Wire tool-manifest (S24) observe-only

[im-tyler]

Changes

• teploy-ship tool validate <manifest.json> [--grant <json|file>] [--json]: read-only dry run (validateManifest + effectivePermissions with an admin-entered grant, excess reported, exit 1 if invalid). Persists nothing. No grant means nothing granted.
• src/tool-manifest-shadow.ts, hooked into executeAction (agent.ts, shared by live and durable loops): SHIP_TOOL_MANIFEST=shadow|on (default off) runs conformanceChecks on every executed action and appends findings to tool-manifest-shadow.jsonl (SHIP_TOOL_MANIFEST_SHADOW_FILE). on also logs to stderr. Never blocks, quarantines or alters a call. Manifest comes from SHIP_TOOL_MANIFEST_FILE; none configured means nothing recorded; a bad one records one error record.
• SHIP_EVENT_ENVELOPE=on (default off): run webhooks gain two additive headers X-Teploy-Event (signed EventEnvelope: eventId = delivery id, cursor = event_seq, data.payloadSha256 binds the body) and X-Teploy-Event-Signature. Body and all existing headers unchanged. No envelope without a secret or an event_seq.
• examples/http-client.mjs: verifyEvent port + EventDedupe; docs/HTTP_CLIENT.md: event verification section.

Checks

• lint clean; build clean; node --test dist/**/*.test.js: 1997 pass, 0 fail (14 new in src/tool-manifest-wiring.test.ts); scripts/http-client.test.mjs 1 pass.
• Default-off byte identity: golden headers/body built independently of the new code; asserted equal (incl. header order) for flag unset, explicit false, and unrecognised env value.
• Negative controls (code broken, tests failed, restored): envelope always on (3 fail), cursor off by one (3 fail), shadow ignores off (1 fail), shadow write failure escaping (4 fail).
• Skipped grader-sensitivity and pj-b-deploy-recovery (fixed port 8901, per wave-4 instructions); CI runs them. Web untouched.

Not verified / still open

• Executor sees only action kind: bash/python = exec, edit/create = write. undeclared-host, secret-in-argv, secret-in-prompt cannot fire from this path until the executor/credential layer reports hosts and injected secrets.
• No requestId on run webhooks (not a reply to a client call). No web dry-run page (CLI output is the view). No live receiver tested.
• Ship has no installed-tool registry; the manifest file is operator-supplied.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VqsBNqvaWezf1DwQrAnVgX

---

Generated by Claude Code