Agent surface lane: gate core

[omridevk]

Parent

#579

What to build

The integration heart: the agent sees and calls the entire core API through one gated path. A boot-built policy catalog drives a wrap pass over the composite router so EVERY procedure call — including ones from routers built on bare bases — passes one gate: human principal passes, agent runs free/ask/deny per policy, asks are bound to validated-input digests, queued per execution, cancelled on run stop, and nested gated calls cannot deadlock. The code-mode catalog is generated from the same policy map (assist-tool special path deleted), cross-session send is guarded (self-target, cycles, depth, rate), streams ride the collector module, and the three legacy approval paths are deleted. Demo: agent catalogs and calls a read freely; a mutation raises an ask in the widget; approving lands it; the poison procedures do not exist for the agent; a credential-less local RPC call gets no human plane.

Spec: docs/superpowers/specs/2026-08-22-agent-api-surface-design.md. Plan tasks 5-12 in docs/superpowers/plans/2026-08-22-agent-api-surface-platform.md.

Acceptance criteria

• Policy catalog at boot: name-collision and missing-summary fail the boot; poison exclusion asserted
• Wrap-pass gate: a bare-base router procedure is still gated (the load-bearing test); unknown-to-catalog denies for agent; forged principals deny
• Approval ledger: digest over validated input, atomic consume, queue + reentrancy, cancellation
• Agent bridge from the catalog; assist path deleted; conciv_ui/conciv_extensions ride the same rails
• Cross-session guard with origin trace; declared SELF_TARGET/CYCLE/RATE_LIMITED errors
• Collector module wired for stream-marked procedures
• Legacy gate paths deleted, verified by antipattern grep; end-to-end test green; fallow clean; changeset

Blocked by

• Agent surface lane: metered contract #580 (metered contract)
• Agent surface lane: principal + widget plane credential #581 (principal + plane credential)
• Agent surface lane: bounded stream collector module #582 (collector module)
• feat/session-scope-enforcement lane (ambient session primitives) — external to this issue set