feat(sidecar,shell): HGW runtime stack #80–#84 (project write policy, project_create, 24-step turns, auto-approve, git safety)

agent-loop/src/lib.rs

@@ -178,6 +178,12 @@ pub enum ToolOutcome {
     /// The tool ran, but this particular output is untrusted whatever the tool's annotation says
     /// (e.g. a file read that resolved outside the granted folders). Taints the session.
     Untrusted(String),
+    /// HGW-5: the tool ran, and its host vouches that this particular output carries only content
+    /// the session may already trust, whatever the tool's annotation says: an auto-approved
+    /// `shell_run` (a listed read or build command, in the OS sandbox with no network, writing
+    /// only a project in the member's grants), whose output derives from the project's own files
+    /// like a folder-grant file read. Never taints. A host that cannot show that never uses it.
+    Vouched(String),
     /// A human (or policy) declined the effect — nothing happened.
     Denied(String),
     /// The tool failed.
@@ -187,14 +193,14 @@ pub enum ToolOutcome {
 impl ToolOutcome {
     fn to_content(&self) -> String {
         match self {
-            ToolOutcome::Ok(s) | ToolOutcome::Untrusted(s) => s.clone(),
+            ToolOutcome::Ok(s) | ToolOutcome::Untrusted(s) | ToolOutcome::Vouched(s) => s.clone(),
             ToolOutcome::Denied(why) => format!("declined: {why}. Nothing was done."),
             ToolOutcome::Error(e) => format!("tool error: {e}"),
         }
     }
     fn status(&self) -> &'static str {
         match self {
-            ToolOutcome::Ok(_) | ToolOutcome::Untrusted(_) => "ok",
+            ToolOutcome::Ok(_) | ToolOutcome::Untrusted(_) | ToolOutcome::Vouched(_) => "ok",
             ToolOutcome::Denied(_) => "denied",
             ToolOutcome::Error(_) => "error",
         }
@@ -944,6 +950,7 @@ pub fn run_turn_with(
             let ingested_untrusted = ran
                 && match &outcome {
                     ToolOutcome::Untrusted(_) => true,
+                    ToolOutcome::Vouched(_) => false,
                     ToolOutcome::Ok(_) | ToolOutcome::Error(_) => {
                         spec.is_some_and(|s| s.annotations.output_untrusted())
                     }

agent-loop/tests/taint_tests.rs

@@ -771,3 +771,51 @@ fn the_loop_records_each_untrusted_tool_as_a_source() {
         "both tools that returned untrusted content are sources"
     );
 }
+
+/// HGW-5: a result its host vouches for (an auto-approved, sandboxed, offline run inside a
+/// project) does not taint, even from a tool annotated untrusted; the same tool's ordinary
+/// output still does.
+#[test]
+fn a_vouched_result_does_not_taint_but_the_same_tools_plain_output_does() {
+    let llm = ScriptLlm::new(vec![
+        AssistantTurn::tools(vec![call("c1", "web_fetch")]),
+        AssistantTurn::tools(vec![call("c2", "write_file")]),
+        AssistantTurn::tools(vec![call("c3", "node_status")]),
+        AssistantTurn::text("done"),
+    ]);
+    let host = Arc::new(PerTool {
+        inner: RecHost::new(true, ToolOutcome::Ok("ok".into())),
+        by_name: vec![("web_fetch", ToolOutcome::Vouched("project output".into()))],
+    });
+    let tools = ToolRegistry::new(catalog()).with_host(HostKind::Core, host.clone());
+    let sink = Sink::default();
+    run_turn(
+        &cfg(),
+        &llm,
+        &tools,
+        &sink,
+        &StopFlag::default(),
+        &mut vec![],
+        "go",
+    );
+    assert!(!tools.taint().is_tainted());
+    assert!(!sink.kinds().contains(&"tainted"));
+    assert_eq!(hic_of(&sink.tool_call("c2")).0, None, "no HIC downgrade");
+    // The same untrusted-annotated tool, answered plainly, taints.
+    let llm = ScriptLlm::new(vec![
+        AssistantTurn::tools(vec![call("c1", "web_fetch")]),
+        AssistantTurn::text("done"),
+    ]);
+    let plain = Arc::new(RecHost::new(true, ToolOutcome::Ok("page".into())));
+    let tools = ToolRegistry::new(catalog()).with_host(HostKind::Core, plain);
+    run_turn(
+        &cfg(),
+        &llm,
+        &tools,
+        &Sink::default(),
+        &StopFlag::default(),
+        &mut vec![],
+        "go",
+    );
+    assert!(tools.taint().is_tainted());
+}

agent-mcp-host/tests/modern.rs

@@ -42,6 +42,7 @@ fn text_of(o: &ToolOutcome) -> String {
     match o {
         ToolOutcome::Ok(s)
         | ToolOutcome::Untrusted(s)
+        | ToolOutcome::Vouched(s)
         | ToolOutcome::Denied(s)
         | ToolOutcome::Error(s) => s.clone(),
     }

agent-mcp-host/tests/node_demo.rs

@@ -15,6 +15,7 @@ fn show(o: &ToolOutcome) -> String {
     match o {
         ToolOutcome::Ok(s) => format!("ok: {s}"),
         ToolOutcome::Untrusted(s) => format!("untrusted: {s}"),
+        ToolOutcome::Vouched(s) => format!("vouched: {s}"),
         ToolOutcome::Denied(s) => format!("denied: {s}"),
         ToolOutcome::Error(s) => format!("error: {s}"),
     }

agent-mcp-host/tests/stdio.rs

@@ -37,6 +37,7 @@ fn text_of(o: &ToolOutcome) -> String {
     match o {
         ToolOutcome::Ok(s)
         | ToolOutcome::Untrusted(s)
+        | ToolOutcome::Vouched(s)
         | ToolOutcome::Denied(s)
         | ToolOutcome::Error(s) => s.clone(),
     }