feat(policies): add decision tokens for transparent agent routing#88
Merged
Destynova2 merged 5 commits intodevelopfrom Apr 6, 2026
Merged
feat(policies): add decision tokens for transparent agent routing#88Destynova2 merged 5 commits intodevelopfrom
Destynova2 merged 5 commits intodevelopfrom
Conversation
Fix run_test shell function (filter args, set -e arithmetic trap), use GROB_HOME correctly, foreground start instead of detached mode, add pass_through for mock provider routing. All 10 tests pass with a Python mock on :8100. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
grob's OpenAI provider appends /chat/completions to base_url (without /v1 prefix). VidaiMock expects the full /v1/chat/completions path. Set base_url to include /v1 to match. All 10 tests pass with vidaimock in podman container. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Refactor setup wizard to collect-then-recap-then-write architecture: - All choices collected in Choices struct before any disk write - Recap screen with confirmation before writing config atomically - Add --yes (accept defaults) and --dry-run (preview) flags - Detect existing config and offer edit/replace/cancel - Store API keys as $ENV_VAR references, never raw keys - Simplify compliance screen from 7 to 5 options (GDPR+EU AI Act merged) - Read provider list from preset TOML dynamically instead of hardcoded table Additional fixes from wizard audit: - Doctor returns meaningful exit codes (0=ok, 1=warnings, 2=errors) - Web API config update creates backup before writing - auto_flow.rs stops replacing $ENV_VAR with raw keys in config - Preset apply supports --dry-run via preview_preset() Add wizard Gherkin tests (6 scenarios, 21 steps): - Unattended setup, dry-run, backup, env var refs, doctor, preset dry-run setup.rs reduced from 800 to 620 lines (-22%). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Remove strategic positioning phrase from ADR-0006 - Remove broken link to deleted ADR-0007 in policies.md - ROADMAP.md, ADR-0007, hit-quorum.md moved to private docs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Decision tokens are MCP tokens emitted by a boss agent, invisible to the target agent. Grob reads the "mode" claim (training/live) to route toward paper or real backends. Includes integrity verification via SHA-256 hash, audience glob matching, and agent-visible view stripping. 11 unit tests cover routing, invisibility, mode switching, tampering detection, serialization roundtrip, and audience matching. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
DecisionTokentype,DecisionModeenum, andBackendTargetfor transparent agent routing in the policy enginemodeclaim (training/live) to route to paper or real backendAgentVisibleTokenwith no access to decision claims (mode, issuer, audience)Changes
src/features/policies/decision_token.rs— full implementation with types, routing, integrity (SHA-256), audience matchingsrc/features/policies/mod.rs— module registrationtests/cucumber/features/decision_token.feature— 5 Gherkin scenariosTests
Test plan
cargo test— 200 passed, 0 failedcargo clippy— clean🤖 Generated with Claude Code