datatug / datatug-cli / 42286050382

100%

push

github

feat: AI-agent onboarding — demo install, local policy exceptions (session-bound), masked project reads, caller context (#586)

AI-agent onboarding: the CLI half. A person's agent goes from installed CLI → local demo → Perimeter demo (allowed read with masking, refused read, a time-boxed policy exception the person applies or rejects in their own terminal, audit) and stops. Spec: datatug/backstage `spec/features/ai-onboarding/` (branch `ai-onboarding`); Decision 0007 (founder-approved 2026-11-06) frames the local step as the person's own policy exception, not a grant (Decision 0002 unchanged).

Source commits:

- cdcb8003fd6a feat(perimeter): local policy exceptions, project-scoped query run with masking, demo install
  - datatug policy exception propose|status|list|apply|reject|revoke|audit:
  per-project store in <project>/.datatug/policy-exceptions/, random 64-bit
  ids, TTY-only person actions (exit 6 HUMAN_TERMINAL_REQUIRED), typed table
  name confirmation, scope hash, lock + re-read before commit, audit JSONL.
  - query run --project <p> --source <db>: project policies only, deny by
  default, exception overlay bound to policy fingerprint, used audit event
  when an exception rule decides, Meaning Graph label masking, structured
  JSON denial on stderr with --format json.
  - datatug demo install: embedded pinned Chinook SQLite + inGitDB support
  notes, curated agent policy and labels; idempotent, fails closed on a
  changed Chinook file.
  - db add accepts ingitdb://<folder>.
- d482a7adb599 test(perimeter): cover policy exceptions, demo fixtures, policy overlay and inGitDB sources
- 9a93150edba2 test(perimeter): cover project reads, policy exception commands and demo install
  Also tightens the code under test: the policy document is decoded once
  per exception command, masking refusals are typed, schema reads have
  seams, and the source URL of a project read is parsed where it is
  resolved. db add's refusal test now uses openvaultdb, sinc... (continued)

1547 of 1547 new or added lines in 19 files covered. (100.0%)

96960 of 96961 relevant lines covered (100.0%)

1.01 hits per line