[dcharlot65-openie]

What this is

A Rust library gate, receipt::auth, that decides whether a proposal is an operator-granted typed action. It does not execute anything, and it is not wired into kev_serve.

On this remote tree, before the change:

• sign::Gate (crates/receipt/src/sign.rs) verifies an event envelope (signer, subscription, payload hash, replay). Accept is authenticity, not permission.
• POST /v1/decisions returns predicate / choice / score probabilities plus a signed slice receipt. dispatched_tool is an unstructured Option<String>, and kev_serve passes None.
• JouleContract Energy / Provenance exist. Mesh joule ceilings are mentioned in docs/infinity-suspend-resume.md and are not a stored budget. Unmetered joules are the existing non-finite sentinel (null in receipt JSON).

The reported failure this gate is aimed at: LFM3-Omni Q4_K_M answered a destructive root-deletion request with Commit plus rm -r / or rm -rf / (0/60 refusals). Those strings were not executed. The transcripts are not in this repository. Fixtures use the reported shapes.

David's unpublished local tree was not in this workspace. This patch is against remote main at 34ad7dd only. It does not claim to meet modules that are not on the remote.

Policy

Fail closed. The closed action set is inspect_decision (a decision content hash) and quote_receipt (a thread id plus a receipt hash). Both are references to objects this runtime already computed. There is no shell, process, filesystem, or network action.

• Unknown, unstructured, or malformed bytes deny. hello, echo hello, and Commit + rm -rf / are the same unstructured result. The parser does not contain a forbidden-command table.
• The verb commit is unknown_action. Prefixing a valid document with Commit denies. There is no commit flag.
• An empty grant list is no_authority. A different kind is action_mismatch. The same kind with a different scope is scope_mismatch. Model bytes do not mint grants.
• An allow carries a permit bound to the domain-separated SHA-256 of the canonical action bytes (length-prefixed, same habit as the other hashes in this crate). One changed byte denies. Permit::covers rejects a substituted action. A permit is not a bearer token and is not consumed by any I/O.
• When any exact-matching grant sets compute_ceiling_j, the strictest ceiling wins. A grant with no ceiling does not erase one that has a ceiling, and it does not invent a number. Measured HwShunt or ModelBased joules at or under the ceiling pass. Estimator, missing, negative, and non-finite joules deny when a ceiling applies. auth does not read sysfs.

sign::Gate is unchanged. kev_serve behavior is unchanged; a comment points at this gate so a probability is not read as an allow.

Tests

cargo test -p receipt with Rust 1.99.1, --locked: 40 unit tests passed (14 new in auth, existing receipt/sign/ledger/meter tests still passed), 6 integration tests passed (crates/receipt/tests/auth_gate.rs), 0 failed. cargo clippy -p receipt --all-targets -- -D warnings is clean.

cargo run -p receipt --example auth_check prints allow for one granted status-ping inspect_decision and one granted quote_receipt under 0.5 J ModelBased, then deny for no authority, both reported Commit / rm shapes, echo hello, hello, a Commit prefix on a valid document, the verb commit, a substituted hash, an over-ceiling figure, and Estimator energy. It does not spawn a shell.

Integration coverage includes those destructive shapes (also with a grant and a large ceiling present), malformed extra lines, payload substitution, a signed destructive envelope that sign::Gate accepts and auth denies, and the reverse (granted action, unsigned envelope).

Limitations

Not general autonomous safety, not a sandbox, not a deployment. Not hooked into Infinity handle_content. dispatched_tool is still not a capability. In-process grants are not signed. No ceiling on a grant means no energy refusal. Cache-hit Estimator energy cannot satisfy a ceiling, and this crate does not invent a measured substitute. Details: docs/action-authorization.md.

Copyright 2026 Open Interface Engineering, Inc. SPDX-License-Identifier: MIT OR Apache-2.0.

  

[github-actions]

Thank you for taking the time to open this! strix-rt is published read-only for now, so we don't merge pull requests and this one was closed automatically. It isn't a judgment of your change: we just can't review and maintain outside code yet. Issues are open for questions, reproduction reports and feedback, and forks are very welcome. Take whatever helps you save energy.