feat: add deterministic workflow policy guardrails and durable human approval gates

.github/workflows/publish-npm.yml

@@ -81,6 +81,7 @@ jobs:
           publish sema-fmt
           publish sema-vm
           publish sema-otel
+          publish sema-policy
           publish sema-workflow
           publish sema-llm
           publish sema-stdlib

CHANGELOG.md

@@ -4,6 +4,35 @@
 
 ### Added
 
+- **Workflow policies — `defpolicy` (#50).** A policy is a compiled, immutable
+  map that guards a workflow at its boundaries: `:models` (which
+  provider/model a call may use), `:tools` (per-tool argument constraints over
+  paths, domains, and commands), `:subjects` (semantic allow/deny rules for the
+  file, network, command, and external-action a tool actually performs),
+  `:input` and `:output` (content scanning, with `:redact` and `:block`
+  actions). Install one with `:policy` in a `defworkflow` or `step` meta map.
+  Layers compose: any layer may deny, a later layer can only tighten an earlier
+  one, and the strictest action wins. Every decision is journaled to the run
+  directory as evidence. `policy/without` is a lexical, audited bypass that
+  emits a `policy.bypassed` event and never widens the workflow's `:permissions`
+  sandbox. `sema workflow check` rejects a source file whose policy or approval
+  use is malformed before the run starts.
+- **Durable human approval gates — `approval` (#50).** `(approval :key {…})`
+  stops a workflow before a sensitive action until a human records a decision.
+  In `auto` mode on a terminal it prompts; with an approval authority it writes
+  a request sidecar, exits 3, and waits. A separate trusted process decides with
+  `sema workflow approve` / `sema workflow reject`, signing with an Ed25519 key
+  that is never passed to the workflow process; `sema workflow run --resume`
+  then applies it. Decisions are bound to the run, workflow, code version,
+  arguments, phase, key, occurrence, and subject digest, so a decision cannot be
+  replayed onto a different gate or run. `sema workflow approvals` lists pending
+  requests as text or JSON, and the loopback `sema workflow view` viewer can
+  record the same signed decision. `sema workflow approval-keygen` creates the
+  authority.
+- **`sema_version_req` in `sema.toml`** — a package can declare the Sema
+  versions it supports, and `sema pkg` refuses an incompatible install with the
+  requirement in the error.
+
 - **macOS release binaries are now Developer-ID signed, notarized, and
   Sigstore-attested (#109, #107, #133).** Every `*-apple-darwin.tar.xz`
   carries a hardened-runtime signature and a GitHub Artifact Attestation

Cargo.toml

@@ -16,6 +16,7 @@ members = [
     "crates/sema-docs",
     "crates/sema-mcp",
     "crates/sema-otel",
+    "crates/sema-policy",
     "crates/sema-workflow",
 ]
 resolver = "2"
@@ -43,6 +44,7 @@ default-members = [
     "crates/sema-docs",
     "crates/sema-mcp",
     "crates/sema-otel",
+    "crates/sema-policy",
     "crates/sema-workflow",
 ]
 
@@ -68,6 +70,7 @@ sema-notebook = { version = "=1.33.0", path = "crates/sema-notebook" }
 sema-docs = { version = "=1.33.0", path = "crates/sema-docs" }
 sema-mcp = { version = "=1.33.0", path = "crates/sema-mcp" }
 sema-otel = { version = "=1.33.0", path = "crates/sema-otel" }
+sema-policy = { version = "=1.33.0", path = "crates/sema-policy" }
 sema-workflow = { version = "=1.33.0", path = "crates/sema-workflow" }
 
 tower-lsp = "0.20"
@@ -96,6 +99,7 @@ rand = "0.10"
 uuid = { version = "1", features = ["v4"] }
 base64 = "0.22"
 sha2 = "0.10"
+ring = "0.17"
 chrono = "0.4"
 csv = "1"
 md5 = "0.8"
@@ -109,6 +113,7 @@ unicode-width = "0.1"
 unicode-segmentation = "1"
 caseless = "0.2"
 glob = "0.3"
+globset = "0.4"
 hostname = "0.4"
 libc = "0.2"
 pdf-extract = "0.12"

crates/sema-core/src/context.rs

@@ -101,6 +101,7 @@ impl Drop for ContextStacksMut<'_> {
 pub struct EvalContext {
     pub module_cache: RefCell<BTreeMap<PathBuf, BTreeMap<String, Value>>>,
     pub embedded_files: RefCell<BTreeMap<PathBuf, Vec<u8>>>,
+    embedded_files_only: Cell<bool>,
     pub current_file: RefCell<Vec<PathBuf>>,
     pub module_exports: RefCell<Vec<Option<Vec<String>>>>,
     pub module_load_stack: RefCell<Vec<PathBuf>>,
@@ -235,6 +236,7 @@ impl EvalContext {
         EvalContext {
             module_cache: RefCell::new(BTreeMap::new()),
             embedded_files: RefCell::new(BTreeMap::new()),
+            embedded_files_only: Cell::new(false),
             current_file: RefCell::new(Vec::new()),
             module_exports: RefCell::new(Vec::new()),
             module_load_stack: RefCell::new(Vec::new()),
@@ -266,6 +268,7 @@ impl EvalContext {
         EvalContext {
             module_cache: RefCell::new(BTreeMap::new()),
             embedded_files: RefCell::new(BTreeMap::new()),
+            embedded_files_only: Cell::new(false),
             current_file: RefCell::new(Vec::new()),
             module_exports: RefCell::new(Vec::new()),
             module_load_stack: RefCell::new(Vec::new()),
@@ -484,6 +487,15 @@ impl EvalContext {
         self.embedded_files.borrow_mut().clear();
     }
 
+    /// When enabled, `import` and `load` may only resolve host-provided embedded files.
+    pub fn set_embedded_files_only(&self, enabled: bool) {
+        self.embedded_files_only.set(enabled);
+    }
+
+    pub fn embedded_files_only(&self) -> bool {
+        self.embedded_files_only.get()
+    }
+
     pub fn set_module_exports(&self, names: Vec<String>) {
         if let Some(state) = self.module_task_state() {
             state.set_current_exports(names);