@attested-intelligence/aga-mcp-server 0.1.1 → 2.0.1

package/dist/resources/crypto-primitives.js

@@ -0,0 +1,52 @@
+export const CRYPTO_PRIMITIVES_DOC = `# AGA Cryptographic Primitives
+
+## Ed25519 Digital Signatures
+- Library: @noble/ed25519 v2.1.0
+- Key size: 256-bit (32 bytes)
+- Signature size: 512-bit (64 bytes)
+- Used for: Artifact signing, receipt signing, chain event signing
+
+## SHA-256 Hashing
+- Library: @noble/hashes v1.7.0
+- Output: 256-bit (64 hex characters)
+- Used for: Sealed hash, leaf hash, payload hash, subject identity
+
+## Sealed Hash Construction
+\`\`\`
+sealed_hash = SHA-256(bytes_hash || metadata_hash || policy_reference || seal_salt)
+\`\`\`
+- No delimiters between fields (raw hex concatenation)
+- No delimiters per protocol spec
+
+## Leaf Hash Construction
+\`\`\`
+leaf_hash = SHA-256(
+  schema_version || "||" || protocol_version || "||" ||
+  event_type || "||" || event_id || "||" ||
+  sequence_number || "||" || timestamp || "||" ||
+  previous_leaf_hash
+)
+\`\`\`
+- **Payload EXCLUDED** - privacy innovation
+- Chain integrity verifiable without revealing event contents
+
+## Salted Commitments
+\`\`\`
+commitment = SHA-256(content_bytes || salt_bytes)
+\`\`\`
+- Salt: 128-bit (16 bytes, 32 hex chars) CSPRNG
+- Enables selective disclosure
+
+## Merkle Trees
+- Binary tree over leaf hashes
+- Internal nodes: SHA-256(left || right)
+- Odd leaf count: last leaf duplicated
+- Inclusion proofs: array of {hash, direction} pairs
+
+## Canonical Serialization
+- RFC 8785 aligned
+- Sorted keys, no whitespace
+- Used before signing any object
+`;
+export const CRYPTO_PRIMITIVES_URI = 'aga://crypto-primitives';
+//# sourceMappingURL=crypto-primitives.js.map

package/dist/resources/crypto-primitives.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-primitives.js","sourceRoot":"","sources":["../../src/resources/crypto-primitives.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiDpC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,CAAC"}

package/dist/resources/sample-bundle.d.ts

@@ -0,0 +1,6 @@
+export declare function generateSampleBundle(): {
+    bundle: string;
+    issuerPkHex: string;
+};
+export declare const SAMPLE_BUNDLE_URI = "aga://sample-bundle";
+//# sourceMappingURL=sample-bundle.d.ts.map

package/dist/resources/sample-bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sample-bundle.d.ts","sourceRoot":"","sources":["../../src/resources/sample-bundle.ts"],"names":[],"mappings":"AAgBA,wBAAgB,oBAAoB,IAAI;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CA8C9E;AAED,eAAO,MAAM,iBAAiB,wBAAwB,CAAC"}

package/dist/resources/sample-bundle.js

@@ -0,0 +1,58 @@
+/**
+ * Sample Evidence Bundle: generates a real, cryptographically signed bundle.
+ * Can be verified with aga_verify_bundle.
+ */
+import { generateKeyPair, pkToHex } from '../crypto/sign.js';
+import { sha256Str } from '../crypto/hash.js';
+import { computeSubjectIdFromString } from '../core/subject.js';
+import { performAttestation } from '../core/attestation.js';
+import { generateArtifact, hashArtifact } from '../core/artifact.js';
+import { generateReceipt } from '../core/receipt.js';
+import { createGenesisEvent, appendEvent } from '../core/chain.js';
+import { createCheckpoint, eventInclusionProof } from '../core/checkpoint.js';
+import { generateBundle } from '../core/bundle.js';
+let cachedBundle = null;
+export function generateSampleBundle() {
+    if (cachedBundle)
+        return cachedBundle;
+    const issuerKP = generateKeyPair();
+    const portalKP = generateKeyPair();
+    const chainKP = generateKeyPair();
+    const content = 'def sample_agent(): return task.execute()';
+    const meta = { filename: 'sample_agent.py', version: '1.0.0' };
+    const subId = computeSubjectIdFromString(content, meta);
+    const policyRef = sha256Str('sample-policy');
+    const att = performAttestation({ subject_identifier: subId, policy_reference: policyRef, evidence_items: [] });
+    const artifact = generateArtifact({
+        subject_identifier: subId, policy_reference: policyRef, policy_version: 1,
+        sealed_hash: att.sealed_hash, seal_salt: att.seal_salt,
+        enforcement_parameters: {
+            measurement_cadence_ms: 1000, ttl_seconds: 3600,
+            enforcement_triggers: ['QUARANTINE', 'TERMINATE'],
+            re_attestation_required: true, measurement_types: ['EXECUTABLE_IMAGE'],
+        },
+        disclosure_policy: { claims_taxonomy: [], substitution_rules: [] },
+        evidence_commitments: att.evidence_commitments, issuer_keypair: issuerKP,
+    });
+    const artRef = hashArtifact(artifact);
+    const receipt = generateReceipt({
+        subjectId: subId, artifactRef: artRef,
+        currentHash: subId.bytes_hash, sealedHash: subId.bytes_hash,
+        driftDetected: false, driftDescription: null, action: null,
+        measurementType: 'EXECUTABLE_IMAGE', seq: 1, prevLeaf: null, portalKP,
+    });
+    const genesis = createGenesisEvent(chainKP, sha256Str('AGA-Spec'));
+    const e1 = appendEvent('POLICY_ISSUANCE', { artifact_hash: artRef }, genesis, chainKP);
+    const e2 = appendEvent('INTERACTION_RECEIPT', { receipt_id: receipt.receipt_id }, e1, chainKP);
+    const chain = [genesis, e1, e2];
+    const { checkpoint } = createCheckpoint(chain);
+    const proof = eventInclusionProof(chain, e1.sequence_number);
+    const bundle = generateBundle(artifact, [receipt], [proof], checkpoint, portalKP);
+    cachedBundle = {
+        bundle: JSON.stringify(bundle, null, 2),
+        issuerPkHex: pkToHex(issuerKP.publicKey),
+    };
+    return cachedBundle;
+}
+export const SAMPLE_BUNDLE_URI = 'aga://sample-bundle';
+//# sourceMappingURL=sample-bundle.js.map

package/dist/resources/sample-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sample-bundle.js","sourceRoot":"","sources":["../../src/resources/sample-bundle.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAuB,MAAM,mBAAmB,CAAC;AAExE,IAAI,YAAY,GAAmD,IAAI,CAAC;AAExE,MAAM,UAAU,oBAAoB;IAClC,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAElC,MAAM,OAAO,GAAG,2CAA2C,CAAC;IAC5D,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,0BAA0B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;IAE/G,MAAM,QAAQ,GAAG,gBAAgB,CAAC;QAChC,kBAAkB,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;QACzE,WAAW,EAAE,GAAG,CAAC,WAAY,EAAE,SAAS,EAAE,GAAG,CAAC,SAAU;QACxD,sBAAsB,EAAE;YACtB,sBAAsB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI;YAC/C,oBAAoB,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC;YACjD,uBAAuB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,kBAAkB,CAAC;SACvE;QACD,iBAAiB,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE;QAClE,oBAAoB,EAAE,GAAG,CAAC,oBAAoB,EAAE,cAAc,EAAE,QAAQ;KACzE,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,eAAe,CAAC;QAC9B,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM;QACrC,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC3D,aAAa,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI;QAC1D,eAAe,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ;KACtE,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IACnE,MAAM,EAAE,GAAG,WAAW,CAAC,iBAAiB,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACvF,MAAM,EAAE,GAAG,WAAW,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAChC,MAAM,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAElF,YAAY,GAAG;QACb,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;KACzC,CAAC;IACF,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC"}

package/dist/resources/specification.d.ts

@@ -0,0 +1,3 @@
+export declare const PROTOCOL_SPECIFICATION = "# Attested Governance Artifact (AGA) Protocol Specification v2.0.0\n\n## NIST References\n- NIST-2025-0035: AI Agent Transparency and Accountability\n- NCCoE AI Agent Identity and Authorization\n\n## Protocol Overview\nThe AGA protocol provides cryptographic governance for autonomous AI systems through:\n1. **Sealed Hash Attestation** - SHA-256(bytes_hash || metadata_hash || policy_ref || seal_salt)\n2. **Continuity Chain** - Tamper-evident append-only event log with privacy-preserving leaf hashes\n3. **Portal State Machine** - Zero-trust Policy Enforcement Point (7 states, fail-closed)\n4. **Signed Receipts** - Ed25519-signed measurement receipt for EVERY measurement\n5. **Evidence Bundles** - Offline-verifiable packages with Merkle inclusion proofs\n\n## 10 Measurement Embodiments\n1. EXECUTABLE_IMAGE - Runtime binary or script content\n2. LOADED_MODULES - Dynamic libraries and plugins\n3. CONTAINER_IMAGE - Container image manifest hash\n4. CONFIG_MANIFEST - Configuration file integrity\n5. SBOM - Software Bill of Materials verification\n6. TEE_QUOTE - Trusted Execution Environment attestation\n7. MEMORY_REGIONS - Runtime memory layout verification\n8. CONTROL_FLOW - Execution path integrity\n9. FILE_SYSTEM_STATE - Filesystem integrity monitoring\n10. NETWORK_CONFIG - Network configuration baseline\n\n## 6 Portal States\n1. INITIALIZATION - Server started, no artifact loaded\n2. ARTIFACT_VERIFICATION - Verifying artifact signature and validity\n3. ACTIVE_MONITORING - Operational, measurements occurring\n4. DRIFT_DETECTED - Hash mismatch detected, enforcement pending\n5. PHANTOM_QUARANTINE - Forensic capture mode, outputs severed\n6. TERMINATED - Fail-closed, no recovery without re-attestation\n\nPlus SAFE_STATE for graceful degradation on revocation.\n\n## 7 Enforcement Actions\n1. QUARANTINE - Phantom execution with forensic capture\n2. TERMINATE - Immediate kill, fail-closed\n3. SAFE_STATE - Return-to-home / controlled shutdown\n4. NETWORK_ISOLATE - Sever network, continue local\n5. KEY_REVOKE - Invalidate cryptographic keys\n6. TOKEN_INVALIDATE - Revoke access tokens\n7. ALERT_ONLY - Log without enforcement (gradual deployment)\n\n## 3 Verification Tiers\n| Tier | Description | Trust Assumption |\n|------|-------------|-----------------|\n| Bronze | Cryptographic signatures only | Trust signing keys |\n| Silver | Signatures + continuity chain | Trust chain operator + keys |\n| Gold | Full verification with blockchain-anchored Merkle proofs | Minimal trust - external anchor |\n\n## 3 Disclosure Modes\n1. PROOF_ONLY - Returns boolean attestation without revealing the value\n2. REVEAL_MIN - Returns minimal representation (e.g., range instead of exact value)\n3. REVEAL_FULL - Returns the complete claim value\n\n## Leaf Hash Formula (Privacy Innovation)\n```\nleaf_hash = SHA-256(\n  schema_version || \"||\" || protocol_version || \"||\" ||\n  event_type || \"||\" || event_id || \"||\" ||\n  sequence_number || \"||\" || timestamp || \"||\" ||\n  previous_leaf_hash\n)\n```\n**PAYLOAD IS EXCLUDED from the leaf hash.** This is a key privacy innovation - chain integrity can be verified without revealing the contents of any event. Only the structural metadata participates in the hash. The payload is separately integrity-protected via event_signature.\n\n## SPIFFE/SPIRE Integration Point\nSPIRE handles node-to-workload identity (SVID); AGA handles workload-to-intent governance. SPIFFE provides transport-layer identity binding via SVIDs (SPIFFE Verifiable Identity Documents). AGA binds governance policy to the workload's operational intent, creating a complementary layer:\n- SPIFFE: \"This workload IS who it claims to be\" (identity)\n- AGA: \"This workload IS DOING what it was attested to do\" (governance)\n\n## Framework Alignment\n| Framework | AGA Alignment |\n|-----------|--------------|\n| NIST SP 800-53 | SI-7 (Software Integrity), AU-10 (Non-repudiation), SI-4 (Monitoring) |\n| NIST AI RMF | Govern \u2192 Policy Artifacts; Map \u2192 Subject ID; Measure \u2192 Portal + Receipts; Manage \u2192 Enforcement |\n| NIST SP 800-57 | Key management for Ed25519 signing keys |\n| NIST SSDF (SP 800-218) | Software supply chain integrity via sealed hash attestation |\n| NIST SP 800-207 (ZTA) | Zero Trust Architecture - portal as Policy Enforcement Point, never trust, always verify |\n| ISO 42001 | AI management system - governance artifacts as compliance evidence |\n| EU AI Act | High-risk AI system transparency via evidence bundles |\n\n## Cryptographic Primitives\n- **Hashing:** SHA-256 (primary), BLAKE2b-256 (secondary)\n- **Signing:** Ed25519 via @noble/ed25519\n- **Salts:** 128-bit CSPRNG via @noble/hashes/utils\n- **Merkle Trees:** SHA-256 binary tree with inclusion proofs\n- **Serialization:** RFC 8785 deterministic JSON (sorted keys)\n\n## Event Types (12)\nGENESIS, POLICY_ISSUANCE, INTERACTION_RECEIPT, REVOCATION, ATTESTATION,\nANCHOR_BATCH, DISCLOSURE, SUBSTITUTION, KEY_ROTATION, BEHAVIORAL_DRIFT,\nDELEGATION, RE_ATTESTATION\n\n## 4 Sensitivity Levels\n- S1_LOW - Can be revealed fully\n- S2_MODERATE - Can be revealed minimally or proved\n- S3_HIGH - Proof only, auto-substitutes to lower sensitivity\n- S4_CRITICAL - Maximum protection, proof only, cascading substitution\n\n## CoSAI MCP Security Threat Coverage\n\nThe Coalition for Secure AI (CoSAI) published a comprehensive MCP security taxonomy\nidentifying 12 core threat categories and nearly 40 distinct threats specific to Model\nContext Protocol deployments (January 2026). The AGA MCP Server addresses all 12 categories.\n\n| CoSAI Category | Threat Domain | AGA Governance Mechanism |\n|---|---|---|\n| T1: Improper Authentication | Identity & Access | Ed25519 artifact signatures, pinned issuer keys, TTL re-attestation, key rotation chain events |\n| T2: Missing Access Control | Identity & Access | Portal as mandatory enforcement boundary, sealed constraints, delegation with scope diminishment |\n| T3: Input Validation Failures | Input Handling | Runtime measurement against sealed reference, behavioral drift detection |\n| T4: Data/Control Boundary Failures | Input Handling | Behavioral baseline (permitted tools, forbidden sequences, rate limits), phantom execution forensics |\n| T5: Inadequate Data Protection | Data & Code | Salted commitments, privacy-preserving disclosure with substitution, inference risk prevention |\n| T6: Missing Integrity Controls | Data & Code | Content-addressable hash binding, 10 measurement embodiments, continuous runtime verification |\n| T7: Session/Transport Security | Network & Transport | TTL-based artifact expiration, fail-closed on expiry, mid-session revocation, Ed25519 signed receipts |\n| T8: Network Isolation Failures | Network & Transport | Two-process architecture, agent holds no credentials, NETWORK_ISOLATE enforcement action |\n| T9: Trust Boundary Failures | Trust & Design | Enforcement pre-committed by human authorities in sealed artifact, not delegated to LLM |\n| T10: Resource Management | Trust & Design | Per-tool rate limits in behavioral baseline, configurable measurement cadence (10ms to 3600s) |\n| T11: Supply Chain Failures | Operational | Content-addressable hashing at attestation, runtime hash comparison blocks modified components |\n| T12: Insufficient Observability | Operational | Signed receipts, tamper-evident continuity chain, Merkle anchoring, offline evidence bundles |\n\nCoverage: 12 of 12 threat categories addressed.\nSource: CoSAI/OASIS, \"Securing the AI Agent Revolution\" (January 2026)\n\n### CoSAI Recommended Controls and AGA Implementation\n\n1. Strong Identity Throughout the Chain\n   AGA: Ed25519 keypairs for issuer, portal, and chain. Every artifact and receipt\n   cryptographically signed. Key rotation recorded in chain. Delegation produces\n   derived artifacts with independent signatures traceable to the issuing authority.\n\n2. Zero Trust Applied to AI Agents\n   AGA: Portal treats all agent operations as untrusted. Every request measured\n   against sealed reference before authorization. Fail-closed: default state is denial.\n   Agent cannot execute without a valid, signature-verified artifact.\n\n3. Sandbox Everything\n   AGA: Two-process architecture. Agent and portal are separate OS processes.\n   Agent has no credentials, no keys, no direct resource access. Phantom execution\n   provides runtime sandboxing when drift is detected.\n\n4. Defensive Tool Design\n   AGA: Permitted tools sealed in artifact. Forbidden sequences explicitly defined.\n   Rate limits per tool. Portal enforces all constraints mechanically, independent\n   of LLM judgment. Behavioral drift detection catches tool misuse patterns.\n\n5. Supply Chain Lockdown\n   AGA: Content-addressable hash binding at attestation. Runtime measurement\n   detects any component modification. Sealed hash covers all subject bytes,\n   metadata, and policy reference. 10 measurement embodiments for comprehensive\n   coverage.\n\n6. Observability from Day One\n   AGA: Signed receipt for every measurement. Tamper-evident continuity chain.\n   Structural metadata linking enables third-party verification without payload\n   disclosure. Merkle checkpoint anchoring. Portable offline evidence bundles.\n";
+export declare const SPECIFICATION_URI = "aga://specification";
+//# sourceMappingURL=specification.d.ts.map

package/dist/resources/specification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"specification.d.ts","sourceRoot":"","sources":["../../src/resources/specification.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,siSA8JlC,CAAC;AAEF,eAAO,MAAM,iBAAiB,wBAAwB,CAAC"}

package/dist/resources/specification.js

@@ -0,0 +1,161 @@
+export const PROTOCOL_SPECIFICATION = `# Attested Governance Artifact (AGA) Protocol Specification v2.0.0
+
+## NIST References
+- NIST-2025-0035: AI Agent Transparency and Accountability
+- NCCoE AI Agent Identity and Authorization
+
+## Protocol Overview
+The AGA protocol provides cryptographic governance for autonomous AI systems through:
+1. **Sealed Hash Attestation** - SHA-256(bytes_hash || metadata_hash || policy_ref || seal_salt)
+2. **Continuity Chain** - Tamper-evident append-only event log with privacy-preserving leaf hashes
+3. **Portal State Machine** - Zero-trust Policy Enforcement Point (7 states, fail-closed)
+4. **Signed Receipts** - Ed25519-signed measurement receipt for EVERY measurement
+5. **Evidence Bundles** - Offline-verifiable packages with Merkle inclusion proofs
+
+## 10 Measurement Embodiments
+1. EXECUTABLE_IMAGE - Runtime binary or script content
+2. LOADED_MODULES - Dynamic libraries and plugins
+3. CONTAINER_IMAGE - Container image manifest hash
+4. CONFIG_MANIFEST - Configuration file integrity
+5. SBOM - Software Bill of Materials verification
+6. TEE_QUOTE - Trusted Execution Environment attestation
+7. MEMORY_REGIONS - Runtime memory layout verification
+8. CONTROL_FLOW - Execution path integrity
+9. FILE_SYSTEM_STATE - Filesystem integrity monitoring
+10. NETWORK_CONFIG - Network configuration baseline
+
+## 6 Portal States
+1. INITIALIZATION - Server started, no artifact loaded
+2. ARTIFACT_VERIFICATION - Verifying artifact signature and validity
+3. ACTIVE_MONITORING - Operational, measurements occurring
+4. DRIFT_DETECTED - Hash mismatch detected, enforcement pending
+5. PHANTOM_QUARANTINE - Forensic capture mode, outputs severed
+6. TERMINATED - Fail-closed, no recovery without re-attestation
+
+Plus SAFE_STATE for graceful degradation on revocation.
+
+## 7 Enforcement Actions
+1. QUARANTINE - Phantom execution with forensic capture
+2. TERMINATE - Immediate kill, fail-closed
+3. SAFE_STATE - Return-to-home / controlled shutdown
+4. NETWORK_ISOLATE - Sever network, continue local
+5. KEY_REVOKE - Invalidate cryptographic keys
+6. TOKEN_INVALIDATE - Revoke access tokens
+7. ALERT_ONLY - Log without enforcement (gradual deployment)
+
+## 3 Verification Tiers
+| Tier | Description | Trust Assumption |
+|------|-------------|-----------------|
+| Bronze | Cryptographic signatures only | Trust signing keys |
+| Silver | Signatures + continuity chain | Trust chain operator + keys |
+| Gold | Full verification with blockchain-anchored Merkle proofs | Minimal trust - external anchor |
+
+## 3 Disclosure Modes
+1. PROOF_ONLY - Returns boolean attestation without revealing the value
+2. REVEAL_MIN - Returns minimal representation (e.g., range instead of exact value)
+3. REVEAL_FULL - Returns the complete claim value
+
+## Leaf Hash Formula (Privacy Innovation)
+\`\`\`
+leaf_hash = SHA-256(
+  schema_version || "||" || protocol_version || "||" ||
+  event_type || "||" || event_id || "||" ||
+  sequence_number || "||" || timestamp || "||" ||
+  previous_leaf_hash
+)
+\`\`\`
+**PAYLOAD IS EXCLUDED from the leaf hash.** This is a key privacy innovation - chain integrity can be verified without revealing the contents of any event. Only the structural metadata participates in the hash. The payload is separately integrity-protected via event_signature.
+
+## SPIFFE/SPIRE Integration Point
+SPIRE handles node-to-workload identity (SVID); AGA handles workload-to-intent governance. SPIFFE provides transport-layer identity binding via SVIDs (SPIFFE Verifiable Identity Documents). AGA binds governance policy to the workload's operational intent, creating a complementary layer:
+- SPIFFE: "This workload IS who it claims to be" (identity)
+- AGA: "This workload IS DOING what it was attested to do" (governance)
+
+## Framework Alignment
+| Framework | AGA Alignment |
+|-----------|--------------|
+| NIST SP 800-53 | SI-7 (Software Integrity), AU-10 (Non-repudiation), SI-4 (Monitoring) |
+| NIST AI RMF | Govern → Policy Artifacts; Map → Subject ID; Measure → Portal + Receipts; Manage → Enforcement |
+| NIST SP 800-57 | Key management for Ed25519 signing keys |
+| NIST SSDF (SP 800-218) | Software supply chain integrity via sealed hash attestation |
+| NIST SP 800-207 (ZTA) | Zero Trust Architecture - portal as Policy Enforcement Point, never trust, always verify |
+| ISO 42001 | AI management system - governance artifacts as compliance evidence |
+| EU AI Act | High-risk AI system transparency via evidence bundles |
+
+## Cryptographic Primitives
+- **Hashing:** SHA-256 (primary), BLAKE2b-256 (secondary)
+- **Signing:** Ed25519 via @noble/ed25519
+- **Salts:** 128-bit CSPRNG via @noble/hashes/utils
+- **Merkle Trees:** SHA-256 binary tree with inclusion proofs
+- **Serialization:** RFC 8785 deterministic JSON (sorted keys)
+
+## Event Types (12)
+GENESIS, POLICY_ISSUANCE, INTERACTION_RECEIPT, REVOCATION, ATTESTATION,
+ANCHOR_BATCH, DISCLOSURE, SUBSTITUTION, KEY_ROTATION, BEHAVIORAL_DRIFT,
+DELEGATION, RE_ATTESTATION
+
+## 4 Sensitivity Levels
+- S1_LOW - Can be revealed fully
+- S2_MODERATE - Can be revealed minimally or proved
+- S3_HIGH - Proof only, auto-substitutes to lower sensitivity
+- S4_CRITICAL - Maximum protection, proof only, cascading substitution
+
+## CoSAI MCP Security Threat Coverage
+
+The Coalition for Secure AI (CoSAI) published a comprehensive MCP security taxonomy
+identifying 12 core threat categories and nearly 40 distinct threats specific to Model
+Context Protocol deployments (January 2026). The AGA MCP Server addresses all 12 categories.
+
+| CoSAI Category | Threat Domain | AGA Governance Mechanism |
+|---|---|---|
+| T1: Improper Authentication | Identity & Access | Ed25519 artifact signatures, pinned issuer keys, TTL re-attestation, key rotation chain events |
+| T2: Missing Access Control | Identity & Access | Portal as mandatory enforcement boundary, sealed constraints, delegation with scope diminishment |
+| T3: Input Validation Failures | Input Handling | Runtime measurement against sealed reference, behavioral drift detection |
+| T4: Data/Control Boundary Failures | Input Handling | Behavioral baseline (permitted tools, forbidden sequences, rate limits), phantom execution forensics |
+| T5: Inadequate Data Protection | Data & Code | Salted commitments, privacy-preserving disclosure with substitution, inference risk prevention |
+| T6: Missing Integrity Controls | Data & Code | Content-addressable hash binding, 10 measurement embodiments, continuous runtime verification |
+| T7: Session/Transport Security | Network & Transport | TTL-based artifact expiration, fail-closed on expiry, mid-session revocation, Ed25519 signed receipts |
+| T8: Network Isolation Failures | Network & Transport | Two-process architecture, agent holds no credentials, NETWORK_ISOLATE enforcement action |
+| T9: Trust Boundary Failures | Trust & Design | Enforcement pre-committed by human authorities in sealed artifact, not delegated to LLM |
+| T10: Resource Management | Trust & Design | Per-tool rate limits in behavioral baseline, configurable measurement cadence (10ms to 3600s) |
+| T11: Supply Chain Failures | Operational | Content-addressable hashing at attestation, runtime hash comparison blocks modified components |
+| T12: Insufficient Observability | Operational | Signed receipts, tamper-evident continuity chain, Merkle anchoring, offline evidence bundles |
+
+Coverage: 12 of 12 threat categories addressed.
+Source: CoSAI/OASIS, "Securing the AI Agent Revolution" (January 2026)
+
+### CoSAI Recommended Controls and AGA Implementation
+
+1. Strong Identity Throughout the Chain
+   AGA: Ed25519 keypairs for issuer, portal, and chain. Every artifact and receipt
+   cryptographically signed. Key rotation recorded in chain. Delegation produces
+   derived artifacts with independent signatures traceable to the issuing authority.
+
+2. Zero Trust Applied to AI Agents
+   AGA: Portal treats all agent operations as untrusted. Every request measured
+   against sealed reference before authorization. Fail-closed: default state is denial.
+   Agent cannot execute without a valid, signature-verified artifact.
+
+3. Sandbox Everything
+   AGA: Two-process architecture. Agent and portal are separate OS processes.
+   Agent has no credentials, no keys, no direct resource access. Phantom execution
+   provides runtime sandboxing when drift is detected.
+
+4. Defensive Tool Design
+   AGA: Permitted tools sealed in artifact. Forbidden sequences explicitly defined.
+   Rate limits per tool. Portal enforces all constraints mechanically, independent
+   of LLM judgment. Behavioral drift detection catches tool misuse patterns.
+
+5. Supply Chain Lockdown
+   AGA: Content-addressable hash binding at attestation. Runtime measurement
+   detects any component modification. Sealed hash covers all subject bytes,
+   metadata, and policy reference. 10 measurement embodiments for comprehensive
+   coverage.
+
+6. Observability from Day One
+   AGA: Signed receipt for every measurement. Tamper-evident continuity chain.
+   Structural metadata linking enables third-party verification without payload
+   disclosure. Merkle checkpoint anchoring. Portable offline evidence bundles.
+`;
+export const SPECIFICATION_URI = 'aga://specification';
+//# sourceMappingURL=specification.js.map

package/dist/resources/specification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"specification.js","sourceRoot":"","sources":["../../src/resources/specification.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8JrC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC"}

package/dist/server.d.ts

@@ -1,12 +1,8 @@
 /**
- * AGA MCP Server. The Portal (ref 150) as an MCP service.
+ * AGA MCP Server V2.0.0 - The Portal (ref 150) as an MCP service.
  *
- * V3 NIST-aligned behaviors:
- * 1. Every measurement generates a receipt (match OR mismatch)
- * 2. TTL checked on every measurement (fail-closed)
- * 3. Mid-session revocation via revoke_artifact tool
- * 4. Governance middleware: portal state checked before tool execution
- * 5. Auto-chaining: every operation writes to continuity chain
+ * 20 tools, 3 resources, 3 prompts.
+ * NIST-2025-0035, NCCoE AI Agent Identity and Authorization
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 export declare function createAGAServer(): Promise<McpServer>;

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAiDpE,wBAAsB,eAAe,IAAI,OAAO,CAAC,SAAS,CAAC,CAwX1D"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAwCpE,wBAAsB,eAAe,IAAI,OAAO,CAAC,SAAS,CAAC,CAiW1D"}