@fabric-harness/agent-boundary

The reusable governed MCP/ACP execution boundary. A vertical parameterizes the boundary with its projection readers and governed-action allowlist; the boundary enforces the full bound set — wall time, turns, tool calls, external calls, concurrency, cumulative tokens, cost — at every consuming path (MCP tools, the model/provider call, the supervised agent process), with durable per-run budget state, audited exhaustion, and cancellation/ revocation that reaches in-flight work.

import {
  createRunGovernor,
  createToolBoundary,
  defineReadTool,
  defineProposalTool,
  guardModelProvider,
  inMemoryAgentRunBudgetStore,
  inMemoryBoundaryAuditSink,
  resolveRunBounds,
  serveMcpBoundary,
} from '@fabric-harness/agent-boundary';
import { z } from 'zod';

const governor = await createRunGovernor({
  runId: 'run-1',
  enrollmentId: 'enrollment-1',
  tenantId: 'tenant-1',
  bounds: resolveRunBounds(agentVersion.modelPolicy, {
    maxWallTimeMs: 10 * 60_000,
    maxTurns: 20,
    maxToolCalls: 50,
    maxExternalCalls: 10,
  }),
  store: inMemoryAgentRunBudgetStore(), // production: durable store
  audit: inMemoryBoundaryAuditSink(),   // production: vertical audit log
});

const boundary = createToolBoundary({
  tools: [
    defineReadTool({
      name: 'list_open_requests',
      description: 'Open approval requests from the authorized projection.',
      input: z.object({ limit: z.number().int().max(50) }),
      read: ({ limit }) => projections.openRequests(limit),
    }),
    defineProposalTool({
      name: 'propose_note',
      description: 'Propose a note via the governed pipeline.',
      input: z.object({ subjectId: z.string(), body: z.string().max(2000) }),
      propose: (params) => ({ actionId: 'vertical.add_note', params }),
    }),
  ],
  allowlist: enrollment.approvedTools, // forbidden tools are never registered
  governor,
  proposals: governedProposalPort,
  principal: executionPrincipal,
});

await serveMcpBoundary({ name: 'vertical-tools', version: '1.0.0', boundary, governor });

Read tools never mutate; proposal tools submit through the registry's GovernedProposalPort and perform no effect themselves. A tool outside the allowlist is unavailable — absent from tools/list, indistinguishable from nonexistent on call.

See the collaboration plan (gate B2, decision D10) in the techfabric vault for the full contract this package satisfies.

License

Apache-2.0