symfonic.agent.cutover.policy

policy

What the migrated path is allowed to serve, as data.

The decision procedure lives in :mod:~symfonic.agent.cutover.envelope; this module is the policy it applies, kept separate so the trusted surface can be read end to end without the reflection that enforces it in the way. Everything here is a claim about the kernel path, and every claim carries its evidence.

The allowlists are the entire trusted surface. Adding a name to one asserts that the migrated path honours that field — an assertion tests/agent/cutover/test_envelope_default_deny.py makes someone state consciously, and holds short enough for a reviewer to check all of it.

capability_for

capability_for(path: str) -> str | None

The switch a field waits on, when one has been named for it.

Every config.domain field shapes the system prompt, so the whole object maps to one capability instead of eleven identical entries. Every config.orchestrator field configures the memory stack, for the same reason and with the same saving (TA8.37).

Source code in src/symfonic/agent/cutover/capability_labels.py

def capability_for(path: str) -> str | None:
    """The switch a field waits on, when one has been named for it.

    Every ``config.domain`` field shapes the system prompt, so the whole
    object maps to one capability instead of eleven identical entries. Every
    ``config.orchestrator`` field configures the memory stack, for the same
    reason and with the same saving (TA8.37).
    """
    if path.startswith("domain."):
        return "prompting"
    if path.startswith("orchestrator."):
        return "memory"
    return _CAPABILITY.get(path)