flowchart TD
NOTE["TWO separate enforcement domains — different threat, different machinery<br/>A · operator-authority governs the agents that BUILD Steelmoth · B · authz governs the assistant that ACTS for users"]
subgraph DA["A · Operator-Authority — governs CODING AGENTS (build-time)"]
direction TB
AG["Coding agents · Claude Code · Codex · Morpheus drain"]
HOOK["PreToolUse hook (Claude Code · stdin) / shim (Codex · args)<br/>runs before EVERY write · edit · shell command"]
GATEA{"Operator-Authority gate · gate.py<br/>reads AGENT_POLICY.yaml + worktree scope manifest<br/>exit 0 = allow · exit 2 = deny"}
PP["protected paths · deny-by-default"]
SCOPE["scope manifest · #scope tokens · task-approved"]
LAND["Landlock · kernel filesystem sandbox (last-resort wall)"]
AQ["Approval queue · dashboard Phase 8 · operator approves"]
VIOL["violations.jsonl · audit + post-hoc sweep"]
AG --> HOOK --> GATEA
PP --> GATEA
SCOPE --> GATEA
GATEA -->|allow| LAND
GATEA -->|approval-required| AQ
AQ -->|approved| LAND
GATEA -->|deny · exit 2| VIOL
end
subgraph MERGE["A2 · Merge-time — blocks the PR (the wall moves to CI)"]
direction TB
CO["CODEOWNERS · operator review on protected paths"]
CI["CI guards · changelog-updated · sidebar-no-removal · vault-no-local-secret · release-versions"]
FIT["Invariant fitness tests · INV-024 broker-only-prontera · INV-025 no-second-brain · canonical-containers"]
end
LAND --> PR["PR / commit"]
PR --> CO
PR --> CI
PR --> FIT
CO --> MAIN["merge to main · deploy source of truth"]
CI --> MAIN
FIT --> MAIN
subgraph DB["B · Authorization pipeline · authz/govern — governs the ASSISTANT (runtime)"]
direction TB
AS["The one brain · wants to act for a user (send email · drive browser)"]
ENV["SERVER builds the request envelope — NOT the model<br/>(confused-deputy guard · the model can't sweet-talk its own paperwork)"]
RISK["1 · risk score"]
POL["2 · policy · PDP · fail-closed"]
DLP["3 · DLP + egress + chain + RS256 sign"]
AUD["4 · hash-chained audit + governance_decisions (multi-tenant)"]
MODE{"shadow = observe / enforce"}
RUN["tool runs"]
BLK["blocked"]
ESC["escalate · write-action token / Telegram approval"]
AS --> ENV --> RISK --> POL --> DLP --> AUD --> MODE
MODE -->|allow| RUN
MODE -->|deny| BLK
MODE -->|escalate| ESC
ESC -->|approved| RUN
end
subgraph DC["B2 · Data plane — every memory read/write"]
direction TB
RLS["Memlink scope authority · owner+lane FORCE row-level security (ADR 0135/0136)"]
SIGN["per-tenant Ed25519 scope signing / verification (RFC 0091)"]
WGATE["ontology writable-slot gate · validate_fact_candidate (RFC 0099)"]
RLS --> SIGN
RLS --> WGATE
end
RUN -.memory read/write.-> RLS
subgraph DS["Secret plane (shared) — PRONTERA only"]
direction TB
VAULT["Agent Vault broker · bearer token + client-vault binding (INV-024 / HR10)"]
end
RUN -.secrets.-> VAULT
AG -.secrets.-> VAULT
GATEA -. writes .-> OADB[("DB · operator_authority.* · scope_manifests · approval_requests · task_plans · sessions · settings · violations · projector_health<br/>+ files /var/lib/operator-authority + /var/log/operator-authority/violations.jsonl")]
VIOL --> OADB
AUD -. writes .-> GVDB[("DB · steelmoth.governance_decisions · write_action_audit · write_approval_tokens · runtime_context_audit")]
RLS -. row-level .-> DPDB[("DB · world.* (owner+lane FORCE-RLS) · core.owner_identity · core.lane_policy")]
VAULT -. logged .-> VLDB[("DB · core.vault_lookup_audit · (secrets live in the prontera vault, NOT the DB)")]
style OADB fill:#ffffff,stroke:#7c5cff,stroke-width:1px,color:#27272a
style GVDB fill:#ffffff,stroke:#7c5cff,stroke-width:1px,color:#27272a
style DPDB fill:#ffffff,stroke:#7c5cff,stroke-width:1px,color:#27272a
style VLDB fill:#ffffff,stroke:#7c5cff,stroke-width:1px,color:#27272a
COV["Coverage reality (the honest part)<br/>14 mechanically enforced · 9 partial · 22 memory-only<br/>WALLS catch ACCESS / ARTIFACT rules — a path · a command · a missing CHANGELOG<br/>MEMORY-ONLY = PROCESS / JUDGMENT rules the gate is structurally blind to — ordering · answer-don't-act · discover-before-build"]
style DA fill:#eef0ff,stroke:#4338ca,stroke-width:3px,color:#4338ca
style MERGE fill:#ecfdf3,stroke:#059669,stroke-width:3px,color:#059669
style DB fill:#fff7ed,stroke:#c2570c,stroke-width:3px,color:#c2570c
style DC fill:#f4f1ff,stroke:#7c5cff,stroke-width:2px,color:#7c5cff
style DS fill:#f1f5f9,stroke:#475569,stroke-width:2px,color:#475569
classDef aaN fill:#ffffff,stroke:#4338ca,color:#27272a,stroke-width:1px
classDef ciN fill:#ffffff,stroke:#059669,color:#27272a,stroke-width:1px
classDef gN fill:#ffffff,stroke:#c2570c,color:#27272a,stroke-width:1px
classDef pN fill:#ffffff,stroke:#7c5cff,color:#27272a,stroke-width:1px
classDef slN fill:#ffffff,stroke:#475569,color:#27272a,stroke-width:1px
classDef rN fill:#fdecec,stroke:#e5484d,color:#27272a,stroke-width:2px
class AG,HOOK,GATEA,PP,SCOPE,LAND,AQ,VIOL aaN
class PR,CO,CI,FIT,MAIN ciN
class AS,ENV,RISK,POL,DLP,AUD,MODE,RUN,ESC gN
class RLS,SIGN,WGATE pN
class VAULT,NOTE slN
class BLK,COV rN
