RELAY

131def lookup(tool: str, args: dict | None = None) -> dict:
132    """policy.lookup: deterministic tier + risk + rate row for one action.
133 
134    Never an error: an unknown tool/action class returns the row-10
135    AUTO-DENY entry (auto_deny=True), the caller must deny and escalate.
136    """
137    args = args or {}
138    for row in POLICY_TABLE:
139        if tool not in row["tools"]:
140            continue
141        pred = row.get("arg_predicate")
142        if pred is not None:
143            field, allowed = pred
144            if args.get(field) not in allowed:
145                continue
146        out = {k: v for k, v in row.items() if k not in ("tools", "arg_predicate")}
147        out["tool"] = tool
148        out["auto_deny"] = False
149        return out
150    out = dict(AUTO_DENY_ROW)
151    out["tool"] = tool
152    return out

57def _gate_write(tool: str, action_args: dict, approval_token, agent_credential_id,
58                idempotency_key) -> dict | None:
59    """Shared write gate. Returns an error dict, or None when the gate passes.
60 
61    Order (CONTRACT §b2): (0) args sanity -> (1) degraded-mode denial,
62    SERVER-SIDE -> (2) credential scope (CSA 2.6) -> (3) approval token
63    verified AGAINST THE APPROVAL SERVER (issuance + binding to
64    tool+args_digest + expiry). The gate runs BEFORE the fault layer, so an
65    injected GUARDRAIL_BYPASS can never skip it.
66    """
67    if not idempotency_key or not isinstance(idempotency_key, str):
68        return make_error("INVALID_ARGS", "idempotency_key must be a non-empty string")
69    degrading = degraded_mode_active()
70    if degrading is not None:
71        return make_error(
72            "DEGRADED_MODE",
73            "write refused: system is DEGRADED_TO_ADVISORY "
74            f"({degrading['fault_type']} on {degrading['target_tool']}); ALL writes are denied "
75            "while degraded, regardless of tier or approval (CONTRACT §c)",
76            context={"fault_id": degrading["fault_id"], "target_tool": degrading["target_tool"]},
77        )
78    if not approval_token:
79        return make_error(

189def _append_locked(path: str, event: dict) -> dict:
190    """The critical section of append(). Caller holds both append locks."""
191    count, prev = _tip(path)
192    sealed = dict(event)
193    sealed["event_id"] = f"TRC-{count + 1:06d}"
194    sealed["prev_hash"] = prev
195    sealed["this_hash"] = chain_hash(sealed)
196    with open(path, "a", encoding="utf-8") as fh:
197        fh.write(json.dumps(sealed, sort_keys=True) + "\n")
198    _remember_tip(path, count + 1, sealed["this_hash"])
199    _write_anchor(path, count + 1, sealed["this_hash"])
200    return sealed