@attested-intelligence/aga-mcp-server 0.1.1 → 2.0.0

package/src/core/types.ts

@@ -1,244 +0,0 @@
-/**
- * V3: Aligned with NIST-2025-0035 and NCCoE AI Agent Identity filings.
- * Every interface annotated with patent reference numeral.
- */
-import type { HashHex, SignatureBase64, SaltHex, MerkleInclusionProof } from '../crypto/types.js';
-
-// ── Subject (100, 102, 104, 106, 126) ──────────────────────────
-
-export interface SubjectIdentifier {          // Ref 126
-  bytes_hash: HashHex;                        // Ref 104
-  metadata_hash: HashHex;                     // Ref 106
-}
-
-export interface SubjectMetadata {
-  filename?: string;
-  creation_timestamp?: string;
-  author?: string;
-  version?: string;
-  content_type?: string;
-  [key: string]: unknown;
-}
-
-// ── Enforcement (130–136, 162–168) ──────────────────────────────
-
-export type EnforcementAction =
-  | 'TERMINATE'           // Ref 162: immediate kill
-  | 'QUARANTINE'          // Ref 164: phantom execution
-  | 'NETWORK_ISOLATE'     // Ref 166: sever network, continue local
-  | 'SAFE_STATE'          // Ref 168: return-to-home / controlled shutdown
-  | 'KEY_REVOKE'          // invalidate crypto keys
-  | 'TOKEN_INVALIDATE'    // revoke access tokens
-  | 'ACTUATOR_DISCONNECT' // sever physical actuator connections
-  | 'ALERT_ONLY';         // log without enforcement (gradual deployment)
-
-export type MeasurementType =
-  | 'EXECUTABLE_IMAGE' | 'LOADED_MODULES' | 'CONTAINER_IMAGE'
-  | 'CONFIG_MANIFEST'  | 'SBOM'           | 'TEE_QUOTE'
-  | 'MEMORY_REGIONS'   | 'CONTROL_FLOW'   | 'FILE_SYSTEM_STATE'
-  | 'NETWORK_CONFIG';
-
-export interface EnforcementParams {           // Ref 130
-  measurement_cadence_ms: number;              // Ref 132
-  ttl_seconds: number;                         // Ref 134
-  enforcement_triggers: EnforcementAction[];   // Ref 136
-  re_attestation_required: boolean;
-  measurement_types: MeasurementType[];
-}
-
-// ── Policy & Disclosure (112, 138–142) ──────────────────────────
-
-export type Sensitivity = 'S1_LOW' | 'S2_MODERATE' | 'S3_HIGH' | 'S4_CRITICAL';
-export type DisclosureMode = 'PROOF_ONLY' | 'REVEAL_MIN' | 'REVEAL_FULL';
-
-export interface ClaimRecord {                 // Ref 140
-  claim_id: string;
-  sensitivity: Sensitivity;
-  substitutes: string[];
-  inference_risks: string[];
-  permitted_modes: DisclosureMode[];
-}
-
-export interface SubstitutionRule {             // Ref 142
-  original_claim_id: string;
-  substitute_claim_id: string;
-  conditions: Record<string, unknown>;
-}
-
-export interface DisclosurePolicy {            // Ref 138
-  claims_taxonomy: ClaimRecord[];
-  substitution_rules: SubstitutionRule[];
-}
-
-// ── Evidence Commitment (114) ───────────────────────────────────
-
-export interface EvidenceCommitmentRecord {
-  commitment: HashHex;
-  salt: SaltHex;
-  label: string;
-}
-
-// ── Policy Artifact (120, 122, 124, 144) ────────────────────────
-
-export interface PolicyArtifact {              // Ref 122 (Weave Piece)
-  schema_version: string;
-  protocol_version: string;
-  subject_identifier: SubjectIdentifier;
-  policy_reference: HashHex;                   // Ref 128
-  policy_version: number;
-  sealed_hash: HashHex;                        // Ref 124
-  seal_salt: SaltHex;                          // stored for audit
-  issued_timestamp: string;
-  effective_timestamp: string;
-  expiration_timestamp: string | null;
-  issuer_identifier: string;
-  enforcement_parameters: EnforcementParams;
-  disclosure_policy: DisclosurePolicy;
-  evidence_commitments: EvidenceCommitmentRecord[];
-  signature: SignatureBase64;                  // Ref 144
-}
-
-// ── Receipts (170, 172) ─────────────────────────────────────────
-// V3: Generated for EVERY measurement, not just drift. Per NIST filing:
-// "each measurement generates a signed receipt — match or mismatch"
-
-export interface SignedReceipt {                // Ref 172
-  receipt_id: string;
-  subject_identifier: SubjectIdentifier;
-  artifact_reference: HashHex;
-  current_hash: string;
-  sealed_hash: string;
-  drift_detected: boolean;
-  drift_description: string | null;
-  enforcement_action: EnforcementAction | null;
-  measurement_type: string;                    // V3: which measurement was performed
-  timestamp: string;
-  sequence_number: number;
-  previous_leaf_hash: HashHex | null;
-  portal_signature: SignatureBase64;
-}
-
-// ── Continuity Chain (180–196) ──────────────────────────────────
-
-export type EventType =
-  | 'GENESIS'
-  | 'POLICY_ISSUANCE'
-  | 'INTERACTION_RECEIPT'
-  | 'REVOCATION'              // V3: mid-session revocation
-  | 'ATTESTATION'
-  | 'ANCHOR_BATCH'
-  | 'DISCLOSURE'
-  | 'SUBSTITUTION'
-  | 'KEY_ROTATION';           // V3: key lifecycle event
-
-export interface GenesisPayload {
-  protocol_version: string;
-  taxonomy_version: string;
-  root_fingerprint: string;
-  specification_hash: HashHex;
-  marker: 'GENESIS';
-}
-
-export interface ContinuityEvent {             // Ref 184
-  schema_version: string;
-  protocol_version: string;
-  event_type: EventType;
-  event_id: string;
-  sequence_number: number;
-  timestamp: string;
-  previous_leaf_hash: HashHex | null;
-  leaf_hash: HashHex;                          // Ref 186
-  payload: unknown;                            // Ref 192
-  payload_hash: HashHex;                       // Ref 194
-  event_signature: SignatureBase64;            // Ref 196
-}
-
-export interface StructuralMetadata {          // Ref 190
-  schema_version: string;
-  protocol_version: string;
-  event_type: EventType;
-  event_id: string;
-  sequence_number: number;
-  timestamp: string;
-  previous_leaf_hash: HashHex | null;
-}
-
-// ── Checkpoints (200–214) ───────────────────────────────────────
-
-export interface CheckpointReference {
-  merkle_root: HashHex;
-  batch_start_sequence: number;
-  batch_end_sequence: number;
-  anchor_network: string;
-  transaction_id: string;
-  timestamp: string;
-}
-
-export interface AnchorBatchPayload {
-  checkpoint_reference: CheckpointReference;
-  leaf_count: number;
-}
-
-// ── Evidence Bundle (240–246) ───────────────────────────────────
-
-export interface EvidenceBundle {
-  artifact: PolicyArtifact;
-  receipts: SignedReceipt[];
-  merkle_proofs: MerkleInclusionProof[];
-  checkpoint_reference: CheckpointReference;
-  public_key: string;
-  bundle_signature: SignatureBase64;
-}
-
-// ── Disclosure (250–256) ────────────────────────────────────────
-
-export interface DisclosureRequest {
-  requested_claim_id: string;
-  requester_id: string;
-  mode: DisclosureMode;
-  timestamp: string;
-}
-
-export interface SubstitutionReceipt {
-  receipt_id: string;
-  original_claim_id: string;
-  substitute_claim_id: string | null;
-  policy_version: number;
-  reason_code: string;
-  timestamp: string;
-  chain_sequence_ref: number;
-  signature: SignatureBase64;
-}
-
-// ── Portal State Machine (150, 270–280) ─────────────────────────
-
-export type PortalState =
-  | 'INITIALIZATION'         // Ref 270
-  | 'ARTIFACT_VERIFICATION'  // Ref 272
-  | 'ACTIVE_MONITORING'      // Ref 274
-  | 'DRIFT_DETECTED'         // Ref 276
-  | 'PHANTOM_QUARANTINE'     // Ref 278
-  | 'TERMINATED';            // Ref 280
-
-export type VerificationTier = 'BRONZE' | 'SILVER' | 'GOLD';
-
-// ── Revocation (V3) ────────────────────────────────────────────
-// Per NCCoE filing Phase 3b: "An administrator pushes a REVOCATION event
-// to the continuity chain, invalidating the agent's active policy artifact."
-
-export interface RevocationRecord {
-  artifact_sealed_hash: HashHex;
-  reason: string;
-  revoked_by: string;                         // issuer pk hex
-  timestamp: string;
-}
-
-// ── Quarantine (220–230) ────────────────────────────────────────
-
-export interface QuarantineState {
-  active: boolean;
-  started_at: string | null;
-  inputs_captured: number;
-  outputs_severed: boolean;
-  forensic_buffer: Array<{ timestamp: string; type: string; data: unknown }>;
-}

package/src/crypto/hash.ts

@@ -1,33 +0,0 @@
-import { sha256 } from '@noble/hashes/sha256';
-import { blake2b } from '@noble/hashes/blake2b';
-import { bytesToHex } from '@noble/hashes/utils';
-import type { HashHex } from './types.js';
-
-const enc = new TextEncoder();
-
-export function sha256Bytes(data: Uint8Array): HashHex {
-  return bytesToHex(sha256(data));
-}
-
-export function sha256Str(data: string): HashHex {
-  return sha256Bytes(enc.encode(data));
-}
-
-export function blake2b256(data: Uint8Array): HashHex {
-  return bytesToHex(blake2b(data, { dkLen: 32 }));
-}
-
-/** Concatenate inputs (NO delimiter) and SHA-256. Patent Section D: "no delimiters." */
-export function sha256Cat(...parts: (Uint8Array | string)[]): HashHex {
-  const bufs = parts.map(p => typeof p === 'string' ? enc.encode(p) : p);
-  const total = bufs.reduce((n, b) => n + b.length, 0);
-  const combined = new Uint8Array(total);
-  let off = 0;
-  for (const b of bufs) { combined.set(b, off); off += b.length; }
-  return sha256Bytes(combined);
-}
-
-/** Concatenate hex strings as text (no decode) and hash. For sealed_hash computation. */
-export function sha256HexCat(...hexes: string[]): HashHex {
-  return sha256Str(hexes.join(''));
-}

package/src/crypto/index.ts

@@ -1,5 +0,0 @@
-export * from './types.js';
-export * from './hash.js';
-export * from './sign.js';
-export * from './salt.js';
-export * from './merkle.js';

package/src/crypto/merkle.ts

@@ -1,43 +0,0 @@
-import { sha256Str } from './hash.js';
-import type { HashHex, MerkleInclusionProof } from './types.js';
-
-function pair(l: HashHex, r: HashHex): HashHex { return sha256Str(l + r); }
-
-export function buildMerkleTree(leaves: HashHex[]): { root: HashHex; layers: HashHex[][] } {
-  if (!leaves.length) throw new Error('Empty leaf set');
-  if (leaves.length === 1) return { root: leaves[0], layers: [leaves] };
-  const layers: HashHex[][] = [[...leaves]];
-  let cur = leaves;
-  while (cur.length > 1) {
-    const next: HashHex[] = [];
-    for (let i = 0; i < cur.length; i += 2) {
-      next.push(pair(cur[i], i + 1 < cur.length ? cur[i + 1] : cur[i]));
-    }
-    layers.push(next);
-    cur = next;
-  }
-  return { root: cur[0], layers };
-}
-
-export function inclusionProof(leaves: HashHex[], idx: number): MerkleInclusionProof {
-  if (idx < 0 || idx >= leaves.length) throw new RangeError(`Index ${idx} out of [0,${leaves.length})`);
-  const { root, layers } = buildMerkleTree(leaves);
-  const siblings: MerkleInclusionProof['siblings'] = [];
-  let ci = idx;
-  for (let L = 0; L < layers.length - 1; L++) {
-    const layer = layers[L];
-    const isRight = ci % 2 === 1;
-    const si = isRight ? ci - 1 : (ci + 1 < layer.length ? ci + 1 : ci);
-    siblings.push({ hash: layer[si], position: isRight ? 'left' : 'right' });
-    ci = Math.floor(ci / 2);
-  }
-  return { leafHash: leaves[idx], leafIndex: idx, siblings, root };
-}
-
-export function verifyProof(proof: MerkleInclusionProof): boolean {
-  let h = proof.leafHash;
-  for (const s of proof.siblings) {
-    h = s.position === 'left' ? pair(s.hash, h) : pair(h, s.hash);
-  }
-  return h === proof.root;
-}

package/src/crypto/salt.ts

@@ -1,18 +0,0 @@
-import { randomBytes } from 'node:crypto';
-import { bytesToHex } from '@noble/hashes/utils';
-import { sha256Cat } from './hash.js';
-import type { SaltHex, SaltedCommitment, HashHex } from './types.js';
-
-const enc = new TextEncoder();
-
-export function generateSalt(): SaltHex { return bytesToHex(randomBytes(16)); }
-
-export function saltedCommitment(content: Uint8Array | string, salt?: SaltHex): SaltedCommitment {
-  const s = salt ?? generateSalt();
-  const c = typeof content === 'string' ? enc.encode(content) : content;
-  return { commitment: sha256Cat(c, s), salt: s };
-}
-
-export function verifySaltedCommitment(content: Uint8Array | string, salt: SaltHex, expected: HashHex): boolean {
-  return saltedCommitment(content, salt).commitment === expected;
-}

package/src/crypto/sign.ts

@@ -1,35 +0,0 @@
-import * as ed from '@noble/ed25519';
-import { sha512 } from '@noble/hashes/sha512';
-import { bytesToHex, hexToBytes } from '@noble/hashes/utils';
-import type { KeyPair, Signature, SignatureBase64 } from './types.js';
-
-// Set sha512 sync ONCE at module load
-ed.etc.sha512Sync = (...m: Uint8Array[]) => {
-  const total = m.reduce((n, a) => n + a.length, 0);
-  const buf = new Uint8Array(total);
-  let off = 0;
-  for (const a of m) { buf.set(a, off); off += a.length; }
-  return sha512(buf);
-};
-
-const enc = new TextEncoder();
-
-export function generateKeyPair(): KeyPair {
-  const secretKey = ed.utils.randomPrivateKey();
-  return { publicKey: ed.getPublicKey(secretKey), secretKey };
-}
-
-export function sign(msg: Uint8Array, sk: Uint8Array): Signature { return ed.sign(msg, sk); }
-export function signStr(msg: string, sk: Uint8Array): Signature { return sign(enc.encode(msg), sk); }
-
-export function verify(sig: Signature, msg: Uint8Array, pk: Uint8Array): boolean {
-  try { return ed.verify(sig, msg, pk); } catch { return false; }
-}
-export function verifyStr(sig: Signature, msg: string, pk: Uint8Array): boolean {
-  return verify(sig, enc.encode(msg), pk);
-}
-
-export const sigToB64 = (s: Signature): SignatureBase64 => Buffer.from(s).toString('base64');
-export const b64ToSig = (b: SignatureBase64): Signature => new Uint8Array(Buffer.from(b, 'base64'));
-export const pkToHex = (pk: Uint8Array): string => bytesToHex(pk);
-export const hexToPk = (h: string): Uint8Array => hexToBytes(h);

package/src/crypto/types.ts

@@ -1,19 +0,0 @@
-export type PublicKey = Uint8Array;
-export type SecretKey = Uint8Array;
-export interface KeyPair { publicKey: PublicKey; secretKey: SecretKey; }
-export type Signature = Uint8Array;
-export type HashHex = string;
-export type SignatureBase64 = string;
-export type SaltHex = string;
-
-export interface SaltedCommitment {
-  commitment: HashHex;
-  salt: SaltHex;
-}
-
-export interface MerkleInclusionProof {
-  leafHash: HashHex;
-  leafIndex: number;
-  siblings: Array<{ hash: HashHex; position: 'left' | 'right' }>;
-  root: HashHex;
-}

package/src/index.ts

@@ -1,12 +0,0 @@
-#!/usr/bin/env node
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { createAGAServer } from './server.js';
-
-async function main() {
-  const server = await createAGAServer();
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
-  console.error('AGA MCP Server running on stdio');
-}
-
-main().catch(e => { console.error('Fatal:', e); process.exit(1); });

package/src/middleware/governance.ts

@@ -1,95 +0,0 @@
-/**
- * Governance Middleware — wraps every MCP tool handler.
- *
- * NCCoE filing Section 4: "The portal operates as a Policy Enforcement Point (PEP)...
- * Every tool invocation, API call, actuator command, and data access passes through
- * the portal, which evaluates it against the sealed artifact's enforcement parameters."
- *
- * Behavior:
- * - TERMINATED state → reject all governed tools
- * - PHANTOM_QUARANTINE → capture tool call as forensic input, reject
- * - ACTIVE_MONITORING → allow, log to chain
- * - Ungoverned tools (get_server_info, get_portal_state, list_claims) → always allow
- */
-import type { Portal } from '../core/portal.js';
-import type { QuarantineState } from '../core/types.js';
-import { captureInput } from '../core/quarantine.js';
-import type { BehavioralMonitor } from '../core/behavioral.js';
-import { sha256Str } from '../crypto/hash.js';
-import { canonicalize } from '../utils/canonical.js';
-
-export type ToolResult = { content: Array<{ type: 'text'; text: string }> };
-export type ToolHandler<T = any> = (args: T) => Promise<ToolResult>;
-
-const UNGOVERNED_TOOLS = new Set([
-  'get_server_info',
-  'get_portal_state',
-  'get_receipts',
-  'get_chain_events',
-  'list_claims',
-  'init_chain',        // must work before attestation
-  'attest_subject',    // creates the governance relationship
-  'verify_chain',      // read-only verification
-]);
-
-export function createGovernanceWrapper(
-  portal: Portal,
-  quarantine: { current: QuarantineState | null },
-  toolName: string,
-  behavioralMonitor?: BehavioralMonitor
-) {
-  const isGoverned = !UNGOVERNED_TOOLS.has(toolName);
-
-  return function wrapHandler<T>(handler: ToolHandler<T>): ToolHandler<T> {
-    if (!isGoverned) return handler;
-
-    return async (args: T): Promise<ToolResult> => {
-      const j = (x: unknown): ToolResult => ({
-        content: [{ type: 'text', text: JSON.stringify(x, null, 2) }]
-      });
-
-      // TERMINATED → reject everything
-      if (portal.state === 'TERMINATED') {
-        return j({
-          success: false,
-          error: 'GOVERNANCE_BLOCKED: Portal is terminated. Agent governance has been revoked. Re-attestation required.',
-          portal_state: portal.state,
-          tool: toolName,
-        });
-      }
-
-      // PHANTOM_QUARANTINE → capture as forensic input, reject
-      if (portal.state === 'PHANTOM_QUARANTINE' && quarantine.current?.active) {
-        captureInput(quarantine.current, `tool_call:${toolName}`, {
-          tool: toolName,
-          args,
-          timestamp: new Date().toISOString(),
-        });
-        return j({
-          success: false,
-          error: 'GOVERNANCE_QUARANTINED: Agent is in phantom quarantine. All outputs are severed. Inputs are being captured for forensic analysis.',
-          portal_state: portal.state,
-          tool: toolName,
-          forensic_capture: true,
-        });
-      }
-
-      // INITIALIZATION or ARTIFACT_VERIFICATION → not yet governed
-      if (portal.state === 'INITIALIZATION' || portal.state === 'ARTIFACT_VERIFICATION') {
-        return j({
-          success: false,
-          error: 'GOVERNANCE_NOT_READY: No active policy artifact. Call attest_subject first.',
-          portal_state: portal.state,
-          tool: toolName,
-        });
-      }
-
-      // ACTIVE_MONITORING or DRIFT_DETECTED → record + allow through
-      if (behavioralMonitor) {
-        const argsHash = sha256Str(canonicalize(args));
-        behavioralMonitor.recordInvocation(toolName, argsHash);
-      }
-      return handler(args);
-    };
-  };
-}

package/src/middleware/index.ts

@@ -1 +0,0 @@
-export * from './governance.js';