aaronrene / knowtation public
feat BREAKING flow feat/flow-projection-pilot #6 / 18
aaronrene · 1 day ago · Jun 21, 2026 · Diff

feat(flow): implement external-agent gate (7A-L2b)

Grant mint/revoke/list handlers, agent_bundle renderer, import sandbox for external_tool refs, Hub routes, gateway hosted projection parity, MCP/CLI tools, and OpenAPI — all gates default OFF with seven-tier test coverage.

sha256:1f885dbfff4d37a90b778092ee8f9cfb63054528eb669897a6806b1e52e4a118 sha
sha256:942476bd56572cb1ff995ab405afecd751e616ee014b01f475b640a5f32bc2ca parent
+32 ~8 symbols
sha256:e7a14badafd917a07bf0df75c0e8f34d4f5ed1c7ec6b7a12505bc4ad42bc3345 snapshot
+32
symbols added
~8
symbols modified
0
dead code introduced
Semantic Changes 40 symbols
~ lib/flow/external-agent.mjs .mjs 25 symbols added
+ collectFlowExternalToolRefs function function collectFlowExternalToolRefs L140–151
+ computeBundleAllowedTools function function computeBundleAllowedTools L176–182
+ envTriState function function envTriState L37–41
+ getFlowExternalAgentEnabled function function getFlowExternalAgentEnabled L63–72
+ getFlowExternalAgentPolicyForbidden function function getFlowExternalAgentPolicyForbidden L93–102
+ getFlowHostedProjectionEnabled function function getFlowHostedProjectionEnabled L78–87
+ grantForClient function function grantForClient L265–271
+ grantsFilePath function function grantsFilePath L203–205
+ handleFlowExternalGrantListRequest function function handleFlowExternalGrantListRequest L490–512
+ handleFlowExternalGrantMintRequest function function handleFlowExternalGrantMintRequest L348–444
+ handleFlowExternalGrantRevokeRequest function function handleFlowExternalGrantRevokeRequest L453–481
+ handleFlowExternalToolInvokeRequest function function handleFlowExternalToolInvokeRequest L591–627
+ hashActorLabel function function hashActorLabel L247–250
+ hashGrantBearer function function hashGrantBearer L237–239
+ intersectGrantTools function function intersectGrantTools L159–169
+ isAgentBundleHarnessActive function function isAgentBundleHarnessActive L635–637
+ loadExternalGrantsStore function function loadExternalGrantsStore L211–221
+ mintExternalGrantRecord function function mintExternalGrantRecord L286–321
+ randomToken function function randomToken L255–257
+ readFlowExternalAgentPolicyFile function function readFlowExternalAgentPolicyFile L47–57
+ readVaultExternalAgentPolicy function function readVaultExternalAgentPolicy L108–134
+ refuse function function refuse L327–329
+ saveExternalGrantsStore function function saveExternalGrantsStore L227–231
+ validateExternalGrantBearer function function validateExternalGrantBearer L525–577
+ validateImportExternalTools function function validateImportExternalTools L189–197
~ test/fixtures/flow/external-agent-helpers.mjs .mjs 2 symbols added
+ makeExternalToolFlowBundle function function makeExternalToolFlowBundle L35–78
+ writeExternalAgentPolicy function function writeExternalAgentPolicy L14–30
+ test/flow-external-agent-data-integrity.test.mjs .mjs
+ test/flow-external-agent-e2e.test.mjs .mjs
~ test/flow-external-agent-parity-integration.test.mjs .mjs 1 symbol added
+ stripVolatileMint function function stripVolatileMint L24–34
+ test/flow-external-agent-performance.test.mjs .mjs
+ test/flow-external-agent-security.test.mjs .mjs
+ test/flow-external-agent-stress.test.mjs .mjs
+ test/flow-external-agent-unit.test.mjs .mjs
~ cli/index.mjs .mjs 1 symbol modified
~ main
~ docs/openapi.yaml .yaml
~ hub/gateway/server.mjs .mjs 1 symbol added
+ isFlowHostedProjectionEnabled function function isFlowHostedProjectionEnabled L848–851
~ hub/server.mjs .mjs
~ lib/flow/flow-authoring.mjs .mjs 1 symbol modified
~ handleFlowProposeRequest
~ lib/flow/flow-handlers.mjs .mjs 1 symbol modified
~ handleFlowProjectRequest
~ lib/flow/projection-generator.mjs .mjs 3 symbols added, 4 symbols modified
+ isAgentBundleInert function function isAgentBundleInert L57–59
+ renderAgentBundle function function renderAgentBundle L190–207
+ renderAgentBundleStep function function renderAgentBundleStep L152–182
~ buildRendered
~ computeFidelity
~ isHarnessActive
~ projectFlow
~ mcp/tools/flow.mjs .mjs 1 symbol modified
~ registerFlowTools
Older docs(flow): freeze external-agent gate contract (7A-L2a) sha256:942476bd56572cb1ff995ab405afecd751e616ee014b01f475b640a5f32bc2ca All commits Newer docs(flow): freeze execution gate contract (7A-L3a) sha256:2f5915feb1e6b18d98844163b41d69e10205ddfcab3efb8dbba909d2b436bf2e

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:1f885dbfff4d37a90b778092ee8f9cfb63054528eb669897a6806b1e52e4a118 --body "your comment"