kairos-chain 3.47.0 → 3.50.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e43541279a3d104b85372574c94f6fdf2d96188fb7de83d5a4d84c3f470634d7
-  data.tar.gz: 21b58d11561dd6d4177a7aa3d3832bdfe4fbde80ff2da2af198662d655a6fc81
+  metadata.gz: 826aabda2632b42bb5e4c688f443616faf29b9b97daba55aa02fa6834bf1629d
+  data.tar.gz: 2a743cfa76eb0d56db2220ed40c11ea0cc52f88c9b16ed8dfb84855d54b15981
 SHA512:
-  metadata.gz: 41bc6c95594567c2e80ed006ea2bd21e7926361bf3cfb14fdf5a6b0a4aac17b9dca3f65faf17be1a4e86b16ce3fb9285af121d747fcdeac66eca58857d4af0bd
-  data.tar.gz: 77a5ac53384830598e90b408b4c737eb8549c219dfdeb47c38feb5939c46829c2b53dc9744da1a9914033521ff1fdf126f8d941989fe62857316863a75790e5f
+  metadata.gz: 0e0ab6e95d0f527e738053fe45e9899e761820809c0f26ab37dd55eacadf13b387b22737475a8685b894d095aa9ba4529df142ab3809adf917c2ff275b46f403
+  data.tar.gz: 1272d3d2ffd8cc80615dc1990346758982cb64cb78d947965d754d3ae5d0e148524044c8197efbb836e0ecf067cfcae69f51aa90a934a71da691525c0b190da2

data/CHANGELOG.md

@@ -4,6 +4,136 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.50.0] - 2026-07-23
+
+### Chain Distillation SkillSet — slice 1 (CD-1..CD-6)
+
+New `chain_distillation` SkillSet implementing design v0.5 (review-converged
+5/6 APPROVE + persona unanimity): provenance-certified distillation of the
+instance chain into distributable SkillSets.
+
+- `cd_distill`: closed-world integer designation (genesis excluded,
+  decline-not-coerce), guard-judged distillate and certificate crossings
+  (separate, in order, single-encoded presentation), CD-6 constitutive
+  record before release (salted sdp-1-style commitments over the distillate
+  and the claim core excluding the record citation), content-independent
+  pre-assigned certificate identity, attestation-carrier seam
+  (`proof_id` = certificate identity), designation-overlap re-issuance
+  citation against then-revoked predecessors.
+- `cd_verify`: full-citation positive grounding (claim-core commitment
+  opening, identity, designation digest, guard policy sha, distillate
+  commitment, predecessors, citation block hash) plus chain-identity /
+  head-binding checks; pinned checkability-status table with
+  both-direction mislabeling fatal; closed claim-core vocabulary at every
+  depth; revocation folds into validity.
+- `cd_revoke`: identity-keyed chain-wide revocation, closed reason
+  vocabulary (`superseded|defective|withdrawn|other`).
+- Requires an active confidentiality-guard regime (CD-1: decline, never
+  degrade). 60 design-constraint tests incl. production-wiring and
+  real-Chain regressions (KAIROS_DATA_DIR-isolated).
+
+### Confidentiality Guard — slice-2 first increment (distillation crossing)
+
+- New `:distillation_outward` crossing class (`cd_release_distillate`,
+  `cd_release_certificate`): conjunctive per-destination verdict
+  (closed-world `distillation_crossings` profile designation AND content
+  classes), outward verdicts recorded pass or deny (CG-4); the general
+  outward class stays denied wholesale.
+- Certificate-crossing verdict records cite the certificate identity
+  (identifier-only, CG-4-compatible).
+- Template-layout require-path parity fix in `regime.rb` / `recorder.rb`.
+- Guard test suite: 75 design-constraint + regression tests.
+
+## [3.49.1] - 2026-07-22
+
+### CLI fix — `skillset upgrade` messaging for non-core new SkillSets
+
+`kairos-chain skillset upgrade --apply` always runs with `core_only: true`
+(the plain CLI form has no way to pass explicit `names`), so a new,
+non-core SkillSet (e.g. `confidentiality_guard`, `daemon_runtime`,
+`kairos_hook_projector`) was never installed by `--apply`, regardless of
+how many times it was run — but the check-mode display mislabeled these as
+"files changed" and told the user to run `--apply`, which silently did
+nothing for them.
+
+- Detected upgrades are now split into "applicable" (existing-installed
+  diffs + core new SkillSets, which `--apply` does handle) and "manual"
+  (non-core new SkillSets, which require explicit
+  `kairos-chain skillset install <name>`). Both the check-mode listing and
+  the post-`--apply` summary report each group accurately.
+- Added the missing `upgrade` line to `kairos-chain skillset -h`.
+
+## [3.49.0] - 2026-07-22
+
+### ZK aggregate reproducibility spike (AUD-L4, Phases 1+2) — KairosChain's first genuine zero-knowledge proof
+
+Additive demonstrator in the `synoptis` SkillSet (candidate convention id
+`sda-1` if later promoted). Proves, over a public DOI set, that an auditor's
+published aggregate (mean reproducibility) is honestly computed from
+per-item scores that stay secret — with each hidden score proven in-range
+via a genuine zero-knowledge proof. Pure-Ruby secp256k1; no trusted setup;
+no new runtime dependency (OpenSSL is a test-only oracle).
+
+- Phase 1 — `ec_group.rb` (hand-rolled prime-order secp256k1, NUMS second
+  generator H), `pedersen.rb` (perfectly-hiding commitments, additive
+  homomorphism, aggregate opening + Σr-hiding Schnorr proof),
+  `aggregate_disclosure.rb` (SDP-2 dual-commitment score binding to rpr-1
+  endorsements, DOI-set commitment, mean verification).
+- Phase 2 — `range_proof.rb` (`Synoptis::Anchoring::RangeProof`):
+  bit-decomposition range proof for s ∈ [0, 7] (3-bit band). Per-bit
+  Cramer-Damgård-Schoenmakers '94 Schnorr OR proofs (b ∈ {0,1}) plus the
+  reconstruction invariant Σ 2^j·B_j = C; Fiat-Shamir (SHA-256) with
+  metadata- and index-bound transcripts. Fail-closed verifier admission
+  (closed schema, type-strict vmax/bits, point/scalar canonicality,
+  identity rejection) closes range-escape and encoding-malleability.
+- CLI: `sda_verify.rb` gains `commit`, `aggregate-verify`,
+  `aggregate-schnorr`, `binding`, `doi-set`, `range-verify`,
+  `full-audit-verify` (C1 coverage + C3 aggregate + C4 range in one pass).
+- Tests: 93 new (52 Phase 1 + 41 Phase 2) incl. the mandatory forgery
+  negatives (an out-of-range 32000 score cannot yield an accepting proof);
+  scalar-mul cross-validated against OpenSSL. Existing suites unchanged
+  (507 total green).
+- Design memos under `docs/drafts/`; design and implementation each
+  converged through philosophy-briefed multi-LLM review (impl round 2:
+  6/6 APPROVE).
+
+## [3.48.0] - 2026-07-22
+
+### Confidentiality Guard SkillSet — slice 1 (CG-1..CG-6)
+
+New `confidentiality_guard` SkillSet implementing design v0.3 (FROZEN,
+review-converged). A fail-closed, selectable-off data-confidentiality regime
+for enterprise environments. Slice 1 covers inward (L2/L1 write) and
+restricted-storage-read surfaces; outward crossings and unmapped
+resource-scheme reads are denied wholesale under the CG-1 coverage clause.
+
+- `lib/confidentiality_guard/regime.rb`: regime lifecycle + tool-surface
+  interception via a `ToolRegistry` gate (verdict precedes effect, CG-2).
+  Activation is environment-level (`KAIROS_CONFIDENTIALITY_GUARD` env >
+  config), read at load time via the skillset `activation_hook` (independent
+  of tool instantiation) with an eager `cg_status` belt-and-suspenders call;
+  policy pinned at activation; activation AND cessation recorded; gate
+  registered only after the regime is active (no fail-open window).
+- `policy.rb`: pinned, content-addressed policy profile; `File.realpath`-
+  matching path resolution (symlink- and `..`-safe, parity with the
+  external-tools readers). `surfaces.rb`: crossing classification with a
+  release-gated enrollment manifest. `verdict.rb`: deterministic LLM-free
+  conjunctive verdict (designation closed-world + content detection),
+  versioned verdict basis. `recorder.rb`: constitutive chain records bound
+  by salted commitments (sdp-1-aligned), never containing content; read
+  records carry the designation id, not the raw path. `canon.rb`: shared
+  canonical serialization faithful to false/nil and mixed string/symbol keys.
+- `tools/cg_status.rb`: read-only regime-state tool (CG-1).
+- 67 design-constraint + regression tests (`test/test_cg_guard.rb`); 75 as of the chain_distillation guard slice-2 first increment (distillation crossing).
+
+Core (minimal, guard-enabling): `tool_registry.rb` adds `FailClosedError`
+(re-raised by the loader, never swallowed), per-skillset isolated loading,
+and fail-closed `activation_hook` invocation; `skillset.rb` adds the
+`activation_hook` accessor. Impl review: 3 rounds with executable-probe
+personas; every deployment-grounded finding (enabled-but-unguarded start,
+copy source-read bypass, path-resolution parity, symlink+`..` bypass, loader
+fail-closed) resolved.
+
 ## [3.47.0] - 2026-07-22
 
 ### Synoptis — selective disclosure sdp-1 (AUD-L4 slice 1)

data/bin/kairos-chain

@@ -134,6 +134,12 @@ when 'skillset'
   when 'upgrade'
     apply = ARGV.delete('--apply')
     upgrades = manager.upgrade_check
+    # --apply always runs with core_only: true (no way to pass names from this
+    # CLI form), so a new, non-core SkillSet is NEVER installed by --apply,
+    # no matter how many times it is run. Split the two groups so the
+    # displayed guidance matches what --apply will actually do.
+    manual = upgrades.select { |u| u[:new_skillset] && !KairosMcp::SkillSetManager::CORE_SKILLSETS.include?(u[:name]) }
+    applicable = upgrades - manual
 
     if upgrades.empty?
       puts "All SkillSets are up to date."
@@ -144,6 +150,12 @@ when 'skillset'
       end
       puts "Done. #{results.size} SkillSet(s) upgraded."
 
+      if manual.any?
+        puts ""
+        puts "Not installed (optional, requires explicit approval):"
+        manual.each { |u| puts "  kairos-chain skillset install #{u[:name]}" }
+      end
+
       # Re-project plugin artifacts if any SkillSets changed
       if results.any?
         begin
@@ -162,15 +174,25 @@ when 'skillset'
         end
       end
     else
-      puts "SkillSet upgrades available:"
-      puts ""
-      upgrades.each do |u|
-        label = u[:version_bump] ? "v#{u[:installed_version]} -> v#{u[:available_version]}" : "files changed"
-        puts "  #{u[:name]}: #{label}"
-        u[:changed_files].each { |f| puts "    Modified: #{f}" }
+      if applicable.any?
+        puts "SkillSet upgrades available:"
+        puts ""
+        applicable.each do |u|
+          label = u[:version_bump] ? "v#{u[:installed_version]} -> v#{u[:available_version]}" : "files changed"
+          puts "  #{u[:name]}: #{label}"
+          u[:changed_files].each { |f| puts "    Modified: #{f}" }
+          puts ""
+        end
+        puts "Run 'kairos-chain skillset upgrade --apply' to apply updates."
+      end
+
+      if manual.any?
+        puts "" if applicable.any?
+        puts "Optional SkillSets available (not auto-installed; require explicit approval):"
+        manual.each { |u| puts "  #{u[:name]} v#{u[:available_version]} — #{u[:description]}" }
         puts ""
+        puts "Install with: kairos-chain skillset install <name>"
       end
-      puts "Run 'kairos-chain skillset upgrade --apply' to apply updates."
     end
 
   when 'remove'
@@ -258,6 +280,7 @@ when 'skillset'
     puts "  install <path> [--layer L0|L1|L2]  Install a SkillSet from path"
     puts "  enable <name>                      Enable a SkillSet"
     puts "  disable <name>                     Disable a SkillSet"
+    puts "  upgrade [--apply]                  Check for/apply SkillSet updates from gem templates"
     puts "  remove <name>                      Remove a SkillSet"
     puts "  info <name>                        Show SkillSet details"
     puts "  package <name>                     Package a knowledge-only SkillSet as JSON archive"

data/lib/kairos_mcp/skillset.rb

@@ -87,6 +87,16 @@ module KairosMcp
       @metadata['config_files'] || []
     end
 
+    # Optional fail-closed activation hook: a fully-qualified class name
+    # whose `activate_on_load!` runs at skillset-load time, independent of
+    # whether any of the SkillSet's tools are instantiated. Used by
+    # fail-closed regimes (confidentiality_guard) so an enabled guard
+    # registers its enforcement even if no tool is ever constructed.
+    def activation_hook
+      name = @metadata['activation_hook']
+      name.is_a?(String) && !name.empty? ? name : nil
+    end
+
     def knowledge_dir_names
       @metadata['knowledge_dirs'] || []
     end

data/lib/kairos_mcp/tool_registry.rb

@@ -5,6 +5,12 @@ require_relative 'lifecycle_hook'
 
 module KairosMcp
   class ToolRegistry
+    # Raised by SkillSets whose activation must never be swallowed
+    # (fail-closed regimes, e.g. confidentiality_guard): the loader
+    # re-raises instead of degrading to a warn, so an enabled regime can
+    # never be silently skipped and leave the server unguarded.
+    class FailClosedError < StandardError; end
+
     # Authorization denial raised by registered gates
     class GateDeniedError < StandardError
       attr_reader :tool_name, :role
@@ -273,17 +279,44 @@ module KairosMcp
 
       manager = SkillSetManager.new
       manager.enabled_skillsets.each do |skillset|
-        skillset.load!
-        skillset.tool_class_names.each do |cls|
-          # Phase 1.5: thread source attribution for capability_status manifest
-          register_if_defined(cls, source: "skillset:#{skillset.name}")
-        end
-        # 24/7 v0.4 §2.3 — register lifecycle hooks declared by this SkillSet.
-        skillset.lifecycle_hooks.each do |hook_name, class_name|
-          register_lifecycle_hook(hook_name, class_name, skillset_name: skillset.name)
+        # Per-skillset isolation: one failing SkillSet must not abort the
+        # loop and silently skip later ones (a fail-closed regime loaded
+        # later would otherwise never register its gate).
+        begin
+          skillset.load!
+          # Fail-closed activation hook (before tool registration): a
+          # regime that ships enabled must register its enforcement at load
+          # time, not as a side effect of some tool being instantiated.
+          # ANY failure to resolve or run the hook is fail-closed: a
+          # missing/typo'd hook constant must not degrade to a warn and
+          # leave an enabled regime unguarded.
+          if (hook = skillset.activation_hook)
+            begin
+              LifecycleHook.validate_class_name!(hook)
+              Object.const_get(hook).activate_on_load!(registry_class: self.class)
+            rescue FailClosedError
+              raise
+            rescue StandardError => e
+              raise FailClosedError,
+                    "activation_hook '#{hook}' (skillset '#{skillset.name}') failed to activate: " \
+                    "#{e.class}: #{e.message}"
+            end
+          end
+          skillset.tool_class_names.each do |cls|
+            # Phase 1.5: thread source attribution for capability_status manifest
+            register_if_defined(cls, source: "skillset:#{skillset.name}")
+          end
+          # 24/7 v0.4 §2.3 — register lifecycle hooks declared by this SkillSet.
+          skillset.lifecycle_hooks.each do |hook_name, class_name|
+            register_lifecycle_hook(hook_name, class_name, skillset_name: skillset.name)
+          end
+        rescue LifecycleHook::Conflict, FailClosedError
+          raise  # never swallow — integrity/fail-closed regimes depend on detection
+        rescue StandardError => e
+          warn "[ToolRegistry] Failed to load SkillSet '#{skillset.name}': #{e.message}"
         end
       end
-    rescue LifecycleHook::Conflict
+    rescue LifecycleHook::Conflict, FailClosedError
       raise  # never swallow — Bootstrap integrity depends on detection
     rescue StandardError => e
       warn "[ToolRegistry] Failed to load SkillSet tools: #{e.message}"

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.47.0"
+  VERSION = "3.50.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/skillsets/chain_distillation/config/chain_distillation.yml

@@ -0,0 +1,13 @@
+# Chain Distillation SkillSet configuration (design v0.5 slice 1).
+#
+# The distiller carries no activation switch of its own: CD-1 couples
+# certified distillation to the confidentiality guard regime, whose
+# activation is environment-level (KAIROS_CONFIDENTIALITY_GUARD / the
+# guard's own config). With the regime inactive the distiller declines.
+#
+# The guard-side designation for the distillation crossings lives in the
+# GUARD's profile (distillation_crossings key) — the guard track owns
+# that surface; see confidentiality_guard/config/profile.example.yml.
+distillation:
+  # Reserved for slice-2 (distribution) settings.
+  {}

data/templates/skillsets/chain_distillation/lib/chain_distillation/canon.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require 'json'
+
+module KairosMcp
+  module SkillSets
+    module ChainDistillation
+      # Canonical serialization for commitments and claim-core hashing
+      # (design v0.5 CD-2/CD-6). Same faithfulness rules as the guard's
+      # Canon (impl review R1 lineage): false/nil preserved distinctly;
+      # mixed string/symbol keys both emitted, sorted by stringified key
+      # with original order as tiebreak. One encoder for designation
+      # digests, artifact commitments, and claim-core commitments so no
+      # two bindings can drift apart.
+      module Canon
+        module_function
+
+        def canonical(obj)
+          case obj
+          when Hash
+            entries = obj.map.with_index { |(k, v), i| [k.to_s, i, v] }
+            entries.sort_by! { |key, i, _| [key, i] }
+            "{#{entries.map { |key, _, v| "#{key.to_json}:#{canonical(v)}" }.join(',')}}"
+          when Array
+            "[#{obj.map { |v| canonical(v) }.join(',')}]"
+          else
+            obj.to_json
+          end
+        end
+
+        def stringify(obj)
+          case obj
+          when Hash
+            obj.each_with_object({}) { |(k, v), acc| acc[k.to_s] = stringify(v) }
+          when Array
+            obj.map { |v| stringify(v) }
+          else
+            obj
+          end
+        end
+      end
+    end
+  end
+end