feat(governance): add core task, approval, and receipt APIs

.github/workflows/ci.yml

@@ -400,6 +400,8 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
       - run: helm lint deploy/helm/kars
+      - name: Preserve task admission defaults with reused legacy values
+        run: python3 ci/helm-task-floor-compat.py
       - name: Render installation profiles
         run: |
           helm template kars deploy/helm/kars --namespace kars-system >/dev/null

ci/helm-task-floor-compat.py

@@ -0,0 +1,108 @@
+#!/usr/bin/env python3
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+"""Render task admission against reused values, without new-default coalescing."""
+
+import io
+import itertools
+import os
+from pathlib import Path
+import subprocess
+import tarfile
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+TEMPLATES = ROOT / "deploy/helm/kars/templates"
+OLD_VALUES = (ROOT / "tests/compat/fixtures/task-floor-old-values.yaml").read_text()
+ARCHIVE_IDS = itertools.count()
+FLOOR = "admission-task-namespace-floor.yaml"
+
+
+def render(values, legacy_templates=False):
+    # The saved release values are the chart defaults in this isolated archive.
+    # Passing -f to the current chart would merge in its new defaults and hide
+    # the --reuse-values nil-map regression.
+    files = {
+        "Chart.yaml": "apiVersion: v2\nname: task-floor-compat\nversion: 0.1.0\n",
+        "values.yaml": values,
+        f"templates/{FLOOR}": (TEMPLATES / FLOOR).read_text(),
+    }
+    if legacy_templates:
+        for name in ["admission-pod-exec-ban.yaml", "admission-sandbox-posture-lock.yaml"]:
+            files[f"templates/{name}"] = (TEMPLATES / name).read_text()
+    archive = Path(f".task-floor-compat-{os.getpid()}-{next(ARCHIVE_IDS)}.tgz")
+    output = archive.open("xb")
+    try:
+        with output, tarfile.open(fileobj=output, mode="w:gz") as package:
+            for name, content in files.items():
+                data = content.encode()
+                info = tarfile.TarInfo(f"task-floor-compat/{name}")
+                info.size = len(data)
+                package.addfile(info, io.BytesIO(data))
+        return subprocess.run(
+            ["helm", "template", "kars", str(archive), "--namespace", "kars-system"],
+            capture_output=True,
+            text=True,
+            timeout=30,
+            check=False,
+        )
+    finally:
+        archive.unlink()
+
+
+class TaskFloorReuseValues(unittest.TestCase):
+    def assert_floor(self, result):
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("name: kars-task-namespace-floor\n", result.stdout)
+        self.assertIn("name: kars-task-namespace-floor-binding\n", result.stdout)
+        self.assertIn("failurePolicy: Fail", result.stdout)
+        self.assertIn("validationActions: [Deny, Audit]", result.stdout)
+
+    def test_old_values_enable_new_floor_without_resetting_old_flags(self):
+        result = render(OLD_VALUES, legacy_templates=True)
+        self.assert_floor(result)
+        self.assertNotIn("name: kars-sandbox-exec-ban", result.stdout)
+        self.assertIn("name: kars-sandbox-posture-lock\n", result.stdout)
+
+    def test_absent_parent_map_enables_floor(self):
+        self.assert_floor(render("{}\n"))
+
+    def test_null_parent_map_enables_floor(self):
+        self.assert_floor(render("admission: null\n"))
+
+    def test_absent_floor_map_enables_floor(self):
+        self.assert_floor(render("admission: {}\n"))
+
+    def test_null_floor_map_enables_floor(self):
+        self.assert_floor(render("admission:\n  taskNamespaceFloor: null\n"))
+
+    def test_absent_enabled_flag_enables_floor(self):
+        self.assert_floor(render("admission:\n  taskNamespaceFloor: {}\n"))
+
+    def test_null_enabled_flag_enables_floor(self):
+        self.assert_floor(render("admission:\n  taskNamespaceFloor:\n    enabled: null\n"))
+
+    def test_explicit_true_enables_floor(self):
+        self.assert_floor(render("admission:\n  taskNamespaceFloor:\n    enabled: true\n"))
+
+    def test_existing_explicit_false_is_preserved(self):
+        result = render(OLD_VALUES + "  taskNamespaceFloor:\n    enabled: false\n", True)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertNotIn("name: kars-task-namespace-floor", result.stdout)
+        self.assertNotIn("name: kars-sandbox-exec-ban", result.stdout)
+        self.assertIn("name: kars-sandbox-posture-lock\n", result.stdout)
+
+    def test_non_boolean_flag_fails_instead_of_disabling_security(self):
+        for value in ['"false"', "0"]:
+            with self.subTest(value=value):
+                result = render(f"admission:\n  taskNamespaceFloor:\n    enabled: {value}\n")
+                self.assertNotEqual(result.returncode, 0)
+                self.assertIn("enabled must be a boolean", result.stderr)
+
+
+if __name__ == "__main__":
+    if Path.cwd().resolve() != ROOT:
+        raise SystemExit("Run this test from the repository root.")
+    unittest.main()

ci/no-custom-crypto.sh

@@ -18,6 +18,8 @@ cd "$REPO_ROOT"
 
 ALLOW_PATHS=(
   'controller/src/providers/signing.rs'
+  'controller/src/kars_receipt_log.rs'  # receipt inclusion log — Sha256 Merkle-style hash chaining of receipt payload digests (transparency-log precursor); standard linkage, no bespoke crypto protocol. Tracked for the V2 external-witness upgrade.
+  'controller/src/kars_task.rs'  # KarsTask envelope digest — Sha256 content-hash over canonical JSON (authority-binding identifier), not a crypto protocol. The Governance Receipt (kars_receipt.rs) binds its subject to this digest; signing itself stays in providers/signing.rs.
   'controller/src/providers/mesh.rs'
   'controller/src/mesh_peer/'  # in-tree controller-side mesh peer hashing/signing — uses ed25519-dalek::SigningKey + Sha256 only; tracked for SigningProvider extraction in plan §4.1
   'inference-router/src/providers/signing.rs'

cli/src/cli.ts

@@ -30,6 +30,8 @@ import { pairCommand } from "./commands/pair.js";
 import { convertCommand } from "./commands/convert.js";
 import { a2aCommand, a2aAgentCommand } from "./commands/a2a.js";
 import { attestCommand } from "./commands/attest.js";
+import { receiptCommand } from "./commands/receipt.js";
+import { approvalCommand } from "./commands/approval.js";
 import { migrateCommand } from "./commands/migrate.js";
 import { toolPolicyCommand } from "./commands/toolpolicy.js";
 import { inferencePolicyCommand } from "./commands/inferencepolicy.js";
@@ -100,10 +102,14 @@ export function createCli(): Command {
 
   // Attestation
   program.addCommand(attestCommand());
+  program.addCommand(receiptCommand());
 
   // Self-management
   program.addCommand(updateCommand());
 
+  // Steering
+  program.addCommand(approvalCommand());
+
   program.addHelpText("after", `
 Command groups:
   Lifecycle       up, dev, add, push, destroy
@@ -113,8 +119,9 @@ Command groups:
   Agent mobility  handoff, mesh, pair
   Interop         convert, a2a, a2a-agent, migrate
   Governance      toolpolicy, inferencepolicy, mcp, memory
-  Attestation     attest
+  Attestation     attest, receipt
   Self            update
+  Steering        approval
 
 Quick start:
   kars up                    # Provision Azure + deploy controller + first sandbox

cli/src/commands/approval.test.ts

@@ -0,0 +1,43 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+import { describe, it, expect } from "vitest";
+import { __test } from "./approval.js";
+
+const { defaultDecider, formatList } = __test;
+
+describe("approval — defaultDecider", () => {
+  it("uses the explicit --by when given", () => {
+    expect(defaultDecider("alice@example.com")).toBe("alice@example.com");
+  });
+
+  it("trims whitespace and falls back to the OS user when blank", () => {
+    expect(defaultDecider("  bob ")).toBe("bob");
+    // Blank → some non-empty username (OS-dependent, just assert non-empty).
+    expect(defaultDecider("   ").length).toBeGreaterThan(0);
+    expect(defaultDecider(undefined).length).toBeGreaterThan(0);
+  });
+});
+
+describe("approval — formatList", () => {
+  it("renders an empty state", () => {
+    expect(formatList([])).toContain("No approvals");
+  });
+
+  it("renders task, action, and decision metadata", () => {
+    const out = formatList([
+      {
+        metadata: { name: "raise-tier", namespace: "kars-system" },
+        spec: {
+          taskRef: { name: "migrate" },
+          action: { kind: "tierRaise", summary: "raise to tier 4" },
+        },
+        status: { phase: "Approved", decider: "alice", decidedAt: "2026-06-26T10:00:00Z" },
+      },
+    ]);
+    expect(out).toContain("raise-tier");
+    expect(out).toContain("migrate");
+    expect(out).toContain("tierRaise");
+    expect(out).toContain("alice");
+  });
+});