feat: add fail-closed policy enforcement (DSE-716)

DOCUMENTATION_INDEX.md

@@ -84,6 +84,7 @@ scope-honesty box and makes no compliance/regulatory claim.
 | [`docs/THREAT_MODEL_V2.md`](docs/THREAT_MODEL_V2.md) | **(v0.2)** Addendum extending the v0.1 model: T-RESULT vectors, the defends (BLOCK) / monitors (fuzzy) / still-does-NOT-defend (T-BEHAVE) table, runtime trust-model notes, retained + added cuts, shadow-default positioning |
 | [`docs/AGENT_TRUST_KERNEL.md`](docs/AGENT_TRUST_KERNEL.md) | **(DSE-714, design contract)** Normative invariants for the future deterministic Agent Trust Kernel: trust boundaries, complete mediation, default deny, non-overridable critical classes, evidence-before-effect, offline operation, residual risks, and bindings for DSE-715 through DSE-717. MCP-Warden v1.1 is explicitly not yet ATK-conformant |
 | [`docs/CONTENT_ENVELOPE.md`](docs/CONTENT_ENVELOPE.md) | **(DSE-715, implemented foundation)** Strict immutable V1 content envelope, domain-separated exact-byte digests, canonical metadata boundary, bounded one-hop lineage, monotonic taint, stable code-only errors, and secret-safe public projection. Evidence only; no authority or whole-ATK conformance claim |
+| [`docs/POLICY_ENFORCEMENT.md`](docs/POLICY_ENFORCEMENT.md) | **(DSE-716, implemented foundation)** Versioned signed policy/runtime/adapter/executable-bundle activation, exact adapter/bundle-bound leases, mechanically derived frozen handler identity, deterministic default-deny PDP, evidence-gated structural PEP, stable reason/recovery matrix, caps, and non-optional fixed-corpus adapter harness. DSE-717 durable evidence remains required |
 | [`docs/WARDEN_LOCK_SCHEMA.md`](docs/WARDEN_LOCK_SCHEMA.md) | **mcp-warden implementation of [`docs/SPEC.md`](docs/SPEC.md) (MCP Lock Format v1).** `warden.lock` format, RFC 8785 canonicalization + SHA-256 hashing, field/entry/overall digests, the normative drift definition + severities; **§5.1/§6.2 structural schema diff** (normalized per-tool `schema_skeleton`, `schema_version` 3 — skeleton added at v2, in-document `$ref` resolution at v3 (#29), granular `WRD-DRIFT-SCHEMA-*` taxonomy + severities, v1 fallback); **§8.1/§8.2 (v0.3, #19)** structured out-of-digest provenance (`pinner` / `attestations` / `rotation_count`, `PROVENANCE_VERSION`, B4 `bound_digest` format) + `lock rotate` digest-invariant semantics + the #16 signing implication; **§11 (v0.2)** optional per-tool inspection policy (`expected_output_charset` / `may_return_urls` / `secret_echo_applies`, fail-safe defaults, digest impact) |
 | [`docs/WARDEN_LOCK_EXAMPLE.md`](docs/WARDEN_LOCK_EXAMPLE.md) | Illustrative full `warden.lock` + a post-`lock rotate` `pin` block (archived from WARDEN_LOCK_SCHEMA §9 to keep that core doc under the line cap) |
 | [`docs/CHECKS.md`](docs/CHECKS.md) | The deterministic `WRD-*` static-check catalog (capability/secret/supply/robustness), the shared tokenizer, severity→SARIF mapping, redaction rule, CUT list. **Reused by v0.2** `WRD-RES-SECRET-ECHO` (the `WRD-SEC-*` patterns + redaction) |
@@ -99,6 +100,7 @@ scope-honesty box and makes no compliance/regulatory claim.
 |---|---|
 | [`docs/plans/2026-07-18-agent-trust-kernel-design.md`](docs/plans/2026-07-18-agent-trust-kernel-design.md) | **Non-normative execution record.** Records the DSE-714 design decision and verification plan; binding requirements live in `docs/AGENT_TRUST_KERNEL.md` |
 | [`docs/plans/2026-07-18-content-envelope-design.md`](docs/plans/2026-07-18-content-envelope-design.md) | **Non-normative DSE-715 execution record.** Records the reviewed strict-TDD plan; verified behavior is documented in `docs/CONTENT_ENVELOPE.md` |
+| [`docs/plans/2026-07-19-pdp-pep-design.md`](docs/plans/2026-07-19-pdp-pep-design.md) | **Non-normative DSE-716 execution record.** Records the activated-snapshot, structural-PEP, TDD, and review plan; verified behavior is documented in `docs/POLICY_ENFORCEMENT.md` |
 
 ---
 
@@ -133,6 +135,8 @@ scope-honesty box and makes no compliance/regulatory claim.
 |--------|----------------|-------------|
 | `src/mcp_warden/hashing.py` | `canon()` (RFC 8785) + `hash()` + field hashes | WARDEN_LOCK_SCHEMA §3 |
 | `src/mcp_warden/content_models.py` · `content_envelope.py` | **(DSE-715)** Strict immutable evidence models; typed domain-separated byte hashing call surface; canonical constructors/parser; bounded derivation and one-hop lineage; explicit secret-safe projection | CONTENT_ENVELOPE.md / AGENT_TRUST_KERNEL ATK-01/02/05/06/09/12 |
+| `src/mcp_warden/decision_models.py` · `policy_decision.py` | **(DSE-716)** Strict V1 decision models; signed policy/runtime activation; exact lease/request binding; deterministic default-deny PDP; canonical digest-only decisions and stable recovery codes | POLICY_ENFORCEMENT.md / AGENT_TRUST_KERNEL ATK-03/05/06/07/08/09 |
+| `src/mcp_warden/policy_enforcement.py` · `handler_identity.py` · `executable_bundle.py` · `adapter_conformance.py` | **(DSE-716)** Signed adapter and executable-bundle closure; exact manifest-bound leases; closure-free mechanically code/dependency-derived frozen handlers; canonical effect binding; evidence-gated PEP; PEP-owned execution trace and multiple output-channel scans; mandatory versioned malformed-input corpus | POLICY_ENFORCEMENT.md / AGENT_TRUST_KERNEL ATK-03/04/06/08 |
 | `src/mcp_warden/tokenizer.py` | Shared tokenizer + capability derivation (single source of truth) | CHECKS §3 / WARDEN_LOCK_SCHEMA §5.4 |
 | `src/mcp_warden/capture.py` | Declared-surface capture over stdio (argv array, no shell) or Streamable HTTP (`--url`); shared list normalization, timeouts, and errors | THREAT_MODEL §3.3 / WARDEN_LOCK_SCHEMA §4.1 |
 | `src/mcp_warden/models.py` | Pydantic models for captured surface + lock (incl. `Pinner`/`Attestation` provenance) | WARDEN_LOCK_SCHEMA §2–§8 |
@@ -173,6 +177,7 @@ scope-honesty box and makes no compliance/regulatory claim.
 |------|--------|
 | `tests/test_hashing.py` | JCS+SHA-256 reproducibility, canonical-form pins, null handling |
 | `tests/test_content_envelope.py` | **(DSE-715)** Strict/frozen models, typed digest domains, nine ingress kinds, canonical/cap boundary, deterministic lineage, parser rejection matrix, atomic digest verification, and planted-secret output/error/log scans |
+| `tests/test_policy_decision.py` · `test_policy_enforcement.py` · `test_adapter_conformance.py` | **(DSE-716)** Exact policy/runtime/adapter/bundle activation, deterministic decisions, every subject/effect/lease/manifest binding, trusted-time/rollback/revocation matrix, critical floor, hostile nested construction, callable drift resistance, evidence/sink ordering, fixed-corpus enforcement, cap boundaries, and deterministic reports |
 | `tests/test_tokenizer.py` | Segment-exact tokenization + capability derivation |
 | `tests/test_checks.py` | Capability/secret/supply/robustness checks + redaction |
 | `tests/test_drift.py` | Drift per class (added/removed/modified/server-identity/unapproved) |
@@ -192,7 +197,7 @@ scope-honesty box and makes no compliance/regulatory claim.
 | `tests/test_guard_v3.py` | **(v0.3)** opt-out demotes to shadow (`--no-block-*`/`--allow-exfil-domain`/`--no-block-deterministic`), `tools/list_changed` gate block+shadow, policy deny block+shadow, audit-only override, cancel/progress passthrough, **server-crash → `-32002` for every pending id**, client-disconnect child reap (no orphan), truncated + oversized frame fail-open |
 | `tests/test_guard_strict.py` | **(#21)** `--strict` fail-CLOSED: 4 terminate sites (request-policy / result-inspect / list-gate / nested-hash re-raise) → exit `3` + one `strict_abort` stderr line + `-32003` client frame + child reaped; negatives (truncated/over-cap/unparseable/clean) do NOT abort; default `--no-strict` byte-identical fail-open regression; secret-leak redaction; CLI threading; double-emission single line; `StrictInspectionAbort` is `BaseException`-not-`Exception` + anyio `ExceptionGroup` unwrap |
 | `tests/test_inspect_parity.py` | **(v0.2)** guard↔inspect finding parity on the same recorded frames + inspect exit codes |
-| `tests/fuzz/` (`test_fuzz_framing.py` · `test_fuzz_ansi.py` · `test_fuzz_domain.py` · `test_fuzz_redact.py` · `test_fuzz_content_envelope.py`) | **(#17 / DSE-715)** `hypothesis` property-fuzzing of the live runtime attack surface plus content-envelope repeatability, round-trip, parent permutation, taint monotonicity, mutation rejection, malformed-byte bounded termination, flat-cycle non-recursion, registry drift, and planted-secret absence. `ci`/`fuzz` profiles in `tests/fuzz/conftest.py`; deep soak via `make fuzz` |
+| `tests/fuzz/` (`test_fuzz_framing.py` · `test_fuzz_ansi.py` · `test_fuzz_domain.py` · `test_fuzz_redact.py` · `test_fuzz_content_envelope.py` · `test_fuzz_policy_decision.py`) | **(#17 / DSE-715 / DSE-716)** `hypothesis` property-fuzzing of the live runtime attack surface, content envelopes, identity substitution, arbitrary effect bytes, explicit trusted-time boundaries, deterministic decisions, and planted-secret absence. `ci`/`fuzz` profiles in `tests/fuzz/conftest.py`; deep soak via `make fuzz` |
 | `tests/fixtures/clean_server.py` · `mutated_server.py` | Real MCP SDK stdio fixtures |
 | `tests/fixtures/poison_server.py` | **(v0.2)** result-poisoning fixture server (ANSI/secret-echo/exfil/inject/clean tools) |
 | `tests/fixtures/crash_server.py` · `listchange_server.py` · `clean_listchange.warden.lock` | **(v0.3)** raw-stdio lifecycle fixtures: crash-mid-call (`-32002`) and `tools/list_changed` rug-pull + its pinned clean lock |

README.md

@@ -462,6 +462,14 @@ empty `allow_paths` = deny-all. See [`docs/POLICY_MODEL.md`](docs/POLICY_MODEL.m
 
 ## Documentation
 
+Agent Trust Kernel development is intentionally isolated from the shipped `guard` path:
+DSE-715's content envelope and DSE-716's deterministic PDP/PEP, exact signed adapter/bundle load
+gates, frozen handler identity, and fixed-corpus adapter harness are implemented foundations, but
+the default evidence gate denies effects. Durable signed receipts,
+fallback evidence, rollback-resistant state, the recovery latch, and any whole-kernel conformance
+claim remain DSE-717. See [`docs/POLICY_ENFORCEMENT.md`](docs/POLICY_ENFORCEMENT.md) and
+[`docs/AGENT_TRUST_KERNEL.md`](docs/AGENT_TRUST_KERNEL.md).
+
 See [`DOCUMENTATION_INDEX.md`](DOCUMENTATION_INDEX.md). The security-contract specs
 under `docs/` (including [`GUARD_PROXY_V3.md`](docs/GUARD_PROXY_V3.md) for the v0.3
 default-block + lifecycle contract) are the source of truth for every algorithm; the

SYSTEM_CONTEXT_DIAGRAM.md

@@ -20,11 +20,12 @@ logic) plus a separate informational provenance section. It never prints raw
 `server.command`/`args` (secret-safe); default exit 0, `--exit-code` → 1 on integrity drift only.
 
 > **Agent Trust Kernel status:** [`docs/AGENT_TRUST_KERNEL.md`](docs/AGENT_TRUST_KERNEL.md)
-> is the normative contract. DSE-715 implements the isolated content-envelope foundation
-> (untrusted ingress, deterministic lineage, monotonic taint, secret-safe projection), but it
-> is not wired into `guard` and grants no authority. DSE-716/717 must still deliver PDP/PEP
-> complete mediation and signed evidence-before-effect. The current `guard` path is not
-> represented as ATK-conformant.
+> is the normative contract. DSE-715 implements the isolated content-envelope foundation.
+> DSE-716 implements isolated signed policy/runtime/adapter/bundle activation, exact
+> adapter/bundle lease binding, deterministic PDP, evidence-gated PEP, frozen handler identity,
+> and fixed-corpus adapter-conformance APIs. None is wired into `guard`; the default evidence gate denies
+> effects. DSE-717 must still deliver durable signed evidence, fallback, rollback-resistant
+> state, and the recovery latch. The current `guard` path is not represented as ATK-conformant.
 
 > `conclave` (the 4-model adversarial council referenced in `docs/THREAT_MODEL.md`)
 > is a **dev-time design reviewer** that shaped this contract. It is **NOT** a
@@ -66,9 +67,11 @@ flowchart TB
     end
 
     envelope["Content Envelope V1\nDSE-715 · implemented evidence foundation\nNOT wired to guard · grants no authority"]
-    future["Future PDP/PEP + signed evidence\nDSE-716–717 · NOT IMPLEMENTED"]
+    decision["Deterministic PDP/PEP V1\nDSE-716 · signed adapter/bundle gates + fixed corpus\nNOT wired to guard"]
+    evidence["Durable evidence + recovery state\nDSE-717 · NOT IMPLEMENTED\ndefault gate denies effects"]
     atk -. "governs partial foundation" .-> envelope
-    envelope -. "required input" .-> future
+    envelope -. "required input" .-> decision
+    decision -. "requires production gate" .-> evidence
 
     subgraph ci["CI pipeline (GitHub Actions / local)"]
         warden["mcp-warden CLI\npin · check · policy · lock rotate · diff"]

docs/AGENT_TRUST_KERNEL.md

@@ -440,6 +440,25 @@ This partial implementation does not change the current-product boundary: no shi
 may claim ATK conformance until DSE-716/717 integrate the envelope through the complete
 mediation and durable evidence paths and every conformance gate below passes.
 
+### DSE-716 implementation status
+
+The versioned DSE-716 modules now implement the isolated decision/enforcement foundation for
+ATK-03 through ATK-09: exact signed policy/runtime/adapter/executable-bundle activation, adapter and
+bundle dependency closure, leases bound to exact adapter and executable-bundle manifests,
+deterministic default-deny PDP decisions, a non-overridable V1 critical floor, closure-free,
+mutable-global-free mechanically code/dependency-derived frozen handler registration, a PEP whose supported path
+orders exact binding then decision then bound evidence then sink, and a PEP-owned instrumented
+foundation harness with registration evidence, multiple serialized output-channel scans, and a
+non-optional versioned malformed-input corpus. The default evidence gate denies every otherwise
+allowed effect.
+
+This is still a partial implementation. It is not wired into the historical `guard`, supplies no
+built-in production verifier or live protocol adapter, and does not implement DSE-717's durable
+signed receipts, independent fallback evidence, rollback-resistant state, or persistent recovery
+latch. A custom evidence gate becomes TCB code and does not create an ATK-conformance claim. No
+production effect or whole-kernel claim is valid until DSE-717 closes ATK-10 through ATK-12 and
+the full §11 platform/restart/rollback gates pass.
+
 ## 11. Conformance gates
 
 A component or adapter may claim ATK conformance only through a mechanically executable suite.