watchmyagents 1.4.0 → 1.4.3

package/src/fortress/url.js

@@ -21,29 +21,103 @@
  */
 export function resolveFortressBase({ explicitUrl, explicitBase, env = process.env } = {}) {
   // 1. Explicit base URL from CLI
-  if (explicitBase) return stripTrailingSlash(explicitBase);
+  if (explicitBase) return assertSafeFortressBase(stripTrailingSlash(explicitBase));
 
   // 2. Env: WMA_FORTRESS_BASE_URL (preferred)
-  if (env.WMA_FORTRESS_BASE_URL) return stripTrailingSlash(env.WMA_FORTRESS_BASE_URL);
+  if (env.WMA_FORTRESS_BASE_URL) return assertSafeFortressBase(stripTrailingSlash(env.WMA_FORTRESS_BASE_URL));
 
   // 3. Legacy: WMA_FORTRESS_URL (full path to ingest-signals)
   const legacy = explicitUrl || env.WMA_FORTRESS_URL;
   if (legacy) {
     // Strip last path segment to get the base
+    let derived;
     try {
       const u = new URL(legacy);
       const parts = u.pathname.split('/').filter(Boolean);
       if (parts.length > 0) parts.pop();
       u.pathname = '/' + parts.join('/');
-      return stripTrailingSlash(u.toString());
+      derived = stripTrailingSlash(u.toString());
     } catch {
       return null;
     }
+    return assertSafeFortressBase(derived);
   }
 
   return null;
 }
 
+// v1.4.2 F-47 (P1->P2 audit) — SSRF guard on the operator-supplied Fortress
+// base URL. WMA POSTs the customer's Bearer API key + signals/decisions to
+// this URL and PULLS live-enforcement policies from it, so an attacker who can
+// influence the SDK's environment (templated deploy, shared .env, compromised
+// orchestration layer) could previously point it at http://, an internal
+// host, or a cloud metadata endpoint (169.254.169.254) and exfiltrate the key
+// — the only prior check was `protocol === 'https:'` at the request layer.
+//
+// We require https, reject embedded credentials, and reject IP-LITERAL hosts
+// in private / loopback / link-local / ULA ranges (the direct metadata-
+// endpoint vector). We deliberately do NOT pin to *.supabase.co because
+// operators self-host Fortress; any PUBLIC host is allowed. Residual:
+// DNS-rebinding (a public hostname resolving to a private IP) is not caught
+// here — that needs per-request resolved-IP pinning, out of scope for a sync
+// URL validator. Throws (fail-loud) on a bad URL rather than returning null,
+// so a misconfigured/hostile endpoint stops the run instead of silently
+// disabling upload/enforcement.
+export function assertSafeFortressBase(base) {
+  let u;
+  try { u = new URL(base); }
+  catch { throw new Error(`Fortress base URL is not a valid URL: ${base}`); }
+
+  if (u.protocol !== 'https:') {
+    throw new Error(`Fortress base URL must use https:// (got ${u.protocol}//). Refusing to send credentials over ${u.protocol}//.`);
+  }
+  if (u.username || u.password) {
+    throw new Error('Fortress base URL must not embed credentials (user:pass@host).');
+  }
+  if (isBlockedHost(u.hostname)) {
+    throw new Error(
+      `Fortress base URL host "${u.hostname}" is a private/loopback/link-local address — refusing (SSRF guard). ` +
+      'Point WMA_FORTRESS_BASE_URL at your public Fortress endpoint.',
+    );
+  }
+  return base;
+}
+
+// True if the host is an IP literal in a private/loopback/link-local/ULA range,
+// or localhost. Public hostnames and public IPs pass.
+function isBlockedHost(hostname) {
+  // Node keeps surrounding brackets on IPv6 hostnames (e.g. "[::1]"); strip them.
+  const h = hostname.toLowerCase().replace(/^\[/, '').replace(/\]$/, '');
+  if (h === 'localhost' || h.endsWith('.localhost')) return true;
+
+  // IPv6 literal. Normalize IPv4-mapped form.
+  if (h.includes(':')) {
+    if (h === '::1' || h === '::') return true;                 // loopback / unspecified
+    if (h.startsWith('fe8') || h.startsWith('fe9') || h.startsWith('fea') || h.startsWith('feb')) return true; // fe80::/10 link-local
+    if (h.startsWith('fc') || h.startsWith('fd')) return true;  // fc00::/7 unique-local
+    const mapped = h.match(/::ffff:(\d+\.\d+\.\d+\.\d+)$/);     // IPv4-mapped IPv6
+    if (mapped) return isBlockedIpv4(mapped[1]);
+    return false;
+  }
+
+  // IPv4 literal?
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(h)) return isBlockedIpv4(h);
+  return false;
+}
+
+function isBlockedIpv4(ip) {
+  const o = ip.split('.').map(Number);
+  if (o.length !== 4 || o.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) return true; // malformed → block
+  const [a, b] = o;
+  if (a === 127) return true;                          // 127.0.0.0/8 loopback
+  if (a === 10) return true;                            // 10.0.0.0/8 private
+  if (a === 172 && b >= 16 && b <= 31) return true;     // 172.16.0.0/12 private
+  if (a === 192 && b === 168) return true;              // 192.168.0.0/16 private
+  if (a === 169 && b === 254) return true;              // 169.254.0.0/16 link-local (cloud metadata)
+  if (a === 0) return true;                             // 0.0.0.0/8
+  return false;
+}
+
 function stripTrailingSlash(s) {
   return s.endsWith('/') ? s.slice(0, -1) : s;
 }

package/src/logger.js

@@ -16,6 +16,14 @@ async function tightenMode(path, mode) {
   try { await chmod(path, mode); } catch { /* not fatal */ }
 }
 
+// v1.4.1 F-34 (P2 Codex audit on v1.4.0): re-exported so other writers
+// of WMA-controlled log paths can defend against the same loose-perms
+// trap (mkdir/appendFile `mode` is creation-only). Used by:
+//   scripts/fetch-anthropic.js --dump-raw  (raw API events on disk)
+//   any future code path that mkdir/appendFile into a customer log dir
+// Best-effort by design — failure of chmod must NOT break log writes.
+export { tightenMode };
+
 // PR-B: `framework` → `provider` (canonical name per src/sources/contract.js).
 // PR-C: adds `parent_agent_id` + `composition_pattern` so any future
 // adapter that knows the hierarchy (OpenAI Agents handoffs, CrewAI

package/src/shield/decisions.js

@@ -52,6 +52,16 @@ export class DecisionLogger {
     message,
     decidedInMs,
     mode,             // v1.1.3 Phase 1.D: 'enforce' | 'shadow' (default 'enforce' if absent)
+    // v1.4.2 F-44 (P1 audit): the ACTUAL outcome of the enforcement API call,
+    // captured by the caller AFTER it attempts confirmDeny / interruptSession.
+    //   true      → the block/interrupt landed (confirmed delivered)
+    //   false     → the call FAILED after retries; the violating action was
+    //               NOT blocked on the wire (silent fail-open if we lied here)
+    //   undefined → not applicable (allow / shadow / non-enforcing caller).
+    // Pre-F-44 the row claimed "enforced" purely from mode+decision, before
+    // (and regardless of) the API call — so the tamper-evident audit chain
+    // could assert a block that never happened.
+    enforcementDelivered,
   }) {
     // In shadow mode the decision is computed and logged but NOT enforced.
     // status must reflect what actually happened on the wire: shadow + deny
@@ -61,25 +71,38 @@ export class DecisionLogger {
     const effectiveMode = mode || 'enforce';
     const enforced = effectiveMode === 'enforce'
       && (decision === 'deny' || decision === 'interrupt');
+    // F-44: enforcement was ATTEMPTED but FAILED → the action was NOT blocked.
+    // Surface that honestly instead of recording a clean block.
+    const failedDelivery = enforced && enforcementDelivered === false;
+
+    const output = {
+      decision,
+      rule_id: ruleId,
+      rule_name: ruleName,
+      message,
+      mode: effectiveMode,
+    };
+    // Only add the field when enforcement was actually attempted, so allow /
+    // shadow / pre-F-44 callers keep their exact record shape.
+    if (enforcementDelivered !== undefined) {
+      output.enforcement_delivered = enforcementDelivered;
+    }
+
     return this._logger.write({
       action_type: 'shield_decision',
       provider: this._provider,
       tool_name: sourceEvent?.name || sourceEvent?.tool_name || null,
       status: enforced ? 'error' : 'ok',
-      error: enforced ? message : null,
+      error: failedDelivery
+        ? `ENFORCEMENT FAILED (action NOT blocked): ${message || ruleName || 'policy violation'}`
+        : (enforced ? message : null),
       duration_ms: decidedInMs ?? null,
       input: {
         source_event_id: sourceEvent?.id || null,
         source_event_type: sourceEvent?.type || null,
         tool_input: sourceEvent?.input ?? null,
       },
-      output: {
-        decision,
-        rule_id: ruleId,
-        rule_name: ruleName,
-        message,
-        mode: effectiveMode,
-      },
+      output,
     });
   }
 }

package/src/shield/policy.js

@@ -24,6 +24,7 @@
 // Field paths use dotted notation (`input.url`, `output.content.text`).
 
 import { readFile } from 'node:fs/promises';
+import { TOOL_USE_FAMILY } from '../sources/contract.js';
 
 export async function loadPolicies(path) {
   const raw = await readFile(path, 'utf8');
@@ -165,6 +166,17 @@ function safeRegexTest(re, value) {
   return re.test(s);
 }
 
+// v1.4.3 F-40: coerce ONLY a clean decimal-number string to a number, for the
+// ordered numeric comparators. Anything else (real number → passthrough;
+// hex/exponent/whitespace/Infinity/non-string → returned as-is so the caller's
+// Number.isFinite check fails closed). Never used for equality or length_*.
+const CLEAN_NUMERIC_STRING = /^-?\d+(\.\d+)?$/;
+function asOrderedNumber(value) {
+  if (typeof value === 'number') return value;
+  if (typeof value === 'string' && CLEAN_NUMERIC_STRING.test(value)) return Number(value);
+  return value;
+}
+
 function matchValue(value, condition) {
   // Literal scalar match
   if (condition === null || typeof condition !== 'object') {
@@ -185,20 +197,34 @@ function matchValue(value, condition) {
     return condition._regex_any.some(r => safeRegexTest(r, value));
   }
   // v1.2.0 — DSL extensions for ABAC / parameter validation.
-  // Numeric comparators are strict: a non-finite VALUE or a non-finite
-  // CONDITION operand fails-closed. Same as the regex branch: we never
-  // coerce or guess intent for a malformed policy.
+  // Numeric comparators reject a non-finite CONDITION operand (malformed
+  // policy → fail-closed).
+  //
+  // v1.4.3 F-40 (P2 audit) — the VALUE is run through asOrderedNumber():
+  // a real number passes through; a CLEAN decimal-number STRING (e.g. a tool
+  // that serializes `bytes` as "1500000") is coerced to its number. Why: a
+  // deny threshold like { gt: 1000000 } previously did NOT match a stringified
+  // value, so the rule silently no-matched and the action fell through to
+  // default-allow — a fail-OPEN on exfil-size / rate thresholds. Coercion is
+  // deliberately NARROW: only /^-?\d+(\.\d+)?$/ (no hex, exponent, whitespace,
+  // Infinity/NaN). This applies ONLY to the ORDERED comparators below.
+  // EQUALITY (literal / in / not_in) stays strict — "3" still never === 3 —
+  // and length_* (further down) still measures the raw string/array length.
   if (Number.isFinite(condition.gt)) {
-    return Number.isFinite(value) && value > condition.gt;
+    const v = asOrderedNumber(value);
+    return Number.isFinite(v) && v > condition.gt;
   }
   if (Number.isFinite(condition.gte)) {
-    return Number.isFinite(value) && value >= condition.gte;
+    const v = asOrderedNumber(value);
+    return Number.isFinite(v) && v >= condition.gte;
   }
   if (Number.isFinite(condition.lt)) {
-    return Number.isFinite(value) && value < condition.lt;
+    const v = asOrderedNumber(value);
+    return Number.isFinite(v) && v < condition.lt;
   }
   if (Number.isFinite(condition.lte)) {
-    return Number.isFinite(value) && value <= condition.lte;
+    const v = asOrderedNumber(value);
+    return Number.isFinite(v) && v <= condition.lte;
   }
   // in_range: tuple [min, max] inclusive both sides. An inverted tuple
   // (min > max) fails-closed — most likely an operator typo, never a
@@ -206,7 +232,8 @@ function matchValue(value, condition) {
   if (Array.isArray(condition.in_range) && condition.in_range.length === 2) {
     const [min, max] = condition.in_range;
     if (!Number.isFinite(min) || !Number.isFinite(max) || min > max) return false;
-    return Number.isFinite(value) && value >= min && value <= max;
+    const v = asOrderedNumber(value);
+    return Number.isFinite(v) && v >= min && v <= max;
   }
   // length_* operators apply to strings or arrays. Anything else (object,
   // number, null) fails-closed — length is meaningless there.
@@ -247,11 +274,55 @@ export function matchesPolicy(event, policy, ctx = {}) {
     const value = field.startsWith('ctx.')
       ? getNested(ctx, field.slice(4))
       : getNested(event, field);
-    if (!matchValue(value, condition)) return false;
+    // v1.4.2 F-38 (P0 audit): the action_type field gets tool-family
+    // expansion so a rule keyed on the generic `tool_use` catches MCP +
+    // custom tool calls too. Every other field uses plain matchValue.
+    const matched = field === 'action_type'
+      ? matchActionType(value, condition)
+      : matchValue(value, condition);
+    if (!matched) return false;
   }
   return true;
 }
 
+// v1.4.2 F-38 (P0 audit) — action_type matching with tool-family expansion.
+//
+// Adapters emit three distinct tool-invocation action_types: `tool_use`
+// (provider built-ins), `mcp_tool_use` (MCP servers), `custom_tool_use`
+// (customer-wired tools). A policy that targets the GENERIC `tool_use` must
+// match all three — otherwise a deny/allowlist rule silently misses MCP and
+// custom tool calls (e.g. the Deep Researcher "only web_search/web_fetch,
+// deny everything else" containment rule had a hole exactly there). The OpenAI
+// adapter emits `custom_tool_use` for EVERY tool, so without this a
+// `tool_use`-keyed rule matched nothing on that runtime at all.
+//
+// Expansion is one-directional and conservative: only the generic `tool_use`
+// token expands to the family. A policy that names a SPECIFIC member
+// (`mcp_tool_use` / `custom_tool_use`) stays an exact match, so an operator
+// who deliberately wants to target one surface still can. Non-set conditions
+// on action_type (regex, numeric — unusual but legal) fall back to matchValue.
+function expandActionTypeTargets(target) {
+  return target === 'tool_use' ? TOOL_USE_FAMILY : [target];
+}
+
+function matchActionType(value, condition) {
+  if (condition === null || typeof condition !== 'object') {
+    return expandActionTypeTargets(condition).includes(value);
+  }
+  if (Array.isArray(condition)) {
+    return condition.flatMap(expandActionTypeTargets).includes(value);
+  }
+  if (condition.in !== undefined) {
+    return condition.in.flatMap(expandActionTypeTargets).includes(value);
+  }
+  if (condition.not_in !== undefined) {
+    return !condition.not_in.flatMap(expandActionTypeTargets).includes(value);
+  }
+  // regex / numeric / unknown shapes on action_type are unusual but legal —
+  // defer to the generic matcher (which fails-closed on unknown shapes).
+  return matchValue(value, condition);
+}
+
 // First-match-wins evaluation. Returns the policy decision and metadata.
 // v1.2.0 — accepts an optional `ctx` for runtime-computed attributes;
 // see matchesPolicy() above. Omitting ctx preserves v1.1.x behavior.

package/src/shield/signature.js

@@ -50,14 +50,47 @@ import { createPublicKey, verify as cryptoVerify } from 'node:crypto';
 
 const POLICY_SIGNED_FIELDS = ['rule_id', 'match', 'action', 'message', 'priority', 'mode'];
 
-// Recursive deterministic JSON: sorted keys at every depth, arrays kept in order.
+// Recursive deterministic JSON: sorted keys at every depth, arrays kept in
+// order. This MUST mirror JSON.stringify's value semantics exactly — the only
+// intentional difference is key sorting for determinism. The reason is
+// load-bearing: the bytes we hash here have to equal the bytes that land on
+// disk after JSON.stringify(record), because the verifier re-reads the disk
+// record (already JSON round-tripped) and re-canonicalizes it.
+//
+// v1.4.2 F-39 (P0 audit) — the previous version emitted the literal token
+// `undefined` for object keys / array elements whose value was `undefined`
+// (or a function / symbol). JSON.stringify DROPS such object keys and renders
+// such array elements as `null`. So a record like { tool_input: { max_uses:
+// undefined } } hashed to `{"tool_input":{"max_uses":undefined}}` at write
+// time but, after JSON.stringify dropped `max_uses` on disk, re-canonicalized
+// to `{"tool_input":{}}` at verify time — chain_hash mismatch on an UNTAMPERED
+// record. That broke the tamper-evidence guarantee (false alarms masking real
+// tampering) and corrupted the Ed25519 signing domain the same way. The fix
+// makes canonicalize JSON-faithful; for JSON-clean data it is byte-identical
+// to the old behavior, so existing valid chains keep verifying.
 export function canonicalize(value) {
-  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (value === null || typeof value !== 'object') {
+    // JSON.stringify(undefined | function | symbol) returns `undefined`
+    // (the JS value, not a string). Default those to `null` so we never
+    // concatenate the literal token `undefined` into the hashed string.
+    const enc = JSON.stringify(value);
+    return enc === undefined ? 'null' : enc;
+  }
   if (Array.isArray(value)) {
-    return '[' + value.map(canonicalize).join(',') + ']';
+    // JSON renders undefined / function / symbol array elements as null —
+    // the primitive branch above already returns 'null' for them.
+    return '[' + value.map((v) => canonicalize(v)).join(',') + ']';
   }
+  // JSON.stringify omits object keys whose value is undefined / a function /
+  // a symbol. Mirror that, or the hashed string carries a key that vanishes
+  // on disk (the F-39 break).
   const keys = Object.keys(value).sort();
-  const pairs = keys.map((k) => JSON.stringify(k) + ':' + canonicalize(value[k]));
+  const pairs = [];
+  for (const k of keys) {
+    const v = value[k];
+    if (v === undefined || typeof v === 'function' || typeof v === 'symbol') continue;
+    pairs.push(JSON.stringify(k) + ':' + canonicalize(v));
+  }
   return '{' + pairs.join(',') + '}';
 }
 

package/src/shield/sources/fortress.js

@@ -167,6 +167,18 @@ function strictModeFromEnv() {
   return true;
 }
 
+// v1.4.2 F-48 (P2 audit) — what to do when a SUCCESSFUL refresh yields zero
+// usable policies even though Fortress SENT some (i.e. every policy was
+// dropped by signature verification or compile validation). 'closed' (the
+// default, the right stance for a security control) refuses to install an
+// empty allow-everything ruleset; 'open' preserves the pre-F-48 behavior
+// (install default-allow) as an explicit opt-out.
+function failModeFromEnv() {
+  const v = process.env.WMA_SHIELD_FAIL_MODE;
+  if (v === 'open') return 'open';
+  return 'closed';                   // unset / anything else → fail-closed
+}
+
 // Parse the embedded root pubkey ONCE at module load. If the file still
 // carries the placeholder, we DO NOT throw — but every refresh logs a
 // loud reminder so an unattended deploy can't silently trust a key whose
@@ -183,7 +195,7 @@ const ROOT_PUBLIC_KEY = (() => {
 })();
 
 export class FortressPolicySource {
-  constructor({ apiKey, base, anthropicAgentId, refreshIntervalMs = 5 * 60_000, onError, onRefresh, requireSignedPolicies }) {
+  constructor({ apiKey, base, anthropicAgentId, refreshIntervalMs = 5 * 60_000, onError, onRefresh, requireSignedPolicies, failMode }) {
     if (!apiKey) throw new Error('FortressPolicySource: apiKey required');
     if (!base) throw new Error('FortressPolicySource: base URL required');
     this.apiKey = apiKey;
@@ -196,12 +208,18 @@ export class FortressPolicySource {
     this.lastFetchedAt = null;
     this._timer = null;
     this._aborted = false;
+    // v1.4.2 F-48: tracks whether this.ruleset came from a non-degraded
+    // refresh (so a later all-dropped refresh can retain last-known-good
+    // instead of wiping it) vs. is still the constructor's default-allow.
+    this._installedFromRefresh = false;
     // v1.1.5: per-instance override of the env var. Tests use this to
     // exercise both modes without touching process.env. If neither the
     // constructor option nor the env var is set, strict mode wins.
     this.requireSignedPolicies = requireSignedPolicies != null
       ? !!requireSignedPolicies
       : strictModeFromEnv();
+    // v1.4.2 F-48: 'closed' (default) | 'open'. Per-instance override for tests.
+    this.failMode = failMode != null ? failMode : failModeFromEnv();
   }
 
   /** Initial fetch — fails loud if it can't reach Fortress at startup. */
@@ -232,14 +250,20 @@ export class FortressPolicySource {
     return this._refresh();
   }
 
+  // v1.4.2 F-48: injectable fetch seam (tests override this to drive _refresh
+  // hermetically). Production hits the real Fortress endpoint.
+  async _fetchPolicies() {
+    return fetchPolicies({
+      apiKey: this.apiKey,
+      base: this.base,
+      anthropicAgentId: this.anthropicAgentId,
+    });
+  }
+
   async _refresh({ initial = false } = {}) {
     if (this._aborted) return;
     try {
-      const { policies, signing_keys, fetched_at } = await fetchPolicies({
-        apiKey: this.apiKey,
-        base: this.base,
-        anthropicAgentId: this.anthropicAgentId,
-      });
+      const { policies, signing_keys, fetched_at } = await this._fetchPolicies();
 
       // v1.1.5 Phase 1.5 — verify the chain-of-trust BEFORE any other
       // processing. We must verify on the raw JSON shape sent by Fortress,
@@ -272,11 +296,47 @@ export class FortressPolicySource {
       // priorities) keep their relative order via the stable sort
       // guarantee in V8 — predictable behavior.
       compiled.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+
+      // v1.4.2 F-48 (P2 audit): FAIL-CLOSED on a "successful" refresh that
+      // dropped EVERYTHING. If Fortress SENT policies (policies.length > 0)
+      // but none survived verification/compile (compiled.length === 0), an
+      // on-path attacker or a broken signing pipeline has effectively
+      // disarmed Shield — installing the empty { default: allow } ruleset
+      // here would silently allow every action while the daemon looks
+      // healthy. We distinguish this from a LEGITIMATELY empty response
+      // (operator cleared all policies → policies.length === 0 → install
+      // allow as intended).
+      const allDropped = policies.length > 0 && compiled.length === 0;
+      if (allDropped && this.failMode === 'closed') {
+        this.lastFetchedAt = fetched_at;
+        if (this._installedFromRefresh) {
+          // We have a last-known-good ruleset → KEEP it; do not overwrite
+          // with allow-everything. Protection continues on the prior rules.
+          this.onError(new Error(
+            `Fortress refresh: all ${policies.length} policies failed verification/compile — ` +
+            'FAIL-CLOSED, retaining last-known-good ruleset (set WMA_SHIELD_FAIL_MODE=open to override).',
+          ));
+          this.onRefresh({ policies: this.ruleset.policies, fetched_at, initial, failClosed: true });
+        } else {
+          // No prior good ruleset (e.g. initial load) → cannot fall back to
+          // allow-everything for a security control. Install deny-by-default
+          // so unmatched actions are denied rather than waved through.
+          this.ruleset = { version: 1, policies: [], default: { action: 'deny' } };
+          this.onError(new Error(
+            `Fortress refresh: all ${policies.length} policies failed verification/compile and there is no ` +
+            'prior ruleset — FAIL-CLOSED to deny-by-default (set WMA_SHIELD_FAIL_MODE=open to override).',
+          ));
+          this.onRefresh({ policies: [], fetched_at, initial, failClosed: true });
+        }
+        return;
+      }
+
       this.ruleset = {
         version: 1,
         policies: compiled,
         default: { action: 'allow' },
       };
+      this._installedFromRefresh = true;
       this.lastFetchedAt = fetched_at;
       this.onRefresh({ policies: compiled, fetched_at, initial });
     } catch (e) {

package/src/shield/upload.js

@@ -57,6 +57,12 @@ function pickInputForHash(input) {
 export function buildFortressDecisionPayload({
   agentId, sessionId, rawEvent, normalized, result, decidedInMs,
   signalsSalt, decidedAtIso,
+  // v1.4.2 F-44 (P1 audit): the real enforcement outcome (true delivered /
+  // false failed / undefined n/a). Lets the Fortress dashboard distinguish a
+  // confirmed block from one whose API call failed — i.e. surface degraded
+  // enforcement instead of trusting the computed verdict. Boolean only; no
+  // raw content, so Containment is unaffected.
+  enforcementDelivered,
 }) {
   // F-19: vendor built-ins survive even without a salt (allowlist short-circuit);
   // custom tool names throw without a salt — we catch and drop the field.
@@ -85,5 +91,7 @@ export function buildFortressDecisionPayload({
     // v1.1.3 Phase 1.D: mode threading so Fortress can store and surface
     // shadow-vs-enforce in the Reports timeline.
     mode: result.mode || undefined,
+    // v1.4.2 F-44: real enforcement outcome (omitted when not applicable).
+    enforcement_delivered: enforcementDelivered === undefined ? undefined : enforcementDelivered,
   };
 }