@attested-intelligence/aga-mcp-server 2.0.1 → 2.2.0

package/src/proxy/verify.ts

@@ -0,0 +1,202 @@
+/**
+ * AGA Gateway Bundle Verifier
+ * Verifies Ed25519-SHA256-JCS evidence bundles.
+ * Uses ONLY @noble crypto - zero imports from ../core/ or ../crypto/.
+ *
+ * 5-step verification matching gateway, Python SDK, and browser verifier:
+ * 1. Algorithm check
+ * 2. Receipt signature verification
+ * 3. Chain integrity (previous_receipt_hash linkage)
+ * 4. Merkle inclusion proofs
+ * 5. Bundle consistency (leaf hashes match receipts)
+ *
+ * Patent: USPTO App. No. 19/433,835
+ * Copyright (c) 2026 Attested Intelligence Holdings LLC
+ * SPDX-License-Identifier: MIT
+ */
+
+import * as ed from '@noble/ed25519';
+import { sha512 } from '@noble/hashes/sha512';
+import { sha256 } from '@noble/hashes/sha256';
+import { bytesToHex, hexToBytes } from '@noble/hashes/utils';
+
+// Ed25519 setup
+ed.etc.sha512Sync = (...m: Uint8Array[]) => {
+  const total = m.reduce((n, a) => n + a.length, 0);
+  const buf = new Uint8Array(total);
+  let off = 0;
+  for (const a of m) { buf.set(a, off); off += a.length; }
+  return sha512(buf);
+};
+
+const enc = new TextEncoder();
+
+// ── RFC 8785 Canonicalization ────────────────────────────────
+
+function deepSortKeys(obj: unknown): unknown {
+  if (obj === null || obj === undefined || typeof obj !== 'object') return obj;
+  if (Array.isArray(obj)) return obj.map(deepSortKeys);
+  const sorted: Record<string, unknown> = {};
+  for (const key of Object.keys(obj as Record<string, unknown>).sort()) {
+    sorted[key] = deepSortKeys((obj as Record<string, unknown>)[key]);
+  }
+  return sorted;
+}
+
+function canonicalize(obj: unknown): string {
+  return JSON.stringify(deepSortKeys(obj));
+}
+
+function sha256Hex(data: string): string {
+  return bytesToHex(sha256(enc.encode(data)));
+}
+
+function merkleNodeHash(leftHex: string, rightHex: string): string {
+  const left = hexToBytes(leftHex);
+  const right = hexToBytes(rightHex);
+  const combined = new Uint8Array(left.length + right.length);
+  combined.set(left, 0);
+  combined.set(right, left.length);
+  return bytesToHex(sha256(combined));
+}
+
+// ── Verification result ─────────────────────────────────────
+
+export interface GatewayVerificationResult {
+  algorithm_valid: boolean;
+  receipt_signatures_valid: boolean;
+  chain_integrity_valid: boolean;
+  merkle_proofs_valid: boolean;
+  bundle_consistent: boolean;
+  overall_valid: boolean;
+  receipts_checked: number;
+  algorithm: string;
+  error?: string;
+}
+
+// ── 5-step verification ─────────────────────────────────────
+
+export async function verifyGatewayBundle(bundleJson: string): Promise<GatewayVerificationResult> {
+  let bundle: any;
+  try {
+    bundle = JSON.parse(bundleJson);
+  } catch {
+    return {
+      algorithm_valid: false, receipt_signatures_valid: false,
+      chain_integrity_valid: false, merkle_proofs_valid: false,
+      bundle_consistent: false, overall_valid: false,
+      receipts_checked: 0, algorithm: '', error: 'Invalid JSON',
+    };
+  }
+
+  const result: GatewayVerificationResult = {
+    algorithm_valid: false, receipt_signatures_valid: false,
+    chain_integrity_valid: false, merkle_proofs_valid: false,
+    bundle_consistent: false, overall_valid: false,
+    receipts_checked: bundle.receipts?.length ?? 0,
+    algorithm: bundle.algorithm ?? '',
+  };
+
+  // Step 1: Algorithm
+  if (bundle.algorithm !== 'Ed25519-SHA256-JCS') {
+    result.error = `unsupported algorithm: ${bundle.algorithm}`;
+    return result;
+  }
+  for (const r of bundle.receipts) {
+    if (r.algorithm !== 'Ed25519-SHA256-JCS') {
+      result.error = `receipt has wrong algorithm: ${r.algorithm}`;
+      return result;
+    }
+  }
+  result.algorithm_valid = true;
+
+  // Step 2: Receipt signatures
+  try {
+    for (const receipt of bundle.receipts) {
+      const { signature, ...unsigned } = receipt;
+      const canonical = canonicalize(unsigned);
+      const sig = hexToBytes(signature);
+      const pk = hexToBytes(receipt.public_key);
+      if (!ed.verify(sig, enc.encode(canonical), pk)) {
+        result.error = `Receipt ${receipt.receipt_id} signature failed`;
+        return result;
+      }
+    }
+    result.receipt_signatures_valid = true;
+  } catch (e) {
+    result.error = `signature verification error: ${e}`;
+    return result;
+  }
+
+  // Step 3: Chain integrity
+  try {
+    const receipts = bundle.receipts;
+    if (receipts.length > 0 && receipts[0].previous_receipt_hash !== '') {
+      result.error = 'First receipt previous_receipt_hash must be empty';
+      return result;
+    }
+    for (let i = 1; i < receipts.length; i++) {
+      const expectedHash = sha256Hex(canonicalize(receipts[i - 1]));
+      if (receipts[i].previous_receipt_hash !== expectedHash) {
+        result.error = `Chain break at receipt ${i}`;
+        return result;
+      }
+    }
+    result.chain_integrity_valid = true;
+  } catch (e) {
+    result.error = `chain integrity error: ${e}`;
+    return result;
+  }
+
+  // Step 4: Merkle proofs
+  try {
+    for (const proof of bundle.merkle_proofs) {
+      let currentHash = proof.leaf_hash;
+      for (let i = 0; i < proof.siblings.length; i++) {
+        if (proof.directions[i] === 'left') {
+          currentHash = merkleNodeHash(proof.siblings[i], currentHash);
+        } else {
+          currentHash = merkleNodeHash(currentHash, proof.siblings[i]);
+        }
+      }
+      if (currentHash !== bundle.merkle_root) {
+        result.error = `Merkle proof failed for leaf ${proof.leaf_index}`;
+        return result;
+      }
+      if (proof.merkle_root !== bundle.merkle_root) {
+        result.error = `Proof root mismatch at leaf ${proof.leaf_index}`;
+        return result;
+      }
+    }
+    result.merkle_proofs_valid = true;
+  } catch (e) {
+    result.error = `merkle proof error: ${e}`;
+    return result;
+  }
+
+  // Step 5: Bundle consistency
+  try {
+    if (bundle.merkle_proofs.length !== bundle.receipts.length) {
+      result.error = 'Proof count != receipt count';
+      return result;
+    }
+    for (let i = 0; i < bundle.receipts.length; i++) {
+      const leafHash = sha256Hex(canonicalize(bundle.receipts[i]));
+      if (bundle.merkle_proofs[i].leaf_hash !== leafHash) {
+        result.error = `Leaf hash mismatch at receipt ${i}`;
+        return result;
+      }
+      if (bundle.merkle_proofs[i].leaf_index !== i) {
+        result.error = `Leaf index mismatch at receipt ${i}`;
+        return result;
+      }
+    }
+    result.bundle_consistent = true;
+  } catch (e) {
+    result.error = `consistency error: ${e}`;
+    return result;
+  }
+
+  result.overall_valid = true;
+  return result;
+}

package/src/server.ts

@@ -0,0 +1,435 @@
+/**
+ * AGA MCP Server. The Portal (ref 150) as an MCP service.
+ *
+ * V3 NIST-aligned behaviors:
+ * 1. Every measurement generates a receipt (match OR mismatch)
+ * 2. TTL checked on every measurement (fail-closed)
+ * 3. Mid-session revocation via revoke_artifact tool
+ * 4. Governance middleware: portal state checked before tool execution
+ * 5. Auto-chaining: every operation writes to continuity chain
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import { generateKeyPair, pkToHex } from './crypto/sign.js';
+import { sha256Str } from './crypto/hash.js';
+import { computeSubjectIdFromString } from './core/subject.js';
+import { performAttestation } from './core/attestation.js';
+import { generateArtifact, hashArtifact } from './core/artifact.js';
+import { Portal } from './core/portal.js';
+import { generateReceipt } from './core/receipt.js';
+import { createGenesisEvent, appendEvent, verifyChainIntegrity } from './core/chain.js';
+import { createCheckpoint, eventInclusionProof } from './core/checkpoint.js';
+import { generateBundle, verifyBundleOffline } from './core/bundle.js';
+import { processDisclosure } from './core/disclosure.js';
+import { initQuarantine, captureInput } from './core/quarantine.js';
+import { MemoryStorage, type AGAStorage } from './storage/index.js';
+import { utcNow } from './utils/timestamp.js';
+import { deriveArtifact } from './core/delegation.js';
+import { createGovernanceWrapper, type ToolHandler } from './middleware/governance.js';
+import { BehavioralMonitor } from './core/behavioral.js';
+import type { EnforcementParams, DisclosurePolicy, QuarantineState, RevocationRecord } from './core/types.js';
+
+// ── Default Policies ────────────────────────────────────────────
+
+const DEFAULT_ENFORCEMENT: EnforcementParams = {
+  measurement_cadence_ms: 1000, ttl_seconds: 3600,
+  enforcement_triggers: ['QUARANTINE', 'TERMINATE'],
+  re_attestation_required: true,
+  measurement_types: ['FILE_SYSTEM_STATE', 'CONFIG_MANIFEST'],
+};
+
+const DEFAULT_CLAIMS: DisclosurePolicy = {
+  claims_taxonomy: [
+    { claim_id: 'identity.name', sensitivity: 'S3_HIGH', substitutes: ['identity.pseudonym', 'identity.org'], inference_risks: [], permitted_modes: ['PROOF_ONLY'] },
+    { claim_id: 'identity.pseudonym', sensitivity: 'S2_MODERATE', substitutes: ['identity.org'], inference_risks: [], permitted_modes: ['PROOF_ONLY', 'REVEAL_MIN'] },
+    { claim_id: 'identity.org', sensitivity: 'S1_LOW', substitutes: [], inference_risks: [], permitted_modes: ['PROOF_ONLY', 'REVEAL_MIN', 'REVEAL_FULL'] },
+    { claim_id: 'identity.age', sensitivity: 'S3_HIGH', substitutes: ['identity.age_range', 'identity.is_adult'], inference_risks: [], permitted_modes: ['PROOF_ONLY'] },
+    { claim_id: 'identity.age_range', sensitivity: 'S2_MODERATE', substitutes: ['identity.is_adult'], inference_risks: [], permitted_modes: ['PROOF_ONLY', 'REVEAL_MIN', 'REVEAL_FULL'] },
+    { claim_id: 'identity.is_adult', sensitivity: 'S1_LOW', substitutes: [], inference_risks: [], permitted_modes: ['PROOF_ONLY', 'REVEAL_FULL'] },
+  ],
+  substitution_rules: [],
+};
+
+const CLAIM_VALUES: Record<string, unknown> = {
+  'identity.name': 'Alice Johnson', 'identity.pseudonym': 'AJ-7742', 'identity.org': 'Attested Intelligence',
+  'identity.age': 32, 'identity.age_range': '25-34', 'identity.is_adult': true,
+};
+
+// ── Server Factory ──────────────────────────────────────────────
+
+export async function createAGAServer(): Promise<McpServer> {
+  const server = new McpServer({ name: 'aga-mcp-server', version: '0.1.0' });
+  const storage: AGAStorage = new MemoryStorage();
+  await storage.initialize();
+
+  const issuerKP = generateKeyPair();
+  const portalKP = generateKeyPair();
+  const chainKP  = generateKeyPair();
+  const portal   = new Portal();
+  let quarantine: QuarantineState | null = null;
+  let chainInitialized = false;
+
+  // ── Auto-chain helper (auto-inits if needed) ──────────────────
+  async function autoChain(type: Parameters<typeof appendEvent>[0], payload: unknown) {
+    if (!chainInitialized) {
+      const genesis = createGenesisEvent(chainKP, sha256Str('AGA Protocol Specification v1.0.0'));
+      await storage.storeEvent(genesis);
+      chainInitialized = true;
+      portal.sequenceCounter = 0;
+      portal.lastLeafHash = genesis.leaf_hash;
+    }
+    const prev = await storage.getLatestEvent();
+    if (!prev) throw new Error('Chain initialization failed');
+    const event = appendEvent(type, payload, prev, chainKP);
+    await storage.storeEvent(event);
+    portal.sequenceCounter = event.sequence_number;
+    portal.lastLeafHash = event.leaf_hash;
+    return event;
+  }
+
+  const j = (x: unknown) => ({ content: [{ type: 'text' as const, text: JSON.stringify(x, null, 2) }] });
+
+  // ── Governance middleware (NCCoE Section 4: Portal as PEP) ────
+  const quarantineRef = { get current() { return quarantine; } };
+  const behavioralMonitor = new BehavioralMonitor();
+
+  function governedTool(
+    name: string, description: string, schema: any,
+    handler: ToolHandler
+  ) {
+    const wrap = createGovernanceWrapper(portal, quarantineRef, name, behavioralMonitor);
+    server.tool(name, description, schema, wrap(handler));
+  }
+
+  // ══════════════════════════════════════════════════════════════
+  // TOOL: get_server_info
+  // ══════════════════════════════════════════════════════════════
+  server.tool('get_server_info', 'Get AGA server info, public keys, and portal state.', {}, async () => j({
+    server: 'AGA MCP Server', version: '0.1.0',
+    protocol: 'Attested Governance Artifacts v1.0.0',
+    nist_references: ['NIST-2025-0035', 'NCCoE AI Agent Identity'],
+    issuer_public_key: pkToHex(issuerKP.publicKey),
+    portal_public_key: pkToHex(portalKP.publicKey),
+    chain_public_key: pkToHex(chainKP.publicKey),
+    chain_initialized: chainInitialized,
+    portal_state: portal.state,
+  }));
+
+  // ══════════════════════════════════════════════════════════════
+  // TOOL: get_portal_state - V3 RESTORED (was dropped in V2)
+  // ══════════════════════════════════════════════════════════════
+  server.tool('get_portal_state', 'Get current portal state, loaded artifact info, and enforcement status.', {}, async () => j({
+    state: portal.state,
+    artifact_loaded: !!portal.artifact,
+    sealed_hash: portal.artifact?.sealed_hash ?? null,
+    ttl_seconds: portal.artifact?.enforcement_parameters.ttl_seconds ?? null,
+    issued_at: portal.artifact?.issued_timestamp ?? null,
+    enforcement_triggers: portal.artifact?.enforcement_parameters.enforcement_triggers ?? [],
+    sequence_counter: portal.sequenceCounter,
+    quarantine_active: quarantine?.active ?? false,
+  }));
+
+  // ══════════════════════════════════════════════════════════════
+  // TOOL: init_chain
+  // ══════════════════════════════════════════════════════════════
+  server.tool('init_chain', 'Initialize continuity chain with genesis event.',
+    { specification_hash: z.string().optional() },
+    async ({ specification_hash }) => {
+      if (chainInitialized) return j({ success: false, error: 'Chain already initialized' });
+      const genesis = createGenesisEvent(chainKP, specification_hash ?? sha256Str('AGA Protocol Specification v1.0.0'));
+      await storage.storeEvent(genesis);
+      chainInitialized = true;
+      portal.sequenceCounter = 0;
+      portal.lastLeafHash = genesis.leaf_hash;
+      return j({ success: true, genesis_event_id: genesis.event_id, genesis_leaf_hash: genesis.leaf_hash });
+    }
+  );
+
+  // ══════════════════════════════════════════════════════════════
+  // TOOL: attest_subject
+  // ══════════════════════════════════════════════════════════════
+  server.tool('attest_subject',
+    'Attest subject, generate sealed Policy Artifact. Auto-loads into portal.',
+    {
+      subject_content: z.string().describe('Content/bytes of the subject'),
+      subject_metadata: z.object({ filename: z.string().optional(), version: z.string().optional(), author: z.string().optional(), content_type: z.string().optional() }),
+      evidence_items: z.array(z.object({ label: z.string(), content: z.string() })).default([]),
+      behavioral_baseline: z.object({
+        permitted_tools: z.array(z.string()),
+        rate_limits: z.record(z.number()),
+        forbidden_sequences: z.array(z.array(z.string())),
+        window_ms: z.number(),
+      }).optional(),
+    },
+    async ({ subject_content, subject_metadata, evidence_items, behavioral_baseline }) => {
+      const subId = computeSubjectIdFromString(subject_content, subject_metadata);
+      const policyRef = sha256Str(JSON.stringify(DEFAULT_ENFORCEMENT));
+      const att = performAttestation({ subject_identifier: subId, policy_reference: policyRef, evidence_items });
+      if (!att.success || !att.sealed_hash || !att.seal_salt) return j({ success: false, error: att.rejection_reason });
+
+      const artifact = generateArtifact({
+        subject_identifier: subId, policy_reference: policyRef, policy_version: 1,
+        sealed_hash: att.sealed_hash, seal_salt: att.seal_salt,
+        enforcement_parameters: DEFAULT_ENFORCEMENT, disclosure_policy: DEFAULT_CLAIMS,
+        evidence_commitments: att.evidence_commitments, issuer_keypair: issuerKP,
+      });
+      await storage.storeArtifact(artifact);
+
+      portal.reset();
+      portal.loadArtifact(artifact, pkToHex(issuerKP.publicKey));
+      quarantine = null;
+      behavioralMonitor.reset();
+      if (behavioral_baseline) behavioralMonitor.setBaseline(behavioral_baseline);
+
+      await autoChain('POLICY_ISSUANCE', { artifact_hash: hashArtifact(artifact), sealed_hash: artifact.sealed_hash });
+
+      return j({
+        success: true, artifact_hash: hashArtifact(artifact), sealed_hash: artifact.sealed_hash,
+        subject_identifier: subId, portal_state: portal.state,
+        issuer_public_key: pkToHex(issuerKP.publicKey),
+      });
+    }
+  );
+
+  // ══════════════════════════════════════════════════════════════
+  // TOOL: measure_integrity
+  // V3: Generates receipt for EVERY measurement (match or mismatch)
+  // V3: Checks TTL and revocation (fail-closed)
+  // ══════════════════════════════════════════════════════════════
+  governedTool('measure_integrity',
+    'Measure subject state, compare to sealed reference. Generates signed receipt for every measurement.',
+    {
+      subject_content: z.string().describe('Current content of the subject'),
+      subject_metadata: z.object({ filename: z.string().optional(), version: z.string().optional(), author: z.string().optional(), content_type: z.string().optional() }),
+    },
+    async ({ subject_content, subject_metadata }) => {
+      if (!portal.artifact) return j({ success: false, error: 'No artifact loaded. Call attest_subject first.' });
+      if (portal.state === 'TERMINATED') return j({ success: false, error: 'Portal is terminated. Re-attest required.' });
+
+      const result = portal.measure(new TextEncoder().encode(subject_content), subject_metadata);
+      const artRef = hashArtifact(portal.artifact);
+      const currentStr = result.currentBytesHash ? `${result.currentBytesHash}||${result.currentMetaHash}` : 'UNAVAILABLE';
+      const sealedStr = `${result.expectedBytesHash}||${result.expectedMetaHash}`;
+
+      // Determine enforcement action
+      let action = null as import('./core/types.js').EnforcementAction | null;
+      let driftDesc: string | null = null;
+
+      if (!result.ttl_ok) {
+        driftDesc = 'TTL expired - fail-closed termination';
+        action = 'TERMINATE';
+      } else if (result.revoked) {
+        driftDesc = 'Artifact revoked - fail-closed termination';
+        action = 'TERMINATE';
+      } else if (!result.match) {
+        driftDesc = 'Subject modified - hash mismatch';
+        action = portal.artifact.enforcement_parameters.enforcement_triggers[0] ?? 'ALERT_ONLY';
+        portal.enforce(action);
+        if (action === 'QUARANTINE') quarantine = initQuarantine();
+      }
+
+      // V3: Receipt for EVERY measurement - match or mismatch
+      const receipt = generateReceipt({
+        subjectId: portal.artifact.subject_identifier, artifactRef: artRef,
+        currentHash: currentStr, sealedHash: sealedStr,
+        driftDetected: !result.match, driftDescription: driftDesc,
+        action, measurementType: portal.artifact.enforcement_parameters.measurement_types.join(','),
+        seq: portal.sequenceCounter + 1, prevLeaf: portal.lastLeafHash, portalKP,
+      });
+      await storage.storeReceipt(receipt);
+      await autoChain('INTERACTION_RECEIPT', { receipt_id: receipt.receipt_id, drift_detected: !result.match, enforcement_action: action });
+
+      return j({
+        success: true, match: result.match, drift_detected: !result.match,
+        ttl_ok: result.ttl_ok, revoked: result.revoked,
+        enforcement_action: action, portal_state: portal.state,
+        receipt_id: receipt.receipt_id,
+      });
+    }
+  );
+
+  // ══════════════════════════════════════════════════════════════
+  // TOOL: revoke_artifact - V3 NEW (NCCoE Phase 3b)
+  // ══════════════════════════════════════════════════════════════
+  governedTool('revoke_artifact',
+    'Revoke an active policy artifact mid-session. Portal terminates on next measurement. (NCCoE Phase 3b)',
+    {
+      sealed_hash: z.string().describe('Sealed hash of artifact to revoke'),
+      reason: z.string().describe('Reason for revocation'),
+    },
+    async ({ sealed_hash, reason }) => {
+      portal.revoke(sealed_hash);
+      const record: RevocationRecord = {
+        artifact_sealed_hash: sealed_hash, reason,
+        revoked_by: pkToHex(issuerKP.publicKey), timestamp: utcNow(),
+      };
+      await autoChain('REVOCATION', record);
+      return j({ success: true, revoked: sealed_hash, portal_state: portal.state, reason });
+    }
+  );
+
+  // ══════════════════════════════════════════════════════════════
+  // TOOL: verify_chain
+  // ══════════════════════════════════════════════════════════════
+  server.tool('verify_chain', 'Verify continuity chain integrity.', {}, async () => {
+    const events = await storage.getAllEvents();
+    if (!events.length) return j({ success: false, error: 'No events in chain' });
+    const result = verifyChainIntegrity(events);
+    return j({ success: true, chain_valid: result.valid, events_verified: events.length, broken_at: result.brokenAt, error: result.error });
+  });
+
+  // ══════════════════════════════════════════════════════════════
+  // TOOL: create_checkpoint
+  // ══════════════════════════════════════════════════════════════
+  governedTool('create_checkpoint', 'Batch events into Merkle tree, anchor.',
+    { anchor_network: z.string().default('local') },
+    async ({ anchor_network }) => {
+      const lastCP = await storage.getLatestCheckpoint();
+      const startSeq = lastCP ? lastCP.batch_end_sequence + 1 : 0;
+      const latest = await storage.getLatestEvent();
+      if (!latest) return j({ success: false, error: 'No events' });
+      const events = await storage.getEvents(startSeq, latest.sequence_number);
+      if (!events.length) return j({ success: false, error: 'No new events since last checkpoint' });
+      const { checkpoint, payload } = createCheckpoint(events, anchor_network);
+      await storage.storeCheckpoint(checkpoint);
+      await autoChain('ANCHOR_BATCH', payload);
+      return j({ success: true, merkle_root: checkpoint.merkle_root, events_checkpointed: events.length, transaction_id: checkpoint.transaction_id });
+    }
+  );
+
+  // ══════════════════════════════════════════════════════════════
+  // TOOL: generate_evidence_bundle
+  // ══════════════════════════════════════════════════════════════
+  governedTool('generate_evidence_bundle', 'Package artifact + receipts + Merkle proofs for offline verification.', {}, async () => {
+    const artifact = await storage.getLatestArtifact();
+    if (!artifact) return j({ success: false, error: 'No artifact' });
+    const cp = await storage.getLatestCheckpoint();
+    if (!cp) return j({ success: false, error: 'No checkpoint. Call create_checkpoint first.' });
+    const receipts = await storage.getReceiptsByArtifact(hashArtifact(artifact));
+    const batchEvents = await storage.getEvents(cp.batch_start_sequence, cp.batch_end_sequence);
+    const proofs = receipts
+      .filter(r => r.sequence_number >= cp.batch_start_sequence && r.sequence_number <= cp.batch_end_sequence)
+      .map(r => eventInclusionProof(batchEvents, r.sequence_number));
+    const bundle = generateBundle(artifact, receipts, proofs, cp, portalKP);
+    return j({ success: true, bundle, offline_verifiable: true, receipt_count: receipts.length, proof_count: proofs.length });
+  });
+
+  // ══════════════════════════════════════════════════════════════
+  // TOOL: verify_bundle_offline (Section J)
+  // ══════════════════════════════════════════════════════════════
+  governedTool('verify_bundle_offline', 'Verify evidence bundle offline. (Section J)',
+    { bundle: z.any(), pinned_public_key: z.string() },
+    async ({ bundle, pinned_public_key }) => j({ success: true, verification: verifyBundleOffline(bundle, pinned_public_key) })
+  );
+
+  // ══════════════════════════════════════════════════════════════
+  // TOOL: request_claim
+  // ══════════════════════════════════════════════════════════════
+  governedTool('request_claim', 'Request disclosure of a claim. Auto-substitutes if denied.',
+    { claim_id: z.string(), requester_id: z.string().default('anonymous'), mode: z.enum(['PROOF_ONLY', 'REVEAL_MIN', 'REVEAL_FULL']).default('REVEAL_MIN') },
+    async ({ claim_id, requester_id, mode }) => {
+      const latest = await storage.getLatestEvent();
+      const result = processDisclosure(
+        { requested_claim_id: claim_id, requester_id, mode, timestamp: utcNow() },
+        DEFAULT_CLAIMS, CLAIM_VALUES, 1, latest?.sequence_number ?? 0, portalKP
+      );
+      if (result.substitution_receipt) await autoChain('SUBSTITUTION', result.substitution_receipt);
+      else await autoChain('DISCLOSURE', { claim_id, mode, permitted: result.permitted });
+      return j({ success: true, ...result });
+    }
+  );
+
+  // ══════════════════════════════════════════════════════════════
+  // TOOL: list_claims
+  // ══════════════════════════════════════════════════════════════
+  server.tool('list_claims', 'List available claims with sensitivity levels.', {}, async () => {
+    return j({ claims: DEFAULT_CLAIMS.claims_taxonomy.map(c => ({ claim_id: c.claim_id, sensitivity: c.sensitivity, substitutes: c.substitutes, permitted_modes: c.permitted_modes })) });
+  });
+
+  // ══════════════════════════════════════════════════════════════
+  // TOOL: delegate_to_subagent (NCCoE: constrained sub-mandates)
+  // ══════════════════════════════════════════════════════════════
+  governedTool('delegate_to_subagent',
+    'Derive a constrained policy artifact for a sub-agent. Scope can only diminish, never expand. (NCCoE constrained delegation)',
+    {
+      enforcement_triggers: z.array(z.string()).describe('Subset of parent enforcement triggers'),
+      measurement_types: z.array(z.string()).describe('Subset of parent measurement types'),
+      requested_ttl_seconds: z.number().describe('Requested TTL (will be clamped to parent remaining)'),
+      delegation_purpose: z.string().describe('Purpose of the delegation'),
+    },
+    async ({ enforcement_triggers, measurement_types, requested_ttl_seconds, delegation_purpose }) => {
+      if (!portal.artifact) return j({ success: false, error: 'No artifact loaded. Call attest_subject first.' });
+
+      const result = deriveArtifact(portal.artifact, {
+        enforcement_triggers: enforcement_triggers as import('./core/types.js').EnforcementAction[],
+        measurement_types: measurement_types as import('./core/types.js').MeasurementType[],
+        requested_ttl_seconds,
+        delegation_purpose,
+      }, issuerKP);
+
+      if (result.success) {
+        await autoChain('ATTESTATION', {
+          type: 'DELEGATION',
+          parent_artifact_hash: result.parent_artifact_hash,
+          child_artifact_hash: result.child_artifact_hash,
+          effective_ttl: result.effective_ttl_seconds,
+          scope_reduction: result.scope_reduction,
+          purpose: delegation_purpose,
+        });
+      }
+
+      return j(result);
+    }
+  );
+
+  // ══════════════════════════════════════════════════════════════
+  // TOOL: measure_behavior (NIST-2025-0035)
+  // ══════════════════════════════════════════════════════════════
+  server.tool('measure_behavior',
+    'Measure behavioral patterns of agent tool usage. Detects unauthorized tools, rate violations, and forbidden sequences. (NIST-2025-0035)',
+    {},
+    async () => {
+      const measurement = behavioralMonitor.measure();
+      if (measurement.drift_detected) {
+        await autoChain('INTERACTION_RECEIPT', {
+          type: 'BEHAVIORAL_DRIFT',
+          violations: measurement.violations,
+          behavioral_hash: measurement.behavioral_hash,
+        });
+      }
+      return j({
+        success: true,
+        ...measurement,
+        violation_count: measurement.violations.length,
+      });
+    }
+  );
+
+  // ══════════════════════════════════════════════════════════════
+  // TOOL: get_receipts - V3 NEW
+  // ══════════════════════════════════════════════════════════════
+  server.tool('get_receipts', 'Get all signed receipts, optionally filtered by artifact.',
+    { artifact_hash: z.string().optional() },
+    async ({ artifact_hash }) => {
+      const receipts = artifact_hash
+        ? await storage.getReceiptsByArtifact(artifact_hash)
+        : await storage.getAllReceipts();
+      return j({ count: receipts.length, receipts: receipts.map(r => ({ receipt_id: r.receipt_id, drift_detected: r.drift_detected, enforcement_action: r.enforcement_action, measurement_type: r.measurement_type, timestamp: r.timestamp })) });
+    }
+  );
+
+  // ══════════════════════════════════════════════════════════════
+  // TOOL: get_chain_events - V3 NEW
+  // ══════════════════════════════════════════════════════════════
+  server.tool('get_chain_events', 'Get continuity chain events.',
+    { start_seq: z.number().optional(), end_seq: z.number().optional() },
+    async ({ start_seq, end_seq }) => {
+      const events = (start_seq !== undefined && end_seq !== undefined)
+        ? await storage.getEvents(start_seq, end_seq)
+        : await storage.getAllEvents();
+      return j({ count: events.length, events: events.map(e => ({ sequence_number: e.sequence_number, event_type: e.event_type, event_id: e.event_id, timestamp: e.timestamp, leaf_hash: e.leaf_hash.slice(0, 16) + '...' })) });
+    }
+  );
+
+  return server;
+}

package/src/storage/index.ts

@@ -0,0 +1,3 @@
+export type { AGAStorage } from './interface.js';
+export { MemoryStorage } from './memory.js';
+export { SQLiteStorage } from './sqlite.js';

package/src/storage/interface.ts

@@ -0,0 +1,21 @@
+import type { PolicyArtifact, ContinuityEvent, SignedReceipt, CheckpointReference } from '../core/types.js';
+
+export interface AGAStorage {
+  initialize(): Promise<void>;
+  close(): Promise<void>;
+  storeArtifact(a: PolicyArtifact): Promise<void>;
+  getArtifact(sealedHash: string): Promise<PolicyArtifact | null>;
+  getLatestArtifact(): Promise<PolicyArtifact | null>;
+  storeEvent(e: ContinuityEvent): Promise<void>;
+  getEvent(seq: number): Promise<ContinuityEvent | null>;
+  getEvents(startSeq: number, endSeq: number): Promise<ContinuityEvent[]>;
+  getLatestEvent(): Promise<ContinuityEvent | null>;
+  getAllEvents(): Promise<ContinuityEvent[]>;
+  storeReceipt(r: SignedReceipt): Promise<void>;
+  getReceipt(id: string): Promise<SignedReceipt | null>;
+  getReceiptsByArtifact(ref: string): Promise<SignedReceipt[]>;
+  getAllReceipts(): Promise<SignedReceipt[]>;
+  storeCheckpoint(c: CheckpointReference): Promise<void>;
+  getLatestCheckpoint(): Promise<CheckpointReference | null>;
+  getCheckpoints(): Promise<CheckpointReference[]>;
+}