Conversation
added 2 commits
September 27, 2026 00:18
- Add canonical nexus.tool_exposure_receipt.v1 producer in src/tool-exposure-receipt.ts - Wire toolExposureReceipt into HerdrExternalHandle, NormalizedHerdrHandleAuthority, and LocalAgentSessionManager - Produce ENFORCED_MANAGED_BRIDGE for OpenCode via opencodeAgentConfig permission projection - Maintain fail-closed REQUEST_ONLY_NOT_ENFORCED for un-enforced CLI providers (agy, codex, grok, cline) - Expose toolExposureReceipt in StartAgentOutput, AgentStatusOutput, and ReconcileAgentOutput - Add unit and matrix test suite in src/tool-exposure-producer.test.ts
#190 G3) - R1: Revert package.json changes and remove non-scope files tool-exposure-receipt.ts and tool-exposure-producer.test.ts; migrate all implementation and tests to authorized files - R2: Set planner_decision_hash from executionContract or zero-padded sha256 rather than dispatchIntentHash - R3: Use canonical hashToolProjectionManifest for full ToolProjectionManifest projection_hash - R4: Physically extract actual_exposed_tools from OPENCODE_CONFIG_CONTENT JSON injected into workspace.create - R5: Handle enforcementState PHYSICALLY_ENFORCED for OpenCode managed bridge and REQUEST_ONLY_NOT_ENFORCED for CLI - R6: Operation ID derives from dispatchIntent.taskId with attemptKey fallback - R7: Full schema compatibility for remote_tool_identities and runtime_tool_generations - R8: Validate sorting and hashing invariants on tool exposure receipts - R10-R16: Repair unit tests and session manager integration within authorized test files
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements and repairs TASK-DEVSPACE-190-G3-HERDR-PHYSICAL-PRODUCER for #190 under campaign CAMPAIGN-DEVSPACE-190-HERDR-PHYSICAL-PRODUCER (Card digest:
sha256:49c0d29ae5534c0347ee93739d2da2ef1240c3ff4434ff1a41dbb80b7a869f7d).Repair Finding Resolution (R1 - R16)
package.jsonto base (be1d7a075dd534c4353486396fe1ed0c6baa3938, zero diff). Removed unauthorized filessrc/tool-exposure-receipt.tsandsrc/tool-exposure-producer.test.ts. All receipt definitions, schemas, and validators moved tosrc/local-effect-enforcement.ts. All producer mechanics moved tosrc/local-agent-herdr.ts. All tests moved tosrc/local-agent-herdr.test.tsandsrc/local-agent-opencode.test.ts. Exactly the 5 authorized files are changed.dispatchIntentHashassignment withplannerDecisionHashfromexecutionContract/toolAuthorityor zero-padded sha256 (0.repeat(64)).hashToolProjectionManifestfromexecution-protocol.ts(covers all canonical fields) rather than ad-hoc partial hashing.extractActualExposedToolsFromOpencodeConfiginspecting the generatedOPENCODE_CONFIG_CONTENTJSON environment injected intoworkspace.create, physically derivingactual_exposed_toolsfromagent.devspace_read_only.permission/devspace_allowed.permission.enforcementState = "PHYSICALLY_ENFORCED"andreceipt.enforcement_mode = "ENFORCED_MANAGED_BRIDGE". CLI providers setenforcementState = "REQUEST_ONLY_NOT_ENFORCED",receipt.enforcement_mode = "REQUEST_ONLY_NOT_ENFORCED",actual_exposed_tools = [].bindHerdrExternalHandlepermitsPHYSICALLY_ENFORCEDexclusively for OpenCode managed bridge.operation_id = dispatchIntent?.taskId ?? attemptKey. Never falls back toattemptKeywhentaskIdis known.remote_tool_identitiesandruntime_tool_generationswith deterministic sorting and validation matching Nexus Python contract.PHYSICAL_AB_CANARY=PHYSICAL_CANARY_NOT_RUN (daemon restart forbidden)to respect no-daemon-restart invariant.H1–H8inlocal-agent-herdr.test.ts, config extractor inlocal-agent-opencode.test.ts). Ran full verification suites.Verification
npm run typecheck: PASS (clean 0 errors)npm run test:local-agent-sessions: PASS (31/31 passed)npx tsx src/local-agent-opencode.test.ts: PASSgit diff be1d7a075dd534c4353486396fe1ed0c6baa3938...HEAD --name-status: EXACT 5 authorized filesgit diff --check: PASS (clean 0 whitespace errors)Ref: #190
Consumer Ref: James3014/Nexus-new#1144