Trusty: provenance library workspace (initial import)

crates/core/trusty-policy/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "trusty-policy"
+version.workspace = true
+edition.workspace = true
+authors.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+description = "Scoped FSM + policy engine. Constrains agent / tool-chain action surfaces; emits a structured audit event per evaluation. Substrate-independent (no trusty-core dep) -- consumers wire a PolicyAuditor sink (trusty for production, no-op for tests, file logger for dev)."
+
+[dependencies]
+serde = { workspace = true }
+serde_json = { workspace = true }
+thiserror = { workspace = true }
+
+[features]
+default = []

crates/core/trusty-policy/examples/claude_session.json

@@ -0,0 +1,171 @@
+{
+  "transitions": [
+    {
+      "from": "idle",
+      "action": "boot",
+      "to": "booted"
+    },
+    {
+      "from": "booted",
+      "action": "present_plan",
+      "to": "planned"
+    },
+    {
+      "from": "planned",
+      "action": "approved",
+      "to": "working"
+    },
+    {
+      "from": "working",
+      "action": "read_file",
+      "to": "working"
+    },
+    {
+      "from": "working",
+      "action": "edit_file",
+      "to": "working"
+    },
+    {
+      "from": "working",
+      "action": "write_new_file",
+      "to": "working"
+    },
+    {
+      "from": "working",
+      "action": "bash_safe",
+      "to": "working"
+    },
+    {
+      "from": "working",
+      "action": "delegate_agent",
+      "to": "working"
+    },
+    {
+      "from": "working",
+      "action": "hit_edit_limit",
+      "to": "cycle_pause"
+    },
+    {
+      "from": "cycle_pause",
+      "action": "approved",
+      "to": "working"
+    },
+    {
+      "from": "cycle_pause",
+      "action": "rollback_cycle",
+      "to": "working"
+    },
+    {
+      "from": "working",
+      "action": "run_tests",
+      "to": "testing"
+    },
+    {
+      "from": "testing",
+      "action": "tests_green",
+      "to": "working"
+    },
+    {
+      "from": "testing",
+      "action": "tests_red",
+      "to": "working"
+    },
+    {
+      "from": "working",
+      "action": "begin_close",
+      "to": "closing"
+    },
+    {
+      "from": "closing",
+      "action": "write_delta_log",
+      "to": "closing"
+    },
+    {
+      "from": "closing",
+      "action": "write_tag",
+      "to": "closing"
+    },
+    {
+      "from": "closing",
+      "action": "write_handoff",
+      "to": "closing"
+    },
+    {
+      "from": "closing",
+      "action": "update_session_gate",
+      "to": "closing"
+    },
+    {
+      "from": "closing",
+      "action": "run_close_check",
+      "to": "closing"
+    },
+    {
+      "from": "closing",
+      "action": "commit_branch",
+      "to": "closed"
+    },
+    {
+      "from": "working",
+      "action": "halt_destructive_op",
+      "to": "await_human"
+    },
+    {
+      "from": "working",
+      "action": "halt_main_branch_write",
+      "to": "await_human"
+    },
+    {
+      "from": "working",
+      "action": "halt_skip_hooks",
+      "to": "await_human"
+    },
+    {
+      "from": "working",
+      "action": "halt_unplanned_file",
+      "to": "await_human"
+    },
+    {
+      "from": "working",
+      "action": "halt_external_publish",
+      "to": "await_human"
+    },
+    {
+      "from": "working",
+      "action": "halt_three_errors",
+      "to": "await_human"
+    },
+    {
+      "from": "working",
+      "action": "halt_secret_in_diff",
+      "to": "await_human"
+    },
+    {
+      "from": "working",
+      "action": "halt_dependency_change",
+      "to": "await_human"
+    },
+    {
+      "from": "testing",
+      "action": "halt_tests_3_attempts",
+      "to": "await_human"
+    },
+    {
+      "from": "await_human",
+      "action": "human_resolves",
+      "to": "working"
+    },
+    {
+      "from": "await_human",
+      "action": "human_aborts",
+      "to": "idle"
+    },
+    {
+      "from": "closed",
+      "action": "next_session",
+      "to": "idle"
+    }
+  ],
+  "scope": "claude.code.session.v1",
+  "initial": "idle"
+}

crates/core/trusty-policy/examples/pipeline.json

@@ -0,0 +1,26 @@
+{
+  "transitions": [
+    {
+      "from": "idle",
+      "action": "claim",
+      "to": "claimed"
+    },
+    {
+      "from": "claimed",
+      "action": "execute",
+      "to": "running"
+    },
+    {
+      "from": "running",
+      "action": "finish",
+      "to": "done"
+    },
+    {
+      "from": "running",
+      "action": "abort",
+      "to": "aborted"
+    }
+  ],
+  "scope": "agent.executor.v1",
+  "initial": "idle"
+}