@atlasnomos/atlas 1.1.15 → 10.0.1

package/src/kernel/constitution/SentinelInterface.js

@@ -15,6 +15,12 @@ const path = require('path');
 const { SecretRedactor } = require('../../core/SecretRedactor');
 const { printDevModeWarning } = require('../io/GovernanceWarning');
 
+// Ring-0 Mode System (PROD enforcement)
+const { getActiveMode, isProdOrHigher, isModeLocked } = require('../modes/ActiveMode');
+
+// Sentinel Key Registry (PROD hardening - cryptographic trust)
+const { getInstance: getKeyRegistry } = require('../sentinel/KeyRegistry');
+
 // ═══════════════════════════════════════════════════════════════
 // HASH-CHAINED AUDIT LOG
 // ═══════════════════════════════════════════════════════════════
@@ -317,6 +323,32 @@ class SentinelInterface {
             const healthy = await this.isHealthy();
             if (!healthy) {
                 log('Health check failed');
+
+                // PROD ENFORCEMENT: Fail-close on Sentinel disconnection
+                if (isModeLocked() && isProdOrHigher()) {
+                    const mode = getActiveMode();
+                    if (mode.requireSentinelApproval) {
+                        log('PROD ENFORCEMENT: Sentinel required but unavailable - BLOCKING');
+                        log('PROD ENFORCEMENT: Sentinel required but unavailable - BLOCKING');
+                        // R-04 FIX: Sentinel Halt Distinction (Unreachable)
+                        this._logAudit({
+                            event: 'SENTINEL_UNREACHABLE',
+                            traceId,
+                            action,
+                            verdict: 'BLOCK',
+                            reason: 'SENTINEL_CONNECTION_FAILURE',
+                            tier: this.tierManager.getTier(),
+                            failClose: true
+                        });
+                        return {
+                            approved: false,
+                            error: 'SENTINEL_UNREACHABLE',
+                            failClose: true,
+                            tier: this.tierManager.getTier()
+                        };
+                    }
+                }
+
                 return { approved: false, error: 'SENTINEL_DISCONNECTED' };
             }
         }
@@ -345,15 +377,57 @@ class SentinelInterface {
                 const valid = this.verifySignature(response.signed_payload, response.signature);
                 if (!valid) panic('SENTINEL_SIGNATURE_INVALID', { traceId });
 
+                // PROD HARDENING: Verify key is in authorized registry
+                // WHY: Ensures the signing key is known, active, and not revoked
+                const keyRegistry = getKeyRegistry();
+                const keyId = this.publicKeyHex ? this.publicKeyHex.substring(0, 16) : 'unknown';
+                const keyVerification = keyRegistry.enforceKeyValidity(keyId, { traceId, action });
+
                 nonceRegistry.markUsed(response.nonce);
-                this._logAudit({ traceId, action, decision: 'APPROVED', hash: crypto.createHash('sha256').update(JSON.stringify(response.signed_payload)).digest('hex') });
 
-                return { approved: true, attested: true, token: response, signature: response.signature, payload: response.signed_payload };
+                // Build approval_proof for hash-chained audit log (PROD requirement)
+                const approvalProof = {
+                    sentinel_payload_hash: crypto.createHash('sha256').update(JSON.stringify(response.signed_payload)).digest('hex'),
+                    sentinel_signature: response.signature,
+                    sentinel_key_id: this.publicKeyHex ? this.publicKeyHex.substring(0, 16) : 'unknown',
+                    alg: 'ed25519',
+                    issued_at: new Date().toISOString(),
+                    expires_at: new Date(response.expires_at * 1000).toISOString(),
+                    nonce: response.nonce
+                };
+
+                // Log EXECUTION_DECISION with approval_proof to hash-chained log
+                this._logAudit({
+                    event: 'EXECUTION_DECISION',
+                    traceId,
+                    action,
+                    verdict: 'PASS',
+                    approval_proof: approvalProof,
+                    tier: this.tierManager.getTier(),
+                    attested: true
+                });
+
+                return {
+                    approved: true,
+                    attested: true,
+                    token: response,
+                    signature: response.signature,
+                    payload: response.signed_payload,
+                    approval_proof: approvalProof  // Include in response for caller access
+                };
             } else {
                 log(`Denied branch. Reason: ${response.reason}`);
                 const deniedLogPath = path.join(process.cwd(), '.atlas', 'logs', 'trace_debug.log');
                 fs.appendFileSync(deniedLogPath, `[DENIED] Reason='${response.reason}'\n`);
-                this._logAudit({ traceId, action, decision: 'DENIED', reason: response.reason });
+
+                // R-04 FIX: Sentinel Halt Distinction (Denied)
+                this._logAudit({
+                    event: 'SENTINEL_DENIED',
+                    traceId,
+                    action,
+                    reason: response.reason,
+                    tier: this.tierManager.getTier()
+                });
                 return { approved: false, reason: response.reason };
             }
         } catch (e) {
@@ -399,6 +473,38 @@ class SentinelInterface {
         }
     }
 
+    /**
+     * Public accessor for audit logging (PROD Hardening).
+     * Allows other kernel modules to write to the main hash-chained log.
+     * @param {Object} entry - Log entry
+     */
+    logAudit(entry) {
+        this._logAudit(entry);
+    }
+
+    /**
+     * Create an anchor to a secondary chain (PROD Hardening).
+     * Preserves causal consistency across split logs.
+     * @param {string} source - Source chain name (e.g. CostTracker)
+     * @param {string} hash - Hash of the event in the secondary chain
+     * @param {number} seq - Sequence number in the secondary chain
+     */
+    logAnchor(source, hash, seq) {
+        try {
+            this._logAudit({
+                event: 'CHAIN_ANCHOR',
+                source_chain: source,
+                anchored_hash: hash,
+                anchored_seq: seq,
+                tier: this.tierManager.getTier(),
+                timestamp: new Date().toISOString()
+            });
+        } catch (e) {
+            // Anchor failure is non-fatal but noisy
+            console.error(`[SentinelInterface] Failed to anchor ${source}: ${e.message}`);
+        }
+    }
+
     // ═══════════════════════════════════════════════════════════════
     // P0.3 - TIMEOUT CONFIGURATION
     // ═══════════════════════════════════════════════════════════════
@@ -516,6 +622,77 @@ class SentinelInterface {
         }
         return { success: false, error: response.detail || 'MODE_SWITCH_FAILED' };
     }
+
+    /**
+     * AURORA: Verify a Standing Automation Grant.
+     * 
+     * @param {Object} grant - The full grant object
+     * @returns {Promise<boolean>} True if valid and signed by active key
+     */
+    async verifyAutomationGrant(grant) {
+        // PROD ENFORCEMENT: Only valid in PROD/FORTRESS
+        if (!isProdOrHigher()) return false;
+
+        if (!this.connected) {
+            await this.isHealthy();
+        }
+
+        const { AutomationSchema } = require('../automation/AutomationSchema');
+
+        try {
+            // 1. Schema Validation
+            AutomationSchema.validateGrant(grant);
+
+            // 2. Check Key Validity
+            const keyRegistry = getKeyRegistry();
+            const keyCheck = keyRegistry.enforceKeyValidity(grant.sentinel_key_id, { context: 'AUTOMATION_VERIFY' });
+            if (!keyCheck.valid) {
+                panic('AUTOMATION_KEY_INVALID', { keyId: grant.sentinel_key_id });
+            }
+
+            // 3. Verify Signature
+            // Clone and remove signature for verification
+            const payload = { ...grant };
+            delete payload.sentinel_signature;
+
+            // Canonicalize
+            const canonical = this._deepSort(payload);
+            const message = JSON.stringify(canonical);
+            const messageBuffer = Buffer.from(message, 'utf-8');
+            const signature = Buffer.from(grant.sentinel_signature, 'hex');
+
+            // Get Key Buffer
+            const publicKeyBuffer = keyRegistry.getPublicKey(grant.sentinel_key_id);
+            if (!publicKeyBuffer) return false;
+
+            // Ed25519 SPKI header
+            const spkiHeader = Buffer.from('302a300506032b6570032100', 'hex');
+            const spkiKey = Buffer.concat([spkiHeader, publicKeyBuffer]);
+
+            const keyObject = crypto.createPublicKey({
+                key: spkiKey,
+                format: 'der',
+                type: 'spki'
+            });
+
+            const valid = crypto.verify(undefined, messageBuffer, keyObject, signature);
+
+            if (!valid) {
+                this._logAudit({
+                    event: 'AUTOMATION_SIGNATURE_FAIL',
+                    grantId: grant.grant_id,
+                    keyId: grant.sentinel_key_id
+                });
+                return false;
+            }
+
+            return true;
+
+        } catch (e) {
+            console.error('[Sentinel] Automation Verification Error:', e.message);
+            return false;
+        }
+    }
 }
 
 let _instance = null;

package/src/kernel/constitution/invariants/automation.invariants.js

@@ -0,0 +1,126 @@
+/**
+ * ATLAS v10 — Automation Invariants (Constitution)
+ * 
+ * PURPOSE: Ring-0 Logic Gates for Automation Authority.
+ * 
+ * INVARIANTS:
+ * - INV-AUTO-001: Execution requires valid Sentinel Grant.
+ * - INV-AUTO-002: Automation cannot mutate policy.
+ * - INV-AUTO-003: Automation cannot create automations.
+ * - INV-AUTO-004: Automation execution must be replay-deterministic.
+ * - INV-AUTO-005: Automation scope limits (Cost/Runtime) cannot be exceeded.
+ * 
+ * @module kernel/constitution/invariants/automation.invariants
+ */
+
+const { isProdOrHigher } = require('../../modes/ActiveMode');
+const { panic, assertInvariant } = require('../../boot/HardKill');
+
+const AUTOMATION_INVARIANTS = {
+    GRANT_REQUIRED: 'INV-AUTO-001',
+    IMMUTABLE_POLICY: 'INV-AUTO-002',
+    NO_RECURSION: 'INV-AUTO-003',
+    REPLAY_DETERMINISM: 'INV-AUTO-004',
+    SCOPE_LIMITS: 'INV-AUTO-005'
+};
+
+/**
+ * INV-AUTO-001: Assert that a valid grant exists for this execution context.
+ * 
+ * @param {Object} grant - The loaded grant object
+ * @param {string} traceId - Execution Trace ID
+ */
+function assertAutomationGrant(grant, traceId) {
+    if (!isProdOrHigher()) return; // DEV bypass allowed (technically DEV shouldn't be here, but defensive)
+
+    assertInvariant(
+        !!grant && !!grant.grant_id && !!grant.sentinel_signature,
+        AUTOMATION_INVARIANTS.GRANT_REQUIRED,
+        { traceId, reason: 'Missing or malformed grant' },
+        true // Terminal Panic
+    );
+}
+
+/**
+ * INV-AUTO-002: Assert that the proposed action is NOT a policy mutation.
+ * 
+ * @param {string} action - Action identifier
+ */
+function assertImmutablePolicy(action) {
+    if (!isProdOrHigher()) return;
+
+    if (action.includes('POLICY_UPDATE') || action.includes('WEAKEN_INVARIANT')) {
+        panic(AUTOMATION_INVARIANTS.IMMUTABLE_POLICY, {
+            reason: 'Automation attempted to mutate policy',
+            action
+        });
+    }
+}
+
+/**
+ * INV-AUTO-003: Assert that the proposed action is NOT creating new automation.
+ * 
+ * @param {string} action - Action identifier
+ */
+function assertNoRecursion(action) {
+    if (!isProdOrHigher()) return;
+
+    if (action.includes('REGISTER_AUTOMATION') || action.includes('GRANT_ISSUE')) {
+        panic(AUTOMATION_INVARIANTS.NO_RECURSION, {
+            reason: 'Automation attempted to create new automation',
+            action
+        });
+    }
+}
+
+/**
+ * INV-AUTO-004: Assert that the execution environment is replay-deterministic.
+ * 
+ * @param {Object} entropyContext - The entropy context used for seeding
+ */
+function assertReplayDeterminism(entropyContext) {
+    if (!isProdOrHigher()) return;
+
+    // In PROD/FORTRESS, entropy must be derived, not random.
+    if (!entropyContext || !entropyContext.deterministic || !entropyContext.seedHash) {
+        panic(AUTOMATION_INVARIANTS.REPLAY_DETERMINISM, {
+            reason: 'Automation execution attempted without deterministic seeding',
+            context: entropyContext
+        });
+    }
+}
+
+/**
+ * INV-AUTO-005: Assert that execution limits (Cost, Runtime) are respected.
+ * 
+ * @param {Object} scope - The grant scope
+ * @param {Object} usage - Current usage metrics
+ */
+function assertScopeLimits(scope, usage) {
+    if (!isProdOrHigher()) return;
+
+    if (usage.estimatedCost > scope.max_cost) {
+        panic(AUTOMATION_INVARIANTS.SCOPE_LIMITS, {
+            reason: 'Cost limit exceeded',
+            limit: scope.max_cost,
+            actual: usage.estimatedCost
+        });
+    }
+
+    if (usage.runtimeMs > scope.max_runtime_ms) {
+        panic(AUTOMATION_INVARIANTS.SCOPE_LIMITS, {
+            reason: 'Runtime limit exceeded',
+            limit: scope.max_runtime_ms,
+            actual: usage.runtimeMs
+        });
+    }
+}
+
+module.exports = {
+    AUTOMATION_INVARIANTS,
+    assertAutomationGrant,
+    assertImmutablePolicy,
+    assertNoRecursion,
+    assertReplayDeterminism,
+    assertScopeLimits
+};

package/src/kernel/constitution/invariants/frequency.invariants.js

@@ -0,0 +1,77 @@
+/**
+ * ATLAS v10.2 — Frequency Invariants (Constitution)
+ * 
+ * PURPOSE: Ring-0 Enforcement of Automation Frequency Limits.
+ * 
+ * INVARIANTS:
+ * - INV-AUTO-FREQ-001: Automation execution MUST NOT occur more frequently than the grant allows.
+ * 
+ * @module kernel/constitution/invariants/frequency.invariants
+ */
+
+const { isProdOrHigher } = require('../../modes/ActiveMode');
+const SentinelInterface = require('../SentinelInterface');
+const { getInstance: getLedger } = require('../../automation/LastRunLedger');
+
+const FREQUENCY_INVARIANTS = {
+    FREQUENCY_LIMIT: 'INV-AUTO-FREQ-001'
+};
+
+/**
+ * INV-AUTO-FREQ-001: Check if automation can execute within its frequency window.
+ * 
+ * Unlike other invariants, this does NOT panic. It BLOCKS and emits a structured event.
+ * 
+ * @param {Object} grant - The automation grant
+ * @returns {{ allowed: boolean, reason?: string, violation?: Object }}
+ */
+function checkFrequencyLimit(grant) {
+    if (!isProdOrHigher()) {
+        // In DEV, we should never reach here. But if we do, block.
+        return { allowed: false, reason: 'DEV_MODE_VIOLATION' };
+    }
+
+    const grantId = grant.grant_id;
+    const maxFrequency = grant.scope?.max_frequency;
+
+    if (!maxFrequency) {
+        // No frequency limit defined = always allowed
+        return { allowed: true };
+    }
+
+    const ledger = getLedger();
+    const check = ledger.canExecute(grantId, maxFrequency);
+
+    if (!check.allowed) {
+        // Emit structured violation event
+        const sentinel = SentinelInterface.getInstance();
+        sentinel.logAudit({
+            event: 'AUTOMATION_FREQUENCY_VIOLATION',
+            invariant: FREQUENCY_INVARIANTS.FREQUENCY_LIMIT,
+            grant_id: grantId,
+            frequency_window: maxFrequency,
+            last_execution_at: check.lastExecutionAt || null,
+            next_allowed_at: check.nextAllowedAt || null,
+            reason: check.reason,
+            timestamp: new Date().toISOString()
+        });
+
+        return {
+            allowed: false,
+            reason: check.reason,
+            violation: {
+                invariant: FREQUENCY_INVARIANTS.FREQUENCY_LIMIT,
+                grantId,
+                frequencyWindow: maxFrequency,
+                lastExecutionAt: check.lastExecutionAt
+            }
+        };
+    }
+
+    return { allowed: true };
+}
+
+module.exports = {
+    FREQUENCY_INVARIANTS,
+    checkFrequencyLimit
+};

package/src/kernel/constitution/invariants/registry.invariants.js

@@ -262,6 +262,75 @@ const AUDIT_INVARIANTS = [
     }
 ];
 
+// ═══════════════════════════════════════════════════════════════════════════
+// POLICY PINNING INVARIANTS (PROD Hardening)
+// ═══════════════════════════════════════════════════════════════════════════
+
+// WHY: Ensures the policy hash observed at AUDIT_RESERVATION matches
+// the policy hash used in every subsequent EXECUTION_DECISION.
+// Any mismatch indicates policy tampering mid-execution.
+// In PROD: Mismatch → INVARIANT_VIOLATION → KERNEL_PANIC
+
+const POLICY_PINNING_INVARIANTS = [
+    {
+        id: 'INV-POLICY-PIN-001',
+        category: INVARIANT_CATEGORIES.AUDIT,
+        scope: INVARIANT_SCOPES.AUDIT,
+        trigger: INVARIANT_TRIGGERS.BEFORE_EXECUTION,
+        enforcement: INVARIANT_ENFORCEMENT.HARD_HALT,
+        terminal: true,
+        ring: 0,
+        description: 'Policy hash at EXECUTION_DECISION must match hash at AUDIT_RESERVATION',
+        predicate: (context) => {
+            // NO BYPASS. Policy pinning is existence-critical in PROD.
+
+            const {
+                policyHashAtReservation,  // Hash captured at AUDIT_RESERVATION
+                currentPolicyHash,        // Hash at current EXECUTION_DECISION
+                executionId
+            } = context;
+
+            // 1. If no reservation policy hash, skip (first execution or DEV)
+            if (!policyHashAtReservation) {
+                return { valid: true, reason: 'NO_RESERVATION_HASH' };
+            }
+
+            // 2. If no current policy hash, fail closed in PROD
+            if (!currentPolicyHash) {
+                // Check if PROD mode
+                const { isProdOrHigher, isModeLocked } = require('../../modes/ActiveMode');
+                if (isModeLocked() && isProdOrHigher()) {
+                    return {
+                        valid: false,
+                        reason: 'POLICY_HASH_MISSING: No policy hash at EXECUTION_DECISION',
+                        evidence: {
+                            executionId,
+                            policyHashAtReservation
+                        }
+                    };
+                }
+                return { valid: true, reason: 'DEV_MODE_SKIP' };
+            }
+
+            // 3. Compare hashes — MUST match exactly
+            if (policyHashAtReservation !== currentPolicyHash) {
+                return {
+                    valid: false,
+                    reason: 'POLICY_HASH_MISMATCH: Policy changed between reservation and execution',
+                    evidence: {
+                        executionId,
+                        hashAtReservation: policyHashAtReservation,
+                        hashAtExecution: currentPolicyHash,
+                        delta: 'POLICY_TAMPERED_MID_EXECUTION'
+                    }
+                };
+            }
+
+            return { valid: true };
+        }
+    }
+];
+
 // ═══════════════════════════════════════════════════════════════════════════
 // COST INVARIANTS (Reservation + Settlement Model)
 // ═══════════════════════════════════════════════════════════════════════════
@@ -859,6 +928,7 @@ const FAILURE_INVARIANTS = [
 
 const REGISTRY_INVARIANTS = [
     ...AUDIT_INVARIANTS,
+    ...POLICY_PINNING_INVARIANTS,
     ...COST_INVARIANTS,
     ...MCP_INVARIANTS,
     ...FALLBACK_INVARIANTS,

package/src/kernel/crypto/DirectoryHasher.js

@@ -0,0 +1,101 @@
+/**
+ * ATLAS v10 — Directory Hasher (Ring-0 Crypto)
+ * 
+ * PURPOSE: Compute deterministic, cryptographic hash of a directory tree.
+ * Used for Boot Trust Sealing to anchor configuration state.
+ * 
+ * SECURITY INVARIANTS:
+ * - Deterministic traversal (Lexicographically sorted)
+ * - Content + Metadata binding (Permissions, Size)
+ * - Symlink Ban (Fail-Close on symlinks to prevent aliasing attacks)
+ * - SHA-256 Strength
+ * 
+ * @module kernel/crypto/DirectoryHasher
+ */
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+
+class DirectoryHasher {
+
+    /**
+     * Compute SHA-256 hash of a directory recursively.
+     * 
+     * @param {string} dirPath - Absolute path to directory
+     * @returns {string} Hex string of SHA-256 hash
+     * @throws {Error} If symlink found or read error
+     */
+    static hashDir(dirPath) {
+        if (!fs.existsSync(dirPath)) {
+            throw new Error(`Directory not found: ${dirPath}`);
+        }
+
+        const hasher = crypto.createHash('sha256');
+
+        // Phase 1: Collect all files (Deterministic Traversal)
+        const entries = this._collectEntries(dirPath, dirPath);
+
+        // Phase 2: Sort entries lexicographically by relative path
+        // WHY: Filesystem enumeration order is undefined; sorting ensures determinism.
+        entries.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
+
+        // Phase 3: Update Hash
+        for (const entry of entries) {
+            // Header: Path | Mode | Size
+            // Null pointer separation to prevent collisions
+            hasher.update(`${entry.relativePath}\0${entry.mode}\0${entry.size}\0`);
+
+            // Content
+            const content = fs.readFileSync(entry.absolutePath);
+            hasher.update(content);
+
+            // Delimiter
+            hasher.update('\n');
+        }
+
+        return hasher.digest('hex');
+    }
+
+    /**
+     * Recursive directory walker.
+     * @private
+     */
+    static _collectEntries(currentPath, rootPath, collected = []) {
+        const stats = fs.lstatSync(currentPath);
+
+        // SECURITY: Ban Symlinks
+        // WHY: Symlinks can point outside trust boundaries or create cycles.
+        // In stable server configs, they are unnecessary and risky.
+        if (stats.isSymbolicLink()) {
+            throw new Error(`SECURITY VIOLATION: Symlink detected at ${currentPath}. Symlinks are prohibited in trusted config directories.`);
+        }
+
+        if (stats.isDirectory()) {
+            const children = fs.readdirSync(currentPath);
+            for (const child of children) {
+                // Ignore standard noise if necessary, but for Trust Seal we prefer exactness.
+                // We typically exclude .DS_Store or Thumbs.db in the caller or here.
+                // For PROD Strictness: We INCLUDE everything. If a rogue file exists, the hash SHOULD change.
+                if (child === '.DS_Store' || child === 'Thumbs.db') continue;
+
+                const childPath = path.join(currentPath, child);
+                this._collectEntries(childPath, rootPath, collected);
+            }
+        } else if (stats.isFile()) {
+            // Normalize relative path to POSIX style (forward slashes) for cross-platform determinism
+            const relativePath = path.relative(rootPath, currentPath).replace(/\\/g, '/');
+
+            collected.push({
+                relativePath,
+                absolutePath: currentPath,
+                mode: stats.mode, // File permissions
+                size: stats.size
+            });
+        }
+
+        return collected;
+    }
+}
+
+module.exports = { DirectoryHasher };