Add governance policy framework (RFC-MACP-0012)

.github/workflows/ci.yml

@@ -123,6 +123,16 @@ jobs:
         env:
           MACP_MEMORY_ONLY: "1"
 
+      - name: Run conformance tests
+        run: cargo test conformance
+        env:
+          MACP_MEMORY_ONLY: "1"
+
+      - name: Run policy tests
+        run: cargo test policy
+        env:
+          MACP_MEMORY_ONLY: "1"
+
   build:
     name: Build
     runs-on: ubuntu-latest
@@ -154,69 +164,6 @@ jobs:
       - name: Build release
         run: cargo build --release
 
-  lint-protobuf:
-    name: Lint Protocol Buffers
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install buf
-        uses: bufbuild/buf-setup-action@v1
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Lint protobuf with buf
-        run: buf lint proto
-
-      - name: Check for breaking changes
-        if: github.event_name == 'pull_request'
-        run: |
-          git fetch origin main
-          # Skip if main branch doesn't have a buf module yet
-          if git show origin/main:proto/buf.yaml > /dev/null 2>&1; then
-            buf breaking proto --against '.git#branch=origin/main,subdir=proto'
-          else
-            echo "No buf module found on main branch, skipping breaking change check"
-          fi
-
-  proto-sync:
-    name: Proto Sync Check
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: bufbuild/buf-setup-action@v1
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Verify protos match pinned BSR version
-        run: |
-          TMPDIR=$(mktemp -d)
-          buf export buf.build/multiagentcoordinationprotocol/macp -o "$TMPDIR"
-
-          DRIFT=0
-          for proto in \
-            macp/v1/envelope.proto \
-            macp/v1/core.proto \
-            macp/modes/decision/v1/decision.proto \
-            macp/modes/proposal/v1/proposal.proto \
-            macp/modes/task/v1/task.proto \
-            macp/modes/handoff/v1/handoff.proto \
-            macp/modes/quorum/v1/quorum.proto; do
-            if ! diff -q "$TMPDIR/$proto" "proto/$proto" > /dev/null 2>&1; then
-              echo "DRIFT: $proto"
-              diff -u "$TMPDIR/$proto" "proto/$proto" || true
-              DRIFT=1
-            fi
-          done
-          rm -rf "$TMPDIR"
-
-          if [ "$DRIFT" -ne 0 ]; then
-            echo "Proto files don't match BSR. Run 'make sync-protos'."
-            exit 1
-          fi
-          echo "All proto files match BSR."
-
   audit:
     name: Security Audit
     runs-on: ubuntu-latest
@@ -275,7 +222,7 @@ jobs:
   ci-pass:
     name: All Checks Passed
     runs-on: ubuntu-latest
-    needs: [check, fmt, clippy, test, build, lint-protobuf, proto-sync, audit]
+    needs: [check, fmt, clippy, test, build, audit]
 
     steps:
       - name: Summary

Cargo.toml

@@ -13,6 +13,7 @@ otel = ["dep:opentelemetry", "dep:opentelemetry_sdk", "dep:opentelemetry-otlp",
 [dependencies]
 tokio = { version = "1", features = ["full"] }
 tonic = { version = "0.14", features = ["transport", "tls-ring"] }
+tonic-health = "0.14"
 prost = "0.14"
 prost-types = "0.14"
 tonic-prost = "0.14"
@@ -33,6 +34,10 @@ opentelemetry-otlp = { version = "0.15", features = ["tonic"], optional = true }
 tracing-opentelemetry = { version = "0.23", optional = true }
 rocksdb = { version = "0.22", optional = true }
 redis = { version = "0.27", features = ["tokio-comp", "aio"], optional = true }
+# Proto definitions from the spec repo (exposes DEP_MACP_PROTO_PROTO_DIR to build.rs via links metadata).
+# For local proto development, temporarily switch to a path dependency:
+#   macp-proto = { path = "../multiagentcoordinationprotocol/packages/proto-rust" }
+macp-proto = { git = "https://github.com/multiagentcoordinationprotocol/multiagentcoordinationprotocol.git" }
 
 [dev-dependencies]
 tempfile = "3"

Dockerfile

@@ -7,7 +7,6 @@ WORKDIR /app
 
 # Cache dependencies: copy manifests first, build a dummy, then copy real source
 COPY Cargo.toml Cargo.lock build.rs ./
-COPY proto/ proto/
 RUN mkdir -p src && echo "fn main() {}" > src/main.rs && \
     mkdir -p src/bin && \
     cargo build --release 2>/dev/null || true && \

Makefile

@@ -1,7 +1,4 @@
-.PHONY: setup build test test-integration test-conformance test-all fmt clippy check audit coverage sync-protos sync-protos-local check-protos test-integration-grpc test-integration-agents test-integration-e2e test-integration-hosted
-
-SPEC_PROTO_DIR := ../multiagentcoordinationprotocol/schemas/proto
-PROTO_FILES := macp/v1/envelope.proto macp/v1/core.proto macp/modes/decision/v1/decision.proto macp/modes/proposal/v1/proposal.proto macp/modes/task/v1/task.proto macp/modes/handoff/v1/handoff.proto macp/modes/quorum/v1/quorum.proto
+.PHONY: setup build test test-integration test-conformance test-all fmt clippy check audit coverage test-integration-grpc test-integration-agents test-integration-e2e test-integration-hosted
 
 ## First-time setup: configure git hooks
 setup:
@@ -26,7 +23,10 @@ test-integration:
 test-conformance:
 	cargo test conformance
 
-test-all: fmt clippy test test-integration test-conformance
+test-policy:
+	cargo test policy
+
+test-all: fmt clippy test test-integration test-conformance test-policy
 
 coverage:
 	cargo tarpaulin --all-targets --out html
@@ -36,25 +36,6 @@ audit:
 
 check: fmt clippy test
 
-## Pull latest proto files from BSR
-sync-protos:
-	buf export buf.build/multiagentcoordinationprotocol/macp -o proto
-	@echo "Done. Run 'git diff proto/' to review changes."
-
-## Sync from local sibling checkout (for development before BSR publish)
-sync-protos-local:
-	@if [ ! -d "$(SPEC_PROTO_DIR)" ]; then \
-		echo "Error: Spec repo not found at $(SPEC_PROTO_DIR)"; \
-		echo "Use 'make sync-protos' to sync from BSR instead."; \
-		exit 1; \
-	fi
-	@for f in $(PROTO_FILES); do \
-		mkdir -p proto/$$(dirname $$f); \
-		cp "$(SPEC_PROTO_DIR)/$$f" "proto/$$f"; \
-		echo "  Copied $$f"; \
-	done
-	@echo "Done. Run 'git diff proto/' to review changes."
-
 ## Integration tests (gRPC, Rig agents)
 test-integration-grpc:
 	cd integration_tests && cargo test --test tier1 -- --test-threads=1
@@ -67,22 +48,3 @@ test-integration-e2e:
 
 test-integration-hosted:
 	cd integration_tests && cargo test -- --test-threads=1
-
-## Check if local protos match BSR
-check-protos:
-	@TMPDIR=$$(mktemp -d); \
-	buf export buf.build/multiagentcoordinationprotocol/macp -o "$$TMPDIR"; \
-	DRIFT=0; \
-	for f in $(PROTO_FILES); do \
-		if ! diff -q "$$TMPDIR/$$f" "proto/$$f" > /dev/null 2>&1; then \
-			echo "DRIFT: $$f"; \
-			DRIFT=1; \
-		fi; \
-	done; \
-	rm -rf "$$TMPDIR"; \
-	if [ "$$DRIFT" -eq 0 ]; then \
-		echo "All proto files match BSR."; \
-	else \
-		echo "Run 'make sync-protos' to update."; \
-		exit 1; \
-	fi

README.md

@@ -276,8 +276,8 @@ Check that the sender identity matches the session's participant list. For `Comm
 **`StorageFailed` error**
 The runtime requires write access to `MACP_DATA_DIR`. Check directory permissions. Log append failures are fatal — the runtime will not acknowledge a message without a durable record.
 
-**Proto drift / `make check-protos` failure**
-Run `make sync-protos` to update local proto files from BSR.
+**Proto version mismatch**
+Update the `macp-proto` dependency version in `Cargo.toml` and run `cargo build`.
 
 ## Testing
 

build.rs

@@ -1,17 +1,20 @@
 fn main() -> Result<(), Box<dyn std::error::Error>> {
+    let proto_dir =
+        std::env::var("DEP_MACP_PROTO_PROTO_DIR").expect("macp-proto crate must set proto_dir");
     tonic_prost_build::configure()
         .build_server(true)
         .compile_protos(
             &[
                 "macp/v1/envelope.proto",
                 "macp/v1/core.proto",
+                "macp/v1/policy.proto",
                 "macp/modes/decision/v1/decision.proto",
                 "macp/modes/proposal/v1/proposal.proto",
                 "macp/modes/task/v1/task.proto",
                 "macp/modes/handoff/v1/handoff.proto",
                 "macp/modes/quorum/v1/quorum.proto",
             ],
-            &["proto"],
+            &[&proto_dir],
         )?;
     Ok(())
 }