kairos-chain 3.49.0 → 3.50.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 69d783a71fb5c56c3b7bfc549695f337ad9099d2db5beaf0ae557b845f854a2f
-  data.tar.gz: 3f858ee398aa3ecbe24c664e5618653ab1bfd38f6a5a01c6779270cefc4d7e68
+  metadata.gz: 826aabda2632b42bb5e4c688f443616faf29b9b97daba55aa02fa6834bf1629d
+  data.tar.gz: 2a743cfa76eb0d56db2220ed40c11ea0cc52f88c9b16ed8dfb84855d54b15981
 SHA512:
-  metadata.gz: 16e67612af99d2dc86f85d9d128a3e5906f07f72677f7a8ff547685b9106e1c62b3dea2161ce776fcd68819676f7b665b8b8a9e127a2e69c6cc33831685aab60
-  data.tar.gz: b202b151145f3bb7c1f1383450129d8b3455f0eeb3d9fa7716b3dea173d9c3eb06a56d3fa90b3236b0e8585cb88a3e2276707512e8cd06c833f64efd6ad7915a
+  metadata.gz: 0e0ab6e95d0f527e738053fe45e9899e761820809c0f26ab37dd55eacadf13b387b22737475a8685b894d095aa9ba4529df142ab3809adf917c2ff275b46f403
+  data.tar.gz: 1272d3d2ffd8cc80615dc1990346758982cb64cb78d947965d754d3ae5d0e148524044c8197efbb836e0ecf067cfcae69f51aa90a934a71da691525c0b190da2

data/CHANGELOG.md

@@ -4,6 +4,65 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.50.0] - 2026-07-23
+
+### Chain Distillation SkillSet — slice 1 (CD-1..CD-6)
+
+New `chain_distillation` SkillSet implementing design v0.5 (review-converged
+5/6 APPROVE + persona unanimity): provenance-certified distillation of the
+instance chain into distributable SkillSets.
+
+- `cd_distill`: closed-world integer designation (genesis excluded,
+  decline-not-coerce), guard-judged distillate and certificate crossings
+  (separate, in order, single-encoded presentation), CD-6 constitutive
+  record before release (salted sdp-1-style commitments over the distillate
+  and the claim core excluding the record citation), content-independent
+  pre-assigned certificate identity, attestation-carrier seam
+  (`proof_id` = certificate identity), designation-overlap re-issuance
+  citation against then-revoked predecessors.
+- `cd_verify`: full-citation positive grounding (claim-core commitment
+  opening, identity, designation digest, guard policy sha, distillate
+  commitment, predecessors, citation block hash) plus chain-identity /
+  head-binding checks; pinned checkability-status table with
+  both-direction mislabeling fatal; closed claim-core vocabulary at every
+  depth; revocation folds into validity.
+- `cd_revoke`: identity-keyed chain-wide revocation, closed reason
+  vocabulary (`superseded|defective|withdrawn|other`).
+- Requires an active confidentiality-guard regime (CD-1: decline, never
+  degrade). 60 design-constraint tests incl. production-wiring and
+  real-Chain regressions (KAIROS_DATA_DIR-isolated).
+
+### Confidentiality Guard — slice-2 first increment (distillation crossing)
+
+- New `:distillation_outward` crossing class (`cd_release_distillate`,
+  `cd_release_certificate`): conjunctive per-destination verdict
+  (closed-world `distillation_crossings` profile designation AND content
+  classes), outward verdicts recorded pass or deny (CG-4); the general
+  outward class stays denied wholesale.
+- Certificate-crossing verdict records cite the certificate identity
+  (identifier-only, CG-4-compatible).
+- Template-layout require-path parity fix in `regime.rb` / `recorder.rb`.
+- Guard test suite: 75 design-constraint + regression tests.
+
+## [3.49.1] - 2026-07-22
+
+### CLI fix — `skillset upgrade` messaging for non-core new SkillSets
+
+`kairos-chain skillset upgrade --apply` always runs with `core_only: true`
+(the plain CLI form has no way to pass explicit `names`), so a new,
+non-core SkillSet (e.g. `confidentiality_guard`, `daemon_runtime`,
+`kairos_hook_projector`) was never installed by `--apply`, regardless of
+how many times it was run — but the check-mode display mislabeled these as
+"files changed" and told the user to run `--apply`, which silently did
+nothing for them.
+
+- Detected upgrades are now split into "applicable" (existing-installed
+  diffs + core new SkillSets, which `--apply` does handle) and "manual"
+  (non-core new SkillSets, which require explicit
+  `kairos-chain skillset install <name>`). Both the check-mode listing and
+  the post-`--apply` summary report each group accurately.
+- Added the missing `upgrade` line to `kairos-chain skillset -h`.
+
 ## [3.49.0] - 2026-07-22
 
 ### ZK aggregate reproducibility spike (AUD-L4, Phases 1+2) — KairosChain's first genuine zero-knowledge proof
@@ -65,7 +124,7 @@ resource-scheme reads are denied wholesale under the CG-1 coverage clause.
   records carry the designation id, not the raw path. `canon.rb`: shared
   canonical serialization faithful to false/nil and mixed string/symbol keys.
 - `tools/cg_status.rb`: read-only regime-state tool (CG-1).
-- 67 design-constraint + regression tests (`test/test_cg_guard.rb`).
+- 67 design-constraint + regression tests (`test/test_cg_guard.rb`); 75 as of the chain_distillation guard slice-2 first increment (distillation crossing).
 
 Core (minimal, guard-enabling): `tool_registry.rb` adds `FailClosedError`
 (re-raised by the loader, never swallowed), per-skillset isolated loading,

data/bin/kairos-chain

@@ -134,6 +134,12 @@ when 'skillset'
   when 'upgrade'
     apply = ARGV.delete('--apply')
     upgrades = manager.upgrade_check
+    # --apply always runs with core_only: true (no way to pass names from this
+    # CLI form), so a new, non-core SkillSet is NEVER installed by --apply,
+    # no matter how many times it is run. Split the two groups so the
+    # displayed guidance matches what --apply will actually do.
+    manual = upgrades.select { |u| u[:new_skillset] && !KairosMcp::SkillSetManager::CORE_SKILLSETS.include?(u[:name]) }
+    applicable = upgrades - manual
 
     if upgrades.empty?
       puts "All SkillSets are up to date."
@@ -144,6 +150,12 @@ when 'skillset'
       end
       puts "Done. #{results.size} SkillSet(s) upgraded."
 
+      if manual.any?
+        puts ""
+        puts "Not installed (optional, requires explicit approval):"
+        manual.each { |u| puts "  kairos-chain skillset install #{u[:name]}" }
+      end
+
       # Re-project plugin artifacts if any SkillSets changed
       if results.any?
         begin
@@ -162,15 +174,25 @@ when 'skillset'
         end
       end
     else
-      puts "SkillSet upgrades available:"
-      puts ""
-      upgrades.each do |u|
-        label = u[:version_bump] ? "v#{u[:installed_version]} -> v#{u[:available_version]}" : "files changed"
-        puts "  #{u[:name]}: #{label}"
-        u[:changed_files].each { |f| puts "    Modified: #{f}" }
+      if applicable.any?
+        puts "SkillSet upgrades available:"
+        puts ""
+        applicable.each do |u|
+          label = u[:version_bump] ? "v#{u[:installed_version]} -> v#{u[:available_version]}" : "files changed"
+          puts "  #{u[:name]}: #{label}"
+          u[:changed_files].each { |f| puts "    Modified: #{f}" }
+          puts ""
+        end
+        puts "Run 'kairos-chain skillset upgrade --apply' to apply updates."
+      end
+
+      if manual.any?
+        puts "" if applicable.any?
+        puts "Optional SkillSets available (not auto-installed; require explicit approval):"
+        manual.each { |u| puts "  #{u[:name]} v#{u[:available_version]} — #{u[:description]}" }
         puts ""
+        puts "Install with: kairos-chain skillset install <name>"
       end
-      puts "Run 'kairos-chain skillset upgrade --apply' to apply updates."
     end
 
   when 'remove'
@@ -258,6 +280,7 @@ when 'skillset'
     puts "  install <path> [--layer L0|L1|L2]  Install a SkillSet from path"
     puts "  enable <name>                      Enable a SkillSet"
     puts "  disable <name>                     Disable a SkillSet"
+    puts "  upgrade [--apply]                  Check for/apply SkillSet updates from gem templates"
     puts "  remove <name>                      Remove a SkillSet"
     puts "  info <name>                        Show SkillSet details"
     puts "  package <name>                     Package a knowledge-only SkillSet as JSON archive"

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.49.0"
+  VERSION = "3.50.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/skillsets/chain_distillation/config/chain_distillation.yml

@@ -0,0 +1,13 @@
+# Chain Distillation SkillSet configuration (design v0.5 slice 1).
+#
+# The distiller carries no activation switch of its own: CD-1 couples
+# certified distillation to the confidentiality guard regime, whose
+# activation is environment-level (KAIROS_CONFIDENTIALITY_GUARD / the
+# guard's own config). With the regime inactive the distiller declines.
+#
+# The guard-side designation for the distillation crossings lives in the
+# GUARD's profile (distillation_crossings key) — the guard track owns
+# that surface; see confidentiality_guard/config/profile.example.yml.
+distillation:
+  # Reserved for slice-2 (distribution) settings.
+  {}

data/templates/skillsets/chain_distillation/lib/chain_distillation/canon.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require 'json'
+
+module KairosMcp
+  module SkillSets
+    module ChainDistillation
+      # Canonical serialization for commitments and claim-core hashing
+      # (design v0.5 CD-2/CD-6). Same faithfulness rules as the guard's
+      # Canon (impl review R1 lineage): false/nil preserved distinctly;
+      # mixed string/symbol keys both emitted, sorted by stringified key
+      # with original order as tiebreak. One encoder for designation
+      # digests, artifact commitments, and claim-core commitments so no
+      # two bindings can drift apart.
+      module Canon
+        module_function
+
+        def canonical(obj)
+          case obj
+          when Hash
+            entries = obj.map.with_index { |(k, v), i| [k.to_s, i, v] }
+            entries.sort_by! { |key, i, _| [key, i] }
+            "{#{entries.map { |key, _, v| "#{key.to_json}:#{canonical(v)}" }.join(',')}}"
+          when Array
+            "[#{obj.map { |v| canonical(v) }.join(',')}]"
+          else
+            obj.to_json
+          end
+        end
+
+        def stringify(obj)
+          case obj
+          when Hash
+            obj.each_with_object({}) { |(k, v), acc| acc[k.to_s] = stringify(v) }
+          when Array
+            obj.map { |v| stringify(v) }
+          else
+            obj
+          end
+        end
+      end
+    end
+  end
+end

data/templates/skillsets/chain_distillation/lib/chain_distillation/certificate.rb

@@ -0,0 +1,308 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'digest'
+require_relative 'canon'
+require_relative 'recorder'
+
+module KairosMcp
+  module SkillSets
+    module ChainDistillation
+      # Certificate shape and verification (design v0.5 §4, CD-2/CD-3/CD-6).
+      #
+      # The certificate's vocabulary is exhausted by three claim families —
+      # identity, derivation, recording — plus the checkability-status
+      # table and the designation-overlap predecessor citations. It is
+      # origin-only: there is no field a quality claim could occupy, and
+      # verification rejects any claim-core key outside the pinned
+      # vocabulary (CD-3's "incapable of expressing quality" made
+      # mechanical).
+      #
+      # Grounding is fixed at issuance (CD-6): the authoritative
+      # distillation record is the one whose claim-core commitment the
+      # certificate's claim core matches and which its finalized form
+      # cites — a positive check, never by exhaustion. Identity uniqueness,
+      # designation-overlap citation observance, the drawn-from link, and
+      # revocation status are trusted claims; mislabeling any status in
+      # either direction fails verification as a whole (CD-2).
+      module Certificate
+        module_function
+
+        CONVENTION = 'cd-1'
+
+        # Pinned claim-core vocabulary (CD-3): verification fails on any
+        # key outside this set, so the claim language cannot be extended
+        # into quality territory by an issuer.
+        CLAIM_CORE_KEYS = %w[
+          convention
+          certificate_identity
+          identity
+          derivation
+          recording
+          predecessors
+          statuses
+        ].freeze
+
+        # Pinned per-claim-family checkability-status table (design v0.5
+        # §6 slice 1; CD-2). The certificate must carry exactly this
+        # table — labeling a checkable claim as trusted is the same defect
+        # as the converse, and either fails verification as a whole.
+        STATUS_TABLE = {
+          'identity.binding'               => 'checkable',
+          'identity.continuity'            => 'trusted',
+          'identity.uniqueness'            => 'trusted',
+          'derivation'                     => 'anchor-pending',
+          'recording'                      => 'anchor-pending',
+          'reissuance_citation_observance' => 'trusted',
+          'drawn_from'                     => 'trusted',
+          'revocation_status'              => 'trusted'
+        }.freeze
+
+        # Claim core: the certificate's claim content EXCLUDING its
+        # citation of the CD-6 record, carrier lifecycle metadata, and
+        # commitment openings (all outside the core, CD-6) — which is what
+        # breaks the self-citation fixed point.
+        def build_claim_core(certificate_identity:, chain_identity:, head_index:, head_hash:,
+                             designation:, guard_policy_sha256:, distillate_commitment:,
+                             verdict_block_indices:, predecessors:)
+          {
+            'convention'           => CONVENTION,
+            'certificate_identity' => certificate_identity,
+            'identity' => {
+              'chain_identity'   => chain_identity,
+              'chain_head_index' => head_index,
+              'chain_head_hash'  => head_hash
+            },
+            'derivation' => {
+              'designation'           => designation.sort,
+              'designation_digest'    => Recorder.designation_digest(designation),
+              'span'                  => { 'first_index' => designation.min, 'last_index' => designation.max },
+              'guard_policy_sha256'   => guard_policy_sha256,
+              'distillate_commitment' => distillate_commitment,
+              'verdict_block_indices' => verdict_block_indices
+            },
+            'recording' => {
+              'revocation_channel' => 'source-chain:cd_revocation'
+            },
+            'predecessors' => predecessors,
+            'statuses'     => STATUS_TABLE.dup
+          }
+        end
+
+        # Finalization adds only what sits outside the claim core: the
+        # CD-6 record citation and the commitment openings for the
+        # released artifacts the holder possesses (CD-2). Later cites
+        # earlier; nothing here feeds back into the committed core.
+        def finalize(claim_core:, record_citation:, openings:)
+          {
+            'claim_core'      => claim_core,
+            'record_citation' => record_citation,
+            'openings'        => openings
+          }
+        end
+
+        # Verification (CD-2/CD-6): positive checks only. `chain_entries`
+        # is the parsed record list of the source chain (index => entry),
+        # available to an in-instance or chain-access verifier; claims
+        # whose witness is the private chain alone are trusted-status and
+        # verified here only when chain access is provided.
+        # Returns { valid:, errors:, revoked: }.
+        # Pinned nested vocabulary per claim family (CD-3): nested extras
+        # and nested missing fields are both defects, so no quality-shaped
+        # content can hide one level down.
+        NESTED_KEYS = {
+          'identity'   => %w[chain_identity chain_head_index chain_head_hash],
+          'derivation' => %w[designation designation_digest span guard_policy_sha256
+                             distillate_commitment verdict_block_indices],
+          'recording'  => %w[revocation_channel]
+        }.freeze
+
+        # The span sub-mapping's closed vocabulary (CD-3 at every depth).
+        SPAN_KEYS = %w[first_index last_index].freeze
+
+        def verify(certificate, chain_entries: nil, distillate_json: nil, chain_hashes: nil)
+          unless certificate.is_a?(Hash)
+            return { valid: false, errors: ['certificate/not-a-mapping'], revoked: nil }
+          end
+          errors = []
+          cert = Canon.stringify(certificate)
+          core = cert['claim_core']
+          return { valid: false, errors: ['certificate/missing-claim-core'], revoked: nil } unless core.is_a?(Hash)
+
+          # CD-3 vocabulary bound: no key outside the pinned set, at the
+          # top level and inside each claim family.
+          extra = core.keys - CLAIM_CORE_KEYS
+          errors << "vocabulary/unknown-keys:#{extra.join(',')}" unless extra.empty?
+          missing = CLAIM_CORE_KEYS - core.keys
+          errors << "vocabulary/missing-keys:#{missing.join(',')}" unless missing.empty?
+          NESTED_KEYS.each do |family, keys|
+            fam = core[family]
+            unless fam.is_a?(Hash)
+              errors << "vocabulary/#{family}-not-a-mapping"
+              next
+            end
+            nested_extra = fam.keys - keys
+            errors << "vocabulary/#{family}-unknown-keys:#{nested_extra.join(',')}" unless nested_extra.empty?
+            nested_missing = keys - fam.keys
+            errors << "vocabulary/#{family}-missing-keys:#{nested_missing.join(',')}" unless nested_missing.empty?
+          end
+          # The span sub-mapping is likewise closed (CD-3 holds at every
+          # depth of the claim core — impl review R3).
+          span = core.is_a?(Hash) ? core.dig('derivation', 'span') : nil
+          if span.is_a?(Hash) && span.keys.sort != SPAN_KEYS
+            errors << "vocabulary/span-keys:#{(span.keys - SPAN_KEYS).join(',')}"
+          elsif !span.is_a?(Hash) && core['derivation'].is_a?(Hash)
+            errors << 'vocabulary/span-not-a-mapping'
+          end
+
+          # CD-2 mislabeling defect, both directions: statuses must equal
+          # the pinned table exactly.
+          errors << 'statuses/mislabeled' unless core['statuses'] == STATUS_TABLE
+
+          # Openings only over released artifacts (claim core + distillate).
+          openings = cert['openings'].is_a?(Hash) ? cert['openings'] : {}
+          errors << 'openings/extra' unless (openings.keys - %w[claim_core_salt distillate_salt]).empty?
+
+          revoked = nil
+          if chain_entries
+            revoked, chain_errors = verify_against_chain(cert, core, openings, chain_entries,
+                                                         chain_hashes: chain_hashes)
+            errors.concat(chain_errors)
+            # A revoked certificate does not verify (CD-6: revocation is
+            # the authoritative channel); callers checking only `valid`
+            # must not accept a chain-revoked certificate.
+            errors << 'revocation/revoked' if revoked
+          end
+
+          if distillate_json
+            if openings['distillate_salt']
+              digest = core.dig('derivation', 'distillate_commitment')
+              unless Recorder.commitment_valid?(Recorder::ARTIFACT_DOMAIN, digest.to_s,
+                                                openings['distillate_salt'], distillate_json)
+                errors << 'distillate/commitment-mismatch'
+              end
+            else
+              # A supplied distillate that cannot be checked is a defect,
+              # not a silent pass (impl review R1).
+              errors << 'distillate/no-opening'
+            end
+          end
+
+          { valid: errors.empty?, errors: errors, revoked: revoked }
+        end
+
+        # Grounding and chain-witnessed checks (positive, never by
+        # exhaustion): locate the cited record, match commitments and
+        # identity, check revocation and the designation-overlap
+        # predecessor-citation obligation.
+        def verify_against_chain(cert, core, openings, chain_entries, chain_hashes: nil)
+          errors = []
+          citation = cert['record_citation'].is_a?(Hash) ? cert['record_citation'] : {}
+          record_index = normalize_index(citation['block_index'])
+          record = record_index ? chain_entries[record_index] : nil
+          unless record.is_a?(Hash) && record['type'] == 'cd_distillation'
+            return [nil, ['grounding/cited-record-absent']]
+          end
+
+          # Positive grounding: claim core matches the cited record's
+          # claim-core commitment (via the disclosed opening), and every
+          # field the record and the core both carry must agree — identity,
+          # designation digest, guard policy version, distillate
+          # commitment, predecessors (impl review R1: grounding must bind
+          # the whole citation, not the index alone).
+          if openings['claim_core_salt']
+            unless Recorder.commitment_valid?(Recorder::CLAIM_CORE_DOMAIN,
+                                              record['claim_core_commitment'].to_s,
+                                              openings['claim_core_salt'], Canon.canonical(core))
+              errors << 'grounding/claim-core-commitment-mismatch'
+            end
+          else
+            errors << 'grounding/no-claim-core-opening'
+          end
+          errors << 'grounding/identity-mismatch' unless record['certificate_identity'] == core['certificate_identity']
+          errors << 'grounding/designation-mismatch' unless record['designation_digest'] == core.dig('derivation', 'designation_digest')
+          errors << 'grounding/policy-mismatch' unless record['guard_policy_sha256'] == core.dig('derivation', 'guard_policy_sha256')
+          errors << 'grounding/distillate-commitment-mismatch' unless record['distillate_commitment'] == core.dig('derivation', 'distillate_commitment')
+          errors << 'grounding/predecessors-mismatch' unless Array(record['predecessors']).sort == Array(core['predecessors']).sort
+
+          # With block hashes available, bind the citation to the block
+          # itself and check the identity family (identity.binding is a
+          # CHECKABLE claim and must actually be checked — impl review R1).
+          if chain_hashes.is_a?(Hash) && !chain_hashes.empty?
+            # Full-citation grounding (CD-2): the block hash is part of the
+            # citation, not an optional extra — a certificate stripped of
+            # it must not verify (impl review R3).
+            cited_hash = citation['block_hash']
+            if cited_hash.nil? || cited_hash.to_s.empty?
+              errors << 'grounding/no-block-hash'
+            elsif chain_hashes[record_index] != cited_hash
+              errors << 'grounding/block-hash-mismatch'
+            end
+            genesis_hash = chain_hashes[chain_hashes.keys.min]
+            claimed_identity = core.dig('identity', 'chain_identity')
+            if genesis_hash && claimed_identity != "block1-sha256:#{genesis_hash}"
+              errors << 'identity/chain-identity-mismatch'
+            end
+            head_index = normalize_index(core.dig('identity', 'chain_head_index'))
+            head_hash = core.dig('identity', 'chain_head_hash')
+            if head_index && head_hash && chain_hashes[head_index] != head_hash
+              errors << 'identity/head-binding-mismatch'
+            end
+          end
+
+          # Revocation: keyed to the certificate identity, chain
+          # authoritative (trusted-status for outside verifiers; checked
+          # here because chain access was provided).
+          revoked = chain_entries.values.any? do |e|
+            e.is_a?(Hash) && e['type'] == 'cd_revocation' &&
+              e['certificate_identity'] == core['certificate_identity']
+          end
+
+          # Designation-overlap predecessor-citation obligation (CD-6,
+          # evaluated at issuance): every certificate identity that was
+          # revoked before this record and whose distillation record's
+          # designation shares records with this designation must appear
+          # in predecessors.
+          required = revoked_overlapping_identities(chain_entries, core.dig('derivation', 'designation'), record_index)
+          cited = Array(core['predecessors'])
+          missing = required - cited
+          errors << "reissuance/uncited-revoked-predecessors:#{missing.join(',')}" unless missing.empty?
+
+          [revoked, errors]
+        end
+
+        # Identities of certificates revoked before `before_index` whose
+        # distillation designation overlaps `designation`. Both the
+        # revocation AND its grounding distillation record must precede
+        # `before_index` (impl review R1: records written after the
+        # evaluated record cannot ground an obligation on it).
+        def revoked_overlapping_identities(chain_entries, designation, before_index)
+          designated = Array(designation)
+          distillations = {}
+          revoked_before = []
+          chain_entries.each do |index, entry|
+            next unless entry.is_a?(Hash)
+            next if index.to_i >= before_index
+            case entry['type']
+            when 'cd_distillation'
+              distillations[entry['certificate_identity']] = Array(entry['designation'])
+            when 'cd_revocation'
+              revoked_before << entry['certificate_identity']
+            end
+          end
+          revoked_before.uniq.select do |identity|
+            overlap = distillations[identity]
+            overlap && !(overlap & designated).empty?
+          end
+        end
+
+        # Integer indices only; a JSON round-trip may deliver strings.
+        def normalize_index(value)
+          return value if value.is_a?(Integer)
+          return value.to_i if value.is_a?(String) && value.match?(/\A\d+\z/)
+          nil
+        end
+      end
+    end
+  end
+end