@saulwade/swl-ses 2.6.1 → 2.8.0

package/scripts/lib/policy-bundle.js

@@ -0,0 +1,342 @@
+'use strict';
+
+/**
+ * Proyecta las declaraciones legacy del harness a una política cerrada y opaca.
+ * El manifiesto generado nunca es fuente de autoridad.
+ */
+
+const crypto = require('node:crypto');
+
+const SCHEMA = require('../../schemas/policy-bundle.schema.json');
+const { capturarHarnessSourceSnapshot } = require('./harness-source-snapshot');
+const { CENTINELA_TODOS, SKILLS_EXTERNAS_SET } = require('./skills-externas');
+
+const BUNDLES_VERIFICADOS = new WeakSet();
+const BUNDLE_KIND = SCHEMA.properties.kind.const;
+const SCHEMA_VERSION = SCHEMA.properties.schemaVersion.const;
+const POLICY_VERSION = SCHEMA.properties.policyVersion.const;
+const DEFAULT_MAX_TURNS = 8;
+const DEFAULT_TOOL_BUDGET = Object.freeze({ simple: 2, standard: 4, complex: 8 });
+const RISK_MAP = Object.freeze({ ALTO: 'high', BAJO: 'low', MEDIO: 'medium' });
+const TOOL_MAP = Object.freeze({
+  Agent: 'delegate',
+  Bash: 'shell.exec',
+  Edit: 'filesystem.mutate',
+  Glob: 'filesystem.read',
+  Grep: 'filesystem.read',
+  MultiEdit: 'filesystem.mutate',
+  Read: 'filesystem.read',
+  Skill: 'skill.invoke',
+  Task: 'delegate',
+  WebFetch: 'network.access',
+  WebSearch: 'network.access',
+  Write: 'filesystem.mutate',
+});
+const CAPABILITIES = new Set(SCHEMA.$defs.capability.enum);
+const CAMPOS_AGENTE = new Set([
+  'color', 'description', 'dominio', 'evolvable', 'evolvable_scope', 'exclusiones',
+  'fase', 'fragmentos', 'hardGuardrails', 'healthMetrics', 'invariantes', 'maxTurnos',
+  'model', 'modeloAlterno', 'name', 'nivelRiesgo', 'permisosComandos',
+  'permisosEscritura', 'permisosRed', 'permissionMode', 'skillsInvocables',
+  'skillsRestringidos', 'steering', 'strategy', 'toolBudget', 'tools',
+  'ventanaContexto', 'version',
+]);
+const RESTRICCIONES_LEGACY = new Set([
+  'angular-component', 'angular-forms', 'angular-signals', 'auth-implementation-patterns',
+  'dataverse-python-production-code', 'django-expert', 'fastapi-python',
+  'frontend-css-swl', 'postgresql-schema-design', 'postgresql-table-design',
+  'python-patterns', 'python-testing-patterns', 'react-native-best-practices',
+  'vercel-react-best-practices',
+]);
+
+function crearError(codigo, mensaje, extras = {}) {
+  const excepcion = new Error(mensaje);
+  Object.assign(excepcion, { codigo, ...extras });
+  return excepcion;
+}
+
+function sha256(valor) {
+  return crypto.createHash('sha256').update(valor).digest('hex');
+}
+
+function congelarProfundo(valor) {
+  if (!valor || typeof valor !== 'object' || Object.isFrozen(valor)) return valor;
+  Object.values(valor).forEach(congelarProfundo);
+  return Object.freeze(valor);
+}
+
+function esObjetoPlano(valor) {
+  if (!valor || typeof valor !== 'object' || Array.isArray(valor)) return false;
+  return Object.getPrototypeOf(valor) === Object.prototype;
+}
+
+function validarClaves(valor, requeridas, opcionales = []) {
+  if (!esObjetoPlano(valor)) return false;
+  const permitidas = new Set([...requeridas, ...opcionales]);
+  return requeridas.every((clave) => Object.hasOwn(valor, clave))
+    && Object.keys(valor).every((clave) => permitidas.has(clave));
+}
+
+function validarNumero(valor, minimo, maximo = Number.POSITIVE_INFINITY) {
+  return typeof valor === 'number' && Number.isFinite(valor) && valor >= minimo && valor <= maximo;
+}
+
+function validarToolBudget(valor) {
+  if (!validarClaves(valor, ['simple', 'standard', 'complex'])) return false;
+  const enteros = Object.values(valor).every((item) => Number.isInteger(item) && item > 0);
+  return enteros && valor.simple <= valor.standard && valor.standard <= valor.complex;
+}
+
+function validarGlobalPolicy(valor) {
+  if (!validarClaves(valor, [
+    'riskThresholds', 'costBudget', 'circuitBreaker', 'defaultMaxTurns', 'defaultToolBudget',
+  ])) return false;
+  const { riskThresholds: risk, costBudget: cost, circuitBreaker: breaker } = valor;
+  const riskOk = validarClaves(risk, ['allow', 'review', 'confirm'])
+    && Object.values(risk).every((item) => validarNumero(item, 0, 1))
+    && risk.allow < risk.review && risk.review < risk.confirm;
+  const costOk = validarClaves(cost, ['maxUsd', 'maxTokens', 'alertAt'])
+    && validarNumero(cost.maxUsd, 0) && Number.isInteger(cost.maxTokens)
+    && cost.maxTokens >= 0 && validarNumero(cost.alertAt, 0, 1);
+  const breakerOk = validarClaves(
+    breaker,
+    ['maxConsecutiveFailures', 'halfOpenCooldownMs', 'auditThreshold']
+  ) && Object.values(breaker).every((item) => Number.isInteger(item) && item > 0);
+  return riskOk && costOk && breakerOk && Number.isInteger(valor.defaultMaxTurns)
+    && valor.defaultMaxTurns > 0 && validarToolBudget(valor.defaultToolBudget);
+}
+
+function construirGlobalPolicy(config) {
+  const valor = {
+    riskThresholds: { ...config.riskThresholds },
+    costBudget: { ...config.costBudget },
+    circuitBreaker: { ...config.circuitBreaker },
+    defaultMaxTurns: DEFAULT_MAX_TURNS,
+    defaultToolBudget: { ...DEFAULT_TOOL_BUDGET },
+  };
+  if (!validarGlobalPolicy(valor)) {
+    throw crearError('POLICY_SOURCE_INVALID', 'Política global inválida');
+  }
+  return valor;
+}
+
+function validarCamposAgente(valor) {
+  if (!esObjetoPlano(valor) || Object.keys(valor).some((clave) => !CAMPOS_AGENTE.has(clave))) {
+    throw crearError('POLICY_SOURCE_INVALID', 'Campo de agente sin mapping total');
+  }
+  const requeridos = ['tools', 'nivelRiesgo', 'permisosRed', 'permisosEscritura', 'permisosComandos'];
+  const tiposValidos = Array.isArray(valor.tools)
+    && valor.tools.every((tool) => typeof tool === 'string')
+    && requeridos.slice(2).every((clave) => typeof valor[clave] === 'boolean')
+    && typeof valor.nivelRiesgo === 'string';
+  if (!requeridos.every((clave) => Object.hasOwn(valor, clave)) || !tiposValidos) {
+    throw crearError('POLICY_SOURCE_INVALID', 'Tipos de agente inválidos');
+  }
+}
+
+function mapearCapabilities(valor) {
+  const capabilities = new Set();
+  for (const tool of valor.tools) {
+    if (!TOOL_MAP[tool]) throw crearError('POLICY_SOURCE_INVALID', `Tool desconocida: ${tool}`);
+    capabilities.add(TOOL_MAP[tool]);
+  }
+  return [...capabilities].sort();
+}
+
+function aplicarPermisos(declaradas, valor) {
+  const permitidas = declaradas.filter((capability) => {
+    if (capability === 'filesystem.mutate') return valor.permisosEscritura;
+    if (capability === 'network.access') return valor.permisosRed;
+    if (capability === 'shell.exec') return valor.permisosComandos;
+    return true;
+  });
+  return permitidas.sort();
+}
+
+function crearIndiceSkills(entries) {
+  const indice = new Map();
+  const identidades = new Set();
+  for (const entry of entries.filter(({ kind }) => kind === 'skill')) {
+    const nombre = entry.parsed.valor?.name || entry.path.split('/')[1];
+    const identidad = nombre.normalize('NFKC').toLowerCase();
+    if (identidades.has(identidad)) {
+      throw crearError('POLICY_SOURCE_INVALID', `Skill duplicada: ${nombre}`);
+    }
+    identidades.add(identidad);
+    indice.set(nombre, `skill:${sha256(entry.path)}`);
+  }
+  return indice;
+}
+
+function validarReferencias(valor, campo) {
+  const referencias = valor[campo] === undefined ? [] : valor[campo];
+  if (!Array.isArray(referencias) || !referencias.every((item) => typeof item === 'string')) {
+    throw crearError('POLICY_SOURCE_INVALID', `${campo} debe ser string[]`);
+  }
+  return referencias;
+}
+
+function clasificarReferencia(referencia, skills, esRestriccion) {
+  if (skills.has(referencia)) return { kind: 'local', nodeId: skills.get(referencia) };
+  if (referencia === CENTINELA_TODOS || SKILLS_EXTERNAS_SET.has(referencia)) {
+    return { kind: 'nonlocal', reason: 'NONLOCAL_SKILL_REFERENCE' };
+  }
+  if (esRestriccion && RESTRICCIONES_LEGACY.has(referencia)) {
+    return { kind: 'nonlocal', reason: 'LEGACY_RESTRICTION_UNRESOLVED' };
+  }
+  throw crearError('POLICY_SOURCE_INVALID', `Skill desconocida: ${referencia}`);
+}
+
+function resolverSkills(valor, skills) {
+  const invocables = validarReferencias(valor, 'skillsInvocables');
+  const restringidas = validarReferencias(valor, 'skillsRestringidos');
+  const allow = invocables.map((ref) => clasificarReferencia(ref, skills, false));
+  const deny = restringidas.map((ref) => clasificarReferencia(ref, skills, true));
+  const deniedIds = new Set(deny.filter(({ kind }) => kind === 'local').map(({ nodeId }) => nodeId));
+  const allowedIds = allow
+    .filter(({ kind, nodeId }) => kind === 'local' && !deniedIds.has(nodeId))
+    .map(({ nodeId }) => nodeId);
+  const reasons = [...allow, ...deny]
+    .filter(({ kind }) => kind === 'nonlocal')
+    .map(({ reason }) => reason);
+  return {
+    allowedSkillNodeIds: [...new Set(allowedIds)].sort(),
+    deniedSkillNodeIds: [...deniedIds].sort(),
+    reasonCodes: [...new Set(reasons)].sort(),
+  };
+}
+
+function resolverLimites(valor) {
+  const maxTurns = valor.maxTurnos === undefined ? DEFAULT_MAX_TURNS : valor.maxTurnos;
+  const toolBudget = valor.toolBudget === undefined ? DEFAULT_TOOL_BUDGET : valor.toolBudget;
+  if (!Number.isInteger(maxTurns) || maxTurns <= 0 || !validarToolBudget(toolBudget)) {
+    throw crearError('POLICY_SOURCE_INVALID', 'Límites de agente inválidos');
+  }
+  return { maxTurns, toolBudget: { ...toolBudget } };
+}
+
+function compilarAgente(entry, skills) {
+  const valor = entry.parsed.valor;
+  validarCamposAgente(valor);
+  if (!RISK_MAP[valor.nivelRiesgo]) {
+    throw crearError('POLICY_SOURCE_INVALID', 'nivelRiesgo desconocido');
+  }
+  const declaredCapabilities = mapearCapabilities(valor);
+  const skillsPolicy = resolverSkills(valor, skills);
+  const limites = resolverLimites(valor);
+  const disposition = skillsPolicy.reasonCodes.length === 0 ? 'allow' : 'deny';
+  return {
+    nodeId: `agent:${sha256(entry.path)}`,
+    kind: 'agent',
+    sourceDigest: entry.source.sha256,
+    disposition,
+    reasonCodes: skillsPolicy.reasonCodes,
+    declaredCapabilities,
+    allowedCapabilities: disposition === 'allow' ? aplicarPermisos(declaredCapabilities, valor) : [],
+    filesystemMutationAllowed: disposition === 'allow' && valor.permisosEscritura,
+    networkAllowed: disposition === 'allow' && valor.permisosRed,
+    shellAllowed: disposition === 'allow' && valor.permisosComandos,
+    allowedSkillNodeIds: disposition === 'allow' ? skillsPolicy.allowedSkillNodeIds : [],
+    deniedSkillNodeIds: skillsPolicy.deniedSkillNodeIds,
+    risk: RISK_MAP[valor.nivelRiesgo],
+    ...limites,
+  };
+}
+
+function esSha256(valor) {
+  return typeof valor === 'string' && /^[a-f0-9]{64}$/u.test(valor);
+}
+
+function esListaUnicaOrdenada(valor, validarItem) {
+  if (!Array.isArray(valor) || !valor.every(validarItem)) return false;
+  return new Set(valor).size === valor.length
+    && valor.every((item, indice) => indice === 0 || valor[indice - 1].localeCompare(item) < 0);
+}
+
+function validarRelacionesPolicy(valor) {
+  const declaradas = new Set(valor.declaredCapabilities);
+  const capabilitiesOk = valor.allowedCapabilities.every((item) => declaradas.has(item));
+  const denyOk = valor.disposition !== 'deny'
+    || (valor.allowedCapabilities.length === 0 && valor.allowedSkillNodeIds.length === 0
+      && !valor.filesystemMutationAllowed && !valor.networkAllowed && !valor.shellAllowed);
+  const permisosOk = (!valor.allowedCapabilities.includes('filesystem.mutate')
+      || valor.filesystemMutationAllowed)
+    && (!valor.allowedCapabilities.includes('network.access') || valor.networkAllowed)
+    && (!valor.allowedCapabilities.includes('shell.exec') || valor.shellAllowed);
+  const skillsOk = valor.allowedSkillNodeIds.every((item) => !valor.deniedSkillNodeIds.includes(item));
+  return capabilitiesOk && denyOk && permisosOk && skillsOk;
+}
+
+function validarPolicy(valor) {
+  const claves = [
+    'nodeId', 'kind', 'sourceDigest', 'disposition', 'reasonCodes', 'declaredCapabilities',
+    'allowedCapabilities', 'filesystemMutationAllowed', 'networkAllowed', 'shellAllowed',
+    'allowedSkillNodeIds', 'deniedSkillNodeIds', 'risk', 'maxTurns', 'toolBudget',
+  ];
+  if (!validarClaves(valor, claves) || valor.kind !== 'agent') return false;
+  const capability = (item) => typeof item === 'string' && CAPABILITIES.has(item);
+  const reason = (item) => typeof item === 'string' && /^[A-Z][A-Z0-9_]+$/u.test(item);
+  const skillId = (item) => typeof item === 'string' && /^skill:[a-f0-9]{64}$/u.test(item);
+  return /^agent:[a-f0-9]{64}$/u.test(valor.nodeId) && esSha256(valor.sourceDigest)
+    && ['allow', 'deny'].includes(valor.disposition) && ['low', 'medium', 'high'].includes(valor.risk)
+    && esListaUnicaOrdenada(valor.reasonCodes, reason)
+    && esListaUnicaOrdenada(valor.declaredCapabilities, capability)
+    && esListaUnicaOrdenada(valor.allowedCapabilities, capability)
+    && esListaUnicaOrdenada(valor.allowedSkillNodeIds, skillId)
+    && esListaUnicaOrdenada(valor.deniedSkillNodeIds, skillId)
+    && ['filesystemMutationAllowed', 'networkAllowed', 'shellAllowed']
+      .every((clave) => typeof valor[clave] === 'boolean')
+    && Number.isInteger(valor.maxTurns) && valor.maxTurns > 0 && validarToolBudget(valor.toolBudget)
+    && validarRelacionesPolicy(valor);
+}
+
+function validarPolicyBundle(valor) {
+  const claves = ['kind', 'schemaVersion', 'policyVersion', 'corpusDigest', 'globalPolicy', 'policies'];
+  const raizOk = validarClaves(valor, claves) && valor.kind === BUNDLE_KIND
+    && valor.schemaVersion === SCHEMA_VERSION && valor.policyVersion === POLICY_VERSION
+    && esSha256(valor.corpusDigest) && validarGlobalPolicy(valor.globalPolicy)
+    && Array.isArray(valor.policies) && valor.policies.length > 0
+    && valor.policies.every(validarPolicy)
+    && esListaUnicaOrdenada(valor.policies.map(({ nodeId }) => nodeId), (item) => typeof item === 'string');
+  return { ok: raizOk, errors: raizOk ? [] : [{ path: '$', code: 'contract' }] };
+}
+
+function compilarPolicyBundle() {
+  const snapshot = capturarHarnessSourceSnapshot();
+  const skills = crearIndiceSkills(snapshot.entries);
+  const policies = snapshot.entries
+    .filter(({ kind }) => kind === 'agent')
+    .map((entry) => compilarAgente(entry, skills))
+    .sort((a, b) => a.nodeId.localeCompare(b.nodeId));
+  const bundle = {
+    kind: BUNDLE_KIND,
+    schemaVersion: SCHEMA_VERSION,
+    policyVersion: POLICY_VERSION,
+    corpusDigest: snapshot.snapshotDigest,
+    globalPolicy: construirGlobalPolicy(snapshot.hooks.parsed.valor),
+    policies,
+  };
+  const validacion = validarPolicyBundle(bundle);
+  if (!validacion.ok) throw crearError('POLICY_BUNDLE_INVALID', 'PolicyBundle inválido');
+  congelarProfundo(bundle);
+  BUNDLES_VERIFICADOS.add(bundle);
+  return bundle;
+}
+
+function esPolicyBundleVerificado(valor) {
+  return BUNDLES_VERIFICADOS.has(valor);
+}
+
+function serializarPolicyBundle(bundle) {
+  if (!esPolicyBundleVerificado(bundle)) {
+    throw crearError('POLICY_BUNDLE_UNVERIFIED', 'Se requiere un VerifiedPolicyBundle');
+  }
+  return `${JSON.stringify(bundle, null, 2)}\n`;
+}
+
+module.exports = {
+  compilarPolicyBundle,
+  esPolicyBundleVerificado,
+  serializarPolicyBundle,
+  validarPolicyBundle,
+};

package/scripts/lib/policy-context-provider.js

@@ -0,0 +1,310 @@
+'use strict';
+
+/** Construye contexto efectivo desde capas firmadas e intersección de permisos. */
+
+const crypto = require('node:crypto');
+
+const { esPolicyBundleVerificado } = require('./policy-bundle');
+const { assertPrincipalCurrent, isVerifiedPrincipal } = require('./principal-verifier');
+const {
+  exactKeys, fail, freezeDeep, getContractValidators, plainObject,
+} = require('./policy-verifier-utils');
+const signed = require('./signed-envelope');
+
+const CONTEXTS = new WeakSet();
+const CONTEXT_META = new WeakMap();
+const LAYERS = Object.freeze(['session', 'runtime', 'project', 'phase']);
+const CAPABILITY = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
+const SKILL = /^skill:[a-f0-9]{64}$/u;
+const SHA256 = /^[a-f0-9]{64}$/u;
+const CLAIM_KEYS = [
+  'kind', 'schemaVersion', 'layer', 'principalDigest', 'sessionId', 'runtimeId',
+  'projectId', 'worktreeDigest', 'phaseId', 'corpusDigest', 'policyVersion',
+  'allowedCapabilities', 'allowedSkillNodeIds', 'issuedAt', 'expiresAt', 'nonce',
+];
+const OPTION_KEYS = ['principal', 'bundle', 'layersRaw', 'trustContext', 'dependencies'];
+
+function sortedUnique(values, pattern) {
+  return Array.isArray(values)
+    && values.every((value) => typeof value === 'string' && pattern.test(value))
+    && values.every((value, index) => index === 0 || values[index - 1] < value);
+}
+
+function validateOptions(options, provider) {
+  plainObject(options, 'CONTEXT_OPTIONS_INVALID', 'opciones contexto');
+  exactKeys(options, OPTION_KEYS, 'CONTEXT_OPTIONS_INVALID', 'opciones contexto');
+  if (!isVerifiedPrincipal(options.principal)) {
+    fail('CONTEXT_PRINCIPAL_INVALID', 'principal inválido');
+  }
+  if (!esPolicyBundleVerificado(options.bundle)) fail('CONTEXT_BUNDLE_INVALID', 'bundle inválido');
+  if (!getContractValidators().isKernelDependencies(options.dependencies)) {
+    fail('CONTEXT_OPTIONS_INVALID', 'dependencies inválidas');
+  }
+  if (options.dependencies.policyContextProvider !== provider) {
+    fail('CONTEXT_OPTIONS_INVALID', 'provider ligado a otro kernel');
+  }
+  plainObject(options.layersRaw, 'CONTEXT_LAYER_INVALID', 'capas');
+  exactKeys(options.layersRaw, LAYERS, 'CONTEXT_LAYER_INVALID', 'capas');
+}
+
+function validateLayerShape(claims, expectedLayer) {
+  plainObject(claims, 'CONTEXT_LAYER_INVALID', 'claims de capa');
+  exactKeys(claims, CLAIM_KEYS, 'CONTEXT_LAYER_INVALID', 'claims de capa');
+  if (claims.kind !== 'policy-context-layer' || claims.schemaVersion !== '1.0.0'
+      || claims.layer !== expectedLayer) {
+    fail('CONTEXT_LAYER_INVALID', 'capa futura, duplicada o inválida');
+  }
+  if (!sortedUnique(claims.allowedCapabilities, CAPABILITY)
+      || !sortedUnique(claims.allowedSkillNodeIds, SKILL)) {
+    fail('CONTEXT_LAYER_INVALID', 'permisos de capa inválidos');
+  }
+}
+
+function validateLayerBindings(claims, options, now) {
+  const principal = options.principal;
+  const expected = {
+    principalDigest: principal.principalDigest,
+    sessionId: principal.sessionId, runtimeId: principal.runtimeId,
+    projectId: principal.projectId, worktreeDigest: principal.worktreeDigest,
+    corpusDigest: options.bundle.corpusDigest, policyVersion: options.bundle.policyVersion,
+  };
+  if (Object.entries(expected).some(([key, value]) => claims[key] !== value)
+      || !CAPABILITY.test(claims.phaseId) || !CAPABILITY.test(claims.nonce)) {
+    fail('CONTEXT_BINDING_INVALID', 'binding de capa inválido');
+  }
+  signed.validarTimestampIso(claims.issuedAt, 'context issuedAt');
+  signed.validarTimestampIso(claims.expiresAt, 'context expiresAt');
+  if (claims.issuedAt > now || claims.expiresAt < now || claims.issuedAt >= claims.expiresAt) {
+    fail('CONTEXT_EXPIRED', 'capa fuera de vigencia');
+  }
+}
+
+function verifyLayer(rawBytes, layer, options, authority) {
+  const envelope = signed.verificarEnvelope(rawBytes, {
+    trustContext: options.trustContext, expectedType: 'policy_context',
+    requiredScope: `policy_context:${layer}`, now: authority.observedAt,
+  });
+  if (envelope.trustEpoch !== authority.trustEpoch
+      || envelope.trustDigest !== authority.trustDigest
+      || envelope.rootKeyDigest !== authority.rootKeyDigest) {
+    fail('CONTEXT_TRUST_INVALID', 'capa ligada a trust distinto');
+  }
+  validateLayerShape(envelope.claims, layer);
+  validateLayerBindings(envelope.claims, options, authority.observedAt);
+  return envelope;
+}
+
+function intersect(values, next) {
+  const allowed = new Set(next);
+  return values.filter((value) => allowed.has(value));
+}
+
+function resolvePolicies(bundle, principal) {
+  const policies = principal.delegationChain.map(({ agentNodeId }) => (
+    bundle.policies.find((policy) => policy.nodeId === agentNodeId)
+  ));
+  if (policies.some((policy) => !policy || policy.disposition !== 'allow')) {
+    fail('CONTEXT_POLICY_DENIED', 'política ausente o denegada');
+  }
+  return policies;
+}
+
+function validateGlobalBoundary(bundle, policies) {
+  const global = bundle.globalPolicy;
+  const toolBudget = Object.fromEntries(['simple', 'standard', 'complex'].map((level) => [
+    level,
+    Math.min(global.defaultToolBudget[level], ...policies.map(({ toolBudget: budget }) => (
+      budget[level]
+    ))),
+  ]));
+  return freezeDeep({
+    digest: crypto.createHash('sha256')
+      .update(signed.canonicalizarIJson(global), 'utf8').digest('hex'),
+    maxTurns: Math.min(global.defaultMaxTurns, ...policies.map(({ maxTurns }) => maxTurns)),
+    toolBudget,
+    riskThresholds: structuredClone(global.riskThresholds),
+    costBudget: structuredClone(global.costBudget),
+    circuitBreaker: structuredClone(global.circuitBreaker),
+  });
+}
+
+function effectivePermissions(policies, principal, envelopes) {
+  let capabilities = [...policies[0].allowedCapabilities];
+  let skills = [...policies[0].allowedSkillNodeIds];
+  const boundaries = [
+    ...policies.slice(1).map((policy) => ({
+      capabilities: policy.allowedCapabilities, skills: policy.allowedSkillNodeIds,
+    })),
+    ...principal.delegationChain.map((entry) => ({
+      capabilities: entry.allowedCapabilities, skills: entry.allowedSkillNodeIds,
+    })),
+    ...envelopes.map(({ claims }) => ({
+      capabilities: claims.allowedCapabilities, skills: claims.allowedSkillNodeIds,
+    })),
+  ];
+  for (const boundary of boundaries) {
+    capabilities = intersect(capabilities, boundary.capabilities);
+    skills = intersect(skills, boundary.skills);
+  }
+  const denied = new Set(policies.flatMap((policy) => policy.deniedSkillNodeIds));
+  return { capabilities, skills: skills.filter((skill) => !denied.has(skill)) };
+}
+
+function layerReceipt(envelope) {
+  return {
+    layer: envelope.claims.layer, keyId: envelope.keyId,
+    signerPublicKeyDigest: envelope.signerPublicKeyDigest,
+    nonce: envelope.claims.nonce, issuedAt: envelope.claims.issuedAt,
+    expiresAt: envelope.claims.expiresAt,
+  };
+}
+
+function createContext(options, envelopes, permissions, globalBoundary, claimReceipt) {
+  const expirations = [
+    options.principal.expiresAt,
+    ...envelopes.map(({ claims }) => claims.expiresAt),
+  ];
+  const layerReceipts = envelopes.map(layerReceipt);
+  const digestInput = {
+    principalDigest: options.principal.principalDigest,
+    bundleDigest: options.bundle.corpusDigest,
+    globalPolicyDigest: globalBoundary.digest,
+    layers: envelopes.map((envelope) => ({
+      claims: envelope.claims, keyId: envelope.keyId,
+      signerPublicKeyDigest: envelope.signerPublicKeyDigest,
+      trustEpoch: envelope.trustEpoch, trustDigest: envelope.trustDigest,
+    })),
+  };
+  const contextDigest = crypto.createHash('sha256')
+    .update(signed.canonicalizarIJson(digestInput), 'utf8').digest('hex');
+  const context = freezeDeep({
+    kind: 'verified-policy-context', principalDigest: options.principal.principalDigest,
+    sessionId: options.principal.sessionId, runtimeId: options.principal.runtimeId,
+    projectId: options.principal.projectId, worktreeDigest: options.principal.worktreeDigest,
+    corpusDigest: options.bundle.corpusDigest, policyVersion: options.bundle.policyVersion,
+    globalPolicyDigest: globalBoundary.digest,
+    maxTurns: globalBoundary.maxTurns, toolBudget: globalBoundary.toolBudget,
+    riskThresholds: globalBoundary.riskThresholds,
+    costBudget: globalBoundary.costBudget,
+    circuitBreaker: globalBoundary.circuitBreaker,
+    phaseId: envelopes[0].claims.phaseId,
+    allowedCapabilities: permissions.capabilities,
+    allowedSkillNodeIds: permissions.skills,
+    trustEpoch: envelopes[0].trustEpoch, trustDigest: envelopes[0].trustDigest,
+    rootKeyDigest: envelopes[0].rootKeyDigest,
+    layerReceipts, claimSequence: claimReceipt.sequence,
+    expiresAt: [...expirations].sort()[0], contextDigest,
+  });
+  CONTEXTS.add(context);
+  CONTEXT_META.set(context, Object.freeze({
+    bundle: options.bundle, envelopes, principal: options.principal,
+    integrityLedger: options.dependencies.integrityLedger,
+  }));
+  return context;
+}
+
+function assertPolicyContextCurrent(context, authority) {
+  if (!CONTEXTS.has(context)) fail('CONTEXT_INVALID', 'contexto no verificado');
+  const metadata = CONTEXT_META.get(context);
+  if (!metadata.integrityLedger.isAuthorityReceipt(authority)) {
+    fail('CONTEXT_AUTHORITY_INVALID', 'autoridad no verificada');
+  }
+  assertPrincipalCurrent(metadata.principal, authority);
+  for (const envelope of metadata.envelopes) {
+    signed.revalidarEnvelopeVerificado(envelope, authority.observedAt);
+    if (envelope.claims.expiresAt < authority.observedAt) {
+      fail('CONTEXT_EXPIRED', 'capa de contexto expirada');
+    }
+  }
+  return true;
+}
+
+function validateContextSet(envelopes) {
+  if (new Set(envelopes.map(({ claims }) => claims.nonce)).size !== LAYERS.length
+      || new Set(envelopes.map(({ claims }) => claims.phaseId)).size !== 1) {
+    fail('CONTEXT_LAYER_INVALID', 'capas duplicadas o de fases distintas');
+  }
+}
+
+function createClaimEntry(state, envelopes) {
+  const layers = envelopes.map(layerReceipt).sort((a, b) => a.layer.localeCompare(b.layer));
+  const used = new Set(state.events
+    .filter(({ eventType }) => eventType === 'policy.context.claimed')
+    .flatMap(({ payload }) => payload.layers.map(({ nonce }) => nonce)));
+  if (layers.some(({ nonce }) => used.has(nonce))) {
+    fail('CONTEXT_REPLAY', 'contexto ya reclamado');
+  }
+  return {
+    expectedSequence: state.sequence,
+    expectedHeadHash: state.headHash,
+    eventType: 'policy.context.claimed',
+    payload: { schemaVersion: '1.0.0', layers },
+  };
+}
+
+function evaluateContext(options, authority) {
+  const envelopes = LAYERS.map((layer) => (
+    verifyLayer(options.layersRaw[layer], layer, options, authority)
+  ));
+  assertPrincipalCurrent(options.principal, authority);
+  validateContextSet(envelopes);
+  const policies = resolvePolicies(options.bundle, options.principal);
+  return {
+    envelopes,
+    globalBoundary: validateGlobalBoundary(options.bundle, policies),
+    permissions: effectivePermissions(policies, options.principal, envelopes),
+  };
+}
+
+function verifyPolicyContextInternal(writer, provider, options) {
+  validateOptions(options, provider);
+  let evaluation;
+  const claimReceipt = writer.transact((state, authority) => {
+    evaluation = evaluateContext(options, authority);
+    return createClaimEntry(state, evaluation.envelopes);
+  });
+  return createContext(
+    options,
+    evaluation.envelopes,
+    evaluation.permissions,
+    evaluation.globalBoundary,
+    claimReceipt
+  );
+}
+
+function isVerifiedPolicyContext(value) {
+  return CONTEXTS.has(value);
+}
+
+function createPolicyContextProvider(writer) {
+  let provider;
+  provider = Object.freeze({
+    verifyPolicyContext: (options) => verifyPolicyContextInternal(writer, provider, options),
+  });
+  const authorizationContextReader = Object.freeze({
+    read: (context, authority) => {
+      assertPolicyContextCurrent(context, authority);
+      const metadata = CONTEXT_META.get(context);
+      return Object.freeze({
+        bundle: metadata.bundle,
+        context,
+        principal: metadata.principal,
+      });
+    },
+  });
+  return Object.freeze({ authorizationContextReader, publicProvider: provider });
+}
+
+function verifyPolicyContext(options) {
+  if (!options || !getContractValidators().isKernelDependencies(options.dependencies)) {
+    fail('CONTEXT_OPTIONS_INVALID', 'dependencies inválidas');
+  }
+  return options.dependencies.policyContextProvider.verifyPolicyContext(options);
+}
+
+module.exports = {
+  assertPolicyContextCurrent,
+  createPolicyContextProvider,
+  isVerifiedPolicyContext,
+  verifyPolicyContext,
+};