@attested-intelligence/aga-mcp-server 2.0.1 → 2.2.0

package/dist/resources/cosai-mapping.d.ts

@@ -1,24 +0,0 @@
-export declare const COSAI_MCP_SECURITY_MAPPING: {
-    title: string;
-    source: string;
-    whitepaper: string;
-    published: string;
-    url: string;
-    categories: {
-        id: string;
-        name: string;
-        domain: string;
-        cosai_description: string;
-        aga_tools: string[];
-        aga_mechanism: string;
-        nist_ref: string;
-    }[];
-};
-export declare const COSAI_COVERAGE_SUMMARY: {
-    total_threat_categories: number;
-    categories_with_aga_coverage: number;
-    total_tools_referenced: number;
-    unique_cosai_categories_covered: number;
-    nist_submission_sections_referenced: number;
-};
-//# sourceMappingURL=cosai-mapping.d.ts.map

package/dist/resources/cosai-mapping.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cosai-mapping.d.ts","sourceRoot":"","sources":["../../src/resources/cosai-mapping.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;CAsHtC,CAAC;AAGF,eAAO,MAAM,sBAAsB;;;;;;CAMlC,CAAC"}

package/dist/resources/cosai-mapping.js

@@ -1,127 +0,0 @@
-// src/resources/cosai-mapping.ts
-export const COSAI_MCP_SECURITY_MAPPING = {
-    title: 'AGA Coverage of CoSAI MCP Security Threat Taxonomy',
-    source: 'Coalition for Secure AI (CoSAI), OASIS Open Project',
-    whitepaper: 'Securing the AI Agent Revolution: A Practical Guide to Model Context Protocol Security',
-    published: 'January 20, 2026',
-    url: 'https://github.com/cosai-oasis/ws4-secure-design-agentic-systems/blob/main/model-context-protocol-security.md',
-    categories: [
-        {
-            id: 'T1',
-            name: 'Improper Authentication',
-            domain: 'Foundational Identity & Access',
-            cosai_description: 'Weak identity verification and credential management across agent chains',
-            aga_tools: ['aga_create_artifact', 'aga_verify_artifact', 'aga_rotate_keys'],
-            aga_mechanism: 'Ed25519 artifact signatures verified against pinned issuer public key. Portal rejects artifacts with invalid signatures. Key rotation recorded as chain events with both old and new keys for transition period. TTL-based re-attestation enforces continuous authentication.',
-            nist_ref: 'NCCoE Section 3: Authentication',
-        },
-        {
-            id: 'T2',
-            name: 'Missing Access Control',
-            domain: 'Foundational Identity & Access',
-            cosai_description: 'Insufficient authorization checks and privilege separation',
-            aga_tools: ['aga_start_monitoring', 'aga_trigger_measurement', 'aga_delegate_to_subagent'],
-            aga_mechanism: 'Portal enforces sealed policy constraints as a mandatory interception layer. Agent holds no credentials and cannot bypass the portal. Delegation enforces scope diminishment: child scope must be a strict subset of parent. TTL inheritance prevents privilege extension through delegation.',
-            nist_ref: 'NCCoE Section 4: Authorization, CAISI Section 4a',
-        },
-        {
-            id: 'T3',
-            name: 'Input Validation Failures',
-            domain: 'Input Handling',
-            cosai_description: 'Traditional injection flaws amplified by AI mediation',
-            aga_tools: ['aga_trigger_measurement', 'aga_measure_behavior'],
-            aga_mechanism: 'Portal validates every operation against sealed artifact parameters before authorizing execution. Behavioral drift detection monitors tool invocation patterns against a sealed baseline, catching injection-driven anomalies independent of binary integrity.',
-            nist_ref: 'CAISI Section 1a: Semantic Drift Without Binary Modification',
-        },
-        {
-            id: 'T4',
-            name: 'Data/Control Boundary Failures',
-            domain: 'Input Handling',
-            cosai_description: 'Prompt injection and tool poisoning exploiting the LLM as intermediary',
-            aga_tools: ['aga_measure_behavior', 'aga_quarantine_status'],
-            aga_mechanism: 'Behavioral baseline sealed in artifact defines permitted tools, forbidden sequences, and rate limits. Prompt injection that causes unauthorized tool invocations or forbidden sequences triggers enforcement. Phantom execution quarantines the compromised agent while capturing the full attack sequence as signed forensic evidence.',
-            nist_ref: 'NCCoE Section 6: Prompt Injection Prevention and Mitigation',
-        },
-        {
-            id: 'T5',
-            name: 'Inadequate Data Protection',
-            domain: 'Data & Code Protection',
-            cosai_description: 'Insufficient encryption and secrets management',
-            aga_tools: ['aga_create_artifact', 'aga_disclose_claim'],
-            aga_mechanism: 'Attestation evidence stored as salted commitments: Hash(Content || Salt). Original content never stored in the artifact. Privacy-preserving disclosure with automatic substitution prevents sensitive data exposure. Inference risk checking blocks combinations of disclosures that would reveal denied claims.',
-            nist_ref: 'CAISI Section 5a: Privacy-Preserving Governance Disclosure',
-        },
-        {
-            id: 'T6',
-            name: 'Missing Integrity Controls',
-            domain: 'Data & Code Protection',
-            cosai_description: 'Lack of verification for MCP servers and tool definitions',
-            aga_tools: ['aga_create_artifact', 'aga_trigger_measurement', 'aga_verify_artifact'],
-            aga_mechanism: 'Sealed hash computed over subject bytes, metadata, policy reference, and salt. Portal computes runtime hash on every request and compares to sealed reference. Any modification to any component (server binary, tool definitions, configuration) produces a hash mismatch and triggers enforcement. 10 measurement embodiments cover executable images, loaded modules, container images, configuration manifests, SBOMs, and more.',
-            nist_ref: 'CAISI Section 2a: Sealed Policy Artifacts',
-        },
-        {
-            id: 'T7',
-            name: 'Session/Transport Security',
-            domain: 'Network & Transport',
-            cosai_description: 'Insecure protocols and session management',
-            aga_tools: ['aga_create_artifact', 'aga_revoke_artifact'],
-            aga_mechanism: 'Artifact TTL enforces session expiration. Expired artifacts require re-attestation (fail-closed). Mid-session revocation immediately terminates agent authority. All artifacts and receipts cryptographically signed with Ed25519, preventing session hijacking or replay.',
-            nist_ref: 'NCCoE Section 3: TTL-Based Re-Attestation',
-        },
-        {
-            id: 'T8',
-            name: 'Network Isolation Failures',
-            domain: 'Network & Transport',
-            cosai_description: 'Improper network binding and segmentation',
-            aga_tools: ['aga_start_monitoring', 'aga_trigger_measurement'],
-            aga_mechanism: 'Two-process architecture: portal and agent are separate OS processes. Agent has no direct network access, no credentials, no keys. Portal is the only path to external resources. NETWORK_ISOLATE enforcement action severs network connections while allowing continued local execution for forensic capture.',
-            nist_ref: 'CAISI Section 2a: The Portal as Mandatory Runtime Enforcement Boundary',
-        },
-        {
-            id: 'T9',
-            name: 'Trust Boundary Failures',
-            domain: 'Trust & Design',
-            cosai_description: 'Overreliance on LLM judgment for security decisions',
-            aga_tools: ['aga_create_artifact', 'aga_trigger_measurement', 'aga_measure_behavior'],
-            aga_mechanism: 'Security decisions are pre-committed in the sealed artifact by human authorities before deployment, not delegated to the LLM at runtime. The portal enforces constraints mechanically through hash comparison and behavioral pattern matching. The LLM cannot override, modify, or bypass the sealed enforcement parameters.',
-            nist_ref: 'CAISI Section 4a: Fail-Closed Semantics',
-        },
-        {
-            id: 'T10',
-            name: 'Resource Management',
-            domain: 'Trust & Design',
-            cosai_description: 'Absence of rate limiting and quota controls',
-            aga_tools: ['aga_measure_behavior', 'aga_create_artifact'],
-            aga_mechanism: 'Behavioral baseline includes per-tool rate limits sealed in the artifact. Portal tracks invocation rates within a configurable time window. Rate limit violations trigger enforcement. Measurement cadence is configurable from 10ms (SCADA) to 3,600,000ms, preventing resource exhaustion from excessive measurement overhead.',
-            nist_ref: 'CAISI Section 2a: Configurable Measurement Cadences',
-        },
-        {
-            id: 'T11',
-            name: 'Supply Chain Failures',
-            domain: 'Operational Security',
-            cosai_description: 'Insecure MCP server lifecycle and distribution',
-            aga_tools: ['aga_create_artifact', 'aga_verify_artifact', 'aga_trigger_measurement'],
-            aga_mechanism: 'Content-addressable hash binding at attestation time. Every component (server binary, skill files, dependencies, configuration) is hashed and sealed into the artifact. Runtime measurement detects any modification to any component. Artifact signature binds all fields cryptographically. Modified or substituted components produce hash mismatches and are blocked before execution.',
-            nist_ref: 'CAISI Section 1a: Supply Chain Injection',
-        },
-        {
-            id: 'T12',
-            name: 'Insufficient Observability',
-            domain: 'Operational Security',
-            cosai_description: 'Lack of logging, monitoring, and audit trails',
-            aga_tools: ['aga_generate_receipt', 'aga_get_chain', 'aga_export_bundle', 'aga_verify_bundle'],
-            aga_mechanism: 'Signed receipt generated for every measurement (match or mismatch). Receipts appended to tamper-evident continuity chain linked by structural metadata hashes. Payload excluded from leaf hash computation, enabling third-party verification without payload disclosure. Merkle checkpoint anchoring prevents history rewriting. Evidence bundles enable portable offline verification through a 4-step process: artifact signature, receipt signatures, Merkle proofs, and anchor validation.',
-            nist_ref: 'CAISI Section 2a: Tamper-Evident Accountability',
-        },
-    ],
-};
-// Summary statistics
-export const COSAI_COVERAGE_SUMMARY = {
-    total_threat_categories: 12,
-    categories_with_aga_coverage: 12,
-    total_tools_referenced: 20, // all 20 tools participate in at least one category
-    unique_cosai_categories_covered: 12,
-    nist_submission_sections_referenced: 10,
-};
-//# sourceMappingURL=cosai-mapping.js.map

package/dist/resources/cosai-mapping.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cosai-mapping.js","sourceRoot":"","sources":["../../src/resources/cosai-mapping.ts"],"names":[],"mappings":"AAAA,iCAAiC;AAEjC,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,KAAK,EAAE,oDAAoD;IAC3D,MAAM,EAAE,qDAAqD;IAC7D,UAAU,EAAE,wFAAwF;IACpG,SAAS,EAAE,kBAAkB;IAC7B,GAAG,EAAE,+GAA+G;IAEpH,UAAU,EAAE;QACV;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,gCAAgC;YACxC,iBAAiB,EAAE,0EAA0E;YAC7F,SAAS,EAAE,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,iBAAiB,CAAC;YAC5E,aAAa,EAAE,+QAA+Q;YAE9R,QAAQ,EAAE,iCAAiC;SAC5C;QACD;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,gCAAgC;YACxC,iBAAiB,EAAE,4DAA4D;YAC/E,SAAS,EAAE,CAAC,sBAAsB,EAAE,yBAAyB,EAAE,0BAA0B,CAAC;YAC1F,aAAa,EAAE,+RAA+R;YAC9S,QAAQ,EAAE,kDAAkD;SAC7D;QACD;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,2BAA2B;YACjC,MAAM,EAAE,gBAAgB;YACxB,iBAAiB,EAAE,uDAAuD;YAC1E,SAAS,EAAE,CAAC,yBAAyB,EAAE,sBAAsB,CAAC;YAC9D,aAAa,EAAE,gQAAgQ;YAC/Q,QAAQ,EAAE,8DAA8D;SACzE;QACD;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,gCAAgC;YACtC,MAAM,EAAE,gBAAgB;YACxB,iBAAiB,EAAE,wEAAwE;YAC3F,SAAS,EAAE,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;YAC5D,aAAa,EAAE,yUAAyU;YACxV,QAAQ,EAAE,6DAA6D;SACxE;QACD;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,wBAAwB;YAChC,iBAAiB,EAAE,gDAAgD;YACnE,SAAS,EAAE,CAAC,qBAAqB,EAAE,oBAAoB,CAAC;YACxD,aAAa,EAAE,kTAAkT;YACjU,QAAQ,EAAE,4DAA4D;SACvE;QACD;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,wBAAwB;YAChC,iBAAiB,EAAE,2DAA2D;YAC9E,SAAS,EAAE,CAAC,qBAAqB,EAAE,yBAAyB,EAAE,qBAAqB,CAAC;YACpF,aAAa,EAAE,saAAsa;YACrb,QAAQ,EAAE,2CAA2C;SACtD;QACD;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,qBAAqB;YAC7B,iBAAiB,EAAE,2CAA2C;YAC9D,SAAS,EAAE,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;YACzD,aAAa,EAAE,4QAA4Q;YAC3R,QAAQ,EAAE,2CAA2C;SACtD;QACD;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,qBAAqB;YAC7B,iBAAiB,EAAE,2CAA2C;YAC9D,SAAS,EAAE,CAAC,sBAAsB,EAAE,yBAAyB,CAAC;YAC9D,aAAa,EAAE,gTAAgT;YAC/T,QAAQ,EAAE,wEAAwE;SACnF;QACD;YACE,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,gBAAgB;YACxB,iBAAiB,EAAE,qDAAqD;YACxE,SAAS,EAAE,CAAC,qBAAqB,EAAE,yBAAyB,EAAE,sBAAsB,CAAC;YACrF,aAAa,EAAE,8TAA8T;YAC7U,QAAQ,EAAE,yCAAyC;SACpD;QACD;YACE,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,gBAAgB;YACxB,iBAAiB,EAAE,6CAA6C;YAChE,SAAS,EAAE,CAAC,sBAAsB,EAAE,qBAAqB,CAAC;YAC1D,aAAa,EAAE,kUAAkU;YACjV,QAAQ,EAAE,qDAAqD;SAChE;QACD;YACE,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,sBAAsB;YAC9B,iBAAiB,EAAE,gDAAgD;YACnE,SAAS,EAAE,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,yBAAyB,CAAC;YACpF,aAAa,EAAE,4XAA4X;YAC3Y,QAAQ,EAAE,0CAA0C;SACrD;QACD;YACE,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,sBAAsB;YAC9B,iBAAiB,EAAE,+CAA+C;YAClE,SAAS,EAAE,CAAC,sBAAsB,EAAE,eAAe,EAAE,mBAAmB,EAAE,mBAAmB,CAAC;YAC9F,aAAa,EAAE,ieAAie;YAChf,QAAQ,EAAE,iDAAiD;SAC5D;KACF;CACF,CAAC;AAEF,qBAAqB;AACrB,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,uBAAuB,EAAE,EAAE;IAC3B,4BAA4B,EAAE,EAAE;IAChC,sBAAsB,EAAE,EAAE,EAAG,oDAAoD;IACjF,+BAA+B,EAAE,EAAE;IACnC,mCAAmC,EAAE,EAAE;CACxC,CAAC"}

package/dist/resources/crypto-primitives.d.ts

@@ -1,3 +0,0 @@
-export declare const CRYPTO_PRIMITIVES_DOC = "# AGA Cryptographic Primitives\n\n## Ed25519 Digital Signatures\n- Library: @noble/ed25519 v2.1.0\n- Key size: 256-bit (32 bytes)\n- Signature size: 512-bit (64 bytes)\n- Used for: Artifact signing, receipt signing, chain event signing\n\n## SHA-256 Hashing\n- Library: @noble/hashes v1.7.0\n- Output: 256-bit (64 hex characters)\n- Used for: Sealed hash, leaf hash, payload hash, subject identity\n\n## Sealed Hash Construction\n```\nsealed_hash = SHA-256(bytes_hash || metadata_hash || policy_reference || seal_salt)\n```\n- No delimiters between fields (raw hex concatenation)\n- No delimiters per protocol spec\n\n## Leaf Hash Construction\n```\nleaf_hash = SHA-256(\n  schema_version || \"||\" || protocol_version || \"||\" ||\n  event_type || \"||\" || event_id || \"||\" ||\n  sequence_number || \"||\" || timestamp || \"||\" ||\n  previous_leaf_hash\n)\n```\n- **Payload EXCLUDED** - privacy innovation\n- Chain integrity verifiable without revealing event contents\n\n## Salted Commitments\n```\ncommitment = SHA-256(content_bytes || salt_bytes)\n```\n- Salt: 128-bit (16 bytes, 32 hex chars) CSPRNG\n- Enables selective disclosure\n\n## Merkle Trees\n- Binary tree over leaf hashes\n- Internal nodes: SHA-256(left || right)\n- Odd leaf count: last leaf duplicated\n- Inclusion proofs: array of {hash, direction} pairs\n\n## Canonical Serialization\n- RFC 8785 aligned\n- Sorted keys, no whitespace\n- Used before signing any object\n";
-export declare const CRYPTO_PRIMITIVES_URI = "aga://crypto-primitives";
-//# sourceMappingURL=crypto-primitives.d.ts.map

package/dist/resources/crypto-primitives.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto-primitives.d.ts","sourceRoot":"","sources":["../../src/resources/crypto-primitives.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,w6CAiDjC,CAAC;AAEF,eAAO,MAAM,qBAAqB,4BAA4B,CAAC"}

package/dist/resources/crypto-primitives.js

@@ -1,52 +0,0 @@
-export const CRYPTO_PRIMITIVES_DOC = `# AGA Cryptographic Primitives
-
-## Ed25519 Digital Signatures
-- Library: @noble/ed25519 v2.1.0
-- Key size: 256-bit (32 bytes)
-- Signature size: 512-bit (64 bytes)
-- Used for: Artifact signing, receipt signing, chain event signing
-
-## SHA-256 Hashing
-- Library: @noble/hashes v1.7.0
-- Output: 256-bit (64 hex characters)
-- Used for: Sealed hash, leaf hash, payload hash, subject identity
-
-## Sealed Hash Construction
-\`\`\`
-sealed_hash = SHA-256(bytes_hash || metadata_hash || policy_reference || seal_salt)
-\`\`\`
-- No delimiters between fields (raw hex concatenation)
-- No delimiters per protocol spec
-
-## Leaf Hash Construction
-\`\`\`
-leaf_hash = SHA-256(
-  schema_version || "||" || protocol_version || "||" ||
-  event_type || "||" || event_id || "||" ||
-  sequence_number || "||" || timestamp || "||" ||
-  previous_leaf_hash
-)
-\`\`\`
-- **Payload EXCLUDED** - privacy innovation
-- Chain integrity verifiable without revealing event contents
-
-## Salted Commitments
-\`\`\`
-commitment = SHA-256(content_bytes || salt_bytes)
-\`\`\`
-- Salt: 128-bit (16 bytes, 32 hex chars) CSPRNG
-- Enables selective disclosure
-
-## Merkle Trees
-- Binary tree over leaf hashes
-- Internal nodes: SHA-256(left || right)
-- Odd leaf count: last leaf duplicated
-- Inclusion proofs: array of {hash, direction} pairs
-
-## Canonical Serialization
-- RFC 8785 aligned
-- Sorted keys, no whitespace
-- Used before signing any object
-`;
-export const CRYPTO_PRIMITIVES_URI = 'aga://crypto-primitives';
-//# sourceMappingURL=crypto-primitives.js.map

package/dist/resources/crypto-primitives.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto-primitives.js","sourceRoot":"","sources":["../../src/resources/crypto-primitives.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiDpC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,CAAC"}

package/dist/resources/sample-bundle.d.ts

@@ -1,6 +0,0 @@
-export declare function generateSampleBundle(): {
-    bundle: string;
-    issuerPkHex: string;
-};
-export declare const SAMPLE_BUNDLE_URI = "aga://sample-bundle";
-//# sourceMappingURL=sample-bundle.d.ts.map

package/dist/resources/sample-bundle.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sample-bundle.d.ts","sourceRoot":"","sources":["../../src/resources/sample-bundle.ts"],"names":[],"mappings":"AAgBA,wBAAgB,oBAAoB,IAAI;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CA8C9E;AAED,eAAO,MAAM,iBAAiB,wBAAwB,CAAC"}

package/dist/resources/sample-bundle.js

@@ -1,58 +0,0 @@
-/**
- * Sample Evidence Bundle: generates a real, cryptographically signed bundle.
- * Can be verified with aga_verify_bundle.
- */
-import { generateKeyPair, pkToHex } from '../crypto/sign.js';
-import { sha256Str } from '../crypto/hash.js';
-import { computeSubjectIdFromString } from '../core/subject.js';
-import { performAttestation } from '../core/attestation.js';
-import { generateArtifact, hashArtifact } from '../core/artifact.js';
-import { generateReceipt } from '../core/receipt.js';
-import { createGenesisEvent, appendEvent } from '../core/chain.js';
-import { createCheckpoint, eventInclusionProof } from '../core/checkpoint.js';
-import { generateBundle } from '../core/bundle.js';
-let cachedBundle = null;
-export function generateSampleBundle() {
-    if (cachedBundle)
-        return cachedBundle;
-    const issuerKP = generateKeyPair();
-    const portalKP = generateKeyPair();
-    const chainKP = generateKeyPair();
-    const content = 'def sample_agent(): return task.execute()';
-    const meta = { filename: 'sample_agent.py', version: '1.0.0' };
-    const subId = computeSubjectIdFromString(content, meta);
-    const policyRef = sha256Str('sample-policy');
-    const att = performAttestation({ subject_identifier: subId, policy_reference: policyRef, evidence_items: [] });
-    const artifact = generateArtifact({
-        subject_identifier: subId, policy_reference: policyRef, policy_version: 1,
-        sealed_hash: att.sealed_hash, seal_salt: att.seal_salt,
-        enforcement_parameters: {
-            measurement_cadence_ms: 1000, ttl_seconds: 3600,
-            enforcement_triggers: ['QUARANTINE', 'TERMINATE'],
-            re_attestation_required: true, measurement_types: ['EXECUTABLE_IMAGE'],
-        },
-        disclosure_policy: { claims_taxonomy: [], substitution_rules: [] },
-        evidence_commitments: att.evidence_commitments, issuer_keypair: issuerKP,
-    });
-    const artRef = hashArtifact(artifact);
-    const receipt = generateReceipt({
-        subjectId: subId, artifactRef: artRef,
-        currentHash: subId.bytes_hash, sealedHash: subId.bytes_hash,
-        driftDetected: false, driftDescription: null, action: null,
-        measurementType: 'EXECUTABLE_IMAGE', seq: 1, prevLeaf: null, portalKP,
-    });
-    const genesis = createGenesisEvent(chainKP, sha256Str('AGA-Spec'));
-    const e1 = appendEvent('POLICY_ISSUANCE', { artifact_hash: artRef }, genesis, chainKP);
-    const e2 = appendEvent('INTERACTION_RECEIPT', { receipt_id: receipt.receipt_id }, e1, chainKP);
-    const chain = [genesis, e1, e2];
-    const { checkpoint } = createCheckpoint(chain);
-    const proof = eventInclusionProof(chain, e1.sequence_number);
-    const bundle = generateBundle(artifact, [receipt], [proof], checkpoint, portalKP);
-    cachedBundle = {
-        bundle: JSON.stringify(bundle, null, 2),
-        issuerPkHex: pkToHex(issuerKP.publicKey),
-    };
-    return cachedBundle;
-}
-export const SAMPLE_BUNDLE_URI = 'aga://sample-bundle';
-//# sourceMappingURL=sample-bundle.js.map

package/dist/resources/sample-bundle.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sample-bundle.js","sourceRoot":"","sources":["../../src/resources/sample-bundle.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAuB,MAAM,mBAAmB,CAAC;AAExE,IAAI,YAAY,GAAmD,IAAI,CAAC;AAExE,MAAM,UAAU,oBAAoB;IAClC,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAElC,MAAM,OAAO,GAAG,2CAA2C,CAAC;IAC5D,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,0BAA0B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,SAAS,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,kBAAkB,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;IAE/G,MAAM,QAAQ,GAAG,gBAAgB,CAAC;QAChC,kBAAkB,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;QACzE,WAAW,EAAE,GAAG,CAAC,WAAY,EAAE,SAAS,EAAE,GAAG,CAAC,SAAU;QACxD,sBAAsB,EAAE;YACtB,sBAAsB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI;YAC/C,oBAAoB,EAAE,CAAC,YAAY,EAAE,WAAW,CAAC;YACjD,uBAAuB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,kBAAkB,CAAC;SACvE;QACD,iBAAiB,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE;QAClE,oBAAoB,EAAE,GAAG,CAAC,oBAAoB,EAAE,cAAc,EAAE,QAAQ;KACzE,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,eAAe,CAAC;QAC9B,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM;QACrC,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC3D,aAAa,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI;QAC1D,eAAe,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ;KACtE,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;IACnE,MAAM,EAAE,GAAG,WAAW,CAAC,iBAAiB,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACvF,MAAM,EAAE,GAAG,WAAW,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAChC,MAAM,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAElF,YAAY,GAAG;QACb,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;KACzC,CAAC;IACF,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC"}

package/dist/resources/specification.d.ts

@@ -1,3 +0,0 @@
-export declare const PROTOCOL_SPECIFICATION = "# Attested Governance Artifact (AGA) Protocol Specification v2.0.0\n\n## NIST References\n- NIST-2025-0035: AI Agent Transparency and Accountability\n- NCCoE AI Agent Identity and Authorization\n\n## Protocol Overview\nThe AGA protocol provides cryptographic governance for autonomous AI systems through:\n1. **Sealed Hash Attestation** - SHA-256(bytes_hash || metadata_hash || policy_ref || seal_salt)\n2. **Continuity Chain** - Tamper-evident append-only event log with privacy-preserving leaf hashes\n3. **Portal State Machine** - Zero-trust Policy Enforcement Point (7 states, fail-closed)\n4. **Signed Receipts** - Ed25519-signed measurement receipt for EVERY measurement\n5. **Evidence Bundles** - Offline-verifiable packages with Merkle inclusion proofs\n\n## 10 Measurement Embodiments\n1. EXECUTABLE_IMAGE - Runtime binary or script content\n2. LOADED_MODULES - Dynamic libraries and plugins\n3. CONTAINER_IMAGE - Container image manifest hash\n4. CONFIG_MANIFEST - Configuration file integrity\n5. SBOM - Software Bill of Materials verification\n6. TEE_QUOTE - Trusted Execution Environment attestation\n7. MEMORY_REGIONS - Runtime memory layout verification\n8. CONTROL_FLOW - Execution path integrity\n9. FILE_SYSTEM_STATE - Filesystem integrity monitoring\n10. NETWORK_CONFIG - Network configuration baseline\n\n## 6 Portal States\n1. INITIALIZATION - Server started, no artifact loaded\n2. ARTIFACT_VERIFICATION - Verifying artifact signature and validity\n3. ACTIVE_MONITORING - Operational, measurements occurring\n4. DRIFT_DETECTED - Hash mismatch detected, enforcement pending\n5. PHANTOM_QUARANTINE - Forensic capture mode, outputs severed\n6. TERMINATED - Fail-closed, no recovery without re-attestation\n\nPlus SAFE_STATE for graceful degradation on revocation.\n\n## 7 Enforcement Actions\n1. QUARANTINE - Phantom execution with forensic capture\n2. TERMINATE - Immediate kill, fail-closed\n3. SAFE_STATE - Return-to-home / controlled shutdown\n4. NETWORK_ISOLATE - Sever network, continue local\n5. KEY_REVOKE - Invalidate cryptographic keys\n6. TOKEN_INVALIDATE - Revoke access tokens\n7. ALERT_ONLY - Log without enforcement (gradual deployment)\n\n## 3 Verification Tiers\n| Tier | Description | Trust Assumption |\n|------|-------------|-----------------|\n| Bronze | Cryptographic signatures only | Trust signing keys |\n| Silver | Signatures + continuity chain | Trust chain operator + keys |\n| Gold | Full verification with blockchain-anchored Merkle proofs | Minimal trust - external anchor |\n\n## 3 Disclosure Modes\n1. PROOF_ONLY - Returns boolean attestation without revealing the value\n2. REVEAL_MIN - Returns minimal representation (e.g., range instead of exact value)\n3. REVEAL_FULL - Returns the complete claim value\n\n## Leaf Hash Formula (Privacy Innovation)\n```\nleaf_hash = SHA-256(\n  schema_version || \"||\" || protocol_version || \"||\" ||\n  event_type || \"||\" || event_id || \"||\" ||\n  sequence_number || \"||\" || timestamp || \"||\" ||\n  previous_leaf_hash\n)\n```\n**PAYLOAD IS EXCLUDED from the leaf hash.** This is a key privacy innovation - chain integrity can be verified without revealing the contents of any event. Only the structural metadata participates in the hash. The payload is separately integrity-protected via event_signature.\n\n## SPIFFE/SPIRE Integration Point\nSPIRE handles node-to-workload identity (SVID); AGA handles workload-to-intent governance. SPIFFE provides transport-layer identity binding via SVIDs (SPIFFE Verifiable Identity Documents). AGA binds governance policy to the workload's operational intent, creating a complementary layer:\n- SPIFFE: \"This workload IS who it claims to be\" (identity)\n- AGA: \"This workload IS DOING what it was attested to do\" (governance)\n\n## Framework Alignment\n| Framework | AGA Alignment |\n|-----------|--------------|\n| NIST SP 800-53 | SI-7 (Software Integrity), AU-10 (Non-repudiation), SI-4 (Monitoring) |\n| NIST AI RMF | Govern \u2192 Policy Artifacts; Map \u2192 Subject ID; Measure \u2192 Portal + Receipts; Manage \u2192 Enforcement |\n| NIST SP 800-57 | Key management for Ed25519 signing keys |\n| NIST SSDF (SP 800-218) | Software supply chain integrity via sealed hash attestation |\n| NIST SP 800-207 (ZTA) | Zero Trust Architecture - portal as Policy Enforcement Point, never trust, always verify |\n| ISO 42001 | AI management system - governance artifacts as compliance evidence |\n| EU AI Act | High-risk AI system transparency via evidence bundles |\n\n## Cryptographic Primitives\n- **Hashing:** SHA-256 (primary), BLAKE2b-256 (secondary)\n- **Signing:** Ed25519 via @noble/ed25519\n- **Salts:** 128-bit CSPRNG via @noble/hashes/utils\n- **Merkle Trees:** SHA-256 binary tree with inclusion proofs\n- **Serialization:** RFC 8785 deterministic JSON (sorted keys)\n\n## Event Types (12)\nGENESIS, POLICY_ISSUANCE, INTERACTION_RECEIPT, REVOCATION, ATTESTATION,\nANCHOR_BATCH, DISCLOSURE, SUBSTITUTION, KEY_ROTATION, BEHAVIORAL_DRIFT,\nDELEGATION, RE_ATTESTATION\n\n## 4 Sensitivity Levels\n- S1_LOW - Can be revealed fully\n- S2_MODERATE - Can be revealed minimally or proved\n- S3_HIGH - Proof only, auto-substitutes to lower sensitivity\n- S4_CRITICAL - Maximum protection, proof only, cascading substitution\n\n## CoSAI MCP Security Threat Coverage\n\nThe Coalition for Secure AI (CoSAI) published a comprehensive MCP security taxonomy\nidentifying 12 core threat categories and nearly 40 distinct threats specific to Model\nContext Protocol deployments (January 2026). The AGA MCP Server addresses all 12 categories.\n\n| CoSAI Category | Threat Domain | AGA Governance Mechanism |\n|---|---|---|\n| T1: Improper Authentication | Identity & Access | Ed25519 artifact signatures, pinned issuer keys, TTL re-attestation, key rotation chain events |\n| T2: Missing Access Control | Identity & Access | Portal as mandatory enforcement boundary, sealed constraints, delegation with scope diminishment |\n| T3: Input Validation Failures | Input Handling | Runtime measurement against sealed reference, behavioral drift detection |\n| T4: Data/Control Boundary Failures | Input Handling | Behavioral baseline (permitted tools, forbidden sequences, rate limits), phantom execution forensics |\n| T5: Inadequate Data Protection | Data & Code | Salted commitments, privacy-preserving disclosure with substitution, inference risk prevention |\n| T6: Missing Integrity Controls | Data & Code | Content-addressable hash binding, 10 measurement embodiments, continuous runtime verification |\n| T7: Session/Transport Security | Network & Transport | TTL-based artifact expiration, fail-closed on expiry, mid-session revocation, Ed25519 signed receipts |\n| T8: Network Isolation Failures | Network & Transport | Two-process architecture, agent holds no credentials, NETWORK_ISOLATE enforcement action |\n| T9: Trust Boundary Failures | Trust & Design | Enforcement pre-committed by human authorities in sealed artifact, not delegated to LLM |\n| T10: Resource Management | Trust & Design | Per-tool rate limits in behavioral baseline, configurable measurement cadence (10ms to 3600s) |\n| T11: Supply Chain Failures | Operational | Content-addressable hashing at attestation, runtime hash comparison blocks modified components |\n| T12: Insufficient Observability | Operational | Signed receipts, tamper-evident continuity chain, Merkle anchoring, offline evidence bundles |\n\nCoverage: 12 of 12 threat categories addressed.\nSource: CoSAI/OASIS, \"Securing the AI Agent Revolution\" (January 2026)\n\n### CoSAI Recommended Controls and AGA Implementation\n\n1. Strong Identity Throughout the Chain\n   AGA: Ed25519 keypairs for issuer, portal, and chain. Every artifact and receipt\n   cryptographically signed. Key rotation recorded in chain. Delegation produces\n   derived artifacts with independent signatures traceable to the issuing authority.\n\n2. Zero Trust Applied to AI Agents\n   AGA: Portal treats all agent operations as untrusted. Every request measured\n   against sealed reference before authorization. Fail-closed: default state is denial.\n   Agent cannot execute without a valid, signature-verified artifact.\n\n3. Sandbox Everything\n   AGA: Two-process architecture. Agent and portal are separate OS processes.\n   Agent has no credentials, no keys, no direct resource access. Phantom execution\n   provides runtime sandboxing when drift is detected.\n\n4. Defensive Tool Design\n   AGA: Permitted tools sealed in artifact. Forbidden sequences explicitly defined.\n   Rate limits per tool. Portal enforces all constraints mechanically, independent\n   of LLM judgment. Behavioral drift detection catches tool misuse patterns.\n\n5. Supply Chain Lockdown\n   AGA: Content-addressable hash binding at attestation. Runtime measurement\n   detects any component modification. Sealed hash covers all subject bytes,\n   metadata, and policy reference. 10 measurement embodiments for comprehensive\n   coverage.\n\n6. Observability from Day One\n   AGA: Signed receipt for every measurement. Tamper-evident continuity chain.\n   Structural metadata linking enables third-party verification without payload\n   disclosure. Merkle checkpoint anchoring. Portable offline evidence bundles.\n";
-export declare const SPECIFICATION_URI = "aga://specification";
-//# sourceMappingURL=specification.d.ts.map

package/dist/resources/specification.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"specification.d.ts","sourceRoot":"","sources":["../../src/resources/specification.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,siSA8JlC,CAAC;AAEF,eAAO,MAAM,iBAAiB,wBAAwB,CAAC"}

package/dist/resources/specification.js

@@ -1,161 +0,0 @@
-export const PROTOCOL_SPECIFICATION = `# Attested Governance Artifact (AGA) Protocol Specification v2.0.0
-
-## NIST References
-- NIST-2025-0035: AI Agent Transparency and Accountability
-- NCCoE AI Agent Identity and Authorization
-
-## Protocol Overview
-The AGA protocol provides cryptographic governance for autonomous AI systems through:
-1. **Sealed Hash Attestation** - SHA-256(bytes_hash || metadata_hash || policy_ref || seal_salt)
-2. **Continuity Chain** - Tamper-evident append-only event log with privacy-preserving leaf hashes
-3. **Portal State Machine** - Zero-trust Policy Enforcement Point (7 states, fail-closed)
-4. **Signed Receipts** - Ed25519-signed measurement receipt for EVERY measurement
-5. **Evidence Bundles** - Offline-verifiable packages with Merkle inclusion proofs
-
-## 10 Measurement Embodiments
-1. EXECUTABLE_IMAGE - Runtime binary or script content
-2. LOADED_MODULES - Dynamic libraries and plugins
-3. CONTAINER_IMAGE - Container image manifest hash
-4. CONFIG_MANIFEST - Configuration file integrity
-5. SBOM - Software Bill of Materials verification
-6. TEE_QUOTE - Trusted Execution Environment attestation
-7. MEMORY_REGIONS - Runtime memory layout verification
-8. CONTROL_FLOW - Execution path integrity
-9. FILE_SYSTEM_STATE - Filesystem integrity monitoring
-10. NETWORK_CONFIG - Network configuration baseline
-
-## 6 Portal States
-1. INITIALIZATION - Server started, no artifact loaded
-2. ARTIFACT_VERIFICATION - Verifying artifact signature and validity
-3. ACTIVE_MONITORING - Operational, measurements occurring
-4. DRIFT_DETECTED - Hash mismatch detected, enforcement pending
-5. PHANTOM_QUARANTINE - Forensic capture mode, outputs severed
-6. TERMINATED - Fail-closed, no recovery without re-attestation
-
-Plus SAFE_STATE for graceful degradation on revocation.
-
-## 7 Enforcement Actions
-1. QUARANTINE - Phantom execution with forensic capture
-2. TERMINATE - Immediate kill, fail-closed
-3. SAFE_STATE - Return-to-home / controlled shutdown
-4. NETWORK_ISOLATE - Sever network, continue local
-5. KEY_REVOKE - Invalidate cryptographic keys
-6. TOKEN_INVALIDATE - Revoke access tokens
-7. ALERT_ONLY - Log without enforcement (gradual deployment)
-
-## 3 Verification Tiers
-| Tier | Description | Trust Assumption |
-|------|-------------|-----------------|
-| Bronze | Cryptographic signatures only | Trust signing keys |
-| Silver | Signatures + continuity chain | Trust chain operator + keys |
-| Gold | Full verification with blockchain-anchored Merkle proofs | Minimal trust - external anchor |
-
-## 3 Disclosure Modes
-1. PROOF_ONLY - Returns boolean attestation without revealing the value
-2. REVEAL_MIN - Returns minimal representation (e.g., range instead of exact value)
-3. REVEAL_FULL - Returns the complete claim value
-
-## Leaf Hash Formula (Privacy Innovation)
-\`\`\`
-leaf_hash = SHA-256(
-  schema_version || "||" || protocol_version || "||" ||
-  event_type || "||" || event_id || "||" ||
-  sequence_number || "||" || timestamp || "||" ||
-  previous_leaf_hash
-)
-\`\`\`
-**PAYLOAD IS EXCLUDED from the leaf hash.** This is a key privacy innovation - chain integrity can be verified without revealing the contents of any event. Only the structural metadata participates in the hash. The payload is separately integrity-protected via event_signature.
-
-## SPIFFE/SPIRE Integration Point
-SPIRE handles node-to-workload identity (SVID); AGA handles workload-to-intent governance. SPIFFE provides transport-layer identity binding via SVIDs (SPIFFE Verifiable Identity Documents). AGA binds governance policy to the workload's operational intent, creating a complementary layer:
-- SPIFFE: "This workload IS who it claims to be" (identity)
-- AGA: "This workload IS DOING what it was attested to do" (governance)
-
-## Framework Alignment
-| Framework | AGA Alignment |
-|-----------|--------------|
-| NIST SP 800-53 | SI-7 (Software Integrity), AU-10 (Non-repudiation), SI-4 (Monitoring) |
-| NIST AI RMF | Govern → Policy Artifacts; Map → Subject ID; Measure → Portal + Receipts; Manage → Enforcement |
-| NIST SP 800-57 | Key management for Ed25519 signing keys |
-| NIST SSDF (SP 800-218) | Software supply chain integrity via sealed hash attestation |
-| NIST SP 800-207 (ZTA) | Zero Trust Architecture - portal as Policy Enforcement Point, never trust, always verify |
-| ISO 42001 | AI management system - governance artifacts as compliance evidence |
-| EU AI Act | High-risk AI system transparency via evidence bundles |
-
-## Cryptographic Primitives
-- **Hashing:** SHA-256 (primary), BLAKE2b-256 (secondary)
-- **Signing:** Ed25519 via @noble/ed25519
-- **Salts:** 128-bit CSPRNG via @noble/hashes/utils
-- **Merkle Trees:** SHA-256 binary tree with inclusion proofs
-- **Serialization:** RFC 8785 deterministic JSON (sorted keys)
-
-## Event Types (12)
-GENESIS, POLICY_ISSUANCE, INTERACTION_RECEIPT, REVOCATION, ATTESTATION,
-ANCHOR_BATCH, DISCLOSURE, SUBSTITUTION, KEY_ROTATION, BEHAVIORAL_DRIFT,
-DELEGATION, RE_ATTESTATION
-
-## 4 Sensitivity Levels
-- S1_LOW - Can be revealed fully
-- S2_MODERATE - Can be revealed minimally or proved
-- S3_HIGH - Proof only, auto-substitutes to lower sensitivity
-- S4_CRITICAL - Maximum protection, proof only, cascading substitution
-
-## CoSAI MCP Security Threat Coverage
-
-The Coalition for Secure AI (CoSAI) published a comprehensive MCP security taxonomy
-identifying 12 core threat categories and nearly 40 distinct threats specific to Model
-Context Protocol deployments (January 2026). The AGA MCP Server addresses all 12 categories.
-
-| CoSAI Category | Threat Domain | AGA Governance Mechanism |
-|---|---|---|
-| T1: Improper Authentication | Identity & Access | Ed25519 artifact signatures, pinned issuer keys, TTL re-attestation, key rotation chain events |
-| T2: Missing Access Control | Identity & Access | Portal as mandatory enforcement boundary, sealed constraints, delegation with scope diminishment |
-| T3: Input Validation Failures | Input Handling | Runtime measurement against sealed reference, behavioral drift detection |
-| T4: Data/Control Boundary Failures | Input Handling | Behavioral baseline (permitted tools, forbidden sequences, rate limits), phantom execution forensics |
-| T5: Inadequate Data Protection | Data & Code | Salted commitments, privacy-preserving disclosure with substitution, inference risk prevention |
-| T6: Missing Integrity Controls | Data & Code | Content-addressable hash binding, 10 measurement embodiments, continuous runtime verification |
-| T7: Session/Transport Security | Network & Transport | TTL-based artifact expiration, fail-closed on expiry, mid-session revocation, Ed25519 signed receipts |
-| T8: Network Isolation Failures | Network & Transport | Two-process architecture, agent holds no credentials, NETWORK_ISOLATE enforcement action |
-| T9: Trust Boundary Failures | Trust & Design | Enforcement pre-committed by human authorities in sealed artifact, not delegated to LLM |
-| T10: Resource Management | Trust & Design | Per-tool rate limits in behavioral baseline, configurable measurement cadence (10ms to 3600s) |
-| T11: Supply Chain Failures | Operational | Content-addressable hashing at attestation, runtime hash comparison blocks modified components |
-| T12: Insufficient Observability | Operational | Signed receipts, tamper-evident continuity chain, Merkle anchoring, offline evidence bundles |
-
-Coverage: 12 of 12 threat categories addressed.
-Source: CoSAI/OASIS, "Securing the AI Agent Revolution" (January 2026)
-
-### CoSAI Recommended Controls and AGA Implementation
-
-1. Strong Identity Throughout the Chain
-   AGA: Ed25519 keypairs for issuer, portal, and chain. Every artifact and receipt
-   cryptographically signed. Key rotation recorded in chain. Delegation produces
-   derived artifacts with independent signatures traceable to the issuing authority.
-
-2. Zero Trust Applied to AI Agents
-   AGA: Portal treats all agent operations as untrusted. Every request measured
-   against sealed reference before authorization. Fail-closed: default state is denial.
-   Agent cannot execute without a valid, signature-verified artifact.
-
-3. Sandbox Everything
-   AGA: Two-process architecture. Agent and portal are separate OS processes.
-   Agent has no credentials, no keys, no direct resource access. Phantom execution
-   provides runtime sandboxing when drift is detected.
-
-4. Defensive Tool Design
-   AGA: Permitted tools sealed in artifact. Forbidden sequences explicitly defined.
-   Rate limits per tool. Portal enforces all constraints mechanically, independent
-   of LLM judgment. Behavioral drift detection catches tool misuse patterns.
-
-5. Supply Chain Lockdown
-   AGA: Content-addressable hash binding at attestation. Runtime measurement
-   detects any component modification. Sealed hash covers all subject bytes,
-   metadata, and policy reference. 10 measurement embodiments for comprehensive
-   coverage.
-
-6. Observability from Day One
-   AGA: Signed receipt for every measurement. Tamper-evident continuity chain.
-   Structural metadata linking enables third-party verification without payload
-   disclosure. Merkle checkpoint anchoring. Portable offline evidence bundles.
-`;
-export const SPECIFICATION_URI = 'aga://specification';
-//# sourceMappingURL=specification.js.map

package/dist/resources/specification.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"specification.js","sourceRoot":"","sources":["../../src/resources/specification.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8JrC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC"}

package/dist/tools/create-artifact.d.ts

@@ -1,25 +0,0 @@
-import type { ServerContext } from '../context.js';
-import type { SubjectMetadata } from '../core/types.js';
-import type { BehavioralBaseline } from '../types.js';
-export interface CreateArtifactArgs {
-    subject_content?: string;
-    subject_metadata?: SubjectMetadata;
-    subject_bytes_hash?: string;
-    subject_metadata_hash?: string;
-    measurement_cadence_ms?: number;
-    enforcement_action?: string;
-    ttl_seconds?: number;
-    measurement_types?: string[];
-    evidence_items?: Array<{
-        label: string;
-        content: string;
-    }>;
-    behavioral_baseline?: BehavioralBaseline;
-}
-export declare function handleCreateArtifact(args: CreateArtifactArgs, ctx: ServerContext): Promise<{
-    content: Array<{
-        type: "text";
-        text: string;
-    }>;
-}>;
-//# sourceMappingURL=create-artifact.d.ts.map

package/dist/tools/create-artifact.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"create-artifact.d.ts","sourceRoot":"","sources":["../../src/tools/create-artifact.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAsC,MAAM,kBAAkB,CAAC;AAC5F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,WAAW,kBAAkB;IAEjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,eAAe,CAAC;IAEnC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE7B,cAAc,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;CAC1C;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,aAAa;;;;;GAoFtF"}

package/dist/tools/create-artifact.js

@@ -1,85 +0,0 @@
-import { sha256Str } from '../crypto/hash.js';
-import { pkToHex } from '../crypto/sign.js';
-import { computeSubjectIdFromString } from '../core/subject.js';
-import { performAttestation } from '../core/attestation.js';
-import { generateArtifact, hashArtifact } from '../core/artifact.js';
-export async function handleCreateArtifact(args, ctx) {
-    // Determine subject identifier - support both content and hash inputs
-    let subId;
-    if (args.subject_bytes_hash && args.subject_metadata_hash) {
-        subId = { bytes_hash: args.subject_bytes_hash, metadata_hash: args.subject_metadata_hash };
-    }
-    else if (args.subject_content) {
-        subId = computeSubjectIdFromString(args.subject_content, args.subject_metadata ?? {});
-    }
-    else {
-        return ctx.error('Provide either subject_content or subject_bytes_hash + subject_metadata_hash');
-    }
-    // Build enforcement parameters - merge custom with defaults
-    const enforcement = {
-        measurement_cadence_ms: args.measurement_cadence_ms ?? ctx.defaultEnforcement.measurement_cadence_ms,
-        ttl_seconds: args.ttl_seconds ?? ctx.defaultEnforcement.ttl_seconds,
-        enforcement_triggers: args.enforcement_action
-            ? [args.enforcement_action]
-            : ctx.defaultEnforcement.enforcement_triggers,
-        re_attestation_required: ctx.defaultEnforcement.re_attestation_required,
-        measurement_types: (args.measurement_types ?? ctx.defaultEnforcement.measurement_types.map(String)),
-    };
-    const policyRef = sha256Str(JSON.stringify(enforcement));
-    const att = performAttestation({
-        subject_identifier: subId,
-        policy_reference: policyRef,
-        evidence_items: args.evidence_items ?? [],
-    });
-    if (!att.success || !att.sealed_hash || !att.seal_salt) {
-        return ctx.error(att.rejection_reason ?? 'Attestation failed');
-    }
-    // Track whether this is a re-attestation (after revocation)
-    const previousArtifact = ctx.activeArtifact;
-    const isReAttestation = previousArtifact !== null && (ctx.portal.state === 'TERMINATED' || ctx.portal.state === 'SAFE_STATE' ||
-        ctx.portal.isRevoked(previousArtifact.sealed_hash));
-    const artifact = generateArtifact({
-        subject_identifier: subId,
-        policy_reference: policyRef,
-        policy_version: isReAttestation ? (previousArtifact.policy_version + 1) : 1,
-        sealed_hash: att.sealed_hash,
-        seal_salt: att.seal_salt,
-        enforcement_parameters: enforcement,
-        disclosure_policy: ctx.defaultClaims,
-        evidence_commitments: att.evidence_commitments,
-        issuer_keypair: ctx.issuerKP,
-    });
-    await ctx.storage.storeArtifact(artifact);
-    ctx.portal.reset();
-    ctx.portal.loadArtifact(artifact, pkToHex(ctx.issuerKP.publicKey));
-    ctx.activeArtifact = artifact;
-    ctx.quarantine = null;
-    ctx.measurementCount = 0;
-    ctx.behavioralMonitor.reset();
-    if (args.behavioral_baseline)
-        ctx.behavioralMonitor.setBaseline(args.behavioral_baseline);
-    const eventType = isReAttestation ? 'RE_ATTESTATION' : 'POLICY_ISSUANCE';
-    const eventPayload = {
-        artifact_hash: hashArtifact(artifact),
-        sealed_hash: artifact.sealed_hash,
-    };
-    if (isReAttestation && previousArtifact) {
-        eventPayload.predecessor_sealed_hash = previousArtifact.sealed_hash;
-        eventPayload.predecessor_artifact_hash = hashArtifact(previousArtifact);
-    }
-    await ctx.appendToChain(eventType, eventPayload);
-    return ctx.json({
-        success: true,
-        artifact_hash: hashArtifact(artifact),
-        sealed_hash: artifact.sealed_hash,
-        subject_identifier: subId,
-        portal_state: ctx.portal.state,
-        issuer_public_key: pkToHex(ctx.issuerKP.publicKey),
-        verification_tier: ctx.verificationTier,
-        event_type: eventType,
-        enforcement_parameters: enforcement,
-        evidence_commitments: att.evidence_commitments,
-        is_re_attestation: isReAttestation,
-    });
-}
-//# sourceMappingURL=create-artifact.js.map

package/dist/tools/create-artifact.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"create-artifact.js","sourceRoot":"","sources":["../../src/tools/create-artifact.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAsBrE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAwB,EAAE,GAAkB;IACrF,sEAAsE;IACtE,IAAI,KAAoD,CAAC;IACzD,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC1D,KAAK,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,kBAAkB,EAAE,aAAa,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC7F,CAAC;SAAM,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,CAAC,KAAK,CAAC,8EAA8E,CAAC,CAAC;IACnG,CAAC;IAED,4DAA4D;IAC5D,MAAM,WAAW,GAAG;QAClB,sBAAsB,EAAE,IAAI,CAAC,sBAAsB,IAAI,GAAG,CAAC,kBAAkB,CAAC,sBAAsB;QACpG,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,kBAAkB,CAAC,WAAW;QACnE,oBAAoB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAuC,CAAC;YAChD,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,oBAAoB;QAC/C,uBAAuB,EAAE,GAAG,CAAC,kBAAkB,CAAC,uBAAuB;QACvE,iBAAiB,EAAE,CAAC,IAAI,CAAC,iBAAiB,IAAI,GAAG,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAsB;KACzH,CAAC;IAEF,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,kBAAkB,CAAC;QAC7B,kBAAkB,EAAE,KAAK;QACzB,gBAAgB,EAAE,SAAS;QAC3B,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,EAAE;KAC1C,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACvD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,IAAI,oBAAoB,CAAC,CAAC;IACjE,CAAC;IAED,4DAA4D;IAC5D,MAAM,gBAAgB,GAAG,GAAG,CAAC,cAAc,CAAC;IAC5C,MAAM,eAAe,GAAG,gBAAgB,KAAK,IAAI,IAAI,CACnD,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,YAAY;QACtE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,WAAW,CAAC,CACnD,CAAC;IAEF,MAAM,QAAQ,GAAG,gBAAgB,CAAC;QAChC,kBAAkB,EAAE,KAAK;QACzB,gBAAgB,EAAE,SAAS;QAC3B,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,gBAAiB,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,sBAAsB,EAAE,WAAW;QACnC,iBAAiB,EAAE,GAAG,CAAC,aAAa;QACpC,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;QAC9C,cAAc,EAAE,GAAG,CAAC,QAAQ;KAC7B,CAAC,CAAC;IACH,MAAM,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAE1C,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACnB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACnE,GAAG,CAAC,cAAc,GAAG,QAAQ,CAAC;IAC9B,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;IACtB,GAAG,CAAC,gBAAgB,GAAG,CAAC,CAAC;IACzB,GAAG,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;IAC9B,IAAI,IAAI,CAAC,mBAAmB;QAAE,GAAG,CAAC,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAE1F,MAAM,SAAS,GAAG,eAAe,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACzE,MAAM,YAAY,GAA4B;QAC5C,aAAa,EAAE,YAAY,CAAC,QAAQ,CAAC;QACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC;IACF,IAAI,eAAe,IAAI,gBAAgB,EAAE,CAAC;QACxC,YAAY,CAAC,uBAAuB,GAAG,gBAAgB,CAAC,WAAW,CAAC;QACpE,YAAY,CAAC,yBAAyB,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,CAAC,aAAa,CAAC,SAAgB,EAAE,YAAY,CAAC,CAAC;IAExD,OAAO,GAAG,CAAC,IAAI,CAAC;QACd,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,YAAY,CAAC,QAAQ,CAAC;QACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,kBAAkB,EAAE,KAAK;QACzB,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK;QAC9B,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QAClD,iBAAiB,EAAE,GAAG,CAAC,gBAAgB;QACvC,UAAU,EAAE,SAAS;QACrB,sBAAsB,EAAE,WAAW;QACnC,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;QAC9C,iBAAiB,EAAE,eAAe;KACnC,CAAC,CAAC;AACL,CAAC"}