feat(policy): human-boundary v2 delta (v1.2.46) — X1 deny, decision-namespace forge guard, approvals v2 tuple, A4 non-blocking notice [t_c91076d0, refresh t_f68e8bed]

[maximalang]

Human-boundary policy v2 delta (v1.2.18) — ADR-001

Kanban: t_c91076d0 (fleet-ops). Delta of t_e7e74526 + threat-model t_25908a44 over the v1.2.5 substrate. ADR: docs/decisions/ADR-001-capability-human-boundary-v2.md (trunk 7538369).

What ships

• policy.py — class X1 boundary: any invocation, inspection, planning or dependency on the external auto-updater is denied before any other classification (updater_dependency). Detection is word-bounded over tool names, terminal commands/workdirs and path/URL arguments only, so prose describing the boundary stays writable.
• policy.py — decision-namespace forge guard: worker board free-text writes (kanban bodies, comments, reasons) cannot mint company or owner authority markers (decision_namespace_forgery, fail-closed). Closes the 2026-09-04 worker-comment company-binding regression class at the classifier level. Repo docs/ADRs legitimately quote the markers and stay writable.
• storage.py — approvals v2 fields: nonce, expires_at (24h TTL), principal_ref (sha256 fingerprint of owner user/direct-chat ids, never raw ids), channel, amount_rub, scope. Idempotent schema heal (v5). Expiry enforced at exact-binding consumption; an expired grant is refused, surfaced and re-armed as a fresh pending cycle (nonce rotation). Legacy rows keep v1 semantics (NULL expiry = never expires).
• runtime.py — hard-gate binding fills the full v2 tuple; A4 ordinary product/UX/brand-risk path queues exactly one a4_review_notice event and proceeds (non-blocking, owner veto window).
• docs/FLEET_POLICY.md — same-PR doc sync per ADR-001 consequences (owner principal, binding tuple, X1, A4).
• tests/test_v1218_human_boundary_v2.py — 23 contract tests: X1 boundaries (tool/command/workdir vs prose), decision-namespace forgery, binding tuple fields, legacy compatibility, nonce rotation on expiry-at-consume, consume-once, A4 non-blocking + single notice, revocation immutability, worker decide guard, v2 schema/heal.
• Version pins 1.2.17 → 1.2.18 (pyproject, plugin.yaml ×2, init, uv.lock, version-match test).

Evidence (local, Windows, python 3.11.16)

• Focused: pytest tests/test_v1218_human_boundary_v2.py -q → 23 passed, exit 0.
• Full suite ×2 after final tree: pytest tests/ -q → 563 passed, exit 0 (suite-final-2.txt, suite-final-3.txt), re-confirmed post-doc-sync (suite-final-4.txt).
• Baseline trunk 7538369: 539 passed + 1 known Windows autocrlf LF-oracle failure (test_v1213_pristine_manifest), unrelated to this delta.
• CI-equivalent statics local: uv lock --check exit 0; compileall exit 0; drift-check {"missing": [], "ok": true}; --version → 1.2.18.

Merge-order note (hotspot)

PR #31 (token hard caps, head eab4996) also claims 1.2.18 and touches the same pin files + CHANGELOG head + uv.lock + test_hardening_v121 version assert. Whichever PR merges second must rebase and re-pin (next free version) — flagged on the Kanban card; QA/ops to sequence.

Gates

Independent exact-head QA: t_dd03658e (assignee qa), rollout child t_7d93de2d. No merge/deploy from this card.

[maximalang]

Triage t_0278daff (22.09): verdict = KEEP OPEN — delta NOT yet on trunk; conflicts are mechanical (branch is built on the v1.2.5 substrate and pins 1.2.18, trunk is now 1.2.28).

Evidence: grep of trunk src/fleet_policy for the key symbols (updater_dependency, decision_namespace_forgery, principal_ref, nonce, a4_review_notice) returns 0 matches — the X1 deny, forge guard and approvals-v2 tuple are not live. ADR-001 doc IS on trunk; the code delta is not. Trunk's approval expiry is card-close-status-driven (expired_at/expired_by, expire_approval, since v1.2.11); this PR's TTL/nonce/principal_ref approvals-v2 schema must be reconciled with that machinery during rebase. Diff vs trunk: 12 files, +649/−23 (policy.py +86, runtime.py +108, storage.py +120, tests/test_v1218_human_boundary_v2.py 301). GitHub: CONFLICTING/DIRTY.

Plan: rebase onto 309c72f; renumber version pins 1.2.18 → next unreleased (1.2.29+, coordinate sequencing with #45 and #12 which also need renumbers); reconcile storage.py approvals-v2 with the trunk expiry sweep and v1.2.25 worker-no-park runtime; port test_v1218_human_boundary_v2.py onto current runtime; CI verify before merge.