@skrr-ai/cli 0.1.93 → 0.1.94

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/commitmentExecutionContract.js

@@ -0,0 +1,550 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COMMITMENT_EXECUTION_CONTRACT_CAPABILITY = exports.COMMITMENT_EXECUTION_CONTRACT_VERSION = void 0;
+exports.eventRepository = eventRepository;
+exports.normalizeCommitmentExecutionContract = normalizeCommitmentExecutionContract;
+const node_util_1 = require("node:util");
+/** Mode-free responsibility context. Tool permissions belong to the Agent runtime. */
+exports.COMMITMENT_EXECUTION_CONTRACT_VERSION = 3;
+exports.COMMITMENT_EXECUTION_CONTRACT_CAPABILITY = 'commitment_execution_contract_v3';
+const DELIVERY_MODES = new Set([
+    'report_only',
+    'local_patch',
+    'draft_pr',
+    'push_branch',
+    'direct_branch',
+]);
+const FACT_KEYS = new Set([
+    'id',
+    'source',
+    'type',
+    'eventType',
+    'checkName',
+    'workflowName',
+    'workflowRunId',
+    'revision',
+    'appId',
+    'appSlug',
+    'slug',
+    'app',
+    'action',
+    'status',
+    'conclusion',
+    'sha',
+    'headSha',
+    'head_sha',
+    'branch',
+    'headBranch',
+    'head_branch',
+    'repo',
+    'repository',
+    'fullName',
+    'full_name',
+    'repoFullName',
+    'prNumber',
+    'owner',
+    'name',
+    'number',
+    'checkRunId',
+    'check_run_id',
+    'runId',
+    'run_id',
+    'url',
+    'runUrl',
+    'htmlUrl',
+    'html_url',
+    'createdAt',
+    'updatedAt',
+    'occurredAt',
+    'completed_at',
+    'started_at',
+    'check_run',
+    'check_suite',
+    'workflow_run',
+    'pull_request',
+    'base',
+    'head',
+    'ref',
+    'eventId',
+    'rerun',
+    'checkAnnotations',
+    'path',
+    'startLine',
+    'endLine',
+    'level',
+    'message',
+    'title',
+]);
+const CAPABILITY_SOURCE_KEYS = new Set([
+    'source',
+    'provider',
+    'capability',
+    'scope',
+    'status',
+    'attestation',
+    'accountFingerprint',
+    'testedAt',
+    'expiresAt',
+    'runtimeId',
+    'reason',
+]);
+const WORKSPACE_CONSTRAINT_KEYS = new Set([
+    'allowedCommitmentDeliveryModes',
+    'requireAttestedAccessForDeliveryModes',
+    'maxInitiativesPerDay',
+    'maxAutoRunsPerDay',
+    'maxCommitmentActionRunsPerDay',
+    'maxCommitmentObservationRunsPerDay',
+    'maxCommitmentConcurrentRuns',
+    'maxCommitmentCostUsdPerDay',
+    'requireApprovalRiskLevels',
+    'requireApprovalActionClasses',
+    'blockedSourceKinds',
+]);
+const CAPABILITY_SOURCES = new Set([
+    'event_payload',
+    'cloud_runtime',
+    'local_harness',
+    'platform_grant',
+]);
+const CAPABILITY_STATUSES = new Set(['available', 'unavailable', 'unknown', 'stale']);
+const CAPABILITY_ATTESTATIONS = new Set(['platform', 'runtime', 'machine', 'none']);
+function plainObject(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function hasOnlyKeys(value, allowed) {
+    return plainObject(value) && Object.keys(value).every((key) => allowed.has(key));
+}
+function boundedString(value, max = 1000) {
+    return typeof value === 'string' && value.length > 0 && value.length <= max;
+}
+function optionalString(value, max = 1000) {
+    return typeof value === 'string' && value.length <= max;
+}
+function isoTimestamp(value) {
+    return (typeof value === 'string' &&
+        value.length <= 40 &&
+        Number.isFinite(Date.parse(value)) &&
+        new Date(value).toISOString() === value);
+}
+function normalizedEventFactValue(item, depth) {
+    if (typeof item === 'string') {
+        if (containsCredentialSignature(item))
+            return undefined;
+        return item.slice(0, 1000);
+    }
+    if (typeof item === 'number' || typeof item === 'boolean')
+        return item;
+    if (Array.isArray(item)) {
+        return item
+            .slice(0, 20)
+            .map((entry) => normalizedEventFacts(entry, depth + 1))
+            .filter((entry) => entry !== undefined);
+    }
+    return normalizedEventFacts(item, depth + 1);
+}
+const CREDENTIAL_SIGNATURE_RE = /(?:bearer\s+(?!\[REDACTED\](?:\s|$))\S{8,}|github_pat_[A-Za-z0-9_]{8,}|gh[pousr]_[A-Za-z0-9_]{8,}|xox[baprs]-[A-Za-z0-9-]{8,}|sk_(?:live|test)_[A-Za-z0-9]{8,}|(?:AKIA|ASIA)[A-Z0-9]{16}|eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}|[a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:(?!\[REDACTED\]@)[^\s/@]+@|-----BEGIN [A-Z ]*PRIVATE KEY-----)/i;
+function containsCredentialSignature(value) {
+    return typeof value === 'string' && CREDENTIAL_SIGNATURE_RE.test(value);
+}
+function normalizedEventFacts(value, depth = 0) {
+    if (!plainObject(value) || depth > 3)
+        return undefined;
+    return Object.fromEntries(Object.entries(value)
+        .filter(([key]) => FACT_KEYS.has(key))
+        .slice(0, 30)
+        .map(([key, item]) => [key, normalizedEventFactValue(item, depth)])
+        .filter(([, item]) => item !== undefined));
+}
+const CI_LOG_EVIDENCE_KEYS = new Set([
+    'version',
+    'provider',
+    'kind',
+    'repoFullName',
+    'checkRunId',
+    'workflowRunId',
+    'jobId',
+    'capability',
+    'attestation',
+    'fetchedAt',
+    'status',
+    'reason',
+    'byteLength',
+    'lineCount',
+    'excerptLines',
+    'excerpt',
+    'digest',
+    // Attribution facts, taken off the job row the server had to fetch to prove
+    // identity. Allowed on an UNREADABLE row: attribution happens before the
+    // download, so the failing step name survives a log the server could not
+    // read. Only text FROM the log is withheld when the read failed.
+    'jobName',
+    'failedStepName',
+    'failedStepNumber',
+]);
+const CI_LOG_EVIDENCE_STATUSES = new Set(['available', 'truncated', 'unavailable', 'unauthorized']);
+const CI_LOG_EVIDENCE_READABLE = new Set(['available', 'truncated']);
+const CI_LOG_EXCERPT_MAX_CHARS = 12_000;
+function validCiLogEvidence(value) {
+    if (!hasOnlyKeys(value, CI_LOG_EVIDENCE_KEYS))
+        return false;
+    if (value.version !== 1 ||
+        value.provider !== 'github' ||
+        value.kind !== 'actions_job_log' ||
+        value.capability !== 'github:actions:read' ||
+        value.attestation !== 'platform' ||
+        !CI_LOG_EVIDENCE_STATUSES.has(String(value.status)) ||
+        !isoTimestamp(value.fetchedAt) ||
+        !/^[\w.-]+\/[\w.-]+$/.test(String(value.repoFullName || '')) ||
+        !/^\d{1,20}$/.test(String(value.checkRunId || '')))
+        return false;
+    for (const key of ['workflowRunId', 'jobId']) {
+        if (value[key] !== undefined && !/^\d{1,20}$/.test(String(value[key])))
+            return false;
+    }
+    for (const key of ['byteLength', 'lineCount', 'excerptLines', 'failedStepNumber']) {
+        const item = value[key];
+        if (item !== undefined && (!Number.isSafeInteger(item) || item < 0))
+            return false;
+    }
+    for (const key of ['jobName', 'failedStepName']) {
+        if (value[key] !== undefined && !boundedString(value[key], 200))
+            return false;
+    }
+    if (value.reason !== undefined && !/^[a-z0-9_]{1,80}$/.test(String(value.reason)))
+        return false;
+    if (value.digest !== undefined && !/^[a-f0-9]{16}$/.test(String(value.digest)))
+        return false;
+    // A read that failed carries no text: an unreadable log must not be able to
+    // arrive looking like a readable one.
+    if (!CI_LOG_EVIDENCE_READABLE.has(String(value.status))) {
+        return value.excerpt === undefined && value.digest === undefined && Boolean(value.reason);
+    }
+    return boundedString(value.excerpt, CI_LOG_EXCERPT_MAX_CHARS) && value.jobId !== undefined;
+}
+function validEvidence(value) {
+    if (!hasOnlyKeys(value, new Set(['version', 'ci'])))
+        return false;
+    return (value.version === 1 &&
+        Array.isArray(value.ci) &&
+        value.ci.length >= 1 &&
+        value.ci.length <= 4 &&
+        value.ci.every(validCiLogEvidence));
+}
+// Mirror of `validObserve` in
+// api/server/services/Commitments/CommitmentExecutionContract.js. The daemon
+// has no projector, so canonical form is part of validity on both sides:
+// `egress` must be strictly ascending (sorted AND unique). The shared parity
+// fixture holds the two to one verdict.
+const OBSERVE_KEYS = new Set(['egress', 'web', 'shell', 'browser']);
+const OBSERVE_EGRESS_MAX = 32;
+const OBSERVE_HOST_PATTERN = /^(\*\.)?[a-z0-9.-]+$/;
+const OBSERVE_HOST_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function evidenceMatchesEvent(row, event) {
+    if (!plainObject(row) || !plainObject(event))
+        return true;
+    const same = (a, b) => String(a).toLowerCase() === String(b).toLowerCase();
+    if (event.repoFullName !== undefined && !same(row.repoFullName, event.repoFullName))
+        return false;
+    if (event.checkRunId !== undefined && !same(row.checkRunId, event.checkRunId))
+        return false;
+    if (row.workflowRunId !== undefined &&
+        event.workflowRunId !== undefined &&
+        !same(row.workflowRunId, event.workflowRunId))
+        return false;
+    return true;
+}
+function validCapabilitySource(value) {
+    if (!hasOnlyKeys(value, CAPABILITY_SOURCE_KEYS))
+        return false;
+    if (!CAPABILITY_SOURCES.has(String(value.source)) ||
+        !boundedString(value.provider, 80) ||
+        !/^[a-z0-9_.-]{1,80}$/i.test(value.provider) ||
+        !boundedString(value.capability, 120) ||
+        !/^[a-z0-9_:.-]{1,120}$/i.test(value.capability) ||
+        !CAPABILITY_STATUSES.has(String(value.status)) ||
+        !CAPABILITY_ATTESTATIONS.has(String(value.attestation)))
+        return false;
+    if (value.scope !== undefined && !optionalString(value.scope, 500))
+        return false;
+    if (value.accountFingerprint !== undefined &&
+        !/^[a-f0-9]{64}$/i.test(String(value.accountFingerprint)))
+        return false;
+    if (value.testedAt !== undefined && !isoTimestamp(value.testedAt))
+        return false;
+    if (value.expiresAt !== undefined && !isoTimestamp(value.expiresAt))
+        return false;
+    if (value.testedAt &&
+        value.expiresAt &&
+        Date.parse(String(value.expiresAt)) <= Date.parse(String(value.testedAt)))
+        return false;
+    if (value.runtimeId !== undefined && !boundedString(value.runtimeId, 200))
+        return false;
+    if (value.reason !== undefined && !optionalString(value.reason, 1000))
+        return false;
+    if (value.source === 'event_payload' && value.attestation !== 'platform')
+        return false;
+    if (value.source === 'platform_grant' && value.attestation !== 'platform')
+        return false;
+    if (value.source === 'local_harness' &&
+        (!['machine', 'none'].includes(String(value.attestation)) ||
+            (value.status === 'available' &&
+                (value.attestation !== 'machine' ||
+                    !value.accountFingerprint ||
+                    !value.testedAt ||
+                    !value.expiresAt ||
+                    !value.runtimeId))))
+        return false;
+    if (value.source === 'cloud_runtime' &&
+        (!['runtime', 'none'].includes(String(value.attestation)) ||
+            (value.status === 'available' &&
+                (value.attestation !== 'runtime' ||
+                    !value.accountFingerprint ||
+                    !value.testedAt ||
+                    !value.expiresAt ||
+                    !value.runtimeId))))
+        return false;
+    return true;
+}
+function validStringArray(value, max, values) {
+    return (Array.isArray(value) &&
+        value.length <= max &&
+        value.every((item) => boundedString(item, 120) && (!values || values.has(item))));
+}
+function validWorkspacePolicy(value) {
+    if (!hasOnlyKeys(value, new Set(['hardStop', 'hardConstraints'])))
+        return false;
+    if (value.hardStop !== undefined && value.hardStop !== null) {
+        if (!hasOnlyKeys(value.hardStop, new Set(['enabled', 'reason', 'scope'])))
+            return false;
+        if (typeof value.hardStop.enabled !== 'boolean')
+            return false;
+        if (value.hardStop.reason !== undefined && !optionalString(value.hardStop.reason, 1000))
+            return false;
+        if (value.hardStop.scope !== undefined && !optionalString(value.hardStop.scope, 100))
+            return false;
+    }
+    if (value.hardConstraints === undefined)
+        return true;
+    if (!hasOnlyKeys(value.hardConstraints, WORKSPACE_CONSTRAINT_KEYS))
+        return false;
+    for (const [key, item] of Object.entries(value.hardConstraints)) {
+        if (item === null)
+            continue;
+        if (key === 'allowedCommitmentDeliveryModes' ||
+            key === 'requireAttestedAccessForDeliveryModes') {
+            if (!validStringArray(item, 5, DELIVERY_MODES))
+                return false;
+        }
+        else if (key === 'maxCommitmentCostUsdPerDay') {
+            if (typeof item !== 'number' || !Number.isFinite(item) || item < 0)
+                return false;
+        }
+        else if (key.startsWith('max')) {
+            if (!Number.isSafeInteger(item) || Number(item) < 0)
+                return false;
+        }
+        else if (key === 'requireApprovalRiskLevels') {
+            if (!validStringArray(item, 3, new Set(['low', 'medium', 'high'])))
+                return false;
+        }
+        else if (!validStringArray(item, key === 'blockedSourceKinds' ? 50 : 20))
+            return false;
+    }
+    return true;
+}
+function validBranch(value) {
+    return (boundedString(value, 255) &&
+        value !== 'HEAD' &&
+        !value.startsWith('refs/') &&
+        !value.startsWith('origin/') &&
+        !value.startsWith('-') &&
+        !value.startsWith('/') &&
+        !value.endsWith('/') &&
+        !value.endsWith('.') &&
+        // Control characters are exactly what this rejects: a Git ref name may not
+        // contain them, so the class is deliberate rather than an oversight.
+        // eslint-disable-next-line no-control-regex
+        !/[\s~^:?*[\\\x00-\x1f\x7f]/.test(value) &&
+        !value.includes('..') &&
+        !value.includes('@{') &&
+        !value.includes('//') &&
+        value !== '@' &&
+        !value.split('/').some((part) => part.startsWith('.') || part.endsWith('.lock')));
+}
+function validDelivery(value) {
+    if (!hasOnlyKeys(value, new Set(['version', 'mode', 'repo', 'baseBranch', 'expectations'])))
+        return false;
+    if (value.version !== 1 || !DELIVERY_MODES.has(String(value.mode)))
+        return false;
+    if (value.repo !== undefined &&
+        (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(String(value.repo)) ||
+            String(value.repo) !== String(value.repo).toLowerCase()))
+        return false;
+    if (value.baseBranch !== undefined && !validBranch(value.baseBranch))
+        return false;
+    if (['draft_pr', 'push_branch', 'direct_branch'].includes(String(value.mode)) &&
+        (!value.repo || !value.baseBranch))
+        return false;
+    if (value.expectations !== undefined) {
+        if (!Array.isArray(value.expectations) || value.expectations.length > 20)
+            return false;
+        const ids = new Set();
+        const allowed = new Set([
+            'id',
+            'shape',
+            'kind',
+            'format',
+            'target',
+            'minimumAuthority',
+            'description',
+            'presetKey',
+        ]);
+        for (const expectation of value.expectations) {
+            if (!hasOnlyKeys(expectation, allowed) ||
+                !['code', 'page', 'url', 'file', 'message', 'dataset'].includes(String(expectation.kind)))
+                return false;
+            if (expectation.id !== undefined) {
+                if (!boundedString(expectation.id, 64) ||
+                    expectation.id === 'commitment-delivery' ||
+                    ids.has(expectation.id))
+                    return false;
+                ids.add(expectation.id);
+            }
+            if (expectation.shape !== undefined &&
+                !['checkable', 'judged'].includes(String(expectation.shape)))
+                return false;
+            if (expectation.minimumAuthority !== undefined &&
+                !['self_reported', 'human_confirmed', 'observation_backed'].includes(String(expectation.minimumAuthority)))
+                return false;
+            for (const [key, max] of [
+                ['format', 40],
+                ['target', 500],
+                ['description', 500],
+                ['presetKey', 64],
+            ]) {
+                if (expectation[key] !== undefined && !optionalString(expectation[key], max))
+                    return false;
+            }
+        }
+    }
+    return true;
+}
+function validDeliverySource(value) {
+    if (!hasOnlyKeys(value, new Set(['parentTaskId', 'branch', 'headSha', 'baseCommit', 'runtime'])))
+        return false;
+    return (typeof value.parentTaskId === 'string' &&
+        value.parentTaskId.length > 0 &&
+        value.parentTaskId.length <= 200 &&
+        typeof value.branch === 'string' &&
+        /^[A-Za-z0-9][A-Za-z0-9_./-]{0,239}$/.test(value.branch) &&
+        !value.branch.includes('..') &&
+        !value.branch.includes('@{') &&
+        /^[a-f0-9]{40,64}$/i.test(value.headSha) &&
+        typeof value.baseCommit === 'string' &&
+        /^[a-f0-9]{40,64}$/i.test(value.baseCommit) &&
+        hasOnlyKeys(value.runtime, new Set(['kind', 'id'])) &&
+        ['local_daemon', 'hosted_machine'].includes(String(value.runtime.kind)) &&
+        boundedString(value.runtime.id, 200) &&
+        (value.runtime.kind !== 'hosted_machine' || value.runtime.id.startsWith('sbs_')));
+}
+function eventSourceRevision(event) {
+    if (!event)
+        return '';
+    const nestedCheck = event.check_run;
+    const nestedWorkflow = event.workflow_run;
+    const value = event.headSha ||
+        event.head_sha ||
+        event.sha ||
+        nestedCheck?.head_sha ||
+        nestedWorkflow?.head_sha;
+    return /^[a-f0-9]{40,64}$/i.test(String(value || '')) ? String(value).toLowerCase() : '';
+}
+function eventRepository(event) {
+    if (!event)
+        return '';
+    const repository = event.repository;
+    const value = event.repoFullName || repository?.full_name || repository?.fullName;
+    return /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(String(value || ''))
+        ? String(value).toLowerCase()
+        : '';
+}
+function failedGitHubCheck(event) {
+    const eventType = String(event?.eventType || event?.type || '').toLowerCase();
+    return eventType === 'github.check_run_failed' || eventType === 'check_run_failed';
+}
+/** One strict parser used at storage admission and at runtime admission. */
+function normalizeCommitmentExecutionContract(value) {
+    if (!hasOnlyKeys(value, new Set([
+        'version',
+        'kind',
+        'responsibilityRef',
+        'responsibility',
+        'event',
+        'workspace',
+        'delivery',
+        'capabilitySources',
+        'evidence',
+        'workspacePolicy',
+        'deliverySource',
+        'mustNot',
+        'return',
+    ])))
+        return null;
+    const contract = value;
+    const event = contract.event === undefined ? null : contract.event;
+    const eventSha = eventSourceRevision(event);
+    const eventRepo = eventRepository(event);
+    const taskDelivery = contract.kind === 'task_delivery';
+    if (contract.version !== exports.COMMITMENT_EXECUTION_CONTRACT_VERSION ||
+        !['commitment', 'task_delivery'].includes(contract.kind) ||
+        !hasOnlyKeys(contract.responsibilityRef, new Set(['kind', 'id', 'version'])) ||
+        contract.responsibilityRef.kind !== (taskDelivery ? 'task' : 'commitment') ||
+        !boundedString(contract.responsibilityRef.id, 240) ||
+        !Number.isSafeInteger(contract.responsibilityRef.version) ||
+        contract.responsibilityRef.version < 1 ||
+        !boundedString(contract.responsibility, 2000) ||
+        !hasOnlyKeys(contract.workspace, new Set(['kind', 'base', 'fetchBase'])) ||
+        contract.workspace.kind !== 'ephemeral' ||
+        !boundedString(contract.workspace.base, 255) ||
+        (contract.workspace.fetchBase !== undefined &&
+            (contract.workspace.fetchBase !== true || contract.workspace.kind !== 'ephemeral')) ||
+        !validDelivery(contract.delivery) ||
+        !Array.isArray(contract.capabilitySources) ||
+        contract.capabilitySources.length > 32 ||
+        !contract.capabilitySources.every(validCapabilitySource) ||
+        !validWorkspacePolicy(contract.workspacePolicy ?? {}) ||
+        !(0, node_util_1.isDeepStrictEqual)(contract.mustNot, [
+            'change_workspace_administration',
+            'broaden_credentials',
+            ...(taskDelivery ? ['reimplement_source_work'] : []),
+        ]) ||
+        (taskDelivery
+            ? contract.return !== 'task_output'
+            : contract.return !== 'commitment_result_v1') ||
+        (event !== null &&
+            (!plainObject(event) || !(0, node_util_1.isDeepStrictEqual)(event, normalizedEventFacts(event)))) ||
+        (eventSha && contract.workspace.base.toLowerCase() !== eventSha) ||
+        (eventRepo &&
+            contract.delivery.repo &&
+            String(contract.delivery.repo).toLowerCase() !== eventRepo) ||
+        (failedGitHubCheck(event) && (!eventSha || !eventRepo)) ||
+        (contract.evidence !== undefined &&
+            (taskDelivery ||
+                !validEvidence(contract.evidence) ||
+                !contract.evidence.ci.every((row) => evidenceMatchesEvent(row, event)))) ||
+        (taskDelivery &&
+            (event !== null ||
+                !['draft_pr', 'push_branch', 'direct_branch'].includes(contract.delivery.mode) ||
+                contract.workspace.kind !== 'ephemeral' ||
+                !validDeliverySource(contract.deliverySource) ||
+                contract.responsibilityRef.id !== contract.deliverySource?.parentTaskId ||
+                contract.workspace.base.toLowerCase() !==
+                    String(contract.deliverySource?.baseCommit).toLowerCase())) ||
+        (!taskDelivery && contract.deliverySource !== undefined))
+        return null;
+    return JSON.parse(JSON.stringify(contract));
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/sessionPermissionAuthority.d.ts

@@ -1,33 +1,5 @@
-/**
- * Session permission authority — the ONE rule that decides whether a session's
- * execution contract governs the run's permissions, shared by the server and
- * the daemon (OSK-11975 introduced it; it was implemented twice — the server
- * read `kind !== 'commitment'`, the daemon read the `permissionSource` marker —
- * which is exactly how a new contract kind or a new source value would drift
- * them apart).
- *
- * The wire model:
- *
- *   - The contract is closed (`hasOnlyKeys` on the daemon), so "whose
- *     permissions govern" can never ride INSIDE it. It is a top-level session
- *     field: `permissionSource`.
- *   - `'agent'` means the Agent's own configured permission mode, tool policy,
- *     Grants, session env, MCP servers and machine consent govern the run,
- *     exactly as for an unattended Task of the same Agent. Today only a
- *     `commitment` contract may carry it.
- *   - A `commitment` contract WITHOUT the marker (an older server mid-deploy)
- *     still governs permissions — the marker is the version signal, so its
- *     absence must keep the legacy fence, not silently lift it.
- *   - `task_delivery` contracts always govern, marker or not.
- *
- * Server vs daemon asymmetry, on purpose: the server STAMPS the marker
- * (`permissionSourceForContract`), so on its own side the predicate reduces to
- * "a commitment never governs" — `contractGovernsPermissions(c,
- * permissionSourceForContract(c))` is exactly `kind !== 'commitment'`. The
- * daemon reads the marker it received, because it cannot distinguish "new
- * server, agent permissions" from "old server, contract fence" any other way.
- * Both call the same function; only the input differs.
- */
+/** Commitment context never overrides Agent permissions. Version 3 admission
+ * rejects old contracts; typed Task delivery is a separate frozen operation. */
 /** The wire vocabulary for `permissionSource`. Top-level session field. */
 export declare const SESSION_PERMISSION_SOURCES: readonly ["agent"];
 export type SessionPermissionSource = (typeof SESSION_PERMISSION_SOURCES)[number];
@@ -37,7 +9,7 @@ export type SessionPermissionSource = (typeof SESSION_PERMISSION_SOURCES)[number
  * a daemon without it (`COMMITMENT_AGENT_PERMISSIONS_RUNTIME_UNSUPPORTED`), so
  * the marker never reaches a daemon that would ignore it.
  */
-export declare const COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = "commitment_execution_contract_v2_agent_permissions";
+export declare const COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = "commitment_execution_contract_v3";
 /**
  * The minimal contract shape this rule reads. The predicate only ever needs
  * `kind` — keeping the input structural means this module never imports the
@@ -50,8 +22,7 @@ export type PermissionContractKind = {
 } | null | undefined;
 /**
  * Untrusted wire input: anything but an exact vocabulary literal reads as
- * absent. Never widen by coercion — an unrecognized future value must degrade
- * to "contract governs", the conservative answer.
+ * absent. An unknown marker carries no authority. Contract admission is validated separately.
  */
 export declare function normalizeSessionPermissionSource(value: unknown): SessionPermissionSource | undefined;
 /**
@@ -60,18 +31,10 @@ export declare function normalizeSessionPermissionSource(value: unknown): Sessio
  * kind keeps its own authority and stamps nothing.
  */
 export declare function permissionSourceForContract(contract: PermissionContractKind): SessionPermissionSource | undefined;
-/**
- * Whether the contract is the run's PERMISSION authority — the single place
- * this rule lives.
- *
- * True for a non-commitment contract regardless of marker, and for a
- * commitment whose server did not declare agent permissions. False for no
- * contract at all, and for a commitment carrying `permissionSource: 'agent'`,
- * which then follows the Agent's own permissions exactly as a Task does while
- * the contract keeps its non-permission roles (normalized shape, ephemeral
- * worktree, result validation, `GIT_OPTIONAL_LOCKS`, provider restriction).
+/** Only typed Task delivery owns an effect-specific permission boundary.
+ * A Commitment is context for the Agent and cannot grant or restrict tools.
  */
-export declare function contractGovernsPermissions(contract: PermissionContractKind, permissionSource: unknown): boolean;
+export declare function contractGovernsPermissions(contract: PermissionContractKind, _permissionSource?: unknown): boolean;
 /**
  * The contract when it governs permissions, else `undefined` — for the sites
  * that used `executionContract` as "is this run permission-fenced".