feat(signing-gate): verdict → signing-gate compose seam

[ernanibmurtinho]

What

A small, generic, fail-closed adapter (gecko/signing_gate.py) that lets a downstream custody / signing layer gate on Gecko's anti-poisoning verdict: refuse to sign or release a credential for a tool Gecko quarantined at comprehension time.

This is the verdict → policy proof-of-seam — the concrete artifact behind the custody-partner compose (target partner: a secrets/signing vault for agents). Kept partner-name-generic so any custody/policy engine can consume it.

Why (the compose)

• Gecko = comprehension + detection, upstream — an ingested spec is untrusted; a tool whose text trips the sanitizer is quarantined (SafetyVerdict, already shipped).
• The custody layer = enforcement, downstream — holds the keys, signs the intent.
• Gecko never holds keys or signs. It hands over a verdict; the signer decides. This module is the thin seam between them, so Gecko stays the brain and does not become the firewall.

How

• SigningDecision(allow, tool, reason) — auditable yes/no + why.
• evaluate(verdict, tool, known_tools=...) — pure function a custody layer calls with a stored verdict (no live surface needed). Fail-closed: unknown tool → deny; quarantined → deny with the sanitizer's reason; clean → allow. Per-tool blast radius (a poisoned sibling never denies a clean tool).
• gate_surface_tool(surface, tool) — convenience over a live Surface.

Proof (offline, $0, falsifiable)

tests/test_signing_gate.py: comprehend a spec with a clean tool + a poisoned tool →

• poisoned tool quarantined at comprehension ✅
• gate DENIES signing for it (carries the reason) ✅
• gate ALLOWS the clean sibling ✅
• unknown tool → fail-closed deny ✅

Gate

ruff + mypy gecko clean; targeted suites 14 passed.

🤖 Generated with Claude Code