S25 wiring: policy inheritance in shadow mode (SHIP_POLICY_SHADOW)

src/cli.ts

@@ -44,6 +44,7 @@ import { attachEvidence, envAsked } from "./fix-evidence.js";
 import type { Evidence } from "./verification.js";
 import type { RepoRef } from "./git.js";
 import { assertRepoAllowed, credentialFor, policyFromEnv } from "./repo-policy.js";
+import { readShadowSummary, renderShadowReport, shadowFile } from "./policy-shadow.js";
 import { detectRepository } from "./stack-import.js";
 import { renderProposal, stackDetectEnabled } from "./stack-propose.js";
 import type { RepoPolicyConfig } from "./repo-policy.js";
@@ -1643,7 +1644,15 @@ async function policyCommand(rest: string[]): Promise<void> {
     "       teploy-ship policy authority <approve|auto|steer|policies> --roles admin,editor [--users a,b]\n" +
     "       teploy-ship policy window set [--source <s>] --days mon-fri --start 09:00 --end 18:00 --tz <zone>\n" +
     "       teploy-ship policy window remove|check [--source <s>]\n" +
-    "       teploy-ship policy reviewers set <repo> [--users a,b] [--teams t]";
+    "       teploy-ship policy reviewers set <repo> [--users a,b] [--teams t]\n" +
+    "       teploy-ship policy shadow-report [--json]    where the S25 policy shadow (SHIP_POLICY_SHADOW=on) disagreed";
+
+  if (sub === "shadow-report") {
+    const file = shadowFile();
+    const summary = await readShadowSummary(file);
+    process.stdout.write(args.flags.json === true ? `${JSON.stringify({ file, ...summary }, null, 2)}\n` : `${renderShadowReport(summary, file)}\n`);
+    return;
+  }
 
   if (sub === "show") {
     const runtime = await makeRuntime(args, config);

src/egress.ts

@@ -29,6 +29,8 @@
  */
 
 /** What Ship records and reasons about. */
+import { shadowObserve } from "./shadow-hook.js";
+
 export type NetworkTier = "none" | "allowlist" | "open";
 
 export const NETWORK_TIERS: readonly NetworkTier[] = ["none", "allowlist", "open"];
@@ -95,7 +97,10 @@ export function resolveNetworkTier(
   config?: string | undefined,
 ): NetworkTier | null {
   const chosen = parseNetworkTier(flag ?? env ?? config);
-  return chosen === null ? null : (chosen ?? DEFAULT_NETWORK_TIER);
+  const result = chosen === null ? null : (chosen ?? DEFAULT_NETWORK_TIER);
+  // S25 shadow (SHIP_POLICY_SHADOW): report the decision, never alter it.
+  shadowObserve({ point: "network", result });
+  return result;
 }
 
 /**
@@ -151,6 +156,13 @@ export function egressEntryError(entry: string): string | null {
  * host nobody can explain, on a run that has already been paid for.
  */
 export function normalizeEgressAllow(entries: readonly string[] | undefined): string[] | undefined {
+  const result = normalizeEgressAllowEntries(entries);
+  // S25 shadow (SHIP_POLICY_SHADOW): report the decision, never alter it. A throw above is not reported.
+  shadowObserve({ point: "egress", result });
+  return result;
+}
+
+function normalizeEgressAllowEntries(entries: readonly string[] | undefined): string[] | undefined {
   if (entries === undefined) return undefined;
   const out: string[] = [];
   for (const raw of entries) {

src/governance.ts

@@ -7,6 +7,7 @@ import { upsertByKey } from "./upsert.js";
 import { stateDir } from "./run-store.js";
 import { repoSlug } from "./observe.js";
 import { normalizeRole } from "./users.js";
+import { shadowObserve } from "./shadow-hook.js";
 import type { Role } from "./users.js";
 
 /**
@@ -101,6 +102,17 @@ export function mayDo(
   governance: Pick<Governance, "authority">,
   action: AuthorityAction,
   principal: { user: string; role: string } | null | undefined,
+): boolean {
+  const allowed = mayDoDecision(governance, action, principal);
+  // S25 shadow (SHIP_POLICY_SHADOW): report the decision, never alter it.
+  shadowObserve({ point: "mayDo", governance, action, principal, allowed });
+  return allowed;
+}
+
+function mayDoDecision(
+  governance: Pick<Governance, "authority">,
+  action: AuthorityAction,
+  principal: { user: string; role: string } | null | undefined,
 ): boolean {
   if (principal === null || principal === undefined) return false;
   const grant = governance.authority[action];

src/ladder.ts

@@ -23,6 +23,7 @@ import type { ChangeClass } from "./change-class.js";
 import type { TestOutcome } from "./tests.js";
 import type { WorkflowEvent } from "@neutron-build/workflow";
 import { verificationFactsFromEvents } from "./verification-summary.js";
+import { shadowObserve } from "./shadow-hook.js";
 
 /** Contract 1's `verification` block, camel-cased for the project record. */
 export interface ProjectVerification {
@@ -102,7 +103,10 @@ export function effectiveAuthority(project: {
 }): Authority {
   const asked = project.authority ?? "send";
   const capped = minAuthority(asked, authorityCap(project.verification));
-  return project.neverAuto === true ? minAuthority(capped, "send") : capped;
+  const result = project.neverAuto === true ? minAuthority(capped, "send") : capped;
+  // S25 shadow (SHIP_POLICY_SHADOW): report the decision, never alter it.
+  shadowObserve({ point: "authority", project, result });
+  return result;
 }
 
 export type RungName = "baseline" | "build" | "tests" | "preview" | "visual" | "flow" | "observe";