@attested-intelligence/aga-mcp-server 2.1.0 → 2.2.1

package/README.md

@@ -1,124 +1,209 @@
-# @attested-intelligence/aga-mcp-server v2.0.0
-
-[![MCP Badge](https://lobehub.com/badge/mcp/attested-intelligence-aga-mcp-server)](https://lobehub.com/mcp/attested-intelligence-aga-mcp-server)
-
-MCP server implementing the Attested Governance Artifact (AGA) protocol - cryptographic compliance enforcement for autonomous AI systems.
-
-## What It Does
-
-This server acts as a **Portal** (zero-trust Policy Enforcement Point) for AI agents. Every tool call is attested, measured against a sealed cryptographic reference, and logged to a tamper-evident continuity chain with signed receipts.
-
-**20 tools, 3 resources, 3 prompts, 159 tests**
-
-## 20 MCP Tools
-
-| # | Tool | Description |
-| --- | --- | --- |
-| 1 | `aga_server_info` | Server identity, keys, portal state, framework alignment |
-| 2 | `aga_init_chain` | Initialize continuity chain with genesis event |
-| 3 | `aga_create_artifact` | Attest subject, generate sealed Policy Artifact |
-| 4 | `aga_measure_subject` | Measure subject, compare to sealed ref, generate receipt |
-| 5 | `aga_verify_artifact` | Verify artifact signature against issuer key |
-| 6 | `aga_start_monitoring` | Start/restart behavioral monitoring with baseline |
-| 7 | `aga_get_portal_state` | Current portal enforcement state and TTL |
-| 8 | `aga_trigger_measurement` | Trigger measurement with specific type |
-| 9 | `aga_generate_receipt` | Generate signed measurement receipt manually |
-| 10 | `aga_export_bundle` | Package artifact + receipts + Merkle proofs |
-| 11 | `aga_verify_bundle` | 4-step offline bundle verification |
-| 12 | `aga_disclose_claim` | Privacy-preserving disclosure with auto-substitution |
-| 13 | `aga_get_chain` | Get chain events with optional integrity verification |
-| 14 | `aga_quarantine_status` | Quarantine state and forensic capture status |
-| 15 | `aga_revoke_artifact` | Mid-session artifact revocation |
-| 16 | `aga_set_verification_tier` | Set verification tier (BRONZE/SILVER/GOLD) |
-| 17 | `aga_demonstrate_lifecycle` | Full lifecycle: attest, measure, checkpoint, verify |
-| 18 | `aga_measure_behavior` | Behavioral drift detection (tool patterns) |
-| 19 | `aga_delegate_to_subagent` | Constrained sub-agent delegation (scope only diminishes) |
-| 20 | `aga_rotate_keys` | Key rotation with chain event |
-
-## 3 Resources
-
-| Resource | URI | Description |
-| --- | --- | --- |
-| Protocol Spec | `aga://specification/protocol-v2` | Full protocol specification with SPIFFE alignment |
-| Sample Bundle | `aga://resources/sample-bundle` | Sample evidence bundle documentation |
-| Crypto Primitives | `aga://resources/crypto-primitives` | Cryptographic primitives documentation |
-
-## 3 Prompts
-
-| Prompt | Description |
-|--------|-------------|
-| `nccoe-demo` | 4-phase NCCoE lab demo with behavioral drift |
-| `governance-report` | Session governance summary report |
-| `drift-analysis` | Drift event analysis and remediation |
-
-## CoSAI MCP Security Threat Coverage
-
-The AGA MCP Server addresses all 12 threat categories identified in the
-[CoSAI MCP Security whitepaper](https://github.com/cosai-oasis/ws4-secure-design-agentic-systems/blob/main/model-context-protocol-security.md)
-(Coalition for Secure AI / OASIS, January 2026).
-
-| CoSAI Category | Threat Domain | AGA Governance Mechanism |
-|---|---|---|
-| T1: Improper Authentication | Identity & Access | Ed25519 artifact signatures, pinned issuer keys, TTL re-attestation, key rotation chain events |
-| T2: Missing Access Control | Identity & Access | Portal as mandatory enforcement boundary, sealed constraints, delegation with scope diminishment |
-| T3: Input Validation Failures | Input Handling | Runtime measurement against sealed reference, behavioral drift detection |
-| T4: Data/Control Boundary Failures | Input Handling | Behavioral baseline (permitted tools, forbidden sequences, rate limits), phantom execution forensics |
-| T5: Inadequate Data Protection | Data & Code | Salted commitments, privacy-preserving disclosure with substitution, inference risk prevention |
-| T6: Missing Integrity Controls | Data & Code | Content-addressable hash binding, 10 measurement embodiments, continuous runtime verification |
-| T7: Session/Transport Security | Network & Transport | TTL-based artifact expiration, fail-closed on expiry, mid-session revocation, Ed25519 signed receipts |
-| T8: Network Isolation Failures | Network & Transport | Two-process architecture, agent holds no credentials, NETWORK_ISOLATE enforcement action |
-| T9: Trust Boundary Failures | Trust & Design | Enforcement pre-committed by human authorities in sealed artifact, not delegated to LLM |
-| T10: Resource Management | Trust & Design | Per-tool rate limits in behavioral baseline, configurable measurement cadence (10ms to 3600s) |
-| T11: Supply Chain Failures | Operational | Content-addressable hashing at attestation, runtime hash comparison blocks modified components |
-| T12: Insufficient Observability | Operational | Signed receipts, tamper-evident continuity chain, Merkle anchoring, offline evidence bundles |
-
-Full mapping details available via the `aga://specification` resource.
-
-## Quick Start
-
-```bash
-npm install && npm run build && npm test
-```
-
-## Connect to an MCP Client
-
-Add to your MCP client config:
-
-```json
-{
-  "mcpServers": {
-    "aga": { "command": "node", "args": ["/path/to/aga-mcp-server/dist/index.js"] }
-  }
-}
-```
-
-## Architecture
-
-```
-MCP Client
-    │ JSON-RPC over stdio
-    ▼
-src/server.ts - 20 tools + 3 resources + 3 prompts
-    │
-    ├── src/tools/          20 individual tool handlers
-    ├── src/core/           Protocol logic (artifact, chain, portal, etc.)
-    ├── src/crypto/         Ed25519 + SHA-256 + Merkle + canonical JSON
-    ├── src/middleware/     Zero-trust governance PEP
-    ├── src/storage/        In-memory + optional SQLite
-    ├── src/resources/      Protocol docs + crypto primitives
-    └── src/prompts/        Demo + report + analysis prompts
-```
-
-## Test Coverage
-
-| Suite | Tests | What |
-|-------|-------|------|
-| Crypto | 33 | SHA-256, Ed25519, Merkle, salt, canonical, keys |
-| Core | 56 | Artifact, chain, portal, governance, behavioral, delegation, privacy, revocation, fail-closed |
-| Tools | 25 | All 20 tool handlers |
-| Integration | 38 | Bundle tamper, lifecycle, performance, NCCoE demo, crucible compatibility |
-| **Total** | **159** | |
-
-## License
-
-MIT - Attested Intelligence Holdings LLC
+# AGA - Attested Governance Artifacts
+
+Cryptographic runtime governance for AI agents and autonomous systems.
+
+[![npm](https://img.shields.io/npm/v/@attested-intelligence/aga-mcp-server)](https://www.npmjs.com/package/@attested-intelligence/aga-mcp-server)
+[![PyPI](https://img.shields.io/pypi/v/aga-governance)](https://pypi.org/project/aga-governance/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![Tests](https://img.shields.io/badge/tests-355%2B-brightgreen)](https://github.com/attestedintelligence/AGA)
+
+```bash
+# Try it now
+pip install aga-governance
+python -m aga demo
+python -m aga verify demo-bundle.json
+```
+
+## What This Does
+
+Every tool call an AI agent makes passes through the AGA gateway. Each call is evaluated against policy, and the decision (PERMITTED or DENIED) is recorded as a signed, hash-linked governance receipt. Receipts are collected into evidence bundles that any third party can verify offline using standard cryptography.
+
+**Record. Prove. Verify.**
+
+## Use with Claude Desktop
+
+Add to your Claude Desktop MCP config (`claude_desktop_config.json`):
+
+```json
+{
+  "mcpServers": {
+    "aga": {
+      "command": "npx",
+      "args": ["-y", "@attested-intelligence/aga-mcp-server"]
+    }
+  }
+}
+```
+
+Claude can then seal artifacts, measure integrity, generate evidence bundles, and verify compliance through natural language.
+
+## MCP Tools (20)
+
+| Category | Tools |
+|----------|-------|
+| **Identity** | `get_server_info`, `get_portal_state` |
+| **Lifecycle** | `init_chain`, `attest_subject`, `revoke_artifact` |
+| **Enforcement** | `measure_integrity`, `measure_behavior`, `verify_chain` |
+| **Evidence** | `create_checkpoint`, `generate_evidence_bundle`, `verify_bundle_offline` |
+| **Privacy** | `request_claim`, `list_claims` |
+| **Delegation** | `delegate_to_subagent` |
+| **Audit** | `get_receipts`, `get_chain_events` |
+
+## Quick Start
+
+### Verify an evidence bundle (3 commands)
+
+```bash
+pip install aga-governance
+curl -s https://aga-mcp-gateway.attestedintelligence.workers.dev/bundle -o evidence-bundle.json
+python -m aga verify evidence-bundle.json
+```
+
+### Or verify in your browser
+
+Go to [attestedintelligence.com/verify](https://attestedintelligence.com/verify) and click "Run Verification." Zero installs required.
+
+## How It Works
+
+```
+AI Agent                  AGA Gateway                    Verifier
+   |                          |                              |
+   |-- tools/call ----------->|                              |
+   |                    [Evaluate Policy]                    |
+   |                    [Sign Receipt]                       |
+   |                    [Chain to Previous]                  |
+   |<-- PERMITTED/DENIED -----|                              |
+   |                          |                              |
+   |                    [Export Bundle]                       |
+   |                          |--------- evidence.json ----->|
+   |                          |                  [Verify Signatures]
+   |                          |                  [Verify Chain]
+   |                          |                  [Verify Merkle Tree]
+   |                          |                  [PASS / FAIL]
+```
+
+## MCP Governance Proxy
+
+Run AGA as a transparent proxy between any MCP client and any MCP server. Every tool call gets evaluated against policy and produces a signed receipt.
+
+```bash
+# Start the proxy with an upstream MCP server
+npx tsx src/proxy/index.ts start --upstream "npx -y @modelcontextprotocol/server-filesystem /tmp/test" --profile standard
+
+# Export the evidence bundle
+npx tsx src/proxy/index.ts export --output evidence.json
+
+# Verify
+npx tsx src/proxy/index.ts verify evidence.json
+```
+
+The proxy intercepts `tools/call` requests, evaluates them against a sealed policy artifact, and generates signed receipts. Permitted calls are forwarded to the downstream server. Denied calls return an MCP error. Every decision is hash-linked into a tamper-evident chain.
+
+Three built-in policy profiles:
+- **permissive** - log everything, block nothing (default)
+- **standard** - rate limits + blocks destructive operations
+- **restrictive** - explicit tool allowlist, all unknown tools denied
+
+## Verification (5 steps)
+
+1. **Algorithm Check** - Bundle declares Ed25519-SHA256-JCS, fail closed on anything else
+2. **Receipt Signatures** - Ed25519 over RFC 8785 canonical JSON (signature field excluded)
+3. **Chain Integrity** - Each receipt's `previous_receipt_hash` = SHA-256 of the preceding receipt
+4. **Merkle Proofs** - Walk siblings/directions to root, compare against bundle root
+5. **Bundle Consistency** - Proof count = receipt count, leaf hashes match receipt hashes
+
+## Cryptographic Primitives
+
+| Primitive | Purpose |
+|-----------|---------|
+| Ed25519 | Receipt signatures |
+| SHA-256 | Hash chaining, Merkle trees, leaf computation |
+| RFC 8785 (JCS) | Canonical JSON for deterministic signing |
+| Merkle Trees | Binding all receipts to a single verifiable root |
+
+## Live Gateway
+
+The demo gateway is deployed on Cloudflare Workers:
+
+```bash
+# Check status
+curl https://aga-mcp-gateway.attestedintelligence.workers.dev/health
+
+# Export evidence bundle
+curl https://aga-mcp-gateway.attestedintelligence.workers.dev/bundle -o evidence-bundle.json
+```
+
+## Python SDK
+
+```bash
+pip install aga-governance
+```
+
+```python
+from aga import AgentSession
+
+with AgentSession(gateway_id="my-gateway") as session:
+    session.record_tool_call(
+        tool_name="search_web",
+        decision="PERMITTED",
+        reason="tool in allowlist",
+        request_id="req-1",
+    )
+    bundle = session.export_bundle()
+    result = session.verify()
+    assert result["overall_valid"]
+```
+
+## Test Suite
+
+355+ automated tests across TypeScript and Python:
+
+- **TypeScript MCP Server:** 218 tests (vitest)
+- **Python SDK:** 137 tests (pytest)
+- **Cross-language test vectors:** 37 vectors across 9 categories
+
+```bash
+npm test                              # TypeScript tests
+cd aga-python && python -m pytest     # Python tests
+```
+
+## Project Structure
+
+```
+src/                   # Core protocol: artifacts, receipts, chain, Merkle, crypto, portal state machine
+  core/                # Governance primitives (artifact, receipt, chain, portal, bundle)
+  crypto/              # Ed25519, SHA-256, BLAKE2b, Merkle, JCS canonicalization
+  proxy/               # MCP governance proxy (transparent interception + policy enforcement)
+  tools/               # MCP tool handlers (20 tools)
+  middleware/          # Zero-trust governance enforcement wrapper
+aga-python/            # Python SDK with @governed decorator (PyPI: aga-governance)
+independent-verifier/  # Standalone verifier with zero AGA imports
+scenarios/             # Deployment scenarios (SCADA, drone, AI agent)
+tests/                 # TypeScript test suite (218 tests)
+```
+
+## Links
+
+- [Website](https://attestedintelligence.com)
+- [Technology](https://attestedintelligence.com/technology)
+- [Live Verifier](https://attestedintelligence.com/verify)
+- [Trust and Scope](https://attestedintelligence.com/trust)
+- [Diligence Materials](https://attestedintelligence.com/diligence)
+- [MCP Server (npm)](https://www.npmjs.com/package/@attested-intelligence/aga-mcp-server)
+- [Python SDK (PyPI)](https://pypi.org/project/aga-governance/)
+
+## Security
+
+See [SECURITY.md](SECURITY.md) for vulnerability reporting.
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup and guidelines.
+
+## License
+
+[MIT](LICENSE)
+
+---
+
+Attested Intelligence Holdings LLC

package/dist/adapters/openclaw.d.ts

@@ -5,7 +5,6 @@
  * All OpenClaw assumptions are documented inline. When a real OpenClaw instance
  * becomes available, validate each assumption.
  *
- * Patent: USPTO App. No. 19/433,835
  * Copyright (c) 2026 Attested Intelligence Holdings LLC
  * SPDX-License-Identifier: MIT
  */

package/dist/adapters/openclaw.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openclaw.d.ts","sourceRoot":"","sources":["../../src/adapters/openclaw.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAmBH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzF,cAAc,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7C,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,qBAAa,eAAgB,YAAW,kBAAkB;IACxD,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,UAAU,CAAuB;IAEzC,OAAO,CAAC,cAAc;IAIhB,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAqBxF,cAAc,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAW5C,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA6B/E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAU/B"}
+{"version":3,"file":"openclaw.d.ts","sourceRoot":"","sources":["../../src/adapters/openclaw.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAmBH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzF,cAAc,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7C,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,qBAAa,eAAgB,YAAW,kBAAkB;IACxD,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,UAAU,CAAuB;IAEzC,OAAO,CAAC,cAAc;IAIhB,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAqBxF,cAAc,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAW5C,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA6B/E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAU/B"}

package/dist/adapters/openclaw.js

@@ -5,7 +5,6 @@
  * All OpenClaw assumptions are documented inline. When a real OpenClaw instance
  * becomes available, validate each assumption.
  *
- * Patent: USPTO App. No. 19/433,835
  * Copyright (c) 2026 Attested Intelligence Holdings LLC
  * SPDX-License-Identifier: MIT
  */

package/dist/adapters/openclaw.js.map

@@ -1 +1 @@
-{"version":3,"file":"openclaw.js","sourceRoot":"","sources":["../../src/adapters/openclaw.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AA+B9B,MAAM,OAAO,eAAe;IAClB,UAAU,GAAkB,IAAI,CAAC;IACjC,UAAU,GAAkB,IAAI,CAAC;IAEjC,cAAc;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAmB;QAC9B,MAAM,CAAC,GAAG,UAAU,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,CAAC,GAAG,aAAa,CAAC;QAEpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACnC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YACvD,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,CAAC;gBACP,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,gBAAgB,IAAI,SAAS;aAChE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAE7D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACrD,IAAI;YACJ,GAAI,KAAiC;SACtC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,SAA4B;QACnE,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAEjF,kBAAkB;QAClB,MAAM,eAAe,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAClE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAE3C,sDAAsD;QACtD,qDAAqD;QACrD,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;YAC/B,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAEhD,6CAA6C;gBAC7C,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG;oBAC/B,yBAAyB;oBACzB,GAAG,EAAE,oBAAoB,SAAS,EAAE;oBACpC,oBAAoB;oBACpB,aAAa,EAAE,QAAQ;oBACvB,aAAa,EAAE,IAAI;iBACpB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAEjF,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACnC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAClD,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"openclaw.js","sourceRoot":"","sources":["../../src/adapters/openclaw.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AA+B9B,MAAM,OAAO,eAAe;IAClB,UAAU,GAAkB,IAAI,CAAC;IACjC,UAAU,GAAkB,IAAI,CAAC;IAEjC,cAAc;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAmB;QAC9B,MAAM,CAAC,GAAG,UAAU,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,CAAC,GAAG,aAAa,CAAC;QAEpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACnC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YACvD,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,CAAC;gBACP,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,gBAAgB,IAAI,SAAS;aAChE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAE7D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;QACxC,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACrD,IAAI;YACJ,GAAI,KAAiC;SACtC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,SAA4B;QACnE,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAEjF,kBAAkB;QAClB,MAAM,eAAe,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAClE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAE3C,sDAAsD;QACtD,qDAAqD;QACrD,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;YAC/B,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAEhD,6CAA6C;gBAC7C,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG;oBAC/B,yBAAyB;oBACzB,GAAG,EAAE,oBAAoB,SAAS,EAAE;oBACpC,oBAAoB;oBACpB,aAAa,EAAE,QAAQ;oBACvB,aAAa,EAAE,IAAI;iBACpB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAEjF,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACnC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAClD,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;CACF"}

package/dist/core/bundle.d.ts

@@ -1,6 +1,13 @@
 import type { KeyPair, MerkleInclusionProof } from '../crypto/types.js';
-import type { EvidenceBundle, PolicyArtifact, SignedReceipt, CheckpointReference } from './types.js';
-export declare function generateBundle(artifact: PolicyArtifact, receipts: SignedReceipt[], proofs: MerkleInclusionProof[], checkpoint: CheckpointReference, kp: KeyPair): EvidenceBundle;
+import type { EvidenceBundle, PolicyArtifact, SignedReceipt, CheckpointReference, VerificationTier } from './types.js';
+/**
+ * Generate an evidence bundle. Original signature preserved for backward compatibility.
+ * Tiered bundle generation (CAISI §3b):
+ *   BRONZE - artifact + receipts only (proofs omitted)
+ *   SILVER - artifact + receipts + Merkle proofs
+ *   GOLD   - artifact + receipts + Merkle proofs + anchor checkpoint reference
+ */
+export declare function generateBundle(artifact: PolicyArtifact, receipts: SignedReceipt[], proofs: MerkleInclusionProof[], checkpoint: CheckpointReference, kp: KeyPair, tier?: VerificationTier): EvidenceBundle;
 export interface VerificationResult {
     step1_artifact_sig: boolean;
     step2_receipt_sigs: boolean;

package/dist/core/bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/core/bundle.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAErG,wBAAgB,cAAc,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,UAAU,EAAE,mBAAmB,EAAE,EAAE,EAAE,OAAO,GAAG,cAAc,CAGhL;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,OAAO,CAAC;IAAC,kBAAkB,EAAE,OAAO,CAAC;IACzD,mBAAmB,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,iBAAiB,GAAG,OAAO,CAAC;IACxE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;CACpC;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,GAAG,kBAAkB,CAanG"}
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/core/bundle.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEvH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,UAAU,EAAE,mBAAmB,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,gBAAgB,GAAG,cAAc,CAUzM;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,OAAO,CAAC;IAAC,kBAAkB,EAAE,OAAO,CAAC;IACzD,mBAAmB,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,iBAAiB,GAAG,OAAO,CAAC;IACxE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;CACpC;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,GAAG,kBAAkB,CAanG"}

package/dist/core/bundle.js

@@ -1,8 +1,22 @@
 import { signStr, sigToB64, b64ToSig, hexToPk, verifyStr, pkToHex } from '../crypto/sign.js';
 import { verifyProof } from '../crypto/merkle.js';
 import { canonicalize } from '../utils/canonical.js';
-export function generateBundle(artifact, receipts, proofs, checkpoint, kp) {
-    const unsigned = { artifact, receipts, merkle_proofs: proofs, checkpoint_reference: checkpoint, public_key: pkToHex(kp.publicKey) };
+/**
+ * Generate an evidence bundle. Original signature preserved for backward compatibility.
+ * Tiered bundle generation (CAISI §3b):
+ *   BRONZE - artifact + receipts only (proofs omitted)
+ *   SILVER - artifact + receipts + Merkle proofs
+ *   GOLD   - artifact + receipts + Merkle proofs + anchor checkpoint reference
+ */
+export function generateBundle(artifact, receipts, proofs, checkpoint, kp, tier) {
+    const effectiveTier = tier ?? 'GOLD';
+    const bundleProofs = effectiveTier === 'BRONZE' ? [] : proofs;
+    const bundleCheckpoint = effectiveTier === 'GOLD' ? checkpoint : {
+        ...checkpoint,
+        transaction_id: effectiveTier === 'BRONZE' ? '' : checkpoint.transaction_id,
+        anchor_network: effectiveTier === 'BRONZE' ? '' : checkpoint.anchor_network,
+    };
+    const unsigned = { artifact, receipts, merkle_proofs: bundleProofs, checkpoint_reference: bundleCheckpoint, public_key: pkToHex(kp.publicKey), verification_tier: effectiveTier };
     return { ...unsigned, bundle_signature: sigToB64(signStr(canonicalize(unsigned), kp.secretKey)) };
 }
 export function verifyBundleOffline(bundle, pinnedPkHex) {

package/dist/core/bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../src/core/bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAIrD,MAAM,UAAU,cAAc,CAAC,QAAwB,EAAE,QAAyB,EAAE,MAA8B,EAAE,UAA+B,EAAE,EAAW;IAC9J,MAAM,QAAQ,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,oBAAoB,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;IACpI,OAAO,EAAE,GAAG,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;AACpG,CAAC;AAQD,MAAM,UAAU,mBAAmB,CAAC,MAAsB,EAAE,WAAmB;IAC7E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IACnD,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAClD,IAAI,EAAE,GAAG,IAAI,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAAC,EAAE,GAAG,KAAK,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,UAAU,aAAa,CAAC,CAAC;QAAC,CAAC;IAC9J,CAAC;IACD,IAAI,EAAE,GAAG,IAAI,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,EAAE,GAAG,KAAK,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAAC,CAAC;IAAC,CAAC;IACtI,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC;AACvJ,CAAC"}
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../../src/core/bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAIrD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,QAAwB,EAAE,QAAyB,EAAE,MAA8B,EAAE,UAA+B,EAAE,EAAW,EAAE,IAAuB;IACvL,MAAM,aAAa,GAAG,IAAI,IAAI,MAAM,CAAC;IACrC,MAAM,YAAY,GAAG,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9D,MAAM,gBAAgB,GAAwB,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACpF,GAAG,UAAU;QACb,cAAc,EAAE,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc;QAC3E,cAAc,EAAE,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc;KAC5E,CAAC;IACF,MAAM,QAAQ,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC;IAClL,OAAO,EAAE,GAAG,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;AACpG,CAAC;AAQD,MAAM,UAAU,mBAAmB,CAAC,MAAsB,EAAE,WAAmB;IAC7E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IACnD,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAClD,IAAI,EAAE,GAAG,IAAI,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAAC,EAAE,GAAG,KAAK,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,UAAU,aAAa,CAAC,CAAC;QAAC,CAAC;IAC9J,CAAC;IACD,IAAI,EAAE,GAAG,IAAI,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,EAAE,GAAG,KAAK,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAAC,CAAC;IAAC,CAAC;IACtI,OAAO,EAAE,kBAAkB,EAAE,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC;AACvJ,CAAC"}

package/dist/core/identity.d.ts

@@ -1,14 +1,23 @@
+import type { KeyPair } from '../crypto/types.js';
+import type { ContinuityEvent } from './types.js';
+export { keyFingerprint } from '../crypto/sign.js';
 /**
- * Identity operations: key fingerprinting, validation, rotation.
+ * Check whether a key is still valid given its issuance time and TTL.
+ * NCCoE §2: non-biometric identity validity check.
  */
-import { keyFingerprint, isKeyValid } from '../crypto/keys.js';
-import type { KeyPair } from '../types.js';
-export { keyFingerprint, isKeyValid };
-export interface KeyRotationResult {
+export declare function isKeyValid(issuedAt: string, ttlSeconds: number): boolean;
+/**
+ * Generate a new key pair for rotation, returning both old and new for
+ * a transition period defined by policy. NCCoE §3: key rotation.
+ */
+export declare function rotateKeyPair(currentKeyPair: KeyPair): {
+    oldKeyPair: KeyPair;
     newKeyPair: KeyPair;
-    newPublicKeyHex: string;
-    oldPublicKeyHex: string;
-    rotatedAt: string;
-}
-export declare function rotateKeys(oldKP: KeyPair): KeyRotationResult;
+};
+/**
+ * Record a key rotation event on the continuity chain.
+ * NCCoE §3: "Key rotation is handled by including both old and new public keys
+ * during a transition period defined by policy."
+ */
+export declare function recordKeyRotation(prevEvent: ContinuityEvent, keypairType: string, oldPublicKeyHex: string, newPublicKeyHex: string, reason: string, signingKeyPair: KeyPair): ContinuityEvent;
 //# sourceMappingURL=identity.d.ts.map

package/dist/core/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/core/identity.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,cAAc,EAAE,UAAU,EAAiB,MAAM,mBAAmB,CAAC;AAE9E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;AAEtC,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CAQ5D"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/core/identity.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,YAAY,CAAC;AAGrE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAExE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,cAAc,EAAE,OAAO,GAAG;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAGnG;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,eAAe,EAC1B,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,OAAO,GACtB,eAAe,CAUjB"}

package/dist/core/identity.js

@@ -1,16 +1,50 @@
 /**
- * Identity operations: key fingerprinting, validation, rotation.
+ * Identity and Key Lifecycle.
+ *
+ * Non-biometric cryptographic identity: agent identity derived from
+ * cryptographic key pair bound to append-only attestation history in
+ * continuity chain. Authority from valid signature history, not biometric traits.
+ *
+ * Functions:
+ * - keyFingerprint: re-exported from crypto/sign.ts for convenience
+ * - isKeyValid: check key TTL expiry
+ * - rotateKeyPair: generate new key pair for rotation
+ * - recordKeyRotation: append KEY_ROTATION event to chain
  */
-import { keyFingerprint, isKeyValid, rotateKeyPair } from '../crypto/keys.js';
-import { pkToHex } from '../crypto/sign.js';
-export { keyFingerprint, isKeyValid };
-export function rotateKeys(oldKP) {
-    const newKP = rotateKeyPair();
-    return {
-        newKeyPair: newKP,
-        newPublicKeyHex: pkToHex(newKP.publicKey),
-        oldPublicKeyHex: pkToHex(oldKP.publicKey),
-        rotatedAt: new Date().toISOString(),
+import { generateKeyPair } from '../crypto/sign.js';
+import { isExpired } from '../utils/timestamp.js';
+import { appendEvent } from './chain.js';
+// Re-export keyFingerprint for identity module consumers (NCCoE §2)
+export { keyFingerprint } from '../crypto/sign.js';
+/**
+ * Check whether a key is still valid given its issuance time and TTL.
+ * NCCoE §2: non-biometric identity validity check.
+ */
+export function isKeyValid(issuedAt, ttlSeconds) {
+    return !isExpired(issuedAt, ttlSeconds);
+}
+/**
+ * Generate a new key pair for rotation, returning both old and new for
+ * a transition period defined by policy. NCCoE §3: key rotation.
+ */
+export function rotateKeyPair(currentKeyPair) {
+    const newKeyPair = generateKeyPair();
+    return { oldKeyPair: currentKeyPair, newKeyPair };
+}
+/**
+ * Record a key rotation event on the continuity chain.
+ * NCCoE §3: "Key rotation is handled by including both old and new public keys
+ * during a transition period defined by policy."
+ */
+export function recordKeyRotation(prevEvent, keypairType, oldPublicKeyHex, newPublicKeyHex, reason, signingKeyPair) {
+    const payload = {
+        keypair_type: keypairType,
+        old_public_key: oldPublicKeyHex,
+        new_public_key: newPublicKeyHex,
+        reason,
+        rotation_timestamp: new Date().toISOString(),
+        chain_sequence: prevEvent.sequence_number + 1,
     };
+    return appendEvent('KEY_ROTATION', payload, prevEvent, signingKeyPair);
 }
 //# sourceMappingURL=identity.js.map

package/dist/core/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/core/identity.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAmB,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAG7D,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;AAStC,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QACzC,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QACzC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/core/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,eAAe,EAA2B,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAIzC,oEAAoE;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,UAAkB;IAC7D,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,cAAuB;IACnD,MAAM,UAAU,GAAG,eAAe,EAAE,CAAC;IACrC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAA0B,EAC1B,WAAmB,EACnB,eAAuB,EACvB,eAAuB,EACvB,MAAc,EACd,cAAuB;IAEvB,MAAM,OAAO,GAAsB;QACjC,YAAY,EAAE,WAAW;QACzB,cAAc,EAAE,eAAe;QAC/B,cAAc,EAAE,eAAe;QAC/B,MAAM;QACN,kBAAkB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5C,cAAc,EAAE,SAAS,CAAC,eAAe,GAAG,CAAC;KAC9C,CAAC;IACF,OAAO,WAAW,CAAC,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;AACzE,CAAC"}

package/dist/core/portal.d.ts

@@ -8,6 +8,14 @@ export interface MeasurementResult {
     expectedMetaHash: HashHex;
     ttl_ok: boolean;
     revoked: boolean;
+    degraded?: boolean;
+}
+/** Degradation event record for the continuity chain. */
+export interface DegradationEvent {
+    reason: string;
+    timestamp: string;
+    artifact_reference: HashHex;
+    previous_state: string;
 }
 export declare class Portal {
     state: PortalState;
@@ -15,13 +23,14 @@ export declare class Portal {
     sequenceCounter: number;
     lastLeafHash: HashHex | null;
     revocations: Set<string>;
+    degradationLog: DegradationEvent[];
     loadArtifact(artifact: PolicyArtifact, pinnedPkHex: string): {
         ok: boolean;
         error?: string;
     };
     measure(subjectBytes: Uint8Array, meta: SubjectMetadata): MeasurementResult;
     enforce(action: EnforcementAction): void;
-    revoke(sealedHash: string, transitionTo?: 'TERMINATED' | 'SAFE_STATE'): void;
+    revoke(sealedHash: string): void;
     isRevoked(sealedHash: string): boolean;
     reset(): void;
 }

package/dist/core/portal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../src/core/portal.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,gBAAgB,EAAE,OAAO,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,MAAM;IACjB,KAAK,EAAE,WAAW,CAAoB;IACtC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAQ;IACvC,eAAe,SAAK;IACpB,YAAY,EAAE,OAAO,GAAG,IAAI,CAAQ;IACpC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAa;IAErC,YAAY,CAAC,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAiB5F,OAAO,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,GAAG,iBAAiB;IA6B3E,OAAO,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI;IAWxC,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,YAAY,GAAG,YAAY,GAAG,IAAI;IAO5E,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAEtC,KAAK,IAAI,IAAI;CAId"}
+{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../src/core/portal.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,gBAAgB,EAAE,OAAO,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,MAAM;IACjB,KAAK,EAAE,WAAW,CAAoB;IACtC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAQ;IACvC,eAAe,SAAK;IACpB,YAAY,EAAE,OAAO,GAAG,IAAI,CAAQ;IACpC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAa;IACrC,cAAc,EAAE,gBAAgB,EAAE,CAAM;IAExC,YAAY,CAAC,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAiB5F,OAAO,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,GAAG,iBAAiB;IAuC3E,OAAO,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI;IAUxC,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAKhC,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAEtC,KAAK,IAAI,IAAI;CAId"}