STEP 1584 — SafetyGate (benchtop probe integration)

STEP 1584 · STEP 1569 arc 「実 hardware 統合」第 1 弾 · production-ready SafetyGate module + PlanRunner (STEP 1579) 統合 · Rei-AIOS · 2026-08-30

目的

STEP 1579 (b) PlanRunner の permissive default safetyGate handler を production-ready に置換する。藤本さん directive 「実 hardware 統合 (benchtop-mcp probe / SafetyGate rule 実装)」応答。

物理 hardware は現状 test bed 未整備なので、本 STEP は rule engine + rule catalog + PlanRunner handler の実装。実 hardware への SCPI/GPIO/SMART 直呼は benchtop-mcp 側 (Python) の担当、本 module は rei-aios 側 pre-check として動作 (STEP 1417 d8_physics_precheck と同じ責任分離 pattern)。

3-tier hazard model

Level	意味	例
safe	副作用なし、 read-only、 pure computation	`read_data`, `disk_health_verdict`, `puzzle_verify`, `log_healthy`
caution	状態読取だが privileged / rate-limited	`benchtop_probe_temperature`, `d8_verdict_x`, `smart_read`
blocked	破壊的、 power on/off、 firmware write、 irreversible	`benchtop_power_off`, `benchtop_firmware_flash`, `kikusui_cr_mode` (STEP 1345)

Rule engine (composable、 first-match wins)

type SafetyRule = (toolName, args) => SafetyDecision | null;

// Rule constructors:
allowByPrefix(prefix, ruleName?)           // approve by name prefix
blockByPattern(regex, reason, ruleName?)   // block by regex
allowReadOnly()                            // approve /^(query|read|get|list|verdict|inspect|probe_status|health)_/
cautionBenchtopProbeRead()                 // approve /^(benchtop_probe|d8_verdict|disk_health|smart_)/  at caution level
blockBenchtopDestructive()                 // block /^(benchtop_power_|benchtop_firmware_|kikusui_cr_mode|scpi_write_)/
customRule(pred, decision, ruleName)       // user-defined predicate

Rule 群は 順序が重要 (first match wins)。 destructive 系を先に block、その後に allow 系。どの rule もマッチしなければ secure-by-default deny。

SafetyGate class

const gate = productionGate([
  // Optional extra rules (evaluated FIRST — custom wins)
  customRule((n) => n === 'my_special_tool',
             { approved: true, hazardLevel: 'safe', note: 'app whitelist' },
             'app-whitelist'),
]);

// Direct evaluation
const d = gate.evaluate('benchtop_probe_temp', {});
// → { approved: true, hazardLevel: 'caution',
//     ruleName: 'benchtop-probe-read', note: 'privileged probe read — approved with caution' }

// PlanRunner integration
const runner = new PlanRunner({ safetyGate: gate.handler });
await runner.run(myPlan());
// → CheckMsg で production rule catalog を経由

Presets: productionGate(extraRules?) (secure-by-default) / permissiveGate() (test / dev only)。

Default rule catalog v0.1 (順序)

(extraRules — user 供給、 catalog 最上位)
blockBenchtopDestructive — power / firmware / wipe / hard reset / kikusui_cr_mode / scpi_write
cautionBenchtopProbeRead — benchtop_probe_ / d8_verdict_ / disk_health / environment_read / smart_
allowReadOnly — query_ / read_ / get_ / list_ / verdict_ / inspect_ / probe_status_ / health_
allowByPrefix: disk_health_verdict / shannon_entropy_verdict / flow_state_verdict / puzzle_ / log_

マッチなし → default-deny-unknown ({ approved: false, hazardLevel: 'blocked' })。

STEP 1345 との責任分離

Layer	担当	SafetyGate 位置
rei-aios (TypeScript)	plan generator + tool dispatch pre-check	本 STEP 1584 module (rule catalog + PlanRunner handler)
benchtop-mcp (Python)	物理計測、 SCPI、 probe hardware, Kikusui CR mode hazard	STEP 1345 SafetyGate (benchtop 内部、変更なし)

本 module は benchtop 呼出前に rei-aios 側で pre-check、 benchtop 側は自身の内部で更に guard する二重 layer 構造 (STEP 1417 d8_physics_precheck pattern の踏襲)。

Test — 44/44 PASS

Rule constructor unit tests (allowByPrefix / blockByPattern / allowReadOnly / cautionBenchtopProbeRead / blockBenchtopDestructive / customRule)
Default catalog covers read-only / probe / destructive patterns
Unknown pattern → default deny (secure-by-default 検証)
SafetyGate.handler PlanRunner adapter shape
Integration: PlanRunner rejects destructive tool via productionGate
Integration: PlanRunner approves safe probe via productionGate (trace で rule name 確認)
extraRules composability (custom rule が catalog 上位で評価)
Plan-declared 'blocked' hazard が rule approval を override

Honest scope

v0.1 = rule engine + rule catalog + PlanRunner handler。実 hardware への SCPI/GPIO 直呼は benchtop-mcp 側担当、本 module は pre-check のみ
rule catalog は regex + prefix match の shallow lint。 args 内容の deep inspection (SCPI command body の解析等) は v0.2 candidate
不明 tool は default deny (secure-by-default)。新 tool 追加時は明示的に allow rule を catalog に追加する forcing function
test bed 未整備なので実 hardware は verify 不可、本 STEP は tsprim + PlanRunner 統合の compile/runtime check まで