Files
ruvnet__ruflo/v3/@claude-flow/security/scripts/benchmark-policy-engine.mjs
rUv 495a451cf6 feat: add ADR-324 agentic policy engine (#2822)
* feat(memory): typed provenance in AgentDB (ADR-323)

Corrects and implements the 2026-07-28 dream-cycle research proposal
(PR #2804, closed as superseded) for typed memory provenance in
AgentDB, addressing MemIR/MemSyco-Bench's "provenance-role collapse"
and memory-induced sycophancy findings.

The dream-cycle PR's proposed schema change targeted the wrong table
(`vector_indexes`, which is per-namespace HNSW index metadata, not
per-entry) and its filename collided with the already-merged
`ADR-322-metaharness-flywheel-integration.md` (#2817) — both corrected
here as ADR-323 against `memory_entries`, the real per-record table.

- memory-initializer.ts: `provenance_type` column (user_claim |
  agent_output | system_observation | tool_result | unknown, default
  unknown) on `memory_entries`, migrated for existing DBs via
  `ensureSchemaColumns()`. `storeEntry()`/`searchEntries()` accept and
  validate `provenanceType`/`provenanceFilter`.
- memory-bridge.ts: same wiring for the native better-sqlite3 AgentDB
  v3 path (`bridgeStoreEntry`/`bridgeSearchEntries`).
- commands/memory.ts: `memory store --provenance <type>`, `memory
  search --provenance-filter <types>` (comma-separated, OR semantics).
- mcp-tools/memory-tools.ts + cli-core/mcp-tools/memory-defs.ts:
  `memory_store`'s `provenance_type` param, `memory_search`'s
  `provenance_filter` param (kept in sync across both tool-def sets).

Found and fixed during implementation: an initial design skipped the
RaBitQ/HNSW acceleration paths entirely whenever a provenance filter
was requested (neither carries provenance_type on their candidates).
This reproducibly crashed the CLI process on exit (a libuv assertion
on Windows) after printing correct results. Fixed by never skipping
those paths — RaBitQ now fetches provenance_type in its existing
per-candidate query, HNSW does one batched (namespace, key) lookup
afterward — eliminating the crash across repeated runs. See ADR-323's
"Implementation note" for detail.

7 new end-to-end tests (adr-323-memory-provenance.test.ts), including
a repeated-run regression guard for the crash. Full existing memory
suite re-verified with no regressions (one pre-existing, environment-
specific #2558 test failure confirmed identical against unmodified
main — better-sqlite3's native bridge is unavailable in this dev
environment, unrelated to this change).

Closes the follow-up from dream-cycle PR #2804 (closed as superseded).

Co-Authored-By: claude-flow <ruv@ruv.net>

* fix(memory): enforce provenance across retrieval paths

* feat: add agentic policy engine

* fix: align Codex MCP integration

* fix: keep MetaHarness dependencies optional

* fix: declare MetaHarness as optional peers

* fix: sync workspace lockfile

* fix: document policy tool selection guidance

* test: cover governed in-process flywheel

* ci: make MetaHarness absence drill deterministic
2026-07-28 22:12:19 -04:00

52 lines
1.9 KiB
JavaScript

import { performance } from 'node:perf_hooks';
import { AgenticPolicyEngine, evaluatePolicy } from '../dist/policy/index.js';
const iterations = Number(process.env.POLICY_BENCH_ITERATIONS ?? 50_000);
const request = {
identity: { id: 'agent:benchmark', type: 'agent', roles: ['developer'] },
action: { type: 'code.write', resource: 'src/app.ts', environment: 'development' },
context: {
envelope: {
actions: ['code.*'],
resources: ['src/*'],
maxConcurrency: 4,
network: false,
destructive: false,
},
},
};
const rules = [
{ id: 'allow-dev-code', effect: 'allow', actions: ['code.*'], roles: ['developer'], environments: ['development'] },
{ id: 'deny-prod-write', effect: 'deny', actions: ['code.write'], environments: ['production'], priority: 100 },
];
const pureStarted = performance.now();
for (let i = 0; i < iterations; i++) evaluatePolicy(request, rules, 'enforce');
const pureMs = performance.now() - pureStarted;
const receiptIterations = Math.min(iterations, 5_000);
const engine = new AgenticPolicyEngine({ mode: 'enforce', rules });
const receiptStarted = performance.now();
for (let i = 0; i < receiptIterations; i++) engine.evaluate({ ...request, requestId: `bench-${i}` });
const receiptMs = performance.now() - receiptStarted;
const report = {
schema: 'ruflo.policy-benchmark/v1',
pure: {
iterations,
durationMs: Number(pureMs.toFixed(3)),
opsPerSecond: Math.round(iterations / (pureMs / 1_000)),
microsPerDecision: Number(((pureMs * 1_000) / iterations).toFixed(3)),
},
withReceipts: {
iterations: receiptIterations,
durationMs: Number(receiptMs.toFixed(3)),
opsPerSecond: Math.round(receiptIterations / (receiptMs / 1_000)),
microsPerDecision: Number(((receiptMs * 1_000) / receiptIterations).toFixed(3)),
ledgerValid: engine.verifyLedger().valid,
},
};
console.log(JSON.stringify(report, null, 2));
if (!report.withReceipts.ledgerValid) process.exitCode = 1;