attesso 0.4.0 → 0.6.0

package/package.json

@@ -1,16 +1,20 @@
 {
   "name": "attesso",
-  "version": "0.4.0",
-  "description": "A local, signed ledger of what your AI agents attempted, what was allowed, and what was refused.",
+  "version": "0.6.0",
+  "description": "Bounds: decide an AI agent's next tool call before it runs, with a signed record. Free and unlimited locally, $0.00085 per synced decision.",
   "license": "Apache-2.0",
   "type": "module",
   "bin": {
-    "attesso": "./bin/attesso.mjs"
+    "attesso": "./bin/attesso.mjs",
+    "attesso-mcp": "./bin/attesso-mcp.mjs",
+    "attesso-control-mcp": "./bin/attesso-control-mcp.mjs"
   },
   "files": [
     "bin",
     "src",
-    "README.md"
+    "README.md",
+    "LICENSE",
+    "NOTICE"
   ],
   "engines": {
     "node": ">=20"

package/src/bundle.mjs

@@ -0,0 +1,128 @@
+// A bundle is the smallest artifact that lets a stranger re-run one decision:
+// the entry, its receipt, the exact policy and rules bytes, and the task history
+// the path rule read.
+import { entryHash, verifyEntry } from './ledger.mjs';
+import { policyDigest } from './policy.mjs';
+import { receiptFor, signerOf, verifyReceipt } from './receipt.mjs';
+import { decide } from './decide.mjs';
+import { proposalOf } from './replay.mjs';
+import { rulesDigest } from './rules.mjs';
+import { toolsDigest, manifestDigest, validateToolLock } from './toolpin.mjs';
+import { readSnapshot, readState, readToolLock } from './store.mjs';
+
+export function bundleFor(dir, seq) {
+  const state = readState(dir);
+  const index = state.entries.findIndex((entry) => entry.seq === Number(seq));
+  if (index === -1) throw new Error(`no entry #${seq} in this ledger`);
+  const entry = state.entries[index];
+  const policy = readSnapshot(dir, entry.policy_digest, 'policy');
+  const rules = entry.rules_digest ? readSnapshot(dir, entry.rules_digest, 'rules') : null;
+  const tools = entry.tools_digest ? readSnapshot(dir, entry.tools_digest, 'tools') : null;
+  const mcp = entry.mcp_digest ? readSnapshot(dir, entry.mcp_digest, 'mcp') : null;
+  const toolLock = readToolLock(dir);
+  const history = state.entries.filter(
+    (candidate) => (candidate.task ?? null) === (entry.task ?? null) && candidate.seq < entry.seq,
+  );
+  return {
+    v: 1,
+    statement: entry,
+    key: state.key.public,
+    receipt: receiptFor(state.entries, index, signerOf(state.key)),
+    policy,
+    rules,
+    tools,
+    mcp,
+    tool_lock: toolLock,
+    history,
+  };
+}
+
+export function verifyBundle(bundle, { replay = false, publicPem } = {}) {
+  if (!bundle || bundle.v !== 1 || !bundle.statement || !bundle.receipt) {
+    return { ok: false, reason: 'bundle is not version 1' };
+  }
+  const key = publicPem ?? bundle.key;
+  const { statement, receipt, policy, rules, tools, mcp, tool_lock: toolLock, history } = bundle;
+  if (!verifyEntry(statement, key)) return { ok: false, reason: 'statement signature does not verify' };
+
+  const receiptResult = verifyReceipt(receipt, key);
+  if (!receiptResult.ok) return { ok: false, reason: receiptResult.reason };
+  if (entryHash(receipt.entry) !== entryHash(statement)) {
+    return { ok: false, reason: 'the receipt proves a different entry' };
+  }
+  if (policyDigest(policy) !== statement.policy_digest) {
+    return { ok: false, reason: 'policy_digest does not match the policy in the bundle' };
+  }
+  let historical = false;
+  if (statement.rules_digest) {
+    if (!rules) return { ok: false, reason: 'rules_digest is set but the bundle carries no rules' };
+    if (rulesDigest(rules) !== statement.rules_digest) {
+      return { ok: false, reason: 'rules_digest does not match the rules in the bundle' };
+    }
+  } else {
+    historical = true;
+  }
+  if (statement.tools_digest) {
+    if (!tools) return { ok: false, reason: 'tools_digest is set but the bundle carries no tools' };
+    if (toolsDigest(tools) !== statement.tools_digest) {
+      return { ok: false, reason: 'tools_digest does not match the tools in the bundle' };
+    }
+  } else {
+    historical = true;
+  }
+  if (statement.mcp_digest) {
+    if (!mcp) return { ok: false, reason: 'mcp_digest is set but the bundle carries no MCP manifest' };
+    if (manifestDigest(mcp) !== statement.mcp_digest) {
+      return { ok: false, reason: 'mcp_digest does not match the MCP manifest in the bundle' };
+    }
+  }
+  if (statement.tool_pin === 'verified') {
+    if (!toolLock) return { ok: false, reason: 'tool_pin is verified but the bundle carries no tool lock' };
+    try {
+      validateToolLock(toolLock);
+    } catch (error) {
+      return { ok: false, reason: error.message };
+    }
+    if (toolLock.tools[statement.subject] !== statement.tool_hash) {
+      return { ok: false, reason: 'tool_hash does not match the pinned tool in the bundle' };
+    }
+  }
+  let previous = 0;
+  for (const item of history ?? []) {
+    if (!verifyEntry(item, key)) return { ok: false, reason: `history entry #${item.seq} signature does not verify` };
+    if ((item.task ?? null) !== (statement.task ?? null)) {
+      return { ok: false, reason: `history entry #${item.seq} belongs to another task` };
+    }
+    if (item.seq >= statement.seq || item.seq <= previous) {
+      return { ok: false, reason: `history entry #${item.seq} is out of order` };
+    }
+    previous = item.seq;
+  }
+  if (!replay) return { ok: true, reason: 'bundle verifies', historical };
+  if (statement.control) {
+    return { ok: true, reason: 'bundle verifies; control verdict is not replayed', historical };
+  }
+  if (statement.code === 'TOOL_CHANGED' || statement.code === 'TOOL_UNPINNED') {
+    return { ok: true, reason: 'bundle verifies; the tool-pin verdict is not replayed', historical };
+  }
+
+  const verdict = decide({
+    policy,
+    rules,
+    history: history ?? [],
+    proposal: proposalOf(statement),
+    now: new Date(statement.at),
+  });
+  if (verdict.decision !== statement.decision || verdict.code !== statement.code) {
+    return {
+      ok: false,
+      reason: `replay produced ${verdict.decision}/${verdict.code}, the record says ${statement.decision}/${statement.code}`,
+    };
+  }
+  return {
+    ok: true,
+    reason: 'bundle verifies and replays to the recorded verdict',
+    historical,
+    replayed: { decision: verdict.decision, code: verdict.code, rule: verdict.rule ?? null },
+  };
+}

package/src/classify.mjs

@@ -0,0 +1,83 @@
+// What a tool call is, decided once for every harness. An unknown tool is an
+// untrusted read: the opposite default silently trusts whatever a harness adds.
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+export const DEFAULT_TOOLS = {
+  version: 1,
+  trusted_read: [
+    'read_file',
+    'search_files',
+    'skill_view',
+    'fact_store',
+    'fact_feedback',
+    'todo_list',
+    'session_search',
+  ],
+  execute: ['terminal', 'execute_code', 'process_manage', 'delegate_task', 'cronjob_manage', 'shell', 'bash'],
+  write: ['write_file', 'patch', 'skill_manage', 'str_replace_editor', 'edit'],
+  send: [],
+};
+
+const FIELDS = ['trusted_read', 'execute', 'write', 'send'];
+const SEND_SHAPE = /send|mail|post|publish/i;
+const ALIASES = {
+  Bash: 'terminal',
+  Shell: 'terminal',
+  execute_command: 'terminal',
+  run_shell_command: 'terminal',
+  Read: 'read_file',
+  Grep: 'search_files',
+  Glob: 'search_files',
+  WebFetch: 'web_extract',
+  WebSearch: 'web_search',
+  Write: 'write_file',
+  Edit: 'patch',
+  MultiEdit: 'patch',
+  NotebookEdit: 'write_file',
+  apply_patch: 'patch',
+  write_to_file: 'write_file',
+  replace_in_file: 'patch',
+  replace: 'patch',
+  Delete: 'write_file',
+  Task: 'delegate_task',
+  Agent: 'delegate_task',
+  spawn_agent: 'delegate_task',
+  web_fetch: 'web_extract',
+  google_web_search: 'web_search',
+  browser_action: 'web_search',
+  update_plan: 'read_file',
+  view_image: 'read_file',
+};
+
+export function validateTools(tools) {
+  const fail = (message) => {
+    throw new Error(`tools.json is invalid: ${message}`);
+  };
+  if (tools === null || typeof tools !== 'object') fail('not an object');
+  if (tools.version !== 1) fail('version must be 1');
+  for (const field of FIELDS) {
+    if (!Array.isArray(tools[field])) fail(`${field} must be a list`);
+    if (tools[field].some((name) => typeof name !== 'string' || name === '')) {
+      fail(`${field} must hold non-empty tool names`);
+    }
+  }
+  return tools;
+}
+
+export function loadTools(dir) {
+  const file = join(dir, 'tools.json');
+  if (!existsSync(file)) return DEFAULT_TOOLS;
+  return validateTools(JSON.parse(readFileSync(file, 'utf8')));
+}
+
+export function classifyTool(toolName, tools = DEFAULT_TOOLS) {
+  const raw = String(toolName ?? '').trim();
+  const name = ALIASES[raw] ?? raw;
+  if (tools.execute.includes(name)) return { action: 'shell.execute', capability: 'execute', trust: 'internal' };
+  if (tools.write.includes(name)) return { action: 'file.write', capability: 'write', trust: 'internal' };
+  if (tools.send.includes(name)) return { action: 'message.send', capability: 'send', trust: 'internal' };
+  if (tools.trusted_read.includes(name)) return { action: 'tool.call', capability: 'read', trust: 'internal' };
+  if (SEND_SHAPE.test(name)) return { action: 'message.send', capability: 'send', trust: 'untrusted' };
+  return { action: 'web.read', capability: 'read', trust: 'untrusted' };
+}

package/src/cli-io.mjs

@@ -0,0 +1,130 @@
+// CLI plumbing: argument shapes, JSON files and the --out guard. Keeping it
+// out of the command dispatch makes the entry point a wiring table, not a
+// second implementation of path handling.
+import { lstatSync, readdirSync, readFileSync, realpathSync, statSync, writeFileSync } from 'node:fs';
+import { basename, dirname, join, resolve, sep } from 'node:path';
+import { paths } from './store.mjs';
+
+export function flags(argv) {
+  const out = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (!token.startsWith('--')) continue;
+    const name = token.slice(2);
+    const next = argv[index + 1];
+    if (next === undefined || next.startsWith('--')) {
+      out[name] = true;
+      continue;
+    }
+    if (name === 'meta') {
+      out.meta = [...(out.meta ?? []), next];
+    } else {
+      out[name] = next;
+    }
+    index += 1;
+  }
+  return out;
+}
+
+export function parseMeta(pairs = []) {
+  const meta = {};
+  for (const pair of pairs) {
+    const at = pair.indexOf('=');
+    if (at <= 0) throw new Error(`--meta expects key=value, got ${pair}`);
+    const key = pair.slice(0, at);
+    const raw = pair.slice(at + 1);
+    meta[key] = raw !== '' && !Number.isNaN(Number(raw)) ? Number(raw) : raw;
+  }
+  return meta;
+}
+
+export function readJsonFile(path, label) {
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch (error) {
+    console.error(`${label}: ${error.message}`);
+    process.exit(2);
+  }
+}
+
+export function publicKey(path) {
+  const text = readFileSync(path, 'utf8');
+  return text.trim().startsWith('{') ? JSON.parse(text).public : text;
+}
+
+function canonical(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    try {
+      return join(realpathSync(dirname(resolve(path))), basename(resolve(path)));
+    } catch {
+      return resolve(path);
+    }
+  }
+}
+
+export function canonicalOut(path) {
+  const absolute = resolve(path);
+  try {
+    const entry = lstatSync(absolute);
+    if (entry.isSymbolicLink()) return null;
+    return canonical(absolute);
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+    return canonical(absolute);
+  }
+}
+
+// An --out path that lands on the ledger, its key or a stored snapshot destroys
+// the record a command is supposed to prove. Refuse before opening the file.
+// A symlink is refused too: resolving only the spelling of the path would let
+// `--out receipt.json` overwrite the ledger through a link.
+export function assertSafeOut(dir, out) {
+  if (!out) return;
+  const file = paths(dir);
+  const target = canonicalOut(out);
+  if (target === null) {
+    console.error(`refusing to write ${resolve(out)}; it is a symbolic link`);
+    process.exit(2);
+  }
+  const guarded = [file.key, file.policy, file.rules, file.ledger, file.config, file.tools, file.toolLock, file.lock].map(canonical);
+  const snapshotDirs = [file.policies, file.toolsSnapshots].map(canonical);
+  for (const snapshotDir of [file.policies, file.toolsSnapshots]) {
+    try {
+      for (const name of readdirSync(snapshotDir)) guarded.push(canonical(join(snapshotDir, name)));
+    } catch {
+      // A snapshot directory is created on the first append.
+    }
+  }
+  let targetStat = null;
+  try {
+    targetStat = statSync(target);
+  } catch {
+    // A new output file has no inode to compare.
+  }
+  const sameFile = guarded.some((path) => {
+    try {
+      const guardedStat = statSync(path);
+      return targetStat !== null && guardedStat.dev === targetStat.dev && guardedStat.ino === targetStat.ino;
+    } catch {
+      return false;
+    }
+  });
+  if (
+    sameFile ||
+    guarded.includes(target) ||
+    snapshotDirs.includes(target) ||
+    snapshotDirs.some((snapshotDir) => target.startsWith(`${snapshotDir}${sep}`))
+  ) {
+    console.error(`refusing to write ${target}; it is part of the ledger`);
+    process.exit(2);
+  }
+}
+
+export function writeJsonOut(dir, value, out) {
+  assertSafeOut(dir, out);
+  const text = `${JSON.stringify(value, null, 2)}\n`;
+  if (out) writeFileSync(out, text);
+  else process.stdout.write(text);
+}

package/src/connect.mjs

@@ -0,0 +1,160 @@
+// Agent-controlled setup. The connector is the command an agent can run
+// without opening Bounds: initialize the ledger, write a mode file, wire the
+// harness hook, and report a machine-readable result on stdout.
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { detectHarnesses, writeAgentContext } from './setup.mjs';
+import { wireHarness } from './install.mjs';
+import { init, isInitialised, paths } from './store.mjs';
+
+export const CONNECT_MODES = ['off', 'observe', 'enforce'];
+export const MODE_FILE = 'mode';
+
+export function modePath(dir) {
+  return join(dir, MODE_FILE);
+}
+
+export function readMode(dir) {
+  const file = modePath(dir);
+  if (!existsSync(file)) return null;
+  const value = readFileSync(file, 'utf8').trim();
+  if (!CONNECT_MODES.includes(value)) {
+    throw new Error(`invalid mode '${value}'; expected ${CONNECT_MODES.join(', ')}`);
+  }
+  return value;
+}
+
+export function setModeAll(dir, mode, { home = homedir() } = {}) {
+  setMode(dir, mode);
+  for (const legacyDir of legacyModeDirs(home)) setMode(legacyDir, mode);
+  return mode;
+}
+
+export function setMode(dir, mode) {
+  if (!CONNECT_MODES.includes(mode)) {
+    throw new Error(`invalid mode '${mode}'; expected ${CONNECT_MODES.join(', ')}`);
+  }
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const file = modePath(dir);
+  const temporary = `${file}.${process.pid}.tmp`;
+  writeFileSync(temporary, `${mode}\n`, { mode: 0o600 });
+  renameSync(temporary, file);
+  return mode;
+}
+
+function legacyModeDirs(home) {
+  const config = join(home, '.hermes', 'config.yaml');
+  if (!existsSync(config)) return [];
+  try {
+    const text = readFileSync(config, 'utf8');
+    const match = text.match(/^\s*-\s*command:\s*(.+hook\.sh)\s*$/m);
+    if (!match) return [];
+    const command = match[1].trim().replace(/^['"]|['"]$/g, '');
+    return command.includes('attesso-veto') ? [dirname(command)] : [];
+  } catch {
+    return [];
+  }
+}
+
+function hasAttessoHook(path) {
+  if (!existsSync(path)) return false;
+  try {
+    const text = readFileSync(path, 'utf8');
+    return /attesso[^\n"]*hook/.test(text);
+  } catch {
+    return false;
+  }
+}
+
+function wiredHarnesses(harnesses) {
+  return harnesses.map((harness) => {
+    const candidate = harness.key === 'cline' ? join(harness.path, 'PreToolUse') : harness.path;
+    return { ...harness, wired: hasAttessoHook(candidate) };
+  });
+}
+
+function instructions({ mode, wired, manual }) {
+  const next = [];
+  if (!mode) next.push('run `attesso connect --write --mode observe` from the agent');
+  else if (mode === 'off') next.push('run `attesso mode observe` to start recording');
+  if (manual.length) next.push('wire the listed harnesses by hand, or use the generic hook contract');
+  if (!wired.length) next.push('run `attesso connect --write --mode observe` from the agent');
+  return next;
+}
+
+export function status({ dir, cwd = process.cwd(), home = homedir() } = {}) {
+  const initialized = isInitialised(dir);
+  const mode = readMode(dir);
+  const detected = wiredHarnesses(detectHarnesses({ home, cwd }));
+  const wired = detected.filter((harness) => harness.wired);
+  const manual = detected.filter((harness) => !['hermes', 'claude-code', 'codex', 'gemini', 'cline'].includes(harness.key));
+  return {
+    initialized,
+    mode,
+    ledger: initialized ? paths(dir).dir : null,
+    harnesses: detected,
+    wired: wired.map((harness) => harness.key),
+    manual: manual.map((harness) => harness.key),
+    connected: initialized && mode !== null && mode !== 'off' && wired.length > 0,
+    next: instructions({ mode, wired, manual }),
+  };
+}
+
+export function connect({
+  dir,
+  cwd = process.cwd(),
+  home = homedir(),
+  cli,
+  write = false,
+  mode = 'observe',
+  harness: only = null,
+} = {}) {
+  if (!CONNECT_MODES.includes(mode)) {
+    throw new Error(`invalid mode '${mode}'; expected ${CONNECT_MODES.join(', ')}`);
+  }
+  const initialized = isInitialised(dir);
+  if (write && !initialized) init(dir);
+  const detected = detectHarnesses({ home, cwd }).filter((harness) => !only || harness.key === only);
+  const agentContext = writeAgentContext(cwd, { dryRun: !write });
+  const results = [];
+  for (const harness of detected) {
+    if (!['hermes', 'claude-code', 'codex', 'gemini', 'cline'].includes(harness.key)) {
+      results.push({
+        key: harness.key,
+        path: harness.path,
+        wired: false,
+        manual: true,
+        reason: 'no automatic installer; use the generic hook contract',
+      });
+      continue;
+    }
+    try {
+      const result = wireHarness(harness.key, cli, dir, {
+        dryRun: !write,
+        enforce: mode === 'enforce',
+        modeFile: true,
+        path: harness.path,
+      });
+      const warnings = [];
+      if (harness.key === 'codex' && result.applied) warnings.push('Codex requires running /hooks and trusting the installed command');
+      results.push({ key: harness.key, path: harness.path, ...result, ...(warnings.length ? { warnings } : {}) });
+    } catch (error) {
+      results.push({ key: harness.key, path: harness.path, wired: false, error: error.message });
+    }
+  }
+  if (write) setModeAll(dir, mode, { home });
+  const wired = results.filter((result) => result.applied || result.reason === 'already wired');
+  const effectiveMode = write ? mode : readMode(dir);
+  return {
+    initialized: isInitialised(dir),
+    mode: effectiveMode,
+    connected: isInitialised(dir) && effectiveMode !== null && effectiveMode !== 'off' && wired.length > 0,
+    ledger: paths(dir).dir,
+    harnesses: results,
+    wired: wired.map((result) => result.key),
+    manual: results.filter((result) => result.manual || result.error || result.reason?.includes('merge by hand')).map((result) => result.key),
+    agent_context: agentContext,
+    next: instructions({ mode: effectiveMode, wired, manual: results.filter((result) => result.manual || result.error) }),
+  };
+}

package/src/control.mjs

@@ -0,0 +1,101 @@
+// Local steering state. This file is deliberately outside the signed ledger:
+// it is the operator's current intent, not a decision about an action. A
+// decision made under it is signed by append as a control entry.
+import { closeSync, existsSync, fsyncSync, openSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { join } from 'node:path';
+import { withLedgerLock } from './store.mjs';
+
+export const CONTROL_MODES = ['pause', 'stop'];
+const controlPath = (dir) => join(dir, 'control.json');
+const empty = () => ({ version: 1, tasks: {} });
+
+function fail(message) {
+  throw new Error(`CONTROL_INVALID: ${message}`);
+}
+
+function validate(value) {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) fail('not an object');
+  if (value.version !== 1) fail('version must be 1');
+  if (value.tasks === null || typeof value.tasks !== 'object' || Array.isArray(value.tasks)) fail('tasks must be an object');
+  for (const [task, control] of Object.entries(value.tasks)) {
+    if (task === '') fail('task id must not be empty');
+    if (control === null || typeof control !== 'object' || Array.isArray(control)) fail(`task ${task} is not an object`);
+    if (!CONTROL_MODES.includes(control.mode)) fail(`task ${task} has unknown mode`);
+    if (typeof control.at !== 'string' || Number.isNaN(Date.parse(control.at))) fail(`task ${task} has no timestamp`);
+    if (control.reason !== undefined && typeof control.reason !== 'string') fail(`task ${task} has a non-string reason`);
+  }
+  return value;
+}
+
+function fsyncDir(path) {
+  let handle;
+  try {
+    handle = openSync(path, 'r');
+    fsyncSync(handle);
+  } catch {
+    // Directory fsync is unavailable on some platforms.
+  } finally {
+    if (handle !== undefined) closeSync(handle);
+  }
+}
+
+function writeControl(dir, value) {
+  validate(value);
+  const file = controlPath(dir);
+  const temporary = `${file}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`;
+  const handle = openSync(temporary, 'w', 0o600);
+  try {
+    writeFileSync(handle, `${JSON.stringify(value, null, 2)}\n`);
+    fsyncSync(handle);
+  } finally {
+    closeSync(handle);
+  }
+  renameSync(temporary, file);
+  fsyncDir(dir);
+}
+
+export function readControl(dir) {
+  const file = controlPath(dir);
+  if (!existsSync(file)) return empty();
+  let value;
+  try {
+    value = JSON.parse(readFileSync(file, 'utf8'));
+  } catch (error) {
+    fail(error.message);
+  }
+  return validate(value);
+}
+
+export function taskControl(dir, task) {
+  return readControl(dir).tasks[task];
+}
+
+export function listControl(dir) {
+  return Object.entries(readControl(dir).tasks)
+    .map(([task, control]) => ({ task, ...control }))
+    .sort((left, right) => Date.parse(left.at) - Date.parse(right.at));
+}
+
+export function setTaskControl(dir, task, mode, { reason } = {}) {
+  if (typeof task !== 'string' || task === '') throw new Error('task id must not be empty');
+  if (!CONTROL_MODES.includes(mode)) throw new Error(`mode must be ${CONTROL_MODES.join(' or ')}`);
+  if (reason !== undefined && typeof reason !== 'string') throw new Error('reason must be a string');
+  return withLedgerLock(dir, () => {
+    const value = readControl(dir);
+    value.tasks[task] = { mode, at: new Date().toISOString(), ...(reason === undefined ? {} : { reason }) };
+    writeControl(dir, value);
+    return { task, ...value.tasks[task] };
+  });
+}
+
+export function clearTaskControl(dir, task) {
+  if (typeof task !== 'string' || task === '') throw new Error('task id must not be empty');
+  return withLedgerLock(dir, () => {
+    const value = readControl(dir);
+    if (value.tasks[task] === undefined) return false;
+    delete value.tasks[task];
+    writeControl(dir, value);
+    return true;
+  });
+}

package/src/decide.mjs

@@ -0,0 +1,10 @@
+// One decision path, shared by the live gate and by replay. The order matters:
+// a policy refusal wins, and a path rule is only consulted when the policy allows.
+import { evaluate } from './policy.mjs';
+import { evaluatePath } from './rules.mjs';
+
+export function decide({ policy, rules, history, proposal, now }) {
+  const policyVerdict = evaluate(policy, proposal, now);
+  if (policyVerdict.decision !== 'ALLOW') return policyVerdict;
+  return evaluatePath(rules, history, proposal, now) ?? policyVerdict;
+}