Repository navigation
Follow SEP-2624: drop chain naming, use confirmations for "ask" - #32
Merged
Merged
Conversation
adtl.policy returns a confirmation request (id, reason, callHash,
expiresAt, HMAC token) with valid: false, so invokers without
confirmation support still block. callHash now covers the call binding
{ event, phase, target, payload }. The gateway sets context.target and,
after a human approves, re-invokes the validators with
context.confirmations and forwards only if they all allow the call and
it still hashes to the approved value. info["adtl/decision"] is still set.
Closes #30
# Conflicts: # CHANGELOG.md
This was referenced Oct 20, 2026
# Conflicts: # packages/gateway/src/gateway.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two changes to follow the current SEP-2624 draft.
Rename (#24).
ChainOutcomeis nowPhaseOutcome, and the "chain" wording is gone from the invoker and the gateway, since the SEP no longer has a chain concept. No behaviour change.Confirmations for "ask" (#30). This follows the proposal in modelcontextprotocol/experimental-ext-interceptors#45.
adtl.policyreturns "ask" asvalid: false, severity: "error"withconfirmation: { id, reason, callHash, expiresAt, token }. An invoker that doesn't implement confirmations still blocks the call.info["adtl/decision"]is still set.callHashnow covers the call binding{ event, phase, target, payload }(newcallBindingHash()in@adtl/labels). The token is an HMAC over the id, that hash, the session and the expiry.adtl.policyaccepts a confirmation fromcontext.confirmationsonly for the same call, in the same session, before it expires, and only once. A confirmation never turns a "block" into an allow.context.targetto the upstream server on every interceptor invocation. After a human approves, it re-invokes the validators withcontext.confirmations, and forwards the call only if they all allow it and it still hashes to the approved value.Note:
callHashvalues in audit logs differ from 0.4.0. The Claude Code hooks path still uses the oldcallHash(server, tool, args), since it doesn't go through the interceptors.Tests: 188 pass, typecheck clean. New tests cover single use, a different call, another session, a forged token, expiry, a block not being overridden, the second check in the gateway, and the token never reaching the agent.
Closes #24
Closes #30