Audit: Agent Capability Boundaries

Scope

This audit covers the complete implementation of m10-agent-capability-boundaries: the extension of AgentPolicy with read-path and profile-override access controls, session-gated read methods, schema build-time validation, and audit integration.

Files Changed

File	Change Type	Risk
`tidal/src/schema/validation/policies.rs`	Additive (5 new fields + Default update)	Low
`tidal/src/schema/validation/builders/mod.rs`	Additive (new field, new method, new validation)	Low
`tidal/src/schema/error.rs`	Additive (3 new error variants)	Low
`tidal/src/session/policy.rs`	Additive (3 new methods, 5 new enum variants, 12 new tests)	Low
`tidal/src/session/audit.rs`	Additive (3 new AuditKind variants)	Low
`tidal/src/session/snapshot.rs`	Bug fix (overrides_rejected was hardcoded to 0)	Low
`tidal/src/db/signals.rs`	Additive (4 new public methods, 2 new private helpers)	Low
`tidal/src/db/query_ops.rs`	Additive (1 private helper, enforcement calls)	Low
`tidal/src/lib.rs`	Additive (3 new re-exports)	Low
`tidal/tests/m10_agent_capability.rs`	New (17 integration tests)	None

No existing public API methods were changed. No WAL changes. No storage changes. No new modules.

Correctness

Read-path enforcement correctly follows the deny-before-allow evaluation order specified in the spec. An empty allow list is unrestricted (not a block-all). An empty deny list is a no-op. This matches the spec's zero-cost fast-path requirement.

Profile override enforcement correctly treats an empty allowed_profile_overrides as "no overrides permitted." The query-level profile name supplied by the caller is checked against the policy before the query executor runs. Both retrieve() and search() are covered.

Snapshot bug fix (overrides_rejected was hardcoded to 0): the fix correctly reads from state.overrides_rejected.load(Ordering::Relaxed) in both build_snapshot and build_frozen_snapshot. This was a latent bug in prior code that the feature exposed and corrected.

SchemaBuilder::new() change from const fn to regular fn is correct and necessary due to Vec::new() not being const in the current MSRV (1.91). No callers relied on the const fn property.

Sentinel "*" expansion resolves to all names registered via declare_profile_names(). If declare_profile_names() was not called, the builder's known_profile_names is empty, so "*" expands to an empty list — effectively disabling the guard, which is the correct behavior (same as empty allowed_profile_overrides).

Backward Compatibility

All new AgentPolicy fields default to empty Vec. The ..AgentPolicy::default() pattern was added to the one struct literal in session_tests.rs that used positional construction. All other existing tests and callers are unaffected. The Default impl was updated correctly.

Security Properties

Read-path enforcement is cooperative at the API boundary (non-session reads remain unrestricted, as documented in the spec non-goals).
Policy evaluation occurs at the call site before any ledger access — violations do not leak data.
Audit log entries are recorded for all violations, enabling forensic review.
signals_rejected counter is incremented for read violations (consistent with write violation accounting).
overrides_rejected counter is independent (tracked separately from signals_rejected).

Performance

All new policy checks short-circuit in O(1) when the relevant lists are empty (the common case for policies that do not restrict reads). Non-empty list checks are O(n) linear scan over Vec<String> — acceptable for typical policy sizes (n ≤ 20). The spec notes that HashSet promotion at n > 50 is available as a future optimization.

No heap allocation occurs on the fast path for empty-list policies.

Test Adequacy

17 integration tests cover all 12 acceptance criteria. 12 unit tests in session/policy.rs validate the PolicyEvaluator methods in isolation. Coverage includes:

Allow-list gate (signal in list → Ok, signal not in list → ReadNotAllowed)
Deny-list gate (signal in deny list → ReadDenied regardless of allow list)
Attribute read allow/deny
Profile override allowed and blocked paths
Audit log recording
Counter increments (signals_rejected, overrides_rejected)
Empty-policy regression (no behavior change)
Schema build-time failure modes (3 cases)
Sentinel "*" expansion
Ungated reads unaffected by session policies

Verdict

APPROVED — implementation is correct, safe, backward-compatible, and adequately tested. No issues requiring remediation.

4.6 KiB Raw Blame History