patchwork-os 1.2.0-beta.2.canary.714 → 1.2.0-beta.2.canary.720

package/dist/privacy/boundaryReceipts.d.ts

@@ -0,0 +1,78 @@
+import type { BoundaryDecision, Classification } from "./dataPolicy.js";
+export declare const BOUNDARY_RECEIPTS_BASENAME = "boundary_receipts.jsonl";
+export declare function boundaryReceiptsPath(dir?: string): string;
+/**
+ * One receipt as this module is willing to hand it onward.
+ *
+ * An explicit field list, not a pass-through of the parsed row. The receipt
+ * type has no payload field, but a reader that spread whatever it found on
+ * disk would publish one the moment anything else wrote one.
+ */
+export interface BoundaryReceiptView {
+    seq?: number;
+    at: number;
+    decision: BoundaryDecision;
+    classification: Classification;
+    categories?: string[];
+    destinationId: string;
+    destinationType?: "local" | "remote";
+    redactCategories?: string[];
+    reason: string;
+    recipeName?: string;
+    workspaceId?: string;
+}
+export interface BoundaryReceiptsSummary {
+    /** The denominator: every decision recorded, INCLUDING the allowed ones. */
+    recorded: number;
+    /**
+     * Decisions that were not a plain ALLOW — refused, rerouted, redacted or
+     * escalated. Never rendered without `recorded` beside it.
+     */
+    refusals: number;
+    byDecision: Record<string, number>;
+    byDestination: Record<string, number>;
+    byClassification: Record<string, number>;
+    /**
+     * Recipe -> how many of ITS dispatches were not plain ALLOW.
+     *
+     * A to-do list rather than another statistic: the remedy for a refusal is
+     * usually to fix the step that produced it, and #1469 established that a
+     * count with no recipe leaves an operator guessing between every installed
+     * recipe.
+     */
+    refusalsByRecipe: Record<string, number>;
+    /**
+     * Refusals carrying no recipe name — rows written before attribution
+     * existed. Reported rather than dropped so
+     * `sum(refusalsByRecipe) + refusalsUnattributed === refusals` holds.
+     */
+    refusalsUnattributed: number;
+    earliest?: number;
+    latest?: number;
+    /** Echoed back so a filtered report cannot be mistaken for the whole ledger. */
+    since?: number;
+    /** Lines that could not be parsed. Reported, never silently skipped. */
+    unreadableLines: number;
+    /** True only if a caller-supplied row limit actually cut the ledger short. */
+    truncated: boolean;
+    recent: BoundaryReceiptView[];
+}
+export interface SummariseReceiptsOptions {
+    /** Directory holding the ledger. Defaults to `${PATCHWORK_HOME}`. */
+    dir?: string;
+    /** Only count decisions at or after this timestamp. */
+    since?: number;
+    /** How many receipts to carry in `recent`. Does not affect the counts. */
+    recentLimit?: number;
+    /** Stop after this many rows. Sets `truncated` when it bites. */
+    maxRows?: number;
+}
+export declare function summariseBoundaryReceipts(opts?: SummariseReceiptsOptions): BoundaryReceiptsSummary;
+/**
+ * Render the denominator FIRST, and never a bare refusal count.
+ *
+ * Same doctrine as `formatPrivacyShadow`, for the same reason: "2 refusals"
+ * invites the reading that everything else was fine, and on an empty ledger it
+ * would state a clean bill of health for a boundary that has never run.
+ */
+export declare function formatBoundaryReceipts(s: BoundaryReceiptsSummary): string;

package/dist/privacy/boundaryReceipts.js

@@ -0,0 +1,203 @@
+/**
+ * Reader for the information-boundary receipt ledger (ADR-0021).
+ *
+ * ## Why this file exists at all
+ *
+ * `boundary_receipts.jsonl` was WRITE-ONLY in this repository. Every ADR-0021
+ * enforcement decision was recorded, and `BoundaryReceiptLog.recent()` /
+ * `.summary()` — the two methods whose own comment says they are "the shape a
+ * dashboard or CLI summary wants" — had no production caller, no CLI verb, no
+ * HTTP route and no page. The only thing in the workspace that read this
+ * ledger lived in the separate, non-MIT control plane.
+ *
+ * ADR-0019:88-92 forbids precisely that: the local ledgers must stay fully
+ * usable standalone, and degrading them in the direction that pushes someone
+ * toward the paid product is the failure the open-core boundary was written to
+ * prevent. ADR-0021:404-406 gives the sharper version — "people need to be able
+ * to read the code that decides whether their confidential information leaves
+ * the machine". Reading the code is worthless if you cannot read what it
+ * decided. Nobody chose this; it happened by default, which is what made it
+ * worth fixing before adding anything else.
+ *
+ * ## Why it reads the FILE and not the class
+ *
+ * `BoundaryReceiptLog` trims its in-memory array to 500 rows on load and again
+ * on every write. A summary built on `.summary()` therefore answers over the
+ * most recent 500 receipts while presenting as a total — a wrong denominator
+ * on the one screen whose entire job is to state the denominator. This module
+ * reads the ledger from disk for the same reason `summarisePrivacyShadow`
+ * does, and the two now share a shape deliberately.
+ *
+ * ## What it must never do
+ *
+ * Surface a payload. The receipt type has no field for one by construction;
+ * this reader additionally copies only whitelisted keys, so a hand-edited or
+ * future-writer row carrying a prompt cannot turn the viewer into the thing
+ * that publishes it.
+ */
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { patchworkPath } from "../patchworkHome.js";
+export const BOUNDARY_RECEIPTS_BASENAME = "boundary_receipts.jsonl";
+/** How many receipts the detail list carries. The summary counts all of them. */
+const DEFAULT_RECENT = 20;
+export function boundaryReceiptsPath(dir) {
+    return dir
+        ? path.join(dir, BOUNDARY_RECEIPTS_BASENAME)
+        : patchworkPath(BOUNDARY_RECEIPTS_BASENAME);
+}
+function view(r) {
+    if (typeof r.at !== "number" || typeof r.decision !== "string")
+        return null;
+    const str = (k) => typeof r[k] === "string" ? r[k] : undefined;
+    const arr = (k) => Array.isArray(r[k])
+        ? r[k].filter((x) => typeof x === "string")
+        : undefined;
+    const dt = str("destinationType");
+    return {
+        ...(typeof r.seq === "number" ? { seq: r.seq } : {}),
+        at: r.at,
+        decision: r.decision,
+        classification: (str("classification") ?? "internal"),
+        ...(arr("categories")?.length ? { categories: arr("categories") } : {}),
+        destinationId: str("destinationId") ?? "",
+        ...(dt === "local" || dt === "remote" ? { destinationType: dt } : {}),
+        ...(arr("redactCategories")?.length
+            ? { redactCategories: arr("redactCategories") }
+            : {}),
+        reason: str("reason") ?? "",
+        ...(str("recipeName") ? { recipeName: str("recipeName") } : {}),
+        ...(str("workspaceId") ? { workspaceId: str("workspaceId") } : {}),
+    };
+}
+export function summariseBoundaryReceipts(opts = {}) {
+    const s = {
+        recorded: 0,
+        refusals: 0,
+        byDecision: {},
+        byDestination: {},
+        byClassification: {},
+        refusalsByRecipe: {},
+        refusalsUnattributed: 0,
+        unreadableLines: 0,
+        truncated: false,
+        recent: [],
+        ...(opts.since !== undefined ? { since: opts.since } : {}),
+    };
+    let text;
+    try {
+        text = readFileSync(boundaryReceiptsPath(opts.dir), "utf-8");
+    }
+    catch {
+        // No ledger yet. Rendered as "nothing recorded" — never as "0 refusals",
+        // which would read as a clean bill of health for a boundary that has not
+        // run.
+        return s;
+    }
+    const kept = [];
+    for (const line of text.split("\n")) {
+        const t = line.trim();
+        if (!t)
+            continue;
+        if (opts.maxRows !== undefined && s.recorded >= opts.maxRows) {
+            s.truncated = true;
+            break;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(t);
+        }
+        catch {
+            s.unreadableLines += 1;
+            continue;
+        }
+        const v = view(parsed);
+        if (!v) {
+            s.unreadableLines += 1;
+            continue;
+        }
+        if (opts.since !== undefined && v.at < opts.since)
+            continue;
+        s.recorded += 1;
+        s.byDecision[v.decision] = (s.byDecision[v.decision] ?? 0) + 1;
+        if (v.destinationId) {
+            s.byDestination[v.destinationId] =
+                (s.byDestination[v.destinationId] ?? 0) + 1;
+        }
+        s.byClassification[v.classification] =
+            (s.byClassification[v.classification] ?? 0) + 1;
+        if (v.decision !== "ALLOW") {
+            s.refusals += 1;
+            if (v.recipeName) {
+                s.refusalsByRecipe[v.recipeName] =
+                    (s.refusalsByRecipe[v.recipeName] ?? 0) + 1;
+            }
+            else {
+                s.refusalsUnattributed += 1;
+            }
+        }
+        if (s.earliest === undefined || v.at < s.earliest)
+            s.earliest = v.at;
+        if (s.latest === undefined || v.at > s.latest)
+            s.latest = v.at;
+        kept.push(v);
+    }
+    s.recent = kept.slice(-(opts.recentLimit ?? DEFAULT_RECENT)).reverse();
+    return s;
+}
+const PAD = 16;
+/**
+ * Render the denominator FIRST, and never a bare refusal count.
+ *
+ * Same doctrine as `formatPrivacyShadow`, for the same reason: "2 refusals"
+ * invites the reading that everything else was fine, and on an empty ledger it
+ * would state a clean bill of health for a boundary that has never run.
+ */
+export function formatBoundaryReceipts(s) {
+    const L = [];
+    if (s.recorded === 0) {
+        L.push("[privacy-receipts] nothing recorded");
+        L.push(s.unreadableLines > 0
+            ? `  The ledger exists but no line in it could be read (${s.unreadableLines} unreadable).`
+            : "  The boundary has written no receipt in this workspace.");
+        L.push("  That means no agent step has dispatched since it was enabled, or no");
+        L.push("  destination is registered under `privacy.destinations` — the boundary");
+        L.push("  is inert until one is. It does NOT mean nothing was refused.");
+        return L.join("\n");
+    }
+    L.push(`[privacy-receipts] ${s.recorded} boundary decisions recorded`);
+    if (s.since !== undefined) {
+        L.push(`  window        since ${new Date(s.since).toISOString()}`);
+    }
+    else if (s.earliest !== undefined && s.latest !== undefined) {
+        L.push(`  window        ${new Date(s.earliest).toISOString()} → ${new Date(s.latest).toISOString()}`);
+    }
+    L.push(`  ${s.refusals} of ${s.recorded} were refused, rerouted or held for approval`);
+    L.push("  by decision");
+    for (const [k, v] of Object.entries(s.byDecision).sort((a, b) => b[1] - a[1])) {
+        L.push(`    ${k.padEnd(PAD)} ${String(v).padStart(5)}`);
+    }
+    L.push("  by destination");
+    for (const [k, v] of Object.entries(s.byDestination).sort((a, b) => b[1] - a[1])) {
+        L.push(`    ${k.padEnd(PAD)} ${String(v).padStart(5)}`);
+    }
+    const recipes = Object.entries(s.refusalsByRecipe).sort((a, b) => b[1] - a[1]);
+    if (recipes.length || s.refusalsUnattributed) {
+        L.push("  refusals by recipe — the fix list");
+        for (const [k, v] of recipes) {
+            L.push(`    ${k.padEnd(PAD)} ${String(v).padStart(5)}`);
+        }
+        if (s.refusalsUnattributed) {
+            L.push(`    ${"(unattributed)".padEnd(PAD)} ${String(s.refusalsUnattributed).padStart(5)}`);
+        }
+    }
+    if (s.unreadableLines > 0) {
+        L.push(`  ${s.unreadableLines} unreadable line(s) skipped`);
+    }
+    if (s.truncated) {
+        L.push("  TRUNCATED — a row limit cut this short; counts are a floor");
+    }
+    L.push("  (declared metadata only — this ledger has no field for the prompt)");
+    return L.join("\n");
+}
+//# sourceMappingURL=boundaryReceipts.js.map

package/dist/privacy/boundaryReceipts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundaryReceipts.js","sourceRoot":"","sources":["../../src/privacy/boundaryReceipts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,MAAM,CAAC,MAAM,0BAA0B,GAAG,yBAAyB,CAAC;AAEpE,iFAAiF;AACjF,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,OAAO,GAAG;QACR,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,0BAA0B,CAAC;QAC5C,CAAC,CAAC,aAAa,CAAC,0BAA0B,CAAC,CAAC;AAChD,CAAC;AAuED,SAAS,IAAI,CAAC,CAA0B;IACtC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5E,MAAM,GAAG,GAAG,CAAC,CAAS,EAAsB,EAAE,CAC5C,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,MAAM,GAAG,GAAG,CAAC,CAAS,EAAwB,EAAE,CAC9C,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC,CAAE,CAAC,CAAC,CAAC,CAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACvE,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,EAAE,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAClC,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,CAAC,CAAC,QAA4B;QACxC,cAAc,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,UAAU,CAAmB;QACvE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,aAAa,EAAE,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE;QACzC,GAAG,CAAC,EAAE,KAAK,OAAO,IAAI,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,MAAM;YACjC,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,kBAAkB,CAAC,EAAE;YAC/C,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;QAC3B,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,OAAiC,EAAE;IAEnC,MAAM,CAAC,GAA4B;QACjC,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,CAAC;QACX,UAAU,EAAE,EAAE;QACd,aAAa,EAAE,EAAE;QACjB,gBAAgB,EAAE,EAAE;QACpB,gBAAgB,EAAE,EAAE;QACpB,oBAAoB,EAAE,CAAC;QACvB,eAAe,EAAE,CAAC;QAClB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,EAAE;QACV,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;IAEF,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,yEAAyE;QACzE,OAAO;QACP,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,IAAI,GAA0B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7D,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC;YACnB,MAAM;QACR,CAAC;QACD,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAA4B,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK;YAAE,SAAS;QAE5D,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;YACpB,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC;gBAC9B,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;QACD,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC;YAClC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC3B,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;YAChB,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;gBACjB,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC;oBAC9B,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACN,CAAC,CAAC,oBAAoB,IAAI,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ;YAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM;YAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IAED,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACvE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,GAAG,GAAG,EAAE,CAAC;AAEf;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,CAA0B;IAC/D,MAAM,CAAC,GAAa,EAAE,CAAC;IACvB,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAC9C,CAAC,CAAC,IAAI,CACJ,CAAC,CAAC,eAAe,GAAG,CAAC;YACnB,CAAC,CAAC,wDAAwD,CAAC,CAAC,eAAe,eAAe;YAC1F,CAAC,CAAC,0DAA0D,CAC/D,CAAC;QACF,CAAC,CAAC,IAAI,CACJ,uEAAuE,CACxE,CAAC;QACF,CAAC,CAAC,IAAI,CACJ,yEAAyE,CAC1E,CAAC;QACF,CAAC,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,QAAQ,8BAA8B,CAAC,CAAC;IACvE,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,CAAC,CAAC,IAAI,CAAC,yBAAyB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;SAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9D,CAAC,CAAC,IAAI,CACJ,mBAAmB,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAC9F,CAAC;IACJ,CAAC;IACD,CAAC,CAAC,IAAI,CACJ,KAAK,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,QAAQ,8CAA8C,CAC/E,CAAC;IAEF,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACxB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CACpD,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACtB,EAAE,CAAC;QACF,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC3B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CACvD,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACtB,EAAE,CAAC;QACF,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,IAAI,CACrD,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACtB,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAC7C,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;YAC7B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,CAAC,oBAAoB,EAAE,CAAC;YAC3B,CAAC,CAAC,IAAI,CACJ,OAAO,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;QAC1B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,eAAe,6BAA6B,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAChB,CAAC,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IACzE,CAAC;IACD,CAAC,CAAC,IAAI,CACJ,sEAAsE,CACvE,CAAC;IACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC"}

package/dist/promptSafety.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Prompt-structure safety, shared by every surface that renders stored text
+ * into the instructions block.
+ *
+ * ## Why this is its own module
+ *
+ * It used to live in `src/butler/memoryCard.ts`, and the session traces digest
+ * — which renders into the SAME prompt from `buildInstructions()`, a few lines
+ * away — did not call it. One prompt-rendering path was hardened and its
+ * neighbour was not: the partial-surface failure this codebase keeps
+ * rediscovering. `AGENT_STEP_TOOL` was centralised for exactly this reason —
+ * two sites holding the same rule independently is how they drift.
+ *
+ * The digest is the sharper of the two cases. Butler facts are graded by
+ * provenance, and anything merely READ from a connector is held below the
+ * card's origination floor. A decision trace is written by `ctxSaveTrace` — a
+ * tool any connected agent can call — and is spliced into every session's
+ * instructions within 12 hours, ordered by recency alone, with no verification.
+ * Both the write and the read are agent-reachable, so the render is the only
+ * place the structure can be defended.
+ *
+ * ## What this is NOT
+ *
+ * Not a content filter, and it must never become one. It cannot tell whether a
+ * stored lesson is true, sensible or hostile — only that it cannot forge the
+ * SHAPE of an instruction. Judging the content would be detection, which
+ * ADR-0021 rejects as a boundary for the same reason.
+ */
+export declare function sanitizeForPrompt(s: string): string;

package/dist/promptSafety.js

@@ -0,0 +1,55 @@
+/**
+ * Prompt-structure safety, shared by every surface that renders stored text
+ * into the instructions block.
+ *
+ * ## Why this is its own module
+ *
+ * It used to live in `src/butler/memoryCard.ts`, and the session traces digest
+ * — which renders into the SAME prompt from `buildInstructions()`, a few lines
+ * away — did not call it. One prompt-rendering path was hardened and its
+ * neighbour was not: the partial-surface failure this codebase keeps
+ * rediscovering. `AGENT_STEP_TOOL` was centralised for exactly this reason —
+ * two sites holding the same rule independently is how they drift.
+ *
+ * The digest is the sharper of the two cases. Butler facts are graded by
+ * provenance, and anything merely READ from a connector is held below the
+ * card's origination floor. A decision trace is written by `ctxSaveTrace` — a
+ * tool any connected agent can call — and is spliced into every session's
+ * instructions within 12 hours, ordered by recency alone, with no verification.
+ * Both the write and the read are agent-reachable, so the render is the only
+ * place the structure can be defended.
+ *
+ * ## What this is NOT
+ *
+ * Not a content filter, and it must never become one. It cannot tell whether a
+ * stored lesson is true, sensible or hostile — only that it cannot forge the
+ * SHAPE of an instruction. Judging the content would be detection, which
+ * ADR-0021 rejects as a boundary for the same reason.
+ */
+/**
+ * Collapse anything that could forge structure in the instructions block.
+ *
+ * This card renders fact text straight into a SYSTEM PROMPT. The store
+ * deliberately accepts any UTF-8 except NUL (a belief is arbitrary text), so
+ * the safety boundary has to be here, at the point of rendering — and it has
+ * to be here rather than at write time, because rows written before this
+ * existed are already on disk.
+ *
+ * Stripped:
+ *   - C0/C1 controls including \n and \r — a newline lets a value emit a
+ *     second line and impersonate a real instruction heading; a lone \r
+ *     rewrites the line in a terminal render.
+ *   - U+2028/U+2029 — Unicode line/paragraph separators, newlines by another
+ *     name in most renderers.
+ *   - U+202A–U+202E, U+2066–U+2069 — bidi overrides, which reorder displayed
+ *     text without changing the bytes, so a value can appear to say something
+ *     other than what is stored.
+ *
+ * Replaced with a space, not removed: deleting them would silently join words
+ * that were separate, which changes the meaning of the belief.
+ */
+const UNSAFE_IN_PROMPT = /[\u0000-\u001F\u007F-\u009F\u2028\u2029\u202A-\u202E\u2066-\u2069]/g;
+export function sanitizeForPrompt(s) {
+    return s.replace(UNSAFE_IN_PROMPT, " ").replace(/\s+/g, " ").trim();
+}
+//# sourceMappingURL=promptSafety.js.map

package/dist/promptSafety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"promptSafety.js","sourceRoot":"","sources":["../src/promptSafety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,gBAAgB,GACpB,qEAAqE,CAAC;AAExE,MAAM,UAAU,iBAAiB,CAAC,CAAS;IACzC,OAAO,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACtE,CAAC"}

package/dist/recipeRoutes.js

@@ -36,6 +36,7 @@ import { consumeToken, refillBucket, } from "./fp/tokenBucket.js";
 import { respondIfUnknownBodyKeys } from "./httpBodyValidation.js";
 import { respond500 } from "./httpErrorResponse.js";
 import { patchworkPath } from "./patchworkHome.js";
+import { summariseBoundaryReceipts } from "./privacy/boundaryReceipts.js";
 import { cancelRun } from "./recipes/runRegistry.js";
 import { invalidateRecipesCache } from "./recipesHttp.js";
 import { validateSafeUrl } from "./ssrfGuard.js";
@@ -684,6 +685,33 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
         }
         return true;
     }
+    // GET /privacy/receipts — what the LIVE information boundary actually decided.
+    //
+    // Sibling of the `patchwork privacy receipts` verb and, like it, reads the
+    // ledger FROM DISK rather than through `BoundaryReceiptLog`, whose in-memory
+    // array is capped at 500 rows — a cap that would silently become this
+    // endpoint's denominator. Imported directly rather than injected because it
+    // is a pure file read keyed on PATCHWORK_HOME, which is also how a test
+    // redirects it.
+    if (parsedUrl.pathname === "/privacy/receipts" && req.method === "GET") {
+        try {
+            const sp = parsedUrl.searchParams;
+            const sinceMsRaw = sp.get("sinceMs");
+            const sinceMs = sinceMsRaw ? Number.parseInt(sinceMsRaw, 10) : Number.NaN;
+            const limitRaw = sp.get("limit");
+            const limit = limitRaw ? Number.parseInt(limitRaw, 10) : Number.NaN;
+            const summary = summariseBoundaryReceipts({
+                ...(Number.isFinite(sinceMs) && { since: sinceMs }),
+                ...(Number.isFinite(limit) && limit > 0 && { recentLimit: limit }),
+            });
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify(summary));
+        }
+        catch (err) {
+            respond500(res, err);
+        }
+        return true;
+    }
     // GET /runs/judge-summary — PR3b sibling of /runs/halt-summary.
     // Same query shape (sinceMs, limit, recipe), returns JudgeSummary.
     if (parsedUrl.pathname === "/runs/judge-summary" && req.method === "GET") {