agent-tempo 1.7.0-beta.3 → 1.7.0-beta.4

package/dashboard/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-tempo-dashboard",
   "private": true,
-  "version": "1.7.0-beta.3",
+  "version": "1.7.0-beta.4",
   "type": "module",
   "description": "Web dashboard for agent-tempo. Bundled into the npm package; served by the daemon at /dashboard/*.",
   "scripts": {

package/dist/types.d.ts

@@ -238,24 +238,28 @@ export interface SessionMetadata {
      * the real posture on EVERY attach (across restart / migrate / re-attach), so
      * a previously-`supervised` agent stays supervised. (tempo-architect ruling.)
      *
-     * **★ Enforcement scope (#712 — claims EXACTLY this, no more).** The daemon
-     * enforces fail-closed for a `supervised` player's gate ENGAGEMENTS: the gate's
-     * `open()` cross-check derives the `failMode` from THIS durable policy (read by
-     * the daemon, populated at spawn + lazily resolved on a cache-miss), so the
-     * `failMode` an engaging agent stamps on its `gate_pending` frame can't
-     * self-downgrade a supervised player out of fail-closed (a `'open'` claim against
-     * a `supervised` policy is overridden to `closed` and a `failmode-override`
-     * audit record is written). This is **NOT a hard boundary** against an agent
-     * that SKIPS gate-engagement entirely (runs the tool without emitting a
-     * `gate_pending` frame) or bypasses the client-side MD-C exec-block — a true
-     * boundary requires spawn-time tool-restriction (the agent physically lacks the
-     * tools), tracked separately in **#715**.
+     * **★ Enforcement scope (#715).** `supervised` is the daemon-enforced approval
+     * boundary for the realistic threat: a prompt-injected agent. A manipulated LLM
+     * can only *emit* tool-call requests — Pi routes every one to agent-tempo's
+     * `tool_call` handler, which engages the gate (non-`low-risk`) or hard-blocks
+     * (exec tools at `toolAccess: 'restricted'`). The agent **cannot** skip the gate
+     * or run a dangerous tool directly — it doesn't control the hook. The daemon also
+     * derives `failMode` from this durable policy (populated at spawn, falling
+     * `closed` on any lookup failure — no-fail-open), so an engaging agent can't
+     * self-downgrade a supervised player out of fail-closed.
+     *
+     * The **residual** is *process compromise*: code execution **inside** the Pi
+     * process (host RCE bypassing the handler entirely). No client-side gate defends
+     * that — it requires OS-level process sandboxing, tracked as a separate future
+     * `'sandboxed'` posture (#724). That is **not a gap in `supervised`'s scope**:
+     * supervised targets prompt-injection, and against that threat it **is** a real
+     * enforcement boundary.
      *
      * **Post-restart window:** on daemon restart the in-memory ingest tokens are
      * invalidated, so existing players' gate engagements are rejected (403) until a
      * re-spawn re-mints. In that window a `supervised` player's gate-client
-     * fail-closes on its own derived deadline (client-side safety holds), but the
-     * gate is NOT daemon-mediated — the #715 client-cooperative residual.
+     * fail-closes on its own derived deadline (client-side safety holds, not
+     * daemon-mediated) — same process-compromise residual, not a distinct gap.
      */
     guardrailPolicy?: GuardrailPolicy;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-tempo",
-  "version": "1.7.0-beta.3",
+  "version": "1.7.0-beta.4",
   "description": "Many agents, one tempo. Durable coordination for multi-agent work via Temporal.",
   "keywords": [
     "mcp",
@@ -72,12 +72,12 @@
     "copilot-bridge": "ts-node src/adapters/copilot/adapter.ts",
     "clean:test": "node -e \"require('fs').rmSync('dist-test',{recursive:true,force:true})\"",
     "build:test": "npm run clean:test && tsc -p test/tsconfig.json",
-    "pretest": "npm run build:test",
+    "pretest": "node scripts/check-bundle-present.js && npm run build:test",
     "test:tui": "vitest run",
     "test:conformance": "npm run build:test && mocha --config .mocharc.conformance.yml",
-    "pretest:shard-1": "npm run build:test && npm run build:scripts",
+    "pretest:shard-1": "node scripts/check-bundle-present.js && npm run build:test && npm run build:scripts",
     "test:shard-1": "node dist/scripts/run-shard.js 1",
-    "pretest:shard-2": "npm run build:test && npm run build:scripts",
+    "pretest:shard-2": "node scripts/check-bundle-present.js && npm run build:test && npm run build:scripts",
     "test:shard-2": "node dist/scripts/run-shard.js 2",
     "test": "mocha && vitest run",
     "lint:surface-drift": "node scripts/check-surface-drift.js",