create-agent-rig 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -9,7 +9,145 @@ Versions are published to npm as [`create-agent-rig`](https://www.npmjs.com/pack
 
 Numbering is ordinary semver — **additive is a minor, a fix is a patch** — so
 that "I only take minors" remains a usable policy; 0.3.2 shipped additive
-content as a patch by the owner's call and stays recorded as one.
+content as a patch by the owner's call and stays recorded as one. 0.8.0 is the
+second recorded departure; its own entry states the direction and the reason,
+and this paragraph deliberately does not restate them — a numbering rule with
+two copies of its exceptions is the shape 0.8.0 exists to remove.
+
+## 0.8.0
+
+**Three stale second copies, spread over three payload files a rig obeys,
+described the mechanisms behind them wrongly — and each fix is a deletion.** A
+count and a path list, both in `.claude/rules/autonomy.md`, and a paraphrase of
+that same path list in `loop/SKILL.md`, which ships in both harnesses' copies.
+Every one of them was a second writing of a fact the code owns, and every one
+had drifted from its source while the suite stayed green.
+
+**The `templates/agent-os/` payload gains no file and loses none**, measured
+tarball to tarball — `npm pack create-agent-rig@0.7.1` unpacked, against this
+release's own `npm pack`. That payload is the same 95 files either way, and
+exactly three of them differ in content. ⚠ The tarball as a whole is **not**
+unchanged: it grows by eleven files, and the section below names which and why.
+
+**Numbered a minor by the owner's call, not by this file's rule.** The rule at
+the top — additive is a minor, a fix is a patch — makes this delta a patch,
+because nothing is added to what a project installs. It ships as `0.8.0`
+because the owner's milestone of that name closes here and the number was fixed
+before the delta was measured. Recorded rather than reconciled, the way `0.3.2`
+is recorded above: a consumer on "I only take minors" receives three corrected
+documents and no new capability.
+
+### Fixed
+
+- **`.claude/rules/autonomy.md` stated a blind-spot count `guard-secret-file`
+  had outgrown.** The Never bullet said the guard's header "states the four
+  blind spots"; the header had been raised past four in `51402e99`, and the
+  stale copy shipped in 0.6.1, 0.6.2, 0.7.0 and 0.7.1 — a security rule
+  describing its own mechanism wrongly for four releases. The fix is not a
+  corrected number, which would only restart the same clock: the prose states
+  no count and points at the header, and `README.md` moved with it for the same
+  reason. Pinned in the generator's `test/template/guard-secret-file.test.ts`
+  (absent in a generated rig) › "no live rulebook document restates the guard’s
+  limit count" and › "the rule and the README still send the reader to the
+  guard’s own header".
+
+- **The same file re-listed the paths `guard-rulebook` protects, and its list
+  was incomplete.** The enumeration of trees an unattended run may not edit
+  omitted `.claude/doctor-exemptions.json`, which the guard does refuse. It is
+  replaced by a pointer to `RULEBOOK_PREFIXES` in
+  `.claude/scripts/unattended-flag.mjs` — the set the guard judges an edit
+  against — so there is one spelling of it rather than two. One fact that
+  pointer cannot carry is stated beside it, because it does not follow from the
+  set: the checkout board selector is refused **even when an item's allow-list
+  names it**.
+
+- **`loop/SKILL.md` paraphrased that set too, in both harnesses' copies.** The
+  step where a session composes an allow-list summarised the protected rulebook
+  in prose, so the one moment the set is read in anger was the moment it was
+  read from a summary that had already drifted. It now names
+  `RULEBOOK_PREFIXES` and says to open it. Both copies carry the change — the
+  Claude skill at `.claude/skills/loop/SKILL.md` and its Codex projection at
+  `.agents/skills/loop/SKILL.md`.
+
+### Inside the generator, and not inside a rig
+
+`packages/cli/src/policy/` is new — a typed policy declaration, a registry, a
+decision-record schema and one adapter per harness. Its compiled output adds
+eleven files to the published tarball, 245 → 256. **No command imports it**, so nothing a
+project scaffolded from this release does comes from it. What such a project
+does get from this release is the three corrected documents above — and an
+installed 0.7.1 rig still needs `create-agent-rig upgrade` to receive them —
+which is a necessary condition and not a sufficient one, because a rig whose
+owner has edited one of those three files is handed a conflict to merge rather
+than an overwrite.
+This module is named here only because a reader diffing the two tarballs sees
+eleven new files and is owed the reason they are not part of that answer.
+
+`templates/release-ledger.json` carries `0.7.1` at `52e879b6`, the commit it was
+published from, read from `npm view create-agent-rig@0.7.1 gitHead` and verified
+an ancestor of `master`. `templates/hash-history.json` is regenerated from it and
+now covers eleven releases, `0.2.0` through `0.7.1`, so `upgrade` can tell an
+untouched file from an edited one in a rig installed from 0.7.1.
+
+## 0.7.1
+
+**The gate could not be run on work that has no queue item.** `pr-ship` names
+owner-directed work and hotfixes with no item as a legitimate path — step 4
+tells the fan-out to declare it and have the reviewer skip the item-contract
+check openly. Step 1 then made that path unexecutable: it called
+`revalidate.mjs` with an unconditional `--ticket`, and the script refused
+without one. A newly scaffolded project inherited a rulebook that contradicted
+itself at the one checkpoint before every PR, so the first hotfix in a fresh rig
+had nothing it was allowed to do. Found downstream while integrating published
+0.7.0.
+
+A patch: no file is added or removed, no new dependency, and the public CLI of
+the generator is untouched. What changes is one flag on one internal script and
+the skill step that calls it.
+
+### Fixed
+
+- **`revalidate.mjs` BEFORE_PR now has two modes, and neither is inferred.**
+  `--ticket <key>` is unchanged, including the mandatory claim comparison.
+  `--owner-directed` runs the same default-branch drift comparison for work
+  with no item, reaching no tracker, no adapter and no claim record — so it
+  needs no tracker credentials. Passing both flags, or neither, is exit 1: a
+  mode chosen by absence is a mode nobody reviewed.
+
+  It is not a lighter checkpoint. A default-branch change under a path the
+  branch touches, or one a `check-premises` record cited, holds with the same
+  exit 2. What it drops is the claim comparison, because work with no item has
+  no claim to compare, and it records `ticket: null` rather than inventing an
+  id.
+
+  **Four refusals keep it from becoming a bypass** — exit 1, nothing
+  journalled: when the run carries an unresolved `revalidationHold`, when the
+  run declares a take-up, when the branch touches a tracked
+  `.rig/claims/*.json` in any direction (added, modified, removed or renamed),
+  and at `BEFORE_CLOSE`. The first is the one that makes re-running a held or
+  `UNVERIFIABLE` ticketed call in this mode a refusal rather than a way past
+  it; the run's stop inputs are read fail-closed, so an unreadable
+  `state.json` refuses instead of reading as an empty run.
+
+  An owner-directed HOLD is answered the same way a ticketed one is, with
+  `revalidate.mjs outcome` at the same point, passing `--owner-directed`
+  instead of `--ticket`. It addresses the detection by mode, since that
+  detection carries no ticket to name.
+
+  ⚠ Its stated limits, because a governance mode is trusted as far as it is
+  described. Nothing can prove an item does not exist. With no `RIG_RUN_DIR`
+  there is no run state, so the hold and take-up refusals cannot fire — the
+  command says so on stdout and in `evidence.runState` rather than reporting a
+  clean check. The claim refusal reads the branch diff, so a record already on
+  the default branch or not yet committed is not seen. And `--base` is the sole
+  authority for the verdict here, the claim comparison that would otherwise
+  survive a wrong base being absent.
+
+- **`pr-ship` step 1 states both paths**, and step 4 now spells the words the
+  fan-out is launched with — `no item — owner-directed` — and says that this
+  skips the item-contract check and **nothing else**: the checks, the routing,
+  the security, code and prose/governance reviews, the coverage check and the
+  DoD all still run.
 
 ## 0.7.0
 
@@ -56,6 +194,31 @@ a patch is the case the rule exists to prevent.
   was allowed on the original surface too — and it is unchanged by this
   release.
 
+- **A shell command the two shell guards cannot read is refused, where it used
+  to be allowed.** `guard-bash` and `block-no-verify` read the `command` a hook
+  hands them on a shell tool, and asked only whether it was a string. A command
+  that was **there** in some other container — an array of argv words, an
+  object — failed that test and returned _allow_ before the kill switch was ever
+  consulted, so restating a forbidden command in another shape stepped over an
+  armed brake. Those two guards now decide the three outcomes in one shared
+  place: an **absent** command still allows, because there is nothing to judge;
+  a **string** is inspected as before; a command that is present in a shape they
+  cannot read is **refused**, naming the shape they expected.
+
+  ⚠ The scope is those two guards, and it is narrow on purpose — it is **not** a
+  repository-wide ruling on the word `command`. `guard-secret-file` reads an
+  `apply_patch` `command` that is a _list of strings_, exactly the shape this
+  contract calls unreadable, and it is right to; routing a third guard through
+  the same place without checking what its tool actually sends would start
+  refusing input another guard exists to read.
+
+  ⚠ Two further limits. This changes only the unreadable case — the name-exact
+  bound described just above is untouched, and an absent field remains fail-open
+  on purpose, since a guard that blocked when handed nothing would be turned off
+  within the hour. And the **edit** surfaces are not part of this: what
+  `.claude/hooks/lib/edit-input.mjs` does with a `tool_input` it cannot read is
+  unchanged by this release.
+
 - **An adapter it cannot read is `UNVERIFIABLE`, not a stack trace.** A
   revalidation whose queue adapter could not be reached exited on a raw Node
   stack trace, which a caller could read as noise rather than as a hold. It now

package/README.md

@@ -116,7 +116,7 @@ wired by both `.claude/settings.json` and `.codex/hooks.json`:
   carries a credential VALUE. Both arms read one vocabulary,
   `.claude/scripts/lib/secrets.mjs`, and a refusal names the pattern and the line
   and **never the matched value** — printing it would leak the secret in the act
-  of refusing it. Its four blind spots are in its own header, each naming the
+  of refusing it. Its blind spots are in its own header, each naming the
   test that pins it or saying plainly that none does — and those tests live in
   this generator, not in the rig;
 - **`block-no-verify`** — refuses bypassing pre-commit checks (and knows the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-agent-rig",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Scaffold a new project with an agent operating system (rules, gates, hooks) and a runnable code skeleton",
   "keywords": [
     "create",

package/packages/cli/dist/policy/core/adapter.js

@@ -0,0 +1,18 @@
+/**
+ * The contract a harness adapter satisfies (RP-76).
+ *
+ * The core knows that a harness exists and has a hook-wiring surface; it does
+ * not know any harness's name, event vocabulary, tool names or paths. Those
+ * belong to the adapter, one module per harness under `../harness/`, and
+ * adding a harness means adding one such module and registering it — pinned in
+ * `test/template/policy-declaration.test.ts` under "adding a harness touches
+ * adapters only", whose two tests name exactly the files that may mention each
+ * harness. Their names carry the harness words this file may not, which is why
+ * the describe is cited here rather than either test.
+ *
+ * An adapter is a mapping, not a compiler: given a declaration it names the
+ * event, matcher and hook path the harness wires for it. The correspondence
+ * between that answer and the snapshot the rig actually ships is a test, in
+ * both directions, in the same file.
+ */
+export {};

package/packages/cli/dist/policy/core/decision-record.js

@@ -0,0 +1,201 @@
+/**
+ * The decision-record schema (RP-76): what one verdict of one policy on one
+ * harness must carry to be audited later, and the validator that refuses a
+ * record which would read as more than it is.
+ *
+ * Emitting these at runtime is a separate task; this file is the shape and the
+ * rules. The rules that go beyond "the field is in its vocabulary":
+ *
+ * - the policy must be registered and the version compatible with it, so the
+ *   record names semantics a reader can look up;
+ * - the operation must be one the policy declares;
+ * - a qualifier (`UNVERIFIABLE`, `UNMEASURED`) must carry a reason;
+ * - a capability state of `UNSUPPORTED` or `INTEGRATION-FAILED` must qualify
+ *   the verdict `UNVERIFIABLE` — an unenforceable policy never yields a silent
+ *   pass (`./vocabulary.ts`, `CAPABILITY_STATES`);
+ * - every evidence kind the policy requires must be present;
+ * - a policy that redacts must not be recorded with unredacted diagnostics;
+ * - the timestamp is supplied by the caller and must be an ISO-8601 date-time
+ *   with seconds and an explicit zone (`ISO_8601` below; a bare date is
+ *   refused) — no clock here.
+ *
+ * Each rule is one test in `packages/cli/test/policy-declaration.test.ts`
+ * under "validating a decision record".
+ *
+ * ⚠ `diagnostics.redacted` is the emitter's claim, and this validator enforces
+ * the claim's presence, not the property: a record marked redacted whose
+ * `diagnostics.text`, `observedFacts[].value` or `evidence[].value` still
+ * carries a matched value is accepted here. Scanning content would pull the
+ * secret vocabulary into the core, which the dependency-direction test
+ * forbids — so the emitting task owns that scan, over those three fields,
+ * before it persists a record.
+ */
+import { compatibilityOf, findPolicy } from './registry.js';
+import { CAPABILITY_STATES, DECISION_OUTCOMES, EVIDENCE_KINDS, OPERATIONS, VERDICT_QUALIFIERS, } from './vocabulary.js';
+import { isRecord, member, nonEmptyString, unknownKeys } from './validation.js';
+export const DECISION_RECORD_SCHEMA_VERSION = 1;
+const KEYS = [
+    'schemaVersion',
+    'policyId',
+    'policyVersion',
+    'harness',
+    'operation',
+    'capabilityState',
+    'observedFacts',
+    'verdict',
+    'evidence',
+    'artifactVersion',
+    'diagnostics',
+    'recordedAt',
+];
+const NEVER_SILENT_PASS = ['UNSUPPORTED', 'INTEGRATION-FAILED'];
+/** Date, `T`, time to the second (fractions allowed), and an explicit zone. */
+const ISO_8601 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+const namedPairs = (problems, field, value, keys) => {
+    if (!Array.isArray(value)) {
+        problems.push({ field, message: 'must be a list' });
+        return;
+    }
+    value.forEach((entry, index) => {
+        if (!isRecord(entry)) {
+            problems.push({ field: `${field}[${index}]`, message: 'must be an object' });
+            return;
+        }
+        unknownKeys(problems, entry, keys, `${field}[${index}]`);
+        for (const key of keys)
+            nonEmptyString(problems, `${field}[${index}].${key}`, entry[key]);
+    });
+};
+const checkVerdict = (problems, value, capabilityState) => {
+    if (!isRecord(value)) {
+        problems.push({ field: 'verdict', message: 'must be an object' });
+        return;
+    }
+    unknownKeys(problems, value, ['outcome', 'qualifier', 'reason'], 'verdict');
+    member(problems, 'verdict.outcome', value.outcome, DECISION_OUTCOMES);
+    const qualified = 'qualifier' in value;
+    if (qualified) {
+        member(problems, 'verdict.qualifier', value.qualifier, VERDICT_QUALIFIERS);
+        if (typeof value.reason !== 'string' || value.reason.trim() === '') {
+            problems.push({
+                field: 'verdict.reason',
+                message: `a ${String(value.qualifier)} verdict must say why`,
+            });
+        }
+    }
+    else if ('reason' in value && typeof value.reason !== 'string') {
+        problems.push({ field: 'verdict.reason', message: 'must be a string when present' });
+    }
+    if (capabilityState !== null && NEVER_SILENT_PASS.includes(capabilityState)) {
+        if (value.qualifier !== 'UNVERIFIABLE') {
+            problems.push({
+                field: 'verdict.qualifier',
+                message: `capabilityState ${capabilityState} never yields a silent pass: ` +
+                    'the verdict must be qualified UNVERIFIABLE with a reason',
+            });
+        }
+    }
+};
+const checkEvidence = (problems, value, required) => {
+    if (!Array.isArray(value)) {
+        problems.push({ field: 'evidence', message: 'must be a list' });
+        return;
+    }
+    const present = new Set();
+    value.forEach((entry, index) => {
+        if (!isRecord(entry)) {
+            problems.push({ field: `evidence[${index}]`, message: 'must be an object' });
+            return;
+        }
+        unknownKeys(problems, entry, ['kind', 'value'], `evidence[${index}]`);
+        if (member(problems, `evidence[${index}].kind`, entry.kind, EVIDENCE_KINDS)) {
+            present.add(entry.kind);
+        }
+        nonEmptyString(problems, `evidence[${index}].value`, entry.value);
+    });
+    for (const kind of required) {
+        if (!present.has(kind)) {
+            problems.push({ field: 'evidence', message: `the policy requires ${kind} evidence` });
+        }
+    }
+};
+const checkDiagnostics = (problems, value, mustRedact) => {
+    if (!isRecord(value)) {
+        problems.push({ field: 'diagnostics', message: 'must be an object' });
+        return;
+    }
+    unknownKeys(problems, value, ['redacted', 'text'], 'diagnostics');
+    if (typeof value.redacted !== 'boolean') {
+        problems.push({ field: 'diagnostics.redacted', message: 'must be a boolean' });
+    }
+    else if (mustRedact && !value.redacted) {
+        problems.push({
+            field: 'diagnostics.redacted',
+            message: 'the policy redacts matched values, so its diagnostics must be recorded redacted',
+        });
+    }
+    if (typeof value.text !== 'string') {
+        problems.push({ field: 'diagnostics.text', message: 'must be a string' });
+    }
+};
+/** Validate an unknown value as a decision record, reporting every problem at once. */
+export function validateDecisionRecord(input) {
+    if (!isRecord(input)) {
+        return { ok: false, problems: [{ field: '', message: 'a decision record is an object' }] };
+    }
+    const problems = [];
+    unknownKeys(problems, input, KEYS);
+    if (input.schemaVersion !== DECISION_RECORD_SCHEMA_VERSION) {
+        problems.push({
+            field: 'schemaVersion',
+            message: `must be ${DECISION_RECORD_SCHEMA_VERSION}, got ${String(input.schemaVersion)}`,
+        });
+    }
+    const policy = typeof input.policyId === 'string' ? findPolicy(input.policyId) : null;
+    if (policy === null) {
+        problems.push({
+            field: 'policyId',
+            message: `${JSON.stringify(input.policyId)} is not a registered policy`,
+        });
+    }
+    else if (typeof input.policyVersion === 'string') {
+        const compatibility = compatibilityOf(policy.policyId, input.policyVersion);
+        if (compatibility !== 'compatible') {
+            problems.push({
+                field: 'policyVersion',
+                message: `${JSON.stringify(input.policyVersion)} is ${compatibility} with ${policy.policyId} ${policy.policyVersion}`,
+            });
+        }
+    }
+    else {
+        nonEmptyString(problems, 'policyVersion', input.policyVersion);
+    }
+    nonEmptyString(problems, 'harness', input.harness);
+    if (member(problems, 'operation', input.operation, OPERATIONS) && policy !== null) {
+        if (!policy.operations.includes(input.operation)) {
+            problems.push({
+                field: 'operation',
+                message: `${policy.policyId} does not apply to ${input.operation}`,
+            });
+        }
+    }
+    const capabilityState = member(problems, 'capabilityState', input.capabilityState, CAPABILITY_STATES)
+        ? input.capabilityState
+        : null;
+    namedPairs(problems, 'observedFacts', input.observedFacts, ['name', 'value']);
+    checkVerdict(problems, input.verdict, capabilityState);
+    checkEvidence(problems, input.evidence, policy?.requiredEvidence ?? []);
+    nonEmptyString(problems, 'artifactVersion', input.artifactVersion);
+    checkDiagnostics(problems, input.diagnostics, policy !== null && policy.redaction !== 'none');
+    if (typeof input.recordedAt !== 'string' ||
+        !ISO_8601.test(input.recordedAt) ||
+        Number.isNaN(Date.parse(input.recordedAt))) {
+        problems.push({
+            field: 'recordedAt',
+            message: `must be an ISO-8601 date-time with seconds and an explicit zone, got ${JSON.stringify(input.recordedAt)}`,
+        });
+    }
+    if (problems.length > 0)
+        return { ok: false, problems };
+    return { ok: true, value: input };
+}

package/packages/cli/dist/policy/core/declaration.js

@@ -0,0 +1,86 @@
+/**
+ * The typed policy declaration (RP-76).
+ *
+ * A declaration is the semantic source of one policy: what the invariant is,
+ * where it applies, what the mechanism can answer, how it fails, what a
+ * verdict must carry as evidence, and which version of those semantics a
+ * decision record is talking about. It is data plus a validator — not a policy
+ * language, not an interpreter, not a compiler: a harness adapter reads a
+ * declaration and names its own native surface for it (`./adapter.ts`), and
+ * that is the whole of the transformation.
+ *
+ * The shape is closed: a field this interface does not name is refused, so a
+ * field added by mistake cannot travel unnoticed into a record somebody later
+ * audits. Every enumerated field draws from `./vocabulary.ts`.
+ */
+import { AUTONOMY_TIERS, DECISION_OUTCOMES, ENFORCEMENT_TIMINGS, EVIDENCE_KINDS, FAILURE_SEMANTICS, HARNESS_CAPABILITIES, LIFECYCLE_STATES, OPERATIONS, REDACTION_RULES, } from './vocabulary.js';
+import { isRecord, matching, member, members, nonEmptyString, unknownKeys } from './validation.js';
+const KEYS = [
+    'policyId',
+    'policyVersion',
+    'lifecycle',
+    'invariant',
+    'tier',
+    'operations',
+    'timing',
+    'requiredCapability',
+    'mechanism',
+    'outcomes',
+    'onInternalError',
+    'onUnreadableInput',
+    'requiredEvidence',
+    'redaction',
+    'statedIn',
+];
+export const KEBAB_CASE = /^[a-z][a-z0-9-]*$/;
+export const POLICY_VERSION = /^\d+\.\d+$/;
+/** Validate an unknown value as a declaration, reporting every problem at once. */
+export function validateDeclaration(input) {
+    if (!isRecord(input)) {
+        return { ok: false, problems: [{ field: '', message: 'a declaration is an object' }] };
+    }
+    const problems = [];
+    unknownKeys(problems, input, KEYS);
+    matching(problems, 'policyId', input.policyId, KEBAB_CASE, 'kebab-case');
+    matching(problems, 'policyVersion', input.policyVersion, POLICY_VERSION, 'MAJOR.MINOR');
+    member(problems, 'lifecycle', input.lifecycle, LIFECYCLE_STATES);
+    nonEmptyString(problems, 'invariant', input.invariant);
+    member(problems, 'tier', input.tier, AUTONOMY_TIERS);
+    members(problems, 'operations', input.operations, OPERATIONS, { nonEmpty: true });
+    member(problems, 'timing', input.timing, ENFORCEMENT_TIMINGS);
+    member(problems, 'requiredCapability', input.requiredCapability, HARNESS_CAPABILITIES);
+    matching(problems, 'mechanism', input.mechanism, KEBAB_CASE, 'kebab-case');
+    members(problems, 'outcomes', input.outcomes, DECISION_OUTCOMES, { nonEmpty: true });
+    member(problems, 'onInternalError', input.onInternalError, FAILURE_SEMANTICS);
+    member(problems, 'onUnreadableInput', input.onUnreadableInput, FAILURE_SEMANTICS);
+    members(problems, 'requiredEvidence', input.requiredEvidence, EVIDENCE_KINDS, {
+        nonEmpty: false,
+    });
+    member(problems, 'redaction', input.redaction, REDACTION_RULES);
+    nonEmptyString(problems, 'statedIn', input.statedIn);
+    if (problems.length > 0)
+        return { ok: false, problems };
+    // Every field above was checked against the shape, so the narrowing is earned
+    // rather than asserted: the cast is to the type the checks just established.
+    return { ok: true, value: input };
+}
+/**
+ * Define a policy: validate it and hand back a frozen copy. Throws an Error
+ * whose message lists every problem as `field: message`, so a registry that
+ * loads at import time fails with the whole list rather than one line at a
+ * time.
+ */
+export function definePolicy(input) {
+    const result = validateDeclaration(input);
+    if (!result.ok) {
+        const lines = result.problems.map(({ field, message }) => `${field}: ${message}`);
+        throw new Error(`invalid policy declaration:\n  ${lines.join('\n  ')}`);
+    }
+    const policy = result.value;
+    return Object.freeze({
+        ...policy,
+        operations: Object.freeze([...policy.operations]),
+        outcomes: Object.freeze([...policy.outcomes]),
+        requiredEvidence: Object.freeze([...policy.requiredEvidence]),
+    });
+}

package/packages/cli/dist/policy/core/registry.js

@@ -0,0 +1,115 @@
+/**
+ * The policy registry (RP-76): the declarations of the policies this rig
+ * enforces, and the compatibility rule a decision record is read against.
+ *
+ * The three entries are the guards the rulebook already ships; declaring them
+ * changes nothing about how they run. Each field below was read off the
+ * guard's own header and its tests rather than inferred from its name, and the
+ * correspondence between a declaration and the hook wiring both harnesses
+ * carry is pinned in `test/template/policy-declaration.test.ts` › "every
+ * registered policy is wired in the %s snapshot under its event, matcher and
+ * hook path". Which hook file a mechanism name resolves to is the adapter's
+ * business (`../harness/`), not this file's.
+ */
+import { definePolicy } from './declaration.js';
+import { POLICY_VERSION } from './declaration.js';
+const NEVER_TIER = 'rules/autonomy.md#never';
+/**
+ * What the three share, stated once: each is a pre-operation hook of the
+ * Never tier that can allow, block, or refuse to inspect; each fails open on
+ * its own error and closed on input it can see but cannot read
+ * (`rules/invariants.md`, "Fail closed on a match, fail open on an error" and
+ * "Refusing to inspect is a third outcome"). The one evidence every outcome
+ * carries is the exit code; a refusal also prints a diagnostic line, an allow
+ * prints nothing, so `diagnostic-text` is not required of every record.
+ */
+const guard = (declaration) => definePolicy({
+    policyVersion: '1.0',
+    lifecycle: 'active',
+    tier: 'never',
+    timing: 'before-operation',
+    requiredCapability: 'pre-operation-hook',
+    outcomes: ['allow', 'block', 'refuse-to-inspect'],
+    onInternalError: 'fail-open',
+    onUnreadableInput: 'fail-closed',
+    requiredEvidence: ['exit-code'],
+    statedIn: NEVER_TIER,
+    ...declaration,
+});
+/**
+ * Secret-write refusal. The guard refuses an edit that names a credential file
+ * or carries a credential value; the value arm never prints what it matched —
+ * `test/template/guard-secret-file.test.ts` › "never prints the credential it
+ * found, nor a fragment of it" — which is what `omit-matched-values` records.
+ */
+const secretWriteRefusal = guard({
+    policyId: 'secret-write-refusal',
+    invariant: 'A credential never enters the repository through an edit.',
+    operations: ['file-edit'],
+    mechanism: 'guard-secret-file',
+    redaction: 'omit-matched-values',
+});
+/**
+ * No-verify refusal. The guard refuses a shell command that bypasses the
+ * pre-commit gate — `test/template/shell-tools.test.ts` › "refuses a
+ * pre-commit bypass through %s" pins the block on every shell tool. The
+ * refuse-to-inspect outcome and the fail-open on an unparseable payload are
+ * `test/template/hook-command-shape.test.ts` › "%s does not tell the caller to
+ * split and retry" and › "allows a malformed payload it cannot parse at all".
+ * ⚠ One limit of `onInternalError: 'fail-open'` for this guard: it has no
+ * try/catch, so an internal throw exits 1, which the harness reads as allow —
+ * a property of the harness that no test here pins.
+ */
+const noVerifyRefusal = guard({
+    policyId: 'no-verify-refusal',
+    invariant: 'The pre-commit gate is never bypassed.',
+    operations: ['shell-command'],
+    mechanism: 'block-no-verify',
+    redaction: 'none',
+});
+/**
+ * Rulebook-mutation restriction. In an unattended run the guard refuses an
+ * edit under a rulebook prefix outside the current item's allow-list; in an
+ * attended session it does nothing — `test/template/guard-rulebook.test.ts` ›
+ * "blocks an edit to a rulebook path the allow-list does not name" and ›
+ * "allows a hook edit when no unattended flag exists".
+ */
+const rulebookMutationRestriction = guard({
+    policyId: 'rulebook-mutation-restriction',
+    invariant: "In an unattended run, the rulebook is never edited outside the current item's allow-list.",
+    operations: ['file-edit'],
+    mechanism: 'guard-rulebook',
+    redaction: 'none',
+});
+/** Every declared policy, in declaration order. */
+export const POLICIES = Object.freeze([
+    secretWriteRefusal,
+    noVerifyRefusal,
+    rulebookMutationRestriction,
+]);
+export function findPolicy(policyId) {
+    return POLICIES.find((policy) => policy.policyId === policyId) ?? null;
+}
+export function policyIds() {
+    return POLICIES.map((policy) => policy.policyId);
+}
+/** The policies the registry still offers — everything not retired. */
+export function activePolicies() {
+    return POLICIES.filter((policy) => policy.lifecycle !== 'retired');
+}
+const majorOf = (version) => Number(version.split('.')[0]);
+/**
+ * Can a decision record naming `policyVersion` be read against the registered
+ * policy? Same MAJOR: yes, whatever the MINOR — a MINOR bump is additive.
+ * Different MAJOR: no, the semantics that produced the verdict are not these.
+ * A version that is not `MAJOR.MINOR` is refused as malformed rather than
+ * parsed for a MAJOR it might have meant.
+ */
+export function compatibilityOf(policyId, policyVersion) {
+    const policy = findPolicy(policyId);
+    if (policy === null)
+        return 'unknown-policy';
+    if (!POLICY_VERSION.test(policyVersion))
+        return 'malformed-version';
+    return majorOf(policyVersion) === majorOf(policy.policyVersion) ? 'compatible' : 'incompatible';
+}