feat(interceptors): §9.4 service interceptors — thin KV allow/deny slice

Smallest honest vertical slice of §9.4: a `[[interceptors]]` block (app OR
group) binds a script to run BEFORE `kv::set`/`delete`; it reads the operation
context (`ctx.request.body`: service, action, collection, key, value, caller
ids) and returns `#{ allowed, reason }` — `allowed == false` denies the op (the
write never runs, the caller gets a runtime error).

Reuses two existing mechanisms rather than inventing new ones:
- Registration mirrors extension points (§5.5): a marker table
  `0073_interceptors.sql` (owner-polymorphic app_id/group_id XOR, keyed
  (service, op) → script), `interceptor_repo` (insert/delete/list + the
  nearest-owner-wins `resolve_before` chain walk), reconciled through the
  declarative apply exactly like `vars` (create/update/delete, prunable).
- Execution reuses the `invoke()` re-entry path: the new `InterceptorService`
  (shared trait + Postgres-backed impl) only RESOLVES the script name (keeping
  executor-core Postgres-free); the executor's `sdk::interceptor::run_before`
  resolves that name and runs it via `run_resolved_blocking` (extracted from
  `invoke_blocking` — shared depth bound + AST cache). An un-hooked write pays
  one indexed `Ok(None)` resolve; no interceptor ⇒ zero overhead.

Nearest-owner-wins so an app overrides a group's interceptor, and a group
interceptor is inherited by every descendant app — the chain walk is the
isolation boundary (a sibling subtree never matches). `validate_bundle_for`
restricts the MVP to `service = "kv"`, `op ∈ {set, delete}`, one marker per
(service, op).

Deferred (documented in §9.4): the `data` transform return, services other
than kv, `after_*` hooks, chaining + circular-dependency guard, the timeout
policy, and a `pic interceptors ls` read surface (needs a server route).

Pinned by `tests/interceptors.rs` (deny blocks the write; allow passes;
group→app inheritance), schema snapshot re-blessed. 154/154 journeys pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/apply_service.rs

@@ -107,6 +107,21 @@ pub struct Bundle {
     /// `[group]` carrying workflows is rejected in `validate_bundle_for`.
     #[serde(default)]
     pub workflows: Vec<BundleWorkflow>,
+    /// §9.4 service interceptors: before-op allow/deny hooks. One entry per
+    /// `(service, op)` guarded, naming the interceptor script. App- OR
+    /// group-owned; resolved nearest-owner-wins on a descendant app's chain.
+    #[serde(default)]
+    pub interceptors: Vec<BundleInterceptor>,
+}
+
+/// One §9.4 interceptor marker on the wire: which `(service, op)` it guards and
+/// the interceptor script name. The CLI expands a manifest `[[interceptors]]`
+/// entry's `ops = [...]` into one of these per op.
+#[derive(Debug, Clone, Deserialize)]
+pub struct BundleInterceptor {
+    pub service: String,
+    pub op: String,
+    pub script: String,
 }
 
 /// One declared workflow on the wire: a name + its (already-parsed) DAG.
@@ -467,6 +482,10 @@ pub struct Plan {
     /// v1.2 Workflows: workflow definitions, keyed by name.
     #[serde(default)]
     pub workflows: Vec<ResourceChange>,
+    /// §9.4 interceptor markers, keyed `"{service}/{op}"` with the script as the
+    /// value (create/update/delete like `vars`).
+    #[serde(default)]
+    pub interceptors: Vec<ResourceChange>,
 }
 
 impl Plan {
@@ -483,6 +502,7 @@ impl Plan {
             .chain(&self.collections)
             .chain(&self.suppressions)
             .chain(&self.workflows)
+            .chain(&self.interceptors)
             .all(|c| c.op == Op::NoOp)
     }
 }
@@ -765,6 +785,9 @@ pub struct CurrentState {
     pub suppressions: Vec<(String, String)>,
     /// v1.2 Workflows owned directly by this node (app-owned; empty for a group).
     pub workflows: Vec<crate::workflow_repo::Workflow>,
+    /// §9.4 interceptor markers declared directly at this node, as
+    /// `(service, op, script)` triples.
+    pub interceptors: Vec<(String, String, String)>,
 }
 
 /// One row of the read-only extension-point report (§5.5).
@@ -1040,6 +1063,7 @@ impl ApplyService {
     /// `validate_bundle`, plus a group-node guard: a group owns only scripts +
     /// vars (+ declared secret names), so a `[group]` manifest carrying routes
     /// or triggers is a 422 — those are app concerns.
+    #[allow(clippy::too_many_lines)]
     fn validate_bundle_for(
         &self,
         is_group: bool,
@@ -1173,6 +1197,35 @@ impl ApplyService {
         for w in &bundle.workflows {
             validate_workflow_definition(&w.name, &w.definition).map_err(ApplyError::Invalid)?;
         }
+        // §9.4 interceptors (MVP): `service = "kv"`, `op ∈ {set, delete}`,
+        // authored on app OR group. One marker per `(service, op)` — a duplicate
+        // would collide on the reconcile key and the DB's partial-unique index.
+        let mut seen_hooks: HashSet<(String, String)> = HashSet::new();
+        for i in &bundle.interceptors {
+            if i.service != "kv" {
+                return Err(ApplyError::Invalid(format!(
+                    "interceptor service `{}` is not supported — only `kv` (MVP)",
+                    i.service
+                )));
+            }
+            if i.op != "set" && i.op != "delete" {
+                return Err(ApplyError::Invalid(format!(
+                    "interceptor op `{}` is not supported for kv — only `set` / `delete`",
+                    i.op
+                )));
+            }
+            if i.script.trim().is_empty() {
+                return Err(ApplyError::Invalid(
+                    "an interceptor must name a `script`".into(),
+                ));
+            }
+            if !seen_hooks.insert((i.service.clone(), i.op.clone())) {
+                return Err(ApplyError::Invalid(format!(
+                    "duplicate interceptor for `{}/{}`",
+                    i.service, i.op
+                )));
+            }
+        }
         self.validate_bundle(bundle, inherited_endpoints)
     }
 
@@ -1450,6 +1503,35 @@ impl ApplyService {
             }
         }
 
+        // 3c.5. §9.4 interceptor markers — upsert each Create/Update by
+        // `(service, op)`. A changed script is an in-place Update; deletes happen
+        // in prune.
+        for ch in &plan.interceptors {
+            if ch.op == Op::Create || ch.op == Op::Update {
+                let bi = bundle
+                    .interceptors
+                    .iter()
+                    .find(|i| format!("{}/{}", i.service, i.op) == ch.key)
+                    .ok_or_else(|| {
+                        ApplyError::Backend("internal: interceptor plan/bundle mismatch".into())
+                    })?;
+                crate::interceptor_repo::insert_interceptor_tx(
+                    &mut *tx,
+                    owner.as_script_owner(),
+                    &bi.service,
+                    &bi.op,
+                    &bi.script,
+                )
+                .await
+                .map_err(|e| ApplyError::Backend(e.to_string()))?;
+                if ch.op == Op::Create {
+                    report.interceptors_created += 1;
+                } else {
+                    report.interceptors_updated += 1;
+                }
+            }
+        }
+
         // 3d. Shared group-collection markers (§11.6) — insert each Create
         // (idempotent). Name-only identity; deletes happen in prune. Pruning a
         // marker hides the store but does NOT drop its `group_kv_entries` data
@@ -1580,6 +1662,24 @@ impl ApplyService {
                 }
             }
 
+            // §9.4 interceptor markers are prunable config too. The delete keys
+            // by `(service, op)` (the marker's identity), so a script-change
+            // Update above is never clobbered here.
+            for ch in &plan.interceptors {
+                if ch.op == Op::Delete {
+                    let (service, op) = ch.key.split_once('/').unwrap_or((ch.key.as_str(), ""));
+                    crate::interceptor_repo::delete_interceptor_tx(
+                        &mut *tx,
+                        owner.as_script_owner(),
+                        service,
+                        op,
+                    )
+                    .await
+                    .map_err(|e| ApplyError::Backend(e.to_string()))?;
+                    report.interceptors_deleted += 1;
+                }
+            }
+
             // Shared group-collection markers are prunable config too (§11.6).
             // Only the marker is removed here — the data survives until the
             // owning group is deleted.
@@ -4048,6 +4148,14 @@ impl ApplyService {
             }
             ApplyOwner::Group(_) => Vec::new(),
         };
+        // §9.4 interceptor markers declared directly at this node.
+        let interceptors =
+            crate::interceptor_repo::list_for_owner(&self.pool, owner.as_script_owner())
+                .await
+                .map_err(|e| ApplyError::Backend(e.to_string()))?
+                .into_iter()
+                .map(|m| (m.service, m.op, m.script))
+                .collect();
         Ok(CurrentState {
             scripts,
             routes,
@@ -4058,6 +4166,7 @@ impl ApplyService {
             collections,
             suppressions,
             workflows,
+            interceptors,
         })
     }
 
@@ -4124,9 +4233,58 @@ fn compute_diff_with_names(
         collections: diff_collections(current, bundle),
         suppressions: diff_suppressions(current, bundle),
         workflows: diff_workflows(current, bundle),
+        interceptors: diff_interceptors(current, bundle),
     }
 }
 
+/// Diff §9.4 interceptor markers by `"{service}/{op}"` key with the script name
+/// as the value — create/update/noop/delete like `vars`. A changed script for
+/// the same `(service, op)` is an `Update`; a live marker the manifest stops
+/// declaring is a `Delete` (applied only under `--prune`).
+fn diff_interceptors(current: &CurrentState, bundle: &Bundle) -> Vec<ResourceChange> {
+    let key = |service: &str, op: &str| format!("{service}/{op}");
+    let live: HashMap<String, &str> = current
+        .interceptors
+        .iter()
+        .map(|(s, o, script)| (key(s, o), script.as_str()))
+        .collect();
+    let mut out = Vec::new();
+    for bi in &bundle.interceptors {
+        let k = key(&bi.service, &bi.op);
+        match live.get(&k) {
+            Some(cur) if *cur == bi.script => out.push(ResourceChange {
+                op: Op::NoOp,
+                key: k,
+                detail: None,
+            }),
+            Some(_) => out.push(ResourceChange {
+                op: Op::Update,
+                key: k,
+                detail: Some("interceptor script changed".into()),
+            }),
+            None => out.push(ResourceChange {
+                op: Op::Create,
+                key: k,
+                detail: Some(bi.script.clone()),
+            }),
+        }
+    }
+    for (s, o, _) in &current.interceptors {
+        let present = bundle
+            .interceptors
+            .iter()
+            .any(|bi| bi.service == *s && bi.op == *o);
+        if !present {
+            out.push(ResourceChange {
+                op: Op::Delete,
+                key: key(s, o),
+                detail: Some("on server, not declared".into()),
+            });
+        }
+    }
+    out
+}
+
 /// Diff workflows by `lower(name)`. Like scripts, a workflow has a stable name
 /// identity with a mutable body, so a changed definition (or `enabled`) is an
 /// `Update`, not a delete+create. Live workflows absent from the manifest are
@@ -5472,6 +5630,12 @@ pub struct ApplyReport {
     pub workflows_updated: u32,
     #[serde(default)]
     pub workflows_deleted: u32,
+    #[serde(default)]
+    pub interceptors_created: u32,
+    #[serde(default)]
+    pub interceptors_updated: u32,
+    #[serde(default)]
+    pub interceptors_deleted: u32,
     #[serde(skip_serializing_if = "Vec::is_empty")]
     pub warnings: Vec<String>,
 }
@@ -5816,6 +5980,7 @@ mod tests {
             suppress_triggers: Vec::new(),
             suppress_routes: Vec::new(),
             workflows: Vec::new(),
+            interceptors: Vec::new(),
         };
         let plan = compute_diff(&current, &bundle);
         assert_eq!(plan.scripts.len(), 1);
@@ -5843,6 +6008,7 @@ mod tests {
             suppress_triggers: Vec::new(),
             suppress_routes: Vec::new(),
             workflows: Vec::new(),
+            interceptors: Vec::new(),
         };
         let plan = compute_diff(&current, &bundle);
         assert!(plan.is_noop(), "expected all no-op, got {plan:?}");
@@ -5865,6 +6031,7 @@ mod tests {
             suppress_triggers: Vec::new(),
             suppress_routes: Vec::new(),
             workflows: Vec::new(),
+            interceptors: Vec::new(),
         };
         let plan = compute_diff(&current, &bundle);
         assert_eq!(plan.scripts[0].op, Op::Update);
@@ -5888,6 +6055,7 @@ mod tests {
             suppress_triggers: Vec::new(),
             suppress_routes: Vec::new(),
             workflows: Vec::new(),
+            interceptors: Vec::new(),
         };
         let plan = compute_diff(&current, &bundle);
         assert_eq!(plan.scripts[0].op, Op::Delete);
@@ -5942,6 +6110,7 @@ mod tests {
             suppress_triggers: Vec::new(),
             suppress_routes: Vec::new(),
             workflows: Vec::new(),
+            interceptors: Vec::new(),
         };
         let plan = compute_diff(&current, &bundle);
         assert_eq!(plan.routes[0].op, Op::Update);
@@ -5959,6 +6128,7 @@ mod tests {
             suppress_triggers: Vec::new(),
             suppress_routes: Vec::new(),
             workflows: Vec::new(),
+            interceptors: Vec::new(),
         }
     }