kairos-chain 3.57.0 → 3.58.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8439763123a17e68d238ebc46369dcc36e6379172752809dd6736fa18f3c5ec4
-  data.tar.gz: 76fe818c7261e464411f54bee9a114bc7eb0ecc025042ef264f15bd591f2ca36
+  metadata.gz: 9d24490106b19ca11e1e04e37a6d406ff8a191563957bb7c029fecf191593237
+  data.tar.gz: 0bcf20859249713fdafe723477a1fda62da79061b09bd4e7d76efcc5d78f0af2
 SHA512:
-  metadata.gz: 2385335588b313d3910519459a79a1325f921fa1f6d1a2b215f0b75144c383b14b90a95f1d9edf97999df6cdc58d95155e653f13007217299f35df097891f38a
-  data.tar.gz: 160f831a399a60089d217e2fe198dfe60692797649b55c2d8b4fbd0d0649512c6f601a75dfc41de713b9bf946be83485f01c289252018c87d33dbbb06221c1ec
+  metadata.gz: d438c2e198ac55990b65a7e124878de1fda2fce6312bd5bfbad0256795b9990addd4ba9b44d3d5b81b572990351f726a3cea7e8ca1e8b6e1a76e6b74f749adc8
+  data.tar.gz: 10184876b0611bbb2590a36c5a7a36a9e3f9e4fc1c1ad3aab43c7df3bc53961516feb9dbd2900a649239ee02b4f942d973148cabbccb8d3010d041fc710918b4

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.57.0"
+  VERSION = "3.58.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/skillsets/llm_client/config/llm_client.yml

@@ -10,7 +10,7 @@
 #   local        — Local model via OpenAI-compatible API (Ollama, vLLM)
 
 provider: claude_code
-model: claude-opus-5
+model: claude-opus-4-6
 # api_key_env not needed for claude_code provider — uses Claude Code subscription
 default_max_tokens: 4096
 default_temperature: 0.7
@@ -41,11 +41,8 @@ timeout_seconds: 600
 
 # Cost estimates (USD per 1M tokens, for llm_status display)
 cost_estimates:
-  claude-opus-5: { input: 5.0, output: 25.0 }
-  claude-fable-5: { input: 10.0, output: 50.0 }
-  claude-opus-4-6: { input: 5.0, output: 25.0 }
-  claude-sonnet-5: { input: 3.0, output: 15.0 }
   claude-sonnet-4-6: { input: 3.0, output: 15.0 }
-  claude-haiku-4-5: { input: 1.0, output: 5.0 }
+  claude-haiku-4-5: { input: 0.80, output: 4.0 }
+  claude-opus-4-6: { input: 15.0, output: 75.0 }
   gpt-4o: { input: 2.50, output: 10.0 }
   gpt-4o-mini: { input: 0.15, output: 0.60 }

data/templates/skillsets/synoptis/lib/synoptis/proof_envelope.rb

@@ -9,30 +9,34 @@ module Synoptis
   class ProofEnvelope
     PROOF_VERSION = '1.0.0'
 
-    # 1.1.0 adds two identity fields to the canonical form: attester_pubkey (the
-    # key that signed) and submitter_pubkey (the party that handed over the
-    # content). The version selects the canonical field set, so an envelope
-    # signed under 1.0.0 keeps verifying against the same bytes it was signed
-    # over — adding fields unconditionally would have invalidated every existing
-    # signature.
+    # 1.1.0 adds one identity field to the canonical form: submitter_pubkey, the
+    # party that handed over the content, as distinct from attester_id, which
+    # names the anchor that recorded it. The version selects the canonical field
+    # set, so an envelope signed under 1.0.0 keeps verifying against the same
+    # bytes it was signed over — adding fields unconditionally would have
+    # invalidated every existing signature.
+    #
+    # It deliberately does NOT carry attester_pubkey. An earlier revision put the
+    # signing key in the canonical form so a reader could verify from the record
+    # alone; the version field is itself a field of the record, so a forger could
+    # write version 1.1.0, name any attester, sign with their own key, record that
+    # key alongside, and obtain valid: true from a key-less verification. Ruling of
+    # 2026-08-02 (option A2): the key is never taken from the record. Verification
+    # needs a key supplied by the caller, which is where authenticity has to come
+    # from anyway — binding a key to a named attester requires a trusted key list
+    # this layer does not have.
     PROOF_VERSION_WITH_IDENTITY = '1.1.0'
     VERSIONS_CARRYING_IDENTITY = [PROOF_VERSION_WITH_IDENTITY].freeze
 
     attr_reader :proof_id, :version, :attester_id, :subject_ref, :claim,
                 :evidence, :merkle_root, :signature, :timestamp, :ttl,
-                :actor_user_id, :actor_role, :metadata, :submitter_pubkey,
-                :attester_pubkey
+                :actor_user_id, :actor_role, :metadata, :submitter_pubkey
 
     def initialize(attrs = {})
       attrs = attrs.transform_keys(&:to_sym) if attrs.is_a?(Hash)
       @proof_id = attrs[:proof_id] || SecureRandom.uuid
       @submitter_pubkey = attrs[:submitter_pubkey]
-      @attester_pubkey = attrs[:attester_pubkey]
-      # Either identity field selects the version. Keying off one of them let a
-      # caller hand over the attester key in good faith and get an envelope that
-      # stores it outside the signature.
-      @version = attrs[:version] ||
-                 ((@submitter_pubkey || @attester_pubkey) ? PROOF_VERSION_WITH_IDENTITY : PROOF_VERSION)
+      @version = attrs[:version] || (@submitter_pubkey ? PROOF_VERSION_WITH_IDENTITY : PROOF_VERSION)
       @attester_id = attrs[:attester_id]
       @subject_ref = attrs[:subject_ref]
       @claim = attrs[:claim]
@@ -61,8 +65,7 @@ module Synoptis
         actor_user_id: @actor_user_id,
         actor_role: @actor_role,
         metadata: @metadata,
-        submitter_pubkey: @submitter_pubkey,
-        attester_pubkey: @attester_pubkey
+        submitter_pubkey: @submitter_pubkey
       }
     end
 
@@ -87,10 +90,7 @@ module Synoptis
         timestamp: @timestamp,
         ttl: @ttl
       }
-      if carries_identity_fields?
-        canonical[:attester_pubkey] = @attester_pubkey
-        canonical[:submitter_pubkey] = @submitter_pubkey
-      end
+      canonical[:submitter_pubkey] = @submitter_pubkey if carries_identity_fields?
       JSON.generate(canonical, sort_keys: true)
     end
 
@@ -102,9 +102,8 @@ module Synoptis
     end
 
     # An identity field present at a version whose canonical form does not carry
-    # it is a value sitting outside the signature. The rule is about the field
-    # set, not about one field: naming only the submitter left the attester —
-    # the field the Verifier reaches for when no key is supplied — unguarded.
+    # it is a value sitting outside the signature — displayed as if it were part
+    # of the record while nothing binds it to the signed bytes.
     #
     # Deserialisation must not raise on it, because from_h is the read path and
     # a stored or third-party record of this shape would otherwise take down
@@ -113,7 +112,7 @@ module Synoptis
     def identity_outside_signature?
       return false if carries_identity_fields?
 
-      !(@submitter_pubkey.nil? && @attester_pubkey.nil?)
+      !@submitter_pubkey.nil?
     end
 
     def content_hash
@@ -130,15 +129,13 @@ module Synoptis
 
     # Accepts an MMP::Crypto instance (which holds the private key internally).
     #
-    # From 1.1.0 the signing key is recorded by the act of signing and is itself
-    # inside the bytes being signed, so a reader can check the signature from the
-    # record alone instead of being handed a key out of band. What that does NOT
-    # establish is that the key belongs to the party named in attester_id — that
-    # needs a trusted key list, which this layer does not have.
+    # Signing does not record the signing key. A key recorded by the signer is a
+    # self-report: it tells a reader which key to check against only if the reader
+    # already trusts whoever wrote the record, which is the thing being checked.
+    # The verifying key travels out of band (see PROOF_VERSION_WITH_IDENTITY).
     def sign!(crypto)
       return unless crypto
 
-      @attester_pubkey = crypto.export_public_key if carries_identity_fields?
       @signature = crypto.sign(canonical_json)
     end
 

data/templates/skillsets/synoptis/lib/synoptis/tool_helpers.rb

@@ -4,7 +4,14 @@ require 'yaml'
 require 'fileutils'
 
 module Synoptis
+  # Raised when this instance cannot name the agent performing a recorded action.
+  # A distinct class so callers can tell "we do not know who this is" apart from
+  # the MMP loading failures that produce it; see ToolHelpers#resolve_agent_id.
+  class UnattributableAgentError < StandardError; end
+
   module ToolHelpers
+    UNATTRIBUTABLE_MESSAGE =
+      'agent identity unavailable; refusing to record an action that could not be attributed'
     def synoptis_data_dir
       dir = File.join(KairosMcp.data_dir, 'synoptis_data')
       FileUtils.mkdir_p(dir)
@@ -80,14 +87,30 @@ module Synoptis
     # instance_id, not introduce: both yield the same identifier, but introduce
     # also globs skills, scans skillsets and signs, so it raises for reasons
     # unrelated to identity (a partially loaded MMP raises NameError on
-    # MMP::VERSION). Returns nil rather than the string 'unknown' on failure:
-    # 'unknown' is non-empty, so every attributability check passed and every
-    # anchor in that state shared one attester id — which RevocationManager
-    # treats as authority to revoke each other's proofs.
+    # MMP::VERSION).
+    #
+    # Raises rather than returning a placeholder. Two placeholders were tried and
+    # both collapsed identity: 'unknown' is non-empty, so every attributability
+    # check passed and every anchor in that state shared one attester id; nil then
+    # became '' at the comparison sites, and '' matches more records than 'unknown'
+    # did — RevocationManager authorises on revoker_id == attester_id, and
+    # ChallengeManager compares against envelope&.attester_id.to_s, which is ''
+    # for a proof that was not found (measured, 2026-08-02).
+    #
+    # The comparison sites are five and growing; a guard at each is a guard that a
+    # sixth caller will not have. Raising makes a blank identity unrepresentable at
+    # the one place it is produced. Callers do not rescue this: an operation that
+    # cannot name its actor must not proceed, and Protocol#handle already turns the
+    # exception into an error response carrying this message.
     def resolve_agent_id
-      mmp_identity.instance_id
-    rescue StandardError
-      nil
+      id = mmp_identity.instance_id
+      raise UnattributableAgentError, UNATTRIBUTABLE_MESSAGE if id.nil? || id.to_s.strip.empty?
+
+      id
+    rescue UnattributableAgentError
+      raise
+    rescue StandardError => e
+      raise UnattributableAgentError, "#{UNATTRIBUTABLE_MESSAGE} (#{e.class}: #{e.message})"
     end
 
     def resolve_actor_user_id

data/templates/skillsets/synoptis/lib/synoptis/verifier.rb

@@ -18,27 +18,24 @@ module Synoptis
       errors << 'identity_outside_signature' if envelope.identity_outside_signature?
 
       if envelope.signature
-        # From envelope version 1.1.0 the signing key is inside the signed
-        # payload, so a reader needs nothing handed to it. A caller may still
-        # supply a key; if it disagrees with the recorded one the envelope is
-        # not the one that caller means, which is a mismatch rather than a
-        # broken signature.
-        # Only at a version whose canonical form covers it: at 1.0.0 the field
-        # is outside the signature, so trusting it would let anyone mint a
-        # record naming any attester, sign it with their own key, record that
-        # key alongside, and have the reader accept it.
-        recorded = envelope.carries_identity_fields? ? envelope.attester_pubkey : nil
+        # The verifying key comes from the caller and only from the caller.
+        # Reading it out of the envelope would make the record self-certifying:
+        # the version field selects the canonical field set and is itself a field
+        # of the record, so a forger could label a record 1.1.0, name any
+        # attester, sign with their own key, record that key alongside, and have
+        # a key-less verification return valid: true (measured, 2026-08-02).
+        # Ruling of 2026-08-02 (option A2): no key is ever taken from the record.
+        #
+        # An empty string is treated as "no key supplied" rather than passed
+        # through: MCP clients routinely send '' for an omitted optional string,
+        # and handing that to the crypto layer would report invalid_signature —
+        # a claim about the signature, when nothing about the signature is known.
         supplied = public_key.to_s.strip.empty? ? nil : public_key
 
-        if supplied && recorded && !keys_equal?(supplied, recorded)
-          errors << 'attester_key_mismatch'
+        if supplied
+          errors << 'invalid_signature' unless verify_signature(envelope, supplied)
         else
-          key = supplied || recorded
-          if key
-            errors << 'invalid_signature' unless verify_signature(envelope, key)
-          else
-            errors << 'no_public_key_for_verification'
-          end
+          errors << 'no_public_key_for_verification'
         end
       elsif @require_signature
         errors << 'missing_signature'
@@ -54,17 +51,6 @@ module Synoptis
 
     private
 
-    # PEM text can differ in line endings and trailing whitespace while naming
-    # the same key, so compare the parsed keys rather than the strings.
-    def keys_equal?(one, other)
-      return one.to_s.strip == other.to_s.strip unless defined?(::MMP::Crypto)
-
-      crypto = MMP::Crypto.new(auto_generate: false)
-      crypto.import_public_key(one.to_s).to_pem == crypto.import_public_key(other.to_s).to_pem
-    rescue StandardError
-      one.to_s.strip == other.to_s.strip
-    end
-
     def verify_signature(envelope, public_key)
       return false unless defined?(::MMP::Crypto)
 

data/templates/skillsets/synoptis/test/test_agent_identity.rb

@@ -0,0 +1,129 @@
+# frozen_string_literal: true
+
+# ToolHelpers#resolve_agent_id — the one place a recorded action's actor is named.
+#
+# R4 (2026-08-01) found this method had no test at all: reverting it left every
+# suite green. Two placeholder returns had already been tried and both collapsed
+# identity, so the behaviour under test here is that there is no placeholder.
+#
+#   'unknown'  non-empty, so every attributability check passed and all anchors
+#              in that state shared one attester id
+#   nil        became '' at the comparison sites, and '' matches more records
+#              than 'unknown' did (a proof that is not found yields nil.to_s)
+#
+# Ruling of 2026-08-02: raise instead, so a blank identity is unrepresentable at
+# the point of production rather than guarded at each of five comparison sites.
+
+project_root = File.expand_path('../../../..', __dir__)
+mmp_lib = File.join(project_root, 'KairosChain_mcp_server', 'templates', 'skillsets', 'mmp', 'lib')
+$LOAD_PATH.unshift(mmp_lib) unless $LOAD_PATH.include?(mmp_lib)
+synoptis_lib = File.expand_path('../lib', __dir__)
+$LOAD_PATH.unshift(synoptis_lib) unless $LOAD_PATH.include?(synoptis_lib)
+
+require 'synoptis/tool_helpers'
+
+$pass = 0
+$fail = 0
+
+def assert(condition, message)
+  if condition
+    $pass += 1
+    puts "  PASS: #{message}"
+  else
+    $fail += 1
+    puts "  FAIL: #{message}"
+  end
+end
+
+def section(title)
+  puts "\n#{'=' * 60}"
+  puts "SECTION: #{title}"
+  puts '=' * 60
+end
+
+# A host that yields whatever identity the case under test needs. Only
+# mmp_identity is stubbed; resolve_agent_id itself is the shipped method.
+class IdentityHost
+  include Synoptis::ToolHelpers
+
+  def initialize(&block)
+    @block = block
+  end
+
+  def mmp_identity
+    @block.call
+  end
+end
+
+def resolve(&block)
+  IdentityHost.new(&block).resolve_agent_id
+end
+
+def raises_unattributable?(&block)
+  resolve(&block)
+  false
+rescue Synoptis::UnattributableAgentError
+  true
+end
+
+# ============================================================
+section '1. A resolvable identity is returned unchanged'
+# ============================================================
+
+id = resolve { Struct.new(:instance_id).new('anchor-instance-0001') }
+assert id == 'anchor-instance-0001', 'a resolvable instance_id is returned as-is'
+
+# ============================================================
+section '2. No blank identity is ever produced'
+# ============================================================
+
+[[nil, 'nil'], ['', 'empty string'], ['   ', 'whitespace only']].each do |value, label|
+  assert raises_unattributable? { Struct.new(:instance_id).new(value) },
+         "#{label} raises UnattributableAgentError instead of being returned"
+end
+
+assert raises_unattributable? { raise NameError, 'uninitialized constant MMP::VERSION' },
+       'a partially loaded MMP raises UnattributableAgentError, not a placeholder'
+
+assert raises_unattributable? { raise StandardError, 'registry unavailable' },
+       'any other failure to resolve raises UnattributableAgentError'
+
+# ============================================================
+section '3. The placeholders that collapsed identity are not reachable'
+# ============================================================
+
+# These are the two values the comparison sites treated as authority. Neither can
+# come out of resolve_agent_id now; the assertions state which comparison each one
+# used to satisfy, so a revision that reintroduces a placeholder fails here.
+begin
+  produced = []
+  [nil, '', '   ', 'x'].each do |value|
+    produced << (resolve { Struct.new(:instance_id).new(value) } rescue :raised)
+  end
+  assert !produced.include?('unknown'),
+         "'unknown' is unreachable (RevocationManager authorises on revoker_id == attester_id)"
+  assert produced.none? { |p| p.is_a?(String) && p.strip.empty? },
+         "'' is unreachable (ChallengeManager compares against envelope&.attester_id.to_s)"
+  assert produced.count(:raised) == 3, 'exactly the three blank inputs raised'
+  assert produced.last == 'x', 'a non-blank identity still passes through'
+end
+
+# ============================================================
+section '4. The error carries why, not just that'
+# ============================================================
+
+begin
+  resolve { raise NameError, 'uninitialized constant MMP::VERSION' }
+rescue Synoptis::UnattributableAgentError => e
+  assert e.message.include?('refusing to record'), 'the message states the refusal'
+  assert e.message.include?('NameError'), 'the message keeps the underlying cause'
+  assert Synoptis::UnattributableAgentError < StandardError,
+         'the error is a StandardError so Protocol#handle turns it into an error response'
+end
+
+# ============================================================
+puts "\n#{'=' * 60}"
+puts "FINAL RESULTS: #{$pass} passed, #{$fail} failed"
+puts '=' * 60
+
+exit(1) if $fail > 0

data/templates/skillsets/synoptis/tools/attestation_verify.rb

@@ -32,7 +32,7 @@ module KairosMcp
               type: 'object',
               properties: {
                 proof_id: { type: 'string', description: 'The proof ID to verify' },
-                public_key: { type: 'string', description: 'Optional PEM public key for signature verification. From envelope version 1.1.0 the signing key is recorded inside the signed payload and is used when this is omitted; for older envelopes, omitting it yields no_public_key_for_verification. Supplying a key that disagrees with the recorded one yields attester_key_mismatch.' }
+                public_key: { type: 'string', description: 'PEM public key of the attester, obtained out of band. Signature verification uses this key and only this key — a key recorded inside a proof is a self-report and is never trusted. Omitting it, or sending an empty string, yields no_public_key_for_verification and the proof is reported invalid.' }
               },
               required: %w[proof_id]
             }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kairos-chain
 version: !ruby/object:Gem::Version
-  version: 3.57.0
+  version: 3.58.0
 platform: ruby
 authors:
 - Masaomi Hatakeyama
@@ -760,6 +760,7 @@ files:
 - templates/skillsets/synoptis/lib/synoptis/trust_scorer.rb
 - templates/skillsets/synoptis/lib/synoptis/verifier.rb
 - templates/skillsets/synoptis/skillset.json
+- templates/skillsets/synoptis/test/test_agent_identity.rb
 - templates/skillsets/synoptis/test/test_head_anchor.rb
 - templates/skillsets/synoptis/test/test_l2_constitutive_slice1.rb
 - templates/skillsets/synoptis/test/test_l2_constitutive_slice2.rb