Implement managed browser security, individual agents and observability

apps/server/policy-review.mjs

@@ -11,6 +11,7 @@ export function policyPublisher(app,store,config){
   store.db.exec(`CREATE TABLE IF NOT EXISTS policy_reviews(id TEXT PRIMARY KEY,time TEXT NOT NULL,author TEXT NOT NULL,expected_version INTEGER NOT NULL,payload_hash TEXT NOT NULL,policy TEXT NOT NULL,kind TEXT NOT NULL,operation TEXT NOT NULL,status TEXT NOT NULL,reviewer TEXT,reviewed_at TEXT,published_version INTEGER)`);
   function validate(policy,expected,operation={}){
     const p=PolicySchema.parse(policy);
+    if(p.evidence.enabled&&!config.evidenceKeyFile)throw Object.assign(Error('Protected evidence storage must be configured before collection is enabled'),{status:400});
     if(store.getRaw('policy').version!==expected||p.version!==expected+1)throw Object.assign(Error('Policy version conflict'),{status:409});
     if(!globalBookmarksValid(store,p))throw Object.assign(Error('Company bookmark IDs conflict with personal bookmarks'),{status:409});
     if(Date.parse(p.expiresAt)<=Date.now()||Date.parse(p.expiresAt)>Date.now()+30*86400000)throw Object.assign(Error('Policy expiry must be within the next 30 days'),{status:400});