feat(openclaw-aport): add aport_check and aport_passport optional agent tools

[uchibeke]

Description

Adds two optional, opt-in agent tools to the extensions/openclaw-aport OpenClaw plugin:

aport_check

Lets the agent query whether a specific tool call is authorized by its OAP passport before executing it.

Usage: Opt-in via agents.list[].tools.allow: ["aport_check"]

Returns: { allowed: boolean, policy: string | null, reason: string }

Design: Reuses existing helpers mapToolToPolicy, verifyViaScript/verifyViaAPI, and verifyDecisionIntegrity from the existing hook. No logic duplication.

aport_passport

Lets the agent inspect its current passport or scaffold a new one.

Usage: Opt-in via agents.list[].tools.allow: ["aport_passport"]

Actions:

• read → returns passport_id, assurance_level, capabilities, status
• generate → creates a default passport.json at the configured path (no-op if already exists)

Type of Change

• New feature

Architecture notes

• Both tools registered with optional: true — never auto-enabled
• Existing before_tool_call hook is untouched (zero regression risk)
• All closure variables (mode, passportFile, guardrailScript, apiUrl, apiKey, etc.) captured from surrounding register() — same as hook
• DRY: no duplication of existing helper logic

Release workflow impact

@aporthq/openclaw-aport IS a workspace package (listed in root package.json workspaces). However, the release workflow (release.yml) only publishes root + core + langchain + crewai + cursor + claude-code packages via explicit -w flags. It does not publish @aporthq/openclaw-aport. The package is also NOT in the .changeset/config.json fixed version group. Therefore this version bump (1.0.10 → 1.1.0) has no impact on the release workflow.

Testing

• npx tsc --noEmit — zero errors
• npm test — all 30 tests pass (21 existing + 9 new)
• Tool registration verified with mocked API
• Gate 1 (EngineerBot): passed
• Gate 2 (SrEngineerBot architecture review): passed
• Gate 3 (SrEngineerBot QA 35/35): passed

Checklist

• Code follows project style guidelines (ESM, TypeScript strict, existing patterns)
• Self-review completed
• No new warnings generated
• Tests added/updated (9 new cases, 30 total)
• CHANGELOG.md updated
• Changeset created (.changeset/feat-openclaw-agent-tools.md)
• Version bumped: openclaw-aport 1.0.10 → 1.1.0

🤖 Generated with Claude Code