[elasticdotventures]

Follow-up to #89 (merged with KR-A01..A05). This completes the assurance thread's enforcement side and the MCP surface. Also pins ufo-types to the merge commit of PromptExecution/ufo-types#31 (1846e6f).

What this adds

Req	What	Evidence
KR-A06 gateway	Per-identity grants (tokens stored as SHA-256), every route classified in gateway::ROUTES, deny by default (unclassified or unmatched = admin). Enforced in the server, so MCP and direct HTTP are covered alike.	tests/assurance_a06.rs: a read-only identity reads (200) and its commit is refused (403) over direct HTTP and through the real bridge.py started with the same token. The commit tool is listed; visibility is not what protects it.
KR-A08 audit	Hash-chained log called from the gateway: decision written before the handler runs, outcome after, one correlation id; fails closed (503) if the log cannot be written. GET /assurance/audit needs audit.read.	tests/assurance_a08.rs: records for the permitted and denied calls over both transports with caller, operation, decision, model revision, correlation id; tokens never appear in the log; chain verifies; reading the log without the grant is denied and itself recorded.
KR-A07 sandbox	deploy/sandbox/run-sandboxed.sh (bubblewrap): read-only root and baseline, one scratch tmpfs, no network, cleared env. Enforcement stays in the deployment component; kr0ki holds the evidence.	tests/assurance_a07.rs: scratch output permitted; writes to the baseline (append, truncate, create, rm, mv, ..) refused and the host file's digest unchanged. The test found /dev writable (bwrap's --dev tmpfs isn't covered by a root remount); fixed and now asserted.
MCP	resources/* and prompts/* in the bridge, manifest-driven like tools; resource reads go through the same gateway as the equivalent HTTP request. X-Kr0ki-Transport: mcp recorded in audit (informational; nothing is authorised on it).	test_bridge.py (14), and end-to-end in assurance_a06.rs.
routes	/assurance/*: requirements, trace, view (json/table/d2/svg), evidence, propose/validate/commit (expected revision), verify, audit, skills.	exercised by the cases above

Baseline: implementation paths recorded for CTL-A06..A08; kr0ki-assurance lint now reports 0 dangling links and only satisfied_untested x8 (no evidence recorded yet).

Verification

cargo fmt --check; cargo clippy --workspace --all-targets -- -D warnings; cargo test --workspace --no-fail-fast on the merged result: all suites pass except the one noted below, which this PR fixes.

• The route-consistency guard failed after merging main: /render/rust-behavior (new on main) was unclassified and would have required admin. It parses a body and renders, writes nothing to the model, so it is classified render. That is the guard working as designed.
• Two assurance_service tests encoded "later controls are still unimplemented", which stopped being true. They now build their own conditions (a temp baseline with a deliberately dangling path and test target).

Needs a human decision / still open

• Identities file: KR0KI_IDENTITIES_FILE is documented in AGENTS.md but no file is provisioned. Until one is, the server runs in shared-token/open mode exactly as before (no behaviour change for existing deployments).
• Evidence for the committed tree: just assurance-verify should be run once this is merged (evidence is revision-bound and the store is gitignored).
• Playb00k UI for the assurance view: not started.
• Pilot server does not enforce previousCommit (found in feat(assurance): versioned assurance thread (KR-A01..A05 done; A06-A08 in progress) #89): the change service is the only guard for writers that go through it.
• ToolGateway::AuditRecorder sub-part and owner = kr0ki-maintainers remain modelling placeholders to confirm.
• The SysMD patches are on https://github.com/PromptExecution/SysMD (record: SysMD (tukcps/SysMD 4.3.0): currency bug + toolchain build gap; patches on our fork, not yet sent upstream #92); not sent upstream.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GgXQRGsprSZc2oXGNj9n8X

[elasticdotventures]

Evidence recorded on the clean committed tree

just assurance-verify at implementation revision abb46f1 (clean tree), model revision sha256:0213bc9c...a67d4b. Then just assurance-view:

requirement	satisfied by (assertion)	verification (evidence)	state
KR-A01	ModelService	1 fresh pass (9 tests)	verified
KR-A02	ModelService	1 fresh pass (6)	verified
KR-A03	ModelService	1 fresh pass (9)	verified
KR-A04	VerificationRunner	1 fresh pass (3)	verified
KR-A05	ModelService	1 fresh pass (2)	verified
KR-A06	ToolGateway	1 fresh pass (21)	verified
KR-A07	ExecutionSandbox	1 fresh pass (8)	verified
KR-A08	AuditRecorder	1 fresh pass (18)	verified

All 8 artifacts verify intact against their recorded digests; kr0ki-assurance lint: 0 defects, 0 dangling links, ReqIF round trip lossless (36 nodes / 147 attributes / 48 relations).

Read this before relying on it

• This evidence is revision-bound and goes stale on merge. It binds to abb46f1; merging creates a new commit, so on main these will show stale until just assurance-verify is run again. That is the system working, not a bug. The store (.kr0ki-evidence/) is local and gitignored, so it is not part of this PR.
• Test counts for VC-A06 and VC-A08 include the server's own unit tests, which are compiled into those test crates when they include app.rs; the acceptance tests themselves are 7 (A06) and 4 (A08).
• Live checks are separate and were not part of this run: KR-A03's render through a real Kroki backend and KR-A05 against the real OMG pilot server are #[ignore] tests, run and reported on feat(assurance): versioned assurance thread (KR-A01..A05 done; A06-A08 in progress) #89. This PR adds no new live check; the sandbox (KR-A07) is exercised for real (bubblewrap), the MCP path for real (the actual bridge.py).
• "Verified" means: the declared acceptance case passed at these revisions. It does not mean the requirement set is complete or the statements are right.