Add M1 plan, given tests and fixtures, AGENTS.md and implementer log

Seven task files for the implementing model under docs/plans/M1/, with
the test files, byte-exact fixtures, Makefile, deny.toml and gate-script
self-test they copy into place. All of it was verified against a private
reference implementation: the gate passes after every task in order.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/plans/M1/files/crates/proto/tests/fixtures/grant/bad_mode.toml

@@ -0,0 +1,3 @@
+tool = "read_file"
+mode = "always"
+max_taint = "private"

docs/plans/M1/files/crates/proto/tests/fixtures/grant/full.toml

@@ -0,0 +1,12 @@
+tool = "http_fetch"
+mode = "ask"
+max_taint = "secret"
+result_class = "public"
+untrusted = false
+expires = "2026-12-31T00:00:00.000Z"
+secret = "example-api-token"
+
+[constraints]
+paths = ["/home/kyle/notes/**"]
+hosts = ["example.com", "api.example.com"]
+patterns = ["^GET "]

docs/plans/M1/files/crates/proto/tests/fixtures/grant/minimal.toml

@@ -0,0 +1,3 @@
+tool = "read_file"
+mode = "auto"
+max_taint = "private"

docs/plans/M1/files/crates/proto/tests/fixtures/grant/missing_max_taint.toml

@@ -0,0 +1,2 @@
+tool = "read_file"
+mode = "auto"

docs/plans/M1/files/crates/proto/tests/fixtures/grant/unknown_constraint.toml

@@ -0,0 +1,6 @@
+tool = "read_file"
+mode = "auto"
+max_taint = "private"
+
+[constraints]
+path = ["/etc/**"]

docs/plans/M1/files/crates/proto/tests/fixtures/grant/unknown_field.toml

@@ -0,0 +1,4 @@
+tool = "read_file"
+mode = "auto"
+max_taint = "private"
+max_tiant = "secret"

docs/plans/M1/files/crates/proto/tests/fixtures/records/audit.jsonl

@@ -0,0 +1,4 @@
+{"seq":0,"time":"2026-09-17T08:05:00.000Z","prev":"0000000000000000000000000000000000000000000000000000000000000000","session":"mm-thread-42","call":1,"tool":"read_file","arguments":"{\"path\":\"/etc/hosts\"}","session_taint":"private","decision":{"outcome":"allowed","grant":"read-etc"}}
+{"seq":1,"time":"2026-09-17T08:05:01.250Z","prev":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f","session":"mm-thread-42","call":2,"tool":"shell","arguments":"{\"command\":\"df -h\"}","session_taint":"private","decision":{"outcome":"approved","grant":"shell-ask","approver":"u8f3k2","post":"p9x7"}}
+{"seq":2,"time":"2026-09-17T08:05:02.000Z","prev":"ffeeddccbbaa99887766554433221100ffeeddccbbaa99887766554433221100","session":"cron-morning","call":1,"tool":"consult","arguments":"{\"question\":\"hi\"}","session_taint":"secret","decision":{"outcome":"denied","reason":"taint_too_high","grant":"consult-private"}}
+{"seq":3,"time":"2026-09-17T08:05:03.000Z","prev":"ffeeddccbbaa99887766554433221100ffeeddccbbaa99887766554433221100","session":"cron-morning","call":2,"tool":"rm_rf","arguments":"{}","session_taint":"secret","decision":{"outcome":"denied","reason":"no_grant","grant":null}}

docs/plans/M1/files/crates/proto/tests/fixtures/records/session.jsonl

@@ -0,0 +1,7 @@
+{"type":"session_start","time":"2026-09-17T08:05:00.000Z","session":"mm-thread-42","epoch":0,"slot":0,"baseline":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f"}
+{"type":"user","time":"2026-09-17T08:05:01.000Z","content":"What is in /etc/hosts?"}
+{"type":"assistant","time":"2026-09-17T08:05:03.000Z","content":null,"reasoning_content":"The user wants a file.\nI will read it.","tool_calls":[{"id":"call_a1","name":"read_file","arguments":"{\"path\":\"/etc/hosts\"}"}]}
+{"type":"tool_result","time":"2026-09-17T08:05:04.000Z","call":1,"tool_call_id":"call_a1","content":"127.0.0.1 localhost\n","class":"private","untrusted":true,"truncated":false}
+{"type":"assistant","time":"2026-09-17T08:05:06.000Z","content":"It maps localhost to 127.0.0.1.","reasoning_content":null,"tool_calls":[]}
+{"type":"cache_loss","time":"2026-09-17T09:00:00.000Z","expected":30695,"got":0}
+{"type":"epoch_end","time":"2026-09-17T12:00:00.000Z","next":1,"summary":"Looked at /etc/hosts."}

docs/plans/M1/files/crates/proto/tests/fixtures/wire/error.json

@@ -0,0 +1 @@
+{"v":1,"id":0,"final":true,"msg":{"kind":"error","body":{"code":"bad_version","detail":"expected 1"}}}

docs/plans/M1/files/crates/proto/tests/fixtures/wire/tool_request.json

@@ -0,0 +1 @@
+{"v":1,"id":7,"final":true,"msg":{"kind":"tool_request","body":{"session":"mm-thread-42","call":3,"tool":"read_file","arguments":"{\"path\":\"/etc/hosts\"}"}}}

docs/plans/M1/files/crates/proto/tests/fixtures/wire/tool_response_denied.json

@@ -0,0 +1 @@
+{"v":1,"id":9,"final":true,"msg":{"kind":"tool_response","body":{"status":"denied","reason":"taint_too_high"}}}

docs/plans/M1/files/crates/proto/tests/fixtures/wire/tool_response_failed.json

@@ -0,0 +1 @@
+{"v":1,"id":8,"final":true,"msg":{"kind":"tool_response","body":{"status":"failed","message":"exit status 2"}}}

docs/plans/M1/files/crates/proto/tests/fixtures/wire/tool_response_pending.json

@@ -0,0 +1 @@
+{"v":1,"id":7,"final":false,"msg":{"kind":"tool_response","body":{"status":"pending_approval","approval":"ap-0001","expires":"2026-09-17T08:35:00.000Z"}}}

docs/plans/M1/files/crates/proto/tests/fixtures/wire/tool_response_result.json

@@ -0,0 +1 @@
+{"v":1,"id":7,"final":true,"msg":{"kind":"tool_response","body":{"status":"result","content":"127.0.0.1 localhost\n","class":"private","untrusted":true,"truncated":false}}}