feat(policy): add host skill scan verdict check

MODULE.md

@@ -127,6 +127,9 @@ Full details: [paired-device lifecycle specification](docs/specs/device-pairing-
 ## Browser destination authorization (contract 1.28)
 Full details: [browser dial specification](docs/specs/browser-dial-contract-1.28.md).
 
+## Host skill-scan decisions (contract 1.29)
+Full details: [host skill-scan specification](docs/specs/skill-scan-contract-1.29.md).
+
 ## Confidential injected master resolution
 Full details: [`Confidential injected master resolution`](docs/module-crypto.md#confidential-injected-master-resolution).
 

README.md

@@ -38,6 +38,12 @@ privacy modes deny this uninspectable traffic; TinyComputer remains responsible
 for enforcing the proxy and dialing the approved socket. See the
 [browser-dial contract specification](docs/specs/browser-dial-contract-1.28.md).
 
+Contract 1.29 adds `Check::SkillScan` so the trusted host can submit the scan
+verdict and exact bundle digest before an installed skill runs. `Block` is a
+content denial, `Warn` enters the host's approval flow, and `Pass` leaves the
+remaining policy checks authoritative. See the
+[host skill-scan specification](docs/specs/skill-scan-contract-1.29.md).
+
 Contract 1.6 supplies `Audit2`, `EvaluateAudited2` and `CheckAudited2` with
 authenticated exact audit callbacks and a bounded [native journal](crates/tinysecurity-audit/README.md).
 The audited permission methods derive events from the actual original request,

crates/tinysecurity-approval/src/binding.rs

@@ -100,6 +100,19 @@ pub(crate) fn native_safe_call(request: &EvaluateRequest) -> Result<String> {
     }
     Ok(safe_call)
 }
+
+fn contains_blocked_skill_scan(checks: &[Check]) -> bool {
+    checks.iter().any(|check| {
+        matches!(
+            check,
+            Check::SkillScan {
+                verdict: tinysecurity_bus::SkillScanVerdict::Block,
+                ..
+            }
+        )
+    })
+}
+
 pub(crate) fn original(
     reg: &ApprovalScope2,
     request: &EvaluateRequest,
@@ -113,6 +126,7 @@ pub(crate) fn original(
         || request.call.arguments_json.len() > 32768
         || request.call.checks.is_empty()
         || request.call.checks.len() > 128
+        || contains_blocked_skill_scan(&request.call.checks)
         || (reg.ceiling == AccessTier::Read && request.caller.tier != AccessTier::Read)
         || (reg.ceiling == AccessTier::Write && request.caller.tier == AccessTier::Full)
         || request
@@ -137,7 +151,7 @@ pub(crate) fn original(
     args.sort_all_objects();
     let canonical = serde_json::to_string(&args).map_err(|_| Error::Invalid)?;
     let external = request.call.checks.iter().any(|check| match check {
-        Check::LocalDiagnostic {} => false,
+        Check::LocalDiagnostic {} | Check::SkillScan { .. } => false,
         Check::Path { write, .. } => *write,
         Check::HostAction {
             external_effect, ..

crates/tinysecurity-approval/src/engine.rs

@@ -760,7 +760,17 @@ impl Engine {
         now: u64,
         native: bool,
     ) -> Result<(Option<ApprovalRow2>, bool)> {
+        let scan_warning = request.request.call.checks.iter().any(|check| {
+            matches!(
+                check,
+                Check::SkillScan {
+                    verdict: tinysecurity_bus::SkillScanVerdict::Warn,
+                    ..
+                }
+            )
+        });
         let human_only = native
+            || scan_warning
             || matches!(
                 request.request.call.tool.as_str(),
                 "sandbox_host_network" | "device_crypto"

crates/tinysecurity-approval/src/engine_scopes_tests.rs

@@ -513,6 +513,33 @@ async fn host_tool_marker_is_an_external_effect_that_cron_cannot_reach() -> Resu
     Ok(())
 }
 
+#[tokio::test]
+async fn skill_scan_warning_enters_human_approval() -> Result<()> {
+    let (_, owner) = owner()?;
+    let mut auto_approve = register(7);
+    auto_approve.scope.auto_approve_all = true;
+    auto_approve.grants = grants(&["run_workflow"], &[]);
+    owner.register_scope(auto_approve).await?;
+
+    let mut warning = begin_for(7, "run_workflow", None, Origin::Operator);
+    warning.request.call.checks = vec![Check::SkillScan {
+        verdict: tinysecurity_bus::SkillScanVerdict::Warn,
+        bundle_sha256: "a".repeat(64),
+    }];
+    let pending = owner.begin(warning).await?;
+    assert_eq!(pending.state, ApprovalLifecycle2::Pending);
+    assert!(!pending.external_effect);
+
+    let mut blocked = begin_for(7, "run_workflow", None, Origin::Operator);
+    blocked.request.caller.call_id = "blocked-call".into();
+    blocked.request.call.checks = vec![Check::SkillScan {
+        verdict: tinysecurity_bus::SkillScanVerdict::Block,
+        bundle_sha256: "b".repeat(64),
+    }];
+    assert_eq!(owner.begin(blocked).await.err(), Some(Error::Denied));
+    Ok(())
+}
+
 #[tokio::test]
 async fn host_action_and_shell_checks_bind_with_their_own_external_effect() -> Result<()> {
     let (_, owner) = owner()?;

crates/tinysecurity-bus/src/device_frame_tests.rs

@@ -70,5 +70,5 @@ fn frame_operations_redact_both_payloads_without_changing_open_wire_shape()
 #[test]
 fn frame_member_name_is_stable_and_contract_version_is_bumped() {
     assert_eq!(crate::names::methods::DEVICE_FRAME2, "DeviceFrame2");
-    assert_eq!(crate::CONTRACT_VERSION, (1, 28));
+    assert_eq!(crate::CONTRACT_VERSION, (1, 29));
 }

crates/tinysecurity-bus/src/device_pairing_tests.rs

@@ -85,7 +85,7 @@ fn refresh_and_close_are_distinct_transient_session_operations() {
 
 #[test]
 fn pairing_contract_is_versioned_after_the_frame_contract() {
-    assert_eq!(CONTRACT_VERSION, (1, 28));
+    assert_eq!(CONTRACT_VERSION, (1, 29));
 }
 
 #[test]

crates/tinysecurity-bus/src/lib.rs

@@ -65,7 +65,7 @@ pub use scoped_policy::*;
 pub use tool_trust::*;
 pub mod names;
 /// Current wire vocabulary version, independent of the artifact version.
-pub const CONTRACT_VERSION: (u32, u32) = (1, 28);
+pub const CONTRACT_VERSION: (u32, u32) = (1, 29);
 /// Whether a remote module's advertised version supplies this host's vocabulary.
 ///
 /// `version` is the provider version received by the host, not a host requirement

crates/tinysecurity-bus/src/policy.rs

@@ -75,6 +75,22 @@ pub struct ToolCall {
     /// Never forward checks supplied by a model, tool client or remote caller.
     pub checks: Vec<Check>,
 }
+
+/// Host-computed verdict from scanning a skill before execution (contract 1.29).
+/// The host must scan the exact installed document and resources it will expose;
+/// this value is a trusted host assertion, never a model-supplied claim. It is
+/// supplemental to the host-effect check and cannot authorize a tool call alone.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum SkillScanVerdict {
+    /// No findings require action.
+    Pass,
+    /// Findings require the existing host approval flow before execution.
+    Warn,
+    /// The scan found content that must not execute.
+    Block,
+}
+
 /// A check of a concrete operation. The bootstrap has no URL authorization.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
@@ -141,6 +157,15 @@ pub enum Check {
         #[serde(default, skip_serializing_if = "Option::is_none")]
         command_policy: Option<CommandPolicyId>,
     },
+    /// A trusted host's scan result for the exact skill bundle being executed
+    /// (contract 1.29). `Warn` requires host approval; `Block` is a hard denial.
+    SkillScan {
+        /// Result computed by the host scanner.
+        verdict: SkillScanVerdict,
+        /// Lowercase SHA-256 of the exact document and resources the host will
+        /// expose during this run. The approval binding includes this value.
+        bundle_sha256: String,
+    },
     /// An effect not supported by this engine.
     Unknown {
         /// Content-free descriptor.

crates/tinysecurity-bus/src/policy_tests.rs

@@ -118,6 +118,31 @@ fn host_shell_has_a_stable_strict_wire_form() -> TestResult {
     Ok(())
 }
 
+#[test]
+fn skill_scan_has_stable_verdict_wire_forms() -> TestResult {
+    for (verdict, wire) in [
+        (SkillScanVerdict::Pass, "pass"),
+        (SkillScanVerdict::Warn, "warn"),
+        (SkillScanVerdict::Block, "block"),
+    ] {
+        let check = Check::SkillScan {
+            verdict,
+            bundle_sha256: "a".repeat(64),
+        };
+        let value = serde_json::to_value(&check)?;
+        assert_eq!(
+            value,
+            serde_json::json!({
+                "kind":"skill_scan",
+                "verdict":wire,
+                "bundle_sha256":"a".repeat(64),
+            })
+        );
+        assert_eq!(serde_json::from_value::<Check>(value)?, check);
+    }
+    Ok(())
+}
+
 #[test]
 fn new_denial_reasons_have_stable_wire_forms_and_old_ones_are_unchanged() -> TestResult {
     for (reason, wire) in [

crates/tinysecurity-bus/tests/scoped_wire.rs

@@ -1,4 +1,4 @@
-//! Registered subject policy wire shapes and the 1.28 compatibility boundary.
+//! Registered subject policy wire shapes and the 1.29 compatibility boundary.
 use serde_json::json;
 use tinysecurity_bus::*;
 
@@ -87,10 +87,10 @@ fn new_members_are_advertised_and_named_by_contract_constants() {
 
 #[test]
 fn contract_bump_is_additive_for_older_hosts_and_modules() {
-    assert_eq!(CONTRACT_VERSION, (1, 28));
-    // A host built against 1.28 accepts this module and newer minors, not a 1.27 module.
-    assert!(is_compatible((1, 28)));
-    assert!(!is_compatible((1, 27)));
+    assert_eq!(CONTRACT_VERSION, (1, 29));
+    // A host built against 1.29 accepts this module and newer minors, not a 1.28 module.
+    assert!(is_compatible((1, 29)));
+    assert!(!is_compatible((1, 28)));
     assert!(!is_compatible((1, 26)));
     assert!(!is_compatible((1, 25)));
     assert!(!is_compatible((1, 24)));

crates/tinysecurity-bus/tests/wire.rs

@@ -343,7 +343,7 @@ fn redactor_init_is_additive_and_secrets_never_enter_public_info()
         serde_json::to_value(&config)?["redactor"]["secrets"][0],
         "literal-private"
     );
-    assert_eq!(CONTRACT_VERSION, (1, 28));
+    assert_eq!(CONTRACT_VERSION, (1, 29));
     for (mode, wire) in [
         (RedactMode::Text, "text"),
         (RedactMode::StructuredArguments, "structured_arguments"),

crates/tinysecurity-module/src/adapter.rs

@@ -1572,13 +1572,18 @@ fn permission_payload(mut original: serde_json::Value) -> BusResult<String> {
 fn approval_failure(error: tinysecurity::approval::Error) -> tinybus::Error {
     tinybus::Error::failed(error.to_string())
 }
-/// Whether every check is a host-tool or shell admission question (contract 1.20).
+/// Whether host-tool checks are admission-only, with an optional supplemental scan.
 fn admission_only(checks: &[tinysecurity_bus::Check]) -> bool {
     use tinysecurity_bus::Check;
-    !checks.is_empty()
-        && checks
-            .iter()
-            .all(|check| matches!(check, Check::HostAction { .. } | Check::HostShell { .. }))
+    checks
+        .iter()
+        .any(|check| matches!(check, Check::HostAction { .. } | Check::HostShell { .. }))
+        && checks.iter().all(|check| {
+            matches!(
+                check,
+                Check::HostAction { .. } | Check::HostShell { .. } | Check::SkillScan { .. }
+            )
+        })
 }
 fn deny_allow(decision: &mut Decision) {
     if matches!(decision.verdict, tinysecurity_bus::Verdict::Allow) {

crates/tinysecurity-module/src/adapter_host_tool_tests.rs

@@ -112,6 +112,52 @@ async fn evaluate_reads_and_spends_the_named_command_scopes_budget() -> TestResu
     Ok(())
 }
 
+#[tokio::test]
+async fn evaluate_applies_host_skill_scan_verdicts_before_run_workflow() -> TestResult {
+    let service = service()?;
+    for (verdict, expected) in [
+        (
+            tinysecurity_bus::SkillScanVerdict::Block,
+            Verdict::Deny {
+                reason: DenialReason::Content,
+            },
+        ),
+        (
+            tinysecurity_bus::SkillScanVerdict::Warn,
+            Verdict::Deny {
+                reason: DenialReason::ApprovalUnavailable,
+            },
+        ),
+        (tinysecurity_bus::SkillScanVerdict::Pass, Verdict::Allow),
+    ] {
+        assert_eq!(
+            evaluate(
+                &service,
+                request(
+                    "run_workflow",
+                    vec![
+                        Check::HostAction {
+                            permission: ToolPermission::None,
+                            external_effect: false,
+                            spend: false,
+                            command_policy: None,
+                        },
+                        Check::SkillScan {
+                            verdict,
+                            bundle_sha256: "c".repeat(64),
+                        },
+                    ],
+                ),
+            )
+            .await?
+            .verdict,
+            expected,
+            "{verdict:?}"
+        );
+    }
+    Ok(())
+}
+
 #[tokio::test]
 async fn evaluate_gates_a_shell_command_under_the_named_scope() -> TestResult {
     let service = service()?;
@@ -242,6 +288,14 @@ async fn a_mixed_request_is_not_an_admission_and_stays_audit_bound() -> TestResu
     assert!(!admission_only(&call.call.checks));
     call.call.checks = vec![acting(false, &scope)];
     assert!(admission_only(&call.call.checks));
+    let scan = Check::SkillScan {
+        verdict: tinysecurity_bus::SkillScanVerdict::Pass,
+        bundle_sha256: "a".repeat(64),
+    };
+    call.call.checks = vec![acting(false, &scope), scan.clone()];
+    assert!(admission_only(&call.call.checks));
+    call.call.checks = vec![scan];
+    assert!(!admission_only(&call.call.checks));
     Ok(())
 }
 

crates/tinysecurity-module/src/adapter_secret_cipher_fixture_tests.rs

@@ -499,6 +499,12 @@ impl Control {
 #[tokio::test]
 async fn actual_confidential_cipher_dispatch_stages_only_at_fixed_slots_and_fails_closed()
 -> TestResult {
+    if isolate_process_owned_fixture(
+        "actual_confidential_cipher_dispatch_stages_only_at_fixed_slots_and_fails_closed",
+        "cipher",
+    )? {
+        return Ok(());
+    }
     for mode in 20..=32 {
         let bus = MemoryBus::new();
         let owner = Broker::new();

crates/tinysecurity-module/src/adapter_secret_tests.rs

@@ -4,6 +4,29 @@ use std::sync::atomic::{AtomicU32, Ordering};
 use tinybus::{Connection, broker::Broker, transport::memory::MemoryBus};
 use tinysecurity_bus::*;
 type TestResult = Result<(), Box<dyn std::error::Error>>;
+
+/// The module's confidential authorities are process-owned and intentionally
+/// survive service-tree replacement. Run actual bus fixtures in a child test
+/// process so Windows' linked module loader cannot share those owners between
+/// independent broker instances in the same libtest process.
+fn isolate_process_owned_fixture(
+    test_filter: &str,
+    marker: &str,
+) -> Result<bool, Box<dyn std::error::Error>> {
+    const CHILD_MARKER: &str = "TINYSECURITY_PROCESS_OWNED_FIXTURE";
+    if std::env::var(CHILD_MARKER).is_ok_and(|value| value == marker) {
+        return Ok(false);
+    }
+    let status = std::process::Command::new(std::env::current_exe()?)
+        .arg(test_filter)
+        .arg("--nocapture")
+        .env(CHILD_MARKER, marker)
+        .status()?;
+    if !status.success() {
+        return Err(format!("isolated fixture process exited with {status}").into());
+    }
+    Ok(true)
+}
 #[derive(Debug)]
 struct FixedClock(std::sync::atomic::AtomicU64);
 impl tinysecurity::approval::Clock for FixedClock {
@@ -922,6 +945,12 @@ mod linked_fixture {
 #[tokio::test]
 async fn actual_sdk_confidential_master_resolution_is_human_only_exact_and_fail_closed()
 -> TestResult {
+    if isolate_process_owned_fixture(
+        "actual_sdk_confidential_master_resolution_is_human_only_exact_and_fail_closed",
+        "master",
+    )? {
+        return Ok(());
+    }
     for mode in 0..=19 {
         let bus = MemoryBus::new();
         let owner = Broker::new();