kairos-chain 3.98.0 → 3.99.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e312be42d3199a05aa52884dcf3370148369c0849df71492fd1c9ab1f79b57be
-  data.tar.gz: 87797db9bd4bdee55f8a5fe7a0fe341a55acc5f642808b3b885e441a66c632fa
+  metadata.gz: dcd329b502a42f94e178401c12cfa06ada118c54d1b5cb369b90964fa5e08efd
+  data.tar.gz: 525e9e08b274f514c8448330d0448d54ecf25ac06943a14f41ec0004718304e5
 SHA512:
-  metadata.gz: 6f0d61ef92ff884f20171cabcbe6222f2423e90937db362074b85abe074ac6bb05d1c21248935bcdeb667cecb9a6967fa261ab93cb37a46b6ba5064d93dbcc96
-  data.tar.gz: 1b806a572ffbfdfd5db978294e140e3682a9f532e1c916eeca4c81cfd8a3aa4193a5c61c5efc9a51fdfdfb9e99a2ec1f31a93b8bce8468fcabdc9082ae557a6d
+  metadata.gz: 7719ba8c1e91b9f592a4e781acb5161a20108c8a776bf22f41d3edf186d335c14c815609d8e8878e1001135786857a5cba67c1b1592ead2914f9b8698c21f4a4
+  data.tar.gz: 212ae7282fedae1a06c3a410c80ffa660ce7bec0cd9d725f52b35763d1441f77b1548b8b96b37173ecfc827cb2ff461c826928d80697a79e792ea90674821cff

data/CHANGELOG.md

@@ -6,6 +6,49 @@ This project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [3.99.0] - 2026-10-25
+
+### Security — Secure MMP v1: MMP direct mode discloses only what is public, and can admit only pinned keys (mmp 1.3.0, secure_mmp 0.1.0)
+
+MMP direct mode listed every L1 entry with its file path to unauthenticated peers, served the body of a
+private entry to anyone holding a session, and took a static identity signature — published and identical
+every time — as proof of who a peer is. This release makes it safe to leave direct mode listening between
+two machines.
+
+- **Disclosure.** Listing, details, content, the card and every introduce draw from one public set, and no
+  response carries a filesystem path. A name that is not served is answered exactly as an unknown name.
+  Publicity belongs to an L1 entry and is decided by its main file (`public: true`, or `public_by_default`
+  in `meeting.yml`); other files under the entry inherit it and can only narrow it. A file whose front
+  matter is opened but cannot be read is private.
+- **Admission.** `kairos-chain --http --admission pinned` issues direct-mode sessions only to keys the
+  pinned decider admits, presented with a fresh, single-use proof addressed to this listener
+  (`--origin URL`, repeatable). Whatever the policy cannot read or verify admits nobody, and only sessions
+  the listener issued are honoured. Without `--admission` a listener behaves as before.
+- **Records.** Pins and SkillSet publications are chain records signed by the instance's MMP key, forming
+  their own sequence (each names the one before), verified in core. A copy of an earlier record counts for
+  nothing; a record signed by another key is ignored and logged once. They are written by operator
+  commands — `kairos-chain peer pin add <alias> <key_sha256> --url URL`, `peer pin revoke`, `peer pin
+  list`, `skillset publish|unpublish <name>` — which never generate a key. The `peer_pin` MCP tool can list,
+  revoke and show refused knocks, never add.
+- **Meeting-only listener.** `--http --meeting-only` serves only `/meeting/v1/*` and `/health`, loads every
+  enabled SkillSet that depends on mmp, and limits request bodies to 256 KiB (needs Puma's
+  `http_content_length_limit`). On a non-loopback address it starts only with an explicit `--admission`.
+- **secure_mmp 0.1.0** ships as a gem template and is not installed automatically: install it by name.
+
+**Upgrade notes**
+
+- Per-entry publicity can make sub-documents of existing `public: true` entries public: a Meeting Place
+  host with public entries exposes their other files after upgrading. Mark sub-documents `public: false`
+  where needed.
+- SkillSets are not served in direct mode until published (`kairos-chain skillset publish <name>`).
+  Nothing is published by the upgrade.
+- Under this core, mmp below 1.3.0 answers `503 mmp_upgrade_required` on `/meeting/*`. Upgrade the mmp
+  SkillSet together with the gem, and run gem ≥ 3.99.0 in every process that uses a data dir before
+  upgrading it.
+
+Design frozen at v0.4 after three design-review rounds; six implementation-review rounds, the last
+(codex) approving with no blocking finding.
+
 ## [3.98.0] - 2026-10-24
 
 ### Added — L1 `photo_song_slideshow`: photos → song → slideshow or music video

data/bin/kairos-chain

@@ -290,6 +290,34 @@ when 'skillset'
       exit 1
     end
 
+  when 'publish', 'unpublish'
+    # Secure MMP v1: a signed chain record decides which SkillSets direct-mode
+    # peers may fetch. Operator command — the agent's MCP tools cannot publish.
+    name = ARGV.shift
+    unless name
+      $stderr.puts "Usage: kairos-chain skillset #{action} <name> [--data-dir DIR]"
+      exit 1
+    end
+    require 'kairos_mcp/admission_commands'
+    begin
+      result = KairosMcp::AdmissionCommands.public_send(action, name)
+      puts "Data dir: #{result[:data_dir]}"
+      puts "Ledger:   #{result[:ledger]}"
+      puts "Key:      #{result[:key_sha256]}"
+      if result[:recorded]
+        puts "#{action == 'publish' ? 'Published' : 'Unpublished'} '#{name}' (record seq #{result[:record]['seq']}, content #{result[:record]['content_hash'][0, 16]}…)"
+      else
+        puts "Nothing recorded: #{result[:reason]}"
+      end
+    rescue KairosMcp::AdmissionRecords::Error => e
+      $stderr.puts "Error: #{e.message}"
+      exit 1
+    rescue StandardError => e
+      $stderr.puts "Error: #{e.class}: #{e.message}"
+      $stderr.puts "It is not known whether the record landed; re-run `kairos-chain skillset #{action} #{name}` — it says so if it is already recorded."
+      exit 1
+    end
+
   when 'install-archive'
     source = ARGV.shift
     archive_json = if source && source != '-'
@@ -329,6 +357,88 @@ when 'skillset'
     puts "  info <name>                        Show SkillSet details"
     puts "  package <name>                     Package a knowledge-only SkillSet as JSON archive"
     puts "  install-archive <file|->           Install a SkillSet from JSON archive"
+    puts "  publish <name>                     Let direct-mode MMP peers fetch this SkillSet (signed record)"
+    puts "  unpublish <name>                   Stop serving it to direct-mode peers"
+  end
+  exit
+
+when 'peer'
+  # Secure MMP v1 admission records. Operator commands: run them yourself
+  # (in a terminal or with `!` in Claude Code); the agent may only revoke.
+  ARGV.shift
+  $LOAD_PATH.unshift File.expand_path('../lib', __dir__)
+  require 'kairos_mcp'
+  if (idx = ARGV.index('--data-dir'))
+    KairosMcp.data_dir = File.expand_path(ARGV[idx + 1])
+    ARGV.delete_at(idx + 1)
+    ARGV.delete_at(idx)
+  end
+  require 'kairos_mcp/admission_commands'
+
+  print_context = lambda do |r|
+    puts "Data dir: #{r[:data_dir]}"
+    puts "Ledger:   #{r[:ledger]}"
+    puts "Key:      #{r[:key_sha256] || '(no MMP keypair — nothing can be recorded)'}"
+  end
+
+  group = ARGV.shift
+  action = ARGV.shift
+  begin
+    case [group, action]
+    when %w[pin add]
+      alias_name = ARGV.shift
+      key = ARGV.shift
+      url = (idx = ARGV.index('--url')) ? ARGV[idx + 1] : nil
+      unless alias_name && key && url
+        $stderr.puts 'Usage: kairos-chain peer pin add <alias> <key_sha256> --url http://HOST:PORT [--data-dir DIR]'
+        exit 1
+      end
+      r = KairosMcp::AdmissionCommands.pin_add(alias_name, key, url: url)
+      print_context.call(r)
+      if r[:recorded]
+        puts "Pinned #{alias_name} = #{r[:record]['key_sha256']} at #{r[:record]['url']} (record seq #{r[:record]['seq']})"
+        puts "  Replaces #{r[:replaces]} for this alias." if r[:replaces]
+      else
+        puts "Nothing recorded: #{r[:reason]}"
+      end
+    when %w[pin revoke]
+      target = ARGV.shift
+      unless target
+        $stderr.puts 'Usage: kairos-chain peer pin revoke <alias|key_sha256> [--data-dir DIR]'
+        exit 1
+      end
+      r = KairosMcp::AdmissionCommands.pin_revoke(target)
+      print_context.call(r)
+      puts "Revoked #{r[:record]['alias']} = #{r[:record]['key_sha256']} (record seq #{r[:record]['seq']})"
+    when %w[pin list], ['pin', nil]
+      r = KairosMcp::AdmissionCommands.pin_list
+      print_context.call(r)
+      puts "Records:  #{r[:status]}#{r[:cause] ? " (#{r[:cause]})" : ''}"
+      if r[:pins].empty?
+        puts 'No admitted pins.'
+      else
+        r[:pins].each { |p| puts "  #{p['alias'].ljust(16)} #{p['key_sha256']}  #{p['url']}  since #{p['added_at']}" }
+      end
+      unless r[:ignored_records].empty?
+        puts "Ignored records (unsigned, other key, out of sequence): #{r[:ignored_records].size}"
+        r[:ignored_records].last(5).each { |i| puts "  block #{i['block']} #{i['type']}: #{i['reason']}" }
+      end
+    else
+      puts 'Usage: kairos-chain peer pin <add|revoke|list> ...'
+      puts ''
+      puts '  pin add <alias> <key_sha256> --url http://HOST:PORT   Admit this key (signed chain record)'
+      puts '  pin revoke <alias|key_sha256>                        Stop admitting it'
+      puts '  pin list                                             Show admitted keys'
+      puts ''
+      puts 'A listener enforces pins only when started with --admission pinned.'
+    end
+  rescue KairosMcp::AdmissionRecords::Error => e
+    $stderr.puts "Error: #{e.message}"
+    exit 1
+  rescue StandardError => e
+    $stderr.puts "Error: #{e.class}: #{e.message}"
+    $stderr.puts 'It is not known whether a record landed; re-run `kairos-chain peer pin list` to see.'
+    exit 1
   end
   exit
 
@@ -840,6 +950,18 @@ OptionParser.new do |opts|
     options[:tls] = true
   end
 
+  opts.on('--meeting-only', 'With --http: serve only /meeting/v1/* and /health (no /mcp, /admin, /place)') do
+    options[:meeting_only] = true
+  end
+
+  opts.on('--admission POLICY', 'With --http: direct-mode admission policy (open, or a decider such as pinned)') do |policy|
+    options[:admission] = policy
+  end
+
+  opts.on('--origin URL', 'With --admission: an origin peers dial to reach this listener (repeatable)') do |url|
+    (options[:origins] ||= []) << url
+  end
+
   opts.on('--gen-cert', 'Generate a self-signed TLS cert/key for --tls and exit') do
     options[:gen_cert] = true
   end
@@ -1083,6 +1205,19 @@ if options[:init_admin]
   exit
 end
 
+# Listener flags mean nothing without --http; refuse rather than start stdio.
+if !options[:http] && (options[:meeting_only] || options[:admission] || options[:origins])
+  $stderr.puts '[ERROR] --meeting-only, --admission and --origin apply only with --http.'
+  exit 1
+end
+
+# A meeting-only listener never creates a data directory: a mistyped
+# --data-dir would otherwise start an empty instance with a fresh key.
+if options[:http] && options[:meeting_only] && !KairosMcp.initialized?
+  $stderr.puts "[ERROR] --meeting-only: no initialized data directory at #{KairosMcp.data_dir}; refusing to create one."
+  exit 1
+end
+
 # Auto-initialize if data directory doesn't exist
 unless KairosMcp.initialized?
   $stderr.puts "[KairosChain] Data directory not initialized at: #{KairosMcp.data_dir}"
@@ -1095,11 +1230,24 @@ end
 if options[:http]
   require 'kairos_mcp/http_server'
 
+  origins = Array(options[:origins]).map do |url|
+    require 'kairos_mcp/admission_commands'
+    normalized = KairosMcp::AdmissionCommands.normalize_origin(url)
+    unless normalized
+      $stderr.puts "[ERROR] --origin #{url.inspect} is not http(s)://host[:port]"
+      exit 1
+    end
+    normalized
+  end
+
   server = KairosMcp::HttpServer.new(
     port: options[:port],
     host: options[:host],
     token_store_path: options[:token_store],
-    tls: options[:tls]
+    tls: options[:tls],
+    meeting_only: options[:meeting_only],
+    admission: options[:admission],
+    origins: origins
   )
   server.run
 else

data/lib/kairos_mcp/admission_commands.rb

@@ -0,0 +1,120 @@
+# frozen_string_literal: true
+
+require 'uri'
+require_relative 'admission_records'
+
+module KairosMcp
+  # Operator commands behind `kairos-chain peer pin …` and
+  # `kairos-chain skillset publish|unpublish` (secure MMP v1, I4).
+  #
+  # Each returns a Hash and raises AdmissionRecords::Error when nothing was
+  # recorded. Additions and publications are reached only from the CLI;
+  # the peer_pin MCP tool reaches revoke alone.
+  module AdmissionCommands
+    DEFAULT_PORTS = { 'https' => 443, 'http' => 80 }.freeze
+
+    module_function
+
+    def records
+      AdmissionRecords.for_data_dir(KairosMcp.data_dir)
+    end
+
+    # Where a command acts, so the operator can see it before trusting it.
+    def context
+      r = records
+      {
+        data_dir: KairosMcp.data_dir,
+        ledger: r.ledger_path,
+        key_sha256: r.own_key_sha256
+      }
+    end
+
+    # "scheme://host[:port]", lowercased, default port dropped; nil if not http(s).
+    def normalize_origin(url)
+      uri = URI.parse(url.to_s.strip)
+      scheme = uri.scheme&.downcase
+      return nil unless DEFAULT_PORTS.key?(scheme) && uri.host && !uri.host.empty?
+      return nil unless uri.path.to_s.empty? || uri.path == '/'
+      return nil if uri.query || uri.fragment || uri.userinfo
+
+      host = uri.host.downcase
+      host = "[#{host}]" if host.include?(':') && !host.start_with?('[')
+      uri.port && uri.port != DEFAULT_PORTS[scheme] ? "#{scheme}://#{host}:#{uri.port}" : "#{scheme}://#{host}"
+    rescue URI::InvalidURIError
+      nil
+    end
+
+    def pin_add(alias_name, key_sha256, url:)
+      alias_name = alias_name.to_s
+      key_sha256 = key_sha256.to_s.downcase.delete(':')
+      origin = normalize_origin(url)
+      raise AdmissionRecords::Error, "url must be http(s)://host[:port] with nothing after it (got #{url.inspect})" unless origin
+      raise AdmissionRecords::Error, 'this key is this instance\'s own key' if key_sha256 == records.own_key_sha256
+
+      existing = records.pin_for_alias(alias_name)
+      if existing && existing['key_sha256'] == key_sha256 && existing['url'] == origin
+        return { recorded: false, reason: 'already pinned', pin: existing }.merge(context)
+      end
+
+      replaces = existing && existing['key_sha256'] != key_sha256 ? existing['key_sha256'] : nil
+      record = records.append(AdmissionRecords::PIN,
+                              { 'action' => 'add', 'alias' => alias_name, 'key_sha256' => key_sha256,
+                                'url' => origin, 'replaces' => replaces },
+                              private_key: AdmissionRecords.load_private_key(KairosMcp.data_dir))
+      { recorded: true, record: record, replaces: replaces }.merge(context)
+    end
+
+    # target: an alias or a full key hash.
+    def pin_revoke(target)
+      target = target.to_s.downcase.delete(':')
+      pin = records.admitted_pins.find { |p| p['alias'] == target || p['key_sha256'] == target }
+      raise AdmissionRecords::Error, "no admitted pin matches #{target.inspect}" unless pin
+
+      record = records.append(AdmissionRecords::PIN,
+                              { 'action' => 'revoke', 'alias' => pin['alias'], 'key_sha256' => pin['key_sha256'] },
+                              private_key: AdmissionRecords.load_private_key(KairosMcp.data_dir))
+      { recorded: true, record: record }.merge(context)
+    end
+
+    def pin_list
+      r = records
+      st = r.state
+      {
+        status: st.status, cause: st.cause,
+        pins: r.admitted_pins,
+        ignored_records: st.ignored
+      }.merge(context)
+    end
+
+    def publish(name)
+      skillset = find_skillset(name)
+      raise AdmissionRecords::Error, "SkillSet '#{name}' is not exchangeable (it contains code), so it cannot be published" unless skillset.exchangeable?
+
+      if records.published?(skillset.name, skillset.content_hash)
+        return { recorded: false, reason: 'already published at this content', name: skillset.name,
+                 content_hash: skillset.content_hash }.merge(context)
+      end
+
+      record = records.append(AdmissionRecords::PUBLICATION,
+                              { 'action' => 'publish', 'name' => skillset.name, 'content_hash' => skillset.content_hash },
+                              private_key: AdmissionRecords.load_private_key(KairosMcp.data_dir))
+      { recorded: true, record: record }.merge(context)
+    end
+
+    def unpublish(name)
+      skillset = find_skillset(name)
+      record = records.append(AdmissionRecords::PUBLICATION,
+                              { 'action' => 'unpublish', 'name' => skillset.name, 'content_hash' => skillset.content_hash },
+                              private_key: AdmissionRecords.load_private_key(KairosMcp.data_dir))
+      { recorded: true, record: record }.merge(context)
+    end
+
+    def find_skillset(name)
+      require_relative 'skillset_manager'
+      skillset = SkillSetManager.new.find_skillset(name.to_s)
+      raise AdmissionRecords::Error, "no SkillSet named #{name.inspect}" unless skillset
+
+      skillset
+    end
+  end
+end