failproofai 1.0.12-beta.1 → 1.0.12-beta.2

package/src/hooks/semantic/cloud-jev.ts

@@ -90,10 +90,28 @@ export interface CloudJevBlock {
 
 /** FailproofAI Cloud's reply block, validated. Its outcomes carry a pack-shaped `cloud:<id>` origin. */
 export interface CloudJevReply {
+  /** The ENFORCED checks' verdict: an observe assignment's outcomes are in `observed`, not here. */
   verdict: SemanticVerdict;
   asked: string[];
   droppedLocal: string[];
   droppedCloud: string[];
+  /** What the checks of an `observe` assignment would have done (deny / instruct only). */
+  observed: ObservedCloudCheck[];
+  /** Every check of an `observe` assignment Cloud asked (its name). */
+  observedAsked: string[];
+}
+
+/**
+ * One `observe` Cloud assignment's would-have: recorded on the activity row's
+ * `observed` list like an observe JS policy's, never applied, never a clear.
+ * One per policy, its most severe check.
+ */
+export interface ObservedCloudCheck {
+  cloudPolicyId: string;
+  cloudVersion: number;
+  check: string;
+  decision: "deny" | "instruct";
+  reason: string;
 }
 
 /** What the Cloud review adds to a `SemanticOutcome`, for the verdict log and the budget report. */
@@ -102,6 +120,20 @@ export interface CloudReplySummary {
   /** The machine's own groups Cloud dropped, with the pack that declared each (null when none did). */
   droppedLocal: Array<{ name: string; packId: string | null }>;
   droppedCloud: string[];
+  /**
+   * TypeSafe's answers to the Cloud checks' own questions (`<check>.<probe>`,
+   * `<check>.exempt`), for the activity row's per-check record. Ids and
+   * numbers only; the machine never decides from these (Cloud did).
+   */
+  answers: Record<string, number>;
+  /**
+   * Checks of WATCHED (observe-assigned) Cloud policies, decided apart into
+   * the reply's `observed` block: recorded on the activity row only. They
+   * never reach the verdict, any clear, or the merge.
+   */
+  observedOutcomes: PolicyOutcome[];
+  observed: ObservedCloudCheck[];
+  observedAsked: string[];
 }
 
 export type CloudSemanticOutcome =
@@ -113,6 +145,8 @@ export interface CloudSemanticOptions extends SemanticOptions {
   machineId: string;
   /** Explicit null = v2 request with unresolved identity (no scoped checks). */
   agent?: AgentIdentity | null;
+  /** Cloud policy ids whose Jev assignment on this machine is `observe` (`active.json` `jevPolicies`). */
+  observedPolicies?: ReadonlyArray<string>;
 }
 
 // ── The request ──────────────────────────────────────────────────────────────
@@ -366,8 +400,19 @@ const DECISIONS = new Set(["allow", "deny", "instruct"]);
 const VERDICTS = new Set(["deny", "instruct", "overridden", "none"]);
 const INTENTS = new Set(["op-requested", "task-step", "downgraded-task-step"]);
 
+/** One Cloud outcome as parsed: the outcome, and what only the reply can say about it. */
+interface ParsedCloudOutcome {
+  outcome: PolicyOutcome;
+  cloudPolicyId: string;
+  cloudVersion: number;
+  /** The assignment's effect, when Cloud says (`effect`); absent reads as `enforce`. */
+  observe: boolean;
+  /** Cloud's own line for this check, when it sends one. */
+  reason: string | null;
+}
+
 /** One Cloud outcome, rebuilt field by field so nothing but these fields crosses over. */
-function parseOutcome(raw: unknown, i: number): PolicyOutcome {
+function parseOutcome(raw: unknown, i: number): ParsedCloudOutcome {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) malformed(`outcome ${i} is not an object`);
   const o = raw as Record<string, unknown>;
   if (!isName(o.policy)) malformed(`outcome ${i} has no policy name`);
@@ -391,7 +436,9 @@ function parseOutcome(raw: unknown, i: number): PolicyOutcome {
   ) {
     malformed(`outcome ${i} has no Cloud origin`);
   }
-  return {
+  if (o.effect !== undefined && o.effect !== "enforce" && o.effect !== "observe") malformed(`outcome ${i} has an unknown effect`);
+  if (o.reason !== undefined && o.reason !== null && typeof o.reason !== "string") malformed(`outcome ${i} reason is not text`);
+  const outcome: PolicyOutcome = {
     policy: o.policy,
     mode: o.mode,
     ...(typeof o.userCanOverride === "boolean" ? { userCanOverride: o.userCanOverride } : {}),
@@ -408,6 +455,48 @@ function parseOutcome(raw: unknown, i: number): PolicyOutcome {
     ...(o.intent !== undefined ? { intent: o.intent as PolicyOutcome["intent"] } : {}),
     ...(o.targetScanIncomplete === true ? { targetScanIncomplete: true as const } : {}),
   };
+  return {
+    outcome,
+    cloudPolicyId: origin.cloudPolicyId as string,
+    cloudVersion: origin.cloudVersion as number,
+    observe: o.effect === "observe",
+    reason: typeof o.reason === "string" ? capReason(o.reason) : null,
+  };
+}
+
+function capReason(reason: string): string {
+  return reason.length > MAX_CLOUD_REASON_CHARS ? `${reason.slice(0, MAX_CLOUD_REASON_CHARS - 1)}…` : reason;
+}
+
+const SEVERITY: Record<"deny" | "instruct", number> = { instruct: 1, deny: 2 };
+
+/**
+ * The would-haves of the observed outcomes: per Cloud policy, its most severe
+ * check that fired (`deny`, or a warning). A check that found nothing, or that
+ * the human asked for, would have done nothing.
+ */
+function observedChecks(
+  parsed: ReadonlyArray<ParsedCloudOutcome>,
+  watched: { v: Record<string, unknown>; parsed: ParsedCloudOutcome[] } | null = null,
+): ObservedCloudCheck[] {
+  // The observed verdict's own reason, when exactly one of its checks fired.
+  const firing = watched?.parsed.filter((p) => p.outcome.verdict === "deny" || p.outcome.verdict === "instruct") ?? [];
+  const watchedReason = firing.length === 1 && typeof watched?.v.reason === "string" ? capReason(watched.v.reason) : null;
+  const byPolicy = new Map<string, ObservedCloudCheck>();
+  for (const p of parsed) {
+    const verdict = p.outcome.verdict;
+    if (verdict !== "deny" && verdict !== "instruct") continue;
+    const prev = byPolicy.get(p.cloudPolicyId);
+    if (prev && SEVERITY[prev.decision] >= SEVERITY[verdict]) continue;
+    byPolicy.set(p.cloudPolicyId, {
+      cloudPolicyId: p.cloudPolicyId,
+      cloudVersion: p.cloudVersion,
+      check: p.outcome.policy,
+      decision: verdict,
+      reason: p.reason ?? (firing[0] === p ? watchedReason : null) ?? `Flagged by semantic review (semantic/${p.outcome.policy})`,
+    });
+  }
+  return [...byPolicy.values()];
 }
 
 /**
@@ -415,17 +504,20 @@ function parseOutcome(raw: unknown, i: number): PolicyOutcome {
  * A reply without one (a server that does not implement C10) is malformed:
  * nothing it says can be told apart from "Cloud has no checks here".
  */
-export function parseCloudReply(raw: unknown): CloudJevReply {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) malformed("no cloud block");
-  const block = raw as Record<string, unknown>;
-  const v = block.verdict as Record<string, unknown> | undefined;
-  if (!v || typeof v !== "object" || Array.isArray(v)) malformed("no verdict");
-  if (typeof v.decision !== "string" || !DECISIONS.has(v.decision)) malformed("verdict has no decision");
-  if (v.reason !== null && v.reason !== undefined && typeof v.reason !== "string") malformed("verdict reason is not text");
-  if (!Array.isArray(v.outcomes) || v.outcomes.length > MAX_LIST) malformed("verdict has no outcomes list");
-  if (v.beyondTask !== undefined && typeof v.beyondTask !== "boolean") malformed("verdict beyondTask is not a flag");
-  const outcomes = v.outcomes.map(parseOutcome);
-  const asked = names(block.asked, "asked");
+/** One verdict block (`verdict` + `asked`) validated, with every rule a reply's verdict is held to. */
+function parseVerdictBlock(
+  rawVerdict: unknown,
+  rawAsked: unknown,
+  what: string,
+): { v: Record<string, unknown>; parsed: ParsedCloudOutcome[]; asked: string[] } {
+  const v = rawVerdict as Record<string, unknown> | undefined;
+  if (!v || typeof v !== "object" || Array.isArray(v)) malformed(`no ${what}`);
+  if (typeof v.decision !== "string" || !DECISIONS.has(v.decision)) malformed(`${what} has no decision`);
+  if (v.reason !== null && v.reason !== undefined && typeof v.reason !== "string") malformed(`${what} reason is not text`);
+  if (!Array.isArray(v.outcomes) || v.outcomes.length > MAX_LIST) malformed(`${what} has no outcomes list`);
+  if (v.beyondTask !== undefined && typeof v.beyondTask !== "boolean") malformed(`${what} beyondTask is not a flag`);
+  const parsed = v.outcomes.map(parseOutcome);
+  const asked = names(rawAsked, `${what} asked`);
   // Each outcome must answer a check Cloud says it ASKED, once. The review
   // clears a `both` policy's regex half from these outcomes, so one that
   // `asked` does not vouch for — `asked: []` beside a fabricated `none` — is a
@@ -433,25 +525,65 @@ export function parseCloudReply(raw: unknown): CloudJevReply {
   // decided by the regex alone (security review of #873).
   const askedSet = new Set(asked);
   const seen = new Set<string>();
-  outcomes.forEach((o, i) => {
-    if (!askedSet.has(o.policy)) malformed(`outcome ${i} answers ${JSON.stringify(o.policy)}, which Cloud did not ask`);
+  parsed.forEach(({ outcome: o }, i) => {
+    if (!askedSet.has(o.policy)) malformed(`${what} outcome ${i} answers ${JSON.stringify(o.policy)}, which Cloud did not ask`);
     const key = `${o.origin?.packId ?? ""}\u0000${o.policy}`;
-    if (seen.has(key)) malformed(`outcome ${i} answers ${JSON.stringify(o.policy)} twice`);
+    if (seen.has(key)) malformed(`${what} outcome ${i} answers ${JSON.stringify(o.policy)} twice`);
     seen.add(key);
   });
+  return { v, parsed, asked };
+}
+
+export function parseCloudReply(raw: unknown, observedPolicies: ReadonlyArray<string> = []): CloudJevReply {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) malformed("no cloud block");
+  const block = raw as Record<string, unknown>;
+  const { v, parsed, asked } = parseVerdictBlock(block.verdict, block.asked, "verdict");
+  // `observed` (CONTRACT, fix round): the checks of watched (`observe`)
+  // assignments, decided apart, present only when one was asked. Held to the
+  // same rules as the verdict; recorded, never applied.
+  let watched: { v: Record<string, unknown>; parsed: ParsedCloudOutcome[]; asked: string[] } | null = null;
+  if (block.observed !== undefined && block.observed !== null) {
+    const o = block.observed as Record<string, unknown>;
+    if (typeof o !== "object" || Array.isArray(o)) malformed("observed is not an object");
+    watched = parseVerdictBlock(o.verdict, o.asked, "observed verdict");
+    if (watched.parsed.some((p) => p.outcome.verdict === "deny") && watched.v.decision !== "deny") {
+      malformed("an observed check denied but its verdict does not");
+    }
+  }
+  // An `observe` assignment's checks (Cloud says so per outcome, or this
+  // machine's deployment does) are recorded, never applied: they leave the
+  // verdict, so they can neither deny nor clear anything.
+  const observeIds = new Set(observedPolicies);
+  const isObserved = (p: ParsedCloudOutcome) => p.observe || observeIds.has(p.cloudPolicyId);
+  const enforced = parsed.filter((p) => !isObserved(p)).map((p) => p.outcome);
+  const observedHere = parsed.filter(isObserved);
+  const observed = [...observedHere, ...(watched?.parsed ?? [])];
   // A check that fired deny makes the verdict a deny; a reply that says
   // otherwise contradicts itself.
-  if (outcomes.some((o) => o.verdict === "deny") && v.decision !== "deny") malformed("a check denied but the verdict does not");
+  if (enforced.some((o) => o.verdict === "deny") && v.decision !== "deny") malformed("a check denied but the verdict does not");
+  const cloudReason = typeof v.reason === "string" ? capReason(v.reason) : null;
+  let decision = v.decision as SemanticVerdict["decision"];
+  let reason = cloudReason;
+  if (observedHere.length > 0) {
+    // Decided again from the enforced checks alone, never above what Cloud
+    // said. Cloud's reason stands when the decision does; otherwise the
+    // combine's generic line names the deciding check.
+    const own: SemanticVerdict["decision"] = enforced.some((o) => o.verdict === "deny")
+      ? "deny"
+      : enforced.some((o) => o.verdict === "instruct") || v.beyondTask === true
+        ? "instruct"
+        : "allow";
+    const capped = RANK[own] <= RANK[decision] ? own : decision;
+    if (capped !== decision) reason = null;
+    decision = capped;
+  }
   return {
+    observed: observedChecks(observed, watched),
+    observedAsked: [...observedHere.map((p) => p.outcome.policy), ...(watched?.asked ?? [])],
     verdict: {
-      decision: v.decision as SemanticVerdict["decision"],
-      reason:
-        typeof v.reason === "string"
-          ? v.reason.length > MAX_CLOUD_REASON_CHARS
-            ? `${v.reason.slice(0, MAX_CLOUD_REASON_CHARS - 1)}…`
-            : v.reason
-          : null,
-      outcomes,
+      decision,
+      reason,
+      outcomes: enforced,
       injectionSuspected: nullableProbability(v.injectionSuspected, "injectionSuspected"),
       scopeWithinRequest: nullableProbability(v.scopeWithinRequest, "scopeWithinRequest"),
       beyondTask: v.beyondTask === true,
@@ -462,6 +594,34 @@ export function parseCloudReply(raw: unknown): CloudJevReply {
   };
 }
 
+/**
+ * The reply's optional `observed: {verdict, asked}` — the outcomes of checks
+ * from watched Cloud policies, which never block. Read leniently and apart
+ * from {@link parseCloudReply}: they are only recorded, so a malformed block
+ * costs the record, never the call's verdict. Only outcomes `observed.asked`
+ * names, each once.
+ */
+export function parseObservedOutcomes(raw: unknown): PolicyOutcome[] {
+  try {
+    const block = (raw as Record<string, unknown> | null)?.observed as Record<string, unknown> | undefined;
+    if (!block || typeof block !== "object" || Array.isArray(block)) return [];
+    const asked = new Set(names(block.asked, "observed.asked"));
+    const outcomes = ((block.verdict as Record<string, unknown> | undefined)?.outcomes ?? []) as unknown[];
+    if (!Array.isArray(outcomes) || outcomes.length > MAX_LIST) return [];
+    const seen = new Set<string>();
+    const out: PolicyOutcome[] = [];
+    outcomes.forEach((o, i) => {
+      const parsed = parseOutcome(o, i).outcome;
+      if (!asked.has(parsed.policy) || seen.has(parsed.policy)) return;
+      seen.add(parsed.policy);
+      out.push(parsed);
+    });
+    return out;
+  } catch {
+    return [];
+  }
+}
+
 // ── The merge (CONTRACT C10.5) ───────────────────────────────────────────────
 
 const RANK: Record<SemanticVerdict["decision"], number> = { allow: 0, instruct: 1, deny: 2 };
@@ -539,6 +699,28 @@ function expectedQuestions(request: JevRequest, prepared: PreparedCall, dropped:
   return { ...request, questions };
 }
 
+/** A question id's own part, as declarations allow it (`force_push`, `exempt`). */
+const QUESTION_PART_RE = /^[a-z][a-z0-9_]{0,31}$/;
+
+/**
+ * The answers to the questions Cloud added for the checks it asked: every
+ * `<check>.<part>` id whose check is in `asked`, read leniently (a missing or
+ * malformed one is simply not recorded — Cloud has already decided).
+ */
+export function cloudCheckAnswers(response: JevResponse, asked: ReadonlyArray<string>): Record<string, number> {
+  const out: Record<string, number> = {};
+  if (asked.length === 0) return out;
+  const names = new Set(asked);
+  const answers = response.answers && typeof response.answers === "object" ? response.answers : {};
+  for (const [id, a] of Object.entries(answers)) {
+    const dot = id.lastIndexOf(".");
+    if (dot <= 0 || !names.has(id.slice(0, dot)) || !QUESTION_PART_RE.test(id.slice(dot + 1))) continue;
+    const p = (a as { noul?: unknown } | null)?.noul;
+    if (isProbability(p)) out[id] = p;
+  }
+  return out;
+}
+
 /** Whatever answers a short-circuit reply carries, read leniently: none is required. */
 function presentAnswers(response: JevResponse): Record<string, number> {
   const out: Record<string, number> = {};
@@ -579,7 +761,7 @@ export async function evaluateCloudSemantic(input: SemanticInput, opts: CloudSem
       model: opts.model ?? DEFAULT_JEV_MODEL,
       modelVerified: true,
       via: "none",
-      cloud: { asked: [], droppedLocal: [], droppedCloud: [] },
+      cloud: { asked: [], droppedLocal: [], droppedCloud: [], answers: {}, observed: [], observedAsked: [], observedOutcomes: [] },
     };
   }
   let prepared: PreparedCall;
@@ -623,7 +805,11 @@ export async function evaluateCloudSemantic(input: SemanticInput, opts: CloudSem
     const timeout = AbortSignal.timeout(opts.timeoutMs ?? envNumber("FAILPROOFAI_JEV_TIMEOUT_MS", DEFAULT_JEV_TIMEOUT_MS));
     const signal = opts.signal ? AbortSignal.any([timeout, opts.signal]) : timeout;
     const response = await transport(request, signal);
-    const reply = parseCloudReply(response.cloud);
+    const reply = parseCloudReply(response.cloud, opts.observedPolicies);
+    // The full outcomes of the watched checks the reply was vetted to have asked
+    // (`parseCloudReply` refuses the whole reply otherwise), for the per-check record.
+    const observedAsked = new Set(reply.observedAsked);
+    const observedOutcomes = parseObservedOutcomes(response.cloud).filter((o) => observedAsked.has(o.policy));
 
     // Only the machine's own groups can be dropped from its side; a name it
     // did not send is not its to act on.
@@ -636,7 +822,8 @@ export async function evaluateCloudSemantic(input: SemanticInput, opts: CloudSem
     // answers to demand. The local verdict is then an empty allow whatever the
     // answers — `decide` with nothing selected reads no per-policy answer, and
     // no warning can fire without one.
-    const shortCircuit = kept.length === 0 && reply.asked.length === 0 && reply.verdict.outcomes.length === 0;
+    const shortCircuit =
+      kept.length === 0 && reply.asked.length === 0 && reply.verdict.outcomes.length === 0 && reply.observedAsked.length === 0;
     const answers = shortCircuit ? presentAnswers(response) : readAnswers(expectedQuestions(request, prepared, dropped), response);
 
     const local =
@@ -664,6 +851,10 @@ export async function evaluateCloudSemantic(input: SemanticInput, opts: CloudSem
         asked: reply.asked,
         droppedLocal: [...dropped].map((name) => ({ name, packId: own.get(name)?.origin?.packId ?? null })),
         droppedCloud: reply.droppedCloud,
+        answers: cloudCheckAnswers(response, [...reply.asked, ...reply.observedAsked]),
+        observed: reply.observed,
+        observedAsked: reply.observedAsked,
+        observedOutcomes,
       },
     };
   } catch (err) {

package/src/hooks/semantic/combine.ts

@@ -236,7 +236,7 @@ import type { PolicyAuthority } from "../policy-types";
 // shape check the row's own `jevModel` does. Importing them makes a rename a
 // compile error here. `jev-activity.ts` is pure (no node imports, no semantic
 // modules), so this costs the hook path nothing.
-import { JEV_MODEL_RE, JEV_REASON_REQUEST_CUT } from "../jev-activity";
+import { JEV_MODEL_RE, JEV_REASON_REQUEST_CUT, type JevCheckRecord } from "../jev-activity";
 
 export type Decision = "allow" | "deny" | "instruct";
 export type JevMode = "observe" | "enforce";
@@ -287,6 +287,11 @@ export type JevReview =
       origin?: { packId: string; packVersion?: string };
       /** Semantic policies whose questions were in the request that was answered. */
       asked: readonly string[];
+      /**
+       * What each asked check concluded (`jevChecks` on the activity row).
+       * Recorded only; nothing here decides from it. Absent: not recorded.
+       */
+      checks?: readonly JevCheckRecord[];
       /**
        * Of `asked`, the ones whose answer lets a reviewable regex verdict be
        * cleared: `none`, `overridden`, or a deny the human's task softened to
@@ -330,6 +335,14 @@ export type JevReview =
        * / `request-cut`.
        */
       requestCut: boolean;
+      /**
+       * What the checks of an `observe` FailproofAI Cloud assignment would have
+       * done. Recorded on the row's `observed` list, never applied: they are in
+       * neither `asked` nor `notDenied`, so they clear nothing either.
+       */
+      observedCloud?: ReadonlyArray<ObservedCloudVerdict>;
+      /** The `observe` Cloud assignments' checks that were asked (names); never in `asked`. */
+      observedAsked?: readonly string[];
       /**
        * Null when nothing had to be sent (no semantic policy applied), or when
        * the answer came from the throttle's cache: a hit's ~0 ms is not a
@@ -358,6 +371,8 @@ export interface TwoTierReview {
    * network instead of holding every hook on the machine behind it.
    */
   releaseRegistry?: () => void;
+  /** The review goes to FailproofAI Cloud (its Jev mode asked), not a local `jev.json`. */
+  cloud?: boolean;
   /** Effective authority + the reviewing semantic policies (empty unless reviewable). */
   authorityOf(p: { name: string; authority?: PolicyAuthority; reviewedBy?: string[] }): {
     authority: PolicyAuthority;
@@ -380,6 +395,7 @@ export interface JevActivityFields {
   jevLatencyMs?: number;
   jevModel?: string;
   jevMode: JevMode;
+  jevChecks?: JevCheckRecord[];
 }
 
 /**
@@ -389,6 +405,14 @@ export interface JevActivityFields {
  * and pack policies already use, so FailproofAI Cloud's policy page counts it
  * with no change on its side.
  */
+/** One observe Cloud assignment's would-have (see `JevReview.observedCloud`). */
+export interface ObservedCloudVerdict {
+  cloudPolicyId: string;
+  cloudVersion: number;
+  decision: "deny" | "instruct";
+  reason: string;
+}
+
 export interface ObserveVerdict {
   /** `semantic/<check>` — the name enforce mode would have attributed it to. */
   policyName: string;
@@ -518,6 +542,7 @@ export function combineTwoTier(
     ...(review.latencyMs !== null ? { jevLatencyMs: review.latencyMs } : {}),
     ...(review.model ? { jevModel: review.model } : {}),
     jevMode: mode,
+    ...(review.checks ? { jevChecks: [...review.checks] } : {}),
   };
 
   if (mode === "observe") {

package/src/hooks/semantic/jev-client.ts

@@ -469,7 +469,7 @@ async function postJson(url: string, bearer: string, body: unknown, signal: Abor
       body: JSON.stringify(body),
       signal,
       // Never followed. The configured URL is the one `validateBaseUrl` checked
-      // (https, or loopback http in observe mode only); a redirect would hand the
+      // (https, or loopback http); a redirect would hand the
       // answer — the thing that can clear a deny — to an origin nobody checked,
       // plain http included. No provider redirects this POST.
       redirect: "manual",

package/src/hooks/semantic/jev-config.ts

@@ -327,8 +327,7 @@ function credentialQueryProblem(url: URL): string | null {
  * An endpoint base URL: https, or http to a loopback host only (a local proxy).
  * No credentials in the URL — not as userinfo, not as a query parameter — and no
  * fragment, because a key belongs in the key field, where it is sent as a bearer
- * and never printed. `validateJevConfig` further accepts the loopback http form
- * only in observe mode.
+ * and never printed. Loopback http is accepted in every mode.
  */
 export function validateBaseUrl(raw: unknown): ValidationResult<string> {
   if (typeof raw !== "string" || raw.trim() === "") return { ok: false, problem: "baseUrl must be a non-empty string" };
@@ -483,14 +482,6 @@ export function providerHostConflict(provider: string, url: string): string | nu
     : null;
 }
 
-function isPlainHttp(url: string): boolean {
-  try {
-    return new URL(url).protocol === "http:";
-  } catch {
-    return false;
-  }
-}
-
 /**
  * The origin a bearer token would be sent to: https, or http to a loopback host
  * — the same schemes `validateBaseUrl` admits. Null for anything else, so a
@@ -697,23 +688,11 @@ export function validateJevConfig(
     cfg.mode = mode;
   }
 
-  // Plain http reaches only a loopback host (`validateBaseUrl`), and nothing
-  // authenticates the server there: while the local proxy is down, any process
-  // of this user — the agent being judged included — can bind its port and
-  // answer "none" to every question. In enforce mode that answer clears
-  // reviewable denies; in observe mode it changes nothing, and `off` sends
-  // nothing at all, so enforce is the one mode it is refused in.
-  if (cfg.baseUrl !== undefined && isPlainHttp(cfg.baseUrl) && cfg.mode === "enforce") {
-    return {
-      ok: false,
-      problem:
-        "plain http (to localhost) is accepted only with mode observe: in enforce mode Jev's answers can clear a deny, " +
-        "and while the local proxy is down any process on this machine could take its port and answer. " +
-        (cfg.provider === JEV_CLOUD_PROVIDER
-          ? "Reconnect to an https FailproofAI Cloud URL (failproofai config --token <key> --url https://…), or keep mode observe"
-          : "Use https, or mode observe"),
-    };
-  }
+  // Plain http reaches only a loopback host (`validateBaseUrl`) and is
+  // accepted in every mode, enforce included, so a local stack can be tested
+  // as it runs in production. Risk: nothing authenticates a loopback server,
+  // so while it is down any process of this user could bind its port and
+  // answer; use https wherever that matters.
 
   return { ok: true, value: cfg };
 }

package/src/hooks/semantic/jev-review.ts

@@ -73,6 +73,7 @@ import { DEFAULT_JEV_MODE, type JevConfig } from "./jev-config";
 import * as jevThrottle from "./jev-throttle";
 import { sessionProjectRoot } from "./session-root";
 import type { PolicyOutcome, SemanticInput } from "./types";
+import { JEV_CHECKS_MAX, JEV_CHECK_PROBES_MAX, JEV_PROBE_ID_RE, round2, type JevCheckRecord } from "../jev-activity";
 
 /**
  * T5's throttle as this file calls it. §7 declares only
@@ -172,7 +173,14 @@ export interface JevCallContext {
    * to Cloud with this machine's id, and the deployment it was made under
    * scopes the answer cache (a new deployment can change Cloud's checks).
    */
-  cloud?: { machineId: string; deployment: number | null; mode: "observe" | "enforce"; agent?: AgentIdentity | null };
+  cloud?: {
+    machineId: string;
+    deployment: number | null;
+    mode: "observe" | "enforce";
+    agent?: AgentIdentity | null;
+    /** Cloud policies whose Jev assignment here is `observe`: recorded, never applied. */
+    observedPolicies?: ReadonlyArray<string>;
+  };
   /**
    * A session pause is active. It suspends local policy, so no installed
    * pack's check is asked; FailproofAI Cloud's checks are exempt from a pause
@@ -248,6 +256,66 @@ export function fallbackCode(reason: string): string {
   return /^[a-z0-9][a-z0-9-]{0,63}$/.test(code) ? code : "error";
 }
 
+/** Why an outcome ended where it did (`JevCheckRecord.why`), from its own fields. */
+function checkWhy(o: PolicyOutcome): JevCheckRecord["why"] {
+  switch (o.verdict) {
+    case "none":
+      // Both deciders: under `fire` nothing fired; at or over it only the exemption stops it.
+      return o.evidence < DEFAULT_THRESHOLDS_V1.fire ? "not-detected" : "exempt";
+    case "overridden":
+      return o.intent === "op-requested" ? "op-requested" : o.intent === "task-step" ? "task-step" : "user-asked";
+    case "deny":
+      return o.escalatedByInjection ? "injection" : "fired";
+    default:
+      if (o.intent === "downgraded-task-step") return "downgraded";
+      return o.targetScanIncomplete ? "scan-incomplete" : "fired";
+  }
+}
+
+/** Who declared a check, as a registered-name prefix: `cloud/<id>@<v>` or `pack/<id>@<v>`. */
+function checkPolicy(o: PolicyOutcome): string | undefined {
+  const packId = o.origin?.packId;
+  if (!packId) return undefined;
+  const at = o.origin?.packVersion ? `@${o.origin.packVersion}` : "";
+  return packId.startsWith("cloud:") ? `cloud/${packId.slice("cloud:".length)}${at}` : `pack/${packId}${at}`;
+}
+
+/**
+ * Every asked check's answer, for the activity row (`jevChecks`): verdict,
+ * why, evidence, exempt and each probe's probability. `answers` holds the
+ * machine's own answers and Cloud's for its checks (`<check>.<probe>`).
+ */
+export function checkRecords(
+  outcomes: ReadonlyArray<PolicyOutcome>,
+  answers: Readonly<Record<string, number>>,
+  watched: ReadonlyArray<PolicyOutcome> = [],
+): JevCheckRecord[] {
+  const all = [...outcomes.map((o) => ({ o, watched: false })), ...watched.map((o) => ({ o, watched: true }))];
+  return all.slice(0, JEV_CHECKS_MAX).map(({ o, watched: isWatched }) => {
+    const probes: Record<string, number> = {};
+    const prefix = `${o.policy}.`;
+    for (const [id, p] of Object.entries(answers)) {
+      if (Object.keys(probes).length >= JEV_CHECK_PROBES_MAX) break;
+      if (!id.startsWith(prefix)) continue;
+      const part = id.slice(prefix.length);
+      // `exempt` has its own field; `user_asked` (v0) is a consent question, not a probe.
+      if (part === "exempt" || part === "user_asked" || !JEV_PROBE_ID_RE.test(part)) continue;
+      probes[part] = round2(p);
+    }
+    const policy = checkPolicy(o);
+    return {
+      check: o.policy,
+      ...(policy ? { policy } : {}),
+      verdict: o.verdict,
+      why: checkWhy(o),
+      p: round2(o.evidence),
+      ...(o.exempt !== null ? { exempt: round2(o.exempt) } : {}),
+      ...(Object.keys(probes).length > 0 ? { probes } : {}),
+      ...(isWatched ? { watched: true as const } : {}),
+    };
+  });
+}
+
 /**
  * @param cached - the answer came from T5's cache, not the provider: it is
  *   applied like any other, but its ~0 ms is not a latency (`latencyMs`
@@ -269,7 +337,8 @@ export function toReview(outcome: SemanticOutcome, cached = false): JevReview {
   // outcome is what clears a `both` policy's regex half. One it cannot vouch
   // for — or a Cloud-origin outcome with no Cloud reply at all — means the
   // picture is not one to clear anything on: the regex decides alone.
-  const cloudAsked = "cloud" in outcome ? new Set((outcome as CloudSemanticOutcome & { status: "ok" }).cloud.asked) : null;
+  const cloudSummary = "cloud" in outcome ? (outcome as CloudSemanticOutcome & { status: "ok" }).cloud : null;
+  const cloudAsked = cloudSummary ? new Set(cloudSummary.asked) : null;
   const unvouched = outcomes.some((o) => isCloudOutcome(o) && !(cloudAsked?.has(o.policy) ?? false));
   if (unvouched) return { kind: "fallback", reason: "malformed", latencyMs, model: null };
   // `null` when the injection probe was not in the request, which now means
@@ -280,9 +349,14 @@ export function toReview(outcome: SemanticOutcome, cached = false): JevReview {
   // not downgrade from a deny (see "A check that fired without consent keeps
   // the floor" in `combine.ts`).
   const warned = (o: (typeof outcomes)[number]) => o.verdict === "instruct" && o.intent !== "downgraded-task-step";
+  const cloudAnswers = cloudSummary?.answers ?? {};
+  const watched = cloudSummary?.observedOutcomes ?? [];
   return {
     kind: "answered",
     decision: outcome.verdict.decision,
+    // What each asked check concluded, for the activity row. `[]` when the
+    // request carried no check (globals only, or Cloud's short-circuit).
+    checks: sent ? checkRecords(outcomes, { ...outcome.answers, ...cloudAnswers }, watched) : [],
     reason: outcome.verdict.reason,
     policyName: jevPolicyName(outcome),
     ...(jevDecider(outcome)?.origin ? { origin: jevDecider(outcome)?.origin } : {}),
@@ -324,6 +398,18 @@ export function toReview(outcome: SemanticOutcome, cached = false): JevReview {
     requestCut: outcome.requestCut && sent,
     latencyMs,
     model,
+    // An `observe` Cloud assignment's checks: asked, recorded, never applied.
+    ...(sent && cloudSummary?.observedAsked?.length ? { observedAsked: cloudSummary.observedAsked } : {}),
+    ...(cloudSummary?.observed?.length
+      ? {
+          observedCloud: cloudSummary.observed.map((o) => ({
+            cloudPolicyId: o.cloudPolicyId,
+            cloudVersion: o.cloudVersion,
+            decision: o.decision,
+            reason: o.reason,
+          })),
+        }
+      : {}),
   };
 }
 
@@ -348,6 +434,7 @@ export function startJevReview(cfg: JevConfig, call: JevCallContext): TwoTierRev
       if (!settled) controller.abort();
     },
     authorityOf,
+    ...(call.cloud ? { cloud: true } : {}),
   });
 
   let route: ReturnType<typeof transportForConfig>;
@@ -429,6 +516,7 @@ export function startJevReview(cfg: JevConfig, call: JevCallContext): TwoTierRev
         ...options,
         machineId: cloud.machineId,
         agent: cloud.agent,
+        observedPolicies: cloud.observedPolicies ?? [],
         // Paused: no installed pack's check is sent, only the globals, and
         // Cloud's own checks are selected and decided on Cloud as ever.
         ...(call.localPaused ? { policies: [] } : {}),