deepdebug-local-agent 1.9.0 → 1.11.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (65) hide show
  1. package/AGENTS.md +1 -1
  2. package/CHANGELOG.md +5 -0
  3. package/CLAUDE.md +1 -1
  4. package/docs/examples/agent2-runner/docker-compose.yml +53 -0
  5. package/docs/la-agent2-runner.md +115 -0
  6. package/docs/la-jobs-and-llm.md +62 -0
  7. package/docs/la-protocol-v2.md +7 -5
  8. package/env.example +12 -0
  9. package/package.json +1 -1
  10. package/src/la-protocol-v2/content-handlers/install.js +27 -1
  11. package/src/la-protocol-v2/contract/CONTRACT_SOURCE.json +10 -6
  12. package/src/la-protocol-v2/contract/README.md +75 -2
  13. package/src/la-protocol-v2/contract/envelope.schema.json +3 -1
  14. package/src/la-protocol-v2/contract/index.json +18 -2
  15. package/src/la-protocol-v2/contract/job.assign.schema.json +31 -0
  16. package/src/la-protocol-v2/contract/policy.check.schema.json +97 -0
  17. package/src/la-protocol-v2/contract/policy.decision.schema.json +119 -0
  18. package/src/la-protocol-v2/jobs/agent2/api-client.js +150 -0
  19. package/src/la-protocol-v2/jobs/agent2/approvals.js +114 -0
  20. package/src/la-protocol-v2/jobs/agent2/bridge.js +299 -0
  21. package/src/la-protocol-v2/jobs/agent2/config.js +128 -0
  22. package/src/la-protocol-v2/jobs/agent2/frames.js +61 -0
  23. package/src/la-protocol-v2/jobs/agent2/policy-check.js +170 -0
  24. package/src/la-protocol-v2/jobs/agent2/runner.js +258 -0
  25. package/src/la-protocol-v2/jobs/agent2/supervisor.js +269 -0
  26. package/src/la-protocol-v2/jobs/config.js +60 -0
  27. package/src/la-protocol-v2/jobs/events.js +106 -0
  28. package/src/la-protocol-v2/jobs/install.js +43 -0
  29. package/src/la-protocol-v2/jobs/manager.js +281 -0
  30. package/src/la-protocol-v2/jobs/options.js +56 -0
  31. package/src/la-protocol-v2/jobs/smoke-runner.js +39 -0
  32. package/src/la-protocol-v2/llm/client.js +432 -0
  33. package/src/la-protocol-v2/llm/config.js +63 -0
  34. package/src/la-protocol-v2/llm/install.js +17 -0
  35. package/src/la-protocol-v2/llm-key/store.js +10 -0
  36. package/src/la-protocol-v2/runtime.js +69 -3
  37. package/src/server.js +4 -0
  38. package/src/utils/approval-token.js +3 -2
  39. package/test/contract/la-protocol-v2/vectors/job.assign.vectors.json +1538 -0
  40. package/test/contract/la-protocol-v2/vectors/policy.check.vectors.json +908 -0
  41. package/test/contract/la-protocol-v2/vectors/policy.decision.vectors.json +826 -0
  42. package/test/la-protocol-v2/agent2-approval-discovery.test.js +114 -0
  43. package/test/la-protocol-v2/agent2-config.test.js +103 -0
  44. package/test/la-protocol-v2/agent2-orphan.test.js +118 -0
  45. package/test/la-protocol-v2/agent2-policy-check.test.js +273 -0
  46. package/test/la-protocol-v2/agent2-real-e2e.test.js +89 -0
  47. package/test/la-protocol-v2/agent2-runner.test.js +510 -0
  48. package/test/la-protocol-v2/agent2-supervisor.test.js +185 -0
  49. package/test/la-protocol-v2/agent2-workspace-door.test.js +142 -0
  50. package/test/la-protocol-v2/agent2-workspace-real-server.test.js +137 -0
  51. package/test/la-protocol-v2/contract-v21.test.js +2 -2
  52. package/test/la-protocol-v2/contract.test.js +8 -7
  53. package/test/la-protocol-v2/helpers/agent2-rig.js +96 -0
  54. package/test/la-protocol-v2/helpers/fake-agent2-cli.js +22 -0
  55. package/test/la-protocol-v2/helpers/fake-agent2.js +280 -0
  56. package/test/la-protocol-v2/helpers/fake-la-api.js +29 -0
  57. package/test/la-protocol-v2/helpers/fake-llm.js +75 -0
  58. package/test/la-protocol-v2/helpers/reference-cp.js +6 -3
  59. package/test/la-protocol-v2/helpers/spawn-agent.js +4 -3
  60. package/test/la-protocol-v2/helpers/supervisor-exit-script.js +15 -0
  61. package/test/la-protocol-v2/jobs-e2e.test.js +405 -0
  62. package/test/la-protocol-v2/jobs-manager.test.js +370 -0
  63. package/test/la-protocol-v2/jobs-options.test.js +288 -0
  64. package/test/la-protocol-v2/llm-client.test.js +380 -0
  65. package/test/la-protocol-v2/llm-messages.test.js +132 -0
package/test/contract/la-protocol-v2/vectors/policy.decision.vectors.json ADDED
@@ -0,0 +1,826 @@
1
+ {
2
+ "type": "policy.decision",
3
+ "schema": "policy.decision.schema.json",
4
+ "vectors": [
5
+ {
6
+ "name": "allow-valid",
7
+ "expect": {
8
+ "valid": true
9
+ },
10
+ "message": {
11
+ "schemaVersion": 2,
12
+ "type": "policy.decision",
13
+ "msgId": "00000000-0000-4000-8000-000000000001",
14
+ "seq": 1,
15
+ "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
16
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
17
+ "workspaceId": "ws-1",
18
+ "ts": "2026-11-04T10:00:00Z",
19
+ "paramsRaw": "{\"decision\":\"ALLOW\",\"reasonCode\":\"autonomous\",\"shadow\":false,\"approvalRequired\":false,\"actionType\":\"APPLY_PATCH\",\"effectiveMode\":\"autonomous\",\"requestHash\":\"abababababababababababababababababababababababababababababababab\",\"policySnapshot\":{\"hash\":\"cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd\"}}",
20
+ "sig": {
21
+ "keyId": "vh-cp-2026-10",
22
+ "timestamp": "1793268000",
23
+ "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
24
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
25
+ "workspaceId": "ws-1",
26
+ "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
27
+ },
28
+ "payload": {
29
+ "decision": "ALLOW",
30
+ "reasonCode": "autonomous",
31
+ "shadow": false,
32
+ "approvalRequired": false,
33
+ "actionType": "APPLY_PATCH",
34
+ "effectiveMode": "autonomous",
35
+ "requestHash": "abababababababababababababababababababababababababababababababab",
36
+ "policySnapshot": {
37
+ "hash": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
38
+ }
39
+ }
40
+ }
41
+ },
42
+ {
43
+ "name": "deny-valid",
44
+ "why": "a denial carries a closed reason code, no free text",
45
+ "expect": {
46
+ "valid": true
47
+ },
48
+ "message": {
49
+ "schemaVersion": 2,
50
+ "type": "policy.decision",
51
+ "msgId": "00000000-0000-4000-8000-000000000001",
52
+ "seq": 1,
53
+ "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
54
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
55
+ "workspaceId": "ws-1",
56
+ "ts": "2026-11-04T10:00:00Z",
57
+ "paramsRaw": "{\"decision\":\"DENY\",\"reasonCode\":\"data_plane_origin\",\"shadow\":false,\"approvalRequired\":false,\"actionType\":\"APPLY_PATCH\",\"effectiveMode\":\"autonomous\",\"requestHash\":\"abababababababababababababababababababababababababababababababab\",\"policySnapshot\":{\"hash\":\"cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd\"}}",
58
+ "sig": {
59
+ "keyId": "vh-cp-2026-10",
60
+ "timestamp": "1793268000",
61
+ "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
62
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
63
+ "workspaceId": "ws-1",
64
+ "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
65
+ },
66
+ "payload": {
67
+ "decision": "DENY",
68
+ "reasonCode": "data_plane_origin",
69
+ "shadow": false,
70
+ "approvalRequired": false,
71
+ "actionType": "APPLY_PATCH",
72
+ "effectiveMode": "autonomous",
73
+ "requestHash": "abababababababababababababababababababababababababababababababab",
74
+ "policySnapshot": {
75
+ "hash": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
76
+ }
77
+ }
78
+ }
79
+ },
80
+ {
81
+ "name": "require-human-valid",
82
+ "why": "enforced REQUIRE_HUMAN: the LA must wait for an approval (approval.decision)",
83
+ "expect": {
84
+ "valid": true
85
+ },
86
+ "message": {
87
+ "schemaVersion": 2,
88
+ "type": "policy.decision",
89
+ "msgId": "00000000-0000-4000-8000-000000000001",
90
+ "seq": 1,
91
+ "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
92
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
93
+ "workspaceId": "ws-1",
94
+ "ts": "2026-11-04T10:00:00Z",
95
+ "paramsRaw": "{\"decision\":\"REQUIRE_HUMAN\",\"reasonCode\":\"assist_mode\",\"shadow\":false,\"approvalRequired\":true,\"actionType\":\"APPLY_PATCH\",\"effectiveMode\":\"assist\",\"requestHash\":\"abababababababababababababababababababababababababababababababab\",\"policySnapshot\":{\"hash\":\"cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd\"}}",
96
+ "sig": {
97
+ "keyId": "vh-cp-2026-10",
98
+ "timestamp": "1793268000",
99
+ "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
100
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
101
+ "workspaceId": "ws-1",
102
+ "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
103
+ },
104
+ "payload": {
105
+ "decision": "REQUIRE_HUMAN",
106
+ "reasonCode": "assist_mode",
107
+ "shadow": false,
108
+ "approvalRequired": true,
109
+ "actionType": "APPLY_PATCH",
110
+ "effectiveMode": "assist",
111
+ "requestHash": "abababababababababababababababababababababababababababababababab",
112
+ "policySnapshot": {
113
+ "hash": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
114
+ }
115
+ }
116
+ }
117
+ },
118
+ {
119
+ "name": "shadow-require-human-valid",
120
+ "why": "advisory (shadow) verdict: recorded, never blocks, so no approval is required",
121
+ "expect": {
122
+ "valid": true
123
+ },
124
+ "message": {
125
+ "schemaVersion": 2,
126
+ "type": "policy.decision",
127
+ "msgId": "00000000-0000-4000-8000-000000000001",
128
+ "seq": 1,
129
+ "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
130
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
131
+ "workspaceId": "ws-1",
132
+ "ts": "2026-11-04T10:00:00Z",
133
+ "paramsRaw": "{\"decision\":\"REQUIRE_HUMAN\",\"reasonCode\":\"assist_mode\",\"shadow\":true,\"approvalRequired\":false,\"actionType\":\"APPLY_PATCH\",\"effectiveMode\":\"autonomous\",\"requestHash\":\"abababababababababababababababababababababababababababababababab\",\"policySnapshot\":{\"hash\":\"cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd\"}}",
134
+ "sig": {
135
+ "keyId": "vh-cp-2026-10",
136
+ "timestamp": "1793268000",
137
+ "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
138
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
139
+ "workspaceId": "ws-1",
140
+ "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
141
+ },
142
+ "payload": {
143
+ "decision": "REQUIRE_HUMAN",
144
+ "reasonCode": "assist_mode",
145
+ "shadow": true,
146
+ "approvalRequired": false,
147
+ "actionType": "APPLY_PATCH",
148
+ "effectiveMode": "autonomous",
149
+ "requestHash": "abababababababababababababababababababababababababababababababab",
150
+ "policySnapshot": {
151
+ "hash": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
152
+ }
153
+ }
154
+ }
155
+ },
156
+ {
157
+ "name": "cp-only-code-valid",
158
+ "why": "codes the CP itself produces (rate_limited, not_client_mode, workspace_unknown) are in the same closed shape",
159
+ "expect": {
160
+ "valid": true
161
+ },
162
+ "message": {
163
+ "schemaVersion": 2,
164
+ "type": "policy.decision",
165
+ "msgId": "00000000-0000-4000-8000-000000000001",
166
+ "seq": 1,
167
+ "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
168
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
169
+ "workspaceId": "ws-1",
170
+ "ts": "2026-11-04T10:00:00Z",
171
+ "paramsRaw": "{\"decision\":\"DENY\",\"reasonCode\":\"rate_limited\",\"shadow\":false,\"approvalRequired\":false,\"actionType\":\"APPLY_PATCH\",\"effectiveMode\":\"none\",\"requestHash\":\"abababababababababababababababababababababababababababababababab\",\"policySnapshot\":{\"hash\":\"cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd\"}}",
172
+ "sig": {
173
+ "keyId": "vh-cp-2026-10",
174
+ "timestamp": "1793268000",
175
+ "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
176
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
177
+ "workspaceId": "ws-1",
178
+ "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
179
+ },
180
+ "payload": {
181
+ "decision": "DENY",
182
+ "reasonCode": "rate_limited",
183
+ "shadow": false,
184
+ "approvalRequired": false,
185
+ "actionType": "APPLY_PATCH",
186
+ "effectiveMode": "none",
187
+ "requestHash": "abababababababababababababababababababababababababababababababab",
188
+ "policySnapshot": {
189
+ "hash": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
190
+ }
191
+ }
192
+ }
193
+ },
194
+ {
195
+ "name": "lowercase-decision",
196
+ "why": "decision is ALLOW, DENY or REQUIRE_HUMAN",
197
+ "expect": {
198
+ "valid": false,
199
+ "code": "schema_violation",
200
+ "keyword": "enum"
201
+ },
202
+ "message": {
203
+ "schemaVersion": 2,
204
+ "type": "policy.decision",
205
+ "msgId": "00000000-0000-4000-8000-000000000001",
206
+ "seq": 1,
207
+ "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
208
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
209
+ "workspaceId": "ws-1",
210
+ "ts": "2026-11-04T10:00:00Z",
211
+ "paramsRaw": "{\"decision\":\"allow\",\"reasonCode\":\"autonomous\",\"shadow\":false,\"approvalRequired\":false,\"actionType\":\"APPLY_PATCH\",\"effectiveMode\":\"autonomous\",\"requestHash\":\"abababababababababababababababababababababababababababababababab\",\"policySnapshot\":{\"hash\":\"cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd\"}}",
212
+ "sig": {
213
+ "keyId": "vh-cp-2026-10",
214
+ "timestamp": "1793268000",
215
+ "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
216
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
217
+ "workspaceId": "ws-1",
218
+ "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
219
+ },
220
+ "payload": {
221
+ "decision": "allow",
222
+ "reasonCode": "autonomous",
223
+ "shadow": false,
224
+ "approvalRequired": false,
225
+ "actionType": "APPLY_PATCH",
226
+ "effectiveMode": "autonomous",
227
+ "requestHash": "abababababababababababababababababababababababababababababababab",
228
+ "policySnapshot": {
229
+ "hash": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
230
+ }
231
+ }
232
+ }
233
+ },
234
+ {
235
+ "name": "unknown-decision",
236
+ "why": "a closed list: no MAYBE",
237
+ "expect": {
238
+ "valid": false,
239
+ "code": "schema_violation",
240
+ "keyword": "enum"
241
+ },
242
+ "message": {
243
+ "schemaVersion": 2,
244
+ "type": "policy.decision",
245
+ "msgId": "00000000-0000-4000-8000-000000000001",
246
+ "seq": 1,
247
+ "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
248
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
249
+ "workspaceId": "ws-1",
250
+ "ts": "2026-11-04T10:00:00Z",
251
+ "paramsRaw": "{\"decision\":\"MAYBE\",\"reasonCode\":\"autonomous\",\"shadow\":false,\"approvalRequired\":false,\"actionType\":\"APPLY_PATCH\",\"effectiveMode\":\"autonomous\",\"requestHash\":\"abababababababababababababababababababababababababababababababab\",\"policySnapshot\":{\"hash\":\"cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd\"}}",
252
+ "sig": {
253
+ "keyId": "vh-cp-2026-10",
254
+ "timestamp": "1793268000",
255
+ "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
256
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
257
+ "workspaceId": "ws-1",
258
+ "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
259
+ },
260
+ "payload": {
261
+ "decision": "MAYBE",
262
+ "reasonCode": "autonomous",
263
+ "shadow": false,
264
+ "approvalRequired": false,
265
+ "actionType": "APPLY_PATCH",
266
+ "effectiveMode": "autonomous",
267
+ "requestHash": "abababababababababababababababababababababababababababababababab",
268
+ "policySnapshot": {
269
+ "hash": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
270
+ }
271
+ }
272
+ }
273
+ },
274
+ {
275
+ "name": "free-text-reason",
276
+ "why": "no free text: the reason is a code",
277
+ "expect": {
278
+ "valid": false,
279
+ "code": "schema_violation",
280
+ "keyword": "additionalProperties"
281
+ },
282
+ "message": {
283
+ "schemaVersion": 2,
284
+ "type": "policy.decision",
285
+ "msgId": "00000000-0000-4000-8000-000000000001",
286
+ "seq": 1,
287
+ "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
288
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
289
+ "workspaceId": "ws-1",
290
+ "ts": "2026-11-04T10:00:00Z",
291
+ "paramsRaw": "{\"decision\":\"ALLOW\",\"reasonCode\":\"autonomous\",\"shadow\":false,\"approvalRequired\":false,\"actionType\":\"APPLY_PATCH\",\"effectiveMode\":\"autonomous\",\"requestHash\":\"abababababababababababababababababababababababababababababababab\",\"policySnapshot\":{\"hash\":\"cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd\"},\"reason\":\"the tenant policy says so\"}",
292
+ "sig": {
293
+ "keyId": "vh-cp-2026-10",
294
+ "timestamp": "1793268000",
295
+ "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
296
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
297
+ "workspaceId": "ws-1",
298
+ "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
299
+ },
300
+ "payload": {
301
+ "decision": "ALLOW",
302
+ "reasonCode": "autonomous",
303
+ "shadow": false,
304
+ "approvalRequired": false,
305
+ "actionType": "APPLY_PATCH",
306
+ "effectiveMode": "autonomous",
307
+ "requestHash": "abababababababababababababababababababababababababababababababab",
308
+ "policySnapshot": {
309
+ "hash": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
310
+ },
311
+ "reason": "the tenant policy says so"
312
+ }
313
+ }
314
+ },
315
+ {
316
+ "name": "reason-code-with-space",
317
+ "why": "reasonCode is a lower-case code",
318
+ "expect": {
319
+ "valid": false,
320
+ "code": "schema_violation",
321
+ "keyword": "pattern"
322
+ },
323
+ "message": {
324
+ "schemaVersion": 2,
325
+ "type": "policy.decision",
326
+ "msgId": "00000000-0000-4000-8000-000000000001",
327
+ "seq": 1,
328
+ "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
329
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
330
+ "workspaceId": "ws-1",
331
+ "ts": "2026-11-04T10:00:00Z",
332
+ "paramsRaw": "{\"decision\":\"ALLOW\",\"reasonCode\":\"Not Allowed\",\"shadow\":false,\"approvalRequired\":false,\"actionType\":\"APPLY_PATCH\",\"effectiveMode\":\"autonomous\",\"requestHash\":\"abababababababababababababababababababababababababababababababab\",\"policySnapshot\":{\"hash\":\"cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd\"}}",
333
+ "sig": {
334
+ "keyId": "vh-cp-2026-10",
335
+ "timestamp": "1793268000",
336
+ "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
337
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
338
+ "workspaceId": "ws-1",
339
+ "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
340
+ },
341
+ "payload": {
342
+ "decision": "ALLOW",
343
+ "reasonCode": "Not Allowed",
344
+ "shadow": false,
345
+ "approvalRequired": false,
346
+ "actionType": "APPLY_PATCH",
347
+ "effectiveMode": "autonomous",
348
+ "requestHash": "abababababababababababababababababababababababababababababababab",
349
+ "policySnapshot": {
350
+ "hash": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
351
+ }
352
+ }
353
+ }
354
+ },
355
+ {
356
+ "name": "missing-approval-required",
357
+ "why": "approvalRequired is required",
358
+ "expect": {
359
+ "valid": false,
360
+ "code": "schema_violation",
361
+ "keyword": "required"
362
+ },
363
+ "message": {
364
+ "schemaVersion": 2,
365
+ "type": "policy.decision",
366
+ "msgId": "00000000-0000-4000-8000-000000000001",
367
+ "seq": 1,
368
+ "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
369
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
370
+ "workspaceId": "ws-1",
371
+ "ts": "2026-11-04T10:00:00Z",
372
+ "paramsRaw": "{\"decision\":\"ALLOW\",\"reasonCode\":\"autonomous\",\"shadow\":false,\"actionType\":\"APPLY_PATCH\",\"effectiveMode\":\"autonomous\",\"requestHash\":\"abababababababababababababababababababababababababababababababab\",\"policySnapshot\":{\"hash\":\"cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd\"}}",
373
+ "sig": {
374
+ "keyId": "vh-cp-2026-10",
375
+ "timestamp": "1793268000",
376
+ "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
377
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
378
+ "workspaceId": "ws-1",
379
+ "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
380
+ },
381
+ "payload": {
382
+ "decision": "ALLOW",
383
+ "reasonCode": "autonomous",
384
+ "shadow": false,
385
+ "actionType": "APPLY_PATCH",
386
+ "effectiveMode": "autonomous",
387
+ "requestHash": "abababababababababababababababababababababababababababababababab",
388
+ "policySnapshot": {
389
+ "hash": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
390
+ }
391
+ }
392
+ }
393
+ },
394
+ {
395
+ "name": "require-human-without-approval",
396
+ "why": "an enforced REQUIRE_HUMAN must say approvalRequired:true",
397
+ "expect": {
398
+ "valid": false,
399
+ "code": "schema_violation",
400
+ "keyword": "const"
401
+ },
402
+ "message": {
403
+ "schemaVersion": 2,
404
+ "type": "policy.decision",
405
+ "msgId": "00000000-0000-4000-8000-000000000001",
406
+ "seq": 1,
407
+ "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
408
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
409
+ "workspaceId": "ws-1",
410
+ "ts": "2026-11-04T10:00:00Z",
411
+ "paramsRaw": "{\"decision\":\"REQUIRE_HUMAN\",\"reasonCode\":\"autonomous\",\"shadow\":false,\"approvalRequired\":false,\"actionType\":\"APPLY_PATCH\",\"effectiveMode\":\"autonomous\",\"requestHash\":\"abababababababababababababababababababababababababababababababab\",\"policySnapshot\":{\"hash\":\"cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd\"}}",
412
+ "sig": {
413
+ "keyId": "vh-cp-2026-10",
414
+ "timestamp": "1793268000",
415
+ "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
416
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
417
+ "workspaceId": "ws-1",
418
+ "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
419
+ },
420
+ "payload": {
421
+ "decision": "REQUIRE_HUMAN",
422
+ "reasonCode": "autonomous",
423
+ "shadow": false,
424
+ "approvalRequired": false,
425
+ "actionType": "APPLY_PATCH",
426
+ "effectiveMode": "autonomous",
427
+ "requestHash": "abababababababababababababababababababababababababababababababab",
428
+ "policySnapshot": {
429
+ "hash": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
430
+ }
431
+ }
432
+ }
433
+ },
434
+ {
435
+ "name": "allow-with-approval-required",
436
+ "why": "only an enforced REQUIRE_HUMAN requires an approval",
437
+ "expect": {
438
+ "valid": false,
439
+ "code": "schema_violation",
440
+ "keyword": "const"
441
+ },
442
+ "message": {
443
+ "schemaVersion": 2,
444
+ "type": "policy.decision",
445
+ "msgId": "00000000-0000-4000-8000-000000000001",
446
+ "seq": 1,
447
+ "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
448
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
449
+ "workspaceId": "ws-1",
450
+ "ts": "2026-11-04T10:00:00Z",
451
+ "paramsRaw": "{\"decision\":\"ALLOW\",\"reasonCode\":\"autonomous\",\"shadow\":false,\"approvalRequired\":true,\"actionType\":\"APPLY_PATCH\",\"effectiveMode\":\"autonomous\",\"requestHash\":\"abababababababababababababababababababababababababababababababab\",\"policySnapshot\":{\"hash\":\"cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd\"}}",
452
+ "sig": {
453
+ "keyId": "vh-cp-2026-10",
454
+ "timestamp": "1793268000",
455
+ "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
456
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
457
+ "workspaceId": "ws-1",
458
+ "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
459
+ },
460
+ "payload": {
461
+ "decision": "ALLOW",
462
+ "reasonCode": "autonomous",
463
+ "shadow": false,
464
+ "approvalRequired": true,
465
+ "actionType": "APPLY_PATCH",
466
+ "effectiveMode": "autonomous",
467
+ "requestHash": "abababababababababababababababababababababababababababababababab",
468
+ "policySnapshot": {
469
+ "hash": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
470
+ }
471
+ }
472
+ }
473
+ },
474
+ {
475
+ "name": "missing-request-hash",
476
+ "why": "the echo of the request hash binds the decision to the request",
477
+ "expect": {
478
+ "valid": false,
479
+ "code": "schema_violation",
480
+ "keyword": "required"
481
+ },
482
+ "message": {
483
+ "schemaVersion": 2,
484
+ "type": "policy.decision",
485
+ "msgId": "00000000-0000-4000-8000-000000000001",
486
+ "seq": 1,
487
+ "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
488
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
489
+ "workspaceId": "ws-1",
490
+ "ts": "2026-11-04T10:00:00Z",
491
+ "paramsRaw": "{\"decision\":\"ALLOW\",\"reasonCode\":\"autonomous\",\"shadow\":false,\"approvalRequired\":false,\"actionType\":\"APPLY_PATCH\",\"effectiveMode\":\"autonomous\",\"policySnapshot\":{\"hash\":\"cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd\"}}",
492
+ "sig": {
493
+ "keyId": "vh-cp-2026-10",
494
+ "timestamp": "1793268000",
495
+ "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
496
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
497
+ "workspaceId": "ws-1",
498
+ "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
499
+ },
500
+ "payload": {
501
+ "decision": "ALLOW",
502
+ "reasonCode": "autonomous",
503
+ "shadow": false,
504
+ "approvalRequired": false,
505
+ "actionType": "APPLY_PATCH",
506
+ "effectiveMode": "autonomous",
507
+ "policySnapshot": {
508
+ "hash": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
509
+ }
510
+ }
511
+ }
512
+ },
513
+ {
514
+ "name": "snapshot-hash-not-sha256",
515
+ "why": "policySnapshot.hash is 64 lower-case hex",
516
+ "expect": {
517
+ "valid": false,
518
+ "code": "schema_violation",
519
+ "keyword": "pattern"
520
+ },
521
+ "message": {
522
+ "schemaVersion": 2,
523
+ "type": "policy.decision",
524
+ "msgId": "00000000-0000-4000-8000-000000000001",
525
+ "seq": 1,
526
+ "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
527
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
528
+ "workspaceId": "ws-1",
529
+ "ts": "2026-11-04T10:00:00Z",
530
+ "paramsRaw": "{\"decision\":\"ALLOW\",\"reasonCode\":\"autonomous\",\"shadow\":false,\"approvalRequired\":false,\"actionType\":\"APPLY_PATCH\",\"effectiveMode\":\"autonomous\",\"requestHash\":\"abababababababababababababababababababababababababababababababab\",\"policySnapshot\":{\"hash\":\"v1\"}}",
531
+ "sig": {
532
+ "keyId": "vh-cp-2026-10",
533
+ "timestamp": "1793268000",
534
+ "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
535
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
536
+ "workspaceId": "ws-1",
537
+ "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
538
+ },
539
+ "payload": {
540
+ "decision": "ALLOW",
541
+ "reasonCode": "autonomous",
542
+ "shadow": false,
543
+ "approvalRequired": false,
544
+ "actionType": "APPLY_PATCH",
545
+ "effectiveMode": "autonomous",
546
+ "requestHash": "abababababababababababababababababababababababababababababababab",
547
+ "policySnapshot": {
548
+ "hash": "v1"
549
+ }
550
+ }
551
+ }
552
+ },
553
+ {
554
+ "name": "snapshot-extra-field",
555
+ "why": "policySnapshot is closed",
556
+ "expect": {
557
+ "valid": false,
558
+ "code": "schema_violation",
559
+ "keyword": "additionalProperties"
560
+ },
561
+ "message": {
562
+ "schemaVersion": 2,
563
+ "type": "policy.decision",
564
+ "msgId": "00000000-0000-4000-8000-000000000001",
565
+ "seq": 1,
566
+ "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
567
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
568
+ "workspaceId": "ws-1",
569
+ "ts": "2026-11-04T10:00:00Z",
570
+ "paramsRaw": "{\"decision\":\"ALLOW\",\"reasonCode\":\"autonomous\",\"shadow\":false,\"approvalRequired\":false,\"actionType\":\"APPLY_PATCH\",\"effectiveMode\":\"autonomous\",\"requestHash\":\"abababababababababababababababababababababababababababababababab\",\"policySnapshot\":{\"hash\":\"cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd\",\"policy\":{\"x\":1}}}",
571
+ "sig": {
572
+ "keyId": "vh-cp-2026-10",
573
+ "timestamp": "1793268000",
574
+ "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
575
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
576
+ "workspaceId": "ws-1",
577
+ "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
578
+ },
579
+ "payload": {
580
+ "decision": "ALLOW",
581
+ "reasonCode": "autonomous",
582
+ "shadow": false,
583
+ "approvalRequired": false,
584
+ "actionType": "APPLY_PATCH",
585
+ "effectiveMode": "autonomous",
586
+ "requestHash": "abababababababababababababababababababababababababababababababab",
587
+ "policySnapshot": {
588
+ "hash": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
589
+ "policy": {
590
+ "x": 1
591
+ }
592
+ }
593
+ }
594
+ }
595
+ },
596
+ {
597
+ "name": "missing-snapshot",
598
+ "why": "the snapshot hash is required",
599
+ "expect": {
600
+ "valid": false,
601
+ "code": "schema_violation",
602
+ "keyword": "required"
603
+ },
604
+ "message": {
605
+ "schemaVersion": 2,
606
+ "type": "policy.decision",
607
+ "msgId": "00000000-0000-4000-8000-000000000001",
608
+ "seq": 1,
609
+ "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
610
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
611
+ "workspaceId": "ws-1",
612
+ "ts": "2026-11-04T10:00:00Z",
613
+ "paramsRaw": "{\"decision\":\"ALLOW\",\"reasonCode\":\"autonomous\",\"shadow\":false,\"approvalRequired\":false,\"actionType\":\"APPLY_PATCH\",\"effectiveMode\":\"autonomous\",\"requestHash\":\"abababababababababababababababababababababababababababababababab\"}",
614
+ "sig": {
615
+ "keyId": "vh-cp-2026-10",
616
+ "timestamp": "1793268000",
617
+ "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
618
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
619
+ "workspaceId": "ws-1",
620
+ "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
621
+ },
622
+ "payload": {
623
+ "decision": "ALLOW",
624
+ "reasonCode": "autonomous",
625
+ "shadow": false,
626
+ "approvalRequired": false,
627
+ "actionType": "APPLY_PATCH",
628
+ "effectiveMode": "autonomous",
629
+ "requestHash": "abababababababababababababababababababababababababababababababab"
630
+ }
631
+ }
632
+ },
633
+ {
634
+ "name": "tenant-in-payload",
635
+ "why": "the payload is closed: no tenant",
636
+ "expect": {
637
+ "valid": false,
638
+ "code": "schema_violation",
639
+ "keyword": "additionalProperties"
640
+ },
641
+ "message": {
642
+ "schemaVersion": 2,
643
+ "type": "policy.decision",
644
+ "msgId": "00000000-0000-4000-8000-000000000001",
645
+ "seq": 1,
646
+ "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
647
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
648
+ "workspaceId": "ws-1",
649
+ "ts": "2026-11-04T10:00:00Z",
650
+ "paramsRaw": "{\"decision\":\"ALLOW\",\"reasonCode\":\"autonomous\",\"shadow\":false,\"approvalRequired\":false,\"actionType\":\"APPLY_PATCH\",\"effectiveMode\":\"autonomous\",\"requestHash\":\"abababababababababababababababababababababababababababababababab\",\"policySnapshot\":{\"hash\":\"cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd\"},\"tenantId\":\"3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f\"}",
651
+ "sig": {
652
+ "keyId": "vh-cp-2026-10",
653
+ "timestamp": "1793268000",
654
+ "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
655
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
656
+ "workspaceId": "ws-1",
657
+ "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
658
+ },
659
+ "payload": {
660
+ "decision": "ALLOW",
661
+ "reasonCode": "autonomous",
662
+ "shadow": false,
663
+ "approvalRequired": false,
664
+ "actionType": "APPLY_PATCH",
665
+ "effectiveMode": "autonomous",
666
+ "requestHash": "abababababababababababababababababababababababababababababababab",
667
+ "policySnapshot": {
668
+ "hash": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
669
+ },
670
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f"
671
+ }
672
+ }
673
+ },
674
+ {
675
+ "name": "unsigned-decision",
676
+ "why": "a decision is signed like every CP->LA command",
677
+ "expect": {
678
+ "valid": false,
679
+ "code": "schema_violation",
680
+ "keyword": "required"
681
+ },
682
+ "message": {
683
+ "schemaVersion": 2,
684
+ "type": "policy.decision",
685
+ "msgId": "00000000-0000-4000-8000-000000000001",
686
+ "seq": 1,
687
+ "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
688
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
689
+ "workspaceId": "ws-1",
690
+ "ts": "2026-11-04T10:00:00Z",
691
+ "paramsRaw": "{\"decision\":\"ALLOW\",\"reasonCode\":\"autonomous\",\"shadow\":false,\"approvalRequired\":false,\"actionType\":\"APPLY_PATCH\",\"effectiveMode\":\"autonomous\",\"requestHash\":\"abababababababababababababababababababababababababababababababab\",\"policySnapshot\":{\"hash\":\"cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd\"}}",
692
+ "payload": {
693
+ "decision": "ALLOW",
694
+ "reasonCode": "autonomous",
695
+ "shadow": false,
696
+ "approvalRequired": false,
697
+ "actionType": "APPLY_PATCH",
698
+ "effectiveMode": "autonomous",
699
+ "requestHash": "abababababababababababababababababababababababababababababababab",
700
+ "policySnapshot": {
701
+ "hash": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
702
+ }
703
+ }
704
+ }
705
+ },
706
+ {
707
+ "name": "missing-params-raw",
708
+ "why": "the signature covers paramsRaw",
709
+ "expect": {
710
+ "valid": false,
711
+ "code": "schema_violation",
712
+ "keyword": "required"
713
+ },
714
+ "message": {
715
+ "schemaVersion": 2,
716
+ "type": "policy.decision",
717
+ "msgId": "00000000-0000-4000-8000-000000000001",
718
+ "seq": 1,
719
+ "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
720
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
721
+ "workspaceId": "ws-1",
722
+ "ts": "2026-11-04T10:00:00Z",
723
+ "sig": {
724
+ "keyId": "vh-cp-2026-10",
725
+ "timestamp": "1793268000",
726
+ "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
727
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
728
+ "workspaceId": "ws-1",
729
+ "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
730
+ },
731
+ "payload": {
732
+ "decision": "ALLOW",
733
+ "reasonCode": "autonomous",
734
+ "shadow": false,
735
+ "approvalRequired": false,
736
+ "actionType": "APPLY_PATCH",
737
+ "effectiveMode": "autonomous",
738
+ "requestHash": "abababababababababababababababababababababababababababababababab",
739
+ "policySnapshot": {
740
+ "hash": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
741
+ }
742
+ }
743
+ }
744
+ },
745
+ {
746
+ "name": "missing-request-id",
747
+ "why": "requestId correlates the decision with its check",
748
+ "expect": {
749
+ "valid": false,
750
+ "code": "schema_violation",
751
+ "keyword": "required"
752
+ },
753
+ "message": {
754
+ "schemaVersion": 2,
755
+ "type": "policy.decision",
756
+ "msgId": "00000000-0000-4000-8000-000000000001",
757
+ "seq": 1,
758
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
759
+ "workspaceId": "ws-1",
760
+ "ts": "2026-11-04T10:00:00Z",
761
+ "paramsRaw": "{\"decision\":\"ALLOW\",\"reasonCode\":\"autonomous\",\"shadow\":false,\"approvalRequired\":false,\"actionType\":\"APPLY_PATCH\",\"effectiveMode\":\"autonomous\",\"requestHash\":\"abababababababababababababababababababababababababababababababab\",\"policySnapshot\":{\"hash\":\"cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd\"}}",
762
+ "sig": {
763
+ "keyId": "vh-cp-2026-10",
764
+ "timestamp": "1793268000",
765
+ "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
766
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
767
+ "workspaceId": "ws-1",
768
+ "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
769
+ },
770
+ "payload": {
771
+ "decision": "ALLOW",
772
+ "reasonCode": "autonomous",
773
+ "shadow": false,
774
+ "approvalRequired": false,
775
+ "actionType": "APPLY_PATCH",
776
+ "effectiveMode": "autonomous",
777
+ "requestHash": "abababababababababababababababababababababababababababababababab",
778
+ "policySnapshot": {
779
+ "hash": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
780
+ }
781
+ }
782
+ }
783
+ },
784
+ {
785
+ "name": "extra-top-level-field",
786
+ "why": "envelope is closed",
787
+ "expect": {
788
+ "valid": false,
789
+ "code": "schema_violation",
790
+ "keyword": "additionalProperties"
791
+ },
792
+ "message": {
793
+ "schemaVersion": 2,
794
+ "type": "policy.decision",
795
+ "msgId": "00000000-0000-4000-8000-000000000001",
796
+ "seq": 1,
797
+ "requestId": "e5f6a7b8-c9d0-4e1f-8a2b-4c5d6e7f8091",
798
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
799
+ "workspaceId": "ws-1",
800
+ "ts": "2026-11-04T10:00:00Z",
801
+ "paramsRaw": "{\"decision\":\"ALLOW\",\"reasonCode\":\"autonomous\",\"shadow\":false,\"approvalRequired\":false,\"actionType\":\"APPLY_PATCH\",\"effectiveMode\":\"autonomous\",\"requestHash\":\"abababababababababababababababababababababababababababababababab\",\"policySnapshot\":{\"hash\":\"cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd\"}}",
802
+ "sig": {
803
+ "keyId": "vh-cp-2026-10",
804
+ "timestamp": "1793268000",
805
+ "nonce": "Zm9vYmFyYmF6cXV4MTIzNDU2",
806
+ "tenantId": "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f",
807
+ "workspaceId": "ws-1",
808
+ "signature": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
809
+ },
810
+ "payload": {
811
+ "decision": "ALLOW",
812
+ "reasonCode": "autonomous",
813
+ "shadow": false,
814
+ "approvalRequired": false,
815
+ "actionType": "APPLY_PATCH",
816
+ "effectiveMode": "autonomous",
817
+ "requestHash": "abababababababababababababababababababababababababababababababab",
818
+ "policySnapshot": {
819
+ "hash": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
820
+ }
821
+ },
822
+ "extra": "x"
823
+ }
824
+ }
825
+ ]
826
+ }