deepdebug-local-agent 1.9.0 → 1.11.0

package/test/contract/la-protocol-v2/vectors/policy.check.vectors.json

@@ -0,0 +1,908 @@
+{
+  "type": "policy.check",
+  "schema": "policy.check.schema.json",
+  "vectors": [
+    {
+      "name": "full-valid",
+      "expect": {
+        "valid": true
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "APPLY_PATCH",
+          "toolName": "mcp.apply-patch",
+          "requestHash": "abababababababababababababababababababababababababababababababab",
+          "repoRefs": [
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "billing"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart"
+        }
+      }
+    },
+    {
+      "name": "minimal-valid",
+      "why": "the two required fields only: no repo, no incident, no tool name",
+      "expect": {
+        "valid": true
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "RUN_SHELL_SAFE",
+          "requestHash": "abababababababababababababababababababababababababababababababab"
+        }
+      }
+    },
+    {
+      "name": "several-repos-valid",
+      "why": "a multi-repo publish names every repository it touches",
+      "expect": {
+        "valid": true
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "APPLY_PATCH",
+          "toolName": "mcp.apply-patch",
+          "requestHash": "abababababababababababababababababababababababababababababababab",
+          "repoRefs": [
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "billing"
+            },
+            {
+              "provider": "gitlab",
+              "org": "acme",
+              "repo": "web"
+            },
+            {
+              "provider": "other",
+              "org": "acme",
+              "repo": "docs"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart"
+        }
+      }
+    },
+    {
+      "name": "empty-workspace-valid",
+      "why": "workspaceId may be empty (envelope rule); the CP then denies it as workspace_unknown, the frame itself is valid",
+      "expect": {
+        "valid": true
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "APPLY_PATCH",
+          "toolName": "mcp.apply-patch",
+          "requestHash": "abababababababababababababababababababababababababababababababab",
+          "repoRefs": [
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "billing"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart"
+        }
+      }
+    },
+    {
+      "name": "opaque-ids-valid",
+      "expect": {
+        "valid": true
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "OPEN_PR",
+          "toolName": "github_open_pr",
+          "requestHash": "0000000000000000000000000000000000000000000000000000000000000000",
+          "incidentId": "8c8deab3",
+          "modelAlias": "vh-coder"
+        }
+      }
+    },
+    {
+      "name": "tenant-id-in-payload",
+      "why": "the tenant comes from the authenticated session, never from the payload",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "additionalProperties"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "APPLY_PATCH",
+          "toolName": "mcp.apply-patch",
+          "requestHash": "abababababababababababababababababababababababababababababababab",
+          "repoRefs": [
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "billing"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart",
+          "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f"
+        }
+      }
+    },
+    {
+      "name": "execution-origin-in-payload",
+      "why": "the execution origin is derived by the CP from the session; an LA cannot claim it",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "additionalProperties"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "APPLY_PATCH",
+          "toolName": "mcp.apply-patch",
+          "requestHash": "abababababababababababababababababababababababababababababababab",
+          "repoRefs": [
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "billing"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart",
+          "executionOrigin": "local-agent"
+        }
+      }
+    },
+    {
+      "name": "agent-id-in-payload",
+      "why": "the agent comes from the session",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "additionalProperties"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "APPLY_PATCH",
+          "toolName": "mcp.apply-patch",
+          "requestHash": "abababababababababababababababababababababababababababababababab",
+          "repoRefs": [
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "billing"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart",
+          "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"
+        }
+      }
+    },
+    {
+      "name": "file-paths-in-payload",
+      "why": "no paths and no content: the file scope never leaves the customer",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "additionalProperties"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "APPLY_PATCH",
+          "toolName": "mcp.apply-patch",
+          "requestHash": "abababababababababababababababababababababababababababababababab",
+          "repoRefs": [
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "billing"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart",
+          "diffFiles": [
+            "src/main/App.java"
+          ]
+        }
+      }
+    },
+    {
+      "name": "diff-content-in-payload",
+      "why": "no diff, no command text, no content of any kind",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "additionalProperties"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "APPLY_PATCH",
+          "toolName": "mcp.apply-patch",
+          "requestHash": "abababababababababababababababababababababababababababababababab",
+          "repoRefs": [
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "billing"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart",
+          "command": "rm -rf /"
+        }
+      }
+    },
+    {
+      "name": "repo-url-with-credentials",
+      "why": "a repository is {provider, org, repo}; a URL (which could carry a token) is not a field",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "additionalProperties"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "APPLY_PATCH",
+          "toolName": "mcp.apply-patch",
+          "requestHash": "abababababababababababababababababababababababababababababababab",
+          "repoRefs": [
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "billing",
+              "url": "https://x:tok@github.com/acme/billing.git"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart"
+        }
+      }
+    },
+    {
+      "name": "repo-extra-branch",
+      "why": "the repo ref of a check has no branch (it is not needed to decide)",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "additionalProperties"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "APPLY_PATCH",
+          "toolName": "mcp.apply-patch",
+          "requestHash": "abababababababababababababababababababababababababababababababab",
+          "repoRefs": [
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "billing",
+              "branch": "main"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart"
+        }
+      }
+    },
+    {
+      "name": "missing-request-hash",
+      "why": "the hash ties the decision (and a later approval) to this exact request",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "required"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "APPLY_PATCH",
+          "toolName": "mcp.apply-patch",
+          "repoRefs": [
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "billing"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart"
+        }
+      }
+    },
+    {
+      "name": "request-hash-not-sha256",
+      "why": "requestHash is 64 lower-case hex",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "pattern"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "APPLY_PATCH",
+          "toolName": "mcp.apply-patch",
+          "requestHash": "ABCDEF",
+          "repoRefs": [
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "billing"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart"
+        }
+      }
+    },
+    {
+      "name": "missing-action-type",
+      "why": "actionType is required",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "required"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "toolName": "mcp.apply-patch",
+          "requestHash": "abababababababababababababababababababababababababababababababab",
+          "repoRefs": [
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "billing"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart"
+        }
+      }
+    },
+    {
+      "name": "action-type-with-space",
+      "why": "actionType is a short id: no space, no shell character",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "pattern"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "apply patch; rm",
+          "toolName": "mcp.apply-patch",
+          "requestHash": "abababababababababababababababababababababababababababababababab",
+          "repoRefs": [
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "billing"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart"
+        }
+      }
+    },
+    {
+      "name": "repo-refs-empty",
+      "why": "repoRefs, when present, names at least one repository",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "minItems"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "APPLY_PATCH",
+          "toolName": "mcp.apply-patch",
+          "requestHash": "abababababababababababababababababababababababababababababababab",
+          "repoRefs": [],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart"
+        }
+      }
+    },
+    {
+      "name": "repo-refs-too-many",
+      "why": "at most 8 repositories",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "maxItems"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "APPLY_PATCH",
+          "toolName": "mcp.apply-patch",
+          "requestHash": "abababababababababababababababababababababababababababababababab",
+          "repoRefs": [
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "r0"
+            },
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "r1"
+            },
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "r2"
+            },
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "r3"
+            },
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "r4"
+            },
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "r5"
+            },
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "r6"
+            },
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "r7"
+            },
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "r8"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart"
+        }
+      }
+    },
+    {
+      "name": "provider-unknown",
+      "why": "provider is a closed list",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "enum"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "APPLY_PATCH",
+          "toolName": "mcp.apply-patch",
+          "requestHash": "abababababababababababababababababababababababababababababababab",
+          "repoRefs": [
+            {
+              "provider": "svn",
+              "org": "acme",
+              "repo": "billing"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart"
+        }
+      }
+    },
+    {
+      "name": "job-id-not-uuid",
+      "why": "jobId is the UUID of the job",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "pattern"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "APPLY_PATCH",
+          "toolName": "mcp.apply-patch",
+          "requestHash": "abababababababababababababababababababababababababababababababab",
+          "repoRefs": [
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "billing"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "job-1",
+          "modelAlias": "vh-smart"
+        }
+      }
+    },
+    {
+      "name": "missing-request-id",
+      "why": "the envelope requestId correlates the decision",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "required"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "APPLY_PATCH",
+          "toolName": "mcp.apply-patch",
+          "requestHash": "abababababababababababababababababababababababababababababababab",
+          "repoRefs": [
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "billing"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart"
+        }
+      }
+    },
+    {
+      "name": "request-id-not-uuid",
+      "why": "requestId is a UUID",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "pattern"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "req-1",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "APPLY_PATCH",
+          "toolName": "mcp.apply-patch",
+          "requestHash": "abababababababababababababababababababababababababababababababab",
+          "repoRefs": [
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "billing"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart"
+        }
+      }
+    },
+    {
+      "name": "missing-agent-id",
+      "why": "an LA->CP frame carries its agentId",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "required"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "payload": {
+          "actionType": "APPLY_PATCH",
+          "toolName": "mcp.apply-patch",
+          "requestHash": "abababababababababababababababababababababababababababababababab",
+          "repoRefs": [
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "billing"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart"
+        }
+      }
+    },
+    {
+      "name": "extra-top-level-field",
+      "why": "envelope is closed",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation",
+        "keyword": "additionalProperties"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "APPLY_PATCH",
+          "toolName": "mcp.apply-patch",
+          "requestHash": "abababababababababababababababababababababababababababababababab",
+          "repoRefs": [
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "billing"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart"
+        },
+        "extra": "x"
+      }
+    },
+    {
+      "name": "signed-by-the-agent",
+      "why": "LA->CP frames are not signed (the session authenticates them): sig and paramsRaw are forbidden",
+      "expect": {
+        "valid": false,
+        "code": "schema_violation"
+      },
+      "message": {
+        "schemaVersion": 2,
+        "type": "policy.check",
+        "msgId": "00000000-0000-4000-8000-000000000001",
+        "seq": 1,
+        "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
+        "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+        "workspaceId": "ws-1",
+        "ts": "2026-11-04T10:00:00Z",
+        "agentId": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+        "payload": {
+          "actionType": "APPLY_PATCH",
+          "toolName": "mcp.apply-patch",
+          "requestHash": "abababababababababababababababababababababababababababababababab",
+          "repoRefs": [
+            {
+              "provider": "github",
+              "org": "acme",
+              "repo": "billing"
+            }
+          ],
+          "incidentId": "inc-8c8deab3",
+          "jobId": "c3d4e5f6-a7b8-4c9d-8e0f-2a3b4c5d6e7f",
+          "modelAlias": "vh-smart"
+        },
+        "sig": {
+          "keyId": "vh-cp-2026-10",
+          "timestamp": "1793268000",
+          "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
+          "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
+          "workspaceId": "ws-1",
+          "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
+        },
+        "paramsRaw": "{}"
+      }
+    }
+  ]
+}