Add runtime-authority gate reference implementation, SDKs, specs, CI, and governed-workflow hardening

[blocksifrdev]

Motivation

• Provide a runnable reference for runtime authority (FrontDesk) and a canonical SCIM-RE/RAP contract so consumers can integrate and test runtime "trust-before-execution" flows.
• Ship minimal Node and Python SDKs plus examples to make it easy for CI/CD, API gateways, and agent runtimes to call POST /re/authorize and handle receipts.
• Harden automation with CI smoke tests and improve the GitHub Actions governed execution workflow to be robust in no-op and misconfigured environments.

Description

• Add a minimal reference implementation reference-implementations/runtime-authority-gate/server.mjs that evaluates trust/risk/cost/compliance, emits structured ExecutionReceipts with integrity.hash and chainHash, and exposes endpoints GET /healthz, POST /re/authorize, POST /re/reauthorize, GET /receipts and /utils/binding-hash.
• Add SDKs: Node SDK (sdk/node/index.js, sdk/node/models.js) and Python SDK (sdk/python/client.py, sdk/python/__init__.py) plus READMEs and usage examples for each language.
• Author canonical specifications and governance docs under specs/ and docs/ including scim-re-authorize-api.md, execution-receipt.md, rap.md, ttp.md, trust-decay.md, and administrative and user guides and examples in examples/.
• Add CI and repo-health workflow .github/workflows/ci.yml to run npm test, compile the Python SDK (python -m py_compile sdk/python/client.py), and perform end-to-end smoke checks using curl, the Python SDK and the Node SDK against the reference gate; and update governed_execution.yml to serialize changed files robustly, return local fallback receipts when no changes or config is missing, surface step-up results, and treat specific local receipts as no-op or non-fatal.
• Update package.json test scripts to run the new runtime-authority-gate test suite and add a top-level CHANGELOG.md and README rework to reflect the BlockSiFr Agent Trust Infrastructure baseline.

Testing

• Ran the Node test suite with npm test which executes test:trust-routing and test:runtime-authority-gate, and the suites completed successfully.
• Executed the reference gate contract test reference-implementations/runtime-authority-gate/server.test.mjs, which exercised GET /healthz, multiple POST /re/authorize scenarios, POST /re/reauthorize, GET /receipts, and POST /utils/binding-hash, and all assertions passed.
• Performed CI smoke checks: python -m py_compile sdk/python/client.py succeeded, and the smoke flows that call the running gate via curl, the Python SDK, and the Node SDK validated PERMIT responses and returned receipts successfully.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6bfe8b1e29

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Recompute integrity hash after setting latencyMs

buildReceipt computes integrity.hash before returning, but /re/authorize mutates the signed payload at receipt.decision.latencyMs immediately afterward. This makes every authorization receipt internally inconsistent (hash no longer matches receipt contents), so downstream verification/audit code will fail even for untampered receipts.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Re-hash receipt after overriding reauth chain hash

In /re/reauthorize, the receipt hash is generated inside buildReceipt, then integrity.chainHash is overwritten afterward. Because the hash is not recomputed, reauthorization receipts are emitted with invalid integrity metadata and cannot be reliably chain-verified.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Reject reauthorization for non-step-up outcomes

The reauthorization path issues PERMIT whenever approval.approvedBy is present, without validating that the prior receipt was STEP_UP or ESCALATE. This allows a previously DENY decision (for example, low trust or policy violation) to be converted into a permitted execution by calling /re/reauthorize with that receipt ID, effectively bypassing deny controls.

Useful? React with 👍 / 👎.