Master doc: docs/shaping/acs-reference-impl-slices.md §V9 — authoritative for this slice's scope. Measurements in docs/shaping/spike-unreached-gates.md.
Demo: Ask for a web fetch of a host the allowlist does not cover. AGT's stock egress gate denies it — a fourth gate class live, from one data.json key and no code. Then ask for the same destination over curl, and it denies again, this time from a Guardian-extracted destination. Both verdicts come from the same unforked rule.
Blocked by: #9
Plan: (added when planned)
Why there is code in this at all
The demo's first half needs none. egress.rego's first default destination path is snapshot.tool_call.args.url, and assemblePreToolCallSnapshot already lands ACS arguments.url.value there — measured allow/deny with one data.json key and one manifest tools: entry.
The code is what makes a second tool shape work at all. AGT's intervention_point is additionalProperties: false with exactly one policy_target, and the shipped $.tool_call.args.command denies a benign WebFetch call with runtime_error:path_missing before any rule runs. It has never bitten because the deployment governs exactly one tool.
Scope boundary
Only the request gate's matcher widens. PostToolUse declares outputs.from: $.tool_response.stdout; a fetch result has no stdout, so buildPayload throws and under the shipped proceed posture the step runs ungoverned. No stock gate reads a fetch's output, so widening it buys nothing and costs a fail-open. The general form is risk row 24 and is unassigned.
Amendments
Master doc:
docs/shaping/acs-reference-impl-slices.md§V9 — authoritative for this slice's scope. Measurements indocs/shaping/spike-unreached-gates.md.Demo: Ask for a web fetch of a host the allowlist does not cover. AGT's stock
egressgate denies it — a fourth gate class live, from onedata.jsonkey and no code. Then ask for the same destination overcurl, and it denies again, this time from a Guardian-extracted destination. Both verdicts come from the same unforked rule.Blocked by: #9
Plan: (added when planned)
Why there is code in this at all
The demo's first half needs none.
egress.rego's first default destination path issnapshot.tool_call.args.url, andassemblePreToolCallSnapshotalready lands ACSarguments.url.valuethere — measured allow/deny with onedata.jsonkey and one manifesttools:entry.The code is what makes a second tool shape work at all. AGT's
intervention_pointisadditionalProperties: falsewith exactly onepolicy_target, and the shipped$.tool_call.args.commanddenies a benignWebFetchcall withruntime_error:path_missingbefore any rule runs. It has never bitten because the deployment governs exactly one tool.Scope boundary
Only the request gate's matcher widens.
PostToolUsedeclaresoutputs.from: $.tool_response.stdout; a fetch result has nostdout, sobuildPayloadthrows and under the shippedproceedposture the step runs ungoverned. No stock gate reads a fetch's output, so widening it buys nothing and costs a fail-open. The general form is risk row 24 and is unassigned.Amendments