| 1 | // Package runtimepolicy is the monotonic pre/post execution guard engine. |
| 2 | // Guards may only add Deny, Ask, Allow, or obligations; they never revoke a |
| 3 | // stronger decision, rewrite a resolved tool identity, or wait on I/O while |
| 4 | // the contract lock is held. |
| 5 | package runtimepolicy |
| 6 |