@scopebond/hook 0.8.1 → 0.9.0

package/dist/policy-load.js

@@ -0,0 +1,151 @@
+// Load a policy exported from a Scopebond Cloud workspace, and say honestly what happened.
+//
+// An export is a reviewed policy in a file. Nothing is enforcing it until a hook loads it, and
+// the workspace shows it as "pending" until a signed acknowledgement echoes exactly what the
+// export said: its policy digest, its policy id and version, its scope digest and the export
+// id. This module checks an export and, when asked, installs it as the active policy; the
+// caller then queues the acknowledgement (`ObservationEmitter.policyAck`).
+//
+// What is checked, and what is not:
+//   - the export's own integrity: its `policy_hash` must be the SHA-256 of the canonical policy
+//     it carries, and its `scope.scope_digest` must be the SHA-256 of
+//     `scopebond:policy-scope/v1\n` + the canonical `{agent_id, environment_id, export_id}`;
+//   - that it is for this workspace environment (when this machine is connected);
+//   - that the gateway can build a runtime from it.
+// An export carries no signature of its own, so this cannot prove who wrote it: get the file
+// from your workspace, over the workspace's own page or API.
+//
+// Loading replaces the active policy. The previous file is kept beside it, and the write is
+// atomic (a temp file in the same directory, then a rename), so an interrupted load leaves the
+// old policy in place. Nothing here touches an agent's settings.
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createHash, randomBytes } from "node:crypto";
+import { canonical } from "@scopebond/policy-schema/canonical";
+import { scaffold } from "./init.js";
+import { createHookRuntime } from "./runtime.js";
+import { digestPolicy } from "./observation.js";
+export const POLICY_SCOPE_DOMAIN = "scopebond:policy-scope/v1\n";
+export const MAX_EXPORT_BYTES = 1024 * 1024;
+export const LOADED_POLICY_FILE = "loaded-policy.json";
+export const PREVIOUS_POLICY_FILE = "policy.previous.json";
+/** SHA-256 of the domain plus the canonical scope an export was made for. */
+export const policyScopeDigest = (scope) => createHash("sha256").update(POLICY_SCOPE_DOMAIN + canonical({ agent_id: scope.agent_id, environment_id: scope.environment_id, export_id: scope.export_id }), "utf8").digest("hex");
+const HEX64 = /^[0-9a-f]{64}$/;
+const OPAQUE = /^[\x21-\x7e]{1,200}$/;
+const isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+/** Accept the export itself, or the workspace's `{ id, configuration }` answer around it. */
+export function unwrapExport(raw) {
+    if (!isObject(raw))
+        return null;
+    if (raw.type === undefined && isObject(raw.configuration))
+        return raw.configuration;
+    return raw;
+}
+/** Check an export without reading or changing anything on disk. Pure. */
+export function inspectExport(raw, context = {}) {
+    const exp = unwrapExport(raw);
+    if (!exp || exp.type !== "scopebond:reviewed-policy-export")
+        return { ok: false, error: "schema_invalid", message: "this is not a Scopebond policy export" };
+    if (exp.version !== 1)
+        return { ok: false, error: "unsupported", message: `unsupported export version ${String(exp.version)}` };
+    const scope = exp.scope;
+    const policy = exp.policy;
+    if (!isObject(scope) || !isObject(policy) || typeof exp.policy_hash !== "string" || !HEX64.test(exp.policy_hash)) {
+        return { ok: false, error: "schema_invalid", message: "the export lacks a policy, a policy hash or a scope block (an export made before scope blocks existed cannot be acknowledged; export it again from the workspace)" };
+    }
+    const { export_id: exportId, policy_id: policyId, policy_version: policyVersion, agent_id: agentId, environment_id: environmentId, scope_digest: scopeDigest } = scope;
+    if (typeof exportId !== "string" || !OPAQUE.test(exportId) || typeof policyId !== "string" || !OPAQUE.test(policyId)
+        || !Number.isInteger(policyVersion) || policyVersion < 1 || policyVersion > 2_147_483_647
+        || typeof agentId !== "string" || !OPAQUE.test(agentId) || typeof environmentId !== "string" || !OPAQUE.test(environmentId)
+        || typeof scopeDigest !== "string" || !HEX64.test(scopeDigest)) {
+        return { ok: false, error: "schema_invalid", message: "the export's scope block is incomplete or malformed" };
+    }
+    // The values below are echoed exactly as the export states them, so a rejection still names the export.
+    const echo = { exportId, policyId, policyVersion: policyVersion, policyDigest: exp.policy_hash, scopeDigest };
+    if (digestPolicy(policy) !== exp.policy_hash) {
+        return { ok: false, error: "signature_invalid", message: "the policy does not match the export's policy hash; the file was changed or damaged", ack: echo };
+    }
+    if (policyScopeDigest({ export_id: exportId, agent_id: agentId, environment_id: environmentId }) !== scopeDigest) {
+        return { ok: false, error: "scope_mismatch", message: "the export's scope digest does not match its export, agent and environment", ack: echo };
+    }
+    if (context.environmentId !== undefined && context.environmentId !== environmentId) {
+        return { ok: false, error: "scope_mismatch", message: "this export is for a different environment than this machine is connected to", ack: echo };
+    }
+    return { ok: true, facts: { ...echo, agentId, environmentId, policy } };
+}
+/** Whether the gateway can build a runtime from this policy, in a throwaway home. Never touches a real one. */
+export function policyBuilds(policy) {
+    const dir = mkdtempSync(join(tmpdir(), "scopebond-policy-check-"));
+    let runtime;
+    try {
+        scaffold(dir);
+        writeFileSync(join(dir, "policy.json"), `${JSON.stringify(policy)}\n`);
+        runtime = createHookRuntime({ policyPath: join(dir, "policy.json"), keyPath: join(dir, "agent.key"), attesterPath: join(dir, "attester.key"), dbPath: join(dir, "receipts.db") });
+        return true;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        try {
+            runtime?.close();
+        }
+        catch { /* removed next */ }
+        try {
+            rmSync(dir, { recursive: true, force: true, maxRetries: 5 });
+        }
+        catch { /* the OS temp dir is cleaned later */ }
+    }
+}
+/** Write a file atomically: a temp file in the same directory, then a rename. */
+function writeAtomic(file, text) {
+    const temp = `${file}.${randomBytes(6).toString("hex")}.tmp`;
+    try {
+        writeFileSync(temp, text, { mode: 0o600 });
+        renameSync(temp, file);
+    }
+    catch (error) {
+        try {
+            rmSync(temp, { force: true });
+        }
+        catch { /* nothing to remove */ }
+        throw error;
+    }
+}
+/** Read an export file, check it, and (with `apply`) install it as the active policy in `dir`. */
+export function loadPolicyExport(dir, file, options) {
+    let raw;
+    try {
+        if (statSync(file).size > MAX_EXPORT_BYTES)
+            return { state: "rejected", error: "schema_invalid", message: "the export file is larger than 1 MiB" };
+        raw = JSON.parse(readFileSync(file, "utf8"));
+    }
+    catch (error) {
+        return { state: "rejected", error: "schema_invalid", message: `the export could not be read as JSON (${error.name})` };
+    }
+    const inspected = inspectExport(raw, { environmentId: options.environmentId });
+    if (!inspected.ok)
+        return { state: "rejected", error: inspected.error, message: inspected.message, ...(inspected.ack ? { ack: inspected.ack } : {}) };
+    const { facts } = inspected;
+    if (!policyBuilds(facts.policy)) {
+        return { state: "rejected", error: "unsupported", message: "this gateway cannot load that policy", ack: { exportId: facts.exportId, policyId: facts.policyId, policyVersion: facts.policyVersion, policyDigest: facts.policyDigest, scopeDigest: facts.scopeDigest } };
+    }
+    if (!options.apply)
+        return { state: "would_load", facts };
+    mkdirSync(dir, { recursive: true });
+    const policyPath = join(dir, "policy.json");
+    let previous = null;
+    if (existsSync(policyPath)) {
+        previous = join(dir, PREVIOUS_POLICY_FILE);
+        copyFileSync(policyPath, previous);
+    }
+    writeAtomic(policyPath, `${JSON.stringify(facts.policy, null, 2)}\n`);
+    writeAtomic(join(dir, LOADED_POLICY_FILE), `${JSON.stringify({
+        export_id: facts.exportId, policy_id: facts.policyId, policy_version: facts.policyVersion, policy_digest: facts.policyDigest,
+        scope_digest: facts.scopeDigest, environment_id: facts.environmentId, agent_id: facts.agentId, loaded_at: new Date().toISOString(),
+    }, null, 2)}\n`);
+    return { state: "loaded", facts, policyPath, previous };
+}
+//# sourceMappingURL=policy-load.js.map

package/dist/policy-load.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-load.js","sourceRoot":"","sources":["../src/policy-load.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,EAAE;AACF,+FAA+F;AAC/F,6FAA6F;AAC7F,6FAA6F;AAC7F,0FAA0F;AAC1F,2EAA2E;AAC3E,EAAE;AACF,oCAAoC;AACpC,gGAAgG;AAChG,sEAAsE;AACtE,6FAA6F;AAC7F,kFAAkF;AAClF,oDAAoD;AACpD,6FAA6F;AAC7F,6DAA6D;AAC7D,EAAE;AACF,4FAA4F;AAC5F,+FAA+F;AAC/F,iEAAiE;AAEjE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtI,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,YAAY,EAA6C,MAAM,kBAAkB,CAAC;AAE3F,MAAM,CAAC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AACjE,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5C,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AACvD,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAsE,EAAU,EAAE,CAClH,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,mBAAmB,GAAG,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAW,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE9L,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAC/B,MAAM,MAAM,GAAG,sBAAsB,CAAC;AAkBtC,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAExH,6FAA6F;AAC7F,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,GAAG,CAAC,aAAa,CAAC;IACpF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,GAAY,EAAE,UAAsC,EAAE;IAClF,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,kCAAkC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;IAC7J,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,8BAA8B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;IAChI,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACjH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,mKAAmK,EAAE,CAAC;IAC9N,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IACvK,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;WAC/G,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAK,aAAwB,GAAG,CAAC,IAAK,aAAwB,GAAG,aAAa;WAC9G,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC;WACxH,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IAChH,CAAC;IACD,wGAAwG;IACxG,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAuB,EAAE,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC;IACxH,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,qFAAqF,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC9J,CAAC;IACD,IAAI,iBAAiB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,KAAK,WAAW,EAAE,CAAC;QACjH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,4EAA4E,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAClJ,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;QACnF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,8EAA8E,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACpJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,YAAY,CAAC,MAA+B;IAC1D,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACnE,IAAI,OAAyD,CAAC;IAC9D,IAAI,CAAC;QACH,QAAQ,CAAC,GAAG,CAAC,CAAC;QACd,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvE,OAAO,GAAG,iBAAiB,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC;QAClL,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;YACjB,CAAC;QACP,IAAI,CAAC;YAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACtD,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,sCAAsC,CAAC,CAAC;IACxH,CAAC;AACH,CAAC;AAOD,iFAAiF;AACjF,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY;IAC7C,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC7D,IAAI,CAAC;QAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IAC3E,OAAO,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;AACzG,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAY,EAAE,OAAmD;IAC7G,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,gBAAgB;YAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;QACnJ,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,yCAA0C,KAAe,CAAC,IAAI,GAAG,EAAE,CAAC;IACpI,CAAC;IACD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACtJ,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC;IAC5B,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,sCAAsC,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;IACzQ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IAC1D,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC5C,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;QAAC,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAAC,CAAC;IAC/G,WAAW,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACtE,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3D,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC,aAAa,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY;QAC5H,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,cAAc,EAAE,KAAK,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC1D,CAAC","sourcesContent":["// Load a policy exported from a Scopebond Cloud workspace, and say honestly what happened.\n//\n// An export is a reviewed policy in a file. Nothing is enforcing it until a hook loads it, and\n// the workspace shows it as \"pending\" until a signed acknowledgement echoes exactly what the\n// export said: its policy digest, its policy id and version, its scope digest and the export\n// id. This module checks an export and, when asked, installs it as the active policy; the\n// caller then queues the acknowledgement (`ObservationEmitter.policyAck`).\n//\n// What is checked, and what is not:\n//   - the export's own integrity: its `policy_hash` must be the SHA-256 of the canonical policy\n//     it carries, and its `scope.scope_digest` must be the SHA-256 of\n//     `scopebond:policy-scope/v1\\n` + the canonical `{agent_id, environment_id, export_id}`;\n//   - that it is for this workspace environment (when this machine is connected);\n//   - that the gateway can build a runtime from it.\n// An export carries no signature of its own, so this cannot prove who wrote it: get the file\n// from your workspace, over the workspace's own page or API.\n//\n// Loading replaces the active policy. The previous file is kept beside it, and the write is\n// atomic (a temp file in the same directory, then a rename), so an interrupted load leaves the\n// old policy in place. Nothing here touches an agent's settings.\n\nimport { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { createHash, randomBytes } from \"node:crypto\";\nimport { canonical } from \"@scopebond/policy-schema/canonical\";\nimport { scaffold } from \"./init.js\";\nimport { createHookRuntime } from \"./runtime.js\";\nimport { digestPolicy, type PolicyAckInput, type PolicyLoadError } from \"./observation.js\";\n\nexport const POLICY_SCOPE_DOMAIN = \"scopebond:policy-scope/v1\\n\";\nexport const MAX_EXPORT_BYTES = 1024 * 1024;\nexport const LOADED_POLICY_FILE = \"loaded-policy.json\";\nexport const PREVIOUS_POLICY_FILE = \"policy.previous.json\";\n\n/** SHA-256 of the domain plus the canonical scope an export was made for. */\nexport const policyScopeDigest = (scope: { export_id: string; agent_id: string; environment_id: string }): string =>\n  createHash(\"sha256\").update(POLICY_SCOPE_DOMAIN + canonical({ agent_id: scope.agent_id, environment_id: scope.environment_id, export_id: scope.export_id } as never), \"utf8\").digest(\"hex\");\n\nconst HEX64 = /^[0-9a-f]{64}$/;\nconst OPAQUE = /^[\\x21-\\x7e]{1,200}$/;\n\nexport interface ExportFacts {\n  exportId: string;\n  policyId: string;\n  policyVersion: number;\n  policyDigest: string;\n  scopeDigest: string;\n  agentId: string;\n  environmentId: string;\n  policy: Record<string, unknown>;\n}\n\nexport type Inspection =\n  | { ok: true; facts: ExportFacts }\n  /** `ack` is set when the export names enough to echo in a rejection; otherwise nothing is acknowledged. */\n  | { ok: false; error: PolicyLoadError; message: string; ack?: Omit<PolicyAckInput, \"error\"> };\n\nconst isObject = (v: unknown): v is Record<string, unknown> => typeof v === \"object\" && v !== null && !Array.isArray(v);\n\n/** Accept the export itself, or the workspace's `{ id, configuration }` answer around it. */\nexport function unwrapExport(raw: unknown): Record<string, unknown> | null {\n  if (!isObject(raw)) return null;\n  if (raw.type === undefined && isObject(raw.configuration)) return raw.configuration;\n  return raw;\n}\n\n/** Check an export without reading or changing anything on disk. Pure. */\nexport function inspectExport(raw: unknown, context: { environmentId?: string } = {}): Inspection {\n  const exp = unwrapExport(raw);\n  if (!exp || exp.type !== \"scopebond:reviewed-policy-export\") return { ok: false, error: \"schema_invalid\", message: \"this is not a Scopebond policy export\" };\n  if (exp.version !== 1) return { ok: false, error: \"unsupported\", message: `unsupported export version ${String(exp.version)}` };\n  const scope = exp.scope;\n  const policy = exp.policy;\n  if (!isObject(scope) || !isObject(policy) || typeof exp.policy_hash !== \"string\" || !HEX64.test(exp.policy_hash)) {\n    return { ok: false, error: \"schema_invalid\", message: \"the export lacks a policy, a policy hash or a scope block (an export made before scope blocks existed cannot be acknowledged; export it again from the workspace)\" };\n  }\n  const { export_id: exportId, policy_id: policyId, policy_version: policyVersion, agent_id: agentId, environment_id: environmentId, scope_digest: scopeDigest } = scope;\n  if (typeof exportId !== \"string\" || !OPAQUE.test(exportId) || typeof policyId !== \"string\" || !OPAQUE.test(policyId)\n    || !Number.isInteger(policyVersion) || (policyVersion as number) < 1 || (policyVersion as number) > 2_147_483_647\n    || typeof agentId !== \"string\" || !OPAQUE.test(agentId) || typeof environmentId !== \"string\" || !OPAQUE.test(environmentId)\n    || typeof scopeDigest !== \"string\" || !HEX64.test(scopeDigest)) {\n    return { ok: false, error: \"schema_invalid\", message: \"the export's scope block is incomplete or malformed\" };\n  }\n  // The values below are echoed exactly as the export states them, so a rejection still names the export.\n  const echo = { exportId, policyId, policyVersion: policyVersion as number, policyDigest: exp.policy_hash, scopeDigest };\n  if (digestPolicy(policy) !== exp.policy_hash) {\n    return { ok: false, error: \"signature_invalid\", message: \"the policy does not match the export's policy hash; the file was changed or damaged\", ack: echo };\n  }\n  if (policyScopeDigest({ export_id: exportId, agent_id: agentId, environment_id: environmentId }) !== scopeDigest) {\n    return { ok: false, error: \"scope_mismatch\", message: \"the export's scope digest does not match its export, agent and environment\", ack: echo };\n  }\n  if (context.environmentId !== undefined && context.environmentId !== environmentId) {\n    return { ok: false, error: \"scope_mismatch\", message: \"this export is for a different environment than this machine is connected to\", ack: echo };\n  }\n  return { ok: true, facts: { ...echo, agentId, environmentId, policy } };\n}\n\n/** Whether the gateway can build a runtime from this policy, in a throwaway home. Never touches a real one. */\nexport function policyBuilds(policy: Record<string, unknown>): boolean {\n  const dir = mkdtempSync(join(tmpdir(), \"scopebond-policy-check-\"));\n  let runtime: ReturnType<typeof createHookRuntime> | undefined;\n  try {\n    scaffold(dir);\n    writeFileSync(join(dir, \"policy.json\"), `${JSON.stringify(policy)}\\n`);\n    runtime = createHookRuntime({ policyPath: join(dir, \"policy.json\"), keyPath: join(dir, \"agent.key\"), attesterPath: join(dir, \"attester.key\"), dbPath: join(dir, \"receipts.db\") });\n    return true;\n  } catch { return false; }\n  finally {\n    try { runtime?.close(); } catch { /* removed next */ }\n    try { rmSync(dir, { recursive: true, force: true, maxRetries: 5 }); } catch { /* the OS temp dir is cleaned later */ }\n  }\n}\n\nexport type LoadOutcome =\n  | { state: \"loaded\"; facts: ExportFacts; policyPath: string; previous: string | null }\n  | { state: \"would_load\"; facts: ExportFacts }\n  | { state: \"rejected\"; error: PolicyLoadError; message: string; ack?: Omit<PolicyAckInput, \"error\"> };\n\n/** Write a file atomically: a temp file in the same directory, then a rename. */\nfunction writeAtomic(file: string, text: string): void {\n  const temp = `${file}.${randomBytes(6).toString(\"hex\")}.tmp`;\n  try { writeFileSync(temp, text, { mode: 0o600 }); renameSync(temp, file); }\n  catch (error) { try { rmSync(temp, { force: true }); } catch { /* nothing to remove */ } throw error; }\n}\n\n/** Read an export file, check it, and (with `apply`) install it as the active policy in `dir`. */\nexport function loadPolicyExport(dir: string, file: string, options: { apply: boolean; environmentId?: string }): LoadOutcome {\n  let raw: unknown;\n  try {\n    if (statSync(file).size > MAX_EXPORT_BYTES) return { state: \"rejected\", error: \"schema_invalid\", message: \"the export file is larger than 1 MiB\" };\n    raw = JSON.parse(readFileSync(file, \"utf8\"));\n  } catch (error) {\n    return { state: \"rejected\", error: \"schema_invalid\", message: `the export could not be read as JSON (${(error as Error).name})` };\n  }\n  const inspected = inspectExport(raw, { environmentId: options.environmentId });\n  if (!inspected.ok) return { state: \"rejected\", error: inspected.error, message: inspected.message, ...(inspected.ack ? { ack: inspected.ack } : {}) };\n  const { facts } = inspected;\n  if (!policyBuilds(facts.policy)) {\n    return { state: \"rejected\", error: \"unsupported\", message: \"this gateway cannot load that policy\", ack: { exportId: facts.exportId, policyId: facts.policyId, policyVersion: facts.policyVersion, policyDigest: facts.policyDigest, scopeDigest: facts.scopeDigest } };\n  }\n  if (!options.apply) return { state: \"would_load\", facts };\n  mkdirSync(dir, { recursive: true });\n  const policyPath = join(dir, \"policy.json\");\n  let previous: string | null = null;\n  if (existsSync(policyPath)) { previous = join(dir, PREVIOUS_POLICY_FILE); copyFileSync(policyPath, previous); }\n  writeAtomic(policyPath, `${JSON.stringify(facts.policy, null, 2)}\\n`);\n  writeAtomic(join(dir, LOADED_POLICY_FILE), `${JSON.stringify({\n    export_id: facts.exportId, policy_id: facts.policyId, policy_version: facts.policyVersion, policy_digest: facts.policyDigest,\n    scope_digest: facts.scopeDigest, environment_id: facts.environmentId, agent_id: facts.agentId, loaded_at: new Date().toISOString(),\n  }, null, 2)}\\n`);\n  return { state: \"loaded\", facts, policyPath, previous };\n}\n"]}

package/dist/proof.d.ts

@@ -0,0 +1,30 @@
+import { type CapabilityCell, type ProofRecord } from "./capabilities.js";
+import type { HookConnection } from "./cloud.js";
+export declare const PROOF_FILE = "capability-proof.json";
+/** Options for a fixture run. */
+export interface ProofRunOptions {
+    /** A real hook config dir whose machine and countersigning keys the fixtures should be
+     *  signed with (copied into the temp home, never modified), so the workspace can accept
+     *  the fixture receipts and resolve a proof's digests against them. Without it the
+     *  fixtures use throwaway keys and produce no digests a workspace could resolve. */
+    identityDir?: string;
+    /** Receives every fixture receipt produced, once each, for delivery. */
+    collect?: unknown[];
+}
+/** Run every supported cell's fixtures once per adapter/action/phase, and record the
+ *  result under each host variant's key. A fixture exercises the adapter, so it cannot
+ *  tell Codex desktop from Codex CLI: both keys get the same fixture proof, and neither
+ *  becomes verified (see `cellState`). */
+export declare function runProofFixtures(adapterVersion: string, options?: ProofRunOptions): Promise<Record<string, ProofRecord>>;
+export declare function loadProofs(configDir: string): Record<string, ProofRecord>;
+export declare function saveProofs(configDir: string, proofs: Record<string, ProofRecord>): string;
+/** Whether a cell's fixture proof passed, for a summary line. */
+export declare const proofPassed: (proof: ProofRecord, cell: CapabilityCell) => boolean;
+/** Deliver fixture receipts to the workspace's receipt route and report whether every one was
+ *  accepted. A proof names these receipts by digest, so it is only worth sending after they
+ *  landed; anything short of full delivery leaves the proof unsent, never half-claimed. */
+export declare function deliverProofReceipts(connection: HookConnection, receipts: unknown[], options?: {
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}): Promise<boolean>;
+//# sourceMappingURL=proof.d.ts.map

package/dist/proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AA4BA,OAAO,EAA4E,KAAK,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAKpJ,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,eAAO,MAAM,UAAU,0BAA0B,CAAC;AAKlD,iCAAiC;AACjC,MAAM,WAAW,eAAe;IAC9B;;;wFAGoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;CACrB;AAyED;;;0CAG0C;AAC1C,wBAAsB,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAkBlI;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAOzE;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,CAIzF;AAED,iEAAiE;AACjE,eAAO,MAAM,WAAW,GAAI,OAAO,WAAW,EAAE,MAAM,cAAc,KAAG,OAC6E,CAAC;AAErJ;;2FAE2F;AAC3F,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAkBxK"}

package/dist/proof.js

@@ -0,0 +1,186 @@
+// Safe proof fixtures.
+//
+// For each supported capability cell this runs its tagged vectors end to end against a
+// throwaway hook home: a safe action must be allowed and countersigned; a violating one
+// must be denied at the hook boundary; every receipt must verify against the
+// countersigning key; and every receipt of one tool call must carry one action group.
+//
+// Nothing here touches a developer's real settings, policy, keys or receipts. Every run
+// creates its own directory under the OS temp dir, scaffolds a fresh machine key, policy
+// and store there, and deletes it afterwards. No network is used, so a fixture can never
+// produce a Cloud acknowledgement: `cloud_ack` is always `not_checked`, and `origin` is
+// always `fixture`. A cell therefore cannot reach `verified_reporting` from this runner
+// (see capabilities.ts); it can only show `configured_unverified` with a passing
+// fixture, or `degraded` with a failing one.
+//
+// Observation-only cells (Cursor's after-edit event, and monitor-mode fetch and MCP
+// calls) are proven with a known successful after-action fixture, labelled
+// observation-only. No deny fixture is run for them and none is claimed.
+import { copyFileSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { createCloudExporter, createMemoryCloudOutbox, verifyReceipt } from "@scopebond/gateway";
+import { loadOrCreateAttester } from "@scopebond/gateway/node";
+import { fillPushBranch } from "./map.js";
+import { scaffold } from "./init.js";
+import { createHookRuntime } from "./runtime.js";
+import { ACTION_GROUP_PARAM } from "./group.js";
+import { computeManifest, specForCell, vectorDigest, vectorsForCell } from "./capabilities.js";
+import { mapVector } from "./vectors.js";
+import { bindingKeyFromHex, operationsForCall, sourceReceiptHash } from "./observation.js";
+import { callRequestOf, fixtureProbe } from "./typed-ops.js";
+import { fixtureFiles } from "./typed-infra.js";
+export const PROOF_FILE = "capability-proof.json";
+const receiptActionType = (receipt) => receipt?.payload?.intent?.action_type;
+const receiptParams = (receipt) => {
+    const payload = receipt?.payload;
+    return payload?.intent?.params ?? {};
+};
+const FIXTURE_KEY = bindingKeyFromHex("00".repeat(32));
+/** Whether the adapter derives the typed operation a vector expects, from the same dispatched
+ *  actions and raw request the hook uses, against a deterministic fixture repository. */
+function typedDerived(vector, dispatched) {
+    if (!vector.typed)
+        return true;
+    const request = callRequestOf(vector.input);
+    const operations = operationsForCall({ dispatched: dispatched ?? [], request }, { key: FIXTURE_KEY, cwd: "/fixture", repositoryId: "sbr_fixture", probe: fixtureProbe, packageManagerVersion: () => undefined, files: fixtureFiles, env: () => undefined });
+    return operations.some((op) => op?.type === vector.typed.type && (vector.typed.verb === undefined || op.verb === vector.typed.verb));
+}
+async function run(vector, runtime, attesterPem) {
+    const decision = await runtime.evaluate(fillPushBranch(mapVector(vector), "feature/work"), { groupKey: `proof:${vector.id}` });
+    const receipts = decision.receipts ?? (decision.receipt ? [decision.receipt] : []);
+    const valid = receipts.length > 0 && receipts.every((r) => verifyReceipt(r, attesterPem).valid);
+    const groups = new Set(receipts.map((r) => receiptParams(r)[ACTION_GROUP_PARAM]));
+    const grouped = receipts.length > 0 && groups.size === 1 && typeof [...groups][0] === "string" && String([...groups][0]) !== "";
+    return { decision: decision.decision, receipts, valid, grouped, typed: typedDerived(vector, decision.dispatched) };
+}
+/** Run one cell's fixtures in a temp hook home. Returns null when the cell has no vectors. */
+async function proveCell(adapter, actionType, phase, observationOnly, adapterVersion, options) {
+    const vectors = vectorsForCell(adapter, actionType, phase);
+    const digest = vectorDigest(vectors);
+    if (digest === null)
+        return null;
+    const dir = mkdtempSync(join(tmpdir(), "scopebond-proof-"));
+    let runtime;
+    try {
+        if (options.identityDir) {
+            for (const name of ["agent.key", "attester.key"]) {
+                const source = join(options.identityDir, name);
+                if (existsSync(source))
+                    copyFileSync(source, join(dir, name));
+            }
+        }
+        scaffold(dir);
+        const attesterPath = join(dir, "attester.key");
+        const { attester } = loadOrCreateAttester({ file: attesterPath });
+        runtime = createHookRuntime({ policyPath: join(dir, "policy.json"), keyPath: join(dir, "agent.key"), attesterPath, dbPath: join(dir, "receipts.db") });
+        const allow = vectors.filter((v) => v.cell?.role === "allow" || v.cell?.role === "after_action");
+        const deny = vectors.filter((v) => v.cell?.role === "deny");
+        const allowed = [];
+        for (const v of allow)
+            allowed.push(await run(v, runtime, attester.publicKeyPem));
+        const denied = [];
+        if (!observationOnly)
+            for (const v of deny)
+                denied.push(await run(v, runtime, attester.publicKeyPem));
+        const all = [...allowed, ...denied];
+        const receipts = all.flatMap((o) => o.receipts);
+        // Only receipts of the cell's own action type stand as its proof (a compound command can
+        // also produce receipts of other types), and each is named by the workspace's projection.
+        const proofDigests = [...new Set(receipts.filter((r) => receiptActionType(r) === actionType).map((r) => sourceReceiptHash(r)))];
+        return { receipts, proof: {
+                ran_at: new Date().toISOString(), adapter_version: adapterVersion, test_vector_digest: digest, origin: "fixture",
+                safe_allow: allowed.length > 0 && allowed.every((o) => o.decision !== "deny" && o.receipts.length > 0),
+                safe_deny: observationOnly ? "not_applicable" : denied.length > 0 && denied.every((o) => o.decision === "deny"),
+                signature: all.length > 0 && all.every((o) => o.valid),
+                grouping: all.length > 0 && all.every((o) => o.grouped),
+                cloud_ack: "not_checked", observation_only: observationOnly, proof_digests: proofDigests,
+                ...(vectors.some((v) => v.typed) ? { typed_operation: all.length > 0 && all.every((o) => o.typed !== false) } : {}),
+            } };
+    }
+    finally {
+        try {
+            runtime?.close();
+        }
+        catch { /* the temp home is removed next */ }
+        try {
+            rmSync(dir, { recursive: true, force: true, maxRetries: 5 });
+        }
+        catch { /* a handle still open on Windows; the OS temp dir is cleaned later */ }
+    }
+}
+/** Run every supported cell's fixtures once per adapter/action/phase, and record the
+ *  result under each host variant's key. A fixture exercises the adapter, so it cannot
+ *  tell Codex desktop from Codex CLI: both keys get the same fixture proof, and neither
+ *  becomes verified (see `cellState`). */
+export async function runProofFixtures(adapterVersion, options = {}) {
+    const cells = computeManifest({ adapterVersion, configured: { claude: true, codex: true, cursor: true } }).cells;
+    const records = {};
+    const cache = new Map();
+    for (const cell of cells) {
+        if (cell.state === "unsupported")
+            continue;
+        const spec = specForCell(cell);
+        if (!spec)
+            continue;
+        const id = `${spec.adapter}/${spec.action_type}/${spec.phase}`;
+        if (!cache.has(id)) {
+            const run = await proveCell(spec.adapter, spec.action_type, spec.phase, cell.observation_only, adapterVersion, options);
+            if (run)
+                options.collect?.push(...run.receipts);
+            cache.set(id, run?.proof ?? null);
+        }
+        const proof = cache.get(id);
+        if (proof)
+            records[cell.key] = { cell: cell.key, ...proof };
+    }
+    return records;
+}
+export function loadProofs(configDir) {
+    const file = join(configDir, PROOF_FILE);
+    if (!existsSync(file))
+        return {};
+    try {
+        const parsed = JSON.parse(readFileSync(file, "utf8"));
+        return parsed.proofs && typeof parsed.proofs === "object" ? parsed.proofs : {};
+    }
+    catch {
+        return {};
+    }
+}
+export function saveProofs(configDir, proofs) {
+    const file = join(configDir, PROOF_FILE);
+    writeFileSync(file, `${JSON.stringify({ version: 1, proofs }, null, 2)}\n`);
+    return file;
+}
+/** Whether a cell's fixture proof passed, for a summary line. */
+export const proofPassed = (proof, cell) => proof.safe_allow && (cell.observation_only ? proof.safe_deny === "not_applicable" : proof.safe_deny === true) && proof.signature && proof.grouping;
+/** Deliver fixture receipts to the workspace's receipt route and report whether every one was
+ *  accepted. A proof names these receipts by digest, so it is only worth sending after they
+ *  landed; anything short of full delivery leaves the proof unsent, never half-claimed. */
+export async function deliverProofReceipts(connection, receipts, options = {}) {
+    if (receipts.length === 0)
+        return true;
+    const exporter = createCloudExporter({
+        url: connection.url, credential: connection.credential, outbox: createMemoryCloudOutbox({ maxPending: Math.max(1000, receipts.length) }),
+        fetch: options.fetch, flushMs: 60_000,
+    });
+    try {
+        for (const receipt of receipts)
+            exporter.enqueue(receipt);
+        const deadline = Date.now() + (options.timeoutMs ?? 15_000);
+        while (exporter.pending() > 0 && Date.now() < deadline) {
+            await exporter.flush();
+            if (exporter.pending() > 0) {
+                if (exporter.status().consecutiveFailures > 0)
+                    return false;
+                await new Promise((resolve) => setTimeout(resolve, 25));
+            }
+        }
+        return exporter.pending() === 0;
+    }
+    finally {
+        exporter.stop();
+    }
+}
+//# sourceMappingURL=proof.js.map

package/dist/proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.js","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AAAA,uBAAuB;AACvB,EAAE;AACF,uFAAuF;AACvF,wFAAwF;AACxF,6EAA6E;AAC7E,sFAAsF;AACtF,EAAE;AACF,wFAAwF;AACxF,yFAAyF;AACzF,yFAAyF;AACzF,wFAAwF;AACxF,wFAAwF;AACxF,iFAAiF;AACjF,6CAA6C;AAC7C,EAAE;AACF,oFAAoF;AACpF,2EAA2E;AAC3E,yEAAyE;AAEzE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,aAAa,EAAsB,MAAM,oBAAoB,CAAC;AACrH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAuD,MAAM,mBAAmB,CAAC;AACpJ,OAAO,EAAE,SAAS,EAAe,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGhD,MAAM,CAAC,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAElD,MAAM,iBAAiB,GAAG,CAAC,OAAgB,EAAsB,EAAE,CAChE,OAA4E,EAAE,OAAO,EAAE,MAAM,EAAE,WAAiC,CAAC;AAapI,MAAM,aAAa,GAAG,CAAC,OAAgB,EAA2B,EAAE;IAClE,MAAM,OAAO,GAAI,OAAuF,EAAE,OAAO,CAAC;IAClH,OAAO,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;AACvC,CAAC,CAAC;AAIF,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AAEvD;yFACyF;AACzF,SAAS,YAAY,CAAC,MAAc,EAAE,UAAmG;IACvI,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,iBAAiB,CAAC,EAAE,UAAU,EAAE,UAAU,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5P,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,MAAM,CAAC,KAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAM,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,KAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1I,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,MAAc,EAAE,OAA6C,EAAE,WAAmB;IACnG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/H,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,aAAa,CAAC,CAAwC,EAAE,WAAW,CAAmC,CAAC,KAAK,CAAC,CAAC;IAC1K,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IAChI,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;AACrH,CAAC;AAED,8FAA8F;AAC9F,KAAK,UAAU,SAAS,CAAC,OAAgB,EAAE,UAAkB,EAAE,KAAoC,EAAE,eAAwB,EAAE,cAAsB,EAAE,OAAwB;IAC7K,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC5D,IAAI,OAAyD,CAAC;IAC9D,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;gBACjD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAC/C,IAAI,UAAU,CAAC,MAAM,CAAC;oBAAE,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/C,MAAM,EAAE,QAAQ,EAAE,GAAG,oBAAoB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAClE,OAAO,GAAG,iBAAiB,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC;QACvJ,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,cAAc,CAAC,CAAC;QACjG,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAc,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAClF,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,CAAC,eAAe;YAAE,KAAK,MAAM,CAAC,IAAI,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACtG,MAAM,GAAG,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAChD,yFAAyF;QACzF,0FAA0F;QAC1F,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChI,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE;gBACxB,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,eAAe,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS;gBAChH,UAAU,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;gBACtG,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC;gBAC/G,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBACtD,QAAQ,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;gBACvD,SAAS,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY;gBACxF,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpH,EAAE,CAAC;IACN,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,mCAAmC,CAAC,CAAC;QACvE,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,sEAAsE,CAAC,CAAC;IACxJ,CAAC;AACH,CAAC;AAED;;;0CAG0C;AAC1C,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,cAAsB,EAAE,UAA2B,EAAE;IAC1F,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;IACjH,MAAM,OAAO,GAAgC,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA4C,CAAC;IAClE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,KAAK,KAAK,aAAa;YAAE,SAAS;QAC3C,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;YACxH,IAAI,GAAG;gBAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;YAChD,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA6C,CAAC;QAClG,OAAO,MAAM,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAiB,EAAE,MAAmC;IAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACzC,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAkB,EAAE,IAAoB,EAAW,EAAE,CAC/E,KAAK,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC;AAErJ;;2FAE2F;AAC3F,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,UAA0B,EAAE,QAAmB,EAAE,UAAwD,EAAE;IACpJ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,QAAQ,GAAG,mBAAmB,CAAC;QACnC,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,uBAAuB,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxI,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM;KACtC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,KAAK,MAAM,OAAO,IAAI,QAAQ;YAAE,QAAQ,CAAC,OAAO,CAAC,OAAwB,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QAC5D,OAAO,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YACvD,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;YACvB,IAAI,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC3B,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,mBAAmB,GAAG,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC5D,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;YAAS,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;AAChC,CAAC","sourcesContent":["// Safe proof fixtures.\n//\n// For each supported capability cell this runs its tagged vectors end to end against a\n// throwaway hook home: a safe action must be allowed and countersigned; a violating one\n// must be denied at the hook boundary; every receipt must verify against the\n// countersigning key; and every receipt of one tool call must carry one action group.\n//\n// Nothing here touches a developer's real settings, policy, keys or receipts. Every run\n// creates its own directory under the OS temp dir, scaffolds a fresh machine key, policy\n// and store there, and deletes it afterwards. No network is used, so a fixture can never\n// produce a Cloud acknowledgement: `cloud_ack` is always `not_checked`, and `origin` is\n// always `fixture`. A cell therefore cannot reach `verified_reporting` from this runner\n// (see capabilities.ts); it can only show `configured_unverified` with a passing\n// fixture, or `degraded` with a failing one.\n//\n// Observation-only cells (Cursor's after-edit event, and monitor-mode fetch and MCP\n// calls) are proven with a known successful after-action fixture, labelled\n// observation-only. No deny fixture is run for them and none is claimed.\n\nimport { copyFileSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { createCloudExporter, createMemoryCloudOutbox, verifyReceipt, type SignedReceipt } from \"@scopebond/gateway\";\nimport { loadOrCreateAttester } from \"@scopebond/gateway/node\";\nimport { fillPushBranch } from \"./map.js\";\nimport { scaffold } from \"./init.js\";\nimport { createHookRuntime } from \"./runtime.js\";\nimport { ACTION_GROUP_PARAM } from \"./group.js\";\nimport { computeManifest, specForCell, vectorDigest, vectorsForCell, type Adapter, type CapabilityCell, type ProofRecord } from \"./capabilities.js\";\nimport { mapVector, type Vector } from \"./vectors.js\";\nimport { bindingKeyFromHex, operationsForCall, sourceReceiptHash } from \"./observation.js\";\nimport { callRequestOf, fixtureProbe } from \"./typed-ops.js\";\nimport { fixtureFiles } from \"./typed-infra.js\";\nimport type { HookConnection } from \"./cloud.js\";\n\nexport const PROOF_FILE = \"capability-proof.json\";\n\nconst receiptActionType = (receipt: unknown): string | undefined =>\n  (receipt as { payload?: { intent?: { action_type?: unknown } } } | undefined)?.payload?.intent?.action_type as string | undefined;\n\n/** Options for a fixture run. */\nexport interface ProofRunOptions {\n  /** A real hook config dir whose machine and countersigning keys the fixtures should be\n   *  signed with (copied into the temp home, never modified), so the workspace can accept\n   *  the fixture receipts and resolve a proof's digests against them. Without it the\n   *  fixtures use throwaway keys and produce no digests a workspace could resolve. */\n  identityDir?: string;\n  /** Receives every fixture receipt produced, once each, for delivery. */\n  collect?: unknown[];\n}\n\nconst receiptParams = (receipt: unknown): Record<string, unknown> => {\n  const payload = (receipt as { payload?: { intent?: { params?: Record<string, unknown> } } } | undefined)?.payload;\n  return payload?.intent?.params ?? {};\n};\n\ninterface Outcome { decision: string; receipts: unknown[]; valid: boolean; grouped: boolean; typed?: boolean }\n\nconst FIXTURE_KEY = bindingKeyFromHex(\"00\".repeat(32));\n\n/** Whether the adapter derives the typed operation a vector expects, from the same dispatched\n *  actions and raw request the hook uses, against a deterministic fixture repository. */\nfunction typedDerived(vector: Vector, dispatched: Array<{ action: { action_type: string; params: Record<string, unknown> } }> | undefined): boolean {\n  if (!vector.typed) return true;\n  const request = callRequestOf(vector.input);\n  const operations = operationsForCall({ dispatched: dispatched ?? [], request }, { key: FIXTURE_KEY, cwd: \"/fixture\", repositoryId: \"sbr_fixture\", probe: fixtureProbe, packageManagerVersion: () => undefined, files: fixtureFiles, env: () => undefined });\n  return operations.some((op) => op?.type === vector.typed!.type && (vector.typed!.verb === undefined || op.verb === vector.typed!.verb));\n}\n\nasync function run(vector: Vector, runtime: ReturnType<typeof createHookRuntime>, attesterPem: string): Promise<Outcome> {\n  const decision = await runtime.evaluate(fillPushBranch(mapVector(vector), \"feature/work\"), { groupKey: `proof:${vector.id}` });\n  const receipts = decision.receipts ?? (decision.receipt ? [decision.receipt] : []);\n  const valid = receipts.length > 0 && receipts.every((r) => (verifyReceipt(r as Parameters<typeof verifyReceipt>[0], attesterPem) as unknown as { valid: boolean }).valid);\n  const groups = new Set(receipts.map((r) => receiptParams(r)[ACTION_GROUP_PARAM]));\n  const grouped = receipts.length > 0 && groups.size === 1 && typeof [...groups][0] === \"string\" && String([...groups][0]) !== \"\";\n  return { decision: decision.decision, receipts, valid, grouped, typed: typedDerived(vector, decision.dispatched) };\n}\n\n/** Run one cell's fixtures in a temp hook home. Returns null when the cell has no vectors. */\nasync function proveCell(adapter: Adapter, actionType: string, phase: \"pre_action\" | \"after_action\", observationOnly: boolean, adapterVersion: string, options: ProofRunOptions): Promise<{ proof: Omit<ProofRecord, \"cell\">; receipts: unknown[] } | null> {\n  const vectors = vectorsForCell(adapter, actionType, phase);\n  const digest = vectorDigest(vectors);\n  if (digest === null) return null;\n  const dir = mkdtempSync(join(tmpdir(), \"scopebond-proof-\"));\n  let runtime: ReturnType<typeof createHookRuntime> | undefined;\n  try {\n    if (options.identityDir) {\n      for (const name of [\"agent.key\", \"attester.key\"]) {\n        const source = join(options.identityDir, name);\n        if (existsSync(source)) copyFileSync(source, join(dir, name));\n      }\n    }\n    scaffold(dir);\n    const attesterPath = join(dir, \"attester.key\");\n    const { attester } = loadOrCreateAttester({ file: attesterPath });\n    runtime = createHookRuntime({ policyPath: join(dir, \"policy.json\"), keyPath: join(dir, \"agent.key\"), attesterPath, dbPath: join(dir, \"receipts.db\") });\n    const allow = vectors.filter((v) => v.cell?.role === \"allow\" || v.cell?.role === \"after_action\");\n    const deny = vectors.filter((v) => v.cell?.role === \"deny\");\n    const allowed: Outcome[] = [];\n    for (const v of allow) allowed.push(await run(v, runtime, attester.publicKeyPem));\n    const denied: Outcome[] = [];\n    if (!observationOnly) for (const v of deny) denied.push(await run(v, runtime, attester.publicKeyPem));\n    const all = [...allowed, ...denied];\n    const receipts = all.flatMap((o) => o.receipts);\n    // Only receipts of the cell's own action type stand as its proof (a compound command can\n    // also produce receipts of other types), and each is named by the workspace's projection.\n    const proofDigests = [...new Set(receipts.filter((r) => receiptActionType(r) === actionType).map((r) => sourceReceiptHash(r)))];\n    return { receipts, proof: {\n      ran_at: new Date().toISOString(), adapter_version: adapterVersion, test_vector_digest: digest, origin: \"fixture\",\n      safe_allow: allowed.length > 0 && allowed.every((o) => o.decision !== \"deny\" && o.receipts.length > 0),\n      safe_deny: observationOnly ? \"not_applicable\" : denied.length > 0 && denied.every((o) => o.decision === \"deny\"),\n      signature: all.length > 0 && all.every((o) => o.valid),\n      grouping: all.length > 0 && all.every((o) => o.grouped),\n      cloud_ack: \"not_checked\", observation_only: observationOnly, proof_digests: proofDigests,\n      ...(vectors.some((v) => v.typed) ? { typed_operation: all.length > 0 && all.every((o) => o.typed !== false) } : {}),\n    } };\n  } finally {\n    try { runtime?.close(); } catch { /* the temp home is removed next */ }\n    try { rmSync(dir, { recursive: true, force: true, maxRetries: 5 }); } catch { /* a handle still open on Windows; the OS temp dir is cleaned later */ }\n  }\n}\n\n/** Run every supported cell's fixtures once per adapter/action/phase, and record the\n *  result under each host variant's key. A fixture exercises the adapter, so it cannot\n *  tell Codex desktop from Codex CLI: both keys get the same fixture proof, and neither\n *  becomes verified (see `cellState`). */\nexport async function runProofFixtures(adapterVersion: string, options: ProofRunOptions = {}): Promise<Record<string, ProofRecord>> {\n  const cells = computeManifest({ adapterVersion, configured: { claude: true, codex: true, cursor: true } }).cells;\n  const records: Record<string, ProofRecord> = {};\n  const cache = new Map<string, Omit<ProofRecord, \"cell\"> | null>();\n  for (const cell of cells) {\n    if (cell.state === \"unsupported\") continue;\n    const spec = specForCell(cell);\n    if (!spec) continue;\n    const id = `${spec.adapter}/${spec.action_type}/${spec.phase}`;\n    if (!cache.has(id)) {\n      const run = await proveCell(spec.adapter, spec.action_type, spec.phase, cell.observation_only, adapterVersion, options);\n      if (run) options.collect?.push(...run.receipts);\n      cache.set(id, run?.proof ?? null);\n    }\n    const proof = cache.get(id);\n    if (proof) records[cell.key] = { cell: cell.key, ...proof };\n  }\n  return records;\n}\n\nexport function loadProofs(configDir: string): Record<string, ProofRecord> {\n  const file = join(configDir, PROOF_FILE);\n  if (!existsSync(file)) return {};\n  try {\n    const parsed = JSON.parse(readFileSync(file, \"utf8\")) as { proofs?: Record<string, ProofRecord> };\n    return parsed.proofs && typeof parsed.proofs === \"object\" ? parsed.proofs : {};\n  } catch { return {}; }\n}\n\nexport function saveProofs(configDir: string, proofs: Record<string, ProofRecord>): string {\n  const file = join(configDir, PROOF_FILE);\n  writeFileSync(file, `${JSON.stringify({ version: 1, proofs }, null, 2)}\\n`);\n  return file;\n}\n\n/** Whether a cell's fixture proof passed, for a summary line. */\nexport const proofPassed = (proof: ProofRecord, cell: CapabilityCell): boolean =>\n  proof.safe_allow && (cell.observation_only ? proof.safe_deny === \"not_applicable\" : proof.safe_deny === true) && proof.signature && proof.grouping;\n\n/** Deliver fixture receipts to the workspace's receipt route and report whether every one was\n *  accepted. A proof names these receipts by digest, so it is only worth sending after they\n *  landed; anything short of full delivery leaves the proof unsent, never half-claimed. */\nexport async function deliverProofReceipts(connection: HookConnection, receipts: unknown[], options: { fetch?: typeof fetch; timeoutMs?: number } = {}): Promise<boolean> {\n  if (receipts.length === 0) return true;\n  const exporter = createCloudExporter({\n    url: connection.url, credential: connection.credential, outbox: createMemoryCloudOutbox({ maxPending: Math.max(1000, receipts.length) }),\n    fetch: options.fetch, flushMs: 60_000,\n  });\n  try {\n    for (const receipt of receipts) exporter.enqueue(receipt as SignedReceipt);\n    const deadline = Date.now() + (options.timeoutMs ?? 15_000);\n    while (exporter.pending() > 0 && Date.now() < deadline) {\n      await exporter.flush();\n      if (exporter.pending() > 0) {\n        if (exporter.status().consecutiveFailures > 0) return false;\n        await new Promise((resolve) => setTimeout(resolve, 25));\n      }\n    }\n    return exporter.pending() === 0;\n  } finally { exporter.stop(); }\n}\n"]}

package/dist/rules.d.ts

@@ -28,6 +28,16 @@ export interface RuleSet {
     protected_read: PathRule[];
     /** Action types recorded but not blocked. */
     observe: string[];
+    /** Optional workspace scope. When set, a write whose physical target (symlinks and
+     *  junctions followed, rename and link destinations included) is outside these roots,
+     *  or cannot be resolved, is denied. `.` means the project directory. Absent = not
+     *  enforced, which is the default. */
+    allowed_roots?: string[];
+    /** Optional. When true, a shell command that runs SQL against a remote database (a Wrangler
+     *  D1 command without --local, or psql to a host other than this machine) is denied before it
+     *  runs if the SQL drops a table, deletes or updates every row, drops or renames in an ALTER, or
+     *  cannot be read. Absent = not enforced, which is the default. */
+    protect_remote_database?: boolean;
 }
 export declare const RULES_FILE = "rules.json";
 /** A protected-path rule from a plain path the user typed. A trailing `/` (or a path with
@@ -46,6 +56,16 @@ export declare function defaultRules(): RuleSet;
 export declare const rulesPath: (dir: string) => string;
 export declare function loadRules(configDir: string): RuleSet | null;
 export declare function saveRules(configDir: string, rules: RuleSet): string;
+/** Whether `path` is inside the location a protected-path rule names. This is the same
+ *  pattern the compiled policy evaluates (the rule allows a path when the pattern's
+ *  negative lookahead matches), tested rule by rule so a classification can say which
+ *  kind of location it was. */
+export declare function pathRuleMatches(rule: PathRule, path: string): boolean;
+/** Whether a shell program is on the destructive list, folded the way the compiled
+ *  policy folds it: case-insensitive, without an executable suffix. */
+export declare function isDestructiveProgram(rules: RuleSet, program: string): boolean;
+/** Whether a push destination is one of the protected refs (`release/*` is a prefix). */
+export declare function isProtectedBranch(rules: RuleSet, ref: string): boolean;
 /** Plain English, for `scopebond-hook rules`. */
 export declare function describeRules(rules: RuleSet): string;
 //# sourceMappingURL=rules.d.ts.map

package/dist/rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAsBA;;6EAE6E;AAC7E,MAAM,MAAM,QAAQ,GAChB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,CAAC,CAAC;IACX,8EAA8E;IAC9E,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,2EAA2E;IAC3E,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,eAAe,EAAE,QAAQ,EAAE,CAAC;IAC5B,cAAc,EAAE,QAAQ,EAAE,CAAC;IAC3B,6CAA6C;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,eAAO,MAAM,UAAU,eAAe,CAAC;AAiBvC;;;;;;oCAMoC;AACpC,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAenD;AA6BD,gEAAgE;AAChE,wBAAgB,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgCjF;AAED;wDACwD;AACxD,wBAAgB,YAAY,IAAI,OAAO,CA0DtC;AAED,eAAO,MAAM,SAAS,GAAI,KAAK,MAAM,KAAG,MAA+B,CAAC;AAExE,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAQ3D;AAED,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAInE;AAED,iDAAiD;AACjD,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAiBpD"}
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../src/rules.ts"],"names":[],"mappings":"AAsBA;;6EAE6E;AAC7E,MAAM,MAAM,QAAQ,GAChB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,CAAC,CAAC;IACX,8EAA8E;IAC9E,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,2EAA2E;IAC3E,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,eAAe,EAAE,QAAQ,EAAE,CAAC;IAC5B,cAAc,EAAE,QAAQ,EAAE,CAAC;IAC3B,6CAA6C;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;0CAGsC;IACtC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;uEAGmE;IACnE,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,eAAO,MAAM,UAAU,eAAe,CAAC;AAiBvC;;;;;;oCAMoC;AACpC,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAenD;AA6BD,gEAAgE;AAChE,wBAAgB,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0CjF;AAED;wDACwD;AACxD,wBAAgB,YAAY,IAAI,OAAO,CAmEtC;AAED,eAAO,MAAM,SAAS,GAAI,KAAK,MAAM,KAAG,MAA+B,CAAC;AAExE,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAQ3D;AAED,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAInE;AAED;;;+BAG+B;AAC/B,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAGrE;AAED;uEACuE;AACvE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAG7E;AAED,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAMtE;AAED,iDAAiD;AACjD,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAyBpD"}

package/dist/rules.js

@@ -107,6 +107,16 @@ export function compile(rules, agentKid) {
                 action_types: rules.observe,
                 description: `Observe ${sentence(rules.observe)} — recorded, not blocked. Add bounds to enforce. Change this list in .scopebond/${RULES_FILE}.`,
             },
+            ...(rules.allowed_roots?.length ? [{
+                    id: "protect-root", type: "action_allowlist", mode: "enforce", action_types: ["file.write"],
+                    param_bounds: { root_scope: { pattern: "^inside$" } },
+                    description: `Deny writes whose physical target is outside ${sentence(rules.allowed_roots)} — symlinks, junctions, rename and link destinations followed — and writes whose target cannot be resolved. Change these in .scopebond/${RULES_FILE}.`,
+                }] : []),
+            ...(rules.protect_remote_database ? [{
+                    id: "protect-remote-database", type: "action_allowlist", mode: "enforce", action_types: ["db.exec"],
+                    param_bounds: { risk: { pattern: "^ordinary$" } },
+                    description: `Deny shell commands that run SQL against a remote database (a wrangler d1 command without --local, or psql to a host other than this machine) when the SQL drops a table, deletes or updates every row, drops or renames inside an ALTER, or cannot be read. The hook cannot tell which database is production, so every remote database is covered. Change this in .scopebond/${RULES_FILE}.`,
+                }] : []),
             { id: "keys", type: "key_policy", active_keys: [agentKid], description: "Only the enrolled machine key may sign." },
         ],
     };
@@ -130,6 +140,8 @@ export function defaultRules() {
             { kind: "under", value: "\\.git/hooks", label: "git hooks" },
             { kind: "named", value: "\\.git/config", label: "git config" },
             { kind: "under", value: "\\.husky", label: "Husky hooks" },
+            { kind: "named", value: "\\.cursor/mcp\\.json", label: "Cursor MCP config" },
+            { kind: "under", value: "\\.githooks", label: "git hooks (.githooks)" },
             { kind: "under", value: "\\.github/workflows", label: "GitHub workflows" },
             { kind: "under", value: "\\.github/actions", label: "GitHub actions" },
             { kind: "named", value: "\\.gitlab-ci\\.yml", label: ".gitlab-ci.yml" },
@@ -137,6 +149,13 @@ export function defaultRules() {
             { kind: "under", value: "\\.circleci", label: "CircleCI config" },
             { kind: "named", value: "azure-pipelines\\.yml", label: "azure-pipelines.yml" },
             { kind: "named", value: "Jenkinsfile", label: "Jenkinsfile" },
+            { kind: "named", value: "azure-pipelines\\.yaml", label: "azure-pipelines.yaml" },
+            { kind: "named", value: "bitbucket-pipelines\\.yml", label: "bitbucket-pipelines.yml" },
+            { kind: "named", value: "\\.travis\\.yml", label: ".travis.yml" },
+            { kind: "named", value: "\\.drone\\.yml", label: ".drone.yml" },
+            { kind: "named", value: "cloudbuild\\.yaml", label: "cloudbuild.yaml" },
+            { kind: "named", value: "cloudbuild\\.yml", label: "cloudbuild.yml" },
+            { kind: "under", value: "\\.buildkite", label: "Buildkite pipelines" },
         ],
         protected_read: [
             { kind: "under", value: "\\.scopebond", label: "the hook's own policy and keys (.scopebond)" },
@@ -192,6 +211,29 @@ export function saveRules(configDir, rules) {
     writeFileSync(file, `${JSON.stringify(rules, null, 2)}\n`);
     return file;
 }
+/** Whether `path` is inside the location a protected-path rule names. This is the same
+ *  pattern the compiled policy evaluates (the rule allows a path when the pattern's
+ *  negative lookahead matches), tested rule by rule so a classification can say which
+ *  kind of location it was. */
+export function pathRuleMatches(rule, path) {
+    if (path === "")
+        return false;
+    return !new RegExp(`^${pathPattern(rule)}.+`).test(path);
+}
+/** Whether a shell program is on the destructive list, folded the way the compiled
+ *  policy folds it: case-insensitive, without an executable suffix. */
+export function isDestructiveProgram(rules, program) {
+    const name = program.toLowerCase().replace(/\.(?:exe|cmd|bat|com|ps1)$/, "");
+    return name !== "" && rules.destructive_programs.some((p) => p.toLowerCase() === name);
+}
+/** Whether a push destination is one of the protected refs (`release/*` is a prefix). */
+export function isProtectedBranch(rules, ref) {
+    const name = ref.toLowerCase();
+    return rules.protected_branches.some((b) => {
+        const p = b.toLowerCase();
+        return p.endsWith("/*") ? name.startsWith(p.slice(0, -1)) : name === p;
+    });
+}
 /** Plain English, for `scopebond-hook rules`. */
 export function describeRules(rules) {
     const lines = [];
@@ -209,6 +251,14 @@ export function describeRules(rules) {
     for (const rule of rules.protected_read)
         lines.push(`                       ${rule.label}`);
     lines.push("");
+    if (rules.protect_remote_database) {
+        lines.push(`  remote SQL         that drops a table, deletes or updates every row, or cannot be read`);
+        lines.push("");
+    }
+    if (rules.allowed_roots?.length) {
+        lines.push(`  writes outside     ${rules.allowed_roots.join(", ")} (physical target; unresolved targets too)`);
+        lines.push("");
+    }
     lines.push("Recorded, not blocked:");
     lines.push(`  ${rules.observe.join(", ")}`);
     return lines.join("\n");