Add inactive control policy-set validator

README.md

@@ -61,6 +61,17 @@ fixed limits, and disposable directories, but this test does not provide or clai
 mechanical network or host-filesystem isolation. Real-adapter sandbox qualification
 and an external-target smoke remain required.
 
+## Inactive control policy-set validator
+
+`control/v1/` defines a canonical identity bundle for six later Control foundation
+policies: duty separation, sandbox, credentials, risk gates, kill switch, and
+immutable evidence. Its validator checks exact immutable policy and decision refs;
+it does not contain or evaluate those policies.
+
+The package stays inactive and fail-closed. It grants no authority, activates no
+profile, reads no credential, launches no adapter, and performs no external write.
+Later bounded units own each policy body and its enforcement.
+
 ## The current default team
 
 You talk **only** to yshifu, in a Claude Code session. yshifu orchestrates the other roles

RESTORE.md

@@ -319,6 +319,17 @@ each cell, and checks the accepted 2×2 matrix plus closed negative protocol cas
 It uses no real adapter or credential and makes no network/host isolation,
 qualification, activation, or external-target-smoke claim.
 
+Restore the three paths in the manifest's inactive control policy-set block, then
+run:
+
+```sh
+bash scripts/test/control-policy-set.test.sh
+```
+
+The proof validates only the canonical six-section identity bundle. It does not
+evaluate a policy, grant authority, activate a profile, or enforce sandbox,
+credential, risk, kill-switch, or evidence behavior.
+
 ---
 
 ## 5. Smoke test — prove the rebuilt team is alive

ci/required-files.txt

@@ -166,3 +166,8 @@ adapter-tests/v1/fakes/forge-b.sh
 adapter-tests/v1/fakes/protocol-fault.sh
 adapter-tests/v1/fixture/source.txt
 scripts/test/portable-adapter-contracts.test.sh
+
+# Inactive control policy-set identity seam
+control/v1/policy-set.jq
+control/v1/validate.sh
+scripts/test/control-policy-set.test.sh

control/v1/policy-set.jq

@@ -0,0 +1,67 @@
+def exact($required):
+  type == "object" and (keys | sort) == ($required | sort);
+
+def id_ok:
+  type == "string" and test("\\A[a-z0-9][a-z0-9._:-]{0,127}\\z");
+
+def content_id_ok:
+  id_ok and (contains(":") | not) and (contains("/") | not);
+
+def sha256_ok:
+  type == "string" and test("\\A[0-9a-f]{64}\\z");
+
+def content_ref_ok($media_type):
+  exact(["content_id","media_type","sha256"]) and
+  (.content_id | content_id_ok) and .media_type == $media_type and
+  (.sha256 | sha256_ok);
+
+def section_shape_ok:
+  exact(["decision_ref","policy_ref","section_id"]) and
+  (.section_id | id_ok) and
+  (.policy_ref | content_ref_ok("application/vnd.ystack.control-policy+json")) and
+  (.decision_ref | content_ref_ok("application/vnd.ystack.control-decision+json"));
+
+def core_contract_shape_ok:
+  exact(["generation_id","package_ref","semantic_identity"]) and
+  (.semantic_identity | id_ok) and
+  (.generation_id |
+    if type == "string" then test("\\Ag-[0-9a-f]{64}\\z") else false end) and
+  (.package_ref | content_ref_ok("application/vnd.ystack.core-contract+json"));
+
+def shape_ok:
+  exact(["body","id","kind","schema_version"]) and
+  .schema_version == 1 and .kind == "control_policy_set" and
+  (.id | id_ok) and
+  (.body |
+    exact(["activation_state","core_contract","fail_mode","policy_version","sections"]) and
+    (.activation_state | type == "string") and
+    (.fail_mode | type == "string") and
+    (.policy_version | type == "string") and
+    (.core_contract | core_contract_shape_ok) and
+    (.sections | type == "array" and length >= 1 and length <= 16 and
+      all(.[];section_shape_ok)));
+
+def expected_sections:
+  ["credential-policy","duty-separation","evidence-integrity",
+   "kill-switch","risk-gates","sandbox"];
+
+def relations_ok:
+  .body as $body |
+  $body.policy_version == "v1" and
+  $body.activation_state == "inactive" and
+  $body.fail_mode == "closed" and
+  ($body.core_contract.semantic_identity |
+    test("\\Acore\\.contracts\\.v[1-9][0-9]*\\z")) and
+  ($body.sections | map(.section_id)) == expected_sections and
+  ($body.sections | all(.[];
+    .policy_ref.content_id == ("control-policy." + .section_id))) and
+  ($body.sections | all(.[];
+    .decision_ref.content_id == ("control-decision." + .section_id))) and
+  ($body.sections | map(.policy_ref.sha256) | unique | length) == 6 and
+  ($body.sections | map(.decision_ref.content_id) | unique | length) == 6 and
+  ($body.sections | map(.decision_ref.sha256) | unique | length) == 6;
+
+if (shape_ok | not) then "E_SHAPE"
+elif (relations_ok | not) then "E_RELATION"
+else empty
+end

control/v1/validate.sh

@@ -0,0 +1,84 @@
+#!/bin/bash
+set -uo pipefail
+export LC_ALL=C
+umask 077
+
+emit_error() {
+  case "${1:-}" in
+    E_USAGE|E_RUNTIME|E_LIMIT|E_PARSE|E_CANONICAL|E_SHAPE|E_RELATION)
+      /usr/bin/printf '%s\n' "$1" >&2
+      ;;
+    *) /usr/bin/printf '%s\n' E_RUNTIME >&2 ;;
+  esac
+  exit 1
+}
+
+[ "$#" -eq 2 ] && [ "$1" = validate ] || emit_error E_USAGE
+input=$2
+source_path=${BASH_SOURCE[0]}
+case "$source_path" in
+  /*) ;;
+  *) source_path="$(pwd -P)/$source_path" ;;
+esac
+[ -f "$source_path" ] && [ ! -L "$source_path" ] || emit_error E_RUNTIME
+source_dir=$(CDPATH='' cd -P -- "${source_path%/*}" 2>/dev/null && pwd -P) ||
+  emit_error E_RUNTIME
+source_path="$source_dir/${source_path##*/}"
+[ "$source_path" = "$source_dir/validate.sh" ] || emit_error E_RUNTIME
+policy_program="$source_dir/policy-set.jq"
+[ -f "$policy_program" ] && [ ! -L "$policy_program" ] || emit_error E_RUNTIME
+[ -f "$input" ] && [ ! -L "$input" ] || emit_error E_RUNTIME
+jq_bin=$(command -v jq 2>/dev/null) || emit_error E_RUNTIME
+case "$jq_bin" in /*) ;; *) emit_error E_RUNTIME ;; esac
+[ -f "$jq_bin" ] && [ -x "$jq_bin" ] && [ ! -L "$jq_bin" ] &&
+  [ "$($jq_bin --version 2>/dev/null)" = jq-1.6 ] || emit_error E_RUNTIME
+
+scratch=$(/usr/bin/mktemp -d "${TMPDIR:-/tmp}/ystack-control-policy.XXXXXX" 2>/dev/null) ||
+  emit_error E_RUNTIME
+cleanup() { /bin/rm -rf -- "$scratch" >/dev/null 2>&1 || :; }
+signal_exit() { trap - EXIT HUP INT TERM; cleanup; exit 1; }
+trap cleanup EXIT
+trap signal_exit HUP INT TERM
+
+raw="$scratch/raw.json"
+/bin/dd if="$input" of="$raw" bs=1048577 count=1 2>/dev/null || emit_error E_RUNTIME
+raw_size=$(/usr/bin/wc -c < "$raw" | /usr/bin/tr -d ' ') || emit_error E_RUNTIME
+[ "$raw_size" -le 1048576 ] || emit_error E_LIMIT
+bom=$(/usr/bin/od -An -tx1 -N3 "$raw" 2>/dev/null | /usr/bin/tr -d ' \n') ||
+  emit_error E_RUNTIME
+[ "$bom" != efbbbf ] || emit_error E_PARSE
+"$jq_bin" . "$raw" >/dev/null 2>&1 || emit_error E_PARSE
+root_count=$("$jq_bin" -s 'length' "$raw" 2>/dev/null) || emit_error E_PARSE
+[ "$root_count" -eq 1 ] || emit_error E_PARSE
+canonical="$scratch/canonical.json"
+"$jq_bin" -S -c . "$raw" > "$canonical" 2>/dev/null || emit_error E_PARSE
+/usr/bin/cmp -s "$raw" "$canonical" || emit_error E_CANONICAL
+
+"$jq_bin" -e '
+  def depth:
+    if type == "array" then
+      if length == 0 then 1 else 1 + ([.[] | depth] | max) end
+    elif type == "object" then
+      if length == 0 then 1 else 1 + ([.[] | depth] | max) end
+    else 1 end;
+  def members:
+    if type == "array" then length + ([.[] | members] | add // 0)
+    elif type == "object" then (keys_unsorted | length) + ([.[] | members] | add // 0)
+    else 0 end;
+  def strings_ok:
+    if type == "array" then all(.[];strings_ok)
+    elif type == "object" then
+      all(keys_unsorted[];utf8bytelength <= 8192) and all(.[];strings_ok)
+    elif type == "string" then utf8bytelength <= 8192
+    else true end;
+  (depth <= 32) and (members <= 1024) and strings_ok
+' "$raw" >/dev/null 2>&1 || emit_error E_LIMIT
+
+result=$("$jq_bin" -r -f "$policy_program" "$raw" 2>/dev/null) || emit_error E_RUNTIME
+case "$result" in
+  '') ;;
+  E_SHAPE|E_RELATION) emit_error "$result" ;;
+  *) emit_error E_RUNTIME ;;
+esac
+trap - EXIT HUP INT TERM
+cleanup