Move RAGE worker scope into Hackmode with StarIntel BBP-only policy #137

Closed

nsaspy wants to merge 7 commits from feature/31-rage-worker-scope into master

nsaspy commented

2026-09-04 20:37:22 +00:00

Owner

What changed

Implements the first executable migration slice from #30 / #31.

adds a Hackmode-native rage-worker identity/run contract;
adds typed rage-work-item and rage-scope-decision values;
defines a closed first-slice cyber task vocabulary;
enforces operation authorization before worker acceptance;
gives :starintel an explicit BBP/cyber-only scope gate;
rejects ordinary StarIntel implementation/product work rather than scanning StarIntel engineering issue queues;
keeps only :passive and :active as authority-bearing worker modes in this foundation;
documents that future Prolog-RLM/ZeroForge plug into the same open objective/action/evidence loop;
adds regression coverage to the core ASDF gate.

Migration proof

The tests require:

:starintel + :implementation -> denied as :starintel-cyber-only;
authorized StarIntel recon/source-security-review/CVE/fuzzing/security-projection -> accepted;
operation not authorized -> denied even for recon;
non-cyber work outside StarIntel -> denied by this cyber worker class;
passive/active worker identities remain distinct and unsupported authority modes fail closed.

The retired StarIntel worker contracts are now closed at starintel-auto-research#170 and starintel-labs/RAGE#3 with migration notices pointing to #30.

This PR does not yet implement provider orchestration, execution graph persistence, operational KB mutation, or LISH controls; those remain in #27/#30.

Closes #31

## What changed Implements the first executable migration slice from #30 / #31. - adds a Hackmode-native `rage-worker` identity/run contract; - adds typed `rage-work-item` and `rage-scope-decision` values; - defines a closed first-slice cyber task vocabulary; - enforces operation authorization before worker acceptance; - gives `:starintel` an explicit BBP/cyber-only scope gate; - rejects ordinary StarIntel implementation/product work rather than scanning StarIntel engineering issue queues; - keeps only `:passive` and `:active` as authority-bearing worker modes in this foundation; - documents that future Prolog-RLM/ZeroForge plug into the same open objective/action/evidence loop; - adds regression coverage to the core ASDF gate. ## Migration proof The tests require: 1. `:starintel` + `:implementation` -> denied as `:starintel-cyber-only`; 2. authorized StarIntel recon/source-security-review/CVE/fuzzing/security-projection -> accepted; 3. operation not authorized -> denied even for recon; 4. non-cyber work outside StarIntel -> denied by this cyber worker class; 5. passive/active worker identities remain distinct and unsupported authority modes fail closed. The retired StarIntel worker contracts are now closed at `starintel-auto-research#170` and `starintel-labs/RAGE#3` with migration notices pointing to #30. This PR does **not** yet implement provider orchestration, execution graph persistence, operational KB mutation, or LISH controls; those remain in #27/#30. Closes #31

nsaspy added 7 commits

2026-09-04 20:37:22 +00:00