[cachafla]

What this adds

Embedding hooks that let another Go service run Atryum as its enforcement engine and own the decisions. Standalone Atryum (no options set) behaves as before.

• WithDecider(d): every tool call on every path (MCP proxy, direct invoke, hook Submit, the Managed Agents bridge) is handed to d, which returns allow, notify, deny or pending. With a decider set, Atryum's own approval rules, plans, default policy provider, operator routes and UI are not used, and the summarizer doesn't send tool arguments to Atryum's LLM backend. A decider error, unknown verdict or panic denies the call.
• WithEventHook(h): h runs inside the database transaction that changes an invocation, so an embedder can record events atomically with the state change. Invocation writes are now transactional (internal/store/tx.go). If the decision can't be recorded, the call is denied and never runs. Results recorded after execution use a context the client can't cancel, so a disconnect can't drop them.
• WithRequireAgentAuth(): refuses to start without an [[auth]] block, refuses auth_debug.skip_verify, rejects agent routes with no verified identity (401), ignores caller-supplied agent_id, and requires HTTPS issuer and JWKS URLs except on loopback.
• WithDatabaseURL(url) and Migrate: let an embedder supply the database and run migrations, and start with a role that lacks CREATE once the schema exists.
• Approval waits are read from the database rather than an in-process channel, and cancelling after an approval keeps the recorded approval.

docs/architecture.md and CHANGELOG.md are updated.

Why

Agent Authority (ValidMind's commercial control plane) embeds Atryum through pkg/atryum and needs to plug in its own decisions and append-only event record. The hooks are generic, so they live here.

Tests

go test ./... passes. New tests cover the decider on each path, deny on decider error and panic, transaction rollback when the hook fails, fail-closed when a decision can't be recorded, results surviving a client disconnect, cancel-after-approve, required agent auth, and the summarizer under a decider on the MCP proxy path. Each was checked to fail without its fix.

🤖 Generated with Claude Code

Rebased onto #168 (main 7518c28) — 15 October

• Conflicts kept both sides. In decider mode, Routes still returns early with the agent routes only, ahead of Nibz/claude/api keys #168's operator middleware. runServer keeps Nibz/claude/api keys #168's identity wiring next to SetAgentRoutesOnly and UseExternalDecider.
• New: WithAgentAPIKeys(enabled bool) (4e3d884). Nibz/claude/api keys #168 accepted atr_ agent API keys on the agent routes unconditionally.
  • Keys stay on by default for standalone Atryum and are now off by default under WithDecider, whose embedder keeps its own agent registry.
  • With keys off, an atr_ bearer gets 401 on /mcp/, /api/v1/invocations and /api/v1/external/*, even with no IdP configured, where an unknown bearer would otherwise be ignored.
  • Tests cover both modes, with and without an IdP, using a real issued key, plus the option's defaults.
• The commit AA pinned before the rebase stays fetchable as the tag aa/pin-e479127.