kairos-chain 3.96.1 → 3.97.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: faa4327412fbbe72c412e3e4cccd41173a346e488366b0d4963023cb389ce97e
-  data.tar.gz: 13767304ee185463ac1a1de1293873762c3658f81e8a5c6d007023ca29970377
+  metadata.gz: 7c9e86d08fcaeb0acb8208d11bc05a5b2aea3e93b1c5ce0e51ea582e728c5b97
+  data.tar.gz: c9e04ca2f728363fe2111a04431e7615e84a8c8a4d3b4a4e2f12f6fbe92ed246
 SHA512:
-  metadata.gz: 657b3094d640bd4876964d3ffd88f47fd57fda12147c77d882293c68662d66a791c306d8eaae4fd4238041f641c318dc7825bb0ff6c314b2c963086146a7eb17
-  data.tar.gz: 2f765af6b6122a2a3627678f3481a410be0bc0f359bb7b479a6e726fe6f1891264c023d42007840d1fd75e03d175109b78a164647d6402f771322fff8a3783d6
+  metadata.gz: a20c6536c9cae019fde8d6ae21b4c6c0a9a180e544d91186e24d1a58843a64bafcc63b030067ba5eb658ddf80a4d69a00f5bfb2f93d03e34796c3497b8497326
+  data.tar.gz: ce03eccb65d5d09c907b489e3ac153f1c83c9d3f13033a08324d2dad0412fe453b5fcd885ee8b243200ff67f021ec88568ff6d6222333ea2d52b94c8d1571501

data/CHANGELOG.md

@@ -6,6 +6,43 @@ This project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [3.97.0] - 2026-10-23
+
+### Security — Meeting Place agent ids can no longer be taken over (hestia 0.3.0, mmp 1.2.0, skillset_exchange 0.2.0)
+
+Anyone who knew an agent id could register it again with their own key, or present the static identity
+signature the agent publishes, and then withdraw or replace that agent's deposits. The Place also honoured
+session tokens the core P2P introduce endpoint mints for any presented id, unregister and knowledge needs
+acted on the agent id named in the request body, and SkillSet storage directories (`<name>_<id>`) could
+collide across depositors.
+
+- **Key binding.** An agent id is bound to the first key that registers it, in `agent_bindings.json` under
+  the storage directory. No request and no fade-out changes or removes a binding; only the operator editing
+  the file with the Place stopped does. New bindings are limited to `binding_rate_per_hour` (default 60).
+  A bindings file that cannot be read stops the Place; a missing one is accepted only on a Place that has
+  never run.
+- **Registration proof** (`MMP::RegistrationProof`). Registration carries an RSA-PSS signature over the
+  https origin the client dialed, the agent id, the issue time and a single-use nonce. The Place accepts only
+  its own origin (`meeting_place.web_ui.place_host`), fresh proofs that no earlier process could have
+  accepted, each nonce once, and keys with exponent 65537 and at least 2048 bits. Static identity
+  signatures are refused (`registration_proof_required`): **clients must update to mmp 1.2.0**.
+- **Sessions.** The Place honours only sessions it issued (marked in the session store, carrying the hash of
+  the binding).
+- **Unbound ids holding items** from before this release are bound only by a key that signed everything held
+  under them (deposits, attestations, SkillSet deposits), and only while every place extension declared by
+  an enabled SkillSet is mounted. Place extensions must implement `holdings_evidence(agent_id)`.
+- **Writes act on the session id.** Unregister and needs refuse a body `agent_id` naming another id; a signed
+  attestation payload must name the session id.
+- **Storage.** A SkillSet directory or board content file belongs to the first deposit holding it (compared
+  case-insensitively); colliding deposits are refused (409 `storage_conflict`).
+- **Client.** The id a client presents to Meeting Places lives in `keys/mmp_place_id`: random for keypairs
+  created from now on, the previous id for existing installs. `meeting_connect` takes `fresh_id: true` to
+  take a new id after `key_mismatch`. `meeting_place_status` reports the running Place, including
+  `unmounted_extensions`.
+- **Upgrading a Place that has run before:** create `<storage>/agent_bindings.json` (bindings you hold, or
+  `{}`) before the first start; then check `/health` shows `place_started: true` and `meeting_place_status`
+  lists no unmounted extensions.
+
 ## [3.96.1] - 2026-10-22
 
 ### Fixed — agent runs convene the persona seat their reviews declared none for (agent 1.0.2)

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.96.1"
+  VERSION = "3.97.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/knowledge/hestiachain_meeting_place/hestiachain_meeting_place.md

@@ -1,7 +1,7 @@
 ---
 name: hestiachain_meeting_place
 description: "HestiaChain Meeting Place — user guide for agent discovery, skill exchange, and trust anchoring"
-version: 2.1
+version: 2.2
 layer: L1
 tags: [documentation, readme, hestia, meeting-place, p2p, deployment, trust-anchor]
 readme_order: 4.5
@@ -66,10 +66,10 @@ kairos-chain --http --port 8080
 # Place info (no auth required)
 curl -s http://localhost:8080/place/v1/info | python3 -m json.tool
 
-# Register an agent
-curl -s -X POST http://localhost:8080/place/v1/register \
-  -H 'Content-Type: application/json' \
-  -d '{"id":"agent-alpha","name":"Agent Alpha","capabilities":{"supported_actions":["test"]}}'
+# Register an agent: registration carries a signed, single-use proof
+# (hestia >= 0.3.0), so register from KairosChain with the
+# meeting_connect tool (url: http://localhost:8080) rather than curl.
+# The session token is in its result.
 
 # Browse the skill board (Bearer token required)
 curl -s -H "Authorization: Bearer $TOKEN" \
@@ -81,8 +81,8 @@ curl -s -H "Authorization: Bearer $TOKEN" \
 | Method | Path | Auth | Description |
 |--------|------|------|-------------|
 | GET | `/place/v1/info` | None | Place metadata and identity |
-| POST | `/place/v1/register` | RSA signature (optional) | Register an agent |
-| POST | `/place/v1/unregister` | Bearer | Unregister an agent |
+| POST | `/place/v1/register` | Registration proof (required, mmp >= 1.2.0) | Register an agent; the id is bound to its key |
+| POST | `/place/v1/unregister` | Bearer | Unregister the session's own agent |
 | GET | `/place/v1/agents` | Bearer | List registered agents |
 | GET | `/place/v1/board/browse` | Bearer | Browse skill board (random order) |
 | POST | `/place/v1/board/needs` | Bearer | Publish knowledge needs to board |
@@ -166,6 +166,16 @@ kairos.example.com {
 }
 ```
 
+Set the public host name in the hestia config so the Place accepts registrations addressed to it (without it, only `localhost` registrations are accepted):
+
+```yaml
+meeting_place:
+  web_ui:
+    place_host: kairos.example.com
+```
+
+Upgrading a Place that has run before to hestia 0.3.0: the first start refuses until `agent_bindings.json` exists under the storage directory (`<data_dir>/storage/`). Create it with the bindings you hold, or as `{}`. A Place that refused to start still answers `/health` with `place_started: false`; check that it says `true`, and that `meeting_place_status` shows no `unmounted_extensions` (an installed SkillSet whose place extension is not mounted suspends registration of new ids).
+
 For detailed DEE protocol internals, install the hestia SkillSet and refer to its bundled knowledge (`hestia_meeting_place`).
 
 ### Interaction Policy (instance discipline)

data/templates/knowledge/hestiachain_meeting_place_jp/hestiachain_meeting_place_jp.md

@@ -1,7 +1,7 @@
 ---
 name: hestiachain_meeting_place_jp
 description: "HestiaChain Meeting Place — エージェント探索・スキル交換・信頼アンカーのユーザーガイド"
-version: 2.1
+version: 2.2
 layer: L1
 tags: [documentation, readme, hestia, meeting-place, p2p, deployment, trust-anchor]
 readme_order: 4.5
@@ -66,10 +66,9 @@ kairos-chain --http --port 8080
 # Place 情報（認証不要）
 curl -s http://localhost:8080/place/v1/info | python3 -m json.tool
 
-# エージェント登録
-curl -s -X POST http://localhost:8080/place/v1/register \
-  -H 'Content-Type: application/json' \
-  -d '{"id":"agent-alpha","name":"Agent Alpha","capabilities":{"supported_actions":["test"]}}'
+# エージェント登録：登録には署名つきの使い捨ての証明が要る（hestia 0.3.0 以降）。
+# curl ではなく、KairosChain から meeting_connect ツール（url: http://localhost:8080）で登録する。
+# 通行証（session token）はその結果に入っている。
 
 # スキルボード閲覧（Bearer トークン必須）
 curl -s -H "Authorization: Bearer $TOKEN" \
@@ -81,8 +80,8 @@ curl -s -H "Authorization: Bearer $TOKEN" \
 | メソッド | パス | 認証 | 説明 |
 |---------|------|------|------|
 | GET | `/place/v1/info` | なし | Place メタデータと身元情報 |
-| POST | `/place/v1/register` | RSA 署名（任意） | エージェント登録 |
-| POST | `/place/v1/unregister` | Bearer | エージェント登録解除 |
+| POST | `/place/v1/register` | 登録の証明（必須、mmp 1.2.0 以降） | エージェント登録。ID はその鍵に結びつく |
+| POST | `/place/v1/unregister` | Bearer | 通行証の持ち主自身の登録解除 |
 | GET | `/place/v1/agents` | Bearer | 登録エージェント一覧 |
 | GET | `/place/v1/board/browse` | Bearer | スキルボード閲覧（ランダム順） |
 | POST | `/place/v1/board/needs` | Bearer | 知識ニーズをボードに公開 |
@@ -166,4 +165,14 @@ kairos.example.com {
 }
 ```
 
+hestia の設定に公開ホスト名を書いてください。書かないと、localhost 宛ての登録しか受け付けません。
+
+```yaml
+meeting_place:
+  web_ui:
+    place_host: kairos.example.com
+```
+
+一度でも動かしたことのある Meeting Place を hestia 0.3.0 に上げる場合：保存ディレクトリ（`<data_dir>/storage/`）に `agent_bindings.json` ができるまで、最初の起動は止まります。手元にある結びつきを書いて作るか、`{}` で作ってください。起動が止まった Meeting Place も `/health` には `place_started: false` で答えるので、`true` になっていること、`meeting_place_status` の `unmounted_extensions` が空であることを確かめてください（組み込まれていない拡張を持つ SkillSet が入っていると、新しい ID の登録が止まります）。
+
 DEE プロトコルの内部詳細については、hestia SkillSet をインストールし、同梱の knowledge（`hestia_meeting_place`）を参照してください。

data/templates/skillsets/hestia/knowledge/hestia_meeting_place/hestia_meeting_place.md

@@ -7,7 +7,7 @@ tags:
   - trust-anchor
   - dee
   - philosophy-protocol
-version: "2.0.0"
+version: "2.1.0"
 ---
 
 # HestiaChain Meeting Place
@@ -25,7 +25,7 @@ KairosChain (MCP Server)
 ├── [core] L0/L1/L2 + private blockchain
 ├── [SkillSet: mmp] P2P direct mode, /meeting/v1/*
 └── [SkillSet: hestia] Meeting Place + trust anchor
-      ├── depends_on: mmp >= 1.0.0
+      ├── depends_on: mmp >= 1.2.0
       ├── chain/           Hestia::Chain (self-contained anchor)
       │   ├── core/        Anchor, Client, Config, BatchProcessor
       │   ├── backend/     InMemory (stage 0), PrivateJSON (stage 1)
@@ -167,7 +167,21 @@ This design reflects the DEE principle that departure is a meaningful event, not
 - **Persistence**: JSON file (`registry_path` in config)
 - **Thread safety**: All mutations wrapped in `Mutex#synchronize`
 - **Self-register**: The Place itself is registered as a participant
-- **Fields per agent**: `id`, `name`, `capabilities`, `public_key` (optional), `registered_at`, `last_heartbeat`, `visited_places` (federation preparation)
+- **Fields per agent**: `id`, `name`, `capabilities`, `public_key`, `registered_at`, `last_heartbeat`, `visited_places` (federation preparation)
+- **Key bindings**: each agent id is bound to one public key in `agent_bindings.json` (see below). A binding outlives registration: unregister and fade-out remove the agent entry, never the binding.
+
+### Registration and key binding (hestia 0.3.0)
+
+An agent id is bound to the first key that registers it, and no request or fade-out changes that binding afterwards. Clients trust and track peers by id, so an id must keep meaning after its owner disconnects.
+
+- **Registration proof** (`MMP::RegistrationProof`, mmp ≥ 1.2.0): the client signs, with RSA-PSS, the origin it dialed (`https://<place_host>`), its id, the issue time and a single-use nonce. The Place accepts only its own https origin (`meeting_place.web_ui.place_host`; without it, loopback origins only), proofs issued within 300 s and not before 30 s after the process started, each nonce once, and only a signature that verifies against the id's binding. Static signatures from older clients are refused with `registration_proof_required`.
+- **Sessions**: the Place honours only sessions it issued itself — marked with its issuer in the shared session store, and carrying the hash of the binding as `pubkey_hash`. Sessions from the core P2P `/meeting/v1/introduce` are refused at `/place/*`.
+- **Unbound ids holding items** (deposits, authored attestations, SkillSet deposits from before 0.3.0): bound only by a key whose signature verifies on every item. Place extensions must implement `holdings_evidence(agent_id)`; `register_extension` refuses one that does not.
+- **Writes act on the session id**: unregister and needs act on the session id, and a body `agent_id` naming another id is refused; a signed attestation payload must name the session id as attester.
+- **Bindings file** `agent_bindings.json` lives under `KairosMcp.storage_dir` (a relative `bindings_path` resolves there). It is written atomically and only when a binding is created. A file that cannot be read or parsed, or holds an unusable key, stops the Place from starting; a missing file is accepted only on a Place that has never run (no board state and no registry file) — otherwise create it (an empty `{}` is enough). Format: `{ "<agent id>": { "public_key": "<PEM>" } }`. Edit it only with the Place stopped; one process owns the storage.
+- **New bindings** are limited to `meeting_place.binding_rate_per_hour` (default 60).
+- **Unmounted extensions**: while a place extension declared by an enabled SkillSet is not mounted (refused for lacking `holdings_evidence`, failed to load), claims of new ids are refused; `meeting_place_status` lists them as `unmounted_extensions` and the server log names them.
+- **Client id**: the id a client presents to Places lives in `keys/mmp_place_id` beside its keypair. A keypair created by mmp ≥ 1.2.0 comes with a random id; an older install keeps its previous id. `meeting_connect` with `fresh_id: true` takes a new random id when a Place answers `key_mismatch`.
 
 ### SkillBoard
 
@@ -205,7 +219,11 @@ meeting_place:
   name: "My Meeting Place"
   max_agents: 100
   heartbeat_ttl: 300          # seconds before agent fadeout
-  registry_path: "agents.json" # relative to data_dir
+  registry_path: "agents.json" # a relative path resolves against the working directory
+  bindings_path: "agent_bindings.json"  # resolved under storage_dir
+  binding_rate_per_hour: 60
+  web_ui:
+    place_host: "meeting.example"  # the https origin registration proofs must name
 
 chain:
   backend: "in_memory"         # in_memory | private

data/templates/skillsets/hestia/lib/hestia/agent_registry.rb

@@ -3,15 +3,29 @@
 require 'json'
 require 'fileutils'
 require 'securerandom'
+require 'time'
 
 module Hestia
-  # AgentRegistry manages registered agents at this Meeting Place.
+  # AgentRegistry manages registered agents at this Meeting Place, and the
+  # binding of each agent id to its public key.
+  #
+  # Registration (presence) and binding are separate: an agent entry comes and
+  # goes with registration and heartbeat expiry, while a binding, once made, is
+  # never changed or removed by a request or by fade-out — only by the operator
+  # editing the bindings file with the Place stopped. Clients trust and track
+  # peers by id, so an id must keep meaning after its owner disconnects.
+  #
+  # Bindings live in their own file, written atomically and only when a binding
+  # is created; heartbeats never rewrite it. A bindings file that cannot be read
+  # or parsed stops the Place rather than being taken for an empty table.
   #
-  # Follows PeerManager persistence pattern (JSON file with Mutex).
-  # RSA signature verification on register (rejects unsigned requests).
   # Self-registration support for 主客未分 (subject-object undifferentiated).
   class AgentRegistry
     DEFAULT_REGISTRY_PATH = 'storage/agent_registry.json'
+    DEFAULT_BINDING_RATE_PER_HOUR = 60
+
+    # Raised when the bindings file cannot be read, parsed or written.
+    class BindingStoreError < StandardError; end
 
     Agent = Struct.new(
       :id, :name, :url, :capabilities, :public_key,
@@ -22,28 +36,44 @@ module Hestia
 
     attr_reader :agents
 
-    def initialize(registry_path: nil, config: {})
+    # @param bindings_path [String, nil] Persistent bindings file. nil keeps
+    #   bindings in memory only (unit use); the Place always passes a path.
+    # @param require_bindings_file [Boolean] Refuse to start when the bindings
+    #   file is missing (the Place sets this when other persisted state exists).
+    def initialize(registry_path: nil, config: {}, bindings_path: nil, require_bindings_file: false)
       @registry_path = registry_path || DEFAULT_REGISTRY_PATH
+      @bindings_path = bindings_path
       @agents = {}
+      @bindings = {}
+      @binding_times = []
       @mutex = Mutex.new
       @config = config
+      @binding_rate = (config['binding_rate_per_hour'] || DEFAULT_BINDING_RATE_PER_HOUR).to_i
+      load_bindings(require_file: require_bindings_file) if @bindings_path
       load_registry
     end
 
     # Register an agent at this Meeting Place.
     #
-    # @param id [String] Agent instance_id
-    # @param name [String] Agent display name
-    # @param capabilities [Hash,Array] Agent capabilities
-    # @param public_key [String] RSA public key PEM
-    # @param url [String] Agent endpoint URL (optional)
-    # @param is_self [Boolean] True if this is the Place itself
-    # @param visited_places [Array] Known place URLs (for federation)
-    # @return [Hash] Registration result
+    # When public_key is given it is compared with, or becomes, the id's
+    # binding (compare-and-bind under the registry mutex). A key that differs
+    # from the binding changes nothing and returns status 'key_mismatch'.
+    # A new binding is persisted before anything else is written; a failed
+    # write raises BindingStoreError and registers nothing.
+    #
+    # @return [Hash] { status: 'registered'|'updated'|'key_mismatch'|
+    #   'invalid_key'|'binding_rate_exceeded', agent_id: }
     def register(id:, name:, capabilities: nil, public_key: nil, url: nil, is_self: false,
                  visited_places: [], description: nil, scope: nil)
       now = Time.now.utc.iso8601
       @mutex.synchronize do
+        if public_key
+          bind_result = bind_locked(id, public_key, rate_limited: !is_self)
+          return bind_result.merge(agent_id: id) if bind_result
+
+          public_key = @bindings[id][:public_key]
+        end
+
         existing = @agents[id]
         if existing
           # Update existing registration
@@ -93,7 +123,7 @@ module Hestia
       )
     end
 
-    # Unregister an agent.
+    # Unregister an agent. The id's binding is kept.
     #
     # @param id [String] Agent ID to remove
     # @return [Hash] Result
@@ -132,12 +162,22 @@ module Hestia
       end
     end
 
-    # Get an agent's public key.
+    # The key bound to an id, or nil when the id is unbound.
+    def bound_key(id)
+      @mutex.synchronize { @bindings[id]&.dig(:public_key) }
+    end
+
+    def bound_ids
+      @mutex.synchronize { @bindings.keys }
+    end
+
+    # Get an agent's public key: its binding, which outlives registration, so
+    # signatures still verify after the agent fades out.
     #
     # @param id [String] Agent ID
     # @return [String, nil] Public key PEM or nil
     def public_key_for(id)
-      @mutex.synchronize { @agents[id]&.public_key }
+      @mutex.synchronize { @bindings[id]&.dig(:public_key) || @agents[id]&.public_key }
     end
 
     # Update heartbeat for an agent.
@@ -171,6 +211,40 @@ module Hestia
 
     private
 
+    # Compare-and-bind, called with @mutex held.
+    # @return [Hash, nil] a refusal, or nil when the key is (now) bound to id
+    def bind_locked(id, public_key, rate_limited:)
+      return { status: 'invalid_id' } unless ::MMP::RegistrationProof::AGENT_ID_PATTERN.match?(id.to_s)
+
+      canonical = ::MMP::RegistrationProof.canonical_pem(public_key)
+      return { status: 'invalid_key' } unless canonical
+
+      bound = @bindings[id]
+      if bound
+        return nil if ::MMP::RegistrationProof.same_key?(bound[:public_key], canonical)
+
+        return { status: 'key_mismatch' }
+      end
+
+      if rate_limited
+        prune_binding_times
+        if @binding_times.size >= @binding_rate
+          return { status: 'binding_rate_exceeded', retry_after: (@binding_times.first + 3600 - Time.now.to_f).ceil }
+        end
+      end
+
+      entry = { public_key: canonical, bound_at: Time.now.utc.iso8601 }
+      persist_bindings(@bindings.merge(id => entry))
+      @bindings[id] = entry
+      @binding_times << Time.now.to_f if rate_limited
+      nil
+    end
+
+    def prune_binding_times
+      cutoff = Time.now.to_f - 3600
+      @binding_times.shift while @binding_times.first && @binding_times.first < cutoff
+    end
+
     def agent_to_h(agent)
       h = {
         id: agent.id,
@@ -187,11 +261,66 @@ module Hestia
       h
     end
 
+    # Load bindings. Anything other than a readable JSON object of
+    # id => { "public_key" => PEM } with acceptable keys raises
+    # BindingStoreError, so the Place does not start on a damaged file.
+    def load_bindings(require_file:)
+      unless File.exist?(@bindings_path)
+        if require_file
+          raise BindingStoreError,
+                "Bindings file #{@bindings_path} is missing but other Meeting Place state exists. " \
+                'Restore it, or create it (an empty {} is enough) to confirm starting without bindings.'
+        end
+        return
+      end
+
+      data = JSON.parse(File.read(@bindings_path))
+      raise BindingStoreError, "Bindings file #{@bindings_path} must hold a JSON object" unless data.is_a?(Hash)
+
+      data.each do |id, entry|
+        unless ::MMP::RegistrationProof::AGENT_ID_PATTERN.match?(id) && entry.is_a?(Hash)
+          raise BindingStoreError, "Bindings file #{@bindings_path}: malformed entry #{id.inspect}"
+        end
+
+        canonical = ::MMP::RegistrationProof.canonical_pem(entry['public_key'])
+        raise BindingStoreError, "Bindings file #{@bindings_path}: unusable public key for #{id}" unless canonical
+
+        @bindings[id] = { public_key: canonical, bound_at: entry['bound_at'] }
+      end
+    rescue JSON::ParserError, SystemCallError, IOError => e
+      raise BindingStoreError, "Bindings file #{@bindings_path} cannot be read: #{e.message}"
+    end
+
+    # Write the whole table atomically; raise on failure so no session is
+    # issued on a binding that is not on disk.
+    def persist_bindings(table)
+      return unless @bindings_path
+
+      temp = nil
+      FileUtils.mkdir_p(File.dirname(@bindings_path))
+      data = table.transform_values { |e| { 'public_key' => e[:public_key], 'bound_at' => e[:bound_at] } }
+      temp = "#{@bindings_path}.tmp.#{Process.pid}.#{SecureRandom.hex(4)}"
+      File.open(temp, 'w') do |f|
+        f.write(JSON.pretty_generate(data))
+        f.flush
+        f.fsync
+      end
+      File.rename(temp, @bindings_path)
+    rescue SystemCallError, IOError => e
+      File.unlink(temp) if temp && File.exist?(temp)
+      raise BindingStoreError, "Bindings file #{@bindings_path} cannot be written: #{e.message}"
+    end
+
     def load_registry
       @mutex.synchronize do
         if File.exist?(@registry_path)
           data = JSON.parse(File.read(@registry_path), symbolize_names: true)
           (data[:agents] || []).each do |a|
+            # With a persistent bindings store, an entry without a binding is
+            # not loaded: its key was never saved, and a registered id must
+            # have a binding.
+            next if @bindings_path && !@bindings.key?(a[:id])
+
             @agents[a[:id]] = Agent.new(**a)
           end
         end