@sponsio/sdk 0.1.0-alpha.3 → 0.1.0

package/contracts/capability/self-modify.yaml

@@ -19,12 +19,42 @@
 # time, but a sponsio-native rule is the right defense — it travels
 # with the user's config to any host (Cursor, Codex, custom MCP).
 #
+# A second escalation vector lives one level up: an agent can
+# ``import sponsio; print(sponsio.__file__)`` to locate the
+# installed package, then edit the upstream capability bundle (or
+# the evaluation engine itself) to delete the rule about to fire.
+# This works on **any** user-writable Python install — editable
+# (``pip install -e .``), ``pip install --user``, conda envs,
+# venvs.  Only system-wide ``/usr/lib/python*`` installs are safe
+# by filesystem permission alone, and that's the minority of real
+# deployments.  This pack closes that vector.
+#
 # What this pack denies:
 #   - Edit / Write / MultiEdit on the legacy host guard config:
 #     ``~/.sponsio/plugins/_host/sponsio.yaml``
 #   - Edit / Write / MultiEdit on ANY per-plugin / per-MCP-server
 #     library (``~/.sponsio/plugins/<plugin-id>/sponsio.yaml``
 #     where ``<plugin-id>`` does NOT start with ``_host``).
+#   - Edit / Write / MultiEdit on the **upstream sponsio package** —
+#     specifically the contract bundles under
+#     ``sponsio/contracts/**/*.yaml`` and the evaluation-engine
+#     Python files (``guard_stdin``, ``config``, ``core``, plus
+#     anything under ``runtime/``, ``patterns/``, ``formulas/``,
+#     ``tracer/``, ``integrations/``).  Without this, an agent can
+#     simply ``import sponsio; print(sponsio.__file__)`` to locate
+#     the package, then edit a capability bundle (or monkey-patch
+#     the loader) to delete the rule about to fire — bypassing the
+#     per-bucket protection above.
+#   - Bash write operators (``>``, ``>>``, ``tee``, ``sed -i``,
+#     ``cp/mv/rm/dd``) targeting any of the above paths — the
+#     "shell shortcut" bypass of the structured Edit/Write block.
+#   - Bash interpreter invocations (``python``, ``node``, ``ruby``,
+#     ``perl``, ``deno``, ``bun``, etc.) targeting any protected
+#     path — the "run a script that does the write" bypass.
+#   - Write / Edit content that creates a script which itself
+#     mutates a protected path — the "stage a file then invoke it"
+#     two-step bypass.
+#
 #     The legitimate way to add or update these bundles is the
 #     ``sponsio plugin install`` / ``sponsio plugin scan --apply``
 #     CLI — those write via Python subprocess, not the agent's
@@ -34,6 +64,17 @@
 #     own Edit/Write tools to weaken or rewrite a bundle that's
 #     about to fire against it.
 #
+#     **Sponsio dev exception**: contributors working on the sponsio
+#     package itself routinely edit these files.  Override in your
+#     project-level config:
+#
+#         customized:
+#           - match: {source: "library:tier1.self-modify"}
+#             disabled: true
+#
+#     This loses self-modify protection inside the sponsio repo —
+#     acceptable for the maintainer workflow, not for end users.
+#
 # Per-host buckets (``_host_cursor`` / ``_host_claude_code`` / etc.)
 # carry their own targeted self-modify rules INSIDE their starter
 # yaml, scoped to that one bucket only. The split keeps the
@@ -56,6 +97,13 @@
 #     ``sponsio onboard`` writes into the user's repo).  That file
 #     IS supposed to evolve — onboard / scan / refresh all rewrite
 #     it.  Locking it would break the core happy path.
+#   - Edits to non-engine sponsio package files (``cli.py``,
+#     ``discovery/``, ``reporting/``, ``scoring/``, ``demos/``,
+#     ``generation/``, ``models/``).  These don't sit on the hook
+#     evaluation hot path — modifying them can't disable a rule
+#     against the agent's NEXT call.  Sponsio contributors edit
+#     them frequently; locking them would make the dev workflow
+#     unworkable.
 #   - Direct edits via the user's IDE, terminal, or
 #     ``sponsio plugin install`` / ``plugin scan --apply`` CLI —
 #     those don't go through the ``Edit`` / ``Write`` tool surface
@@ -82,11 +130,11 @@ agents:
     contracts:
 
       # =================================================================
-      # § 1 — No agent-mediated Edit of own host guard config
+      # § 1 — No agent-mediated Edit of any sponsio config or engine
       # =================================================================
 
-      - desc: "Host agent must not edit any sponsio guard config (host bucket or per-plugin bundle) — use `sponsio plugin install` / `plugin scan --apply`, or hand-edit"
-        E:
+      - desc: "Host agent must not edit any sponsio guard config or engine file — use `sponsio plugin install` / `plugin scan --apply`, or hand-edit"
+        G:
           pattern: arg_blacklist
           args:
             - Edit
@@ -101,10 +149,17 @@ agents:
             # still manage downstream plugin policy.
             - - "(^|/)\\.sponsio/plugins/_host/sponsio\\.yaml$"
               - "(^|/)\\.sponsio/plugins/[^_/][^/]*/sponsio\\.yaml$"
+              # Upstream sponsio package — contract bundles (rule data)
+              # and evaluation-engine .py files. Anchored on
+              # ``(^|/)sponsio/...`` so it matches editable installs,
+              # site-packages, --user installs, conda/venv all the same.
+              - "(^|/)sponsio/contracts/[^/]+/[^/]+\\.yaml$"
+              - "(^|/)sponsio/(guard_stdin|config|core)\\.py$"
+              - "(^|/)sponsio/(runtime|patterns|formulas|tracer|integrations)/[^/]+\\.py$"
           source: "library:tier1.self-modify"
 
       # =================================================================
-      # § 2 — No agent-mediated Write of own host guard config
+      # § 2 — No agent-mediated Write of any sponsio config or engine
       # =================================================================
       #
       # ``Write`` is the "create or overwrite whole file" tool —
@@ -112,28 +167,173 @@ agents:
       # rules removed" workaround a pure ``Edit`` block would leave
       # open.
 
-      - desc: "Host agent must not overwrite any sponsio guard config (host bucket or per-plugin bundle) — use the CLI or hand-edit"
-        E:
+      - desc: "Host agent must not overwrite any sponsio guard config or engine file — use the CLI or hand-edit"
+        G:
           pattern: arg_blacklist
           args:
             - Write
             - file_path
             - - "(^|/)\\.sponsio/plugins/_host/sponsio\\.yaml$"
               - "(^|/)\\.sponsio/plugins/[^_/][^/]*/sponsio\\.yaml$"
+              - "(^|/)sponsio/contracts/[^/]+/[^/]+\\.yaml$"
+              - "(^|/)sponsio/(guard_stdin|config|core)\\.py$"
+              - "(^|/)sponsio/(runtime|patterns|formulas|tracer|integrations)/[^/]+\\.py$"
           source: "library:tier1.self-modify"
 
       # =================================================================
-      # § 3 — No agent-mediated MultiEdit of own host guard config
+      # § 3 — No agent-mediated MultiEdit of any sponsio config or engine
       # =================================================================
 
-      - desc: "Host agent must not multi-edit any sponsio guard config (host bucket or per-plugin bundle) — use the CLI or hand-edit"
-        E:
+      - desc: "Host agent must not multi-edit any sponsio guard config or engine file — use the CLI or hand-edit"
+        G:
           pattern: arg_blacklist
           args:
             - MultiEdit
             - file_path
             - - "(^|/)\\.sponsio/plugins/_host/sponsio\\.yaml$"
               - "(^|/)\\.sponsio/plugins/[^_/][^/]*/sponsio\\.yaml$"
+              - "(^|/)sponsio/contracts/[^/]+/[^/]+\\.yaml$"
+              - "(^|/)sponsio/(guard_stdin|config|core)\\.py$"
+              - "(^|/)sponsio/(runtime|patterns|formulas|tracer|integrations)/[^/]+\\.py$"
+          source: "library:tier1.self-modify"
+
+      # =================================================================
+      # § 4 — No agent-mediated creation of a *script* that writes to
+      #       a protected path (the "Python file I/O bypass")
+      # =================================================================
+      #
+      # Observed bypass: agent's ``Write`` to the host bucket gets denied
+      # by §1–§3, agent recovers by writing a small ``merge_host_*.py``
+      # script in the workspace whose content opens the host bucket
+      # path in write mode and mutates it.  The script's file_path is a
+      # normal repo path so §1–§3 don't fire; the Bash invocation
+      # ``python merge.py`` doesn't carry the host bucket path on the
+      # command line so §6 below also doesn't fire.  The signal IS
+      # present: the script's *content* mentions a protected path
+      # AND uses an open-for-write idiom.
+      #
+      # The lookahead form ``(?s)(?=.*PATH).*(WRITE_SHAPE)`` requires
+      # both signals in the same content blob — pure docs that mention
+      # the path stay editable; only files that mention the path AND
+      # carry write-shaped code are denied.
+      #
+      # The PATH alternation covers all four protected families:
+      #   - host buckets (~/.sponsio/plugins/_host*/...)
+      #   - per-plugin libs (~/.sponsio/plugins/<id>/...)
+      #   - upstream contract bundles (sponsio/contracts/.../*.yaml)
+      #   - upstream engine .py (sponsio/{guard_stdin,config,core}.py
+      #     and sponsio/{runtime,patterns,formulas,tracer,
+      #     integrations}/*.py)
+      #
+      # Tools covered: Write.content, Edit.new_string,
+      # MultiEdit.edits[*].new_string (the ``new_string`` projection
+      # that grounding extracts from MultiEdit's edit list).
+
+      - desc: "Host agent must not write a script that mutates a sponsio guard config or engine file — use `sponsio plugin append`/`install`"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Write
+            - content
+            - - "(?s)(?=.*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations)/[^/]+\\.py)).*(\\.write_text\\s*\\(|\\.write_bytes\\s*\\(|\\bf\\.write\\s*\\(|\\bopen\\s*\\([^)]*['\\\"][aw][\\+bxt]*['\\\"]\\s*\\)|\\bfs\\.(writeFileSync|appendFileSync|createWriteStream|writeFile)\\s*\\(|\\bFile\\.(open|write)\\s*\\(|\\b(IO|File)\\.write\\b)"
+          source: "library:tier1.self-modify"
+
+      - desc: "Host agent must not edit a script that mutates a sponsio guard config or engine file — use `sponsio plugin append`/`install`"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Edit
+            - new_string
+            - - "(?s)(?=.*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations)/[^/]+\\.py)).*(\\.write_text\\s*\\(|\\.write_bytes\\s*\\(|\\bf\\.write\\s*\\(|\\bopen\\s*\\([^)]*['\\\"][aw][\\+bxt]*['\\\"]\\s*\\)|\\bfs\\.(writeFileSync|appendFileSync|createWriteStream|writeFile)\\s*\\(|\\bFile\\.(open|write)\\s*\\(|\\b(IO|File)\\.write\\b)"
+          source: "library:tier1.self-modify"
+
+      # =================================================================
+      # § 5 — No interpreter invocation that targets a protected path
+      # =================================================================
+      #
+      # Catches the inline form (``python -c "...sponsio/contracts/..."``)
+      # and the path-as-argument form (``python merge.py
+      # ~/.sponsio/plugins/...sponsio.yaml``).  Pairs with §4 — that
+      # rule blocks the *creation* of bypass scripts, this rule blocks
+      # the *invocation* path that doesn't go through a separate file.
+      #
+      # The interpreter list is the common scripting set; add new ones
+      # via a project-local ``customized:`` extending the regex if your
+      # environment uses a less common runtime.  The trailing path
+      # regex is the same shape as §1–§3 / §6 so the privilege boundary
+      # stays consistent across tools.
+      #
+      # Legitimate sponsio CLIs that read the path
+      # (``sponsio validate --config <path>``, ``sponsio plugin
+      # show <name>``) are not blocked because the leading verb is
+      # ``sponsio``, not an interpreter alias.  ``sponsio plugin
+      # append --target <plugin-id>`` doesn't pass the path at all —
+      # it takes the plugin id and resolves the path internally.
+
+      - desc: "Host agent must not run an interpreter against a sponsio guard config or engine file — use `sponsio plugin append`/`install`"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Bash
+            - command
+            # ``[^|\n]*`` excludes pipe + newline so we don't match
+            # across pipelines, but keeps ``;`` permitted because
+            # Python's ``-c "..."`` payloads commonly use it as a
+            # statement separator (``python -c "import x; x.do()"``).
+            - - "\\b(python|python2|python3|node|deno|bun|ruby|perl|php|lua|tclsh|R|Rscript)\\b[^|\\n]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations)/[^/]+\\.py)"
+          source: "library:tier1.self-modify"
+
+      # =================================================================
+      # § 6 — No Bash write operators against a protected path
+      # =================================================================
+      #
+      # The "shell shortcut" bypass: ``echo … > sponsio/contracts/…``,
+      # ``sed -i … sponsio/runtime/monitor.py``, ``cp /tmp/replacement
+      # sponsio/patterns/library.py``.  These don't go through Edit /
+      # Write / MultiEdit so §1–§3 don't see them.  Each operator
+      # gets one regex, applied against the same alternation of
+      # protected paths as §1–§3.
+      #
+      # Operator list: redirect (``>``, ``>>``), explicit writers
+      # (``tee``, ``sed -i``), file movers (``cp``, ``mv``, ``rm``,
+      # ``dd``).  The ``[^|&;]*`` segment between operator and path
+      # keeps each match local to its own command (won't cross
+      # pipelines or statement separators).
+
+      - desc: "Host agent must not redirect Bash output (`>` / `>>`) into a sponsio guard config or engine file"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Bash
+            - command
+            - - ">>?\\s*[^|&;]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations)/[^/]+\\.py)"
+          source: "library:tier1.self-modify"
+
+      - desc: "Host agent must not `tee` into a sponsio guard config or engine file"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Bash
+            - command
+            - - "\\btee\\b\\s+[^|&;]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations)/[^/]+\\.py)"
+          source: "library:tier1.self-modify"
+
+      - desc: "Host agent must not `sed -i` a sponsio guard config or engine file"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Bash
+            - command
+            - - "\\bsed\\b\\s+-i\\b[^|&;]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations)/[^/]+\\.py)"
+          source: "library:tier1.self-modify"
+
+      - desc: "Host agent must not `cp` / `mv` / `rm` / `dd` against a sponsio guard config or engine file"
+        G:
+          pattern: arg_blacklist
+          args:
+            - Bash
+            - command
+            - - "\\b(cp|mv|rm|dd)\\b\\s+[^|&;]*(\\.sponsio/plugins/(_host[^/]*|[^_/][^/]*)/sponsio\\.yaml|sponsio/contracts/[^/]+/[^/]+\\.yaml|sponsio/(guard_stdin|config|core)\\.py|sponsio/(runtime|patterns|formulas|tracer|integrations)/[^/]+\\.py)"
           source: "library:tier1.self-modify"
 
 # -----------------------------------------------------------------------------
@@ -150,3 +350,8 @@ agents:
 #   trying to touch this same file is covered by the broader
 #   ``sponsio:incident/subagent-escape`` pack, which denies the
 #   ENTIRE ``~/.sponsio/`` tree to sub-agents.
+#
+# - Upstream package paths are matched WITHOUT the install prefix —
+#   ``(^|/)sponsio/contracts/...`` matches editable installs, site-
+#   packages, --user installs, conda/venv all the same.  The first
+#   ``sponsio/`` directory boundary anchors the match cleanly.

package/contracts/capability/shell.yaml

@@ -52,7 +52,7 @@ agents:
       # =================================================================
 
       - desc: "Ban recursive deletes of sensitive roots"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - exec
@@ -72,7 +72,7 @@ agents:
           source: "library:tier1.shell"
 
       - desc: "Ban fork-bomb and obvious denial-of-service patterns"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - exec
@@ -88,7 +88,7 @@ agents:
           source: "library:tier1.shell"
 
       - desc: "Ban curl-to-shell and wget-to-shell (ClawHavoc ClickFix vector)"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - exec
@@ -100,7 +100,7 @@ agents:
           source: "library:tier1.shell"
 
       - desc: "Ban outbound reverse-shell / exfiltration primitives"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - exec
@@ -119,7 +119,7 @@ agents:
       # a privilege-sensitive command token.  Keeps the CVE coverage
       # while eliminating the biggest day-1 false-positive source.
       - desc: "Ban shell line-continuation chained into a privileged command (CVE-2026-28460)"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - exec
@@ -130,7 +130,7 @@ agents:
 
       - desc: "Ban undefined-variable-looking patterns that expand to empty in shell"
         # rm -rf {undefined}/{also_undefined} → rm -rf /
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - exec
@@ -144,33 +144,26 @@ agents:
       # =================================================================
 
       - desc: "Reject exec commands with suspiciously long inline payloads (injection indicator)"
-        E:
+        G:
           pattern: arg_length_limit
           args: [exec, command, 2000]
           source: "library:tier1.shell"
 
-      - desc: "Cap exec calls per session"
-        E:
-          pattern: rate_limit
-          args: [exec, 50]
-          source: "library:tier1.shell"
-
-      # Threshold tuned for shell specifically. Earlier 5 was inherited
-      # from narrow-tool defaults (apply_patch / merge_pr) where 5
-      # consecutive same-tool calls is genuinely suspicious. Shell is a
-      # swiss-army-knife — a normal coding agent doing a refactor will
-      # routinely run pytest → git status → git diff → git add → git
-      # commit → git push back-to-back without ever leaving the shell
-      # tool, which is 6 consecutive calls of legitimate work. 20 still
-      # trips on the runaway pattern (a genuinely stuck self-rewrite
-      # loop hits 20 in a few seconds) without false-positiving real
-      # development workflows. The session-wide rate_limit(exec, 50)
-      # below remains the harder backstop.
-      - desc: "No more than 20 consecutive exec calls (runaway loop cap)"
-        E:
-          pattern: loop_detection
-          args: [exec, 20]
-          source: "library:tier1.shell"
+      # NOTE: Previously shipped two session-wide backstops here:
+      #   1. `rate_limit(exec, 50)` (later 200) — removed earlier; the
+      #      cross-session trace store (24h TTL) made a "per-session"
+      #      cap behave like a rolling 24h cap and false-positive
+      #      heavy interactive work.
+      #   2. `loop_detection(exec, 20)` — also removed.  Even at 20
+      #      consecutive calls the rule false-positived routine
+      #      coding-agent loops (build/lint/test/regen cycles can hit
+      #      20+ shell calls without any of them being destructive),
+      #      and contributed nothing the targeted §1 arg_blacklists
+      #      and §3/§4 confirm-gate didn't already cover.  Runaway
+      #      detection at this layer just generated noise without
+      #      catching real attacks.
+      # When per-session trace isolation lands, we can revisit a
+      # tighter per-session loop cap that won't roll across sessions.
 
       # =================================================================
       # § 3 — Privileged commands require confirmation
@@ -182,7 +175,7 @@ agents:
       # =================================================================
 
       - desc: "Privileged exec patterns (sudo, chmod 777, dd if=) require preceding human confirmation"
-        E:
+        G:
           ltl: 'G(called_with(exec, "(sudo\\s|dd\\s+if=|chmod\\s+777|chown\\s+-R|mount\\s)") -> count(confirm_reconfirmed) >= count_with(exec, "(sudo\\s|dd\\s+if=|chmod\\s+777|chown\\s+-R|mount\\s)"))'
           source: "library:tier1.shell"
 
@@ -221,7 +214,7 @@ agents:
 
       - desc: "Each exec call needs its own confirm_reconfirmed (no confirmation reuse)"
         A: "called `confirm_reconfirmed`"
-        E:
+        G:
           ltl: "G(called(exec) -> count(confirm_reconfirmed) >= count(exec))"
           source: "library:tier1.shell"
 
@@ -242,5 +235,5 @@ agents:
 # - The LTL contracts in §3 and §4 depend on the `ltl:` schema field
 #   being supported by the config parser.  Until the LTL parser lands,
 #   these can be temporarily commented out; the arg_blacklist contracts
-#   in §1 and the rate_limit / loop_detection / arg_length_limit
+#   in §1 and the arg_length_limit
 #   contracts in §2 work on current master.

package/contracts/capability/subagent.yaml

@@ -82,7 +82,7 @@ agents:
       # whether to commit.
 
       - desc: "Sub-agents may not commit, push, force-push, or rewrite git history"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - exec
@@ -111,7 +111,7 @@ agents:
       # sub-agents shouldn't decide unilaterally.
 
       - desc: "Sub-agents may not install packages globally or system-wide"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - exec
@@ -136,7 +136,7 @@ agents:
       # arbitrary host is appropriate.
 
       - desc: "Sub-agents may not make outbound HTTP / shell-tunneled network calls"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - exec
@@ -158,7 +158,7 @@ agents:
       # agent should do it with user visibility.
 
       - desc: "Sub-agents may not write to system / user-home paths"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - write
@@ -171,7 +171,7 @@ agents:
           source: "library:tier1.subagent"
 
       - desc: "Sub-agents may not edit system / user-home paths"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - edit

package/contracts/core/llm_safety.yaml

@@ -1,18 +1,28 @@
 # =============================================================================
 # sponsio/contracts/core/llm_safety.yaml
 #
-# Stochastic output-safety contracts for LLM responses.  Default-OFF —
-# users opt in by adding this to their config:
+# !! Sponsio Cloud only !! — this pack is composed entirely of LLM-judged
+# stochastic atoms (`injection_free`, `jailbreak_free`, `harmful`,
+# `toxic_free`, `semantic_pii_free`). The OSS engine ships no evaluator
+# for them and will refuse to load this pack with a clear pointer to
+# `pip install sponsio[cloud]`.
+#
+# It still ships in the OSS package so Cloud installs see the same on-disk
+# layout — Cloud's StoEvaluator (auto-discovered via the
+# `sponsio.evaluators` entry-point group) is what actually evaluates
+# these contracts.
+#
+# Once Cloud is installed, opt in from your config:
 #
 #     include:
 #       - sponsio:core/llm_safety
 #
-# Why opt-in: every contract here is a stochastic atom, which means the
-# runtime calls a judge LLM on each evaluation.  That's the right default
-# for response-quality work but the wrong default for tool-call-only
-# agents (no LLM responses to score → judge calls add latency without
-# value).  Splitting out of ``core/universal`` was the user-driven fix
-# for "why is the SRE tool-call demo running prompt-injection scoring".
+# Why opt-in even on Cloud: every contract here triggers a judge LLM call
+# on each evaluation. That's the right default for response-quality work
+# but the wrong default for tool-call-only agents (no LLM responses to
+# score → judge calls add latency without value). Splitting out of
+# `core/universal` was the user-driven fix for "why is the SRE tool-call
+# demo running prompt-injection scoring".
 #
 # Source tag convention for this file:
 #   library:tier0.<category>  where category ∈
@@ -44,7 +54,7 @@ agents:
       # 0.95 — prompt-injection slip-throughs cause downstream tool
       # misuse with full agent privileges.  High slip-through cost.
       - desc: "Every LLM response must be free of prompt-injection compliance"
-        E:
+        G:
           pattern: injection_free
           context_scope: full_trace
           source: "library:tier0.adversarial"
@@ -53,7 +63,7 @@ agents:
       # 0.90 — jailbreak compliance is bad but mostly self-contained
       # (response-level harm, not tool-level harm).
       - desc: "LLM must not comply with jailbreak attempts (DAN, roleplay, hypothetical bypass)"
-        E:
+        G:
           pattern: jailbreak_free
           source: "library:tier0.adversarial"
         beta: 0.9
@@ -63,7 +73,7 @@ agents:
       # 0.95 — real-world-harm enablement (CSAM, weapons, self-harm
       # methods) carries the same high slip-through cost as injection.
       - desc: "Response must not encourage or enable real-world harm"
-        E:
+        G:
           pattern: harmful
           source: "library:tier0.harm"
         beta: 0.95
@@ -71,7 +81,7 @@ agents:
       # 0.90 — toxic language is corrosive but not safety-critical;
       # match the jailbreak weight rather than the harm weight.
       - desc: "Response free of toxic / harassing language"
-        E:
+        G:
           pattern: toxic_free
           source: "library:tier0.harm"
         beta: 0.9
@@ -81,7 +91,7 @@ agents:
       # 0.95 — PII slip-throughs are regulatory issues (GDPR / CCPA)
       # not just trust issues.  High slip-through cost.
       - desc: "Response free of contextual PII (names tied to conditions, inferable identity)"
-        E:
+        G:
           pattern: semantic_pii_free
           source: "library:tier0.privacy"
         beta: 0.95

package/contracts/incident/claude-code-secret-bypass.yaml

@@ -66,13 +66,12 @@ agents:
       # § 1 — Trace-aware: secret-emitting commands followed by exfil-shape
       #       network call.
       #
-      # Each rule uses the explicit A/E + ``activate_at: first_match`` form:
+      # Each rule uses the explicit A/G + ``activate_at: first_match`` form:
       # the assumption A names the trigger event (e.g. `docker compose
       # config`), and the enforcement E forbids the exfil shape from the
       # *first* position where the trigger occurred.  Events before
       # activation are not subject to E — so a `curl` issued before any
-      # secret-emitting command is unaffected.  See
-      # ``docs/internal/contract-activate-at.md`` for the semantic.
+      # secret-emitting command is unaffected.
       #
       # We use `arg_field_has` (per-field regex) rather than `called_with`
       # (full-args regex) to avoid (a) the `{'command': ...}` dict-wrapping
@@ -98,7 +97,7 @@ agents:
         activate_at: first_match
         A:
           ltl: 'F(arg_field_has(Bash, command, "docker[ -]+compose[ -]+config\b|docker[ -]+config\b|docker[ -]+inspect\b"))'
-        E:
+        G:
           ltl: 'G(!arg_field_has(Bash, command, "(curl|wget|httpie|http)\b.*(?<!\S)(-d|--data[a-z-]*)(?!\S).*(@-(\s|$)|\$\([^)]*\)|`[^`]*`)"))'
           source: "incident:claude-code-secret-bypass.docker_then_exfil"
 
@@ -106,7 +105,7 @@ agents:
         activate_at: first_match
         A:
           ltl: 'F(arg_field_has(Bash, command, "\bop[ ]+run\b|\baws-vault\b|\bdirenv\b|\bdotenvx[ ]+run\b|\benvchain\b"))'
-        E:
+        G:
           ltl: 'G(!arg_field_has(Bash, command, "(curl|wget|httpie|http)\b.*(?<!\S)(-d|--data[a-z-]*)(?!\S).*(@-(\s|$)|\$\([^)]*\)|`[^`]*`)"))'
           source: "incident:claude-code-secret-bypass.vault_then_exfil"
 
@@ -120,7 +119,7 @@ agents:
         #   `export -p` (always lists exports)
         A:
           ltl: 'F(arg_field_has(Bash, command, "(?<!\S)(printenv|export[ ]+-p)\b|(?<!\S)(env|set)(\s*$|\s*[|>])"))'
-        E:
+        G:
           ltl: 'G(!arg_field_has(Bash, command, "(curl|wget|httpie|http)\b.*(?<!\S)(-d|--data[a-z-]*)(?!\S).*(@-(\s|$)|\$\([^)]*\)|`[^`]*`)"))'
           source: "incident:claude-code-secret-bypass.envdump_then_exfil"
 
@@ -128,7 +127,7 @@ agents:
         activate_at: first_match
         A:
           ltl: 'F(arg_field_has(Bash, command, "git[ ]+(log|show|reflog)\b.*(-p\b|-G\b|--all\b)|git[ ]+grep\b"))'
-        E:
+        G:
           ltl: 'G(!arg_field_has(Bash, command, "(curl|wget|httpie|http)\b.*(?<!\S)(-d|--data[a-z-]*)(?!\S).*(@-(\s|$)|\$\([^)]*\)|`[^`]*`)"))'
           source: "incident:claude-code-secret-bypass.githist_then_exfil"
 
@@ -138,7 +137,7 @@ agents:
       # =====================================================================
 
       - desc: "Reading /proc/<pid>/environ via Bash is the canonical env-leak path"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - Bash
@@ -147,7 +146,7 @@ agents:
           source: "incident:claude-code-secret-bypass.proc_environ_bash"
 
       - desc: "Reading /proc/<pid>/environ via the Read tool"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - Read
@@ -156,7 +155,7 @@ agents:
           source: "incident:claude-code-secret-bypass.proc_environ_read"
 
       - desc: "Bare exfil-shape POST: curl/wget with -d/--data carrying @- / \\$(...) / backtick"
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - Bash
@@ -186,7 +185,7 @@ agents:
       #   - Hosts: the egress regex is host-agnostic.  Operators wanting
       #     a positive allowlist (`api.openai.com`, `*.amazonaws.com`)
       #     should add an `customized:` rule that further requires the
-      #     URL argument to be off-allowlist.  See `docs/contracts.md`
+      #     URL argument to be off-allowlist.  See `docs/concepts/contracts.md`
       #     § Overrides for the wiring.
       #
       #   - Mode: this pack is enforce-mode safe by design — every rule

package/contracts/incident/cursor-railway-wipe.yaml

@@ -93,7 +93,7 @@ agents:
       - desc: >-
           Block destructive Railway control-plane API calls
           (PocketOS-style 9-second prod wipe via curl + token).
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - exec
@@ -124,7 +124,7 @@ agents:
       - desc: >-
           Block Railway CLI destructive verbs (down / volume delete /
           environment delete / project delete / service delete).
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - exec
@@ -150,7 +150,7 @@ agents:
           Block ``curl -X DELETE`` against known cloud / PaaS control
           planes (Railway / Fly / Render / Supabase / Vercel / Heroku /
           Cloudflare / DigitalOcean / Linode / Hetzner / AWS / GCP / Azure).
-        E:
+        G:
           pattern: arg_blacklist
           args:
             - exec