@sema-agent/core/dist/core/safety-merge-corpus.d.ts

Stateless, task-oriented AI agent core

import type { SessionPermissionRules } from "./session-policy-store.js";
/**
 * design/99 (sema-registry center control-plane seam, channel review R2): the PUBLISHED golden conformance corpus
 * for the safety-domain MERGE predicate {@link loosenReasons}.
 *
 * THE SEAM. The center control-plane's ConfigBundle merger is a DISPATCHER: for any field it classifies
 * safety-critical (the permissions / tool-policy domain), it MUST delegate the org-published-vs-workspace-override
 * decision to core's {@link loosenReasons} (NOT re-implement "deny>allow" — a forked safety law is the exact
 * "mixed = security incident" failure). Core owns the safety SEMANTICS; center owns the bundle merger that calls it.
 *
 * THIS CORPUS is the anti-drift anchor between the two codebases (the design/87 gold-corpus discipline):
 *  - CORE runs it as a regression test (`test/safety-merge-corpus.test.ts`) — every vector's `reasons` MUST equal
 *    `loosenReasons(prior, next)`. If core ever changes the loosen law, this test fails and the corpus updates in
 *    lockstep with the engine version, so the published contract can never silently drift from the implementation.
 *  - The CENTER imports this corpus from `@sema-agent/core` and runs it as a CONTRACT test in its merger CI: for each
 *    vector, its merger's accept/reject of a non-operator workspace override on the permissions domain MUST match
 *    `loosens` (reject iff `loosens`). That proves center's dispatcher actually routes through core's predicate.
 *
 * Invariant under test: a workspace override that LOOSENS an org-published safety rule (removes a deny, widens an
 * allowlist, removes/widens a path confinement) is a tighten-only violation — `loosens === true`, and a
 * non-operator write of it MUST be rejected. A pure tighten / no-op is `loosens === false`.
 */
export interface SafetyMergeVector {
    /** Stable case id (appears in test output + the published contract). */
    name: string;
    /** What this vector proves. */
    intent: string;
    /** The org-published baseline (the lower, authoritative layer). */
    prior: SessionPermissionRules;
    /** The proposed workspace-override (the upper layer being merged down). */
    next: SessionPermissionRules;
    /** Whether `next` LOOSENS `prior` — true ⇒ a non-operator merge of this override MUST be rejected. */
    loosens: boolean;
    /** The EXACT reasons {@link loosenReasons}(prior, next) returns (compared order-insensitively). Empty iff
     *  `loosens` is false. Pinned so CORE's regression test catches a change in the loosen SEMANTICS, not just the
     *  boolean. ⚠️ CENTER CONTRACT: depend ONLY on `loosens` (reject-iff-loosens) — `reasons` is core's internal
     *  message wording, anti-drift for core; a center CI that asserts on `reasons` would break on a core reword. On
     *  ACCEPT (`loosens === false`) the resolved safety-domain value is `next` (the tightened override applied). */
    reasons: string[];
}
/**
 * The published vectors. Covers every loosen path in {@link loosenReasons} (deny removal, allowlist widen, allowlist
 * removal = all-allowed, path-confinement removal, path widen, and a multi-axis loosen) plus the tighten / safe /
 * no-op cases (adding a deny, narrowing an allowlist, narrowing-to-a-subdir, adding confinement from none, identical,
 * empty). Extend it as the safety domain grows — both core and center re-run it.
 */
export declare const SAFETY_MERGE_CONFORMANCE_CORPUS: readonly SafetyMergeVector[];