fix(agents): enforce target input-guardrail parity across handoffs

[CompleteDotTech]

Context

• Summary: Runner::run_loop evaluated input guardrails once, for the starting agent only. A handoff target's input guardrails never ran, so an agent reached through a model handoff could consume input that direct entry to it would reject. This PR extracts the input-guardrail evaluation into one shared path, Runner::check_input_guardrails, and runs it at every agent boundary: for the starting agent before its first model turn (unchanged), and for every handoff target after the Handoff item/event is recorded and before the target's first model turn or tool execution.
• Files changed: crates/coven-agents/src/runner.rs (shared ingress helper + handoff boundary check), crates/coven-agents/src/guardrail.rs (trait docs), crates/coven-agents/tests/runner.rs (7 focused characterization/regression tests), docs/superpowers/specs/2026-08-14-coven-agents-rust-design.md (runner loop description).
• Refs P0: enforce target input-guardrail parity across coven-agents handoffs OpenCoven/coven#803

Vehicle note: opened in the fork CompleteDotTech/coven as the CI vehicle — this token cannot write to OpenCoven/coven. Re-target upstream once write access is restored. Refs OpenCoven#803.

Issue

Refs OpenCoven#803 — P0: enforce target input-guardrail parity across coven-agents handoffs.

Implementation

• Approach: one named helper, Runner::check_input_guardrails, is the single ingress path shared by direct-start and handoff semantics. In the handoff branch it runs after the RunItem::Handoff / RunEvent::Handoff are recorded (the handoff genuinely happened and stays in the failure transcript) and before continue, so the target's policy is enforced before the target's first ModelRequest.
• Compatibility contract (precise): a handoff target's input guardrails are evaluated against the original/root user input — the exact same bounded string a direct Runner::run(target, input, …) would check. No serialized transcript, no session history, and no intermediate assistant/tool output is evaluated by the target's ingress policy. The structured task/context manifest for delegated invocations is the successor contract tracked in P1: refactor coven-agents onto invocation/delegation contracts without a second distributed runtime OpenCoven/coven#804; this patch is intentionally not complete A2A security.
• Event semantics: GuardrailChecked is emitted per target guardrail with the target identity and GuardrailStage::Input; each run still emits exactly one terminal RunCompleted/RunFailed. A target policy rejection reports RunError::GuardrailRejected { agent: target, stage: Input }; a guardrail implementation error reports RunError::GuardrailFailed — the two remain distinguishable.
• Security invariants: a rejected target receives no model call and executes no tool side effect; tools, authority, project scope, context, and session persistence are unchanged; handoff remains mutually exclusive with tool actions; fail-fast topology validation is untouched.
• User-visible behavior: the only visible change is the intentional closure of the bypass — a handoff into a target that rejects the root input now fails with RunFailureKind::InputGuardrail at the boundary, returning the partial transcript (UserMessage, source items, Handoff) to the caller. Existing fail-fast limits, session load/append semantics, and output-guardrail behavior are unchanged.

Verification

• python scripts/check-secrets.py — ran locally, passed
• python3 scripts/check-coven-privacy.py --staged — ran locally, passed
• rustfmt --edition 2021 --check on touched files — ran locally with a standalone rustfmt binary (workspace has no Rust toolchain); full cargo fmt --check deferred to CI
• cargo clippy --workspace --all-targets -- -D warnings — deferred to CI (no Rust toolchain locally)
• cargo test -p coven-agents — deferred to CI (no Rust toolchain locally)
• cargo test --workspace --locked — deferred to CI (no Rust toolchain locally)
• Additional manual checks: new focused tests in crates/coven-agents/tests/runner.rs make the security property visible from test output: handoff_target_enforces_the_same_input_policy_as_direct_entry (direct-vs-handoff parity, no model call / no tool execution for the rejected target), handoff_target_input_guardrail_runs_before_the_target_model_turn (event ordering + the exact evaluated input), multi_hop_handoff_enforces_input_policy_at_every_boundary (A→B→C per-boundary checks), multi_hop_handoff_target_rejection_prevents_the_target_model_turn (rejection at hop C), handoff_target_guardrail_error_is_distinguishable_from_a_rejection + failing_input_guardrail_is_distinguishable_from_a_rejection (GuardrailFailed vs GuardrailRejected), handoff_cannot_be_combined_with_tool_calls (exclusivity). Characterization-first: commit 1 lands the regression tests encoding the corrected expectation (direct-B rejection vs the current handoff-B bypass), commit 2 closes the bypass.

Risk and Rollback

• Risk level: low-medium — a security tightening of one runner branch. Direct-start behavior is code-motion identical; no existing test encodes the bypass; limits, session, and output-guardrail paths are untouched.
• Rollback plan: revert the fix commit (fix(agents): enforce target input-guardrail parity across handoffs); the characterization commit is additive.

Agent Handoff

• Current state: 2 commits, conventional-commit subjects, DCO Signed-off-by on both; opened as a draft until CI is green.
• Follow-ups: bounded task/context manifest and policy over that bounded ingress for delegated invocations (P1: refactor coven-agents onto invocation/delegation contracts without a second distributed runtime OpenCoven/coven#804).
• Known gaps: target ingress evaluates only the root user input (by design — see the compatibility contract above); output guardrails on intermediate agents still do not run (unchanged MVP behavior).

CI status note (no CI exists on this vehicle): GitHub Actions is enabled on CompleteDotTech/coven, but the repository has zero workflow runs (actions/runs.total_count = 0, check-runs.total_count = 0 for the head SHA), no registered workflows, and a close/reopen re-dispatch produced no checks — this fork cannot run the repo's CI. The Rust checks (cargo fmt --check, cargo clippy --workspace --all-targets -- -D warnings, cargo test -p coven-agents, cargo test --workspace --locked) are therefore not verified by CI on this vehicle and must run on an upstream PR once write access to OpenCoven/coven is restored. Local verification performed: rustfmt --edition 2021 --check on all touched files, python scripts/check-secrets.py (passed), python3 scripts/check-coven-privacy.py --staged (passed).