allow", "deny"] },
+        "reasonCodes": {
+          "type": "array",
+          "items": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]+$" }
+        },
+        "declaredCapabilities": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/capability" }
+        },
+        "allowedCapabilities": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/capability" }
+        },
+        "filesystemMutationAllowed": { "type": "boolean" },
+        "networkAllowed": { "type": "boolean" },
+        "shellAllowed": { "type": "boolean" },
+        "allowedSkillNodeIds": {
+          "type": "array",
+          "items": { "type": "string", "pattern": "^skill:[a-f0-9]{64}$" }
+        },
+        "deniedSkillNodeIds": {
+          "type": "array",
+          "items": { "type": "string", "pattern": "^skill:[a-f0-9]{64}$" }
+        },
+        "risk": { "enum": ["low", "medium", "high"] },
+        "maxTurns": { "type": "integer", "minimum": 1 },
+        "toolBudget": { "$ref": "#/$defs/toolBudget" }
+      }
+    }
+  }
+}

package/schemas/policy-enforcement.schema.json

@@ -0,0 +1,117 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://swl-ses.dev/schemas/policy-enforcement.schema.json",
+  "title": "SWL Policy Enforcement Decision",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "kind", "schemaVersion", "decisionId", "outcome", "reasonCodes",
+    "decisionDigest", "evidenceDigest", "expiresAt", "sequence", "headHash",
+    "operationDigest", "contextDigest", "gateAuthorizationDigest",
+    "approvalDigest", "grantDigest", "timestamp", "authorizationGrant"
+  ],
+  "properties": {
+    "kind": { "const": "policy-enforcement-decision" },
+    "schemaVersion": { "const": "1.0.0" },
+    "decisionId": { "$ref": "#/$defs/identifier" },
+    "outcome": { "enum": ["allow", "deny", "require_approval"] },
+    "reasonCodes": {
+      "type": "array", "minItems": 1, "uniqueItems": true,
+      "items": {
+        "enum": [
+          "ALLOWED", "APPROVAL_ACCEPTED", "APPROVAL_INVALID", "APPROVAL_REQUIRED",
+          "APPROVAL_STALE", "APPROVAL_USED", "CAPABILITY_DENIED", "CONTEXT_INVALID",
+          "CONTEXT_MISMATCH", "DELEGATION_DENIED", "GATE_NOT_SATISFIED",
+          "GATE_PHASE_UNKNOWN", "GATE_VERSION_MISMATCH", "OPERATION_INVALID",
+          "OPERATION_SCOPE_UNVERIFIABLE", "PATH_OUTSIDE_WORKSPACE", "PATH_UNSAFE",
+          "POLICY_DRIFT", "SHELL_OPAQUE", "SKILL_DENIED", "TRUST_INVALID"
+        ]
+      }
+    },
+    "decisionDigest": { "$ref": "#/$defs/sha256" },
+    "evidenceDigest": { "oneOf": [{ "$ref": "#/$defs/sha256" }, { "type": "null" }] },
+    "operationDigest": { "oneOf": [{ "$ref": "#/$defs/sha256" }, { "type": "null" }] },
+    "contextDigest": { "oneOf": [{ "$ref": "#/$defs/sha256" }, { "type": "null" }] },
+    "gateAuthorizationDigest": { "oneOf": [{ "$ref": "#/$defs/sha256" }, { "type": "null" }] },
+    "approvalDigest": { "oneOf": [{ "$ref": "#/$defs/sha256" }, { "type": "null" }] },
+    "grantDigest": { "oneOf": [{ "$ref": "#/$defs/sha256" }, { "type": "null" }] },
+    "timestamp": { "type": "string", "format": "date-time" },
+    "expiresAt": { "type": "string", "format": "date-time" },
+    "sequence": { "type": "integer", "minimum": 1 },
+    "headHash": { "$ref": "#/$defs/sha256" },
+    "authorizationGrant": {
+      "oneOf": [
+        { "type": "null" },
+        {
+          "type": "object", "additionalProperties": false,
+          "required": [
+            "kind", "schemaVersion", "grantId", "approvalDigest", "principalDigest",
+            "operationDigest", "capability", "effectKind", "scopeDigest", "planDigest",
+            "fsmVersion", "issuedAt", "expiresAt", "trustEpoch", "trustDigest",
+            "rootKeyDigest", "status", "phaseId", "taskId",
+            "grantDigest"
+          ],
+          "properties": {
+            "kind": { "const": "authorization-grant" },
+            "schemaVersion": { "enum": ["1.1.0", "1.2.0"] },
+            "grantId": { "$ref": "#/$defs/identifier" },
+            "approvalDigest": { "$ref": "#/$defs/sha256" },
+            "principalDigest": { "$ref": "#/$defs/sha256" },
+            "operationDigest": { "$ref": "#/$defs/sha256" },
+            "capability": { "$ref": "#/$defs/capability" },
+            "effectKind": {
+              "enum": ["access", "delegate", "execute", "invoke", "mutate", "read"]
+            },
+            "scopeDigest": { "$ref": "#/$defs/sha256" },
+            "planDigest": { "$ref": "#/$defs/sha256" },
+            "fsmVersion": { "type": "integer", "minimum": 0 },
+            "issuedAt": { "type": "string", "format": "date-time" },
+            "expiresAt": { "type": "string", "format": "date-time" },
+            "trustEpoch": { "type": "integer", "minimum": 0 },
+            "trustDigest": { "$ref": "#/$defs/sha256" },
+            "rootKeyDigest": { "$ref": "#/$defs/sha256" },
+            "grantDigest": { "$ref": "#/$defs/sha256" },
+            "status": { "const": "issued" },
+            "phaseId": { "$ref": "#/$defs/identifier" },
+            "taskId": { "type": "string", "pattern": "^T-[0-9]{2}$" },
+            "g1ApprovalDigest": { "$ref": "#/$defs/sha256" }
+          },
+          "allOf": [
+            {
+              "if": { "properties": { "schemaVersion": { "const": "1.2.0" } } },
+              "then": { "required": ["g1ApprovalDigest"] },
+              "else": { "not": { "required": ["g1ApprovalDigest"] } }
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "outcome": { "const": "allow" } } },
+      "then": {
+        "properties": {
+          "grantDigest": { "$ref": "#/$defs/sha256" },
+          "authorizationGrant": { "type": "object" }
+        }
+      },
+      "else": {
+        "properties": {
+          "grantDigest": { "type": "null" },
+          "authorizationGrant": { "type": "null" }
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "identifier": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$" },
+    "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "capability": {
+      "enum": [
+        "delegate", "filesystem.mutate", "filesystem.read", "memory.read",
+        "memory.write", "network.access", "shell.exec", "skill.invoke"
+      ]
+    }
+  }
+}