feat(netwatch): real Governor approval loop via guardrail-fabric - #42
Merged
Conversation
Closes the security-critical half of loop #2: netwatch proposals no longer route into the void. The env-var approval stub is replaced by a real guardrail-fabric PolicyDecision. - decide --action A --target T --approve|--deny: records a guardrail-fabric PolicyDecision (allow/deny). Fail-closed — without guardrail-fabric a network mutation cannot be authorized (explicit $PROPHET_GUARDRAIL_FABRIC honored alone). - pending: lists proposed actions still awaiting a Governor decision. - propose: consent-admit -> Governor. Default ESCALATE (human required); a recorded ALLOW + --apply => applied; a recorded DENY => refused. Decisions keyed by (capability, target), consistent across propose/decide/pending. - also fixed the same explicit-root fail-closed bug in the consent-plane binding. Proven end-to-end (real policy-fabric + guardrail-fabric): approve->applied, deny->refused (exit 3), undecided->pending, default->escalate. 11 tests pass (4 new Governor unit tests, hermetic). Runbook updated with the decide/pending flow. Remaining half of loop #2 (graph memory): hellgraph ingestion of the agent.v1 KnowledgeUpdate delta (needs a TS ingest entrypoint) — tracked separately.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the security-critical half of gap #2 (the observe→act loop): netwatch's proposed actions no longer route into the void. The env-var approval stub becomes a real guardrail-fabric
PolicyDecision.The Governor surface
turtle-netwatch decide --action A --target T --approve|--deny [--reason R]— records a real guardrail-fabricPolicyDecision(allow/deny). Fail-closed: without guardrail-fabric a network mutation cannot be authorized (explicit$PROPHET_GUARDRAIL_FABRIChonored alone — no silent sibling fallback).turtle-netwatch pending— proposed actions still awaiting a Governor decision.propose: consent-admit → Governor. Default ESCALATE (human required); a recorded ALLOW +--apply⇒ applied; a recorded DENY ⇒ refused. Decisions keyed by(capability, target), consistent across propose/decide/pending.Proven end-to-end (real policy-fabric + guardrail-fabric engines)
approve → applied · deny → refused (exit 3) · undecided → pending · default → escalate. 11 tests pass (4 new hermetic Governor unit tests incl. the fail-closed-without-guardrail case). Runbook updated with the decide/pending flow.
Also fixed the same explicit-root fail-closed bug in the consent-plane binding (an explicit
$PROPHET_POLICY_FABRICmiss now fails closed instead of falling through to a sibling).Remaining half of loop #2 (graph memory): hellgraph ingestion of the
agent.v1KnowledgeUpdatedelta — needs a small TS ingest entrypoint in hellgraph (its graph API isaddNode/addEdge, no JSON-CLI). Tracked as the paired follow-on.