WallGuard runtime collaboration and delegation admission gate

[mdheller]

Parent: SocioProphet/sociosphere#443
Depends on: #252
Depends on: SocioProphet/agent-registry#47
Depends on: SocioProphet/policy-fabric#93

Purpose

Implement the AgentPlane runtime admission gate for WallGuard collaboration, delegation, and tool-use paths.

AgentPlane must not make final policy decisions locally. It must gather/receive subject wall context from Agent Registry, submit or consume WallGuard decisions from Policy Fabric, and emit collaboration admission receipts suitable for Core Ledger.

Runtime objective

Gate these runtime actions before execution:

• agent-to-agent message
• subagent delegation
• tool grant
• action dispatch
• memory access request handoff
• clean-room handoff request

Required behavior

• Same-wall collaboration can proceed only after canonical allow decision.
• Cross-wall collaboration is denied before message/delegation/tool payload exposure.
• Missing wall context fails closed.
• Contaminated session state cannot initiate collaboration or tool grants.
• Denied attempts produce receipt/event refs, not only logs.
• Payload contents are not written into receipts.

Suggested files

• tools/wallguard_collaboration_gate.py
• tests/fixtures/wallguard-runtime/*.json
• tools/validate_wallguard_collaboration_gate.py
• Makefile target validate-wallguard-collaboration-gate

Acceptance criteria

• Same-wall collaboration fixture passes and emits/returns admission evidence.
• Cross-wall collaboration fixture is denied before payload dispatch.
• Missing wall context fixture fails closed.
• Contaminated session fixture is denied/quarantined.
• Tool grant and subagent delegation are covered by runtime fixtures.
• AgentPlane consumes Policy Fabric/Agent Registry surfaces instead of implementing policy authority locally.
• No dependency on cascade, presidio, OrchestraOS, or noncanonical/unlicensed code.

Non-goals

• Do not implement Policy Fabric evaluator here.
• Do not implement Memory Mesh storage/read/write behavior here.
• Do not build product UI here.