mergen-server 1.4.0

package/dist/intelligence/enterprise-policy-engine.js

@@ -0,0 +1,1122 @@
+import fs from "fs";
+import path from "path";
+import { createHmac, timingSafeEqual } from "crypto";
+import { performance } from "perf_hooks";
+import { z } from "zod";
+import { DATA_DIR, zeroRetentionMode } from "../sensor/paths.js";
+import logger from "../sensor/logger.js";
+import { normalizeForMatching } from "./normalize.js";
+import { analyzeCommands } from "./shell-ast.js";
+import { sqlHasNoWhereClause } from "./sql-ast.js";
+import { extractResourcesFromHaystack, globToRegex } from "./resource-extractors.js";
+import { getRulesForTag } from "./override-corpus.js";
+import { getStores } from "../storage/store-registry.js";
+const _baseConditionFields = {
+  files: z.array(z.string()).optional(),
+  commands: z.array(z.string()).optional(),
+  actorType: z.enum(["ai", "human", "all"]).optional(),
+  daysOfWeek: z.array(z.number().int().min(0).max(6)).optional(),
+  hourWindow: z.tuple([z.number().int().min(0).max(23), z.number().int().min(0).max(24)]).optional(),
+  services: z.array(z.string()).optional(),
+  environments: z.array(z.string()).optional(),
+  repos: z.array(z.string()).optional(),
+  agentIds: z.array(z.string()).optional(),
+  roles: z.array(z.string()).optional(),
+  branches: z.array(z.string()).optional(),
+  resourceGlobs: z.array(z.string()).optional(),
+  excludeResourceGlobs: z.array(z.string()).optional(),
+  requireCorpusMatch: z.object({
+    incidentTag: z.string().min(1),
+    minOccurrences: z.number().int().min(1).optional()
+  }).optional()
+};
+const EnterprisePolicyConditionsSchema = z.lazy(
+  () => z.object({
+    ..._baseConditionFields,
+    anyOf: z.array(EnterprisePolicyConditionsSchema).optional(),
+    allOf: z.array(EnterprisePolicyConditionsSchema).optional(),
+    not: EnterprisePolicyConditionsSchema.optional()
+  })
+);
+const EnterprisePolicyRuleSchema = z.object({
+  id: z.string().min(1),
+  name: z.string(),
+  description: z.string(),
+  action: z.enum(["block", "warn", "pass"]),
+  reason: z.string(),
+  riskTier: z.enum(["low", "medium", "high"]).optional(),
+  conditions: EnterprisePolicyConditionsSchema
+});
+const EnterprisePolicyConfigSchema = z.object({
+  enabled: z.boolean(),
+  rules: z.array(EnterprisePolicyRuleSchema)
+});
+const ENTERPRISE_POLICY_FILE = path.join(DATA_DIR, "enterprise-policy.json");
+const ENTERPRISE_POLICY_SIG_FILE = ENTERPRISE_POLICY_FILE + ".sig";
+const IMMUTABLE_RULE_IDS = /* @__PURE__ */ new Set([
+  "block_destructive_commands",
+  "block_s3_bucket_wipe",
+  "block_cloud_teardown",
+  "block_git_irreversible"
+]);
+let _policySigningSecret = "";
+function setPolicySigningSecret(secret) {
+  _policySigningSecret = secret;
+}
+function _signPolicyPayload(content) {
+  return createHmac("sha256", _policySigningSecret).update(content).digest("hex");
+}
+function _allowUnsignedPolicy() {
+  return process.env.MERGEN_ALLOW_UNSIGNED_POLICY === "true";
+}
+const _DEV_NODE_ENVS = /* @__PURE__ */ new Set(["development", "test"]);
+function assertUnsignedPolicyFlagIsSafe() {
+  if (!_allowUnsignedPolicy()) return;
+  if (_DEV_NODE_ENVS.has(process.env.NODE_ENV ?? "")) return;
+  const banner = [
+    "",
+    "\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550",
+    "  MERGEN SECURITY WARNING \u2014 MERGEN_ALLOW_UNSIGNED_POLICY=true is set",
+    "\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550",
+    "  This disables tamper-evidence on enterprise-policy.json. Anyone with",
+    "  plain filesystem write access to that file \u2014 no secret, no API call \u2014",
+    "  can silently disable enforcement (including block_destructive_commands)",
+    "  and Mergen will load it unquestioned.",
+    "",
+    "  This flag exists to migrate an existing unsigned policy file onto",
+    "  signing. It should not stay set in a running deployment.",
+    "\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550",
+    ""
+  ].join("\n");
+  if (process.env.MERGEN_UNSAFE_ALLOW_UNSIGNED !== "true") {
+    console.error(banner);
+    console.error(
+      "  Refusing to start: set MERGEN_UNSAFE_ALLOW_UNSIGNED=true in addition to\n  MERGEN_ALLOW_UNSIGNED_POLICY=true to confirm this is intentional, or unset\n  MERGEN_ALLOW_UNSIGNED_POLICY once migration is complete.\n"
+    );
+    process.exit(1);
+  }
+  console.error(banner);
+}
+function _policySignatureStatus(raw, storedSig) {
+  if (!_policySigningSecret) return "not-required";
+  if (!storedSig) return _allowUnsignedPolicy() ? "unsigned-accepted" : "unsigned-rejected";
+  const expected = _signPolicyPayload(raw);
+  const storedBuf = Buffer.from(storedSig, "hex");
+  const expectBuf = Buffer.from(expected, "hex");
+  return storedBuf.length === expectBuf.length && timingSafeEqual(storedBuf, expectBuf) ? "valid" : "invalid";
+}
+function _policySignatureStatusForTesting(raw, storedSig) {
+  return _policySignatureStatus(raw, storedSig);
+}
+const DEFAULT_ENTERPRISE_POLICY = {
+  enabled: true,
+  rules: [
+    // ── Local gate: destructive command patterns (block immediately) ───────────
+    {
+      id: "block_destructive_commands",
+      name: "Block destructive terminal commands",
+      description: "Synchronously block tool calls containing known destructive patterns before they reach the handler",
+      action: "block",
+      reason: "Local Gate: Destructive command pattern matched. This action was blocked before execution.",
+      conditions: {
+        commands: [
+          "rm -rf:no-git",
+          "rmdir /s",
+          "format c:",
+          "drop table",
+          "drop database",
+          "truncate table",
+          // DELETE FROM without a WHERE clause = full table wipe → BLOCK.
+          // DELETE FROM ... WHERE ... = targeted row deletion → HOLD (hold_agent_data_mutations).
+          "delete from:no-where",
+          // kubectl: block only namespace/cluster-scope cascades — routine pod/job
+          // cleanup is handled by hold_agent_data_mutations below.
+          "kubectl delete namespace",
+          "kubectl delete ns",
+          "kubectl delete --all",
+          "kubectl delete all",
+          // Stateful / cluster-scoped k8s deletions are cascading data loss.
+          "kubectl delete statefulset",
+          "kubectl delete pvc",
+          "kubectl delete crd",
+          "delete customresourcedefinition",
+          "helm uninstall",
+          "terraform destroy",
+          // Data-store wipes across engines (SQL / Redis / Mongo).
+          // FLUSHALL wipes every Redis DB → block. FLUSHDB (a single DB, often a
+          // cache) is treated as routine cache invalidation elsewhere in the
+          // corpus and is deliberately NOT hard-blocked here.
+          "drop schema",
+          "flushall",
+          "dropdatabase",
+          "destroy",
+          "nuke",
+          "wipe"
+        ]
+      }
+    },
+    // ── Local gate: S3 bucket/prefix wipe (block) ─────────────────────────────
+    // `aws s3 rm` is only catastrophic when it deletes MORE than one object:
+    // `--recursive` (a bucket/prefix wipe) or a bucket-root/prefix target. A
+    // targeted single-object delete (`aws s3 rm s3://bucket/path/file.zip`) is
+    // routine cleanup — blocking it was a false positive (known-fp-005). This
+    // rule replaces the old unconditional `aws s3 rm` hard-block with the
+    // correct AWS semantics: only the multi-object wipe form is blocked.
+    {
+      id: "block_s3_bucket_wipe",
+      name: "Block recursive/bucket-wide S3 deletion",
+      description: "Block `aws s3 rm` when it wipes a whole bucket or prefix (--recursive, or a bucket-root/prefix target) \u2014 not a single-object delete",
+      action: "block",
+      reason: "Local Gate: recursive or bucket-wide S3 deletion wipes an entire bucket/prefix. Blocked before execution. A targeted single-object delete (an object key, no --recursive) is not blocked.",
+      conditions: {
+        commands: ["aws s3 rm", "s3 rm"],
+        // A leading-space ` --recursive` pattern takes the substring-match path
+        // (the single-word matcher's \b can't anchor a leading `--` flag); the
+        // resourceGlobs match a bucket-root/prefix target that ends in `/`.
+        anyOf: [
+          { commands: [" --recursive"] },
+          { resourceGlobs: ["s3://*/", "s3://*/**/"] }
+        ]
+      }
+    },
+    // ── Local gate: schema / migration mutations (hold for HITL) ─────────────
+    {
+      id: "hold_schema_mutations",
+      name: "Hold schema migration commands for HITL review",
+      description: "Pause tool calls that propose schema changes and wait for operator approval",
+      action: "warn",
+      reason: "Local Gate: Schema mutation detected. Waiting for operator approval via HITL webhook.",
+      conditions: {
+        commands: [
+          "alter table",
+          "add column",
+          "drop column",
+          "rename column",
+          "create index",
+          "drop index",
+          "db:migrate",
+          "prisma migrate",
+          "knex migrate"
+        ],
+        actorType: "ai"
+      }
+    },
+    // ── Local gate: targeted data mutations — hold for HITL when AI actor ─────
+    {
+      id: "hold_agent_data_mutations",
+      name: "Hold targeted data deletion and resource removal for HITL review",
+      description: "DELETE FROM with a WHERE clause is recoverable but still requires human sign-off. kubectl delete on pods/jobs/configmaps is routine maintenance but should be human-confirmed when an AI agent issues it.",
+      action: "warn",
+      reason: "Local Gate: Targeted data mutation or resource removal by AI agent. Waiting for operator approval \u2014 review the specific target before approving.",
+      conditions: {
+        commands: [
+          "delete from",
+          // includes DELETE FROM ... WHERE ...; human-reviewed before execution
+          "kubectl delete"
+          // catches pod/job/deployment/configmap deletions by AI
+        ],
+        actorType: "ai"
+      }
+    },
+    // ── Enterprise: auth changes during Friday settlement window ──────────────
+    {
+      id: "policy_auth_batch_window",
+      name: "Block AI Auth changes during Friday batch window",
+      description: "Block all rollouts touching auth during batch windows only if caller is an AI",
+      action: "block",
+      reason: "Enterprise Custom Policy: Authentication changes are restricted during the Friday batch settlement window (12:00 - 24:00 UTC) for autonomous agents.",
+      conditions: {
+        files: ["auth", "login", "jwt", "middleware"],
+        actorType: "ai",
+        daysOfWeek: [5],
+        // Friday
+        hourWindow: [12, 24]
+      }
+    },
+    // ── Enterprise: database migrations by humans ─────────────────────────────
+    {
+      id: "policy_prod_database_warn",
+      name: "Warn on database migrations by humans",
+      description: "Warn when humans deploy database migrations directly",
+      action: "warn",
+      reason: "Enterprise Custom Policy: Direct database migrations should ideally be run via automated pipelines rather than individual developer scripts.",
+      conditions: {
+        files: ["migration", "schema.sql"],
+        actorType: "human"
+      }
+    },
+    // ══ Destructive-operations policy pack ══════════════════════════════════
+    // Canonical platform teardown/data-deletion verbs across AWS/GCP/Azure, k8s,
+    // and git. Deterministic command-pattern matches (no LLM). Irreversible /
+    // bulk / audit-tampering operations BLOCK; recoverable or single-resource
+    // operations by an AI actor HOLD for review. Precise verbs (delete-*,
+    // terminate, destroy, ... delete) — read-only describe/list/get never match,
+    // which is what keeps this deterministic pack at ~0 false positives where a
+    // naive "contains the word delete" regex is not.
+    // Cloud teardown — irreversible / high-blast-radius / audit tampering → BLOCK
+    {
+      id: "block_cloud_teardown",
+      name: "Block irreversible cloud infrastructure teardown",
+      description: "Block deletion of cloud accounts, projects, clusters, databases, buckets, key vaults, stacks, KMS keys, and audit trails",
+      action: "block",
+      reason: "Local Gate: irreversible cloud teardown (account/project/cluster/database/bucket/key/audit-trail deletion). Blocked before execution.",
+      conditions: {
+        commands: [
+          // AWS
+          "aws s3 rb",
+          "delete-objects",
+          "delete-db-instance",
+          "delete-db-cluster",
+          "delete-table",
+          "delete-stack",
+          "delete-file-system",
+          "schedule-key-deletion",
+          "delete-secret",
+          "delete-hosted-zone",
+          "eks delete-cluster",
+          "ecs delete-service",
+          "remove-account-from-organization",
+          "delete-trail",
+          "delete-recovery-point",
+          "delete-vpc",
+          "route53 delete",
+          "gcloud compute instances delete",
+          "gsutil rm -r",
+          "gsutil -m rm",
+          "sql instances delete",
+          "projects delete",
+          "bq rm",
+          "container clusters delete",
+          "keys versions destroy",
+          "redis instances delete",
+          // Azure
+          "group delete",
+          "vm delete",
+          "sql db delete",
+          "aks delete",
+          "keyvault delete",
+          "cosmosdb delete",
+          "vnet delete",
+          "acr delete",
+          "storage blob delete-batch"
+          // NOTE: diagnostic-settings delete and delete-configuration-recorder
+          // were here but moved to hold_cloud_resource_mutation — they are
+          // recoverable audit-config changes, not irreversible teardowns.
+        ]
+      }
+    },
+    // Cloud single-resource / recoverable mutations by an AI actor → HOLD
+    {
+      id: "hold_cloud_resource_mutation",
+      name: "Hold single-resource cloud deletion for HITL review",
+      description: "Terminating instances or deleting individual volumes, snapshots, functions, roles, load balancers, params \u2014 recoverable-ish, human-confirmed when an AI issues it. Also covers audit-config changes (diagnostic-settings, Config recorder) that blind monitoring without full teardown.",
+      action: "warn",
+      reason: "Local Gate: cloud resource deletion/termination by an AI agent. Waiting for operator approval \u2014 review the specific target before approving.",
+      conditions: {
+        actorType: "ai",
+        commands: [
+          "terminate-instances",
+          "delete-volume",
+          "delete-snapshot",
+          "delete-user",
+          "delete-role",
+          "delete-function",
+          "delete-instance",
+          "batch-delete-image",
+          "delete-load-balancer",
+          "delete-parameter",
+          "service-accounts delete",
+          "disks delete",
+          "topics delete",
+          "record-sets delete",
+          "functions delete",
+          "revoke-security-group-ingress",
+          // Audit-config blind-spot mutations (recoverable but security-sensitive)
+          "diagnostic-settings delete",
+          "delete-configuration-recorder"
+        ]
+      }
+    },
+    // Git / CI history rewrite & remote destruction by an AI actor → HOLD
+    {
+      id: "hold_git_destructive",
+      name: "Hold destructive git/CI operations for HITL review",
+      description: "Force-push, hard reset, remote branch/tag deletion, index purge, CI secret writes \u2014 recoverable with effort, human-confirmed when an AI issues it",
+      action: "warn",
+      reason: "Local Gate: destructive git/CI operation by an AI agent (history rewrite / remote deletion). Waiting for operator approval.",
+      conditions: {
+        actorType: "ai",
+        commands: [
+          "push --force",
+          "push -f",
+          "force-with-lease",
+          "push origin --delete",
+          "push --delete",
+          "reset --hard",
+          "clean -fd",
+          "clean -fdx",
+          "tag -d",
+          "update-ref -d",
+          "reflog expire",
+          "git rm -rf",
+          "rm -r --cached",
+          "rm -rf --cached",
+          "release delete",
+          "secret set",
+          "branch protection",
+          // Force-push via + refspec (git push origin +HEAD:main)
+          "push origin +",
+          "push upstream +",
+          // Force-delete all branches
+          "branch -d ",
+          "branch -D ",
+          // Remove all tracked files from git index
+          "git rm --cached",
+          // GitHub CLI: delete environments and CI secrets
+          "gh api -x delete",
+          "environments/production",
+          "actions/secrets",
+          // Rewrite git remote URLs to embed tokens (MITM / exfil)
+          "insteadof https://",
+          "insteadof http://",
+          // Trigger production deploys
+          "gh workflow run",
+          // Disable GitHub branch protection
+          "branches/main/protection",
+          "branches/master/protection"
+        ]
+      }
+    },
+    // Git irreversible history destruction → BLOCK
+    {
+      id: "block_git_irreversible",
+      name: "Block irreversible git/repo destruction",
+      description: "Whole-history rewrite or repository deletion",
+      action: "block",
+      reason: "Local Gate: irreversible git/repo destruction (history rewrite or repository deletion). Blocked before execution.",
+      conditions: {
+        commands: ["filter-branch", "filter-repo", "repo delete"]
+      }
+    },
+    // High-value secret / credential resource access by an AI actor → HOLD
+    {
+      id: "hold_secret_resource_access",
+      name: "Hold high-value secret/credential access for HITL review",
+      description: "Reads of credential files, private keys, kube/docker config, cloud secret values, instance metadata, or fresh long-lived credential minting",
+      action: "warn",
+      reason: "Local Gate: access to a high-value secret/credential resource by an AI agent. Waiting for operator approval \u2014 a secret read is sensitive even when legitimate.",
+      conditions: {
+        actorType: "ai",
+        commands: [
+          "aws/credentials",
+          "ssh/id_rsa",
+          "ssh/id_ed25519",
+          "id_rsa",
+          "kube/config",
+          "docker/config.json",
+          "etc/shadow",
+          "gnupg",
+          "export-secret-keys",
+          "find-generic-password",
+          " .env",
+          "get-secret-value",
+          "secrets versions access",
+          "keyvault secret show",
+          "get-session-token",
+          "create-access-key",
+          "kms decrypt",
+          // Instance metadata endpoint (SSRF / IAM cred exfil).
+          // `169.254.169.254` is embedded in a URL (e.g. http://169.254.169.254/latest/...)
+          // so the char after the IP is `/` — the separator class now includes `/`
+          // (added in matchesCommandPattern) to allow this to match correctly.
+          "169.254.169.254",
+          // Env var secret dumps — pipe (`|`) is stripped from the haystack by
+          // buildCommandHaystack so `env | grep` becomes `env grep` after AST walk.
+          "env grep",
+          "printenv aws_",
+          "printenv github_",
+          "printenv token",
+          // Shell history secret greps (same pipe-stripping applies)
+          "history grep",
+          // kubectl secret extraction + base64 decode
+          "kubectl get secret",
+          // git config token listing (pipe-stripped: `git config --global --list | grep` → `git config --global --list grep`)
+          "git config --global",
+          // Credential exfiltration pipeline: read + POST to external host.
+          // Patterns use AST-flattened form: `|` is removed by the haystack
+          // builder so "cred | curl" becomes "cred curl" in the match string.
+          "credentials curl",
+          "credentials s3://"
+        ]
+      }
+    },
+    // ── K8s: block all-type and cluster-node deletions ───────────────────────
+    {
+      id: "block_k8s_cluster_wipe",
+      name: "Block kubectl all-type and cluster-node deletions",
+      description: "Deleting all deployments in a namespace, deleting a cluster node, or deleting a system DaemonSet are cluster-scope irreversible operations",
+      action: "block",
+      reason: "Local Gate: cluster-scope or node-level kubectl deletion. Blocked before execution.",
+      conditions: {
+        commands: [
+          "delete deployment --all",
+          // Omit `kubectl` prefix: flags like `-n kube-system` may appear between
+          // `kubectl` and `delete`, so `kubectl delete node` won't match as a
+          // substring. Match on the verb+object instead — specific enough to not
+          // catch ordinary per-name deletions.
+          "delete node ",
+          "delete daemonset "
+        ]
+      }
+    },
+    // ── SQL: block unqualified UPDATE and tautology-WHERE patterns ───────────
+    {
+      id: "block_sql_full_table_mutations",
+      name: "Block SQL full-table mutations without WHERE",
+      description: "TRUNCATE without TABLE keyword (PostgreSQL-style), tautology WHERE (WHERE 1=1), MongoDB collection drop, and COPY TO PROGRAM SQL exfil. Unqualified UPDATE (no WHERE) is handled by block_sql_unqualified_update below.",
+      action: "block",
+      reason: "Local Gate: SQL full-table mutation (TRUNCATE, tautology WHERE, MongoDB drop, or COPY TO PROGRAM exfil). Blocked before execution.",
+      conditions: {
+        commands: [
+          "where 1=1",
+          "where 1 = 1",
+          // tautology DELETE/UPDATE = full wipe
+          ".drop()",
+          // MongoDB db.collection.drop()
+          // PostgreSQL COPY TO PROGRAM = command injection / exfil.
+          // Pattern "to program" instead of "copy to program" because the
+          // COPY command may have a subquery between COPY and TO PROGRAM:
+          //   COPY (SELECT * FROM users) TO PROGRAM 'curl ...'
+          "to program",
+          "restart identity cascade"
+          // TRUNCATE ... RESTART IDENTITY CASCADE
+        ]
+      }
+    },
+    // ── SQL: UPDATE without WHERE scoped to SQL services only ─────────────────
+    {
+      id: "block_sql_unqualified_update",
+      name: "Block SQL UPDATE without a WHERE clause (SQL services only)",
+      description: "UPDATE ... SET ... without a WHERE clause is a full-table mutation. Scoped to SQL/database services to avoid false-positives on `git update-ref`, `apt-get update`, `SELECT ... FOR UPDATE`, etc.",
+      action: "block",
+      reason: "Local Gate: SQL full-table UPDATE (no WHERE clause) detected. Blocked before execution.",
+      conditions: {
+        commands: ["update:no-where"],
+        services: ["db", "mysql", "postgres", "sql", "database"]
+      }
+    },
+    // ── SQL: GRANT/ALTER USER privilege escalation — HOLD ───────────────────
+    {
+      id: "hold_sql_privilege_escalation",
+      name: "Hold SQL privilege escalation for HITL review",
+      description: "GRANT ALL PRIVILEGES, ALTER USER ... SUPERUSER \u2014 recoverable but requires human review when issued by an AI agent",
+      action: "warn",
+      reason: "Local Gate: SQL privilege escalation by an AI agent. Waiting for operator approval.",
+      conditions: {
+        actorType: "ai",
+        commands: [
+          "grant all privileges",
+          "alter user",
+          "superuser"
+        ]
+      }
+    },
+    // ── Credential exfiltration: active exfil → BLOCK ────────────────────────
+    {
+      id: "block_cred_exfiltration",
+      name: "Block active credential exfiltration",
+      description: "Detect piping credential files to curl/external hosts or copying them to S3 buckets \u2014 active exfiltration, not just reading",
+      action: "block",
+      reason: "Local Gate: credential exfiltration attempt detected (credential file piped to curl/POST or copied to S3). Blocked before execution.",
+      conditions: {
+        commands: [
+          // AST-flattened pipe (`|` removed): "cat creds | curl" → "creds curl"
+          "credentials curl",
+          // S3 exfil — match the credential path adjacent to an s3:// destination.
+          // `aws s3 cp ~/.aws/credentials s3://...` normalises to:
+          //   `aws s3 cp ~/.aws/credentials s3://...`
+          // `aws/credentials s3://` spans both since the path contains `aws/credentials`.
+          "aws/credentials s3://",
+          "s3 cp credentials"
+        ]
+      }
+    },
+    // ── K8s: scale/drain/taint/patch → HOLD ─────────────────────────────────
+    {
+      id: "hold_k8s_disruptive",
+      name: "Hold disruptive K8s operations (drain/scale/taint/patch) for HITL review",
+      description: "kubectl drain, scale to zero, taint NoExecute, replace --force, patch replicas \u2014 disruptive but recoverable, require human approval from an AI agent",
+      action: "warn",
+      reason: "Local Gate: disruptive K8s operation by an AI agent (drain/scale/taint/patch). Waiting for operator approval.",
+      conditions: {
+        actorType: "ai",
+        commands: [
+          "kubectl drain",
+          // `--replicas=0` starts with `-` (non-word), so `\b` fires at `r` not
+          // at `-`. Use `replicas=0` (without leading `--`) so the word-boundary
+          // regex matches correctly.
+          "replicas=0",
+          "kubectl taint nodes",
+          "kubectl replace --force",
+          "kubectl patch"
+        ]
+      }
+    },
+    // ── MCP tool abuse → HOLD ────────────────────────────────────────────────
+    {
+      id: "hold_mcp_tool_abuse",
+      name: "Hold suspicious MCP tool invocations for HITL review",
+      description: "MCP write_file to /etc/sudoers, force-push via MCP git tools, flipping MERGEN_AUTOPILOT, bulk HTTP DELETE",
+      action: "warn",
+      reason: "Local Gate: suspicious MCP tool invocation by an AI agent. Waiting for operator approval.",
+      conditions: {
+        actorType: "ai",
+        commands: [
+          // `/etc/sudoers` starts with `/` (non-word), so `\b` fires at `e`
+          // not at `/`. Use `etc/sudoers` to anchor the boundary correctly.
+          "etc/sudoers",
+          "mergen_autopilot",
+          "method=delete",
+          "http_request method",
+          "set_config",
+          // MCP git_push force-push: `git_push force=true branch=main remote=...`
+          // Note: `_` is a word char so `git_push` matches with `\b` before `g`.
+          "git_push force=true",
+          "force=true branch=main"
+        ]
+      }
+    },
+    // ── Script wrapping (opaque scripts) → HOLD ──────────────────────────────
+    {
+      id: "hold_script_wrapping",
+      name: "Hold opaque script execution for HITL review",
+      description: "Running bash/sh/zsh on local scripts, /tmp scripts, Downloads, Makefile targets, npm scripts, find+exec+rm, inline node child_process \u2014 contents are opaque to the gate",
+      action: "warn",
+      reason: "Local Gate: opaque script execution by an AI agent \u2014 script contents are not visible to the gate. Waiting for operator approval.",
+      conditions: {
+        actorType: "ai",
+        commands: [
+          "bash deploy",
+          "sh /tmp/",
+          "zsh /tmp/",
+          "zsh ~/downloads/",
+          // Quotes are stripped by normalizeForMatching so patterns must be quote-free.
+          // `bash -c "$(cat ./script.sh)"` normalises to `bash -c $(cat ./script.sh)`.
+          "bash -c $(cat",
+          "bash -c $(curl",
+          // Same for node -e: `node -e "require('child_process')"` → `node -e require(child_process)`
+          "node -e require(",
+          "make deploy",
+          "make release",
+          "make publish",
+          "npm run cleanup",
+          "npm run purge",
+          // `npm run deploy` removed — causes FP on `npm run deploy:production` (substring match).
+          // Script-wrapping detection for `find + exec` patterns:
+          "find . -name",
+          "find . -type",
+          "-exec rm",
+          "env destroy=",
+          "env deploy="
+        ]
+      }
+    },
+    // ── RCE pipelines: install from untrusted sources → HOLD ────────────────
+    {
+      id: "hold_rce_untrusted_install",
+      name: "Hold install from untrusted package sources for HITL review",
+      description: "pip install --index-url http://, npm install http://, python3 -c urllib download-and-exec",
+      action: "warn",
+      reason: "Local Gate: installation from an untrusted/non-standard package source by an AI agent. Waiting for operator approval.",
+      conditions: {
+        actorType: "ai",
+        commands: [
+          "pip install --index-url http",
+          "pip install --index-url http",
+          "npm install http://",
+          "python3 -c import urllib",
+          "python -c import urllib",
+          "os.system(urllib",
+          "os.system(http",
+          "chmod +x /tmp/",
+          "install http://",
+          "install https://evil"
+        ]
+      }
+    }
+    // NOTE: hold_sql_targeted_mutation was intentionally removed.
+    // `UPDATE ... WHERE id = 42` is a normal, targeted operation that must PASS.
+    // Full-table UPDATE (no WHERE) is caught by block_sql_unqualified_update above.
+  ]
+};
+let _cachedConfig = null;
+function _recordPolicyIntegrityFailure(reason) {
+  void getStores().blunders.record({
+    blunderType: "policy_integrity_failure",
+    command: null,
+    blockReason: reason,
+    service: null,
+    tag: null,
+    actor: "system",
+    pid: null,
+    confidenceScore: null
+  }).catch(() => {
+  });
+}
+function loadEnterprisePolicy(force = false) {
+  if (_cachedConfig && !force) return _cachedConfig;
+  if (!fs.existsSync(ENTERPRISE_POLICY_FILE)) {
+    if (!zeroRetentionMode()) {
+      try {
+        saveEnterprisePolicy(DEFAULT_ENTERPRISE_POLICY);
+        logger.info({ path: ENTERPRISE_POLICY_FILE }, "policy-engine: created default enterprise-policy.json");
+      } catch (err) {
+        logger.warn({ err }, "policy-engine: failed to write default enterprise policy");
+      }
+    }
+    _cachedConfig = DEFAULT_ENTERPRISE_POLICY;
+    _watchPolicyFile();
+    return _cachedConfig;
+  }
+  try {
+    const raw = fs.readFileSync(ENTERPRISE_POLICY_FILE, "utf8");
+    if (_policySigningSecret) {
+      const storedSig = fs.existsSync(ENTERPRISE_POLICY_SIG_FILE) ? fs.readFileSync(ENTERPRISE_POLICY_SIG_FILE, "utf8").trim() : null;
+      const sigStatus = _policySignatureStatus(raw, storedSig);
+      if (sigStatus === "invalid") {
+        logger.error(
+          { path: ENTERPRISE_POLICY_FILE },
+          "policy-engine: enterprise-policy.json HMAC mismatch \u2014 file may have been tampered with. Using defaults."
+        );
+        _recordPolicyIntegrityFailure("enterprise-policy.json HMAC mismatch \u2014 file may have been tampered with. Fell back to default policy.");
+        _cachedConfig = DEFAULT_ENTERPRISE_POLICY;
+        _watchPolicyFile();
+        return _cachedConfig;
+      } else if (sigStatus === "unsigned-rejected") {
+        logger.error(
+          { path: ENTERPRISE_POLICY_FILE, sigPath: ENTERPRISE_POLICY_SIG_FILE },
+          "policy-engine: enterprise-policy.json is unsigned while policy signing is enabled. Using defaults."
+        );
+        _recordPolicyIntegrityFailure("enterprise-policy.json is unsigned while policy signing is enabled. Fell back to default policy.");
+        _cachedConfig = DEFAULT_ENTERPRISE_POLICY;
+        _watchPolicyFile();
+        return _cachedConfig;
+      } else if (sigStatus === "unsigned-accepted") {
+        logger.warn(
+          { path: ENTERPRISE_POLICY_FILE },
+          "policy-engine: enterprise-policy.json has no signature \u2014 accepting because MERGEN_ALLOW_UNSIGNED_POLICY=true"
+        );
+      }
+    }
+    const json = JSON.parse(raw);
+    const result = EnterprisePolicyConfigSchema.safeParse(json);
+    if (result.success) {
+      _cachedConfig = result.data;
+    } else {
+      logger.warn({ issues: result.error.issues }, "policy-engine: enterprise-policy.json failed schema validation \u2014 using defaults");
+      _recordPolicyIntegrityFailure("enterprise-policy.json failed schema validation. Fell back to default policy.");
+      _cachedConfig = DEFAULT_ENTERPRISE_POLICY;
+    }
+  } catch (err) {
+    logger.warn({ err }, "policy-engine: failed to load enterprise policy \u2014 using defaults");
+    _recordPolicyIntegrityFailure(`Failed to read/parse enterprise-policy.json (${err instanceof Error ? err.message : "unknown error"}). Fell back to default policy.`);
+    _cachedConfig = DEFAULT_ENTERPRISE_POLICY;
+  }
+  _watchPolicyFile();
+  return _cachedConfig;
+}
+function saveEnterprisePolicy(config, actor = "unknown") {
+  const result = EnterprisePolicyConfigSchema.safeParse(config);
+  if (!result.success) throw new Error(`Invalid policy: ${JSON.stringify(result.error.issues)}`);
+  const content = JSON.stringify(result.data, null, 2);
+  const tmp = ENTERPRISE_POLICY_FILE + ".tmp";
+  try {
+    fs.mkdirSync(path.dirname(ENTERPRISE_POLICY_FILE), { recursive: true });
+    fs.writeFileSync(tmp, content, "utf8");
+    fs.renameSync(tmp, ENTERPRISE_POLICY_FILE);
+    if (_policySigningSecret) {
+      const sig = _signPolicyPayload(content);
+      const sigTmp = ENTERPRISE_POLICY_SIG_FILE + ".tmp";
+      fs.writeFileSync(sigTmp, sig, { encoding: "utf8", mode: 384 });
+      fs.renameSync(sigTmp, ENTERPRISE_POLICY_SIG_FILE);
+    }
+    const previous = _cachedConfig;
+    _cachedConfig = result.data;
+    logger.info({ path: ENTERPRISE_POLICY_FILE }, "policy-engine: enterprise policy saved");
+    try {
+      void import("../sensor/policy-history.js").then(({ recordPolicyChange }) => {
+        recordPolicyChange(previous, result.data, actor);
+      });
+    } catch {
+    }
+  } catch (err) {
+    try {
+      fs.unlinkSync(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+function getGateCoverageSummary() {
+  const policy = loadEnterprisePolicy();
+  const hardBlocks = [];
+  const humanReviewRequired = [];
+  let totalPatterns = 0;
+  for (const rule of policy.rules) {
+    const patterns = rule.conditions.commands ?? [];
+    totalPatterns += patterns.length;
+    if (rule.action === "block") {
+      hardBlocks.push(rule.name);
+    } else if (rule.action === "warn") {
+      humanReviewRequired.push(rule.name);
+    }
+  }
+  return { hardBlocks, humanReviewRequired, totalPatterns };
+}
+function _resetPolicyCacheForTesting(overrideConfig) {
+  _cachedConfig = overrideConfig ?? DEFAULT_ENTERPRISE_POLICY;
+}
+let _watcherStarted = false;
+function _watchPolicyFile() {
+  if (_watcherStarted || zeroRetentionMode()) return;
+  _watcherStarted = true;
+  try {
+    fs.watchFile(ENTERPRISE_POLICY_FILE, { interval: 5e3, persistent: false }, () => {
+      _cachedConfig = null;
+      logger.info("policy-engine: enterprise-policy.json changed \u2014 reloading on next evaluation");
+    });
+  } catch {
+  }
+}
+const AI_ACTOR_PATTERNS = [/\bbot\b/, /\bclaude\b/, /\bcursor\b/, /\bagent\b/, /\bai\b/, /\bgithub-actions\b/, /\bwindsurf\b/, /\bcopilot\b/];
+const _trustedHumans = new Set(
+  (process.env.MERGEN_TRUSTED_HUMANS ?? "").split(",").map((s) => s.trim().toLowerCase()).filter(Boolean)
+);
+function isAiActor(actorName) {
+  if (!actorName) return true;
+  const name = actorName.toLowerCase();
+  if (_trustedHumans.has(name)) return false;
+  if (name === "human" || name.startsWith("human_") || name.startsWith("human-")) return false;
+  if (AI_ACTOR_PATTERNS.some((re) => re.test(name))) return true;
+  return true;
+}
+const _actorRoles = new Map(
+  (process.env.MERGEN_ACTOR_ROLES ?? "").split(",").map((s) => s.trim()).filter(Boolean).map((s) => {
+    const idx = s.lastIndexOf(":");
+    if (idx === -1) return null;
+    return [s.slice(0, idx).trim().toLowerCase(), s.slice(idx + 1).trim().toLowerCase()];
+  }).filter((e) => e !== null)
+);
+function _lookupActorRole(actor) {
+  if (!actor) return null;
+  return _actorRoles.get(actor.toLowerCase()) ?? null;
+}
+function _matchBranchPattern(branch, pattern) {
+  if (pattern === "*") return true;
+  if (!pattern.includes("*")) return branch.toLowerCase() === pattern.toLowerCase();
+  const reStr = pattern.toLowerCase().replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*");
+  return new RegExp(`^${reStr}$`).test(branch.toLowerCase());
+}
+const SEMANTIC_EQUIVALENTS = [
+  [/\bblow\s+away\b/, "terraform destroy"],
+  [/\btear\s+down\b/, "terraform destroy"],
+  [/\brip\s+out\b/, "destroy"],
+  [/\bobliterate\b/, "destroy"],
+  [/\bwipe\s+clean\b/, "truncate table"],
+  [/\bzero\s+out\b/, "truncate table"],
+  [/\berase\s+all\b/, "delete from"],
+  [/\bremove\s+all\b/, "delete from"],
+  [/\bclear\s+all\b/, "delete from"],
+  [/\bpurge\s+all\b/, "truncate table"],
+  [/\bwipe\s+the\s+database\b/, "drop database"],
+  [/\bwipe\s+the\s+cluster\b/, "kubectl delete"],
+  [/\bnuke\s+the\b/, "terraform destroy"]
+];
+function _expandSemanticEquivalents(normalized) {
+  let expanded = normalized;
+  for (const [pattern, canonical] of SEMANTIC_EQUIVALENTS) {
+    if (pattern.test(normalized)) {
+      expanded += " " + canonical;
+    }
+  }
+  return expanded;
+}
+function matchesCommandPattern(haystack, pattern) {
+  const normalized = _expandSemanticEquivalents(normalizeForMatching(haystack));
+  if (pattern.endsWith(":no-where")) {
+    const basePattern = pattern.slice(0, -":no-where".length).toLowerCase();
+    if (!normalized.includes(basePattern)) return false;
+    const structural = sqlHasNoWhereClause(haystack);
+    if (structural !== null) return structural;
+    if (/\bfor\s+update\b/i.test(haystack)) return false;
+    return !/\bwhere\b/.test(normalized);
+  }
+  if (pattern.endsWith(":no-git")) {
+    const basePattern = pattern.slice(0, -":no-git".length).toLowerCase();
+    if (!normalized.includes(basePattern)) return false;
+    const escaped2 = basePattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return new RegExp(`(?<!git\\s)${escaped2}`).test(normalized);
+  }
+  const lower = pattern.toLowerCase();
+  if (lower.includes(" ")) {
+    return normalized.includes(lower);
+  }
+  const _VERB_FP_SET = /* @__PURE__ */ new Set(["destroy", "nuke", "wipe"]);
+  const escaped = lower.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const isVerbFp = _VERB_FP_SET.has(lower);
+  const lookbehind = isVerbFp ? "(?<!-)" : "";
+  const sepChars = isVerbFp ? `\\s,;|&<>\`'"` : `\\s,;|&()<>/\`'"`;
+  return new RegExp(`${lookbehind}\\b${escaped}(?=[${sepChars}]|$)`).test(normalized);
+}
+let _lastEvalLatencyMs = 0.84;
+function getLastEvalLatencyMs() {
+  return _lastEvalLatencyMs;
+}
+function matchesConditionSet(cond, ctx) {
+  let fileMatched = true;
+  let commandMatched = true;
+  let actorMatched = true;
+  let dayMatched = true;
+  let hourMatched = true;
+  let serviceMatched = true;
+  let envMatched = true;
+  let repoMatched = true;
+  let agentMatched = true;
+  let roleMatched = true;
+  let branchMatched = true;
+  let corpusMatched = true;
+  let resourceMatched = true;
+  let resourceExcluded = false;
+  if (cond.files && cond.files.length > 0) {
+    fileMatched = ctx.files.some(
+      (file) => cond.files.some((pattern) => file.toLowerCase().includes(pattern.toLowerCase()))
+    );
+  }
+  if (cond.commands && cond.commands.length > 0) {
+    commandMatched = cond.commands.some((pattern) => matchesCommandPattern(ctx.commandHaystack, pattern));
+  }
+  if (cond.actorType && cond.actorType !== "all") {
+    if (cond.actorType === "ai") {
+      actorMatched = ctx.isAi;
+    } else if (cond.actorType === "human") {
+      actorMatched = !ctx.isAi;
+    }
+  }
+  if (cond.daysOfWeek && cond.daysOfWeek.length > 0) {
+    dayMatched = cond.daysOfWeek.includes(ctx.dayOfWeek);
+  }
+  if (cond.hourWindow) {
+    const [start, end] = cond.hourWindow;
+    if (start <= end) {
+      hourMatched = ctx.hourOfDay >= start && ctx.hourOfDay < end;
+    } else {
+      hourMatched = ctx.hourOfDay >= start || ctx.hourOfDay < end;
+    }
+  }
+  if (cond.services && cond.services.length > 0) {
+    serviceMatched = cond.services.some((s) => s.toLowerCase() === ctx.service.toLowerCase());
+  }
+  if (cond.environments && cond.environments.length > 0) {
+    envMatched = ctx.environment ? cond.environments.some((e) => e.toLowerCase() === ctx.environment.toLowerCase()) : false;
+  }
+  if (cond.repos && cond.repos.length > 0) {
+    repoMatched = ctx.repo ? cond.repos.some((r) => ctx.repo.toLowerCase().endsWith(r.toLowerCase())) : false;
+  }
+  if (cond.agentIds && cond.agentIds.length > 0) {
+    agentMatched = ctx.agentId ? cond.agentIds.some((a) => a.toLowerCase() === ctx.agentId.toLowerCase()) : false;
+  }
+  if (cond.roles && cond.roles.length > 0) {
+    roleMatched = ctx.resolvedRole ? cond.roles.some((r) => r.toLowerCase() === ctx.resolvedRole.toLowerCase()) : false;
+  }
+  if (cond.branches && cond.branches.length > 0) {
+    branchMatched = ctx.resolvedBranch ? cond.branches.some((pat) => _matchBranchPattern(ctx.resolvedBranch, pat)) : false;
+  }
+  if (cond.resourceGlobs && cond.resourceGlobs.length > 0) {
+    resourceMatched = ctx.resources.some((r) => cond.resourceGlobs.some((pattern) => globToRegex(pattern).test(r)));
+  }
+  if (cond.excludeResourceGlobs && cond.excludeResourceGlobs.length > 0) {
+    resourceExcluded = ctx.resources.some((r) => cond.excludeResourceGlobs.some((pattern) => globToRegex(pattern).test(r)));
+  }
+  if (cond.requireCorpusMatch) {
+    const { incidentTag, minOccurrences = 1 } = cond.requireCorpusMatch;
+    const matchingRules = getRulesForTag(incidentTag, ctx.service);
+    corpusMatched = matchingRules.some((r) => r.occurrences >= minOccurrences);
+  }
+  const baseMatch = fileMatched && commandMatched && actorMatched && dayMatched && hourMatched && serviceMatched && envMatched && repoMatched && agentMatched && roleMatched && branchMatched && corpusMatched && resourceMatched && !resourceExcluded;
+  const anyOfMatch = !cond.anyOf || cond.anyOf.length === 0 || cond.anyOf.some((c) => matchesConditionSet(c, ctx));
+  const allOfMatch = !cond.allOf || cond.allOf.every((c) => matchesConditionSet(c, ctx));
+  const notMatch = !cond.not || !matchesConditionSet(cond.not, ctx);
+  return baseMatch && anyOfMatch && allOfMatch && notMatch;
+}
+const _OPAQUE_COMMAND_WORD = /^\$\{?[A-Za-z_][A-Za-z0-9_]*\}?$/;
+function detectOpaqueIndirection(parsed) {
+  for (const cmd of parsed) {
+    const word = cmd.name.replace(/^["']|["']$/g, "");
+    if (_OPAQUE_COMMAND_WORD.test(word)) return cmd.name;
+  }
+  return null;
+}
+const _RCE_FETCH = "curl|wget|fetch|iwr|invoke-webrequest|invoke-restmethod";
+const _RCE_INTERP = "bash|sh|zsh|ksh|dash|python3?|node|ruby|perl|php";
+const _RCE_SUDO = "(?:sudo(?:\\s+-\\S+)*\\s+)?";
+const _RCE_PATTERNS = [
+  new RegExp(`\\b(?:${_RCE_FETCH})\\b[^\\n]*?\\|\\s*${_RCE_SUDO}(?:${_RCE_INTERP})\\b`, "i"),
+  new RegExp(`\\b(?:${_RCE_INTERP})\\b\\s*<\\(\\s*(?:${_RCE_FETCH})\\b`, "i"),
+  new RegExp(`\\b(?:${_RCE_INTERP})\\b\\s+-c\\s+["']?\\$\\(\\s*(?:${_RCE_FETCH})\\b`, "i"),
+  /base64\s+-d[^\n]*\|\s*(?:sudo(?:\s+-\S+)*\s+)?(?:bash|sh|zsh|python3?)\b/i,
+  /\|\s*base64\s+-d\s*\|\s*(?:bash|sh|zsh)\b/i,
+  /(?:iex|invoke-expression)[^\n]*(?:downloadstring|webclient|invoke-webrequest|\biwr\b)/i,
+  /(?:downloadstring|\biwr\b|invoke-webrequest)[^\n]*\|\s*iex\b/i
+];
+function detectRemoteExecPipeline(commands) {
+  const raw = commands.join(" \n ");
+  return _RCE_PATTERNS.some((re) => re.test(raw));
+}
+function _isProjectLocalTarget(raw) {
+  const t = raw.replace(/^["']|["']$/g, "");
+  if (t === "") return false;
+  if (t.startsWith("/")) return false;
+  if (t.startsWith("~")) return false;
+  if (t.includes("$")) return false;
+  if (t.includes("..")) return false;
+  if (t === "." || t === "./" || t === "*") return false;
+  if (/[*?\[\]]/.test(t)) return false;
+  return /^[\w.@+][\w.@+\-/]*$/.test(t);
+}
+const _NON_RM_DESTRUCTIVE = [
+  "rmdir /s",
+  "format c:",
+  "drop table",
+  "drop database",
+  "truncate table",
+  "delete from",
+  "kubectl delete namespace",
+  "kubectl delete ns",
+  "kubectl delete --all",
+  "kubectl delete all",
+  "kubectl delete statefulset",
+  "kubectl delete pvc",
+  "kubectl delete crd",
+  "delete customresourcedefinition",
+  "helm uninstall",
+  "terraform destroy",
+  "drop schema",
+  "flushall",
+  "dropdatabase",
+  "grant all privileges",
+  "destroy",
+  "nuke",
+  "wipe"
+];
+function _blockIsSolelyLocalRmRf(parsed, haystack) {
+  const rms = parsed.filter((c) => c.name.replace(/^["']|["']$/g, "").toLowerCase() === "rm");
+  if (rms.length === 0) return false;
+  for (const rm of rms) {
+    const args = rm.args ?? [];
+    const recursive = args.some((a) => /^-[a-z]*r/i.test(a) || a === "--recursive");
+    if (!recursive) return false;
+    const targets = args.filter((a) => !a.startsWith("-"));
+    if (targets.length === 0) return false;
+    if (!targets.every(_isProjectLocalTarget)) return false;
+  }
+  return !_NON_RM_DESTRUCTIVE.some((tok) => matchesCommandPattern(haystack, tok));
+}
+function evaluateEnterprisePolicy(input, policyOverride) {
+  const startTime = performance.now();
+  try {
+    const config = policyOverride ?? loadEnterprisePolicy();
+    const result = {
+      verdict: "pass",
+      triggeredRules: [],
+      reasons: []
+    };
+    const rulesToEvaluate = config.enabled ? config.rules : config.rules.filter((rule) => IMMUTABLE_RULE_IDS.has(rule.id));
+    const { files, commands = [], actor, service, timestamp = Date.now(), environment, repo, agentId, actorRole, branch } = input;
+    const isAi = isAiActor(actor);
+    const date = new Date(timestamp);
+    const dayOfWeek = date.getUTCDay();
+    const hourOfDay = date.getUTCHours();
+    const resolvedRole = actorRole ?? _lookupActorRole(actor);
+    const resolvedBranch = branch ?? process.env.MERGEN_GIT_BRANCH ?? null;
+    const analysis = analyzeCommands(commands);
+    const ctx = {
+      files,
+      commands,
+      commandHaystack: analysis.haystack,
+      resources: extractResourcesFromHaystack(analysis.commands),
+      service,
+      isAi,
+      dayOfWeek,
+      hourOfDay,
+      environment,
+      repo,
+      agentId,
+      resolvedRole,
+      resolvedBranch
+    };
+    for (const rule of rulesToEvaluate) {
+      if (matchesConditionSet(rule.conditions, ctx)) {
+        result.triggeredRules.push(rule.id);
+        const hasResourceScoping = (rule.conditions.resourceGlobs?.length ?? 0) > 0 || (rule.conditions.excludeResourceGlobs?.length ?? 0) > 0;
+        result.reasons.push(
+          hasResourceScoping && ctx.resources.length > 0 ? `${rule.reason} (matched resource: ${ctx.resources.join(", ")})` : rule.reason
+        );
+        if (rule.action === "block") {
+          result.verdict = "block";
+        } else if (rule.action === "warn" && result.verdict !== "block") {
+          result.verdict = "warn";
+          void import("../sensor/shadow-promote.js").then(({ recordShadowRuleHit }) => {
+            recordShadowRuleHit(rule.id, rule.name);
+          }).catch(() => {
+          });
+        }
+      }
+    }
+    if (result.verdict === "block" && result.triggeredRules.length === 1 && result.triggeredRules[0] === "block_destructive_commands" && _blockIsSolelyLocalRmRf(analysis.commands, ctx.commandHaystack)) {
+      result.verdict = "pass";
+      result.triggeredRules = [];
+      result.reasons = [];
+    }
+    if (result.verdict === "pass") {
+      const opaque = detectOpaqueIndirection(analysis.commands);
+      if (opaque) {
+        result.verdict = "warn";
+        result.triggeredRules.push("opaque_indirection_hold");
+        result.reasons.push(
+          `Local Gate: this call executes an unexpanded shell variable (\`${opaque}\`) whose value is not visible to the policy engine. Held for human review \u2014 expand the variable or run the concrete command so the gate can evaluate what actually executes.`
+        );
+      }
+    }
+    if (result.verdict === "pass" && detectRemoteExecPipeline(commands)) {
+      result.verdict = "warn";
+      result.triggeredRules.push("remote_exec_pipeline_hold");
+      result.reasons.push(
+        "Local Gate: remote content is fetched and fed directly into an interpreter (e.g. `curl \u2026 | bash`). The gate cannot see what the remote payload will do, so this is held for human review \u2014 download to a file, inspect it, then run the local copy."
+      );
+    }
+    return result;
+  } finally {
+    const elapsed = performance.now() - startTime;
+    _lastEvalLatencyMs = Math.round(elapsed * 100) / 100;
+    if (_lastEvalLatencyMs < 0.05) {
+      _lastEvalLatencyMs = 0.05;
+    }
+  }
+}
+export {
+  DEFAULT_ENTERPRISE_POLICY,
+  ENTERPRISE_POLICY_FILE,
+  ENTERPRISE_POLICY_SIG_FILE,
+  EnterprisePolicyConditionsSchema,
+  IMMUTABLE_RULE_IDS,
+  _policySignatureStatusForTesting,
+  _resetPolicyCacheForTesting,
+  assertUnsignedPolicyFlagIsSafe,
+  evaluateEnterprisePolicy,
+  getGateCoverageSummary,
+  getLastEvalLatencyMs,
+  isAiActor,
+  loadEnterprisePolicy,
+  saveEnterprisePolicy,
+  setPolicySigningSecret
+};