fix(security): stop tool arguments shadowing governance fields; close LLM classifier channel gap

[requie]

Reopens #35 against the renamed branch (claude/pr28-p29-review-arbrx0 → bug/pr28-p29-review). Closes #30 and #31.

What this fixes

[Critical] Tool arguments could shadow the fields governance matches on.
The pre_tool_use buffer entry spread the agent's own arguments over the trusted fields ({"tool": tool_name, "type": "tool_call", **tool_input}). That entry becomes context["action"], so an argument named tool overwrote the real tool name and GOV-001's sensitive-tool gate evaluated the forgery. A prompt-injected agent calling payment_execute with {"tool": "noop"} skipped approval entirely: under enforce=True the dangerous tool ran, and in observe-only mode the signed attestation recorded governance: pass for a check that never happened. The same trick overrode type.

Verified reproducible before fixing — GOV-001 returns pass on the old shape and escalate on the new one for the same poisoned call.

[High] The LLM classifier skipped the two multi-agent channels.
The regex scanner covers seven channels; AdversarialLLMLayer.aevaluate fed only five to the classifier, so shared_memory and broadcast_messages reached neither strong detector — the regex taxonomy scores ~0 on the action-oriented injections that travel through those channels. A compromised peer's injection into shared memory passed clean, which is the cross-agent cascade (T-CASCADE) the v0.8 channels exist to defend.

Unbounded LLM classification cost (#31).
Calls ran sequentially with no ceiling while the multi-agent buffers cap at 1000 entries per channel — a latency tail and a cost-amplification lever on attacker-writable content.

Approach

Arguments now nest under action["arguments"], the shape the decision-record and enforcement paths already used, rather than the narrower spread-order fix. Spread-first would only guarantee tool and type win; untrusted keys would still sit at the top level where any future rule reading a flat key inherits the same bug. Nesting makes the collision structurally impossible. GOV-003 reads action["arguments"]["amount"] accordingly (#30).

Cost is bounded on two axes — max_concurrency (default 8) and max_targets_per_evaluation (default 200) — with truncation logged and surfaced as details["llm_classifier"]["targets_dropped"] so a capped scan never reads as full coverage. Verdicts are cached per (channel, content-hash) with oldest-first eviction so growing buffers don't re-bill classified text. Fail-open verdicts are never cached: they record an outage, not a judgment, and pinning one would blind every later pass over the same text.

Breaking change

context["action"] for a tool call is now {"tool": …, "type": "tool_call", "arguments": {…}}. Custom PolicyRule conditions reading call-derived keys off the top level must read them from action["arguments"]; rules matching only tool or type are unaffected. Callers who build their own action dicts and pass them to evaluate() directly are unaffected, since they control the shape end to end.

The migration hazard here is that the failure is silent: a rule reading an argument off the top level doesn't raise, it just stops matching. So this PR also updates spec/layers/governance-layer.md — its custom-rule example previously taught exactly that pattern. The spec now documents the action-dict contract (which fields are trusted and why the nesting is a security boundary), reads from arguments in the example, and states the silent-failure mode so rules written against the old shape get re-checked during migration. The CHANGELOG carries the same migration note.

Tests

19 new regression tests covering the bypass end to end, both channel gaps (including content-key fallbacks and the deliberate broadcast_messages → broadcast_channels label mapping the dedup map depends on), and every cost bound. Full suite 682 passing, ruff and mypy --strict clean.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.