kairos-chain 3.46.0 → 3.49.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 372dd921a298d45c97b957ae724a253bb22da73b5bb211025fe894eab5de4ff7
-  data.tar.gz: f15e37a2caeef2d4d08b92f49608aa52307b1a93124a1742d3f40c10ae145bf8
+  metadata.gz: 69d783a71fb5c56c3b7bfc549695f337ad9099d2db5beaf0ae557b845f854a2f
+  data.tar.gz: 3f858ee398aa3ecbe24c664e5618653ab1bfd38f6a5a01c6779270cefc4d7e68
 SHA512:
-  metadata.gz: c9fc60d9acee8dcb8b7a2bfb43021d3c8b129cb94471fe8488092683ade4755665faa72860fb8c1bed77d254e977226c3d8cd85bec4dfe95eea2d0dc12352190
-  data.tar.gz: e5769c4b23ce1daef9704423f41e097d8969f5b86442ab1592beab4e3dc7623a3a79e30aba51d7ca2d5621e55fd635db740b5489761995bc2b9b33de8eb0b80e
+  metadata.gz: 16e67612af99d2dc86f85d9d128a3e5906f07f72677f7a8ff547685b9106e1c62b3dea2161ce776fcd68819676f7b665b8b8a9e127a2e69c6cc33831685aab60
+  data.tar.gz: b202b151145f3bb7c1f1383450129d8b3455f0eeb3d9fa7716b3dea173d9c3eb06a56d3fa90b3236b0e8585cb88a3e2276707512e8cd06c833f64efd6ad7915a

data/CHANGELOG.md

@@ -4,6 +4,118 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.49.0] - 2026-07-22
+
+### ZK aggregate reproducibility spike (AUD-L4, Phases 1+2) — KairosChain's first genuine zero-knowledge proof
+
+Additive demonstrator in the `synoptis` SkillSet (candidate convention id
+`sda-1` if later promoted). Proves, over a public DOI set, that an auditor's
+published aggregate (mean reproducibility) is honestly computed from
+per-item scores that stay secret — with each hidden score proven in-range
+via a genuine zero-knowledge proof. Pure-Ruby secp256k1; no trusted setup;
+no new runtime dependency (OpenSSL is a test-only oracle).
+
+- Phase 1 — `ec_group.rb` (hand-rolled prime-order secp256k1, NUMS second
+  generator H), `pedersen.rb` (perfectly-hiding commitments, additive
+  homomorphism, aggregate opening + Σr-hiding Schnorr proof),
+  `aggregate_disclosure.rb` (SDP-2 dual-commitment score binding to rpr-1
+  endorsements, DOI-set commitment, mean verification).
+- Phase 2 — `range_proof.rb` (`Synoptis::Anchoring::RangeProof`):
+  bit-decomposition range proof for s ∈ [0, 7] (3-bit band). Per-bit
+  Cramer-Damgård-Schoenmakers '94 Schnorr OR proofs (b ∈ {0,1}) plus the
+  reconstruction invariant Σ 2^j·B_j = C; Fiat-Shamir (SHA-256) with
+  metadata- and index-bound transcripts. Fail-closed verifier admission
+  (closed schema, type-strict vmax/bits, point/scalar canonicality,
+  identity rejection) closes range-escape and encoding-malleability.
+- CLI: `sda_verify.rb` gains `commit`, `aggregate-verify`,
+  `aggregate-schnorr`, `binding`, `doi-set`, `range-verify`,
+  `full-audit-verify` (C1 coverage + C3 aggregate + C4 range in one pass).
+- Tests: 93 new (52 Phase 1 + 41 Phase 2) incl. the mandatory forgery
+  negatives (an out-of-range 32000 score cannot yield an accepting proof);
+  scalar-mul cross-validated against OpenSSL. Existing suites unchanged
+  (507 total green).
+- Design memos under `docs/drafts/`; design and implementation each
+  converged through philosophy-briefed multi-LLM review (impl round 2:
+  6/6 APPROVE).
+
+## [3.48.0] - 2026-07-22
+
+### Confidentiality Guard SkillSet — slice 1 (CG-1..CG-6)
+
+New `confidentiality_guard` SkillSet implementing design v0.3 (FROZEN,
+review-converged). A fail-closed, selectable-off data-confidentiality regime
+for enterprise environments. Slice 1 covers inward (L2/L1 write) and
+restricted-storage-read surfaces; outward crossings and unmapped
+resource-scheme reads are denied wholesale under the CG-1 coverage clause.
+
+- `lib/confidentiality_guard/regime.rb`: regime lifecycle + tool-surface
+  interception via a `ToolRegistry` gate (verdict precedes effect, CG-2).
+  Activation is environment-level (`KAIROS_CONFIDENTIALITY_GUARD` env >
+  config), read at load time via the skillset `activation_hook` (independent
+  of tool instantiation) with an eager `cg_status` belt-and-suspenders call;
+  policy pinned at activation; activation AND cessation recorded; gate
+  registered only after the regime is active (no fail-open window).
+- `policy.rb`: pinned, content-addressed policy profile; `File.realpath`-
+  matching path resolution (symlink- and `..`-safe, parity with the
+  external-tools readers). `surfaces.rb`: crossing classification with a
+  release-gated enrollment manifest. `verdict.rb`: deterministic LLM-free
+  conjunctive verdict (designation closed-world + content detection),
+  versioned verdict basis. `recorder.rb`: constitutive chain records bound
+  by salted commitments (sdp-1-aligned), never containing content; read
+  records carry the designation id, not the raw path. `canon.rb`: shared
+  canonical serialization faithful to false/nil and mixed string/symbol keys.
+- `tools/cg_status.rb`: read-only regime-state tool (CG-1).
+- 67 design-constraint + regression tests (`test/test_cg_guard.rb`).
+
+Core (minimal, guard-enabling): `tool_registry.rb` adds `FailClosedError`
+(re-raised by the loader, never swallowed), per-skillset isolated loading,
+and fail-closed `activation_hook` invocation; `skillset.rb` adds the
+`activation_hook` accessor. Impl review: 3 rounds with executable-probe
+personas; every deployment-grounded finding (enabled-but-unguarded start,
+copy source-read bypass, path-resolution parity, symlink+`..` bypass, loader
+fail-closed) resolved.
+
+## [3.47.0] - 2026-07-22
+
+### Synoptis — selective disclosure sdp-1 (AUD-L4 slice 1)
+
+Implements AUD-L4 design v0.3 (SDP-1..5, FROZEN, review-converged) slice 1
+in the synoptis SkillSet. All additive: sdp-1 builds on khab-1/map-1/rpr-1
+exactly as each prior slice built on its predecessors; no pre-existing file
+changed.
+
+- `conventions/sdp-1.md`: content-addressed selective-disclosure convention —
+  hash-based salted field-level disclosure (content-blinding: field values
+  hidden, record digest / field names / count public; the ZK membership
+  family is disclosed as out of scope for a later convention). Field
+  commitments (one salted digest per field, total coverage, `sdp-1/field`
+  domain separation), convention-determined disclosure profile (closed
+  schema; predicate + opened set + currency, `format` always opened),
+  presentation (closed schema per shape), three predicates
+  (typed-existence / claimed-verdict / conforming-verdict with foreignness,
+  anterior-tolerance assessment, and sibling-aware tolerance-target
+  coherence inside the checked predicate), extent-bounded currency scan
+  (issuer rule, residues disclosed unconditionally), computational
+  hiding/soundness base stated (no trusted setup).
+- `selective_disclosure.rb`: build/parse/verify for field commitments,
+  profile, presentation (refuse-not-coerce, canonical-serialization
+  equality everywhere); signature verification from the record DIGEST alone
+  via the unchanged map-1 §1.1 attestation signature — blinded verdicts
+  without record content; conforming-verdict refuses (never degrades) when
+  operator credential or rpr-1 §2.1 assessment material is missing;
+  currency scan with unestablished-vs-unretracted discipline.
+- `bin/sdp_verify.rb`: offline verifier (commit / binding / presentation /
+  profile / currency / convention), exit-code discipline (0/1/2), strict
+  intake (delete_suffix, canonical numerals).
+- `test/test_sdp_disclosure.rb`: 61 design-constraint assertions
+  (SDP-1..5), including crafted-record shape refusal, verdict-vocabulary
+  closure, sibling-target coherence (rpr-1 §2.1 pooling agreement),
+  hiding of withheld values across artifacts and error paths, and
+  khab/map/rpr non-interference (37/75/76/88 regression green).
+
+Implementation review: 3 rounds, R3 4/6 APPROVE + executable-probe
+personas 2/2, zero remaining P0/P1 (dispositions in docs/drafts/).
+
 ## [3.46.0] - 2026-07-22
 
 ### Synoptis — reproduction endorsement rpr-1 (AUD-L3 slice 1)

data/lib/kairos_mcp/skillset.rb

@@ -87,6 +87,16 @@ module KairosMcp
       @metadata['config_files'] || []
     end
 
+    # Optional fail-closed activation hook: a fully-qualified class name
+    # whose `activate_on_load!` runs at skillset-load time, independent of
+    # whether any of the SkillSet's tools are instantiated. Used by
+    # fail-closed regimes (confidentiality_guard) so an enabled guard
+    # registers its enforcement even if no tool is ever constructed.
+    def activation_hook
+      name = @metadata['activation_hook']
+      name.is_a?(String) && !name.empty? ? name : nil
+    end
+
     def knowledge_dir_names
       @metadata['knowledge_dirs'] || []
     end

data/lib/kairos_mcp/tool_registry.rb

@@ -5,6 +5,12 @@ require_relative 'lifecycle_hook'
 
 module KairosMcp
   class ToolRegistry
+    # Raised by SkillSets whose activation must never be swallowed
+    # (fail-closed regimes, e.g. confidentiality_guard): the loader
+    # re-raises instead of degrading to a warn, so an enabled regime can
+    # never be silently skipped and leave the server unguarded.
+    class FailClosedError < StandardError; end
+
     # Authorization denial raised by registered gates
     class GateDeniedError < StandardError
       attr_reader :tool_name, :role
@@ -273,17 +279,44 @@ module KairosMcp
 
       manager = SkillSetManager.new
       manager.enabled_skillsets.each do |skillset|
-        skillset.load!
-        skillset.tool_class_names.each do |cls|
-          # Phase 1.5: thread source attribution for capability_status manifest
-          register_if_defined(cls, source: "skillset:#{skillset.name}")
-        end
-        # 24/7 v0.4 §2.3 — register lifecycle hooks declared by this SkillSet.
-        skillset.lifecycle_hooks.each do |hook_name, class_name|
-          register_lifecycle_hook(hook_name, class_name, skillset_name: skillset.name)
+        # Per-skillset isolation: one failing SkillSet must not abort the
+        # loop and silently skip later ones (a fail-closed regime loaded
+        # later would otherwise never register its gate).
+        begin
+          skillset.load!
+          # Fail-closed activation hook (before tool registration): a
+          # regime that ships enabled must register its enforcement at load
+          # time, not as a side effect of some tool being instantiated.
+          # ANY failure to resolve or run the hook is fail-closed: a
+          # missing/typo'd hook constant must not degrade to a warn and
+          # leave an enabled regime unguarded.
+          if (hook = skillset.activation_hook)
+            begin
+              LifecycleHook.validate_class_name!(hook)
+              Object.const_get(hook).activate_on_load!(registry_class: self.class)
+            rescue FailClosedError
+              raise
+            rescue StandardError => e
+              raise FailClosedError,
+                    "activation_hook '#{hook}' (skillset '#{skillset.name}') failed to activate: " \
+                    "#{e.class}: #{e.message}"
+            end
+          end
+          skillset.tool_class_names.each do |cls|
+            # Phase 1.5: thread source attribution for capability_status manifest
+            register_if_defined(cls, source: "skillset:#{skillset.name}")
+          end
+          # 24/7 v0.4 §2.3 — register lifecycle hooks declared by this SkillSet.
+          skillset.lifecycle_hooks.each do |hook_name, class_name|
+            register_lifecycle_hook(hook_name, class_name, skillset_name: skillset.name)
+          end
+        rescue LifecycleHook::Conflict, FailClosedError
+          raise  # never swallow — integrity/fail-closed regimes depend on detection
+        rescue StandardError => e
+          warn "[ToolRegistry] Failed to load SkillSet '#{skillset.name}': #{e.message}"
         end
       end
-    rescue LifecycleHook::Conflict
+    rescue LifecycleHook::Conflict, FailClosedError
       raise  # never swallow — Bootstrap integrity depends on detection
     rescue StandardError => e
       warn "[ToolRegistry] Failed to load SkillSet tools: #{e.message}"

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.46.0"
+  VERSION = "3.49.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/skillsets/confidentiality_guard/config/confidentiality_guard.yml

@@ -0,0 +1,18 @@
+# Confidentiality Guard SkillSet configuration (CG-1).
+#
+# The regime ships selectable-off. Flipping `enabled: true` activates the
+# fail-closed confidentiality regime as a whole at the next instance start —
+# there is no per-surface toggle (design v0.3, CG-1).
+#
+# Activation precedence (mechanism choice recorded here, invariant in CG-1):
+#   1. Environment variable KAIROS_CONFIDENTIALITY_GUARD ("1" forces on,
+#      "0" forces off) — highest precedence, environment-level act.
+#   2. This file's guard.enabled.
+# Both are read at instance start, outside the deciding model's reach.
+guard:
+  enabled: false
+  # Path to the enforced policy profile, relative to this config directory.
+  # The profile is pinned (content-addressed) at activation; edits to the
+  # file are inert until a subsequent activation-level act adopts them
+  # (CG-1), and edits made through instance tools are recorded (CG-4).
+  profile: profile.yml

data/templates/skillsets/confidentiality_guard/config/profile.example.yml

@@ -0,0 +1,34 @@
+# Confidentiality Guard policy profile — EXAMPLE (copy to profile.yml and edit).
+#
+# The profile is data, not code (design v0.3 §4). Its designations span the
+# guarded crossing classes; a class left undesignated is wholly denied
+# (CG-1 fail-closed). Activation with no profile file at all is total denial.
+#
+# All patterns must be valid Ruby regexes; an invalid pattern aborts
+# activation (fail-closed: the regime never runs on a policy it cannot pin).
+version: 1
+
+# Persistent-layer admissions (inward writes). Absent layer => denied.
+persistent_admissions:
+  l2: permitted
+  l1: denied
+
+# Restricted storage designations. Reads of designated roots are guarded
+# crossings: recorded when permitted (CG-4), denied otherwise. Paths are
+# resolved relative to the process working directory unless absolute.
+restricted_storage:
+  - id: chain_store
+    path: .kairos/storage
+    reads: denied
+
+# Content classes. A detection on a designated crossing denies the call
+# (transform-and-pass is a Slice 2 opt-in; any `consequence` other than
+# `deny` is unenforced in Slice 1 and therefore denies — CG-1 coverage).
+# Note: detection runs over the canonical JSON of the call's arguments, so
+# a key/value pair like {api_key: "..."} presents as "api_key":"..." — the
+# pattern therefore tolerates quotes between the name and the separator.
+content_classes:
+  - id: api_key
+    pattern: '(?i)\b(api[_-]?key|secret[_-]?key|access[_-]?token)\b["'']?\s*[:=]'
+  - id: private_key_block
+    pattern: '-----BEGIN [A-Z ]*PRIVATE KEY-----'

data/templates/skillsets/confidentiality_guard/lib/confidentiality_guard/canon.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require 'json'
+
+module KairosMcp
+  module SkillSets
+    module ConfidentialityGuard
+      # Shared canonical serialization for policy pinning (CG-1/CG-3) and
+      # content presentation/commitment (CG-3/CG-4). One encoder for both
+      # so the pinned-policy hash and the content commitment can never
+      # drift apart.
+      #
+      # Faithfulness rules (impl review R1):
+      # - false and nil are preserved distinctly (no truthiness fallback).
+      # - Hash keys are stringified; when a hash carries BOTH string and
+      #   symbol forms of one name, BOTH entries are emitted (sorted by
+      #   stringified key, original order as tiebreak) — dropping either
+      #   would be a detection miss on a security guard. The output is a
+      #   deterministic function of the presented object.
+      module Canon
+        module_function
+
+        def canonical(obj)
+          case obj
+          when Hash
+            entries = obj.map.with_index { |(k, v), i| [k.to_s, i, v] }
+            entries.sort_by! { |key, i, _| [key, i] }
+            "{#{entries.map { |key, _, v| "#{key.to_json}:#{canonical(v)}" }.join(',')}}"
+          when Array
+            "[#{obj.map { |v| canonical(v) }.join(',')}]"
+          else
+            obj.to_json
+          end
+        end
+
+        # Deep string-keyed copy for classification (path extraction must
+        # not depend on the caller's key form). Later entries win on
+        # collision, matching Ruby hash assignment semantics.
+        def stringify(obj)
+          case obj
+          when Hash
+            obj.each_with_object({}) { |(k, v), acc| acc[k.to_s] = stringify(v) }
+          when Array
+            obj.map { |v| stringify(v) }
+          else
+            obj
+          end
+        end
+      end
+    end
+  end
+end

data/templates/skillsets/confidentiality_guard/lib/confidentiality_guard/policy.rb

@@ -0,0 +1,144 @@
+# frozen_string_literal: true
+
+require 'yaml'
+require 'json'
+require 'digest'
+require_relative 'canon'
+
+module KairosMcp
+  module SkillSets
+    module ConfidentialityGuard
+      # Pinned policy profile (design v0.3 §4, CG-1/CG-3).
+      #
+      # The profile is loaded once at activation and pinned by content hash;
+      # subsequent edits to the file are invisible to the running regime.
+      # A missing profile yields the empty policy: every designation absent,
+      # therefore total denial (CG-1 fail-closed, §4 zero-profile case).
+      class Policy
+        class ActivationError < StandardError; end
+
+        # Detection-machinery version, part of the versioned verdict basis
+        # (CG-3). Bump when the detection semantics below change.
+        ENGINE_VERSION = 'cg-1/1'
+
+        attr_reader :sha256, :profile_path
+
+        def self.load(profile_path)
+          raw = if profile_path && File.file?(profile_path)
+                  YAML.safe_load(File.read(profile_path)) || {}
+                else
+                  {}
+                end
+          raise ActivationError, 'profile must be a YAML mapping' unless raw.is_a?(Hash)
+          new(raw, profile_path: profile_path)
+        rescue Psych::Exception => e
+          raise ActivationError, "profile unparseable: #{e.message}"
+        end
+
+        def initialize(data, profile_path: nil)
+          @data = data
+          @profile_path = profile_path
+          @sha256 = Digest::SHA256.hexdigest(Canon.canonical(data))
+          @content_classes = compile_content_classes(data['content_classes'])
+          @restricted = normalize_restricted(data['restricted_storage'])
+        end
+
+        def empty?
+          @data.empty?
+        end
+
+        # 'permitted' / 'denied' / nil (absent designation => denial, CG-1)
+        def persistent_admission(layer)
+          value = @data.dig('persistent_admissions', layer.to_s)
+          value.is_a?(String) ? value : nil
+        end
+
+        # Returns the matching restricted-storage designation for a path,
+        # or nil when the path is not designated (an undesignated read is
+        # not a guarded crossing — design v0.3 §1 scope (c)).
+        def restricted_entry(path)
+          return nil unless path.is_a?(String) && !path.empty?
+          resolved = Policy.resolve(path)
+          @restricted.find { |entry| under_root?(resolved, entry[:root]) }
+        end
+
+        # True when `path` is the root itself or lives beneath it. Uses a
+        # separator-normalized prefix so a root of "/" (whose separator
+        # tail would be "//") still matches its children.
+        def under_root?(path, root)
+          return true if path == root
+          prefix = root.end_with?(File::SEPARATOR) ? root : "#{root}#{File::SEPARATOR}"
+          path.start_with?(prefix)
+        end
+
+        # Path normalization that matches the read tools' File.realpath
+        # semantics (impl review R1/R3). Crucially it does NOT lexically
+        # collapse ".." via File.expand_path first — that would discard a
+        # symlink component and diverge from what the tool actually reads
+        # (e.g. "link/../data" where link -> /root/sub must resolve through
+        # the filesystem, not lexically to the parent of link). The full
+        # path is realpath'd when it exists; otherwise the deepest existing
+        # prefix is realpath'd (walking the raw path, ".." included) and the
+        # non-existing tail is appended.
+        def self.resolve(path)
+          candidate = path.to_s
+          candidate = File.join(Dir.pwd, candidate) unless candidate.start_with?(File::SEPARATOR)
+          return File.realpath(candidate) if File.exist?(candidate)
+
+          tail = []
+          current = candidate
+          loop do
+            parent = File.dirname(current)
+            tail.unshift(File.basename(current))
+            current = parent
+            break if current == File.dirname(current) # reached the fs root
+            return File.join(File.realpath(current), *tail) if File.exist?(current)
+          end
+          # Nothing along the path exists: best-effort lexical form.
+          File.expand_path(candidate)
+        rescue ArgumentError
+          # Malformed path (e.g. NUL byte): re-raise so the caller's
+          # resolve_target turns it into an unextractable denial rather
+          # than a crash.
+          raise
+        end
+
+        # First content-class detection hit on the presented content, or nil.
+        # Deterministic: classes are evaluated in profile order (CG-3).
+        def content_class_hit(content)
+          return nil unless content.is_a?(String)
+          @content_classes.find { |klass| klass[:regexp].match?(content) }
+        end
+
+        private
+
+        def compile_content_classes(classes)
+          Array(classes).map do |klass|
+            raise ActivationError, 'content_classes entries must be mappings' unless klass.is_a?(Hash)
+            id = klass['id'].to_s
+            pattern = klass['pattern']
+            raise ActivationError, "content class #{id.inspect} missing id or pattern" if id.empty? || !pattern.is_a?(String)
+            begin
+              { id: id, regexp: Regexp.new(pattern) }
+            rescue RegexpError => e
+              raise ActivationError, "content class #{id.inspect} has invalid pattern: #{e.message}"
+            end
+          end
+        end
+
+        def normalize_restricted(entries)
+          Array(entries).map do |entry|
+            raise ActivationError, 'restricted_storage entries must be mappings' unless entry.is_a?(Hash)
+            path = entry['path']
+            raise ActivationError, 'restricted_storage entry missing path' unless path.is_a?(String) && !path.empty?
+            {
+              id: (entry['id'] || path).to_s,
+              root: Policy.resolve(path),
+              reads: entry['reads'].is_a?(String) ? entry['reads'] : nil
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/templates/skillsets/confidentiality_guard/lib/confidentiality_guard/recorder.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'digest'
+require 'securerandom'
+require_relative 'policy'
+
+module KairosMcp
+  module SkillSets
+    module ConfidentialityGuard
+      # Constitutive audit records (design v0.3 CG-4).
+      #
+      # Records are commitment-bound: they identify the verdict (versioned
+      # basis, grounding rule, crossing descriptor) and bind the presented
+      # content by a salted commitment, never containing it. The commitment
+      # construction follows the sdp-1 salted field-commitment pattern
+      # (domain-tagged SHA-256 over salt + canonical content; 16-byte hex
+      # salt); the salt stays with the operator-visible report, off-chain
+      # (salt custody is a §8 choice — slice 1 keeps it operator-side).
+      #
+      # The audit write itself is constitutive of the guard's operation,
+      # not a guarded crossing (CG-4): it goes to the chain directly and
+      # never back through the tool surface.
+      module Recorder
+        module_function
+
+        SALT_BYTES = 16
+        COMMITMENT_DOMAIN = 'cg-1/content'
+
+        # Injectable chain factory so design-constraint tests can redirect
+        # records away from the live chain store.
+        @chain_factory = nil
+
+        def chain_factory=(callable)
+          @chain_factory = callable
+        end
+
+        def chain
+          if @chain_factory
+            @chain_factory.call
+          else
+            # In-server the chain class is already loaded; the require path
+            # is a template-layout fallback for standalone runs (tests).
+            unless defined?(KairosMcp::KairosChain::Chain)
+              require_relative '../../../../lib/kairos_mcp/kairos_chain/chain'
+            end
+            KairosMcp::KairosChain::Chain.new
+          end
+        end
+
+        def commitment(content_json)
+          salt = SecureRandom.hex(SALT_BYTES)
+          digest = Digest::SHA256.hexdigest("#{COMMITMENT_DOMAIN}|#{salt}|#{content_json}")
+          { salt: salt, digest: digest }
+        end
+
+        # Re-derivation check (CG-4): given a record's digest, the salt from
+        # the operator report, and a re-presentation of the content, verify
+        # the commitment binds. The record alone reconstructs nothing.
+        def commitment_valid?(digest, salt, content_json)
+          Digest::SHA256.hexdigest("#{COMMITMENT_DOMAIN}|#{salt}|#{content_json}") == digest
+        end
+
+        def record_decision(verdict_result, commitment_digest)
+          entry = {
+            'type'          => 'cg_guard_decision',
+            'verdict'       => verdict_result[:verdict],
+            'rule'          => verdict_result[:rule],
+            'crossing'      => descriptor_fields(verdict_result[:crossing]),
+            'policy_sha256' => verdict_result[:basis][:policy_sha256],
+            'engine'        => verdict_result[:basis][:engine],
+            'commitment'    => commitment_digest
+          }
+          append(entry)
+        end
+
+        def record_regime_event(event, policy)
+          append(
+            'type'          => 'cg_guard_regime',
+            'event'         => event,
+            'policy_sha256' => policy&.sha256,
+            'engine'        => KairosMcp::SkillSets::ConfidentialityGuard::Policy::ENGINE_VERSION,
+            'profile'       => policy&.profile_path ? File.basename(policy.profile_path) : nil
+          )
+        end
+
+        def record_policy_edit(descriptor, commitment_digest, policy)
+          append(
+            'type'          => 'cg_policy_edit',
+            'tool'          => descriptor[:tool],
+            'path'          => File.basename(descriptor[:path].to_s),
+            'pinned_sha256' => policy.sha256,
+            'commitment'    => commitment_digest
+          )
+        end
+
+        def append(entry)
+          chain.add_block([JSON.generate(entry)])
+        end
+
+        # Record fields are identifiers, versions, descriptors, and
+        # commitments — never content (§7). Storage-read records carry the
+        # designation id, not the raw caller-supplied path (which can
+        # itself be sensitive); the path is bound by the commitment.
+        def descriptor_fields(descriptor)
+          fields = { 'class' => descriptor[:class].to_s, 'tool' => descriptor[:tool] }
+          fields['layer'] = descriptor[:layer] if descriptor[:layer]
+          fields['designation'] = descriptor[:designation] if descriptor[:designation]
+          fields
+        end
+      end
+    end
+  end
+end