Answer known questions locally; gate egress; approve every key use

[abhijitkrm]

Implements the plan agreed for v0.4.x. The end-to-end run on a throwaway testnet comes next, before any release.

Local router: no model call for known questions and incidents

• Known questions: an intent catalog (YAML: built-ins plus ~/.cometcli/intents) answers them with read-only tools and a fixed template.
  • It covers jailed validators, validator count, peers, sync, missed blocks, consensus, proposals, pending votes, rewards, balance, upgrade plan and slashing params.
  • Repeats within 30s come from a cache.
• What always goes to the model: open-ended prompts (why/how/explain), actions (unjail/restart/vote yes), long or multi-line prompts, anything unmatched, and any lookup that fails.
• /incident: triage runs locally. When one known case is clearly the root cause and has a playbook, cometcli runs it, records the incident and reports.
  • Changes and transactions still ask.
  • A failed step hands over to the model, with the triage and the steps done attached.
  • A declined step stops.
• Playbooks so far: node down, jailed for downtime, halt-height left set, and container memory limit.
• Commands and config: /llm forces the model, /route explains the routing, /cost counts local answers, and agent.router: off disables routing.

Egress gate

• Key material: a message carrying any of these is withheld whole, in the history too:

  • PEM/OpenSSH keys, consensus keys
  • BIP-39 mnemonics, keystores, file-keyring entries, private-key hex
  • API and bot tokens

  A prompt containing a mnemonic is refused before it's sent.

• Strict egress (default on validators): the model sees bash/read/grep/node.logs/fleet output only as a local summary, with identifiers masked, repeats folded and errors first. The UI and the audit log keep the raw output. RPC/sentry profiles and general mode default to filtered.

Key access

• Every signature is its own approval. It shows the account, which key and where it lives, the decoded messages, the fee and the stated reason.
• It is never auto-approved, and each use is audited as a key event.
• Telegram approvals of a key use expire in 5 minutes.
• The local keyring no longer signs during gas simulation, so the key is untouched until approval.

Tests

• Router: classification (local and model cases), cache, fallbacks, read-only enforcement, router off.
• Local incidents: full playbook run, conditional skips, handoff with context, a declined step stopping, and an unknown case going to the model.
• Egress: scanner true positives and false positives, summaries, the agent-level gate, strict mode.
• Key use: always asked even under the most permissive auto-approval, a decline meaning nothing is signed (simulation checked unsigned), and the Telegram expiry.
• Registry: every playbook and intent names a real tool, and intents use only read-only tools.

🤖 Generated with Claude Code