agent-contracts 0.30.3 → 0.31.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 foo-ogawa
+Copyright (c) 2026 foo-log-inc
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -278,6 +278,8 @@ A **Guardrail Policy** defines enforcement strategy for guardrails:
 
 * rules — array of enforcement rules mapping guardrails to actions
 * Each rule specifies: severity (`critical`/`mandatory`/`warning`/`info`), action (`block`/`warn`/`shadow`/`info`), override permissions
+* `action` supports a conditional form for state-dependent enforcement: `{ default: "block", when: { maintenance: "shadow" } }`
+* Available states are declared system-wide via `system.states`
 
 ### Handoff Type
 
@@ -337,6 +339,7 @@ Design regressions become testable.
 * **Inheritance with merge operators via `extends`**
 * **Guardrail definitions** for cross-cutting process constraints
 * **Guardrail policies** with configurable enforcement (block/warn/shadow/info)
+* **State-dependent guardrail action** — `action` accepts a conditional form `{ default, when }` keyed by `system.states` for workspace-mode-aware enforcement
 * **Software bindings** (DI) for tool-specific guardrail implementation (Cursor, Git, GitHub)
 * **Guardrail generation** from DSL + policy + bindings via `generate guardrails`
 * **Navigation index** — compile-time artifact-centric model mapping artifacts to operations, agent permissions, relations, and action routes
@@ -374,6 +377,7 @@ system:
     - audit
     - release
     - reflect
+  states: []                       # optional — named workspace states for conditional guardrail action
 
 agents: {}
 tasks: {}
@@ -711,7 +715,7 @@ artifacts:
 
 ## artifact-contracts integration
 
-agent-contracts integrates with [artifact-contracts](https://github.com/foo-ogawa/artifact-contracts) and [cli-contracts](https://github.com/foo-ogawa/cli-contracts) to provide a unified artifact governance model.
+agent-contracts integrates with [artifact-contracts](https://github.com/foo-log-inc/artifact-contracts) and [cli-contracts](https://github.com/foo-log-inc/cli-contracts) to provide a unified artifact governance model.
 
 ### Design principle
 
@@ -1106,7 +1110,7 @@ VarsSubstitutionError: Undefined variable "repo_url" in value "Repository: ${var
 
 For the full CLI reference with all commands, options, arguments, exit codes, and AI agent policies, see the [CLI Reference](docs/cli-reference.md).
 
-The CLI contract specification is defined in [`cli-contract.yaml`](cli-contract.yaml) using [CLI Contracts](https://github.com/foo-ogawa/cli-contracts). Commands that have side effects declare structured `effects` metadata, and the `--introspect` global option outputs the derived policy as JSON without executing the command.
+The CLI contract specification is defined in [`cli-contract.yaml`](cli-contract.yaml) using [CLI Contracts](https://github.com/foo-log-inc/cli-contracts). Commands that have side effects declare structured `effects` metadata, and the `--introspect` global option outputs the derived policy as JSON without executing the command.
 
 ### Installation
 
@@ -1149,7 +1153,7 @@ agent-contracts audit --introspect
 agent-contracts validate --introspect
 ````
 
-The output follows the [CLI Contracts](https://github.com/foo-ogawa/cli-contracts) `IntrospectionResult` shape:
+The output follows the [CLI Contracts](https://github.com/foo-log-inc/cli-contracts) `IntrospectionResult` shape:
 
 ````json
 {
@@ -1536,6 +1540,12 @@ guardrail_policies:
       - guardrail: no-force-push
         severity: critical
         action: block
+      - guardrail: branch-lock
+        severity: critical
+        action:
+          default: block
+          when:
+            maintenance: shadow
       - guardrail: english-only-code
         severity: warning
         action: warn

package/cli-contract.yaml

@@ -12,8 +12,8 @@ info:
   license:
     name: MIT
   contact:
-    name: foo-ogawa
-    url: https://github.com/foo-ogawa/agent-contracts
+    name: foo-log-inc
+    url: https://github.com/foo-log-inc/agent-contracts
 
 artifact_slots:
   dsl-definitions:

package/dist/cli.js

@@ -49099,10 +49099,16 @@ var GuardrailPolicyRuleEscalationSchema = z6.object({
   target: z6.string(),
   condition: z6.string().optional()
 }).passthrough();
+var ActionEnum = z6.enum(["block", "warn", "shadow", "info"]);
+var ConditionalActionSchema = z6.object({
+  default: ActionEnum,
+  when: z6.record(z6.string(), ActionEnum)
+});
+var ActionSchema = z6.union([ActionEnum, ConditionalActionSchema]);
 var GuardrailPolicyRuleSchema = z6.object({
   guardrail: z6.string(),
   severity: z6.enum(["critical", "mandatory", "warning", "info"]),
-  action: z6.enum(["block", "warn", "shadow", "info"]),
+  action: ActionSchema,
   allow_override: z6.boolean().default(false),
   override_requires: z6.array(z6.string()).optional(),
   escalation: GuardrailPolicyRuleEscalationSchema.optional()
@@ -49134,7 +49140,8 @@ var SystemSchema = z8.object({
   name: z8.string(),
   default_workflow_order: z8.array(z8.string()),
   sections: z8.array(SectionSchema).optional(),
-  context_loading: ContextLoadingSchema
+  context_loading: ContextLoadingSchema,
+  states: z8.array(z8.string()).default([])
 }).passthrough();
 
 // src/schema/task.ts
@@ -52246,6 +52253,70 @@ var guardrailPolicyCoverageRule = {
   }
 };
 
+// src/linter/rules/guardrail-policy-action-state.ts
+function isConditionalAction(action) {
+  return typeof action === "object" && action !== null && "default" in action;
+}
+function collectReferencedWhenStates(dsl) {
+  const referenced = /* @__PURE__ */ new Set();
+  for (const policy of Object.values(dsl.guardrail_policies)) {
+    for (const rule of policy.rules) {
+      if (isConditionalAction(rule.action)) {
+        for (const state of Object.keys(rule.action.when)) {
+          referenced.add(state);
+        }
+      }
+    }
+  }
+  return referenced;
+}
+var guardrailPolicyActionStateUndefinedRule = {
+  id: "guardrail-policy-action-state-undefined",
+  description: "Policy rule action.when keys must reference states declared in system.states",
+  run(dsl) {
+    const diagnostics = [];
+    const systemStates = new Set(dsl.system.states ?? []);
+    for (const [policyId, policy] of Object.entries(dsl.guardrail_policies)) {
+      for (let ruleIndex = 0; ruleIndex < policy.rules.length; ruleIndex++) {
+        const rule = policy.rules[ruleIndex];
+        if (!isConditionalAction(rule.action)) continue;
+        for (const state of Object.keys(rule.action.when)) {
+          if (!systemStates.has(state)) {
+            diagnostics.push({
+              ruleId: "guardrail-policy-action-state-undefined",
+              severity: "error",
+              path: `guardrail_policies.${policyId}.rules[${ruleIndex}].action.when.${state}`,
+              message: `Policy rule references state "${state}" in action.when, but it is not declared in system.states`
+            });
+          }
+        }
+      }
+    }
+    return diagnostics;
+  }
+};
+var systemStatesUnusedRule = {
+  id: "system-states-unused",
+  description: "Each state in system.states should be referenced by at least one policy rule action.when",
+  run(dsl) {
+    const diagnostics = [];
+    const states = dsl.system.states ?? [];
+    if (states.length === 0) return diagnostics;
+    const referenced = collectReferencedWhenStates(dsl);
+    for (const state of states) {
+      if (!referenced.has(state)) {
+        diagnostics.push({
+          ruleId: "system-states-unused",
+          severity: "info",
+          path: `system.states`,
+          message: `State "${state}" is declared in system.states but not referenced by any policy rule action.when`
+        });
+      }
+    }
+    return diagnostics;
+  }
+};
+
 // src/linter/rules/yaml-reserved-key-safety.ts
 var YAML_11_RESERVED_KEYS = /* @__PURE__ */ new Set([
   "on",
@@ -53055,6 +53126,8 @@ var builtinRules = [
   artifactOwnershipRule,
   toolCommandsRule,
   guardrailPolicyCoverageRule,
+  guardrailPolicyActionStateUndefinedRule,
+  systemStatesUnusedRule,
   yamlReservedKeySafetyRule,
   artifactRequiredValidationWiringRule,
   taskOutputValidationCompletenessRule,