RAGE #209: canonical resumable runtime tool approvals #211

Merged

lost-rob0t merged 7 commits from rage/209-runtime-tool-approvals into master

2026-08-24 13:13:16 +00:00

lost-rob0t commented

2026-08-24 13:03:24 +00:00

(Migrated from github.com)

Summary

add one principal-owned, bounded approval controller for the canonical LangGraph runtime
interrupt before approval-required side effects and resume through checkpointed Command(resume=...)
expose approve/reject/cancel/restart lifecycle through existing RuntimeHost commands and typed runtime events
enforce server-owned policy, bounded metadata, replay/cancellation fencing, redacted failures, and fail-closed restart cleanup
add focused deterministic coverage, the full-gate phase, RAGE research/design evidence, and operator documentation

Auto-RAGE decision

Analyze, Design, Adversarial Review, and the recorded autonomous Decision are in:

rage/209-runtime-tool-approvals-research.org
rage/209-runtime-tool-approvals-design.org
rage/209-runtime-tool-approvals.org

The accepted design keeps the existing registry, RuntimeHost, principal boundary, and LangGraph ToolNode. It deliberately rejects cross-process resumption for generic non-idempotent tools; restart and shutdown fail closed.

TDD evidence

The run log records five red-green slices covering the missing production approval gate, policy bounds, duplicate/malformed metadata, provider-error redaction, typed rejection results, and unsafe tool names.

Final candidate: 394a0ede032b0528b9eb727512666db9a822e09f

NIX_CONFIG='experimental-features = nix-command flakes' nix develop -c bash scripts/test-all.sh — 10/10 phases; 31 focused approval tests; 1064 full pytest tests
NIX_CONFIG='experimental-features = nix-command flakes' nix flake check --show-trace — all 10 checks passed
NIX_CONFIG='experimental-features = nix-command flakes' nix build --print-out-paths — /nix/store/ccxhgycp02z2rpx6f16x4mb7z3w2wfnx-zarathushtra-full
git diff --check origin/master...HEAD — passed

Closes #209

## Summary - add one principal-owned, bounded approval controller for the canonical LangGraph runtime - interrupt before approval-required side effects and resume through checkpointed `Command(resume=...)` - expose approve/reject/cancel/restart lifecycle through existing `RuntimeHost` commands and typed runtime events - enforce server-owned policy, bounded metadata, replay/cancellation fencing, redacted failures, and fail-closed restart cleanup - add focused deterministic coverage, the full-gate phase, RAGE research/design evidence, and operator documentation ## Auto-RAGE decision Analyze, Design, Adversarial Review, and the recorded autonomous Decision are in: - `rage/209-runtime-tool-approvals-research.org` - `rage/209-runtime-tool-approvals-design.org` - `rage/209-runtime-tool-approvals.org` The accepted design keeps the existing registry, `RuntimeHost`, principal boundary, and LangGraph `ToolNode`. It deliberately rejects cross-process resumption for generic non-idempotent tools; restart and shutdown fail closed. ## TDD evidence The run log records five red-green slices covering the missing production approval gate, policy bounds, duplicate/malformed metadata, provider-error redaction, typed rejection results, and unsafe tool names. Final candidate: `394a0ede032b0528b9eb727512666db9a822e09f` - `NIX_CONFIG='experimental-features = nix-command flakes' nix develop -c bash scripts/test-all.sh` — 10/10 phases; 31 focused approval tests; 1064 full pytest tests - `NIX_CONFIG='experimental-features = nix-command flakes' nix flake check --show-trace` — all 10 checks passed - `NIX_CONFIG='experimental-features = nix-command flakes' nix build --print-out-paths` — `/nix/store/ccxhgycp02z2rpx6f16x4mb7z3w2wfnx-zarathushtra-full` - `git diff --check origin/master...HEAD` — passed Closes #209