nexus-agents 8.8.2 → 8.9.1

package/dist/{chunk-MXQG3A5W.js → chunk-FPHFCZ2E.js}

@@ -1,7 +1,7 @@
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-Q5V3KTUL.js";
+} from "./chunk-Q55JVMUD.js";
 import {
   ROLE_DEFAULT_TRUST,
   ReputationCache,
@@ -9,22 +9,223 @@ import {
   TrustTierSchema,
   assessReputation,
   gateWithReputation,
+  resolveEnvMode,
   resolveReputationGatingMode,
   sanitizeInput
-} from "./chunk-N347WXTT.js";
+} from "./chunk-M33EQB7P.js";
 import {
-  emitPolicyEvent
-} from "./chunk-3YKFLM2B.js";
+  MAX_STRIPPED_ELEMENTS_PER_EVENT,
+  createAuditTrail,
+  emitPolicyEvent,
+  emitReputationEvent,
+  emitSanitizationEvent,
+  emitTrustEvent
+} from "./chunk-46YGVSBD.js";
 import {
   hasToken
-} from "./chunk-II5NJRKH.js";
+} from "./chunk-CMQO6WEQ.js";
 import {
   CLI_SUBPROCESS_TIMEOUTS,
   createLogger,
   err,
+  getErrorMessage,
   getTimeProvider,
   ok
-} from "./chunk-ERL3XHQO.js";
+} from "./chunk-AOBIUJX5.js";
+
+// src/security/firewall/firewall-policy-mode.ts
+import { z } from "zod";
+var FirewallPolicyModeSchema = z.enum(["off", "audit", "enforce"]);
+var DEFAULT_FIREWALL_POLICY_MODE = "off";
+var FIREWALL_POLICY_ENV_VAR = "NEXUS_FIREWALL_POLICY";
+function resolveFirewallPolicyMode(env = process.env, logger6) {
+  return resolveEnvMode(
+    env[FIREWALL_POLICY_ENV_VAR],
+    FirewallPolicyModeSchema,
+    DEFAULT_FIREWALL_POLICY_MODE,
+    FIREWALL_POLICY_ENV_VAR,
+    {
+      ...logger6 !== void 0 ? { logger: logger6 } : {},
+      // An explicit-but-invalid value lands on `audit`, NOT on the unset
+      // default `off`. Unset means "the operator has not opted in" and `off` is
+      // right for it; a typo means "the operator opted in and mistyped how",
+      // and answering that with the most permissive mode hands them a firewall
+      // that refuses nothing while they believe it is on. `audit` reports
+      // without refusing, so it cannot break an external caller any more than
+      // `off` can, and it emits the `wouldRefuse` telemetry the rollout is
+      // supposed to be collecting — which `off` does not.
+      invalidFallback: "audit"
+    }
+  );
+}
+
+// src/security/audit-bridge.ts
+var logger = createLogger({ component: "SecurityAuditBridge" });
+function systemActor(id, name) {
+  return name !== void 0 ? { type: "system", id, name } : { type: "system", id };
+}
+function userActor(username) {
+  return { type: "user", id: username };
+}
+function mapTrust(e) {
+  const severity = e.wasDowngraded ? "warning" : "info";
+  return {
+    category: "authorization",
+    severity,
+    outcome: "success",
+    action: "security.trust_classification",
+    actor: userActor(e.username),
+    description: e.reason,
+    metadata: {
+      assignedTier: e.assignedTier,
+      userRole: e.userRole,
+      // Absent when no allowlist was consulted (#4992) — never a default false.
+      ...e.isAllowlisted !== void 0 ? { isAllowlisted: e.isAllowlisted } : {},
+      wasDowngraded: e.wasDowngraded,
+      component: e.component
+    }
+  };
+}
+function pipelinePolicyMetadata(e) {
+  return {
+    ...e.actionType !== void 0 ? { actionType: e.actionType } : {},
+    ...e.mode !== void 0 ? { mode: e.mode } : {},
+    ...e.ruleIds !== void 0 ? { ruleIds: e.ruleIds } : {},
+    ...e.stageType !== void 0 ? { stageType: e.stageType } : {},
+    ...e.recordKind !== void 0 ? { recordKind: e.recordKind } : {},
+    ...e.violationCount !== void 0 ? { violationCount: e.violationCount } : {}
+  };
+}
+function mapPolicyGate(e) {
+  const outcome = e.allowed ? "success" : "denied";
+  return {
+    category: "authorization",
+    severity: e.allowed ? "info" : "warning",
+    outcome,
+    action: "security.policy_gate",
+    actor: systemActor(e.component),
+    policyName: "security.policy_gate",
+    policyDecision: e.allowed ? "allow" : "deny",
+    ...e.violationRules.length > 0 ? { violationType: e.violationRules.join(",") } : {},
+    metadata: {
+      requiresApproval: e.requiresApproval,
+      inputTrustTier: e.inputTrustTier,
+      violationRules: e.violationRules,
+      ...pipelinePolicyMetadata(e)
+    }
+  };
+}
+function mapCorroboration(e) {
+  return {
+    category: "security",
+    severity: e.satisfied ? "info" : "warning",
+    outcome: e.satisfied ? "success" : "denied",
+    action: "security.corroboration",
+    actor: systemActor(e.component),
+    metadata: {
+      actionType: e.actionType,
+      sourceCount: e.sourceCount,
+      missingRequirements: e.missingRequirements
+    }
+  };
+}
+function mapReputation(e) {
+  return {
+    category: "security",
+    severity: e.isSuspicious ? "warning" : "info",
+    outcome: "success",
+    action: "security.reputation",
+    actor: userActor(e.username),
+    metadata: {
+      reputationScore: e.reputationScore,
+      isSuspicious: e.isSuspicious,
+      effectiveTier: e.effectiveTier,
+      signalCount: e.signalCount,
+      component: e.component
+    }
+  };
+}
+function mapSanitization(e) {
+  return {
+    category: "security",
+    severity: e.injectionFlagCount > 0 ? "warning" : "info",
+    outcome: "success",
+    action: "security.sanitization",
+    actor: systemActor(e.component, e.source),
+    metadata: {
+      source: e.source,
+      wasModified: e.wasModified,
+      strippedCount: e.strippedCount,
+      injectionFlagCount: e.injectionFlagCount,
+      strippedElements: e.strippedElements
+    }
+  };
+}
+function mapGraphExecution(e) {
+  return {
+    category: "system",
+    severity: "info",
+    outcome: "success",
+    action: "security.graph_execution",
+    actor: systemActor(e.component),
+    description: e.detail,
+    metadata: {
+      graphEvent: e.graphEvent,
+      ...e.nodeId !== void 0 ? { nodeId: e.nodeId } : {},
+      stepNumber: e.stepNumber
+    }
+  };
+}
+function mapClawGuard(e) {
+  return {
+    category: "authorization",
+    severity: "warning",
+    outcome: "success",
+    action: "security.clawguard_violation",
+    actor: systemActor(e.component),
+    metadata: {
+      toolName: e.toolName,
+      warning: e.warning,
+      policySource: e.policySource,
+      mode: e.mode,
+      requestId: e.requestId
+    }
+  };
+}
+function securityAuditEventToInput(event) {
+  switch (event.type) {
+    case "trust_classification":
+      return mapTrust(event);
+    case "policy_gate":
+      return mapPolicyGate(event);
+    case "corroboration":
+      return mapCorroboration(event);
+    case "reputation":
+      return mapReputation(event);
+    case "sanitization":
+      return mapSanitization(event);
+    case "graph_execution":
+      return mapGraphExecution(event);
+    case "clawguard_violation":
+      return mapClawGuard(event);
+  }
+}
+function createDurableAuditSink(auditLogger) {
+  return (event) => {
+    try {
+      auditLogger.log(securityAuditEventToInput(event));
+    } catch (error) {
+      logger.warn("Failed to mirror security event to durable audit log", {
+        type: event.type,
+        error: getErrorMessage(error)
+      });
+    }
+  };
+}
+function createDurableAuditTrail(auditLogger) {
+  if (auditLogger === void 0) return void 0;
+  return createAuditTrail(createDurableAuditSink(auditLogger));
+}
 
 // src/security/trust-classifier.ts
 function mapAuthorAssociation(association) {
@@ -109,47 +310,180 @@ function getRequiredTrustTier(actionType) {
   }
 }
 
-// src/security/policy-gate.ts
+// src/security/firewall/firewall-types.ts
 import { z as z2 } from "zod";
+var FirewallStagesSchema = z2.object({
+  sanitization: z2.boolean().default(true),
+  trustClassification: z2.boolean().default(true),
+  reputationAssessment: z2.boolean().default(false),
+  policyEnforcement: z2.boolean().default(true),
+  corroboration: z2.boolean().default(false),
+  audit: z2.boolean().default(true)
+});
+var FirewallConfigSchema = z2.object({
+  stages: FirewallStagesSchema.default(() => ({
+    sanitization: true,
+    trustClassification: true,
+    reputationAssessment: false,
+    policyEnforcement: true,
+    corroboration: false,
+    audit: true
+  })),
+  allowlistedMaintainers: z2.array(z2.string().min(1)).default([]),
+  maxInputLength: z2.number().int().positive().default(5e4),
+  context: z2.object({
+    hasWriteAccess: z2.boolean().default(false),
+    hasSecretAccess: z2.boolean().default(false)
+  }).default(() => ({
+    hasWriteAccess: false,
+    hasSecretAccess: false
+  }))
+});
+var ATLDataSchema = z2.object({
+  tier: z2.enum(["1", "2", "3", "4"]),
+  source: z2.string().min(1),
+  user: z2.string().min(1),
+  sanitized: z2.boolean(),
+  rep: z2.number().min(0).max(1).optional()
+});
+
+// src/security/firewall/agent-trust-labels.ts
+var ATL_PREFIX = "[ATL:";
+var ATL_SUFFIX = "]";
+var ATL_PATTERN = /^\[ATL:(.+)\]$/;
+function generateATL(data) {
+  const validated = ATLDataSchema.parse(data);
+  const parts = [
+    `tier=${validated.tier}`,
+    `source=${encodeATLValue(validated.source)}`,
+    `user=${encodeATLValue(validated.user)}`,
+    `sanitized=${String(validated.sanitized)}`
+  ];
+  if (validated.rep !== void 0) {
+    parts.push(`rep=${validated.rep.toFixed(2)}`);
+  }
+  return `${ATL_PREFIX}${parts.join(",")}${ATL_SUFFIX}`;
+}
+function parseATL(atl) {
+  const match = ATL_PATTERN.exec(atl.trim());
+  if (match === null) return void 0;
+  const body = match[1];
+  if (body === void 0) return void 0;
+  const raw = parseKeyValuePairs(body);
+  if (raw === void 0) return void 0;
+  return validateParsedATL(raw);
+}
+function parseKeyValuePairs(body) {
+  const pairs = body.split(",");
+  const raw = {};
+  for (const pair of pairs) {
+    const eqIndex = pair.indexOf("=");
+    if (eqIndex < 1) return void 0;
+    raw[pair.slice(0, eqIndex)] = pair.slice(eqIndex + 1);
+  }
+  return raw;
+}
+function validateParsedATL(raw) {
+  const tier = raw["tier"];
+  const source = raw["source"];
+  const user = raw["user"];
+  const sanitized = raw["sanitized"];
+  if (tier === void 0 || source === void 0 || user === void 0 || sanitized === void 0) {
+    return void 0;
+  }
+  const parsed = {
+    tier,
+    source: decodeATLValue(source),
+    user: decodeATLValue(user),
+    sanitized: sanitized === "true",
+    ...raw["rep"] !== void 0 ? { rep: parseFloat(raw["rep"]) } : {}
+  };
+  const result = ATLDataSchema.safeParse(parsed);
+  return result.success ? result.data : void 0;
+}
+function encodeATLValue(value) {
+  return value.replace(/,/g, "%2C").replace(/=/g, "%3D").replace(/\]/g, "%5D");
+}
+function decodeATLValue(value) {
+  return value.replace(/%2C/g, ",").replace(/%3D/g, "=").replace(/%5D/g, "]");
+}
+
+// src/security/firewall/firewall-passthrough.ts
+function createPassthroughSanitized(meta) {
+  return {
+    content: meta.content,
+    originalLength: meta.content.length,
+    trustTier: "3",
+    userRole: mapAuthorAssociation(meta.authorAssociation),
+    injectionFlags: [],
+    strippedElements: [],
+    wasModified: false,
+    sanitizedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function createPassthroughClassification(meta) {
+  return {
+    trustTier: "3",
+    userRole: mapAuthorAssociation(meta.authorAssociation),
+    isAllowlisted: false,
+    wasDowngraded: false,
+    reason: "Trust classification disabled \u2014 default Tier 3"
+  };
+}
+
+// src/security/firewall/firewall-trust-reason.ts
+function describeGate(reason, demoted, gate) {
+  if (gate === void 0) return reason;
+  if (demoted) {
+    return `${reason}; demoted to Tier ${gate.enforcedTier} by reputation gating (${gate.mode})`;
+  }
+  if (gate.demotionSuppressed) {
+    return `${reason}; would demote to Tier ${gate.reconciledTier} (reputation gating: ${gate.mode})`;
+  }
+  return reason;
+}
+
+// src/security/policy-gate.ts
+import { z as z4 } from "zod";
 
 // src/security/action-schema.ts
-import { z } from "zod";
-var RepoFileSource = z.object({
-  type: z.literal("repoFile"),
-  path: z.string().min(1),
-  line: z.number().int().positive().optional(),
-  commit: z.string().regex(/^[a-f0-9]{7,40}$/).optional()
+import { z as z3 } from "zod";
+var RepoFileSource = z3.object({
+  type: z3.literal("repoFile"),
+  path: z3.string().min(1),
+  line: z3.number().int().positive().optional(),
+  commit: z3.string().regex(/^[a-f0-9]{7,40}$/).optional()
 });
-var IssueCommentSource = z.object({
-  type: z.literal("issueComment"),
-  issueNumber: z.number().int().positive(),
-  commentId: z.number().int().positive(),
-  author: z.string().min(1),
+var IssueCommentSource = z3.object({
+  type: z3.literal("issueComment"),
+  issueNumber: z3.number().int().positive(),
+  commentId: z3.number().int().positive(),
+  author: z3.string().min(1),
   authorTrustTier: TrustTierSchema
 });
-var IssueBodySource = z.object({
-  type: z.literal("issueBody"),
-  issueNumber: z.number().int().positive(),
-  author: z.string().min(1),
+var IssueBodySource = z3.object({
+  type: z3.literal("issueBody"),
+  issueNumber: z3.number().int().positive(),
+  author: z3.string().min(1),
   authorTrustTier: TrustTierSchema
 });
-var CIResultSource = z.object({
-  type: z.literal("ciResult"),
-  runId: z.number().int().positive(),
-  status: z.enum(["pass", "fail"]),
-  job: z.string().min(1)
+var CIResultSource = z3.object({
+  type: z3.literal("ciResult"),
+  runId: z3.number().int().positive(),
+  status: z3.enum(["pass", "fail"]),
+  job: z3.string().min(1)
 });
-var PolicyDocSource = z.object({
-  type: z.literal("policyDoc"),
-  path: z.string().min(1),
-  section: z.string().min(1)
+var PolicyDocSource = z3.object({
+  type: z3.literal("policyDoc"),
+  path: z3.string().min(1),
+  section: z3.string().min(1)
 });
-var MaintainerCommandSource = z.object({
-  type: z.literal("maintainerCommand"),
-  username: z.string().min(1),
-  commentId: z.number().int().positive()
+var MaintainerCommandSource = z3.object({
+  type: z3.literal("maintainerCommand"),
+  username: z3.string().min(1),
+  commentId: z3.number().int().positive()
 });
-var SourceCitationSchema = z.discriminatedUnion("type", [
+var SourceCitationSchema = z3.discriminatedUnion("type", [
   IssueBodySource,
   RepoFileSource,
   IssueCommentSource,
@@ -157,66 +491,66 @@ var SourceCitationSchema = z.discriminatedUnion("type", [
   PolicyDocSource,
   MaintainerCommandSource
 ]);
-var SummarizeIssueAction = z.object({
-  type: z.literal("SummarizeIssue"),
-  summary: z.string().min(10).max(2e3),
-  sources: z.array(SourceCitationSchema).min(1).max(20)
+var SummarizeIssueAction = z3.object({
+  type: z3.literal("SummarizeIssue"),
+  summary: z3.string().min(10).max(2e3),
+  sources: z3.array(SourceCitationSchema).min(1).max(20)
 });
-var ProposeLabelsAction = z.object({
-  type: z.literal("ProposeLabels"),
-  labels: z.array(z.string()).min(1).max(5),
-  reason: z.string().min(10).max(500),
-  sources: z.array(SourceCitationSchema).min(1).max(20)
+var ProposeLabelsAction = z3.object({
+  type: z3.literal("ProposeLabels"),
+  labels: z3.array(z3.string()).min(1).max(5),
+  reason: z3.string().min(10).max(500),
+  sources: z3.array(SourceCitationSchema).min(1).max(20)
 });
-var DraftReplyAction = z.object({
-  type: z.literal("DraftReply"),
-  body: z.string().min(10).max(2e3),
-  requiresApproval: z.literal(true),
-  sources: z.array(SourceCitationSchema).min(1).max(20)
+var DraftReplyAction = z3.object({
+  type: z3.literal("DraftReply"),
+  body: z3.string().min(10).max(2e3),
+  requiresApproval: z3.literal(true),
+  sources: z3.array(SourceCitationSchema).min(1).max(20)
 });
-var RequestHumanApprovalAction = z.object({
-  type: z.literal("RequestHumanApproval"),
-  reason: z.string().min(10).max(500),
-  context: z.string().min(10).max(2e3)
+var RequestHumanApprovalAction = z3.object({
+  type: z3.literal("RequestHumanApproval"),
+  reason: z3.string().min(10).max(500),
+  context: z3.string().min(10).max(2e3)
 });
-var GeneratePatchPlanAction = z.object({
-  type: z.literal("GeneratePatchPlan"),
-  files: z.array(
-    z.object({
-      path: z.string().min(1),
-      operation: z.enum(["modify", "create", "delete"]),
-      description: z.string().min(10).max(500)
+var GeneratePatchPlanAction = z3.object({
+  type: z3.literal("GeneratePatchPlan"),
+  files: z3.array(
+    z3.object({
+      path: z3.string().min(1),
+      operation: z3.enum(["modify", "create", "delete"]),
+      description: z3.string().min(10).max(500)
     })
   ).min(1).max(10),
-  rationale: z.string().min(10).max(1e3),
-  requiresApproval: z.literal(true),
-  sources: z.array(SourceCitationSchema).min(2).max(20)
+  rationale: z3.string().min(10).max(1e3),
+  requiresApproval: z3.literal(true),
+  sources: z3.array(SourceCitationSchema).min(2).max(20)
 });
-var ClassifyIssueAction = z.object({
-  type: z.literal("ClassifyIssue"),
-  category: z.enum(["bug", "feature", "question", "documentation", "security", "performance"]),
-  confidence: z.number().min(0).max(1),
-  sources: z.array(SourceCitationSchema).min(1).max(20)
+var ClassifyIssueAction = z3.object({
+  type: z3.literal("ClassifyIssue"),
+  category: z3.enum(["bug", "feature", "question", "documentation", "security", "performance"]),
+  confidence: z3.number().min(0).max(1),
+  sources: z3.array(SourceCitationSchema).min(1).max(20)
 });
-var IdentifyDuplicatesAction = z.object({
-  type: z.literal("IdentifyDuplicates"),
-  candidates: z.array(z.number().int().positive()).min(1).max(10),
-  similarity: z.array(z.number().min(0).max(1)),
-  sources: z.array(SourceCitationSchema).min(1).max(20)
+var IdentifyDuplicatesAction = z3.object({
+  type: z3.literal("IdentifyDuplicates"),
+  candidates: z3.array(z3.number().int().positive()).min(1).max(10),
+  similarity: z3.array(z3.number().min(0).max(1)),
+  sources: z3.array(SourceCitationSchema).min(1).max(20)
 });
-var RefuseActionAction = z.object({
-  type: z.literal("RefuseAction"),
-  reason: z.string().min(10).max(500),
-  escalateTo: z.enum(["maintainer", "security"])
+var RefuseActionAction = z3.object({
+  type: z3.literal("RefuseAction"),
+  reason: z3.string().min(10).max(500),
+  escalateTo: z3.enum(["maintainer", "security"])
 });
-var HandoffMessageAction = z.object({
-  type: z.literal("HandoffMessage"),
-  targetCapability: z.string().min(1).max(100),
-  reason: z.string().min(5).max(500),
-  inputTrustTier: z.enum(["1", "2", "3", "4"]),
-  sources: z.array(SourceCitationSchema).min(1).max(20)
+var HandoffMessageAction = z3.object({
+  type: z3.literal("HandoffMessage"),
+  targetCapability: z3.string().min(1).max(100),
+  reason: z3.string().min(5).max(500),
+  inputTrustTier: z3.enum(["1", "2", "3", "4"]),
+  sources: z3.array(SourceCitationSchema).min(1).max(20)
 });
-var AgentActionSchema = z.discriminatedUnion("type", [
+var AgentActionSchema = z3.discriminatedUnion("type", [
   SummarizeIssueAction,
   ProposeLabelsAction,
   DraftReplyAction,
@@ -275,13 +609,13 @@ function requiresCitation(actionType) {
 }
 
 // src/security/policy-gate.ts
-var ViolationSchema = z2.object({
+var ViolationSchema = z4.object({
   /** Machine-readable rule identifier. */
-  rule: z2.string().min(1),
+  rule: z4.string().min(1),
   /** Human-readable description of the violation. */
-  message: z2.string().min(1),
+  message: z4.string().min(1),
   /** Severity: 'block' prevents execution, 'warn' logs only. */
-  severity: z2.enum(["block", "warn"])
+  severity: z4.enum(["block", "warn"])
 });
 function getActionSources(action) {
   if ("sources" in action) {
@@ -554,6 +888,468 @@ function getCorroborationRules(actionType) {
   return ACTION_CORROBORATION_RULES[actionType];
 }
 
+// src/security/firewall/firewall-pipeline.ts
+var logger2 = createLogger({ component: "HostileInputFirewall" });
+var HostileInputFirewall = class {
+  stages;
+  /**
+   * Construction-time allowlist, or `undefined` when none was supplied (#4992).
+   * The Zod default of `[]` is deliberately NOT taken here: an absent list and
+   * an empty list must stay distinguishable so `isAllowlisted` can be omitted
+   * rather than recorded as `false` when nothing was consulted.
+   */
+  allowlisted;
+  maxInputLength;
+  adapter;
+  reputationCache;
+  auditTrail;
+  context;
+  /** #5382 rollout gate; resolved once at construction, not per call. */
+  policyMode;
+  /** #5381 reputation-demotion gate; a DIFFERENT knob from `policyMode`. */
+  reputationGatingMode;
+  /** #5405 seam: how a reputation assessment is obtained. */
+  assessReputationFn;
+  /** #4992: whether the sanitizer's content tier downgrades the classifier tier. */
+  contentDowngrade;
+  /** #4992 review: whether a durable logger was configured (not per-call delivery). */
+  auditSink;
+  constructor(config) {
+    const validated = FirewallConfigSchema.parse({
+      stages: config.stages,
+      allowlistedMaintainers: config.allowlistedMaintainers,
+      maxInputLength: config.maxInputLength,
+      context: config.context
+    });
+    this.stages = validated.stages;
+    this.allowlisted = config.allowlistedMaintainers !== void 0 ? validated.allowlistedMaintainers : void 0;
+    this.maxInputLength = validated.maxInputLength;
+    this.adapter = config.adapter;
+    this.reputationCache = new ReputationCache();
+    this.auditTrail = createAuditTrail(
+      config.auditLogger !== void 0 ? createDurableAuditSink(config.auditLogger) : void 0
+    );
+    this.auditSink = config.auditLogger !== void 0 ? "configured" : "none";
+    this.context = validated.context;
+    this.policyMode = config.policyMode ?? resolveFirewallPolicyMode(config.env ?? process.env);
+    this.reputationGatingMode = config.reputationGatingMode ?? resolveReputationGatingMode(config.env ?? process.env);
+    this.assessReputationFn = config.reputationAssessor ?? ((metadata) => assessReputation(metadata, this.reputationCache));
+    this.contentDowngrade = config.contentDowngrade ?? true;
+  }
+  /**
+   * Processes untrusted input through the firewall pipeline.
+   * Returns a structured FirewallResult or a typed FirewallError.
+   *
+   * `options` carries the per-call facts (#4992): the repository's maintainer
+   * allowlist and the caller's access posture. Each replaces its
+   * construction-time counterpart for this call only, so one shared instance
+   * never holds a repository's allowlist or a caller's posture process-wide.
+   */
+  process(input, options) {
+    const start = Date.now();
+    this.auditTrail.clear();
+    const allowlist = options?.allowlistedMaintainers ?? this.allowlisted;
+    const context = options?.context ?? this.context;
+    const metaResult = this.runExtraction(input);
+    if (!metaResult.ok) return metaResult;
+    const meta = metaResult.value;
+    const sanitized = this.runSanitization(meta, allowlist);
+    const trust = this.runClassification(meta, sanitized, allowlist);
+    const reputation = this.runReputation(meta, sanitized, options?.reputation);
+    const { tier: effectiveTrustTier, gate: reputationGate } = this.runReputationGate(
+      trust.trustTier,
+      reputation,
+      options?.reputation !== void 0
+    );
+    this.recordTrustDecision(meta, trust, effectiveTrustTier, reputationGate, allowlist);
+    const atl = this.buildATL(meta, effectiveTrustTier, sanitized, reputation);
+    const ruleOfTwoViolation = this.runPolicyEnforcement(meta, effectiveTrustTier, context);
+    const refusal = this.refuseIfEnforcing(ruleOfTwoViolation, meta, effectiveTrustTier);
+    if (refusal !== void 0) return err(refusal);
+    return ok(
+      this.assembleResult({
+        sanitized,
+        trust,
+        // Measured or absent: present only when an allowlist was consulted.
+        isAllowlisted: allowlist !== void 0 ? trust.isAllowlisted : void 0,
+        reputation,
+        effectiveTrustTier,
+        reputationGate,
+        atl,
+        ruleOfTwoViolation,
+        start
+      })
+    );
+  }
+  /**
+   * Evaluates the Rule of Two against the call's access posture and surfaces
+   * the violation (previously the `policyEnforcement` stage was declared but
+   * never read — #3198). Returns `undefined` when the stage is disabled or the
+   * rule holds.
+   */
+  runPolicyEnforcement(meta, effectiveTrustTier, context) {
+    if (!this.stages.policyEnforcement) return void 0;
+    const violation = checkRuleOfTwo({
+      inputTrustTier: effectiveTrustTier,
+      hasWriteAccess: context.hasWriteAccess,
+      hasSecretAccess: context.hasSecretAccess
+    });
+    if (violation !== void 0) {
+      logger2.warn("Firewall surfaced a Rule-of-Two violation", {
+        user: meta.username,
+        effectiveTrustTier,
+        rule: violation.rule
+      });
+    }
+    return violation;
+  }
+  /**
+   * Builds the successful result. Optional fields are spread in only when they
+   * were evaluated, so absence keeps meaning "not measured" (see the field
+   * docs on {@link FirewallResult}).
+   */
+  assembleResult(parts) {
+    const { isAllowlisted, reputation, reputationGate, ruleOfTwoViolation } = parts;
+    const blocking = ruleOfTwoViolation?.severity === "block";
+    return {
+      sanitized: parts.sanitized,
+      trust: parts.trust,
+      ...isAllowlisted !== void 0 ? { isAllowlisted } : {},
+      ...reputation !== void 0 ? { reputation } : {},
+      effectiveTrustTier: parts.effectiveTrustTier,
+      ...reputationGate !== void 0 ? { reputationGate } : {},
+      atl: parts.atl,
+      ...ruleOfTwoViolation !== void 0 ? { ruleOfTwoViolation } : {},
+      policyMode: this.policyMode,
+      // Reached only when we did NOT refuse, so this is "audit mode saw
+      // something enforce would have stopped". Under `off` it stays false: the
+      // signal is already on `ruleOfTwoViolation`, and reporting a would-be
+      // refusal for a mode that has not opted in would overstate the gate.
+      wouldRefuse: blocking && this.policyMode === "audit",
+      auditEvents: this.auditTrail.query().map((e) => ({ id: e.id, type: e.type })),
+      auditSink: this.auditSink,
+      durationMs: Date.now() - parts.start
+    };
+  }
+  /**
+   * The fail-closed half of the #5382 gate: under `enforce`, a blocking policy
+   * violation refuses the input instead of riding along as a signal on an
+   * `ok()` result that a caller checking only `result.ok` walks straight past.
+   *
+   * This gates the RESPONSE to a violation, never its detection. It cannot
+   * manufacture a refusal where the `policyEnforcement` stage never ran, and it
+   * cannot refuse a non-blocking (`warn`) violation — so `enforce` is not a
+   * kill switch, and an allowlisted maintainer stays served.
+   *
+   * @returns the refusal, or `undefined` when the input passes or the mode has
+   *          not opted in.
+   */
+  refuseIfEnforcing(violation, meta, effectiveTrustTier) {
+    if (violation?.severity !== "block" || this.policyMode !== "enforce") return void 0;
+    logger2.warn("Firewall REFUSED input under enforce mode", {
+      user: meta.username,
+      effectiveTrustTier,
+      rule: violation.rule
+    });
+    return {
+      code: "POLICY_REFUSED",
+      message: `Refused by firewall policy: ${violation.rule} \u2014 ${violation.message}`,
+      stage: "policy"
+    };
+  }
+  /**
+   * Validates corroboration for a decided action (#5382).
+   *
+   * Separate from {@link process} because the two operate at different points
+   * in the lifecycle, which is the real shape of the divergence epic #5281
+   * found: `process()` is INPUT-shaped — it sanitizes, classifies and labels
+   * untrusted content — while corroboration is ACTION-shaped, asking whether a
+   * decision the consumer has now reached is backed by sources of sufficient
+   * tier. There is no `AgentAction` in scope during `process()`, so the
+   * `stages.corroboration` flag could never have been wired there; this is the
+   * entry point that makes it readable.
+   *
+   * It is also the shape #5383 needs: production validates corroboration per
+   * action (`issue-triage.ts:391`), so those callers cannot migrate onto the
+   * firewall unless it offers a per-action surface.
+   *
+   * Returns `evaluated: false` when the stage is disabled — never a satisfied
+   * verdict for a check that did not run. Under `enforce` an unsatisfied action
+   * is refused with `POLICY_REFUSED`; under `audit` the would-be refusal is
+   * reported via `wouldRefuse` and the action is allowed through.
+   */
+  validateAction(action) {
+    if (!this.stages.corroboration) {
+      return ok({
+        evaluated: false,
+        reason: "corroboration-stage-disabled",
+        policyMode: this.policyMode
+      });
+    }
+    const corroboration = validateCorroboration(action);
+    if (!corroboration.satisfied && this.policyMode === "enforce") {
+      logger2.warn("Firewall REFUSED an uncorroborated action under enforce mode", {
+        actionType: corroboration.actionType,
+        missing: corroboration.missing
+      });
+      return err({
+        code: "POLICY_REFUSED",
+        message: `Refused by firewall policy: ${corroboration.actionType} lacks required corroboration \u2014 ${corroboration.missing.join("; ")}`,
+        stage: "corroboration"
+      });
+    }
+    return ok({
+      evaluated: true,
+      satisfied: corroboration.satisfied,
+      missing: corroboration.missing,
+      corroboratingSources: corroboration.corroboratingSources,
+      policyMode: this.policyMode,
+      wouldRefuse: !corroboration.satisfied && this.policyMode === "audit"
+    });
+  }
+  /** Returns the internal audit trail for inspection. */
+  getAuditTrail() {
+    return this.auditTrail;
+  }
+  // ==========================================================================
+  // Pipeline Stages (private)
+  // ==========================================================================
+  runExtraction(input) {
+    try {
+      const meta = this.adapter.extractMetadata(input);
+      return ok(meta);
+    } catch (cause) {
+      const message = cause instanceof Error ? cause.message : String(cause);
+      return err({
+        code: "EXTRACTION_FAILED",
+        message: `Adapter extraction failed: ${message}`,
+        stage: "extraction"
+      });
+    }
+  }
+  runSanitization(meta, allowlist) {
+    if (!this.stages.sanitization) {
+      return createPassthroughSanitized(meta);
+    }
+    const result = sanitizeInput(
+      meta.content,
+      mapAuthorAssociation(meta.authorAssociation),
+      meta.username,
+      {
+        allowlistedMaintainers: [...allowlist ?? []],
+        maxInputLength: this.maxInputLength
+      }
+    );
+    if (this.stages.audit) {
+      emitSanitizationEvent(this.auditTrail, {
+        source: meta.sourceType,
+        wasModified: result.wasModified,
+        strippedCount: result.strippedElements.length,
+        injectionFlagCount: result.injectionFlags.length,
+        strippedElements: result.strippedElements.slice(0, MAX_STRIPPED_ELEMENTS_PER_EVENT).map((e) => ({ tag: e.tag, reason: e.reason }))
+      });
+    }
+    return result;
+  }
+  runClassification(meta, sanitized, allowlist) {
+    if (!this.stages.trustClassification) {
+      return createPassthroughClassification(meta);
+    }
+    return classifyTrust({
+      username: meta.username,
+      authorAssociation: meta.authorAssociation,
+      // #4992: `contentDowngrade: false` withholds the sanitizer's content tier
+      // from the classifier; the flags themselves were still measured above.
+      ...this.contentDowngrade ? { sanitizedInput: sanitized } : {},
+      config: {
+        allowlistedMaintainers: [...allowlist ?? []]
+      }
+    });
+  }
+  /**
+   * Emits the trust audit event for the tier the consumer acts on — after the
+   * reputation gate, so the record cannot describe a tier nobody enforced
+   * (#4992 review). A demotion is named in `reason`.
+   */
+  recordTrustDecision(meta, trust, effectiveTrustTier, gate, allowlist) {
+    if (!this.stages.audit) return;
+    const demoted = effectiveTrustTier !== trust.trustTier;
+    emitTrustEvent(this.auditTrail, {
+      username: meta.username,
+      assignedTier: effectiveTrustTier,
+      userRole: trust.userRole,
+      // Recorded only when an allowlist was consulted (#4992).
+      ...allowlist !== void 0 ? { isAllowlisted: trust.isAllowlisted } : {},
+      wasDowngraded: trust.wasDowngraded || demoted,
+      reason: describeGate(trust.reason, demoted, gate)
+    });
+  }
+  /**
+   * Reconcile the classifier tier with reputation, under the rollout mode
+   * production honours (#3106 reconciliation, #5381 gating).
+   *
+   * #3106's reconciliation is demotion-only; Tier-1/allowlist wins; it equals
+   * the classifier tier when reputation is absent. #5381 puts it behind
+   * `NEXUS_REPUTATION_GATING`, so `audit` is audit-only here too — previously
+   * the firewall enforced unconditionally while production suppressed, on
+   * identical configuration.
+   *
+   * Returns no gate at all when the stage is off, so absence in the result
+   * means "not evaluated" rather than "evaluated, nothing suppressed" —
+   * `demotionSuppressed` is a required boolean and would otherwise report
+   * `false` for a check that never ran.
+   */
+  runReputationGate(classifierTier, reputation, callerSupplied) {
+    if (!this.stages.reputationAssessment && !callerSupplied) return { tier: classifierTier };
+    const gate = gateWithReputation(classifierTier, reputation, this.reputationGatingMode);
+    return { tier: gate.enforcedTier, gate };
+  }
+  runReputation(meta, sanitized, supplied) {
+    if (supplied !== void 0) {
+      if (supplied.assessment !== void 0 && this.stages.audit) {
+        emitReputationEvent(this.auditTrail, {
+          username: meta.username,
+          reputationScore: supplied.assessment.reputationScore,
+          isSuspicious: supplied.assessment.isSuspicious,
+          effectiveTier: supplied.assessment.effectiveTrustTier,
+          signalCount: supplied.assessment.suspiciousSignals.length
+        });
+      }
+      return supplied.assessment;
+    }
+    if (!this.stages.reputationAssessment) return void 0;
+    const metadata = {
+      username: meta.username,
+      authorAssociation: meta.authorAssociation.toUpperCase(),
+      injectionFlags: sanitized.injectionFlags
+    };
+    const result = this.assessReputationFn(metadata);
+    if (this.stages.audit) {
+      emitReputationEvent(this.auditTrail, {
+        username: meta.username,
+        reputationScore: result.reputationScore,
+        isSuspicious: result.isSuspicious,
+        effectiveTier: result.effectiveTrustTier,
+        signalCount: result.suspiciousSignals.length
+      });
+    }
+    return result;
+  }
+  buildATL(meta, effectiveTrustTier, sanitized, reputation) {
+    const data = {
+      tier: effectiveTrustTier,
+      source: meta.sourceType,
+      user: meta.username,
+      sanitized: sanitized.wasModified,
+      ...reputation !== void 0 ? { rep: reputation.reputationScore / 100 } : {}
+    };
+    return generateATL(data);
+  }
+};
+
+// src/security/firewall/github-adapter.ts
+import { z as z5 } from "zod";
+var GitHubIssueSchema = z5.object({
+  type: z5.literal("issue"),
+  username: z5.string().min(1),
+  authorAssociation: z5.string().min(1),
+  title: z5.string().default(""),
+  body: z5.string().default("")
+});
+var GitHubCommentSchema = z5.object({
+  type: z5.literal("comment"),
+  username: z5.string().min(1),
+  authorAssociation: z5.string().min(1),
+  body: z5.string().default("")
+});
+var GitHubPRSchema = z5.object({
+  type: z5.literal("pull_request"),
+  username: z5.string().min(1),
+  authorAssociation: z5.string().min(1),
+  title: z5.string().default(""),
+  body: z5.string().default("")
+});
+var GitHubInputSchema = z5.discriminatedUnion("type", [
+  GitHubIssueSchema,
+  GitHubCommentSchema,
+  GitHubPRSchema
+]);
+function toSourceType(type) {
+  const mapping = {
+    issue: "github-issue",
+    comment: "github-comment",
+    pull_request: "github-pr"
+  };
+  return mapping[type];
+}
+function extractContent(input) {
+  if (input.type === "comment") return input.body;
+  const title = input.title;
+  const body = input.body;
+  return title && body ? `${title}
+
+${body}` : title || body;
+}
+function createGitHubAdapter() {
+  return {
+    platform: "github",
+    extractMetadata(input) {
+      const result = GitHubInputSchema.safeParse(input);
+      if (!result.success) {
+        const issues = result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
+        throw new Error(`GitHub input validation failed: ${issues}`);
+      }
+      const parsed = result.data;
+      const role = mapAuthorAssociation(parsed.authorAssociation);
+      return {
+        username: parsed.username,
+        authorAssociation: role,
+        content: extractContent(parsed),
+        sourceType: toSourceType(parsed.type)
+      };
+    }
+  };
+}
+
+// src/dogfooding/untrusted-input-firewall.ts
+var logger3 = createLogger({ component: "UntrustedInputFirewall" });
+var singleton;
+var configuredAuditLogger;
+function configureUntrustedInputFirewall(deps) {
+  configuredAuditLogger = deps.auditLogger;
+  singleton = void 0;
+}
+function getUntrustedInputFirewall() {
+  singleton ??= new HostileInputFirewall({
+    adapter: createGitHubAdapter(),
+    contentDowngrade: false,
+    ...configuredAuditLogger !== void 0 ? { auditLogger: configuredAuditLogger } : {}
+  });
+  return singleton;
+}
+function runUntrustedInputFirewall(input, options) {
+  const result = getUntrustedInputFirewall().process(input, options);
+  if (!result.ok) {
+    const { code, stage, message } = result.error;
+    logger3.warn("Untrusted-input firewall rejected the input", {
+      user: input.username,
+      sourceType: input.type,
+      code,
+      stage
+    });
+    return err(new Error(`Untrusted-input firewall ${code} at stage ${stage}: ${message}`));
+  }
+  if (result.value.wouldRefuse) {
+    logger3.warn("Untrusted-input firewall would refuse under enforce (audit mode)", {
+      user: input.username,
+      sourceType: input.type,
+      trustTier: result.value.effectiveTrustTier,
+      rule: result.value.ruleOfTwoViolation?.rule
+    });
+  }
+  return ok(result.value);
+}
+
 // src/scm/url-parsers.ts
 function parsePRUrl(url) {
   const httpPattern = /github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)/;
@@ -595,7 +1391,7 @@ function parseIssueUrl(url) {
 }
 
 // src/scm/github-provider-traits.ts
-var logger = createLogger({ component: "GitHubProviderTraits" });
+var logger4 = createLogger({ component: "GitHubProviderTraits" });
 var cachedGhToken = null;
 var ghTokenPromise;
 async function resolveGhToken() {
@@ -672,7 +1468,7 @@ var GitHubReviewer = class {
   provider;
   async getPullRequestDetail(prNumber) {
     const repo = this.provider.repo;
-    logger.debug("Getting PR detail", { repo, prNumber });
+    logger4.debug("Getting PR detail", { repo, prNumber });
     const prResult = await execGhApi(`repos/${repo}/pulls/${String(prNumber)}`);
     if (!prResult.ok) return prResult;
     const filesResult = await execGhApi(`repos/${repo}/pulls/${String(prNumber)}/files`);
@@ -707,7 +1503,7 @@ var GitHubReviewer = class {
       request_changes: "REQUEST_CHANGES",
       comment: "COMMENT"
     };
-    logger.info("Creating review", { repo, prNumber, decision });
+    logger4.info("Creating review", { repo, prNumber, decision });
     const { execFile } = await import("node:child_process");
     const { promisify } = await import("node:util");
     const exec = promisify(execFile);
@@ -734,7 +1530,7 @@ var GitHubReviewer = class {
   }
   async getIssueDetail(issueNumber) {
     const repo = this.provider.repo;
-    logger.debug("Getting issue detail", { repo, issueNumber });
+    logger4.debug("Getting issue detail", { repo, issueNumber });
     const result = await execGhApi(`repos/${repo}/issues/${String(issueNumber)}`);
     if (!result.ok) return result;
     try {
@@ -756,7 +1552,7 @@ var GitHubReviewer = class {
   }
   async listCommentDetails(issueNumber) {
     const repo = this.provider.repo;
-    logger.debug("Listing comment details", { repo, issueNumber });
+    logger4.debug("Listing comment details", { repo, issueNumber });
     const result = await execGhApi(`repos/${repo}/issues/${String(issueNumber)}/comments`);
     if (!result.ok) return result;
     try {
@@ -777,7 +1573,7 @@ var GitHubReviewer = class {
 };
 var GitHubUserInfo = class {
   async fetchUserMetadata(username) {
-    logger.debug("Fetching user metadata", { username });
+    logger4.debug("Fetching user metadata", { username });
     const result = await execGhApi(`users/${username}`);
     if (!result.ok) return result;
     try {
@@ -810,17 +1606,17 @@ function createFullGitHubProvider(repo) {
 }
 
 // src/dogfooding/issue-triage-types.ts
-import { z as z3 } from "zod";
+import { z as z6 } from "zod";
 var DEFAULT_ISSUE_TRIAGE_CONFIG = {
   dryRun: true,
   maxComments: 50,
   enableReputation: true
 };
-var IssueTriageConfigSchema = z3.object({
-  dryRun: z3.boolean().default(true),
-  githubToken: z3.string().optional(),
-  maxComments: z3.number().int().min(1).max(100).default(50),
-  enableReputation: z3.boolean().default(true)
+var IssueTriageConfigSchema = z6.object({
+  dryRun: z6.boolean().default(true),
+  githubToken: z6.string().optional(),
+  maxComments: z6.number().int().min(1).max(100).default(50),
+  enableReputation: z6.boolean().default(true)
 });
 
 // src/dogfooding/issue-triage-helpers.ts
@@ -886,7 +1682,7 @@ function extractLabelsFromBody(title, body) {
 }
 
 // src/dogfooding/issue-triage.ts
-var logger2 = createLogger({ component: "IssueTriage" });
+var logger5 = createLogger({ component: "IssueTriage" });
 function applySafetyActions(actions, gateDecision, reputation, issue) {
   const withRefusal = appendRefusalIfHostile(actions, gateDecision, issue);
   return appendApprovalIfBorderline(withRefusal, gateDecision, reputation, issue);
@@ -932,7 +1728,7 @@ var IssueTriage = class {
    */
   async triageIssue(issueUrl) {
     const startTime = getTimeProvider().now();
-    logger2.info("Starting issue triage", { issueUrl });
+    logger5.info("Starting issue triage", { issueUrl });
     const parseResult = parseIssueUrl(issueUrl);
     if (!parseResult.ok) return parseResult;
     const { owner, repo, issueNumber } = parseResult.value;
@@ -941,15 +1737,16 @@ var IssueTriage = class {
     const { issue: issueResult, comments, accountAgeDays } = fetchResult.value;
     const safeTitle = this.sanitizeContent(issueResult.title, issueResult.author);
     const safeBody = this.sanitizeContent(issueResult.body, issueResult.author);
-    const trustResult = this.classifyAuthor(issueResult);
     const reputation = this.assessAuthorReputation(issueResult, comments, accountAgeDays);
-    const gateDecision = gateWithReputation(
-      trustResult.trustTier,
-      reputation,
-      resolveReputationGatingMode()
-    );
+    const firewall = this.classifyAuthor(issueResult, reputation);
+    if (!firewall.ok) return firewall;
+    const trustResult = firewall.value.trust;
+    const gateDecision = firewall.value.reputationGate;
+    if (gateDecision === void 0) {
+      return err(new Error("Untrusted-input firewall returned no reputation gate decision"));
+    }
     if (gateDecision.demotionSuppressed) {
-      logger2.warn("Reputation demotion suppressed by gating mode (would block under enforce)", {
+      logger5.warn("Reputation demotion suppressed by gating mode (would block under enforce)", {
         issueNumber,
         author: issueResult.author,
         mode: gateDecision.mode,
@@ -964,12 +1761,14 @@ var IssueTriage = class {
       issue: issueResult,
       actions: validatedActions,
       trustResult,
+      isAllowlisted: firewall.value.isAllowlisted,
+      auditSink: firewall.value.auditSink,
       reputation,
       gateDecision,
       safeContent: { title: safeTitle, body: safeBody },
       startTime
     });
-    logger2.info("Issue triage completed", {
+    logger5.info("Issue triage completed", {
       issueNumber,
       category: result.category,
       actionCount: result.proposedActions.length,
@@ -985,7 +1784,7 @@ var IssueTriage = class {
     if (text.length === 0) return text;
     const result = sanitizeInput(text, "unknown", author);
     if (result.wasModified) {
-      logger2.warn("Issue content sanitized", {
+      logger5.warn("Issue content sanitized", {
         author,
         strippedCount: result.strippedElements.length,
         injectionFlags: result.injectionFlags
@@ -994,14 +1793,44 @@ var IssueTriage = class {
     return result.content;
   }
   /**
-   * Classifies the issue author's trust tier.
-   * (Source: Issue #828 — trust-classifier wiring)
+   * Classifies the issue author's trust tier through the shared firewall
+   * (#4992; originally Issue #828 — trust-classifier wiring).
+   *
+   * The access posture is passed per call so the firewall's Rule-of-Two check
+   * sees the same facts `validateActions` enforces on. No maintainer allowlist
+   * is passed: there is no source for one today (no config field, no env var),
+   * so none is consulted and `isAllowlisted` stays absent on the result rather
+   * than being recorded as `false`.
    */
-  classifyAuthor(issue) {
-    return classifyTrust({
-      username: issue.author,
-      authorAssociation: issue.authorAssociation
-    });
+  classifyAuthor(issue, reputation) {
+    return runUntrustedInputFirewall(
+      {
+        type: "issue",
+        username: issue.author,
+        authorAssociation: issue.authorAssociation,
+        title: issue.title,
+        body: issue.body
+      },
+      { context: this.accessContext(), reputation: { assessment: reputation } }
+    );
+  }
+  /**
+   * The access posture this triage runs under — the two Rule-of-Two conjuncts
+   * that are about the agent rather than the input. Shared by the firewall
+   * (#4992) and `validateActions` so the two cannot disagree.
+   */
+  accessContext() {
+    return {
+      hasWriteAccess: !this.config.dryRun,
+      // #4681: read the token from where it ACTUALLY comes from. The previous
+      // form (`this.config.githubToken !== undefined`) was written to make this
+      // conjunct "real", but no production caller ever sets `githubToken` — the
+      // SCM provider resolves the live credential from GITHUB_TOKEN/GH_TOKEN.
+      // So the conjunct was permanently false and Rule of Two could never trip,
+      // which is precisely the constant it was introduced to remove.
+      // `hasToken()` is the canonical resolver-backed check.
+      hasSecretAccess: this.config.githubToken !== void 0 || hasToken("github")
+    };
   }
   /**
    * Assesses the issue author's reputation using the reputation model.
@@ -1064,15 +1893,7 @@ var IssueTriage = class {
   validateActions(actions, gateDecision) {
     const context = {
       inputTrustTier: gateDecision.enforcedTier,
-      hasWriteAccess: !this.config.dryRun,
-      // #4681: read the token from where it ACTUALLY comes from. The previous
-      // form (`this.config.githubToken !== undefined`) was written to make this
-      // conjunct "real", but no production caller ever sets `githubToken` — the
-      // SCM provider resolves the live credential from GITHUB_TOKEN/GH_TOKEN.
-      // So the conjunct was permanently false and Rule of Two could never trip,
-      // which is precisely the constant it was introduced to remove.
-      // `hasToken()` is the canonical resolver-backed check.
-      hasSecretAccess: this.config.githubToken !== void 0 || hasToken("github")
+      ...this.accessContext()
     };
     return actions.map((action) => {
       const policyDecision = evaluatePolicy(action, context);
@@ -1098,13 +1919,25 @@ var IssueTriage = class {
    * Builds the final triage result.
    */
   buildResult(opts) {
-    const { issue, actions, trustResult, reputation, gateDecision, safeContent, startTime } = opts;
+    const {
+      issue,
+      actions,
+      trustResult,
+      isAllowlisted,
+      auditSink,
+      reputation,
+      gateDecision,
+      safeContent,
+      startTime
+    } = opts;
     const [category, confidence] = categorizeIssue(safeContent.title, safeContent.body);
     const isTier1 = trustResult.trustTier === "1";
     const trustAssessment = {
       trustTier: trustResult.trustTier,
       userRole: trustResult.userRole,
-      isAllowlisted: trustResult.isAllowlisted,
+      // Measured or absent (#4992): never the classifier's default `false`.
+      ...isAllowlisted !== void 0 ? { isAllowlisted } : {},
+      auditSink,
       reputationScore: reputation?.reputationScore,
       suspiciousSignals: isTier1 ? [] : reputation?.suspiciousSignals ?? [],
       isSuspicious: isTier1 ? false : reputation?.isSuspicious ?? false,
@@ -1222,11 +2055,19 @@ function createIssueTriage(config) {
 }
 
 export {
+  createDurableAuditSink,
+  createDurableAuditTrail,
+  FirewallPolicyModeSchema,
+  DEFAULT_FIREWALL_POLICY_MODE,
+  FIREWALL_POLICY_ENV_VAR,
+  resolveFirewallPolicyMode,
   mapAuthorAssociation,
   classifyTrust,
   canInfluenceDecisions,
   requiresCorroboration,
   getRequiredTrustTier,
+  generateATL,
+  parseATL,
   SourceCitationSchema,
   AgentActionSchema,
   validateAgentAction,
@@ -1235,11 +2076,14 @@ export {
   requiresHumanApproval,
   requiresCitation,
   ViolationSchema,
-  checkRuleOfTwo,
   evaluatePolicy,
   canProceed,
   validateCorroboration,
   getCorroborationRules,
+  HostileInputFirewall,
+  createGitHubAdapter,
+  configureUntrustedInputFirewall,
+  runUntrustedInputFirewall,
   parsePRUrl,
   GitHubReviewer,
   GitHubUserInfo,
@@ -1247,4 +2091,4 @@ export {
   IssueTriage,
   createIssueTriage
 };
-//# sourceMappingURL=chunk-MXQG3A5W.js.map
+//# sourceMappingURL=chunk-FPHFCZ2E.js.map