oacp-cli 0.4.1__tar.gz → 0.4.2__tar.gz

{oacp_cli-0.4.1 → oacp_cli-0.4.2}/.github/workflows/release.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Install Python dependencies
         run: |
           python -m pip install --upgrade pip
-          python -m pip install -e . build pytest ruff
+          python -m pip install -e ".[crypto]" build pytest ruff
 
       - name: Run quality gate
         run: make preflight ARGS="--full"

{oacp_cli-0.4.1 → oacp_cli-0.4.2}/CHANGELOG.md

@@ -5,6 +5,134 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.2] - 2026-08-07
+
+### Added
+
+- Profileless admitted requests now receive a documented **default scope
+  envelope** instead of running unbounded: 25 minutes / 2 files /
+  reply-only, every capability and risk flag false, `risk_tier` mirroring
+  the message's declared priority (else `P2`). `allow_without_task_profile`
+  is thereby an admission-only exemption — the sender needn't author a
+  profile, but the bound always exists, and the post-accept threshold
+  checkpoint is always evaluable. A sender-attached voluntary profile on an
+  exempt type is the documented override path and replaces the default
+  entirely. Every decision names its envelope origin in the new
+  `scope_envelope_source` field (`task_profile` / `default_profileless`),
+  and `scope_envelope: null` on an admitted record is now a schema
+  violation the audit writer refuses to persist. Protocol spec version
+  bumps to 0.4.2.
+- Admitted public-visibility tasks gain an explicit, recorded enforcement
+  branch: `oacp envelope compile --audit <admission-record>` on a
+  `public_visibility: true` task whose record carries a human admission
+  approval deliberately does **not** compile (a compiled public envelope
+  denies the entire approved chain) and instead stamps
+  `envelope_enforcement: none` with the named reason
+  `public_visibility_admission_approved` into the audit record — the
+  degradation is a documented mode with the human as the bound, not a
+  silent absence. The approval record is treated as authorization:
+  `--audit` must resolve inside the receiver's canonical admission audit
+  directory, the record must be an admission-paused record bound to the
+  exact verified message snapshot (`message_sha256`) with a recorded
+  `approved`/`modified` outcome, eligibility and the stamp consume one
+  locked read, and the branch fails closed while any envelope is active
+  for the receiver. Unapproved public tasks and all private tasks are
+  unaffected and keep the fail-closed compile path.
+- `signing.verify_mode: enforce` is now a real mode with a real caller.
+  The autonomy gate invokes verification at message intake, before any
+  evaluation: under enforce, only a `signed-verified` message proceeds —
+  every other outcome (unsigned, INVALID, unknown-kid, revoked,
+  unverifiable) quarantines a mode-600 evidence copy into the receiver's
+  `dead_letter/`, evaluates nothing, and exits `3` with an
+  `intake_rejected` decision object. Rejection is mechanism, not
+  per-receiver diligence; previously the mode silently degraded to warn
+  and nothing on the receive path consumed it. Warn and off behavior are
+  unchanged. The receive-path contract is pinned by a new executable
+  conformance corpus at `tests/conformance/intake/` (four failure classes
+  under each mode, plus a signed-verified positive control).
+- Policy-file signing: `oacp trust sign-policy` signs a receiver's
+  `config.yaml` and `trust/allowed_signers.yaml` with the receiver's own
+  local key, under a distinct JOSE profile (`oacp-policy+yaml` /
+  `urn:oacp:policy:v1`) so message and policy signatures can never be
+  exchanged. Loaders verify at load time: audit records now carry a
+  `policy_auth` block binding `policy_sha256` to an authorized signer; a
+  tampered `config.yaml` fails closed with the new pinned reason code
+  `policy_auth_invalid` before anything — including its own
+  `verify_mode` — reads it, and a tampered `allowed_signers.yaml` makes
+  the trust root unusable (under enforce, everything then rejects).
+  Unsigned policy files remain loadable with the unsigned state recorded
+  (bootstrap: init → key gen → sign-policy).
+- Policy signatures bind their target context — `{project, receiver,
+  kind}` in the protected header — so a signed policy can never be
+  replayed across projects, receivers, or between `config.yaml` and
+  `allowed_signers.yaml`. `sign-policy` also enrolls each target in a
+  machine-local registry (`$OACP_HOME/keys/policy_enrollment.json`):
+  once enrolled, a policy file without a verifiable signature is
+  `invalid`, never `unsigned` — stripping a trailer stops being a
+  downgrade path. Trust mutations (`trust import` / `revoke`)
+  atomically re-sign an enrolled trust root or refuse the write.
+- Single-read snapshot discipline on every receiver read path: the gate,
+  the trust-root load, and all policy consumers (envelope compiler, send
+  helper, trust mutations, inbox lister) verify and parse ONE bounded
+  read of each security-sensitive file, closing the window where a
+  config, message, or pins file could be swapped between its
+  verification and its use. The audit record's `message_sha256` now
+  names the verified snapshot bytes.
+- Every non-gate inbox read path goes through one shared receive
+  boundary (verify one bounded snapshot before parsing it): the `oacp
+  inbox` lister, the `oacp watch` event emitter, the send helper's
+  parent-message lookup, and the trust drift report's traffic probe.
+  Under `enforce`, an unverified message surfaces as a held row/event
+  built from filesystem metadata only (no attacker-controlled field is
+  parsed or surfaced), never donates thread identity to replies, and
+  never counts as sender liveness; under `warn` rows and events carry
+  the verification status. A receiver config that fails policy
+  authorization cannot choose a weaker mode — these paths fail closed
+  to enforce. The envelope compiler refuses to compile from a message
+  that is not signed-verified under enforce, and the envelope's
+  `message_sha256` names the verified snapshot. `oacp trust list` and
+  doctor readiness calculations load policy files through the
+  authorized loader; `oacp doctor` reports per-receiver policy-file
+  authorization status.
+
+### Fixed
+
+- Intake conformance tests now skip goldens that pin a
+  signature-evaluation outcome when the optional cryptography dependency
+  is not installed, restoring the suite's graceful degradation without
+  the `[crypto]` extra. The release quality gate installs the extra so
+  the full signing matrix runs before publishing.
+- Agent enumeration now consistently ignores hidden directories under
+  `agents/`, preventing runtime scaffolding such as `.claude/.cc-writes` from
+  appearing as phantom agents in doctor, inbox, profile, and trust workflows.
+- Autonomy-gate negation demotion now recognizes common scope language and
+  carries unambiguous negation headings over their immediately following,
+  bounded block. Blank lines and subsequent headings end that scope, while
+  non-demotable side-effect and content-sensitivity hard stops remain hard.
+- Claude envelope enforcement now allows a reconstructed Edit/Write change
+  confined to the project's own `[project] version` string in
+  `pyproject.toml` under `touches_dependencies: false`, while counting the
+  file and continuing to deny real dependency, mixed, ambiguous, and
+  Bash-side manifest edits.
+- The foreign-session read-only `oacp envelope show` exemption now recognizes
+  argparse-equivalent `--option=value` spellings, unambiguous long-option
+  abbreviations, and help flags without weakening its fail-closed handling of
+  unknown options.
+- Autonomy audit records now resolve `runtime.model` at the writer instead
+  of defaulting to a silent null. The serving model resolves caller-first
+  (an explicit `runtime.model` on the decision), then from the
+  `OACP_RUNTIME_MODEL` environment variable exported by the invoking
+  session, and is normalized at write time: case variants fold to
+  lowercase, and `[context]` suffixes split into the base id plus a
+  separate `model_context` field. `model_source` names the provenance and
+  `model_raw` preserves any input the normalization changed. Records with
+  no signal carry an explicit `model_unknown_reason` — never a silent
+  null — and the requested model (harness configuration) is never used as
+  a fallback. Historical records are not backfilled.
+- The autonomy audit writer now validates `result.completion_kind` against
+  the pinned enum at write time, refusing to persist decisions that carry
+  a caller-composed off-enum kind.
+
 ## [0.4.1] - 2026-08-04
 
 ### Fixed
@@ -574,6 +702,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Checkout step in github-release workflow job (#19)
 - Pre-release audit fixes: SHA-pinned actions, dangling doc refs (#15, #16)
 
+[0.4.2]: https://github.com/kiloloop/oacp/compare/v0.4.1...v0.4.2
+[0.4.1]: https://github.com/kiloloop/oacp/compare/v0.4.0...v0.4.1
 [0.4.0]: https://github.com/kiloloop/oacp/compare/v0.3.5...v0.4.0
 [0.3.5]: https://github.com/kiloloop/oacp/compare/v0.3.4...v0.3.5
 [0.3.4]: https://github.com/kiloloop/oacp/compare/v0.3.3...v0.3.4

{oacp_cli-0.4.1 → oacp_cli-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: oacp-cli
-Version: 0.4.1
+Version: 0.4.2
 Summary: Open Agent Coordination Protocol CLI for file-based multi-agent workflows
 Project-URL: Homepage, https://github.com/kiloloop/oacp
 Project-URL: Repository, https://github.com/kiloloop/oacp

{oacp_cli-0.4.1 → oacp_cli-0.4.2}/docs/guides/doctor.md

@@ -35,6 +35,10 @@ Checks the project directory structure under `$OACP_HOME/projects/<name>/`.
 - **workspace.json** — must exist and contain valid JSON
 - **agents/ directory** — must exist; reports the number of registered agents
 
+Agent discovery ignores hidden directories directly under `agents/`. Tooling
+scaffolding such as `agents/.claude/.cc-writes/` is therefore not counted or
+checked as a phantom agent if a runtime creates it in that location.
+
 ### 3. Inbox Health
 
 Scans each agent's `inbox/` directory for pending messages and staleness.

{oacp_cli-0.4.1 → oacp_cli-0.4.2}/docs/protocol/autonomy.md

@@ -106,6 +106,35 @@ schema-invalid profile pauses with `task_profile_unparsable`; it is not a fatal
 message-schema error. Message types listed in `allow_without_task_profile`, such
 as `brainstorm_request`, may auto-accept without the block.
 
+### Default scope envelope (profileless admissions)
+
+`allow_without_task_profile` is an **admission-only exemption**: the sender
+needn't author a profile, but the bound always exists — a grant removes
+friction, never the bound. A profileless admitted request receives the
+documented default envelope instead of running unbounded:
+
+- `estimated_minutes: 25`, `expected_files_touched: 2`, reply-only
+  (`sends_oacp_reply_only: true`); every other capability and risk flag
+  `false`; `target_repo` empty; no continuation grants.
+- `risk_tier` mirrors the message's own declared `priority` when it is a
+  valid tier (`P0`–`P3`) — it is the sender's severity claim — else `P2`.
+
+The default envelope binds the post-accept threshold checkpoint exactly
+like a declared one: a genuinely long profileless task may
+checkpoint-pause against it — that is the bound existing, by design, not a
+regression. A sender that legitimately needs more attaches a **voluntary
+`task_profile` on the exempt type** — a documented, supported path; the
+profile's envelope then replaces the default entirely (and is the only way
+an exempt type reaches continuation-grant evaluation, since a default
+envelope declares nothing).
+
+Every decision names its envelope's origin in `scope_envelope_source`
+(`task_profile` or `default_profileless`; null only on a pause taken
+before envelope construction). No admitted message type is
+envelope-exempt — the exempt set is empty — and `scope_envelope: null` on
+an admitted record is a **schema violation**: the audit writer refuses to
+persist it rather than recording an unbounded admission.
+
 The core declaration is complete only when it includes the two numeric fields,
 `risk_tier`, and all five legacy risk booleans shown above. Granular side-effect
 booleans are optional but must agree with `external_side_effects`; a profile
@@ -178,7 +207,16 @@ If any required gate is missing or uncertain, the receiver pauses.
    - Path-like tokens such as `packets/deploy/` are not deploy verbs.
    - Exclude sender-marked `oacp-guardrails` fences from demotable pause
      classification while logging their matches as advisories. Suppress
-     demotable matches in clauses headed by `no`, `not`, `never`, or `do not`.
+     demotable matches in clauses headed by `no`, `not`, `never`, `do not`,
+     `does not`, `don't`, `doesn't`, `out of scope`, `exclude`/`excluded`,
+     `excludes`, `avoid`, `refrain from`, `prohibited`, `forbidden`, `skip`, or
+     `without`. A classic negation or scope-oriented form in a Markdown heading
+     or colon-terminated heading also scopes over the following block;
+     `skip` and `without` remain same-clause only because their ordinary prose
+     uses are ambiguous. Heading scope ends at the first blank line or next
+     heading, so the first governed line must follow the heading directly.
+     Non-demotable hard stops remain hard even when they appear in such a
+     clause or block.
    - With a complete profile, demote side-effect or sensitive-scope lexical
      matches to a logged `lexical_advisory` when the corresponding declaration
      is `false`. Missing/unparsable profiles and contradictory declarations do
@@ -225,7 +263,7 @@ Every autonomy decision writes one YAML file:
 
 ```yaml
 schema_version: 2
-spec_version: "0.4.1"
+spec_version: "0.4.2"
 created_at_utc: "2026-05-12T13:23:25Z"
 receiver: codex
 sender: iris
@@ -267,7 +305,8 @@ breached: []
 co_occurring_reason_codes: []
 runtime:
   agent: codex
-  model: gpt-5
+  model: gpt-5            # serving model, normalized at the writer; null only with a reason
+  model_source: "env:OACP_RUNTIME_MODEL"
 evaluator:
   source: scripts/autonomy_gate.py
   content_sha256: "<sha256 of the evaluator file bytes>"
@@ -315,13 +354,26 @@ result:
 missing or malformed config. `sender` is normally traceability metadata and
 also binds an enabled standing grant to the sender that received approval.
 `policy_sha256` is the SHA-256 of a canonical, key-sorted serialization of the
-parsed policy, so comments and YAML formatting do not produce false drift.
-`spec_version: "0.4.1"` pins everything 0.4.0 pinned — Gate 1 integrity
+parsed policy (excluding any `auth` trailer key), so comments, YAML
+formatting, and signing state do not produce false drift. Records written
+through the gate CLI additionally carry a `policy_auth` block —
+`{status: unsigned | verified | invalid | unsupported, signer_agent,
+signer_kid, reason}` — the policy-file authorization outcome (see
+`message_signing.md` → "Policy-file signing"): together with
+`policy_sha256` the record commits to an *authorized* policy identity,
+not just which bytes ran. An `invalid` status fails closed with reason
+code `policy_auth_invalid` before any gate consumes the config.
+`spec_version: "0.4.2"` pins everything 0.4.1 pinned — Gate 1 integrity
 enforcement, the recalibrated Gate 2/3 policy, full task-profile capture, the
-explicit `breached` list, and the outcome block shown above — plus
-session-scoped envelope enforcement, the enforce-mode trust-pin completeness
-gate, and preserved `always_pause` defaults for configs without an `autonomy`
-block. Audit `schema_version: 2` adds thread identity and
+explicit `breached` list, the outcome block shown above, session-scoped
+envelope enforcement, the enforce-mode trust-pin completeness gate, and
+preserved `always_pause` defaults for configs without an `autonomy` block —
+plus intake verification as mechanism (`verify_mode: enforce` rejects at
+the gate), the `policy_auth` authorized-policy block, the default scope
+envelope for profileless admissions (with `scope_envelope_source` and the
+null-on-admitted writer refusal), and the recorded none-by-rule
+enforcement branch for approved public-visibility tasks. Audit
+`schema_version: 2` adds thread identity and
 the structured `result.human_outcome` block. Recorders may upgrade a v1 audit
 to v2 when the first human outcome is written; standing grants trust only v2
 records.
@@ -337,6 +389,25 @@ non-checkout install all record `null` rather than a SHA that names code
 which did not run. The only evaluator block a receiver ever authors by
 hand is the no-executed-gate case: `executed: false` with no hashes.
 
+`runtime.model` is resolved **at the writer and never backfilled**. The
+serving model resolves caller-first (an explicit `runtime.model` already on
+the decision), then from the `OACP_RUNTIME_MODEL` environment variable the
+invoking session exports — the variable names the model actually serving
+that session, not the model a configuration requested. Values are
+normalized at write time: case variants fold to lowercase, and a
+`[context]` suffix (same weights, different serving context window) splits
+into the base id plus a separate `model_context` field so per-model
+grouping never divides one model across suffix variants. `model_source`
+names the provenance (`caller` or `env:OACP_RUNTIME_MODEL`) and
+`model_raw` preserves any input the normalization changed. A record with
+no signal carries an explicit unknown — `model: null` plus a
+`model_unknown_reason` — never a silent null. The *requested* model
+(harness configuration, settings files) is deliberately never consulted,
+and historical records are never rewritten: a request can be silently
+served by a different model, alias, or context variant, and filling the
+field from it would reintroduce exactly the confound the field exists to
+remove.
+
 `breached` is always an ordered list, but its entries intentionally reflect the
 evaluation phase. Admission-time pauses record pinned gate reason codes (for
 example `estimated_minutes_exceeds_threshold`); post-accept checkpoint pauses
@@ -373,7 +444,9 @@ Receivers copy the evaluator's `completion_kind` verbatim and never overwrite
 it at terminal update time — a paused-then-approved task keeps
 `admission_paused` while `final_state` moves to `done` and `human_outcome`
 records the approval. Receiver-composed values outside this enum are
-non-conforming. Records written before this pin carry mixed
+non-conforming, and the audit writer enforces the pin at write time: a
+decision whose `result.completion_kind` is missing or outside the enum is
+refused rather than persisted. Records written before this pin carry mixed
 cause/event/state values (`hard_stop`, bare `paused`, fused decision+state
 kinds) and cannot be bucketed against the pinned enum.
 
@@ -449,7 +522,10 @@ that malformed request can be approved or modified.
 Evaluator implementations must reject unpinned reason codes. The canonical
 families are:
 
-- integrity/config: `config_malformed`, `mode_always_pause`,
+- integrity/config: `config_malformed`, `policy_auth_invalid` (the
+  receiver config carries a policy signature that fails verification —
+  the gate refuses to evaluate a tampered policy, distinguishably from a
+  merely malformed or absent one), `mode_always_pause`,
   `message_invalid`, `message_expired`, `message_replayed`,
   `task_profile_missing`, `task_profile_unparsable`,
   `risk_obvious_no_profile`, `envelope_compile_error`;
@@ -623,13 +699,54 @@ autonomy config into a runtime envelope:
 oacp envelope compile <message.yaml> --receiver <agent>
 ```
 
+**Admitted public-visibility tasks are the one explicit exception.** A
+compiled `public_visibility: true` envelope denies the entire chain the
+human just approved — the runtime adapter has no post-approval carve-out —
+so for a public task whose admission audit records a human outcome of
+`approved`/`modified`, the receiver passes that record to the compiler:
+
+```
+oacp envelope compile <message.yaml> --receiver <agent> \
+  --audit <admission-record.yaml>
+```
+
+and the compiler takes the **none-by-rule branch**: it does **not**
+compile, and it stamps `result.envelope_enforcement: none` plus
+`result.envelope_enforcement_reason: public_visibility_admission_approved`
+into the audit record under the audit lock. Degradation is the documented
+mode, not silence — the human admission approval plus live supervision is
+the named control, and the record says so.
+
+The approval record is authorization, so eligibility is strict: the
+`--audit` path must resolve inside the receiver's canonical admission
+audit directory (`agents/<receiver>/audit/autonomy_decisions/` — an
+arbitrary readable YAML never qualifies), and the record must be an
+admission-**paused** record carrying a `schema_version`, content-matched
+on `message_id` + `receiver` (in the record itself, never the filename),
+bound to the exact verified message snapshot via `message_sha256`, with
+a recorded human outcome of `approved` or `modified`. Eligibility and
+the marker write consume ONE locked read of the record. A none-by-rule
+result must also MEAN none: the branch holds the envelope lock, fails
+closed if any envelope is active for the receiver (its normal lifecycle
+clears it — never a silent delete, never a false `none`), and consumes
+the compiling session's pending claim so a deliberate no-envelope
+success cannot bind a later, unrelated compile.
+
+This is a deliberate, recorded exception to "a grant removes friction,
+never the bound": for approved public work the **human is the bound**,
+and the exception retires when a post-approval envelope path (compile
+consuming the recorded approval into a workable public envelope) ships.
+Private tasks, and public tasks without a matching eligible record, are
+entirely unaffected: the fail-closed compile below still runs, and an
+unapproved public envelope still denies at the hook.
+
 The envelope is written to
 `agents/<receiver>/state/active_envelope.json`:
 
 ```json
 {
   "envelope_version": 1,
-  "spec_version": "0.4.1",
+  "spec_version": "0.4.2",
   "compiler": "envelope_compiler.py",
   "compiled_at_utc": "2026-07-12T02:00:00Z",
   "project": "my-project",
@@ -705,7 +822,11 @@ dispatched task's constraints nor consumes its file budget. The scope never
 silently narrows: an unbound envelope enforces every session in the
 (project, agent) workspace exactly as before, and a caller the harness gave
 no session id is enforced even under a bound envelope (it cannot be proven
-foreign).
+foreign). A foreign session still cannot mutate the shared envelope state;
+only provably read-only inspection is exempt. The `oacp envelope show`
+inspection grammar recognizes argparse-equivalent value options in both
+`--option value` and `--option=value` forms, plus unambiguous long-option
+abbreviations and help flags, while unknown options continue to fail closed.
 
 Runtime decisions:
 
@@ -762,6 +883,14 @@ Runtime decisions:
 - Determinable Bash write targets feed the same distinct-file counter as
   Edit/Write calls (`/dev/*` excluded), so shell writes cannot bypass
   `expected_files_touched`.
+- A `pyproject.toml` Edit or Write under `touches_dependencies: false` is
+  exempt from the dependency-manifest denial only when the hook can
+  reconstruct both complete documents and prove that every byte outside the
+  sole `[project] version` string literal is unchanged. The file still counts
+  toward `expected_files_touched`. Dependency, optional-dependency, and
+  build-system changes remain denied, as do mixed edits, ambiguous or
+  unsupported file-tool inputs, and every Bash-side manifest write whose
+  resulting content cannot be proven before execution.
 - Protocol bookkeeping never consumes the file budget. The receiver's own
   `audit/`, `inbox/`, and `outbox/` directories and the runtime scratchpad
   (reply/body-file composition) are the enforcement layer's instrumentation
@@ -836,8 +965,13 @@ envelope compile --extend`, which preserves accumulated counters.
 
 The audit `result` block records `envelope_enforcement: hooks | none`.
 Receivers set `hooks` after a successful compile on an adapter-equipped
-runtime; `none` means pickup-gate-only enforcement (no adapter for the
-runtime yet). Degradation must never be silent.
+runtime; `none` means pickup-gate-only enforcement. Degradation must never
+be silent: when `none` is a **rule** rather than a runtime gap, the record
+carries the named reason alongside it —
+`envelope_enforcement_reason: public_visibility_admission_approved` for
+the admitted-public branch above, stamped by the compiler itself. A bare
+`none` with no reason means an adapterless runtime (the historical
+pickup-gate-only state), distinguishable from the rule-based mode.
 
 Enforcement boundary: hooks constrain every tool call inside the session,
 including subagent tool calls, and fire before sandbox/permission

{oacp_cli-0.4.1 → oacp_cli-0.4.2}/docs/protocol/inbox_outbox.md

@@ -75,9 +75,11 @@ named by `kid` (RFC 7638 thumbprint) and never carried in the message.
 Sender signing is config-gated off by default (`signing.sign_messages`);
 receivers without a `verify_mode` knob treat the trailer as an ordinary
 optional field.
-Receiver verification runs in warn mode (identity recorded, no authority
-granted); the trust root — receiver pins, the zero-authority project
-catalog, `oacp trust import`, and key management — is documented in
+Receiver verification is mode-gated (`off` / `warn` / `enforce`): warn
+records identity and grants no authority; enforce rejects any message
+that does not verify, at intake, with a quarantined evidence copy. The
+modes, the trust root — receiver pins, the zero-authority project
+catalog, `oacp trust import`, and key management — are documented in
 [`message_signing.md`](message_signing.md).
 
 ## Message Types

{oacp_cli-0.4.1 → oacp_cli-0.4.2}/docs/protocol/message_signing.md

@@ -1,28 +1,84 @@
-# Message Signing — Trust Root & Key Management (v0.4.0, warn mode)
+# Message Signing — Trust Root & Key Management
 
 Status: **non-normative** companion to the message-signing wire format.
 The wire format itself — the raw-prefix detached-JWS `auth` trailer — is
 specified in [`inbox_outbox.md` → "Signed messages"](inbox_outbox.md);
 this document covers the trust root, verification modes, and key
-management. The normative authority-doctrine amendment ships with the
-first authority-bearing knob (a later 0.4.x/0.5 release) as its own
-reviewed change.
+management.
 
-## Warn-mode seam (v0.4.0)
+## Verify modes
+
+Receivers opt in per-agent via `signing.verify_mode: off | warn | enforce`
+in `agents/<receiver>/config.yaml`; any other value degrades to `off`.
 
 **Warn mode records identity and grants no authority.** Every verification
 outcome — `unsigned`, `signed-verified`, `signed-unknown-kid`,
 `signed-INVALID`, `signed-REVOKED` — produces an annotation and a
 `message_auth` audit block; none of them rejects, quarantines-as-rejection,
 or changes how a message is processed. A verified signature is a recorded
-fact about who signed, not a permission. Enforce mode (rejection, receipt
-ledger, quarantine activation) lands in **a later release**, activated only
-after a warn soak on live fleet traffic and an explicit enforcement ruling;
-the seams exist in v0.4.0 and none activate.
-
-Receivers opt in per-agent via `signing.verify_mode: off | warn` in
-`agents/<receiver>/config.yaml`. An early `enforce` value degrades to
-`warn`; anything else degrades to `off`.
+fact about who signed, not a permission.
+
+**Enforce mode makes rejection mechanism, not receiver diligence.** The
+autonomy gate invokes verification at message intake, before any
+evaluation, parse, or gate runs. Only `signed-verified` proceeds; every
+other outcome — unsigned, INVALID, unknown-kid, revoked, and
+unverifiable-without-crypto — is rejected: a mode-600 evidence copy is
+quarantined into the receiver's `dead_letter/` (exclusive-create; the
+original inbox artifact is never touched), nothing is evaluated, and the
+gate exits `3` with an `intake_rejected` decision object. An unusable or
+tampered trust root fails closed the same way: with no loadable pins,
+nothing verifies, so everything rejects.
+
+### Receiver intake contract
+
+What a receiver's inbox-processing flow does with each annotation, by mode:
+
+| Annotation | `off` | `warn` | `enforce` |
+|---|---|---|---|
+| (none — verification skipped) | process | — | — |
+| `unsigned` | — | process; annotation recorded | rejected at intake (quarantined, unprocessed) |
+| `signed-verified` | — | process; identity recorded | process |
+| `signed-unknown-kid` | — | process; annotation recorded | rejected at intake |
+| `signed-INVALID` | — | process; evidence quarantine available (`--quarantine`) | rejected at intake |
+| `signed-REVOKED` | — | process; annotation recorded | rejected at intake |
+| `signed-unverifiable (crypto unavailable)` | — | process; annotation recorded | rejected at intake (fail closed) |
+
+Under `enforce` the rejection happens inside the gate CLI — a receiver
+flow that never explicitly runs `oacp verify` still cannot process an
+unverified message, because admission itself refuses. The quarantined
+evidence copy plus the gate's `intake_rejected` output are the record of
+the rejection; no admission audit record is written for a message that
+never reached admission. Receivers surface the rejection to their
+operator and may notify the sender; they never process or silently delete
+the quarantined evidence.
+
+Every receiver read path verifies before it parses. The gate is the
+admission choke point; every other CLI surface that reads inbox
+artifacts goes through one shared receive boundary (resolve the
+authorized receiver config, load policy-checked pins, verify one
+bounded snapshot, and only then parse those bytes): the `oacp inbox`
+lister, the `oacp watch` event emitter, the send helper's
+parent-message lookup (a held message can never donate
+`conversation_id` to an outgoing reply), and the trust drift report's
+inbox traffic probe (a forged `from:` line cannot manufacture a
+liveness signal). Under `enforce`, a message that is not
+`signed-verified` surfaces as a HELD row or event built from
+filesystem metadata only — none of its (attacker-controlled) fields
+are parsed or surfaced; under `warn` rows and events carry the
+verification status; under `off` behavior is unchanged. These read
+paths are read-only, so they never quarantine — dispositioning a held
+message belongs to the processing path. The envelope compiler is a
+processing step and fails closed instead: under `enforce` it refuses
+to compile an envelope from a message that is not signed-verified,
+and the envelope's `message_sha256` names the verified snapshot.
+
+**Verified bytes are the processed bytes.** Verification and any
+subsequent parse, hash, or evaluation of the same artifact consume one
+bounded read — a single snapshot. A verifier that approves one read and a
+consumer that then re-reads the path would leave a swap window between
+them; the gate, the inbox lister, and the policy loaders all parse the
+exact bytes they verified, and the audit record's `message_sha256` names
+that snapshot.
 
 ## Enforce-mode preparation
 
@@ -188,6 +244,90 @@ Warn-mode semantics carry through unchanged: the block records identity
 and grants no authority — gates and instrumentation consume it as
 telemetry only.
 
+## Policy-file signing
+
+The autonomy audit record's `policy_sha256` proves **which** policy ran;
+policy-file signing proves it was **authorized**. The receiver's two
+policy files — `config.yaml` and `trust/allowed_signers.yaml` — carry the
+same raw-prefix detached-JWS auth trailer as messages, under a distinct
+JOSE profile (`typ: oacp-policy+yaml`, domain `urn:oacp:policy:v1`) so a
+message signature can never authorize a policy file and a policy signature
+can never authenticate a message.
+
+- **Trust anchor**: the machine-local keystore under `$OACP_HOME/keys/`.
+  A policy file for receiver X verifies only against agent X's own public
+  keys (the `<kid>.pub.json` stubs written by `oacp key gen`); a valid
+  signature by a *different* local agent's key is a receiver-binding
+  failure, not authorization. Tampering with a policy file on disk
+  therefore requires the 0600 private key material, not just filesystem
+  write access. (The trust root cannot anchor its own signature — the
+  keystore is the separate root that breaks that cycle.)
+- **Context binding**: every policy signature commits to its target —
+  `{project, receiver, kind}` (`receiver_config` or `allowed_signers`) —
+  inside the protected header's `oacp.policy` claim, and verification
+  requires an exact match against the file's canonical workspace
+  location. A signature over one project's policy never authorizes a
+  byte-identical file in another project, a config signature never
+  authorizes a trust root (or vice versa), and a signed policy file
+  copied outside its canonical location does not verify at all.
+- **Sign and re-sign**:
+
+  ```bash
+  oacp trust sign-policy --project <name> --agent <receiver>
+  ```
+
+  signs both files with the receiver's own local key and round-trip
+  verifies them. Unlike messages (append-once, immutable), policy files
+  are long-lived and edited: signing strips any existing trailer and signs
+  the current content — run it again after every policy edit.
+- **Enrollment (downgrade resistance)**: the first successful
+  `sign-policy` run enrolls each target in the machine-local registry
+  `$OACP_HOME/keys/policy_enrollment.json` (part of the keystore trust
+  anchor, outside every project workspace). From then on, that policy
+  file without a verifiable signature — trailer stripped, or crypto
+  unavailable — is `invalid`, never `unsigned`: stripping a signature is
+  tampering, not a path back to bootstrap. Enrollment is recorded only
+  after every target round-trip verifies, so a partial signing failure
+  never strands an unsigned file behind downgrade resistance.
+- **Writers re-sign or refuse**: trust mutations that re-emit
+  `allowed_signers.yaml` (`oacp trust import` / `revoke`) atomically
+  re-sign an enrolled trust root with the receiver's own key. If the
+  signing key is unavailable, the mutation is refused before anything is
+  written — a writer never strips an enrolled file's signature as a side
+  effect, and a fleet-wide revoke either fully lands signed or leaves
+  zero pins changed.
+- **One authorized read path**: consumers load policy files through a
+  single loader that reads the file once (bounded at 1 MiB), verifies
+  those bytes, and parses the policy from the same snapshot — the bytes
+  evaluated are always the bytes verified. This covers the autonomy gate,
+  intake's trust-root load, the envelope compiler, the send helper's
+  signing-intent read, trust mutations, and the inbox lister; `oacp
+  doctor` reports each policy file's authorization status per receiver
+  (verified / unsigned-bootstrap / invalid / unsupported) without
+  blocking diagnostics.
+- **Verified at load, fail closed on tamper**: loaders check the signature
+  wherever the policy is consumed. The gate records the outcome in every
+  decision as a `policy_auth` block (`status`, `signer_agent`,
+  `signer_kid`, `reason`); together with `policy_sha256` the record
+  commits to an authorized policy identity, not just bytes. A **tampered**
+  `config.yaml` pauses the decision with reason code `policy_auth_invalid`
+  before anything reads the config — including its own `verify_mode`, so a
+  tamper cannot switch enforcement off. A **tampered**
+  `allowed_signers.yaml` makes the trust root unusable exactly like an
+  unreadable one: no pins load, and under `enforce` every inbound message
+  consequently rejects. Both failures are distinguishable in the record
+  from a policy that is merely *absent* (absent config is a usage error
+  with no record; absent pins simply mean no pins).
+- **Bootstrap**: a fresh workspace's policy files are unsigned and load
+  normally with `policy_auth.status: unsigned` recorded — signing requires
+  a key, so the order is `oacp init` → `oacp key gen --agent <receiver>` →
+  `oacp trust sign-policy`. Unsigned is a visible, recorded state, never a
+  silent one. On a host without the crypto extra, a signed but
+  *unenrolled* policy file records `unsupported` and loads (signing
+  itself always requires the extra); an *enrolled* one is `invalid` —
+  fail closed, because that host's registry proves a signature is
+  required.
+
 ## Key management
 
 - **Keys are per-machine and never leave `$OACP_HOME/keys/`.** They are
@@ -235,3 +375,9 @@ signed prefix bytes, and JWS preimages, plus a tamper-detection suite
 cases). Implementations of the framing or the verify flow should run
 against it; the corpus README defines which expected fields are
 normative and why regenerating goldens requires a ruling.
+
+The receive-path behavior — what a receiver *does* with each verification
+outcome under each verify mode — is pinned separately by the intake corpus
+at `tests/conformance/intake/`: four failure classes (unsigned /
+signed-INVALID / unknown-kid / revoked) under `off`/`warn`/`enforce`, plus
+a signed-verified positive control, executed against the real gate CLI.