patchwork-os 1.2.0-beta.2.canary.625 → 1.2.0-beta.2.canary.627

package/dist/privacy/dataPolicy.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Information boundary — declared labels and the boundary decision (ADR-0021,
+ * Phases 1 and 2).
+ *
+ * The invariant this exists to hold:
+ *
+ *   > No model-bound context leaves Patchwork without passing the
+ *   > information-boundary decision point.
+ *
+ * Two properties are deliberate and load-bearing.
+ *
+ * **Declared, never detected.** A step says what it carries; a destination says
+ * what it may receive. Nothing is inferred. ADR-0021 rules detection out on the
+ * grounds that a detector which IS the boundary fails silently on everything it
+ * does not recognise, and its recall is unknowable. A detector may later suggest
+ * a classification; policy still decides.
+ *
+ * **Pure.** The decision is a function of (declared policy, destination policy)
+ * and nothing else — no clock, no filesystem, no model. That is what makes it
+ * testable without a model in the loop, and what stops the boundary being
+ * enforced by the thing it constrains.
+ */
+/**
+ * Sensitivity ladder, ordered. The order is the whole comparison: a destination
+ * cleared for `internal` is cleared for `public`, never the reverse.
+ */
+export declare const CLASSIFICATIONS: readonly ["public", "internal", "personal", "confidential", "restricted"];
+export type Classification = (typeof CLASSIFICATIONS)[number];
+/**
+ * Default for a step that declares nothing.
+ *
+ * `internal` rather than `restricted`, deliberately. Every existing recipe
+ * declares nothing, so a strict default would refuse the entire installed base
+ * on upgrade to solve a problem those installs do not have — and a boundary
+ * that breaks everything on day one gets switched off, which protects nobody.
+ * Same fail-soft reasoning as the identity roster's implicit owner.
+ */
+export declare const DEFAULT_CLASSIFICATION: Classification;
+export declare function classificationRank(c: Classification): number;
+/** What a step declares it is carrying. */
+export interface DataPolicy {
+    classification: Classification;
+    /** Free-form tags (e.g. "financial"). Used for redaction, not for ranking. */
+    categories?: string[];
+}
+/** What a destination declares it may receive. */
+export interface Destination {
+    id: string;
+    /** `local` never leaves the machine; `remote` crosses a network boundary. */
+    type: "local" | "remote";
+    /** Classifications this destination is cleared for. */
+    classifications: Classification[];
+    /**
+     * Categories this destination must never receive even when it is cleared for
+     * the classification. Redaction removes them; if they cannot be removed the
+     * decision escalates rather than silently sending them.
+     */
+    forbiddenCategories?: string[];
+    /**
+     * Whether a human may authorise an otherwise-refused send. Absent means no:
+     * the refusal stands, which keeps DENY meaningful as "no approval unlocks
+     * this" exactly as the autonomy gate's `forbid` does.
+     */
+    approvable?: boolean;
+}
+/**
+ * The five outcomes.
+ *
+ * `LOCAL_ONLY` is distinct from `DENY` on purpose: it means the data may be
+ * processed, just not here. It is a routing instruction, and the caller is
+ * expected to retry against a local destination rather than fail the step.
+ */
+export type BoundaryDecision = "ALLOW" | "ALLOW_REDACTED" | "LOCAL_ONLY" | "REQUIRE_APPROVAL" | "DENY";
+export interface BoundaryOutcome {
+    decision: BoundaryDecision;
+    /** One sentence, safe to show a human. Never contains the payload. */
+    reason: string;
+    /** Categories that must be removed before dispatch (ALLOW_REDACTED only). */
+    redactCategories?: string[];
+}
+/**
+ * Decide whether `policy` may be sent to `destination`.
+ *
+ * The rule table, in evaluation order:
+ *
+ *   1. destination not cleared for the classification
+ *        → LOCAL_ONLY if a local destination could take it, else
+ *          REQUIRE_APPROVAL if the destination is approvable, else DENY
+ *   2. cleared, but carries a forbidden category
+ *        → ALLOW_REDACTED (the category is removable)
+ *   3. otherwise → ALLOW
+ *
+ * Rule 1 runs FIRST and is not reachable past. A destination cannot become
+ * cleared by redacting a category, because the classification is a property of
+ * the step as a whole — dropping a tag does not declassify what remains.
+ */
+export declare function decideBoundary(policy: DataPolicy, destination: Destination, opts?: {
+    localDestinationAccepts?: boolean;
+}): BoundaryOutcome;
+/**
+ * Parse a step's declared `data_policy`, falling back to the default.
+ *
+ * An UNRECOGNISED classification is not silently defaulted — it returns null so
+ * the caller can fail closed. Defaulting a typo to `internal` would let
+ * `classification: confidentail` sail through as ordinary internal data, which
+ * is precisely the failure a declared-labels scheme cannot afford: the operator
+ * believes they labelled it and the system believes they did not.
+ */
+export declare function parseDataPolicy(raw: unknown): DataPolicy | null;
+export declare function narrowest(a: BoundaryOutcome, b: BoundaryOutcome): BoundaryOutcome;

package/dist/privacy/dataPolicy.js

@@ -0,0 +1,148 @@
+/**
+ * Information boundary — declared labels and the boundary decision (ADR-0021,
+ * Phases 1 and 2).
+ *
+ * The invariant this exists to hold:
+ *
+ *   > No model-bound context leaves Patchwork without passing the
+ *   > information-boundary decision point.
+ *
+ * Two properties are deliberate and load-bearing.
+ *
+ * **Declared, never detected.** A step says what it carries; a destination says
+ * what it may receive. Nothing is inferred. ADR-0021 rules detection out on the
+ * grounds that a detector which IS the boundary fails silently on everything it
+ * does not recognise, and its recall is unknowable. A detector may later suggest
+ * a classification; policy still decides.
+ *
+ * **Pure.** The decision is a function of (declared policy, destination policy)
+ * and nothing else — no clock, no filesystem, no model. That is what makes it
+ * testable without a model in the loop, and what stops the boundary being
+ * enforced by the thing it constrains.
+ */
+/**
+ * Sensitivity ladder, ordered. The order is the whole comparison: a destination
+ * cleared for `internal` is cleared for `public`, never the reverse.
+ */
+export const CLASSIFICATIONS = [
+    "public",
+    "internal",
+    "personal",
+    "confidential",
+    "restricted",
+];
+/**
+ * Default for a step that declares nothing.
+ *
+ * `internal` rather than `restricted`, deliberately. Every existing recipe
+ * declares nothing, so a strict default would refuse the entire installed base
+ * on upgrade to solve a problem those installs do not have — and a boundary
+ * that breaks everything on day one gets switched off, which protects nobody.
+ * Same fail-soft reasoning as the identity roster's implicit owner.
+ */
+export const DEFAULT_CLASSIFICATION = "internal";
+export function classificationRank(c) {
+    return CLASSIFICATIONS.indexOf(c);
+}
+/**
+ * Decide whether `policy` may be sent to `destination`.
+ *
+ * The rule table, in evaluation order:
+ *
+ *   1. destination not cleared for the classification
+ *        → LOCAL_ONLY if a local destination could take it, else
+ *          REQUIRE_APPROVAL if the destination is approvable, else DENY
+ *   2. cleared, but carries a forbidden category
+ *        → ALLOW_REDACTED (the category is removable)
+ *   3. otherwise → ALLOW
+ *
+ * Rule 1 runs FIRST and is not reachable past. A destination cannot become
+ * cleared by redacting a category, because the classification is a property of
+ * the step as a whole — dropping a tag does not declassify what remains.
+ */
+export function decideBoundary(policy, destination, opts = {}) {
+    const cleared = destination.classifications.includes(policy.classification);
+    if (!cleared) {
+        if (destination.type === "remote" && opts.localDestinationAccepts) {
+            return {
+                decision: "LOCAL_ONLY",
+                reason: `"${policy.classification}" may not leave the machine; a local destination accepts it`,
+            };
+        }
+        if (destination.approvable) {
+            return {
+                decision: "REQUIRE_APPROVAL",
+                reason: `"${destination.id}" is not cleared for "${policy.classification}"; a human may authorise this send`,
+            };
+        }
+        return {
+            decision: "DENY",
+            reason: `"${destination.id}" is not cleared for "${policy.classification}" and no approval can unlock it`,
+        };
+    }
+    const forbidden = destination.forbiddenCategories ?? [];
+    const carried = policy.categories ?? [];
+    const hits = carried.filter((c) => forbidden.includes(c));
+    if (hits.length > 0) {
+        return {
+            decision: "ALLOW_REDACTED",
+            reason: `"${destination.id}" is cleared for "${policy.classification}" but must not receive: ${hits.join(", ")}`,
+            redactCategories: hits,
+        };
+    }
+    return {
+        decision: "ALLOW",
+        reason: `"${destination.id}" is cleared for "${policy.classification}"`,
+    };
+}
+/**
+ * Parse a step's declared `data_policy`, falling back to the default.
+ *
+ * An UNRECOGNISED classification is not silently defaulted — it returns null so
+ * the caller can fail closed. Defaulting a typo to `internal` would let
+ * `classification: confidentail` sail through as ordinary internal data, which
+ * is precisely the failure a declared-labels scheme cannot afford: the operator
+ * believes they labelled it and the system believes they did not.
+ */
+export function parseDataPolicy(raw) {
+    if (raw === undefined || raw === null) {
+        return { classification: DEFAULT_CLASSIFICATION };
+    }
+    if (typeof raw !== "object")
+        return null;
+    const obj = raw;
+    const c = obj.classification;
+    let classification;
+    if (c === undefined) {
+        classification = DEFAULT_CLASSIFICATION;
+    }
+    else if (typeof c === "string" &&
+        CLASSIFICATIONS.includes(c)) {
+        classification = c;
+    }
+    else {
+        return null;
+    }
+    const categories = Array.isArray(obj.categories)
+        ? obj.categories.filter((x) => typeof x === "string")
+        : undefined;
+    return categories ? { classification, categories } : { classification };
+}
+/**
+ * NEVER-WIDEN composition, mirroring the autonomy gate's rule.
+ *
+ * A later stage may restrict further; it may never restore what an earlier one
+ * removed. Applied by taking the MORE restrictive of two decisions, so ordering
+ * the stages wrongly cannot loosen the result.
+ */
+const RESTRICTIVENESS = {
+    ALLOW: 0,
+    ALLOW_REDACTED: 1,
+    LOCAL_ONLY: 2,
+    REQUIRE_APPROVAL: 3,
+    DENY: 4,
+};
+export function narrowest(a, b) {
+    return RESTRICTIVENESS[b.decision] > RESTRICTIVENESS[a.decision] ? b : a;
+}
+//# sourceMappingURL=dataPolicy.js.map

package/dist/privacy/dataPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataPolicy.js","sourceRoot":"","sources":["../../src/privacy/dataPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ;IACR,UAAU;IACV,UAAU;IACV,cAAc;IACd,YAAY;CACJ,CAAC;AAIX;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAmB,UAAU,CAAC;AAEjE,MAAM,UAAU,kBAAkB,CAAC,CAAiB;IAClD,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAoDD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAkB,EAClB,WAAwB,EACxB,OAA8C,EAAE;IAEhD,MAAM,OAAO,GAAG,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAE5E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,WAAW,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAClE,OAAO;gBACL,QAAQ,EAAE,YAAY;gBACtB,MAAM,EAAE,IAAI,MAAM,CAAC,cAAc,6DAA6D;aAC/F,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,CAAC,UAAU,EAAE,CAAC;YAC3B,OAAO;gBACL,QAAQ,EAAE,kBAAkB;gBAC5B,MAAM,EAAE,IAAI,WAAW,CAAC,EAAE,yBAAyB,MAAM,CAAC,cAAc,oCAAoC;aAC7G,CAAC;QACJ,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,IAAI,WAAW,CAAC,EAAE,yBAAyB,MAAM,CAAC,cAAc,iCAAiC;SAC1G,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,WAAW,CAAC,mBAAmB,IAAI,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO;YACL,QAAQ,EAAE,gBAAgB;YAC1B,MAAM,EAAE,IAAI,WAAW,CAAC,EAAE,qBAAqB,MAAM,CAAC,cAAc,2BAA2B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAChH,gBAAgB,EAAE,IAAI;SACvB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,IAAI,WAAW,CAAC,EAAE,qBAAqB,MAAM,CAAC,cAAc,GAAG;KACxE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,GAAG,GAAG,GAAyD,CAAC;IACtE,MAAM,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC;IAC7B,IAAI,cAA8B,CAAC;IACnC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACpB,cAAc,GAAG,sBAAsB,CAAC;IAC1C,CAAC;SAAM,IACL,OAAO,CAAC,KAAK,QAAQ;QACpB,eAAqC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAClD,CAAC;QACD,cAAc,GAAG,CAAmB,CAAC;IACvC,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAC9C,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAClE,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,eAAe,GAAqC;IACxD,KAAK,EAAE,CAAC;IACR,cAAc,EAAE,CAAC;IACjB,UAAU,EAAE,CAAC;IACb,gBAAgB,EAAE,CAAC;IACnB,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,MAAM,UAAU,SAAS,CACvB,CAAkB,EAClB,CAAkB;IAElB,OAAO,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC"}

package/dist/privacy/destinationRegistry.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Destination registry (ADR-0021).
+ *
+ * The decision in `dataPolicy.ts` is pure and complete, and until this module
+ * existed it was also unreachable: `executeAgent` only evaluates the boundary
+ * when a destination is supplied, and nothing supplied one. The engine was
+ * built and inert.
+ *
+ * A destination is *where a prompt is about to go*. Patchwork resolves that
+ * from the driver, because that is what actually determines whether bytes
+ * cross a network boundary:
+ *
+ *   local   — a model on this machine (`local`, `ollama`, an OpenAI-compatible
+ *             endpoint pointed at localhost)
+ *   remote  — anything that sends the prompt to a third party
+ *
+ * ## Configuration is opt-in, and absence means inert
+ *
+ * With no `privacy.destinations` block, `resolveDestination` returns null and
+ * `executeAgent` skips the boundary entirely — byte-identical to before. That
+ * is the same fail-soft posture as the default classification, and for the same
+ * reason: a boundary that refuses work on every install that has not configured
+ * it would be switched off before it ever protected anyone.
+ *
+ * The asymmetry is deliberate and worth stating. Configuring a destination is
+ * how an operator OPTS IN to enforcement. Once opted in, the decision is
+ * fail-CLOSED — an unknown driver resolves to the strictest registered remote
+ * profile rather than to "no destination", because "we do not recognise where
+ * this is going" must never read as "it is fine to send".
+ */
+import { type Classification, type Destination } from "./dataPolicy.js";
+export interface DestinationConfig {
+    type?: string;
+    classifications?: unknown;
+    forbiddenCategories?: unknown;
+    approvable?: unknown;
+    /** Driver names this destination covers. */
+    drivers?: unknown;
+}
+export interface PrivacyConfig {
+    destinations?: Record<string, DestinationConfig>;
+}
+export interface ParsedRegistry {
+    destinations: Destination[];
+    /** Destination id → driver names it covers. */
+    driversFor: Map<string, string[]>;
+    /**
+     * Entries that could not be parsed, with a reason. REPORTED rather than
+     * dropped: a destination that silently vanishes from the registry downgrades
+     * enforcement to "no destination", which is exactly the direction this must
+     * never fail in.
+     */
+    invalid: Array<{
+        id: string;
+        reason: string;
+    }>;
+}
+export declare function parseRegistry(cfg: PrivacyConfig | undefined): ParsedRegistry;
+export interface ResolvedDestination {
+    destination: Destination;
+    /** True when some registered LOCAL destination is cleared for `forClass`. */
+    localDestinationAccepts: boolean;
+}
+/**
+ * Resolve the destination for a dispatch.
+ *
+ * Returns null ONLY when nothing is registered — the inert case. Once anything
+ * is registered, this always yields a destination, because falling back to null
+ * on an unrecognised driver would silently disable the boundary for exactly the
+ * dispatches nobody anticipated.
+ */
+export declare function resolveDestination(registry: ParsedRegistry, driver: string | undefined, forClass: Classification): ResolvedDestination | null;

package/dist/privacy/destinationRegistry.js

@@ -0,0 +1,127 @@
+/**
+ * Destination registry (ADR-0021).
+ *
+ * The decision in `dataPolicy.ts` is pure and complete, and until this module
+ * existed it was also unreachable: `executeAgent` only evaluates the boundary
+ * when a destination is supplied, and nothing supplied one. The engine was
+ * built and inert.
+ *
+ * A destination is *where a prompt is about to go*. Patchwork resolves that
+ * from the driver, because that is what actually determines whether bytes
+ * cross a network boundary:
+ *
+ *   local   — a model on this machine (`local`, `ollama`, an OpenAI-compatible
+ *             endpoint pointed at localhost)
+ *   remote  — anything that sends the prompt to a third party
+ *
+ * ## Configuration is opt-in, and absence means inert
+ *
+ * With no `privacy.destinations` block, `resolveDestination` returns null and
+ * `executeAgent` skips the boundary entirely — byte-identical to before. That
+ * is the same fail-soft posture as the default classification, and for the same
+ * reason: a boundary that refuses work on every install that has not configured
+ * it would be switched off before it ever protected anyone.
+ *
+ * The asymmetry is deliberate and worth stating. Configuring a destination is
+ * how an operator OPTS IN to enforcement. Once opted in, the decision is
+ * fail-CLOSED — an unknown driver resolves to the strictest registered remote
+ * profile rather than to "no destination", because "we do not recognise where
+ * this is going" must never read as "it is fine to send".
+ */
+import { CLASSIFICATIONS, } from "./dataPolicy.js";
+/** Drivers that keep the prompt on this machine. */
+const LOCAL_DRIVERS = new Set(["local", "ollama", "lmstudio", "llamacpp"]);
+function parseClassifications(raw) {
+    if (!Array.isArray(raw))
+        return null;
+    const out = [];
+    for (const v of raw) {
+        if (typeof v !== "string")
+            return null;
+        if (!CLASSIFICATIONS.includes(v))
+            return null;
+        out.push(v);
+    }
+    return out;
+}
+export function parseRegistry(cfg) {
+    const destinations = [];
+    const driversFor = new Map();
+    const invalid = [];
+    for (const [id, raw] of Object.entries(cfg?.destinations ?? {})) {
+        if (!raw || typeof raw !== "object") {
+            invalid.push({ id, reason: "not an object" });
+            continue;
+        }
+        const type = raw.type === "local" ? "local" : raw.type === "remote" ? "remote" : null;
+        if (!type) {
+            invalid.push({ id, reason: `type must be "local" or "remote"` });
+            continue;
+        }
+        const classifications = parseClassifications(raw.classifications);
+        if (!classifications) {
+            invalid.push({
+                id,
+                reason: "classifications must be an array of known classifications",
+            });
+            continue;
+        }
+        const dest = { id, type, classifications };
+        if (Array.isArray(raw.forbiddenCategories)) {
+            dest.forbiddenCategories = raw.forbiddenCategories.filter((c) => typeof c === "string");
+        }
+        if (raw.approvable === true)
+            dest.approvable = true;
+        destinations.push(dest);
+        driversFor.set(id, Array.isArray(raw.drivers)
+            ? raw.drivers.filter((d) => typeof d === "string")
+            : []);
+    }
+    return { destinations, driversFor, invalid };
+}
+/** The strictest remote destination — fewest classifications wins. */
+function strictestRemote(destinations) {
+    const remotes = destinations.filter((d) => d.type === "remote");
+    if (remotes.length === 0)
+        return null;
+    return remotes.reduce((a, b) => b.classifications.length < a.classifications.length ? b : a);
+}
+/**
+ * Resolve the destination for a dispatch.
+ *
+ * Returns null ONLY when nothing is registered — the inert case. Once anything
+ * is registered, this always yields a destination, because falling back to null
+ * on an unrecognised driver would silently disable the boundary for exactly the
+ * dispatches nobody anticipated.
+ */
+export function resolveDestination(registry, driver, forClass) {
+    if (registry.destinations.length === 0)
+        return null;
+    const d = (driver ?? "").toLowerCase();
+    const localAccepts = registry.destinations.some((dest) => dest.type === "local" && dest.classifications.includes(forClass));
+    // Explicit driver mapping wins.
+    for (const dest of registry.destinations) {
+        if ((registry.driversFor.get(dest.id) ?? []).includes(d)) {
+            return { destination: dest, localDestinationAccepts: localAccepts };
+        }
+    }
+    // Otherwise infer by driver family.
+    if (LOCAL_DRIVERS.has(d)) {
+        const local = registry.destinations.find((x) => x.type === "local");
+        if (local) {
+            return { destination: local, localDestinationAccepts: localAccepts };
+        }
+    }
+    // Unknown or remote driver → strictest remote. Fail closed: "we do not
+    // recognise where this is going" must never read as "it is fine to send".
+    const remote = strictestRemote(registry.destinations);
+    if (remote) {
+        return { destination: remote, localDestinationAccepts: localAccepts };
+    }
+    // Only local destinations are registered but the driver is not local. The
+    // strictest available answer is the local profile, which will refuse
+    // anything it is not cleared for.
+    const first = registry.destinations[0];
+    return { destination: first, localDestinationAccepts: localAccepts };
+}
+//# sourceMappingURL=destinationRegistry.js.map

package/dist/privacy/destinationRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"destinationRegistry.js","sourceRoot":"","sources":["../../src/privacy/destinationRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EACL,eAAe,GAGhB,MAAM,iBAAiB,CAAC;AAEzB,oDAAoD;AACpD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAe3E,SAAS,oBAAoB,CAAC,GAAY;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,CAAE,eAAqC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACrE,GAAG,CAAC,IAAI,CAAC,CAAmB,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAeD,MAAM,UAAU,aAAa,CAAC,GAA8B;IAC1D,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,MAAM,OAAO,GAA0C,EAAE,CAAC;IAE1D,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GACR,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC,CAAC;YACjE,SAAS;QACX,CAAC;QACD,MAAM,eAAe,GAAG,oBAAoB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAClE,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE;gBACF,MAAM,EAAE,2DAA2D;aACpE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAgB,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QACxD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,mBAAmB,GAAG,GAAG,CAAC,mBAAmB,CAAC,MAAM,CACvD,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACpD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,UAAU,CAAC,GAAG,CACZ,EAAE,EACF,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YACxB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAC/D,CAAC,CAAC,EAAE,CACP,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,sEAAsE;AACtE,SAAS,eAAe,CAAC,YAA2B;IAClD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC7B,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC5D,CAAC;AACJ,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAwB,EACxB,MAA0B,EAC1B,QAAwB;IAExB,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpD,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAC7C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC3E,CAAC;IAEF,gCAAgC;IAChC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,uBAAuB,EAAE,YAAY,EAAE,CAAC;QACtE,CAAC;IACH,CAAC;IAED,oCAAoC;IACpC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QACpE,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,uBAAuB,EAAE,YAAY,EAAE,CAAC;QACvE,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACtD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,uBAAuB,EAAE,YAAY,EAAE,CAAC;IACxE,CAAC;IACD,0EAA0E;IAC1E,qEAAqE;IACrE,kCAAkC;IAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAgB,CAAC;IACtD,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,uBAAuB,EAAE,YAAY,EAAE,CAAC;AACvE,CAAC"}

package/dist/recipes/agentExecutor.d.ts

@@ -7,6 +7,8 @@
  * CHANGELOG: chained users with model:local in ~/.patchwork/config now route to
  * localFn (Ollama/LM Studio) instead of Anthropic API — opt-in behaviour change.
  */
+import { type Destination } from "../privacy/dataPolicy.js";
+import { type PrivacyConfig } from "../privacy/destinationRegistry.js";
 /**
  * Token usage reported by an adapter. Both fields are integers; absent
  * `usage` on the parent `AgentResult` means the driver didn't surface
@@ -42,6 +44,23 @@ export interface AgentResult {
     };
 }
 export interface AgentExecutorDeps {
+    /**
+     * Receipt sink for information-boundary decisions (ADR-0021 Phase 3).
+     * Optional: an unwired sink means no receipt, never a refusal — the
+     * boundary must not depend on its own audit trail being configured.
+     */
+    /**
+     * Supplies `privacy.destinations` from operator config. Absent means the
+     * boundary stays inert unless a caller passes an explicit destination —
+     * the opt-in posture ADR-0021 requires.
+     */
+    loadPrivacyConfigFn?: () => PrivacyConfig | undefined;
+    recordBoundaryDecisionFn?: (r: {
+        decision: string;
+        reason: string;
+        destinationId?: string;
+        redactCategories?: string[];
+    }) => void;
     anthropicFn: (prompt: string, model: string) => Promise<AgentResult>;
     /** Handles openai, grok, gemini, gemini-api, codex — passes driver name through. */
     providerDriverFn: (driver: "openai" | "grok" | "gemini" | "gemini-api" | "codex", prompt: string, model: string | undefined, 
@@ -82,6 +101,19 @@ export interface AgentExecutorInput {
     allowedTools?: string[];
     /** Deny rules via --disallowed-tools (any mode). */
     disallowedTools?: string[];
+    /**
+     * Information-boundary context (ADR-0021). Absent means the step declared no
+     * `data_policy` and no destination is registered, which is byte-identical to
+     * pre-boundary behaviour — the overwhelmingly common case on upgrade.
+     */
+    boundary?: {
+        /** Raw `data_policy` as declared on the step. Parsed here, not by callers. */
+        dataPolicy?: unknown;
+        /** Where this prompt is about to go. */
+        destination?: Destination;
+        /** Whether ANY registered local destination accepts the classification. */
+        localDestinationAccepts?: boolean;
+    };
     /**
      * Worker-autonomy hard requirement. When true, this agent step carries a
      * worker-mandated tool sandbox (see disallowedToolsForAgentStep) that ONLY the

package/dist/recipes/agentExecutor.js

@@ -7,6 +7,8 @@
  * CHANGELOG: chained users with model:local in ~/.patchwork/config now route to
  * localFn (Ollama/LM Studio) instead of Anthropic API — opt-in behaviour change.
  */
+import { DEFAULT_CLASSIFICATION, decideBoundary, parseDataPolicy, } from "../privacy/dataPolicy.js";
+import { parseRegistry, resolveDestination, } from "../privacy/destinationRegistry.js";
 import { resolveLocalModel } from "./localSettings.js";
 /**
  * Model the anthropic/local agent paths fall back to when a step omits `model`.
@@ -50,6 +52,52 @@ const CODEX_WORKER_SANDBOX_LOCKDOWN = {
     networkAccess: false,
     webSearch: false,
 };
+/**
+ * Evaluate the information boundary for one agent step.
+ *
+ * Returns null when the step declares nothing AND no destination is registered
+ * — byte-identical to pre-boundary behaviour, which is the state of every
+ * existing install.
+ *
+ * A MALFORMED `data_policy` fails closed with DENY rather than defaulting. The
+ * operator wrote a label; silently reading it as `internal` because of a typo
+ * would leave them believing data was protected when it was not.
+ */
+function evaluateBoundary(ctx, driver, loadPrivacyConfig) {
+    const policy0 = parseDataPolicy(ctx?.dataPolicy);
+    // Resolve the destination HERE rather than requiring every call site to pass
+    // one. There are four dispatch sites in the flat runner alone; a boundary
+    // that depends on each of them remembering is a boundary with four ways to
+    // be bypassed, and the fifth call site added later inherits none of them.
+    let destination = ctx?.destination;
+    let localAccepts = ctx?.localDestinationAccepts;
+    if (!destination && loadPrivacyConfig) {
+        const registry = parseRegistry(loadPrivacyConfig());
+        const forClass = policy0?.classification ?? DEFAULT_CLASSIFICATION;
+        const resolved = resolveDestination(registry, driver, forClass);
+        if (resolved) {
+            destination = resolved.destination;
+            localAccepts = resolved.localDestinationAccepts;
+        }
+    }
+    if (!destination)
+        return null;
+    const ctx2 = { ...ctx, destination, localDestinationAccepts: localAccepts };
+    return evaluateAgainst(policy0, ctx2);
+}
+function evaluateAgainst(policy, ctx) {
+    if (policy === null) {
+        return {
+            decision: "DENY",
+            reason: "data_policy declares an unrecognised classification — refusing rather than defaulting a typo to `internal`",
+        };
+    }
+    return decideBoundary(policy, ctx.destination, {
+        ...(ctx.localDestinationAccepts !== undefined && {
+            localDestinationAccepts: ctx.localDestinationAccepts,
+        }),
+    });
+}
 export async function executeAgent(input, deps) {
     const { prompt, driver, model, mcpAccess, sandbox, allowedTools, disallowedTools, providerOptions, enforceSandbox, } = input;
     // NEVER-WIDEN guard. A worker-mandated sandbox is enforceable only on drivers
@@ -66,6 +114,42 @@ export async function executeAgent(input, deps) {
             servedBy: { driver: driver ?? "auto" },
         };
     }
+    // ── INFORMATION BOUNDARY (ADR-0021) ─────────────────────────────────────
+    // Evaluated BEFORE dispatch, and here rather than in `costRouter`, which is
+    // the tempting seam and the wrong one: costRouter short-circuits with no
+    // downshift list and no USD cap, so binding privacy there would cover only
+    // budgeted steps while presenting as total enforcement. This function is on
+    // the unconditional path for both runners.
+    //
+    // Precedence is privacy -> capability -> cost, and it is not negotiable by
+    // the later stages: a cheaper or more capable model that is not authorised
+    // for the data does not become authorised by being cheaper or more capable.
+    const boundary = evaluateBoundary(input.boundary, driver, deps.loadPrivacyConfigFn);
+    if (boundary && boundary.decision !== "ALLOW") {
+        deps.recordBoundaryDecisionFn?.({
+            decision: boundary.decision,
+            reason: boundary.reason,
+            destinationId: input.boundary?.destination?.id,
+            ...(boundary.redactCategories && {
+                redactCategories: boundary.redactCategories,
+            }),
+        });
+        // ALLOW_REDACTED is not implemented as a transform in this phase, and is
+        // therefore REFUSED rather than silently sent unredacted. Failing closed on
+        // "we know something must be removed and cannot remove it" is the whole
+        // point; the alternative sends the data and logs that it should not have.
+        return {
+            text: `[agent step failed: information boundary — ${boundary.reason}]`,
+            servedBy: { driver: driver ?? "auto" },
+        };
+    }
+    if (boundary) {
+        deps.recordBoundaryDecisionFn?.({
+            decision: boundary.decision,
+            reason: boundary.reason,
+            destinationId: input.boundary?.destination?.id,
+        });
+    }
     const cliOpts = mcpAccess !== undefined ||
         sandbox !== undefined ||
         allowedTools !== undefined ||

package/dist/recipes/agentExecutor.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentExecutor.js","sourceRoot":"","sources":["../../src/recipes/agentExecutor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAuGvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAoBzD,SAAS,yBAAyB,CAChC,MAA0B,EAC1B,IAAuB;IAEvB,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO,UAAU,CAAC;IAC3E,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,gBAAgB,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,CAAC,6CAA6C;IACtF,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa;QACjE,OAAO,UAAU,CAAC;IACpB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAAE,OAAO,MAAM,CAAC,CAAC,8BAA8B;IAChF,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,mDAAmD;AACzG,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,6BAA6B,GAA4B;IAC7D,WAAW,EAAE,WAAW;IACxB,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,SAAS,EAAE,KAAK;CACjB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAyB,EACzB,IAAuB;IAEvB,MAAM,EACJ,MAAM,EACN,MAAM,EACN,KAAK,EACL,SAAS,EACT,OAAO,EACP,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,GACf,GAAG,KAAK,CAAC;IAEV,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,gFAAgF;IAChF,2EAA2E;IAC3E,6EAA6E;IAC7E,kBAAkB;IAClB,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,cAAc,IAAI,kBAAkB,KAAK,MAAM,EAAE,CAAC;QACpD,OAAO;YACL,IAAI,EAAE,sNAAsN;YAC5N,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,MAAM,EAAE;SACvC,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GACX,SAAS,KAAK,SAAS;QACvB,OAAO,KAAK,SAAS;QACrB,YAAY,KAAK,SAAS;QAC1B,eAAe,KAAK,SAAS;QAC3B,CAAC,CAAC;YACE,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;YAC7C,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;YACzC,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;YACnD,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI,EAAE,eAAe,EAAE,CAAC;SAC1D;QACH,CAAC,CAAC,SAAS,CAAC;IAEhB,yEAAyE;IACzE,wEAAwE;IACxE,oEAAoE;IACpE,qEAAqE;IACrE,0EAA0E;IAC1E,MAAM,KAAK,GAAG,KAAK,EACjB,cAAsB,EACtB,aAAiC,EACjC,CAAuB,EACD,EAAE;QACxB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;QAClB,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC;QACzB,OAAO;YACL,GAAG,CAAC;YACJ,QAAQ,EAAE;gBACR,MAAM,EAAE,cAAc;gBACtB,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,KAAK,CACV,WAAW,EACX,KAAK,IAAI,aAAa,EACtB,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,IAAI,aAAa,CAAC,CACjD,CAAC;IACJ,CAAC;IACD,IACE,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,MAAM;QACjB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,YAAY;QACvB,MAAM,KAAK,OAAO,EAClB,CAAC;QACD,yEAAyE;QACzE,4EAA4E;QAC5E,MAAM,wBAAwB,GAC5B,MAAM,KAAK,OAAO,IAAI,cAAc;YAClC,CAAC,CAAC,6BAA6B;YAC/B,CAAC,CAAC,eAAe,CAAC;QACtB,OAAO,KAAK,CACV,MAAM,EACN,KAAK;QACL,0EAA0E;QAC1E,4DAA4D;QAC5D,wBAAwB;YACtB,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,wBAAwB,CAAC;YACxE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CACjD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,8BAA8B;QAC9B,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;QACxE,OAAO,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,2EAA2E;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,mEAAmE;IACnE,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,+DAA+D;IAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAClC,OAAO,KAAK,CACV,WAAW,EACX,KAAK,IAAI,aAAa,EACtB,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,IAAI,aAAa,CAAC,CACjD,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,uEAAuE;IACvE,6EAA6E;IAC7E,+DAA+D;IAC/D,OAAO,KAAK,CACV,WAAW,EACX,KAAK,IAAI,aAAa,EACtB,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,IAAI,aAAa,CAAC,CACjD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"agentExecutor.js","sourceRoot":"","sources":["../../src/recipes/agentExecutor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAEL,sBAAsB,EAEtB,cAAc,EACd,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,aAAa,EACb,kBAAkB,GACnB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAqIvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAoBzD,SAAS,yBAAyB,CAChC,MAA0B,EAC1B,IAAuB;IAEvB,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO,UAAU,CAAC;IAC3E,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,gBAAgB,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,CAAC,6CAA6C;IACtF,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa;QACjE,OAAO,UAAU,CAAC;IACpB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAAE,OAAO,MAAM,CAAC,CAAC,8BAA8B;IAChF,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,mDAAmD;AACzG,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,6BAA6B,GAA4B;IAC7D,WAAW,EAAE,WAAW;IACxB,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,SAAS,EAAE,KAAK;CACjB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB,CACvB,GAAmC,EACnC,MAA0B,EAC1B,iBAAgE;IAEhE,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAEjD,6EAA6E;IAC7E,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,WAAW,GAAG,GAAG,EAAE,WAAW,CAAC;IACnC,IAAI,YAAY,GAAG,GAAG,EAAE,uBAAuB,CAAC;IAChD,IAAI,CAAC,WAAW,IAAI,iBAAiB,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,aAAa,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,OAAO,EAAE,cAAc,IAAI,sBAAsB,CAAC;QACnE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,QAAQ,EAAE,CAAC;YACb,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;YACnC,YAAY,GAAG,QAAQ,CAAC,uBAAuB,CAAC;QAClD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE,uBAAuB,EAAE,YAAY,EAAE,CAAC;IAC5E,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,eAAe,CACtB,MAA0C,EAC1C,GAEC;IAED,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,QAAQ,EAAE,MAAM;YAChB,MAAM,EACJ,4GAA4G;SAC/G,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE;QAC7C,GAAG,CAAC,GAAG,CAAC,uBAAuB,KAAK,SAAS,IAAI;YAC/C,uBAAuB,EAAE,GAAG,CAAC,uBAAuB;SACrD,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAyB,EACzB,IAAuB;IAEvB,MAAM,EACJ,MAAM,EACN,MAAM,EACN,KAAK,EACL,SAAS,EACT,OAAO,EACP,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,GACf,GAAG,KAAK,CAAC;IAEV,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,gFAAgF;IAChF,2EAA2E;IAC3E,6EAA6E;IAC7E,kBAAkB;IAClB,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,cAAc,IAAI,kBAAkB,KAAK,MAAM,EAAE,CAAC;QACpD,OAAO;YACL,IAAI,EAAE,sNAAsN;YAC5N,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,MAAM,EAAE;SACvC,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,2CAA2C;IAC3C,EAAE;IACF,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,KAAK,CAAC,QAAQ,EACd,MAAM,EACN,IAAI,CAAC,mBAAmB,CACzB,CAAC;IACF,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC9C,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE;YAC9C,GAAG,CAAC,QAAQ,CAAC,gBAAgB,IAAI;gBAC/B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;aAC5C,CAAC;SACH,CAAC,CAAC;QACH,yEAAyE;QACzE,4EAA4E;QAC5E,wEAAwE;QACxE,0EAA0E;QAC1E,OAAO;YACL,IAAI,EAAE,8CAA8C,QAAQ,CAAC,MAAM,GAAG;YACtE,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,MAAM,EAAE;SACvC,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GACX,SAAS,KAAK,SAAS;QACvB,OAAO,KAAK,SAAS;QACrB,YAAY,KAAK,SAAS;QAC1B,eAAe,KAAK,SAAS;QAC3B,CAAC,CAAC;YACE,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;YAC7C,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;YACzC,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;YACnD,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI,EAAE,eAAe,EAAE,CAAC;SAC1D;QACH,CAAC,CAAC,SAAS,CAAC;IAEhB,yEAAyE;IACzE,wEAAwE;IACxE,oEAAoE;IACpE,qEAAqE;IACrE,0EAA0E;IAC1E,MAAM,KAAK,GAAG,KAAK,EACjB,cAAsB,EACtB,aAAiC,EACjC,CAAuB,EACD,EAAE;QACxB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;QAClB,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC;QACzB,OAAO;YACL,GAAG,CAAC;YACJ,QAAQ,EAAE;gBACR,MAAM,EAAE,cAAc;gBACtB,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,KAAK,CACV,WAAW,EACX,KAAK,IAAI,aAAa,EACtB,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,IAAI,aAAa,CAAC,CACjD,CAAC;IACJ,CAAC;IACD,IACE,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,MAAM;QACjB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,YAAY;QACvB,MAAM,KAAK,OAAO,EAClB,CAAC;QACD,yEAAyE;QACzE,4EAA4E;QAC5E,MAAM,wBAAwB,GAC5B,MAAM,KAAK,OAAO,IAAI,cAAc;YAClC,CAAC,CAAC,6BAA6B;YAC/B,CAAC,CAAC,eAAe,CAAC;QACtB,OAAO,KAAK,CACV,MAAM,EACN,KAAK;QACL,0EAA0E;QAC1E,4DAA4D;QAC5D,wBAAwB;YACtB,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,wBAAwB,CAAC;YACxE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CACjD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,8BAA8B;QAC9B,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;QACxE,OAAO,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,2EAA2E;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,mEAAmE;IACnE,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,+DAA+D;IAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAClC,OAAO,KAAK,CACV,WAAW,EACX,KAAK,IAAI,aAAa,EACtB,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,IAAI,aAAa,CAAC,CACjD,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,uEAAuE;IACvE,6EAA6E;IAC7E,+DAA+D;IAC/D,OAAO,KAAK,CACV,WAAW,EACX,KAAK,IAAI,aAAa,EACtB,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,IAAI,aAAa,CAAC,CACjD,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchwork-os",
-  "version": "1.2.0-beta.2.canary.625",
+  "version": "1.2.0-beta.2.canary.627",
   "description": "Your personal AI runtime, local-first. Patchwork OS gives any AI model a consistent set of tools, YAML recipes, a delegation policy with approval queue, and a durable trace memory — all on your machine, all under your policy.",
   "type": "module",
   "main": "dist/index.js",