AtomCode v5.0.9 新子系统深度分析 — 安全策略执行与政策干预

基于 strings 错误串 + WebUI 事件族 + 策略不变量的还原分析 2026-09-09 前置报告：05-version-diff-v4.25.5-to-v5.0.9.md

---

1. 源码模块（全新）

crates/atomcode-coding/src/execution_policy.rs   ← 执行策略引擎（核心）
crates/atomcode-capabilities/src/atomgit/push_label_mw.rs  ← 策略中间件
crates/atomcode-coding/src/skill_first.rs         ← 技能优先路由

---

2. 政策干预（Policy Intervention）事件流

2.1 事件通道

atomcode:child-policy-intervention    ← 子代理策略干预命名通道
policy_intervention                   ← 实时事件（WebUI/daemon 事件族）
policy_intervention_resolved          ← 干预已解决
policy_intervention_cleared           ← 干预已清除
intervention_id                       ← 干预唯一标识
actions                               ← 可选项
request_id                            ← 关联请求

2.2 端到端流程（事件 + API 还原）

agent 触发安全策略
  → 生成 policy intervention（intervention_id）
  → /live/policy-intervention 端点 POST（WebUI 前端）
  → 用户选择 recovery action
  → policy_intervention_resolved 事件回到 agent
  → policy intervention resolution was not accepted  ← 拒绝回退
  → policy_intervention_cleared 清除挂起干预

---

3. 干预状态机

no security policy intervention is pending          ← 无挂起干预
security policy recovery action is not available    ← 无恢复动作
policy intervention resolution was not accepted:    ← 拒绝接受
policy intervention resolution was not accepted
security policy recovery action is not available
kernel runtime did not accept the policy intervention resolution

---

4. 策略阻断语义（三条主线）

4.1 凭据参数阻断

blocked by security policy: credentials cannot be passed through generic shell arguments

→ 凭据不得经由通用 shell 参数（与 DEEP_ANALYSIS_39 的 credential_bash_gate 配合）。

4.2 硬策略下子代理输出没收

blocked by a hard security policy; the subagent's output was withheld.
Choose a recovery option or take ...

→ 硬策略触发时子代理输出被扣留，需用户恢复决策。

4.3 回合级中止

Turn stopped by security policy

---

5. 政策恢复（Policy Recovery）UI 面

WebUI 恢复对话框（完整还原）：

"Security policy needs your decision"    ← 标题
policyRecovery.instructions: View safe instructions
policyRecovery.skip / skipDesc            ← 跳过本步
policyRecovery.complete: I completed it externally   ← 外部完成
policyRecovery.end: End task             ← 终止任务
policyRecovery.title / submitError
policyRecovery.endedLocally

动作	语义
View safe instructions	查看安全指令（View safe instructions）
Skip this step	跳过当前步骤
I completed it externally	用户声称已在外部完成
End task	终止任务（含 keep the ... ）

对应后端动作键：end_task / prompt_rejected / policy_denied。

---

6. 策略不变式

thresholds satisfy the policy invariant

→ 执行策略引擎对阈值集合做不变式校验，保证策略自洽。

---

7. 与既有安全层的分层

层	职责	模块
审批策略	工具调用级审批	approval policy / denied by approval policy
安全策略	凭据/敏感内容策略	execution_policy.rs + 门禁
Bash 门禁	命令边界	bash_workspace_gate / credential_bash_gate
子代理输出	硬策略扣留	blocked by a hard security policy

---

8. 逆向方法论备注

1. atomcode:child-policy-intervention 通道名直接暴露子代理策略干预的通信载体
2. WebUI 端 policyRecovery.* i18n 键完整还原恢复对话框动作集
3. policy_intervention_resolved / cleared 事件族揭示干预生命周期
4. denied by approval policy（审批）与 blocked by security policy（安全）是两条独立策略路径
5. thresholds satisfy the policy invariant 表明策略配置有自检不变式

---

本报告由持续分析循环生成 — v5.0.9 安全策略执行与政策干预深度分析