patchwork-os 1.2.0-beta.2.canary.770 → 1.2.0-beta.2.canary.771

package/dist/gate.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The autonomy gate's public surface, for a consumer outside this package.
+ *
+ * ## Why this file exists at all
+ *
+ * `previewActions` already exists so that a screen showing "may do now / needs
+ * approval / not permitted" is computed by the SAME code that enforces it.
+ * Its own header states the reason: a preview holding policy of its own drifts,
+ * and the drift is silent and permissive — a screen reading "not permitted"
+ * where the gate would allow it tells an operator they are protected when they
+ * are not. `ControlBoundary.tsx` is presentational for the same reason.
+ *
+ * That guarantee held only inside this repository. `package.json` exposes two
+ * subpaths — `.` and `./plugin` — and `.` is `dist/index.js`, which is also the
+ * `bin`: importing the package root RUNS THE CLI rather than yielding a module.
+ * So an out-of-package consumer could not reach the gate at all, and its only
+ * remaining option was to re-derive the three buckets from `boundary_receipts
+ * .jsonl` and `worker_gate_decisions.jsonl` by hand — a second implementation
+ * of the boundary, arrived at not by anyone deciding to have one but by the
+ * export map being narrower than the guarantee.
+ *
+ * The compiled modules were already shipped (`files` carries `dist` wholesale),
+ * so nothing new is published here. What changes is that the seam is now NAMED,
+ * and a consumer gets the gate's answer instead of its ledger's residue.
+ *
+ * ## This is a re-export, and it must stay one
+ *
+ * Every binding below is the identity of the symbol it names. Nothing here
+ * wraps, adapts, defaults or "simplifies" — a barrel that computed anything
+ * would be the very second implementation the seam exists to prevent, sited
+ * where it looks most like plumbing. `gateBarrelIsPassThrough.test.ts` asserts
+ * reference identity against the source modules and fails if that changes.
+ *
+ * ## Scope: the decision, not the operation
+ *
+ * Exported: how an action is CLASSIFIED, what the gate DECIDES, and the types
+ * to say either. Not exported: anything that writes a ledger, mutates a dial or
+ * runs a recipe. A consumer of this surface asks questions; the runtime remains
+ * the only thing that acts.
+ */
+export { type AutonomyDecisionOpts, decideWorkerAction, disallowedToolsForAgentStep, flowsUngated, GATE_POLICY_VERSION, type GateOutcome, gateOutcomeFor, mergeAgentDisallowedTools, type ResolvedGateOutcome, resolveGateOutcome, type StandingPermissionContext, type WorkerGateAction, type WorkerGateDecision, } from "./workers/workerGate.js";
+export { type ActionBoundary, type CandidateAction, defaultCandidatesFor, type PreviewedAction, type PreviewOpts, previewActions, } from "./workers/previewActions.js";
+export { type ActionClass, AGENT_STEP_TOOL, classifyActionClass, knownActionDomains, knownActionTools, type MagnitudeBand, outcomeWeight, type Reversibility, reachableLevels, } from "./workers/actionClass.js";
+export { ownsAction, ownsClassKey, parseWorker, priorFor, WORKER_ID_RE, type WorkerCompetence, type WorkerManifest, WorkerParseError, } from "./workers/worker.js";
+export { loadWorkersFromDir } from "./workers/workerLoader.js";
+export { DEFAULT_PRIOR, DEFAULT_THRESHOLDS, evidenceCount, type LevelOpts, type LevelResult, levelFromPosterior, lowerConfidenceBound, type Posterior, posteriorMean, posteriorStddev, type TrustLevel, } from "./workers/trustLevel.js";
+export { type AppliedOutcome, type BoardRow, WorkerLevelStore, } from "./workers/workerLevelStore.js";
+export { describeForbidRules, type ForbidRule, type ForbidVerdict, isForbidden, type ParsedForbidRules, parseForbidRule, parseForbidRules, } from "./workers/forbidPolicy.js";
+export { type ContextRisk, contextRiskCeiling, } from "./workers/contextRisk.js";
+export { type CoverageOpts, coversAction, isActive, type PermissionCheck, type PermissionSubject, type StandingPermission, } from "./butler/standingPermission.js";

package/dist/gate.js

@@ -0,0 +1,70 @@
+/**
+ * The autonomy gate's public surface, for a consumer outside this package.
+ *
+ * ## Why this file exists at all
+ *
+ * `previewActions` already exists so that a screen showing "may do now / needs
+ * approval / not permitted" is computed by the SAME code that enforces it.
+ * Its own header states the reason: a preview holding policy of its own drifts,
+ * and the drift is silent and permissive — a screen reading "not permitted"
+ * where the gate would allow it tells an operator they are protected when they
+ * are not. `ControlBoundary.tsx` is presentational for the same reason.
+ *
+ * That guarantee held only inside this repository. `package.json` exposes two
+ * subpaths — `.` and `./plugin` — and `.` is `dist/index.js`, which is also the
+ * `bin`: importing the package root RUNS THE CLI rather than yielding a module.
+ * So an out-of-package consumer could not reach the gate at all, and its only
+ * remaining option was to re-derive the three buckets from `boundary_receipts
+ * .jsonl` and `worker_gate_decisions.jsonl` by hand — a second implementation
+ * of the boundary, arrived at not by anyone deciding to have one but by the
+ * export map being narrower than the guarantee.
+ *
+ * The compiled modules were already shipped (`files` carries `dist` wholesale),
+ * so nothing new is published here. What changes is that the seam is now NAMED,
+ * and a consumer gets the gate's answer instead of its ledger's residue.
+ *
+ * ## This is a re-export, and it must stay one
+ *
+ * Every binding below is the identity of the symbol it names. Nothing here
+ * wraps, adapts, defaults or "simplifies" — a barrel that computed anything
+ * would be the very second implementation the seam exists to prevent, sited
+ * where it looks most like plumbing. `gateBarrelIsPassThrough.test.ts` asserts
+ * reference identity against the source modules and fails if that changes.
+ *
+ * ## Scope: the decision, not the operation
+ *
+ * Exported: how an action is CLASSIFIED, what the gate DECIDES, and the types
+ * to say either. Not exported: anything that writes a ledger, mutates a dial or
+ * runs a recipe. A consumer of this surface asks questions; the runtime remains
+ * the only thing that acts.
+ */
+// ── The decision ─────────────────────────────────────────────────────────────
+export { decideWorkerAction, disallowedToolsForAgentStep, flowsUngated, GATE_POLICY_VERSION, gateOutcomeFor, mergeAgentDisallowedTools, resolveGateOutcome, } from "./workers/workerGate.js";
+// ── The prospective view (the three columns) ─────────────────────────────────
+export { defaultCandidatesFor, previewActions, } from "./workers/previewActions.js";
+// ── What an action IS ────────────────────────────────────────────────────────
+export { AGENT_STEP_TOOL, classifyActionClass, knownActionDomains, knownActionTools, outcomeWeight, reachableLevels, } from "./workers/actionClass.js";
+// ── Who the worker is, and what it owns ──────────────────────────────────────
+export { ownsAction, ownsClassKey, parseWorker, priorFor, WORKER_ID_RE, WorkerParseError, } from "./workers/worker.js";
+export { loadWorkersFromDir } from "./workers/workerLoader.js";
+// ── The trust dial ───────────────────────────────────────────────────────────
+export { DEFAULT_PRIOR, DEFAULT_THRESHOLDS, evidenceCount, levelFromPosterior, lowerConfidenceBound, posteriorMean, posteriorStddev, } from "./workers/trustLevel.js";
+export { WorkerLevelStore, } from "./workers/workerLevelStore.js";
+// ── The deny-list ────────────────────────────────────────────────────────────
+//
+// `parseForbidRules` REPORTS what it could not parse and drops it, which fails
+// OPEN — correct at runtime, where a banned action degrading to merely gated is
+// still recoverable because a human approves it. A consumer building a
+// repository gate must invert that (see `workers authority-delta`): "I could
+// not read your deny-list" may not resolve to "looks fine". The parser is
+// exported with its report intact so that inversion stays possible.
+export { describeForbidRules, isForbidden, parseForbidRule, parseForbidRules, } from "./workers/forbidPolicy.js";
+// ── Descending-only situational risk ─────────────────────────────────────────
+export { contextRiskCeiling, } from "./workers/contextRisk.js";
+// ── Standing permissions ─────────────────────────────────────────────────────
+//
+// A pre-recorded human approval, NOT earned trust, and deliberately not part of
+// the `min()` in `decideWorkerAction`. Exported so a consumer can render why an
+// action flowed without anyone being asked — never so it can grant one.
+export { coversAction, isActive, } from "./butler/standingPermission.js";
+//# sourceMappingURL=gate.js.map

package/dist/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,gFAAgF;AAEhF,OAAO,EAEL,kBAAkB,EAClB,2BAA2B,EAC3B,YAAY,EACZ,mBAAmB,EAEnB,cAAc,EACd,yBAAyB,EAEzB,kBAAkB,GAInB,MAAM,yBAAyB,CAAC;AAEjC,gFAAgF;AAEhF,OAAO,EAGL,oBAAoB,EAGpB,cAAc,GACf,MAAM,6BAA6B,CAAC;AAErC,gFAAgF;AAEhF,OAAO,EAEL,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAEhB,aAAa,EAEb,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAElC,gFAAgF;AAEhF,OAAO,EACL,UAAU,EACV,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,YAAY,EAGZ,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,gFAAgF;AAEhF,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,aAAa,EAGb,kBAAkB,EAClB,oBAAoB,EAEpB,aAAa,EACb,eAAe,GAEhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAGL,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AAEvC,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,uEAAuE;AACvE,6EAA6E;AAC7E,0EAA0E;AAC1E,oEAAoE;AAEpE,OAAO,EACL,mBAAmB,EAGnB,WAAW,EAEX,eAAe,EACf,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,gFAAgF;AAEhF,OAAO,EAEL,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAElC,gFAAgF;AAChF,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,wEAAwE;AAExE,OAAO,EAEL,YAAY,EACZ,QAAQ,GAIT,MAAM,gCAAgC,CAAC"}

package/dist/privacy.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The information boundary's public surface, for a consumer outside this
+ * package.
+ *
+ * ## Why this is a second barrel and not more of `./gate`
+ *
+ * They answer different questions and must stay separable. The autonomy gate
+ * answers *what may this worker DO*; the information boundary answers *what may
+ * this destination RECEIVE*. A consumer that conflated them would show a
+ * refusal under the wrong heading, and the two refusals have opposite remedies:
+ * a gated action waits for a person, a `LOCAL_ONLY` dispatch waits for a
+ * different destination.
+ *
+ * ## Same reason as `./gate`, applied to a second engine
+ *
+ * `decideBoundary` is a pure function of (declared classification, destination
+ * policy) with no model in the loop — deliberately, so it is replayable and
+ * testable, and so the boundary is not enforced by the thing it constrains.
+ * That makes it exactly the kind of decision an external console should CALL
+ * rather than reconstruct.
+ *
+ * Reconstructing it is the alternative, and it is worse than it looks. The
+ * residue in `boundary_receipts.jsonl` records what was decided, not the rule
+ * that decided it, so a console deriving the boundary from receipts would be
+ * inferring policy from outcomes — and would quietly disagree the moment a
+ * destination's clearances changed, in the direction that shows a refusal
+ * where there is now an allow.
+ *
+ * ## This is a re-export, and it must stay one
+ *
+ * Every binding below is the identity of the symbol it names. Nothing wraps,
+ * adapts or defaults. `privacySubpathExport.test.ts` asserts reference identity
+ * against the source modules and fails if that changes — the same guard, for
+ * the same reason, as the gate barrel.
+ *
+ * ## Scope: the decision, not the ledger
+ *
+ * Exported: how data is CLASSIFIED, which destination a dispatch RESOLVES to,
+ * what the boundary DECIDES, and how to describe a destination to a human. Not
+ * exported: `BoundaryReceiptLog` or anything else that writes. A consumer of
+ * this surface asks questions; the runtime remains the only thing that records.
+ */
+export { type BoundaryDecision, type BoundaryOutcome, CLASSIFICATIONS, type Classification, classificationRank, type DataPolicy, DEFAULT_CLASSIFICATION, type Destination, decideBoundary, narrowest, parseDataPolicy, } from "./privacy/dataPolicy.js";
+export { type DestinationConfig, isLocalFamilyDriver, type ParsedRegistry, type PrivacyConfig, parseRegistry, type ResolveDestinationOptions, type ResolvedDestination, resolveDestination, } from "./privacy/destinationRegistry.js";
+export { ALL_CLASSIFICATIONS, type DescribedDestination, type DescribeOptions, type DestinationNote, describeDestinations, disclosureFor, noteIsStale, } from "./privacy/describeDestinations.js";

package/dist/privacy.js

@@ -0,0 +1,64 @@
+/**
+ * The information boundary's public surface, for a consumer outside this
+ * package.
+ *
+ * ## Why this is a second barrel and not more of `./gate`
+ *
+ * They answer different questions and must stay separable. The autonomy gate
+ * answers *what may this worker DO*; the information boundary answers *what may
+ * this destination RECEIVE*. A consumer that conflated them would show a
+ * refusal under the wrong heading, and the two refusals have opposite remedies:
+ * a gated action waits for a person, a `LOCAL_ONLY` dispatch waits for a
+ * different destination.
+ *
+ * ## Same reason as `./gate`, applied to a second engine
+ *
+ * `decideBoundary` is a pure function of (declared classification, destination
+ * policy) with no model in the loop — deliberately, so it is replayable and
+ * testable, and so the boundary is not enforced by the thing it constrains.
+ * That makes it exactly the kind of decision an external console should CALL
+ * rather than reconstruct.
+ *
+ * Reconstructing it is the alternative, and it is worse than it looks. The
+ * residue in `boundary_receipts.jsonl` records what was decided, not the rule
+ * that decided it, so a console deriving the boundary from receipts would be
+ * inferring policy from outcomes — and would quietly disagree the moment a
+ * destination's clearances changed, in the direction that shows a refusal
+ * where there is now an allow.
+ *
+ * ## This is a re-export, and it must stay one
+ *
+ * Every binding below is the identity of the symbol it names. Nothing wraps,
+ * adapts or defaults. `privacySubpathExport.test.ts` asserts reference identity
+ * against the source modules and fails if that changes — the same guard, for
+ * the same reason, as the gate barrel.
+ *
+ * ## Scope: the decision, not the ledger
+ *
+ * Exported: how data is CLASSIFIED, which destination a dispatch RESOLVES to,
+ * what the boundary DECIDES, and how to describe a destination to a human. Not
+ * exported: `BoundaryReceiptLog` or anything else that writes. A consumer of
+ * this surface asks questions; the runtime remains the only thing that records.
+ */
+// ── What the data is, and what a destination may receive ─────────────────────
+export { CLASSIFICATIONS, classificationRank, DEFAULT_CLASSIFICATION, decideBoundary, narrowest, parseDataPolicy, } from "./privacy/dataPolicy.js";
+// ── Which destination a dispatch actually resolves to ────────────────────────
+//
+// `resolveDestination` returns `localDestinationAccepts` alongside the
+// destination, and BOTH must be passed to `decideBoundary`. Dropping the second
+// is not a cosmetic omission: it turns `LOCAL_ONLY` ("a local destination
+// accepts this — set `driver: local`") into `DENY` ("no approval can unlock
+// it"). Nothing leaks either way, which is why that defect survives review; it
+// is wrong in the SENTENCE, telling an operator their situation is unfixable
+// while a registered local destination would take the data.
+export { isLocalFamilyDriver, parseRegistry, resolveDestination, } from "./privacy/destinationRegistry.js";
+// ── Saying what a destination is, to a person ────────────────────────────────
+//
+// The disclosure states only what is true by construction: whether the prompt
+// leaves the machine, over the network, to the named destination. It carries no
+// retention period, deletion promise or training claim, because such a claim
+// rots without a code change and a claim the code cannot keep is worse than
+// none — it is believed. Provider behaviour belongs in an operator `note`, and
+// an undated or stale note is reported as undated or stale.
+export { ALL_CLASSIFICATIONS, describeDestinations, disclosureFor, noteIsStale, } from "./privacy/describeDestinations.js";
+//# sourceMappingURL=privacy.js.map

package/dist/privacy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy.js","sourceRoot":"","sources":["../src/privacy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,gFAAgF;AAEhF,OAAO,EAGL,eAAe,EAEf,kBAAkB,EAElB,sBAAsB,EAEtB,cAAc,EACd,SAAS,EACT,eAAe,GAChB,MAAM,yBAAyB,CAAC;AAEjC,gFAAgF;AAChF,EAAE;AACF,uEAAuE;AACvE,gFAAgF;AAChF,0EAA0E;AAC1E,4EAA4E;AAC5E,+EAA+E;AAC/E,6EAA6E;AAC7E,4DAA4D;AAE5D,OAAO,EAEL,mBAAmB,EAGnB,aAAa,EAGb,kBAAkB,GACnB,MAAM,kCAAkC,CAAC;AAE1C,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,6EAA6E;AAC7E,4EAA4E;AAC5E,+EAA+E;AAC/E,4DAA4D;AAE5D,OAAO,EACL,mBAAmB,EAInB,oBAAoB,EACpB,aAAa,EACb,WAAW,GACZ,MAAM,mCAAmC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchwork-os",
-  "version": "1.2.0-beta.2.canary.770",
+  "version": "1.2.0-beta.2.canary.771",
   "description": "Your personal AI runtime, local-first. Patchwork OS gives any AI model a consistent set of tools, YAML recipes, a delegation policy with approval queue, and a durable trace memory — all on your machine, all under your policy.",
   "type": "module",
   "main": "dist/index.js",
@@ -13,6 +13,14 @@
     "./plugin": {
       "import": "./dist/plugin.js",
       "types": "./dist/plugin.d.ts"
+    },
+    "./gate": {
+      "import": "./dist/gate.js",
+      "types": "./dist/gate.d.ts"
+    },
+    "./privacy": {
+      "import": "./dist/privacy.js",
+      "types": "./dist/privacy.d.ts"
     }
   },
   "bin": {