feat: add capability source policy metadata

src/wf_platform/__init__.py

@@ -20,6 +20,8 @@ if TYPE_CHECKING:
         SourceKind,
         SourcePermissions,
         SourcePermissionsSnapshot,
+        SourcePolicy,
+        SourcePolicySnapshot,
         SourceStatus,
         SourceVisibility,
         SourceVisibilitySnapshot,
@@ -37,6 +39,8 @@ _LAZY_EXPORTS = {
     "SourceKind": ".sources",
     "SourcePermissions": ".sources",
     "SourcePermissionsSnapshot": ".sources",
+    "SourcePolicy": ".sources",
+    "SourcePolicySnapshot": ".sources",
     "SourceStatus": ".sources",
     "SourceVisibility": ".sources",
     "SourceVisibilitySnapshot": ".sources",
@@ -57,6 +61,8 @@ __all__ = [
     "SourceKind",
     "SourcePermissions",
     "SourcePermissionsSnapshot",
+    "SourcePolicy",
+    "SourcePolicySnapshot",
     "SourceStatus",
     "SourceVisibility",
     "SourceVisibilitySnapshot",

src/wf_platform/sources.py

@@ -30,6 +30,18 @@ class SourcePermissions:
     mutates_auth: bool = False
 
 
+@dataclass(frozen=True, slots=True)
+class SourcePolicy:
+    """Runtime/deployment policy for one capability source.
+
+    Platform sources are process-provided built-ins such as `wf.std`. They are
+    not account-bound and should not require deployment source bindings.
+    """
+
+    platform: bool = False
+    binding_required: bool = True
+
+
 class SourceVisibilitySnapshot(BaseModel):
     """Serializable visibility flags for one source inventory snapshot."""
 
@@ -47,6 +59,13 @@ class SourcePermissionsSnapshot(BaseModel):
     mutates_auth: bool = False
 
 
+class SourcePolicySnapshot(BaseModel):
+    """Serializable source policy used by CLI/API inventory responses."""
+
+    platform: bool = False
+    binding_required: bool = True
+
+
 class NodeSpecInventory(BaseModel):
     """Serializable public contract for one executable node spec."""
 
@@ -108,6 +127,7 @@ class SourceStatus(BaseModel):
     enabled: bool
     visibility: SourceVisibilitySnapshot
     permissions: SourcePermissionsSnapshot
+    policy: SourcePolicySnapshot
     description: str | None = None
     tool_count: int
     node_spec_count: int
@@ -142,6 +162,7 @@ class CapabilitySource:
     enabled: bool = True
     visibility: SourceVisibility = field(default_factory=SourceVisibility)
     permissions: SourcePermissions = field(default_factory=SourcePermissions)
+    policy: SourcePolicy = field(default_factory=SourcePolicy)
     description: str | None = None
 
     def as_status(self) -> SourceStatus:
@@ -161,6 +182,10 @@ class CapabilitySource:
                 mutates_config=self.permissions.mutates_config,
                 mutates_auth=self.permissions.mutates_auth,
             ),
+            policy=SourcePolicySnapshot(
+                platform=self.policy.platform,
+                binding_required=self.policy.binding_required,
+            ),
             description=self.description,
             tool_count=len(self.capabilities.tools),
             node_spec_count=len(self.capabilities.node_specs),

tests/platform/test_sources.py

@@ -7,6 +7,7 @@ from wf_platform import (
     DocumentationResource,
     SourceInventory,
     SourcePermissions,
+    SourcePolicy,
     SourceStatus,
     SourceVisibility,
     build_documentation_source,
@@ -100,3 +101,20 @@ def test_documentation_source_owns_provider_neutral_resources() -> None:
     assert source.capabilities.prompts["wf.docs.operator_guide"].text == (
         "Read wf://docs/operator-manual first."
     )
+
+
+def test_capability_source_exposes_policy_snapshot() -> None:
+    source = CapabilitySource(
+        id="wf.std",
+        kind="system",
+        policy=SourcePolicy(platform=True, binding_required=False),
+    )
+
+    status = source.as_status()
+
+    assert status.policy.platform is True
+    assert status.policy.binding_required is False
+    assert status.model_dump(mode="json")["policy"] == {
+        "platform": True,
+        "binding_required": False,
+    }