guard: simulate, analyzers, policy, identity checkpoint

[mfw78]

Problem. Doc 09 step 4 / ADR-0011 (PR nullislabs/shepherd#132): one egress guard for intent submissions, EIP-712 signing, and transaction signing. None of it exists, and the identity backend it checkpoints is still a stub.

Scope. The simulate host primitive with a pluggable backend seam (local revm over provider-pool state first; a remote backend is explicit and consent-surfaced). Fact assembly producing typed bundles over nexum:value-flow (decoded payload, balance diffs, approvals, context). The analyzer component kind (query-module lineage; a pure fact-fed default tier, granted chain and scoped-http extras behind hard consent copy, deadline via epoch). The policy engine (binding verdicts with per-event override; authorisation-class routing, host-signed full pipeline versus pre-authorised audit-plus-advisory; fail-open/closed per profile). The identity-boundary checkpoint decoding EIP-712 and transactions. The audit log. The guard reasons over the portable intent and value-flow vocabulary only; it has no venue knowledge.

Dependencies. Intent core (#137) for the vocabulary. #34 (real identity backend, homed here; nothing to checkpoint until it is real). M0 nullislabs/shepherd#91/#92/#93 (the embedding builder, add-on, and handle surface is where verdicts and consent hooks reach a wallet embedder). Absorbs #55: the analyzer world is the query-module world's shipping consumer.

Notes. Guard sequenced after the intent core by owner decision (wallet embedding is design-ahead, not near-term). GitHub files this under milestone M5.

---

Next-train plan

Current state. None of the guard exists; the identity backend it checkpoints (#52) is a stub, and the query-module world (the analyzer's lineage) is authored but not bindgen'd. Children below are to be filed as native sub-issues once nullislabs/shepherd#137 lands the vocabulary.

Children (ordered):

• identity: real signing backend (keystore) #34 — real identity backend (accounts, sign, sign-typed-data) · Wave A · L
• simulate host primitive + pluggable backend seam (local revm first) · Wave B · L · deps intent: WIT packages, venue-adapter world, pool router shepherd#137
• fact assembly over nexum:value-flow (payload, balance diffs, approvals, context) · Wave B · M · deps intent: WIT packages, venue-adapter world, pool router shepherd#137
• analyzer component kind (query-module lineage, tiered consent) · Wave C · L · deps fact-assembly, testing: unify the wasm-artifact locator and fix the CI skip-policy divergence #55
• policy engine (binding verdicts, authorisation-class routing, fail profiles) · Wave D · L · deps analyzer
• identity-boundary checkpoint (decode EIP-712 + transactions) + audit log · Wave D · M · deps identity: real signing backend (keystore) #34, policy-engine

Blocked by: nullislabs/shepherd#137. Gated by: #34.

[mfw78]

Rescoped to fold the router/capability/lifecycle hardening the guard engine did not enumerate (single-decode/derive-before-guard, signed-tx boundary, async policy, http-under-world guarantee, messaging query scope, adapter sweeps, mock fidelity) as children. Advisory-only for the reshape milestone; depends on the identity backend #34.

[mfw78]

Transferred here as the primary repo in the M5 three-repo split. This is a cross-repo issue — portions of the work also land in the other carved repos; split into per-repo children when scheduled.

Identity (keystore signing) + the guard checkpoint are L1 here; the videre fact-assembly-over-value-flow analyzers are the cross-repo tail.