[#526] Implement Green/Red action classification

[anchapin]

Summary

Implements Green/Red action classification feature for LuminaGuard approval cliff. This determines whether MCP tool calls require human approval based on security risk.

Changes

Created orchestrator/src/approval/classifier.rs with comprehensive action classification logic:

ToolClassifier

Classifies tool calls as Green (autonomous) or Red (requires approval):

Green Actions (No Approval):

• Read operations: read_file, read, read_resource, read_prompt
• List operations: list_files, list_directory, list_resources, list_prompts
• Search operations: search, grep, find, locate
• View operations: view, view_file, get_file_info, stat, info, status
• Monitor operations: check_file, monitor

Red Actions (Require Approval):

• Critical Risk: delete_file, remove_file, transfer_crypto, transfer_asset
• High Risk: write_file, edit_file, modify_system, execute_command, run_script
• Medium Risk: create_file, send_email, deploy, publish, external_call
• Low Risk: install, commit, push

ClassificationResult

Returns detailed classification information:

• requires_approval: Whether approval is needed
• action_type: Inferred action type
• risk_level: None, Low, Medium, High, Critical
• reason: Human-readable explanation

Advanced Features

• Batch Classification: Classify multiple tools at once
• Pattern Matching: Word boundary checks to avoid false positives
• Parameter Analysis: Detects dangerous operations in parameters
• Read-Only External Calls: Identifies safe API calls (GET, LIST, FETCH)
• Server-Specific Support: Handles GitHub, Slack, and other MCP server conventions
• Conservative Default: Unknown tools default to RED (fail-secure)

Testing

42 comprehensive test cases covering:

• Green action classification (read_file, list_directory, search, etc.)
• Red action classification (write_file, delete_file, send_email, etc.)
• Case insensitivity
• Batch classification
• GitHub-specific tools (github_list_issues, github_create_issue)
• Slack-specific tools (slack_send_message)
• Parameter-based classification
• Risk level assignment
• Unknown tools (conservative default)

All 42 tests pass successfully.

Integration

The classifier is integrated into the approval module and can be used by ApprovalManager to automatically determine whether a tool call requires human approval. This provides the foundation for the complete approval cliff workflow.

Acceptance Criteria

• Create orchestrator/src/approval/ module
• Implement action classifier with ToolClassifier
• Green actions: read_file, list_files, search, read-only operations
• Red actions: write_file, delete_file, send_email, transfer_crypto, destructive operations
• Add classification logic based on tool name and parameters
• Add tests for classification accuracy (42 tests)
• Document classification rules

Closes #526

[sourcery-ai]

Sorry @anchapin, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery