kcp-harness 0.5.1 → 0.6.0

package/dist/approval.d.ts

@@ -0,0 +1,104 @@
+import { type ApprovalsConfig } from "./config.js";
+import type { ConfidenceVerdict } from "kcp-agent";
+/** Lifecycle states for an approval ticket. */
+export type ApprovalState = "pending_review" | "approved" | "dismissed" | "expired";
+/** A request for human approval of a governed call. */
+export interface ApprovalRequest {
+    /** Ticket id, assigned by the harness. */
+    id: string;
+    /** Session that triggered the request. */
+    sessionId: string;
+    /** The intercepted tool call. */
+    toolName: string;
+    /** The classified target (path / action). */
+    target: string;
+    /** The task context the call was made under. */
+    task: string;
+    /** Role that must approve, from harness policy (e.g. "account-owner"). */
+    requiredRole: string;
+    /** ISO timestamp the ticket was opened. */
+    requestedAt: string;
+    /** ISO timestamp after which an unresolved ticket reads as expired. */
+    expiresAt?: string;
+    /** Evidence generated at request time — why a human is being asked. */
+    evidence: {
+        manifest?: string;
+        /** The policy rule that demanded human sign-off. */
+        policyRef?: string;
+        detail?: string;
+        /** The failed confidence verdict, when the gate routed here. */
+        confidence?: ConfidenceVerdict;
+    };
+}
+/** A named human's resolution of a ticket. */
+export interface ApprovalResolution {
+    id: string;
+    state: "approved" | "dismissed";
+    /** Named reviewer — required, never anonymous. */
+    reviewer: string;
+    reviewedAt: string;
+    /** Policy/regulatory citation satisfied — required at approval time. */
+    policyRef: string;
+    note?: string;
+}
+/** Current status of a ticket: its request, computed state, and resolution. */
+export interface ApprovalStatus {
+    state: ApprovalState;
+    request: ApprovalRequest;
+    resolution?: ApprovalResolution;
+}
+/**
+ * The channel-agnostic provider surface. The harness submits and checks;
+ * the approval channel (CLI, Slack bot, ticketing system) resolves.
+ */
+export interface ApprovalProvider {
+    submit(req: ApprovalRequest): Promise<void>;
+    check(id: string): Promise<ApprovalStatus | undefined>;
+    resolve(res: ApprovalResolution): Promise<ApprovalStatus>;
+    list(filter?: {
+        state?: ApprovalState;
+    }): Promise<ApprovalStatus[]>;
+}
+/** Construct the configured ticket store. */
+export declare function providerFromConfig(config: ApprovalsConfig): ApprovalProvider;
+/** Build a new ticket with id + requestedAt assigned. */
+export declare function newRequest(fields: Omit<ApprovalRequest, "id" | "requestedAt"> & {
+    expiresAt?: string;
+}): ApprovalRequest;
+/** Parse a policy duration ("72h", "30m", "7d") to milliseconds. */
+export declare function parseDuration(text: string): number;
+/**
+ * Find the most recent ticket for a (target, tool) pair, whatever its state.
+ * The governor uses this to decide whether to honor, wait on, or re-submit.
+ */
+export declare function latestForCall(provider: ApprovalProvider, target: string, toolName: string): Promise<ApprovalStatus | undefined>;
+export declare class InMemoryApprovalProvider implements ApprovalProvider {
+    private readonly requests;
+    private readonly resolutions;
+    submit(req: ApprovalRequest): Promise<void>;
+    check(id: string): Promise<ApprovalStatus | undefined>;
+    resolve(res: ApprovalResolution): Promise<ApprovalStatus>;
+    list(filter?: {
+        state?: ApprovalState;
+    }): Promise<ApprovalStatus[]>;
+}
+/**
+ * Append-only JSONL store under a directory (default `.kcp-harness/approvals`).
+ * Every read replays the log, so a CLI in one process and the proxy in
+ * another always see each other's writes — no daemon, no lock protocol
+ * beyond O_APPEND line writes (approvals are low-volume by nature).
+ */
+export declare class FileApprovalProvider implements ApprovalProvider {
+    private readonly file;
+    constructor(dir: string);
+    /** The backing file path (for status displays). */
+    getPath(): string;
+    private read;
+    private append;
+    submit(req: ApprovalRequest): Promise<void>;
+    check(id: string): Promise<ApprovalStatus | undefined>;
+    resolve(res: ApprovalResolution): Promise<ApprovalStatus>;
+    list(filter?: {
+        state?: ApprovalState;
+    }): Promise<ApprovalStatus[]>;
+}

package/dist/approval.js

@@ -0,0 +1,179 @@
+// Approval — pending governance decisions resolved by a named human.
+//
+// Some governed actions must not be decided by the automated gate cascade
+// alone: org policy demands a named human sign off, and that can take
+// minutes or days. This module is the state machine for those decisions:
+//
+//   pending_review ─▶ approved   (terminal, by a named reviewer)
+//          │────────▶ dismissed  (terminal, by a named reviewer)
+//          └────────▶ expired    (terminal, via TTL — fail-closed)
+//
+// Two invariants, from the governance pilot this design serves:
+// 1. A resolution REQUIRES a named reviewer and a policy reference —
+//    `approved: true` alone is not a valid resolution. Evidence is
+//    generated at approval time, never reconstructed from logs later.
+// 2. Approvals must survive process restart: sessions are ephemeral,
+//    human review is not. The FileApprovalProvider persists every ticket.
+//
+// The provider interface is deliberately channel-agnostic — Slack, email,
+// or ticketing integrations are org-side implementations of the same
+// submit/check/resolve/list surface the built-in file provider ships.
+import { randomUUID } from "node:crypto";
+import { appendFileSync, mkdirSync, readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { DEFAULT_APPROVALS_DIR } from "./config.js";
+/** Construct the configured ticket store. */
+export function providerFromConfig(config) {
+    if (config.provider === "memory")
+        return new InMemoryApprovalProvider();
+    return new FileApprovalProvider(config.dir ?? DEFAULT_APPROVALS_DIR);
+}
+/** Build a new ticket with id + requestedAt assigned. */
+export function newRequest(fields) {
+    return {
+        id: randomUUID(),
+        requestedAt: new Date().toISOString(),
+        ...fields,
+    };
+}
+/** Parse a policy duration ("72h", "30m", "7d") to milliseconds. */
+export function parseDuration(text) {
+    const m = /^(\d+)([mhd])$/.exec(text.trim());
+    if (!m)
+        throw new Error(`invalid duration "${text}" — expected <number><m|h|d>, e.g. "72h"`);
+    const n = Number(m[1]);
+    const unit = m[2] === "m" ? 60_000 : m[2] === "h" ? 3600_000 : 24 * 3600_000;
+    return n * unit;
+}
+/**
+ * Find the most recent ticket for a (target, tool) pair, whatever its state.
+ * The governor uses this to decide whether to honor, wait on, or re-submit.
+ */
+export async function latestForCall(provider, target, toolName) {
+    const all = await provider.list();
+    const matching = all.filter((s) => s.request.target === target && s.request.toolName === toolName);
+    return matching[matching.length - 1];
+}
+// -- Shared state-machine core ----------------------------------------------
+/** Compute the effective state, applying TTL expiry to unresolved tickets. */
+function effectiveState(request, resolution) {
+    if (resolution)
+        return resolution.state;
+    if (request.expiresAt && Date.parse(request.expiresAt) < Date.now())
+        return "expired";
+    return "pending_review";
+}
+function validateResolution(res) {
+    if (!res.reviewer?.trim())
+        throw new Error("approval resolution requires a named reviewer");
+    if (!res.policyRef?.trim()) {
+        throw new Error("approval resolution requires a policyRef — approved alone is not evidence");
+    }
+}
+/** Check a ticket is resolvable; throws with the reason if not. */
+function assertResolvable(status, id) {
+    if (!status)
+        throw new Error(`unknown approval ticket: ${id}`);
+    if (status.state === "expired")
+        throw new Error(`approval ticket ${id} has expired`);
+    if (status.state !== "pending_review") {
+        throw new Error(`approval ticket ${id} is already resolved (${status.state}) — terminal states are terminal`);
+    }
+}
+// -- In-memory provider (tests, ephemeral setups) ---------------------------
+export class InMemoryApprovalProvider {
+    requests = [];
+    resolutions = new Map();
+    async submit(req) {
+        this.requests.push(req);
+    }
+    async check(id) {
+        const request = this.requests.find((r) => r.id === id);
+        if (!request)
+            return undefined;
+        const resolution = this.resolutions.get(id);
+        return { state: effectiveState(request, resolution), request, resolution };
+    }
+    async resolve(res) {
+        validateResolution(res);
+        const status = await this.check(res.id);
+        assertResolvable(status, res.id);
+        this.resolutions.set(res.id, res);
+        return { state: res.state, request: status.request, resolution: res };
+    }
+    async list(filter) {
+        const all = await Promise.all(this.requests.map((r) => this.check(r.id)));
+        const statuses = all.filter((s) => s !== undefined);
+        return filter?.state ? statuses.filter((s) => s.state === filter.state) : statuses;
+    }
+}
+/**
+ * Append-only JSONL store under a directory (default `.kcp-harness/approvals`).
+ * Every read replays the log, so a CLI in one process and the proxy in
+ * another always see each other's writes — no daemon, no lock protocol
+ * beyond O_APPEND line writes (approvals are low-volume by nature).
+ */
+export class FileApprovalProvider {
+    file;
+    constructor(dir) {
+        this.file = join(dir, "approvals.jsonl");
+        mkdirSync(dir, { recursive: true });
+    }
+    /** The backing file path (for status displays). */
+    getPath() {
+        return this.file;
+    }
+    read() {
+        const requests = [];
+        const resolutions = new Map();
+        if (!existsSync(this.file))
+            return { requests, resolutions };
+        for (const line of readFileSync(this.file, "utf-8").split("\n")) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            try {
+                const record = JSON.parse(trimmed);
+                if (record.kind === "request")
+                    requests.push(record.request);
+                else if (record.kind === "resolution")
+                    resolutions.set(record.resolution.id, record.resolution);
+            }
+            catch {
+                // A torn write must not take the whole store down — skip the line.
+                // Fail-closed still holds: a missing resolution reads as pending/expired.
+            }
+        }
+        return { requests, resolutions };
+    }
+    append(record) {
+        appendFileSync(this.file, JSON.stringify(record) + "\n", "utf-8");
+    }
+    async submit(req) {
+        this.append({ kind: "request", request: req });
+    }
+    async check(id) {
+        const { requests, resolutions } = this.read();
+        const request = requests.find((r) => r.id === id);
+        if (!request)
+            return undefined;
+        const resolution = resolutions.get(id);
+        return { state: effectiveState(request, resolution), request, resolution };
+    }
+    async resolve(res) {
+        validateResolution(res);
+        const status = await this.check(res.id);
+        assertResolvable(status, res.id);
+        this.append({ kind: "resolution", resolution: res });
+        return { state: res.state, request: status.request, resolution: res };
+    }
+    async list(filter) {
+        const { requests, resolutions } = this.read();
+        const statuses = requests.map((request) => ({
+            state: effectiveState(request, resolutions.get(request.id)),
+            request,
+            resolution: resolutions.get(request.id),
+        }));
+        return filter?.state ? statuses.filter((s) => s.state === filter.state) : statuses;
+    }
+}

package/dist/approvals-cli.d.ts

@@ -0,0 +1,4 @@
+import type { HarnessConfig } from "./config.js";
+import { type AuditWriter } from "./audit.js";
+/** Run an approvals subcommand; returns the text to print. Throws on misuse. */
+export declare function runApprovals(argv: string[], config: HarnessConfig, audit?: AuditWriter): Promise<string>;

package/dist/approvals-cli.js

@@ -0,0 +1,68 @@
+// Approvals CLI — the built-in review channel for the FileApprovalProvider.
+//
+// The proxy opens tickets; a human resolves them here (or via any other
+// ApprovalProvider channel an org wires up). Resolutions require a named
+// reviewer and a policy reference — the CLI refuses anything less, the
+// same invariant the provider enforces.
+//
+//   kcp-harness approvals list [--state pending_review]
+//   kcp-harness approvals approve <id> --reviewer "Kari N." --policy-ref POL-7.2 [--note ...]
+//   kcp-harness approvals dismiss <id> --reviewer "Kari N." --policy-ref POL-7.2 [--note ...]
+import { providerFromConfig } from "./approval.js";
+import { buildApprovalEvent } from "./audit.js";
+/** Run an approvals subcommand; returns the text to print. Throws on misuse. */
+export async function runApprovals(argv, config, audit) {
+    const approvalsConfig = config.governance.approvals;
+    if (!approvalsConfig) {
+        throw new Error("no approvals configured — add governance.approvals to harness.yaml");
+    }
+    const provider = providerFromConfig(approvalsConfig);
+    const sub = argv[0];
+    switch (sub) {
+        case "list": {
+            const state = flag(argv, "--state");
+            const statuses = await provider.list(state ? { state } : undefined);
+            if (statuses.length === 0)
+                return "no approval tickets\n";
+            return statuses.map(formatStatus).join("\n") + "\n";
+        }
+        case "approve":
+        case "dismiss": {
+            const id = argv[1];
+            if (!id || id.startsWith("--"))
+                throw new Error(`usage: approvals ${sub} <id> --reviewer <name> --policy-ref <ref>`);
+            const reviewer = flag(argv, "--reviewer");
+            if (!reviewer)
+                throw new Error(`--reviewer is required — resolutions are never anonymous`);
+            const policyRef = flag(argv, "--policy-ref");
+            if (!policyRef)
+                throw new Error(`--policy-ref is required — cite the policy this resolution satisfies`);
+            const note = flag(argv, "--note");
+            const status = await provider.resolve({
+                id,
+                state: sub === "approve" ? "approved" : "dismissed",
+                reviewer,
+                reviewedAt: new Date().toISOString(),
+                policyRef,
+                note,
+            });
+            // The resolution is an audit event on the same log the proxy writes
+            audit?.emit(buildApprovalEvent(status.request.sessionId, 0, "approval_resolved", status));
+            return formatStatus(status) + "\n";
+        }
+        default:
+            throw new Error(`unknown approvals subcommand: ${sub ?? "(none)"} — expected list, approve, or dismiss`);
+    }
+}
+function formatStatus(s) {
+    const head = `${s.request.id}  ${s.state}  ${s.request.toolName} ${s.request.target}  role=${s.request.requiredRole}`;
+    const when = `  requested=${s.request.requestedAt}${s.request.expiresAt ? ` expires=${s.request.expiresAt}` : ""}`;
+    const who = s.resolution
+        ? `\n  ${s.resolution.state} by ${s.resolution.reviewer} at ${s.resolution.reviewedAt} (${s.resolution.policyRef})${s.resolution.note ? ` — ${s.resolution.note}` : ""}`
+        : "";
+    return head + when + who;
+}
+function flag(argv, name) {
+    const idx = argv.indexOf(name);
+    return idx >= 0 && idx + 1 < argv.length ? argv[idx + 1] : undefined;
+}

package/dist/audit.d.ts

@@ -3,8 +3,9 @@ import type { Classification } from "./classifier.js";
 import type { GovernanceDecision } from "./governor.js";
 import type { LedgerSnapshot } from "./budget-ledger.js";
 import type { DriftResult } from "./temporal-watch.js";
+import type { ApprovalStatus } from "./approval.js";
 /** Event types for structured audit logging. */
-export type AuditEventType = "tool_call" | "session_start" | "session_end" | "budget_spend" | "budget_exceeded" | "temporal_drift" | "plan_invalidated";
+export type AuditEventType = "tool_call" | "session_start" | "session_end" | "budget_spend" | "budget_exceeded" | "temporal_drift" | "plan_invalidated" | "approval_requested" | "approval_resolved" | "confidence_verdict";
 /** A single audit event. */
 export interface AuditEvent {
     /** ISO 8601 timestamp. */
@@ -42,6 +43,31 @@ export interface AuditEvent {
     };
     /** Manifest signature verification result. */
     signature?: SignatureResult;
+    /** Approval ticket details (for approval_requested / approval_resolved events). */
+    approval?: {
+        id: string;
+        state: string;
+        toolName?: string;
+        target?: string;
+        requiredRole?: string;
+        /** Policy citation — from the rule at request time, from the reviewer at resolution time. */
+        policyRef?: string;
+        reviewer?: string;
+        reviewedAt?: string;
+        note?: string;
+        expiresAt?: string;
+    };
+    /** Confidence verdict summary (for confidence_verdict events; no answer text). */
+    confidence?: {
+        task: string;
+        passed: boolean;
+        score: number;
+        threshold: number;
+        detail: string;
+        severity?: string;
+        /** Ticket opened for the failure, when routing applied. */
+        ticketId?: string;
+    };
 }
 /** Append-only audit log writer. */
 export declare class AuditLog {
@@ -72,6 +98,16 @@ export declare function buildBudgetEvent(sessionId: string, sequence: number, ac
     amount?: number;
     currency?: string;
 }): AuditEvent;
+/** Build a human-approval lifecycle event from a ticket's current status. */
+export declare function buildApprovalEvent(sessionId: string, sequence: number, type: "approval_requested" | "approval_resolved", status: ApprovalStatus): AuditEvent;
+/** Build a confidence-gate event: the verdict, never the answer text. */
+export declare function buildConfidenceEvent(sessionId: string, sequence: number, task: string, verdict: {
+    passed: boolean;
+    score: number;
+    threshold: number;
+    detail: string;
+    severity?: string;
+}, ticketId?: string): AuditEvent;
 /** Build a temporal drift event. */
 export declare function buildDriftEvent(sessionId: string, sequence: number, drift: DriftResult): AuditEvent;
 /** Redact sensitive values from tool arguments for audit logging. */

package/dist/audit.js

@@ -89,6 +89,50 @@ export function buildBudgetEvent(sessionId, sequence, accepted, snapshot, detail
         ...(details ? { toolCall: { name: accepted ? "budget_spend" : "budget_exceeded", args: details } } : {}),
     };
 }
+/** Build a human-approval lifecycle event from a ticket's current status. */
+export function buildApprovalEvent(sessionId, sequence, type, status) {
+    return {
+        timestamp: new Date().toISOString(),
+        sessionId,
+        sequence,
+        type,
+        // A request is not yet an outcome; a resolution's outcome follows the reviewer.
+        outcome: status.state === "approved" ? "approved" : "blocked",
+        durationMs: 0,
+        approval: {
+            id: status.request.id,
+            state: status.state,
+            toolName: status.request.toolName,
+            target: status.request.target,
+            requiredRole: status.request.requiredRole,
+            policyRef: status.resolution?.policyRef ?? status.request.evidence.policyRef,
+            reviewer: status.resolution?.reviewer,
+            reviewedAt: status.resolution?.reviewedAt,
+            note: status.resolution?.note,
+            expiresAt: status.request.expiresAt,
+        },
+    };
+}
+/** Build a confidence-gate event: the verdict, never the answer text. */
+export function buildConfidenceEvent(sessionId, sequence, task, verdict, ticketId) {
+    return {
+        timestamp: new Date().toISOString(),
+        sessionId,
+        sequence,
+        type: "confidence_verdict",
+        outcome: verdict.passed ? "approved" : "blocked",
+        durationMs: 0,
+        confidence: {
+            task,
+            passed: verdict.passed,
+            score: verdict.score,
+            threshold: verdict.threshold,
+            detail: verdict.detail,
+            severity: verdict.severity,
+            ticketId,
+        },
+    };
+}
 /** Build a temporal drift event. */
 export function buildDriftEvent(sessionId, sequence, drift) {
     return {

package/dist/cli.js

@@ -16,6 +16,8 @@ import { serveProxy } from "./proxy.js";
 import { generate, listAgents } from "./integrations/generate.js";
 import { exportEvidence } from "./export.js";
 import { DashboardServer } from "./dashboard/server.js";
+import { runApprovals } from "./approvals-cli.js";
+import { AuditLog } from "./audit.js";
 const USAGE = `kcp-harness — KCP Compliance Harness
 
 Usage:
@@ -26,6 +28,9 @@ Usage:
   kcp-harness integrate --list                  List supported agents
   kcp-harness export   [options]               Export compliance evidence
   kcp-harness dashboard [options]              Launch compliance dashboard
+  kcp-harness approvals list [--state s]        List human-approval tickets
+  kcp-harness approvals approve <id> --reviewer <name> --policy-ref <ref> [--note n]
+  kcp-harness approvals dismiss <id> --reviewer <name> --policy-ref <ref> [--note n]
   kcp-harness --version                        Show version
   kcp-harness --help                           Show this help
 
@@ -36,7 +41,7 @@ governance for any agent. It intercepts tool calls, classifies them
 as knowledge-navigation or pass-through, and routes governed calls
 through the kcp-agent planner before execution.
 `;
-const VERSION = "0.5.1";
+const VERSION = "0.6.0";
 const TEMPLATE = `# kcp-harness configuration
 version: "1.0"
 
@@ -65,6 +70,27 @@ governance:
     # trusted_keys:
     #   - "./keys/manifest-key.pem"
 
+  # Confidence gate — harness_assess adjudicates an answer's confidence
+  # against this threshold before it may be acted on; failures route to
+  # the named approval role when set
+  # confidence:
+  #   threshold: 0.7
+  #   severity: critical
+  #   route_to_role: account-owner
+  #   expires_after: 72h
+  #   policy_ref: POL-9.1
+
+  # Human-approval gates — calls matching a rule are held for a named
+  # reviewer (resolve with: kcp-harness approvals approve <id> ...)
+  # approvals:
+  #   provider: file
+  #   dir: .kcp-harness/approvals
+  #   rules:
+  #     - match: { tools: [Write, Edit], paths: [records/] }
+  #       required_role: account-owner
+  #       expires_after: 72h
+  #       policy_ref: POL-7.2
+
 downstream:
   # - name: "filesystem"
   #   command: "npx"
@@ -225,6 +251,24 @@ async function main() {
             process.on("SIGTERM", shutdown);
             break;
         }
+        case "approvals": {
+            if (!existsSync(configPath)) {
+                process.stderr.write(`[kcp-harness] config not found: ${configPath}\n`);
+                process.exit(1);
+            }
+            try {
+                const config = loadConfig(configPath);
+                const audit = new AuditLog(config.audit.path);
+                const out = await runApprovals(args.slice(1), config, audit);
+                process.stdout.write(out);
+            }
+            catch (e) {
+                const msg = e instanceof Error ? e.message : String(e);
+                process.stderr.write(`[kcp-harness] approvals error: ${msg}\n`);
+                process.exit(1);
+            }
+            break;
+        }
         default:
             process.stderr.write(`[kcp-harness] unknown command: ${command}\n\n`);
             process.stdout.write(USAGE);

package/dist/config.d.ts

@@ -33,6 +33,50 @@ export interface GovernancePolicy {
     /** Trusted public keys for signature verification (paths, URLs, or inline). */
     trusted_keys?: string[];
 }
+/** A rule demanding human approval for matching governed calls. */
+export interface ApprovalRule {
+    /** What the rule applies to. Absent criteria match everything; present criteria AND together. */
+    match: {
+        /** Tool names (exact), e.g. [Write, Edit]. */
+        tools?: string[];
+        /** Path prefixes, matched like governed-domain paths. */
+        paths?: string[];
+    };
+    /** Role that must approve (recorded on the ticket; enforcement is channel-side). */
+    required_role: string;
+    /** TTL after which an unresolved ticket expires ("30m", "72h", "7d"). */
+    expires_after?: string;
+    /** Policy/regulatory citation this rule enforces — carried as ticket evidence. */
+    policy_ref?: string;
+}
+/** Human-approval configuration — org policy, deliberately not manifest data. */
+export interface ApprovalsConfig {
+    /** Ticket store: "file" (persisted, default) or "memory" (ephemeral). */
+    provider: "file" | "memory";
+    /** Directory for the file provider's store (default: .kcp-harness/approvals). */
+    dir?: string;
+    /** Rules evaluated before any automated governance path. */
+    rules: ApprovalRule[];
+}
+/** Default approvals store directory. */
+export declare const DEFAULT_APPROVALS_DIR = ".kcp-harness/approvals";
+/**
+ * Confidence-gate configuration for harness_assess — org policy for when a
+ * synthesized conclusion may be acted on (kcp-agent's assess() decides,
+ * the harness enforces).
+ */
+export interface ConfidenceConfig {
+    /** Pass/fail line, 0..1. A caller may tighten it, never loosen it. */
+    threshold: number;
+    /** Severity label recorded on verdicts (e.g. "critical"). */
+    severity?: string;
+    /** Route failed verdicts to this approval role (requires governance.approvals). */
+    route_to_role?: string;
+    /** TTL for routed tickets ("30m", "72h", "7d"). */
+    expires_after?: string;
+    /** Policy citation carried as ticket evidence. */
+    policy_ref?: string;
+}
 /** A downstream MCP server to proxy tool calls to. */
 export interface DownstreamConfig {
     /** Human-readable name for this downstream server. */
@@ -60,6 +104,10 @@ export interface HarnessConfig {
     governance: {
         domains: GovernedDomain[];
         policy: GovernancePolicy;
+        /** Human-approval gates (absent = no approval rules). */
+        approvals?: ApprovalsConfig;
+        /** Confidence gate for harness_assess (absent = caller must supply a threshold). */
+        confidence?: ConfidenceConfig;
     };
     downstream: DownstreamConfig[];
     audit: AuditConfig;

package/dist/config.js

@@ -5,6 +5,8 @@
 // which downstream MCP servers to proxy. Everything else passes through.
 import { readFileSync } from "node:fs";
 import yaml from "js-yaml";
+/** Default approvals store directory. */
+export const DEFAULT_APPROVALS_DIR = ".kcp-harness/approvals";
 /** Default governance policy. */
 export const DEFAULT_POLICY = {
     fail_closed: true,
@@ -29,12 +31,19 @@ export function parseConfig(text) {
     const governance = raw["governance"];
     const domains = parseDomains(governance?.["domains"]);
     const policy = parsePolicy(governance?.["policy"]);
+    const approvals = parseApprovals(governance?.["approvals"]);
+    const confidence = parseConfidence(governance?.["confidence"]);
     const downstream = parseDownstream(raw["downstream"]);
     const audit = parseAudit(raw["audit"]);
     const dashboard = parseDashboard(raw["dashboard"]);
     return {
         version: String(raw["version"] ?? "1.0"),
-        governance: { domains, policy },
+        governance: {
+            domains,
+            policy,
+            ...(approvals ? { approvals } : {}),
+            ...(confidence ? { confidence } : {}),
+        },
         downstream,
         audit,
         ...(dashboard ? { dashboard } : {}),
@@ -46,6 +55,49 @@ function parseDashboard(raw) {
     const d = raw;
     return { url: d["url"] === undefined ? undefined : String(d["url"]) };
 }
+function parseApprovals(raw) {
+    if (!raw || typeof raw !== "object")
+        return undefined;
+    const a = raw;
+    const rules = Array.isArray(a["rules"]) ? a["rules"].map(parseApprovalRule) : [];
+    return {
+        provider: a["provider"] === "memory" ? "memory" : "file",
+        dir: a["dir"] === undefined ? undefined : String(a["dir"]),
+        rules,
+    };
+}
+function parseApprovalRule(raw) {
+    const requiredRole = raw["required_role"];
+    if (!requiredRole || typeof requiredRole !== "string") {
+        throw new Error("approval rule requires required_role — an approval nobody is named to give cannot resolve");
+    }
+    const match = (raw["match"] ?? {});
+    return {
+        match: {
+            tools: Array.isArray(match["tools"]) ? match["tools"].map(String) : undefined,
+            paths: Array.isArray(match["paths"]) ? match["paths"].map(String) : undefined,
+        },
+        required_role: requiredRole,
+        expires_after: raw["expires_after"] === undefined ? undefined : String(raw["expires_after"]),
+        policy_ref: raw["policy_ref"] === undefined ? undefined : String(raw["policy_ref"]),
+    };
+}
+function parseConfidence(raw) {
+    if (!raw || typeof raw !== "object")
+        return undefined;
+    const c = raw;
+    const threshold = Number(c["threshold"]);
+    if (Number.isNaN(threshold) || threshold < 0 || threshold > 1) {
+        throw new Error(`confidence.threshold must be a number in 0..1, got ${String(c["threshold"])}`);
+    }
+    return {
+        threshold,
+        severity: c["severity"] === undefined ? undefined : String(c["severity"]),
+        route_to_role: c["route_to_role"] === undefined ? undefined : String(c["route_to_role"]),
+        expires_after: c["expires_after"] === undefined ? undefined : String(c["expires_after"]),
+        policy_ref: c["policy_ref"] === undefined ? undefined : String(c["policy_ref"]),
+    };
+}
 function parseDomains(raw) {
     if (!Array.isArray(raw))
         return [];

package/dist/governor.d.ts

@@ -1,14 +1,20 @@
 import { type AgentPlan, type DecisionTrace, type SignatureResult } from "kcp-agent";
-import type { GovernancePolicy } from "./config.js";
+import type { GovernancePolicy, ApprovalRule } from "./config.js";
 import type { Classification } from "./classifier.js";
 import type { SessionState, ApprovedPlan } from "./session.js";
 import type { SpendResult } from "./budget-ledger.js";
+import { type ApprovalProvider, type ApprovalResolution } from "./approval.js";
+/** Approval wiring the proxy hands to the governor: the store + the rules. */
+export interface ApprovalContext {
+    provider: ApprovalProvider;
+    rules: ApprovalRule[];
+}
 /** The governor's decision for a tool call. */
 export interface GovernanceDecision {
     /** Whether the tool call is approved. */
     approved: boolean;
     /** How the decision was made. */
-    mode: "plan-first" | "auto-plan" | "kcp-passthrough" | "blocked";
+    mode: "plan-first" | "auto-plan" | "kcp-passthrough" | "blocked" | "pending" | "human-approved";
     /** The plan that governs this decision (if any). */
     plan?: AgentPlan;
     /** The decision trace (if tracing is enabled). */
@@ -21,6 +27,12 @@ export interface GovernanceDecision {
     budgetSpend?: SpendResult;
     /** Manifest signature verification result (when signature checking is active). */
     signature?: SignatureResult;
+    /** Ticket id, when mode is "pending". */
+    pendingId?: string;
+    /** True when this call opened a new ticket (the proxy audits approval_requested). */
+    submitted?: boolean;
+    /** The named human's resolution, when mode is "human-approved". */
+    resolution?: ApprovalResolution;
 }
 /**
  * Govern a classified tool call — decide whether to approve or block.
@@ -33,4 +45,4 @@ export interface GovernanceDecision {
  * 2. If not, auto-plan against the domain's manifest → approve if selected
  * 3. Otherwise → block (fail-closed)
  */
-export declare function govern(classification: Classification, toolName: string, args: Record<string, unknown>, session: SessionState, policy: GovernancePolicy): Promise<GovernanceDecision>;
+export declare function govern(classification: Classification, toolName: string, args: Record<string, unknown>, session: SessionState, policy: GovernancePolicy, approvals?: ApprovalContext): Promise<GovernanceDecision>;

package/dist/governor.js

@@ -19,7 +19,9 @@
 // the manifest, if the unit isn't selected, or if the budget is exhausted,
 // the call is blocked — never silently passed through.
 import { planTree, plans, } from "kcp-agent";
+import { matchesPrefix } from "./classifier.js";
 import { isPathApproved, addPlan, recordSpend } from "./session.js";
+import { latestForCall, newRequest, parseDuration, } from "./approval.js";
 /**
  * Govern a classified tool call — decide whether to approve or block.
  *
@@ -31,7 +33,7 @@ import { isPathApproved, addPlan, recordSpend } from "./session.js";
  * 2. If not, auto-plan against the domain's manifest → approve if selected
  * 3. Otherwise → block (fail-closed)
  */
-export async function govern(classification, toolName, args, session, policy) {
+export async function govern(classification, toolName, args, session, policy, approvals) {
     // KCP tools pass through — they ARE the governance layer
     if (toolName.startsWith("kcp_")) {
         return { approved: true, mode: "kcp-passthrough", reason: "KCP tool — governance layer itself" };
@@ -41,6 +43,22 @@ export async function govern(classification, toolName, args, session, policy) {
     }
     const domain = classification.domain;
     const target = classification.target;
+    // Mode 0: human-approval rules outrank every automated path. A matched
+    // rule means a named human decides — an approved plan must not bypass it.
+    if (approvals) {
+        const rule = approvals.rules.find((r) => ruleMatches(r, toolName, target));
+        if (rule) {
+            try {
+                return await governByApproval(rule, toolName, target ?? "", session, domain, approvals.provider);
+            }
+            catch (e) {
+                const msg = e instanceof Error ? e.message : String(e);
+                // Fail-closed: if the approval store is unreachable we cannot prove
+                // a human signed off, so the call is blocked.
+                return { approved: false, mode: "blocked", reason: `approval check failed (fail-closed): ${msg}` };
+            }
+        }
+    }
     // Mode 1: check existing approved plans
     if (target) {
         const approved = isPathApproved(session, target);
@@ -84,6 +102,78 @@ export async function govern(classification, toolName, args, session, policy) {
         reason: `governed tool call with no extractable target — blocked by policy`,
     };
 }
+/** Does an approval rule apply to this call? Present criteria AND together. */
+function ruleMatches(rule, toolName, target) {
+    if (rule.match.tools && !rule.match.tools.includes(toolName))
+        return false;
+    if (rule.match.paths) {
+        if (!target)
+            return false;
+        if (!rule.match.paths.some((p) => matchesPrefix(target, p)))
+            return false;
+    }
+    return true;
+}
+/**
+ * Decide a rule-matched call from the approval store:
+ * approved → allow with the resolution attached; pending → wait;
+ * dismissed → terminal block; expired or absent → open a fresh ticket.
+ */
+async function governByApproval(rule, toolName, target, session, domain, provider) {
+    const existing = await latestForCall(provider, target, toolName);
+    if (existing?.state === "approved" && existing.resolution) {
+        return {
+            approved: true,
+            mode: "human-approved",
+            resolution: existing.resolution,
+            reason: `approved by ${existing.resolution.reviewer} at ${existing.resolution.reviewedAt} ` +
+                `(${existing.resolution.policyRef}) — ticket ${existing.request.id}`,
+        };
+    }
+    if (existing?.state === "pending_review") {
+        return {
+            approved: false,
+            mode: "pending",
+            pendingId: existing.request.id,
+            reason: `pending approval ${existing.request.id} from role ${existing.request.requiredRole} — ` +
+                `re-try after approval or check harness_approvals`,
+        };
+    }
+    if (existing?.state === "dismissed" && existing.resolution) {
+        return {
+            approved: false,
+            mode: "blocked",
+            reason: `dismissed by ${existing.resolution.reviewer}` +
+                `${existing.resolution.note ? `: ${existing.resolution.note}` : ""} — ticket ${existing.request.id}`,
+        };
+    }
+    // No usable ticket (none yet, or the last one expired) → open a fresh one.
+    const request = newRequest({
+        sessionId: session.id,
+        toolName,
+        target,
+        task: `${toolName} ${target}`.trim(),
+        requiredRole: rule.required_role,
+        expiresAt: rule.expires_after
+            ? new Date(Date.now() + parseDuration(rule.expires_after)).toISOString()
+            : undefined,
+        evidence: {
+            manifest: domain.manifest,
+            policyRef: rule.policy_ref,
+            detail: existing?.state === "expired" ? `previous ticket ${existing.request.id} expired` : undefined,
+        },
+    });
+    await provider.submit(request);
+    return {
+        approved: false,
+        mode: "pending",
+        pendingId: request.id,
+        submitted: true,
+        reason: `pending approval ${request.id} from role ${rule.required_role}` +
+            `${rule.policy_ref ? ` (${rule.policy_ref})` : ""} — ` +
+            `re-try after approval or check harness_approvals`,
+    };
+}
 /**
  * Auto-govern: run the kcp-agent planner to decide if accessing a target
  * path is approved. Creates a plan and checks if the target is in the

package/dist/index.d.ts

@@ -1,10 +1,12 @@
 export { classify, extractTargets, normalizePath, matchesPrefix, type Classification, } from "./classifier.js";
-export { govern, type GovernanceDecision, } from "./governor.js";
-export { AuditLog, InMemoryAuditLog, buildEvent, buildLifecycleEvent, buildBudgetEvent, buildDriftEvent, type AuditWriter, type AuditEvent, type AuditEventType, } from "./audit.js";
+export { govern, type GovernanceDecision, type ApprovalContext, } from "./governor.js";
+export { InMemoryApprovalProvider, FileApprovalProvider, providerFromConfig, newRequest, parseDuration, latestForCall, type ApprovalProvider, type ApprovalRequest, type ApprovalResolution, type ApprovalStatus, type ApprovalState, } from "./approval.js";
+export { runApprovals } from "./approvals-cli.js";
+export { AuditLog, InMemoryAuditLog, buildEvent, buildLifecycleEvent, buildBudgetEvent, buildDriftEvent, buildApprovalEvent, buildConfidenceEvent, type AuditWriter, type AuditEvent, type AuditEventType, } from "./audit.js";
 export { createSession, addPlan, isPathApproved, recordLoaded, getKnown, recordSpend, nextSequence, type SessionState, type ApprovedPlan, } from "./session.js";
 export { DownstreamManager, type McpTool, type DownstreamConnection, } from "./downstream.js";
 export { HarnessProxy, serveProxy, type ProxyOptions, } from "./proxy.js";
-export { loadConfig, parseConfig, DEFAULT_POLICY, DEFAULT_AUDIT, type HarnessConfig, type GovernedDomain, type GovernancePolicy, type DownstreamConfig, type AuditConfig, } from "./config.js";
+export { loadConfig, parseConfig, DEFAULT_POLICY, DEFAULT_AUDIT, DEFAULT_APPROVALS_DIR, type HarnessConfig, type GovernedDomain, type GovernancePolicy, type DownstreamConfig, type AuditConfig, type ApprovalRule, type ApprovalsConfig, type ConfidenceConfig, } from "./config.js";
 export { callKcpTool } from "./kcp-bridge.js";
 export { BudgetLedger, type BudgetCeiling, type LedgerEntry, type LedgerSource, type LedgerCost, type LedgerSnapshot, type SpendResult, } from "./budget-ledger.js";
 export { TemporalWatch, type WatchedPlan, type DriftResult, type WatchResult, } from "./temporal-watch.js";

package/dist/index.js

@@ -9,11 +9,13 @@
 // bypass governance because it only has access to the proxy's stdio.
 export { classify, extractTargets, normalizePath, matchesPrefix, } from "./classifier.js";
 export { govern, } from "./governor.js";
-export { AuditLog, InMemoryAuditLog, buildEvent, buildLifecycleEvent, buildBudgetEvent, buildDriftEvent, } from "./audit.js";
+export { InMemoryApprovalProvider, FileApprovalProvider, providerFromConfig, newRequest, parseDuration, latestForCall, } from "./approval.js";
+export { runApprovals } from "./approvals-cli.js";
+export { AuditLog, InMemoryAuditLog, buildEvent, buildLifecycleEvent, buildBudgetEvent, buildDriftEvent, buildApprovalEvent, buildConfidenceEvent, } from "./audit.js";
 export { createSession, addPlan, isPathApproved, recordLoaded, getKnown, recordSpend, nextSequence, } from "./session.js";
 export { DownstreamManager, } from "./downstream.js";
 export { HarnessProxy, serveProxy, } from "./proxy.js";
-export { loadConfig, parseConfig, DEFAULT_POLICY, DEFAULT_AUDIT, } from "./config.js";
+export { loadConfig, parseConfig, DEFAULT_POLICY, DEFAULT_AUDIT, DEFAULT_APPROVALS_DIR, } from "./config.js";
 export { callKcpTool } from "./kcp-bridge.js";
 export { BudgetLedger, } from "./budget-ledger.js";
 export { TemporalWatch, } from "./temporal-watch.js";

package/dist/proxy.d.ts

@@ -1,4 +1,5 @@
 import type { HarnessConfig } from "./config.js";
+import { type ApprovalProvider } from "./approval.js";
 import { type AuditWriter } from "./audit.js";
 import { type SessionState } from "./session.js";
 interface JsonRpcRequest {
@@ -16,6 +17,7 @@ export declare class HarnessProxy {
     private readonly downstream;
     private readonly audit;
     private readonly session;
+    private readonly approvals?;
     constructor(options: ProxyOptions);
     /** Start the proxy: spawn downstream servers and begin serving. */
     start(): Promise<void>;
@@ -35,8 +37,17 @@ export declare class HarnessProxy {
     private maybeEmitTrace;
     /** Handle harness-internal tools. */
     private handleHarnessTool;
+    /**
+     * Confidence-gate an answer: kcp-agent's assess() decides, the harness
+     * enforces. A failed verdict on a routed config opens an approval ticket
+     * carrying the verdict as evidence; a named human's approval overrides
+     * the gate on retry. Dismissal is terminal.
+     */
+    private handleAssess;
     /** Expose session for testing. */
     getSession(): SessionState;
+    /** Expose the approval ticket store (for testing and embedding). */
+    getApprovalProvider(): ApprovalProvider | undefined;
 }
 /** Serve the harness proxy over stdio until stdin closes. */
 export declare function serveProxy(config: HarnessConfig): Promise<void>;

package/dist/proxy.js

@@ -14,7 +14,9 @@
 import { createInterface } from "node:readline";
 import { classify } from "./classifier.js";
 import { govern } from "./governor.js";
-import { AuditLog, buildEvent, buildLifecycleEvent, buildDriftEvent, } from "./audit.js";
+import { providerFromConfig, latestForCall, newRequest, parseDuration } from "./approval.js";
+import { assess } from "kcp-agent";
+import { AuditLog, buildEvent, buildLifecycleEvent, buildDriftEvent, buildApprovalEvent, buildConfidenceEvent, } from "./audit.js";
 import { createSession, nextSequence } from "./session.js";
 import { DownstreamManager } from "./downstream.js";
 import { callKcpTool } from "./kcp-bridge.js";
@@ -57,6 +59,40 @@ const HARNESS_TOOLS = [
             "time and report any plans that would produce different results now.",
         inputSchema: { type: "object", properties: {} },
     },
+    {
+        name: "harness_approvals",
+        description: "List human-approval tickets: calls held for a named reviewer. " +
+            "A pending call is denied with its ticket id — re-try it after approval.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                state: {
+                    type: "string",
+                    description: "Filter by state: pending_review, approved, dismissed, expired",
+                },
+            },
+        },
+    },
+    {
+        name: "harness_assess",
+        description: "Confidence-gate a synthesized answer before acting on it. Runs kcp-agent's " +
+            "post-synthesis assess(): the answer's self-reported confidence is adjudicated " +
+            "against the org threshold. A failed verdict is routed to a named human when " +
+            "governance.confidence.route_to_role is set — re-try after approval.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                task: { type: "string", description: "The task the answer concludes" },
+                answer: { type: "string", description: "The synthesized answer to gate" },
+                threshold: {
+                    type: "number",
+                    description: "Optional tightening of the configured threshold (the strictest wins)",
+                },
+                severity: { type: "string", description: "Severity label override (e.g. critical)" },
+            },
+            required: ["task", "answer"],
+        },
+    },
 ];
 /** KCP tool names that the harness routes to kcp-agent directly. */
 const KCP_TOOLS = new Set(["kcp_plan", "kcp_load", "kcp_trace", "kcp_validate", "kcp_replay"]);
@@ -65,10 +101,18 @@ export class HarnessProxy {
     downstream;
     audit;
     session;
+    approvals;
     constructor(options) {
         this.config = options.config;
         this.downstream = new DownstreamManager();
         this.audit = options.audit ?? new AuditLog(options.config.audit.path);
+        const approvalsConfig = options.config.governance.approvals;
+        if (approvalsConfig) {
+            this.approvals = {
+                provider: providerFromConfig(approvalsConfig),
+                rules: approvalsConfig.rules,
+            };
+        }
         // Derive budget ceiling from policy
         const policy = options.config.governance.policy;
         const ceiling = policy.budget
@@ -213,7 +257,14 @@ export class HarnessProxy {
             // Step 2: Govern (for governed calls)
             let governance;
             if (classification.governed) {
-                governance = await govern(classification, toolName, args, this.session, this.config.governance.policy);
+                governance = await govern(classification, toolName, args, this.session, this.config.governance.policy, this.approvals);
+                // A freshly opened ticket is its own audit event
+                if (governance.submitted && governance.pendingId && this.approvals) {
+                    const status = await this.approvals.provider.check(governance.pendingId);
+                    if (status) {
+                        this.audit.emit(buildApprovalEvent(this.session.id, nextSequence(this.session), "approval_requested", status));
+                    }
+                }
                 if (!governance.approved) {
                     // Blocked — emit audit and return error
                     const event = buildEvent(this.session.id, seq, toolName, args, classification, governance, "blocked", Date.now() - startTime);
@@ -381,6 +432,39 @@ export class HarnessProxy {
                     isError: false,
                 };
             }
+            case "harness_approvals": {
+                if (!this.approvals) {
+                    return {
+                        content: [{ type: "text", text: "no approval rules configured — see governance.approvals in harness.yaml" }],
+                        isError: false,
+                    };
+                }
+                const stateFilter = typeof _args["state"] === "string" ? _args["state"] : undefined;
+                const statuses = await this.approvals.provider.list(stateFilter ? { state: stateFilter } : undefined);
+                return {
+                    content: [{
+                            type: "text",
+                            text: JSON.stringify({
+                                approvals: statuses.map((s) => ({
+                                    id: s.request.id,
+                                    state: s.state,
+                                    toolName: s.request.toolName,
+                                    target: s.request.target,
+                                    requiredRole: s.request.requiredRole,
+                                    requestedAt: s.request.requestedAt,
+                                    expiresAt: s.request.expiresAt,
+                                    policyRef: s.resolution?.policyRef ?? s.request.evidence.policyRef,
+                                    reviewer: s.resolution?.reviewer,
+                                    reviewedAt: s.resolution?.reviewedAt,
+                                    note: s.resolution?.note,
+                                })),
+                            }, null, 2),
+                        }],
+                    isError: false,
+                };
+            }
+            case "harness_assess":
+                return this.handleAssess(_args);
             default:
                 return {
                     content: [{ type: "text", text: `unknown harness tool: ${name}` }],
@@ -388,10 +472,108 @@ export class HarnessProxy {
                 };
         }
     }
+    /**
+     * Confidence-gate an answer: kcp-agent's assess() decides, the harness
+     * enforces. A failed verdict on a routed config opens an approval ticket
+     * carrying the verdict as evidence; a named human's approval overrides
+     * the gate on retry. Dismissal is terminal.
+     */
+    async handleAssess(args) {
+        const err = (text) => ({ content: [{ type: "text", text }], isError: true });
+        const ok = (body) => ({
+            content: [{ type: "text", text: JSON.stringify(body, null, 2) }],
+            isError: false,
+        });
+        const task = typeof args["task"] === "string" ? args["task"] : "";
+        const answer = typeof args["answer"] === "string" ? args["answer"] : "";
+        if (!task)
+            return err("harness_assess requires a task");
+        if (!answer)
+            return err("harness_assess requires an answer to gate");
+        const confidence = this.config.governance.confidence;
+        const callerThreshold = typeof args["threshold"] === "number" ? args["threshold"] : undefined;
+        // Strictest wins: a caller may tighten org policy, never loosen it.
+        const candidates = [confidence?.threshold, callerThreshold].filter((t) => t !== undefined);
+        if (candidates.length === 0) {
+            return err("harness_assess: no threshold — set governance.confidence.threshold or pass one");
+        }
+        const threshold = Math.max(...candidates);
+        const severity = typeof args["severity"] === "string" ? args["severity"] : confidence?.severity;
+        const verdict = await assess(task, answer, [], { threshold, severity });
+        const routing = confidence?.route_to_role && this.approvals ? confidence : undefined;
+        let ticketInfo;
+        let override;
+        let dismissed;
+        let allowed = verdict.passed;
+        if (!verdict.passed && routing && this.approvals) {
+            const provider = this.approvals.provider;
+            const existing = await latestForCall(provider, task, "harness_assess");
+            if (existing?.state === "approved" && existing.resolution) {
+                // The gate failed, but a named human has overridden it for this task.
+                allowed = true;
+                override = {
+                    reviewer: existing.resolution.reviewer,
+                    reviewedAt: existing.resolution.reviewedAt,
+                    policyRef: existing.resolution.policyRef,
+                    ticketId: existing.request.id,
+                };
+            }
+            else if (existing?.state === "pending_review") {
+                ticketInfo = ticketSummary(existing.request.id, existing.state, existing.request.requiredRole);
+            }
+            else if (existing?.state === "dismissed" && existing.resolution) {
+                dismissed = {
+                    reviewer: existing.resolution.reviewer,
+                    note: existing.resolution.note,
+                    ticketId: existing.request.id,
+                };
+            }
+            else {
+                // None yet, or the last ticket expired → open a fresh one with the
+                // verdict as evidence, generated at gate time.
+                const request = newRequest({
+                    sessionId: this.session.id,
+                    toolName: "harness_assess",
+                    target: task,
+                    task,
+                    requiredRole: routing.route_to_role,
+                    expiresAt: routing.expires_after
+                        ? new Date(Date.now() + parseDuration(routing.expires_after)).toISOString()
+                        : undefined,
+                    evidence: {
+                        policyRef: routing.policy_ref,
+                        detail: verdict.detail,
+                        confidence: verdict,
+                    },
+                });
+                await provider.submit(request);
+                const status = await provider.check(request.id);
+                if (status) {
+                    this.audit.emit(buildApprovalEvent(this.session.id, nextSequence(this.session), "approval_requested", status));
+                }
+                ticketInfo = ticketSummary(request.id, "pending_review", routing.route_to_role);
+            }
+        }
+        this.audit.emit(buildConfidenceEvent(this.session.id, nextSequence(this.session), task, verdict, ticketInfo ? ticketInfo["id"] : undefined));
+        return ok({
+            allowed,
+            verdict,
+            ...(ticketInfo ? { ticket: ticketInfo } : {}),
+            ...(override ? { override } : {}),
+            ...(dismissed ? { dismissed } : {}),
+        });
+    }
     /** Expose session for testing. */
     getSession() {
         return this.session;
     }
+    /** Expose the approval ticket store (for testing and embedding). */
+    getApprovalProvider() {
+        return this.approvals?.provider;
+    }
+}
+function ticketSummary(id, state, requiredRole) {
+    return { id, state, requiredRole };
 }
 /** Serve the harness proxy over stdio until stdin closes. */
 export async function serveProxy(config) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kcp-harness",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "mcpName": "no.cantara/kcp-harness",
   "description": "KCP Compliance Harness — MCP proxy that enforces deterministic knowledge governance for any agent",
   "type": "module",
@@ -25,7 +25,7 @@
   },
   "dependencies": {
     "js-yaml": "^4.1.0",
-    "kcp-agent": "^0.13.0"
+    "kcp-agent": "^0.15.0"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",