@attested-intelligence/aga-mcp-server 2.2.1 → 3.0.0-rc.0

package/DEPLOYMENT.md

@@ -0,0 +1,111 @@
+# AGA MCP Server — Deployment & Hardening Guide
+
+Practical guidance for running `@attested-intelligence/aga-mcp-server` (3.0.0-rc) in a defensible configuration. Scope is the **MCP server boundary** — see `THREAT_BOUNDARY.md` for the full claim/limitation surface this guide operationalizes.
+
+The hardened posture in one line: **stdio upstream + a persisted, well-protected gateway key + network isolation + verifiers that pin the gateway key.**
+
+---
+
+## 1. Upstream mode — stdio (recommended) vs HTTP
+
+The governance proxy (`aga-proxy`) sits between an MCP client and an upstream MCP server and produces a signed receipt for every governed `tools/call`. How you connect the upstream determines whether that mediation can be bypassed.
+
+### ✅ stdio upstream — the hardened default
+```bash
+npx -p @attested-intelligence/aga-mcp-server aga-proxy start \
+  --upstream "npx -y @modelcontextprotocol/server-filesystem /tmp/data" --profile standard
+```
+The upstream is a **child process** the proxy spawns and talks to over stdio. It is **not network-reachable**, so the agent has no route to the tools except through the proxy. This closes the direct-reach bypass (`THREAT_BOUNDARY.md` §3.1) by construction. **Prefer this mode.**
+
+### ⚠️ HTTP upstream — only behind strict network isolation
+```bash
+# Bypassable unless the agent CANNOT reach the upstream URL directly.
+aga-proxy start --upstream-url "http://127.0.0.1:9000" --profile standard
+```
+With an HTTP upstream, **anything that can reach the upstream URL bypasses governance entirely** (no receipt). This is a deployment property the server cannot enforce in code. If you must use HTTP upstream:
+- Bind the upstream to `127.0.0.1` / a private network the agent cannot reach.
+- Use network policy / firewall so the **only** path to the upstream is through the proxy.
+- Treat any deployment where the agent can resolve+reach the upstream URL as **ungoverned**.
+
+The server emits an stderr warning when HTTP-upstream mode is used.
+
+### Method coverage
+Only `method === "tools/call"` is policy-evaluated. Other JSON-RPC methods are forwarded (with passthrough receipts as of P2; see `THREAT_BOUNDARY.md` §3.2). If your upstream exposes side effects via non-`tools/call` methods, account for that explicitly.
+
+---
+
+## 2. The gateway key — generate, persist, pin, protect
+
+The **gateway key** is the Ed25519 key that signs every receipt and checkpoint. Pinning its public key is what turns a bundle from "internally consistent" into "provably issued by *this* gateway."
+
+### Generate a 32-byte seed (64-hex)
+```bash
+node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+```
+
+### Persist it (so provenance survives restarts and is pinnable)
+Either:
+```bash
+export AGA_GATEWAY_KEY=<64-hex-seed>            # environment variable
+# or
+export AGA_GATEWAY_KEY_FILE=/run/secrets/aga-gateway-key   # file containing the hex seed
+```
+If neither is set, the server uses an **ephemeral** key that rotates on every restart (it warns on stderr). Ephemeral is fine for local experiments but means **provenance cannot be pinned across restarts** — avoid it in anything you'll later audit.
+
+### Obtain the public key to pin
+Call the `get_server_info` tool → **`gateway_public_key`**. That 64-hex value is what verifiers pin.
+
+### Pin it when verifying
+```bash
+# reference verifier (zero deps)
+node aga-receipt-spec/verify/verify-sep.mjs evidence-bundle.json --pubkey <gateway_public_key>
+# or the published CLI (2.0.0 — publish pending)
+aga-verify evidence-bundle.json --pubkey <gateway_public_key>
+```
+Or via the tool: `verify_bundle_offline(bundle, pinned_public_key=<gateway_public_key>)`. **Without a pin you get an integrity-only result** (`issuerVerified=false`, summary says "NOT provenance"). See §3.7 of the boundary doc.
+
+### Protect it
+The gateway key is a signing secret — **anyone who holds it can mint a fully VERIFIED, provenance-bound bundle saying anything.** Therefore:
+- Store it in a secret manager, or a file with restricted permissions (e.g. `chmod 600`, owned by the service user); never world-readable, never committed, never in shell history.
+- Rotate by minting a new seed and **re-publishing the new public key** to your verifiers (old bundles stay verifiable against the old key).
+
+---
+
+## 3. Recommended hardened configuration
+
+```jsonc
+// Claude Desktop / MCP client config — proxy in front of a stdio upstream, persisted key
+{
+  "mcpServers": {
+    "aga": {
+      "command": "npx",
+      "args": ["-y", "@attested-intelligence/aga-mcp-server"],
+      "env": { "AGA_GATEWAY_KEY_FILE": "/run/secrets/aga-gateway-key" }
+    }
+  }
+}
+```
+Checklist:
+- [ ] stdio upstream (no HTTP upstream, or HTTP only behind network isolation).
+- [ ] Persisted gateway key from a secret manager / restricted file.
+- [ ] The agent's **only** route to tools is through the proxy (network isolation).
+- [ ] Verifiers **pin** `gateway_public_key`; an unpinned PASS is treated as integrity-only, not provenance.
+- [ ] Export evidence bundles regularly — default storage is in-memory and the live chain is lost on restart; the **exported, signed bundle is the durable record** (`THREAT_BOUNDARY.md` §3.5).
+- [ ] Choose the `restrictive` profile (allowlist, default-deny) for high-stakes upstreams.
+
+---
+
+## 4. Anti-patterns (do not do these)
+
+- ❌ **HTTP upstream without network isolation** — the agent reaches the upstream directly and governance is bypassed (§3.1).
+- ❌ **Ephemeral gateway key in production** — provenance can't be pinned across restarts; auditors can't bind bundles to a stable issuer.
+- ❌ **Treating an unpinned "VERIFIED" as proof of who issued it** — unpinned is integrity-only (`issuerVerified=false`). Always pin to claim provenance (§3.7).
+- ❌ **World-readable / committed / shell-history gateway key** — it's a signing secret; leaking it lets anyone forge provenance-bound bundles.
+- ❌ **Relying on the public demo gateway as the canonical artifact** — it's a separate deployment that may track its own version; always verify offline against a pinned key.
+- ❌ **Adding a new mutating tool without governing it** — any new agent-action tool must go through the PEP (not `UNGOVERNED_TOOLS`) so it emits a signed receipt (`THREAT_BOUNDARY.md` §2 maintenance invariant).
+
+---
+
+## 5. What this does and does not prove
+
+Per `THREAT_BOUNDARY.md`: a verified bundle proves the **integrity of the receipts present** — authentic, ordered, Merkle-included, checkpoint-bound, and (when pinned) issued by the pinned gateway. It does **not** prove non-omission, prevent jailbreaks, or protect a leaked key. Deployment hardening (this guide) is what makes the in-claim guarantee hold in practice.

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Attested Intelligence Holdings LLC
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Attested Intelligence Holdings LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -5,21 +5,25 @@ Cryptographic runtime governance for AI agents and autonomous systems.
 [![npm](https://img.shields.io/npm/v/@attested-intelligence/aga-mcp-server)](https://www.npmjs.com/package/@attested-intelligence/aga-mcp-server)
 [![PyPI](https://img.shields.io/pypi/v/aga-governance)](https://pypi.org/project/aga-governance/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
-[![Tests](https://img.shields.io/badge/tests-355%2B-brightgreen)](https://github.com/attestedintelligence/AGA)
+[![status](https://img.shields.io/badge/status-3.0.0--rc-blue)](https://github.com/attestedintelligence/aga-mcp-server)
+
+> **Status — 3.0.0-rc.** This release candidate emits the **canonical SEP evidence bundle** from both the server tools and the `aga-proxy`, verifiable offline by `@attested-intelligence/aga-verify` and the reference verifier `aga-receipt-spec/verify/verify-sep.mjs`. The **currently-published npm release (2.2.2) still emits a legacy continuity-chain bundle** that does *not* verify under the SEP verifier — upgrade to 3.0 once published. Claim scope and residual attack surface are documented honestly in `THREAT_BOUNDARY.md`.
 
 ```bash
-# Try it now
-pip install aga-governance
-python -m aga demo
-python -m aga verify demo-bundle.json
+# This package IS the AGA MCP server (TypeScript, runs over stdio). Use it from any MCP client:
+npx -y @attested-intelligence/aga-mcp-server
 ```
 
+A Python companion SDK (`aga-governance`) is documented in the Python SDK section below.
+
 ## What This Does
 
 Every tool call an AI agent makes passes through the AGA gateway. Each call is evaluated against policy, and the decision (PERMITTED or DENIED) is recorded as a signed, hash-linked governance receipt. Receipts are collected into evidence bundles that any third party can verify offline using standard cryptography.
 
 **Record. Prove. Verify.**
 
+**Scope:** a verified bundle proves the *integrity of the receipts present* — each is authentic, correctly ordered, Merkle-included, and (when a key is pinned) provenance-bound. It does **not** prove non-omission (that every action the agent took was logged); completeness is bounded by the tamper-evidence of the interception point, which is outside the bundle.
+
 ## Use with Claude Desktop
 
 Add to your Claude Desktop MCP config (`claude_desktop_config.json`):
@@ -37,31 +41,32 @@ Add to your Claude Desktop MCP config (`claude_desktop_config.json`):
 
 Claude can then seal artifacts, measure integrity, generate evidence bundles, and verify compliance through natural language.
 
-## MCP Tools (20)
+## MCP Tools (15)
 
 | Category | Tools |
 |----------|-------|
 | **Identity** | `get_server_info`, `get_portal_state` |
 | **Lifecycle** | `init_chain`, `attest_subject`, `revoke_artifact` |
 | **Enforcement** | `measure_integrity`, `measure_behavior`, `verify_chain` |
-| **Evidence** | `create_checkpoint`, `generate_evidence_bundle`, `verify_bundle_offline` |
+| **Evidence** | `generate_evidence_bundle`, `verify_bundle_offline` |
 | **Privacy** | `request_claim`, `list_claims` |
 | **Delegation** | `delegate_to_subagent` |
 | **Audit** | `get_receipts`, `get_chain_events` |
 
-## Quick Start
+> **`measure_behavior` is detective-only by default** — it observes tool-usage patterns and records a *signed, provable* drift finding, but does not block. Enforcement (drift → quarantine) is opt-in via `enforce=true` and off by default. Hard governance decisions (PERMITTED/DENIED) are made by the portal/PEP, not the behavioral monitor.
+
+## Quick Start — verify a bundle offline
 
-### Verify an evidence bundle (3 commands)
+A bundle this package emits (via the `generate_evidence_bundle` tool, or `aga-proxy export`) is a **canonical SEP bundle**. Verify it offline, with no network and no dependency on us:
 
 ```bash
-pip install aga-governance
-curl -s https://aga-mcp-gateway.attestedintelligence.workers.dev/bundle -o evidence-bundle.json
-python -m aga verify evidence-bundle.json
+# Reference verifier (zero deps, Node 18+). Pin the gateway key (from get_server_info) to prove provenance.
+node aga-receipt-spec/verify/verify-sep.mjs evidence-bundle.json --pubkey <gateway-public-key>
 ```
 
-### Or verify in your browser
+The published `@attested-intelligence/aga-verify` CLI mirrors this reference (2.0.0 — publish pending; the npm registry currently has the older 1.0.0). Without `--pubkey` you get an **integrity-only** result (`issuerVerified=false`); pin the key to also prove *who* issued it — see `THREAT_BOUNDARY.md` §3.7. A hosted browser verifier is linked under [Links](#links).
 
-Go to [attestedintelligence.com/verify](https://attestedintelligence.com/verify) and click "Run Verification." Zero installs required.
+The reference §6 algorithm is implemented in **three languages** — JavaScript (`aga-receipt-spec/verify/verify-sep.mjs`), Go (`verify.go`, stdlib `crypto/ed25519`), and Python (`verify.py`, pure-stdlib RFC-8032 Ed25519) — and a cross-stack harness (`npm run conformance:cross-stack`) proves all three, plus the in-server engine and `aga-verify`, render **identical verdicts** on the canonical vectors (valid, adversarial, and every small-order forgery).
 
 ## How It Works
 
@@ -77,8 +82,9 @@ AI Agent                  AGA Gateway                    Verifier
    |                    [Export Bundle]                       |
    |                          |--------- evidence.json ----->|
    |                          |                  [Verify Signatures]
-   |                          |                  [Verify Chain]
+   |                          |                  [Verify Chain + Order]
    |                          |                  [Verify Merkle Tree]
+   |                          |                  [Verify Signed Checkpoint]
    |                          |                  [PASS / FAIL]
 ```
 
@@ -87,30 +93,31 @@ AI Agent                  AGA Gateway                    Verifier
 Run AGA as a transparent proxy between any MCP client and any MCP server. Every tool call gets evaluated against policy and produces a signed receipt.
 
 ```bash
-# Start the proxy with an upstream MCP server
-npx tsx src/proxy/index.ts start --upstream "npx -y @modelcontextprotocol/server-filesystem /tmp/test" --profile standard
-
-# Export the evidence bundle
-npx tsx src/proxy/index.ts export --output evidence.json
-
-# Verify
-npx tsx src/proxy/index.ts verify evidence.json
+# Start the proxy (the `aga-proxy` bin) in front of an upstream MCP server.
+# stdio upstream = the hardened default (the upstream is a child process, not network-reachable).
+npx -p @attested-intelligence/aga-mcp-server aga-proxy start \
+  --upstream "npx -y @modelcontextprotocol/server-filesystem /tmp/test" --profile standard
+
+# Export the canonical SEP evidence bundle, then verify it offline
+npx -p @attested-intelligence/aga-mcp-server aga-proxy export --output evidence.json
+npx -p @attested-intelligence/aga-mcp-server aga-proxy verify evidence.json
 ```
 
-The proxy intercepts `tools/call` requests, evaluates them against a sealed policy artifact, and generates signed receipts. Permitted calls are forwarded to the downstream server. Denied calls return an MCP error. Every decision is hash-linked into a tamper-evident chain.
+The proxy intercepts `tools/call` requests, evaluates them against a sealed policy, and generates a signed SEP receipt for **every** decision. Permitted calls are forwarded to the downstream server; denied calls return an MCP error and never reach it. Every decision is hash-linked and checkpoint-bound into a tamper-evident bundle. (Methods other than `tools/call` aren't policy-evaluated, but non-benign ones are recorded as signed *passthrough* receipts for auditability, and an optional denylist can reject them; see `THREAT_BOUNDARY.md` §3.2.)
 
 Three built-in policy profiles:
 - **permissive** - log everything, block nothing (default)
 - **standard** - rate limits + blocks destructive operations
 - **restrictive** - explicit tool allowlist, all unknown tools denied
 
-## Verification (5 steps)
+## Verification _(canonical SEP — 3.0; normative §6 algorithm in `aga-receipt-spec/verify/verify-sep.mjs`)_
 
-1. **Algorithm Check** - Bundle declares Ed25519-SHA256-JCS, fail closed on anything else
-2. **Receipt Signatures** - Ed25519 over RFC 8785 canonical JSON (signature field excluded)
-3. **Chain Integrity** - Each receipt's `previous_receipt_hash` = SHA-256 of the preceding receipt
-4. **Merkle Proofs** - Walk siblings/directions to root, compare against bundle root
-5. **Bundle Consistency** - Proof count = receipt count, leaf hashes match receipt hashes
+1. **Structural floor** - Bundle declares Ed25519-SHA256-JCS, public key well-formed (all small-order encodings + non-canonical `y ≥ p` rejected), `receipts.length > 0`, proof count = receipt count
+2. **Receipt Signatures** - Ed25519 over JCS-profile canonical JSON, sorted-key (signature field excluded)
+3. **Chain + ordering** - Each receipt's `previous_receipt_hash` = leaf of the preceding receipt; non-decreasing timestamps
+4. **Merkle Proofs** - Recompute every leaf from receipt content, walk siblings/directions to one root, leaf indices form the complete `0..N-1` bijection
+5. **Signed checkpoint** - Verify the gateway-signed checkpoint binding `merkle_root`, `leaf_count`, and chain head (this makes the no-prefix construction truncation-safe)
+6. **Provenance** _(when a key is pinned)_ - `public_key == expected key`; otherwise integrity-only is reported
 
 ## Cryptographic Primitives
 
@@ -118,12 +125,12 @@ Three built-in policy profiles:
 |-----------|---------|
 | Ed25519 | Receipt signatures |
 | SHA-256 | Hash chaining, Merkle trees, leaf computation |
-| RFC 8785 (JCS) | Canonical JSON for deterministic signing |
+| JCS-profile (sorted-key canonical JSON) | Deterministic signing (canon is byte-compatible with the reference verifier) |
 | Merkle Trees | Binding all receipts to a single verifiable root |
 
 ## Live Gateway
 
-The demo gateway is deployed on Cloudflare Workers:
+A demo gateway is deployed on Cloudflare Workers (a **separate deployment** that may track its own version; treat it as a convenience mirror, and always verify what it returns offline against a pinned key — not as the canonical artifact):
 
 ```bash
 # Check status
@@ -156,30 +163,35 @@ with AgentSession(gateway_id="my-gateway") as session:
 
 ## Test Suite
 
-355+ automated tests across TypeScript and Python:
+Automated tests across TypeScript and Python, plus a conformance corpus:
 
-- **TypeScript MCP Server:** 218 tests (vitest)
-- **Python SDK:** 137 tests (pytest)
-- **Cross-language test vectors:** 37 vectors across 9 categories
+- **TypeScript MCP server:** 248 tests (vitest) — including provable-denial and behavioral-monitor regressions
+- **SEP conformance corpus:** `npm run test:conformance` (valid → VERIFIED, negatives → FAILED)
+- **Python companion SDK:** pytest suite (`aga-python`)
 
 ```bash
-npm test                              # TypeScript tests
-cd aga-python && python -m pytest     # Python tests
+npm test                              # TypeScript tests (vitest)
+npm run test:conformance              # SEP conformance corpus
+cd aga-python && python -m pytest     # Python companion tests
 ```
 
+## Benchmarks
+
+Performance baseline (signature primitives, storage overhead, the end-to-end measurement cycle, and post-quantum cadence feasibility) is documented in [BENCHMARKS.md](BENCHMARKS.md), matching Section 4.7 of the paper. Receipt-format determinism is reproducible here via the cross-language vectors (`npm test`).
+
 ## Project Structure
 
 ```
-src/                   # Core protocol: artifacts, receipts, chain, Merkle, crypto, portal state machine
-  core/                # Governance primitives (artifact, receipt, chain, portal, bundle)
-  crypto/              # Ed25519, SHA-256, BLAKE2b, Merkle, JCS canonicalization
-  proxy/               # MCP governance proxy (transparent interception + policy enforcement)
-  tools/               # MCP tool handlers (20 tools)
-  middleware/          # Zero-trust governance enforcement wrapper
-aga-python/            # Python SDK with @governed decorator (PyPI: aga-governance)
-independent-verifier/  # Standalone verifier with zero AGA imports
-scenarios/             # Deployment scenarios (SCADA, drone, AI agent)
-tests/                 # TypeScript test suite (218 tests)
+src/
+  sep/                 # Canonical SEP evidence engine — single source of truth (canon, merkle, receipt, checkpoint, bundle, verify)
+  core/                # Governance primitives (portal, artifact, attestation, disclosure, delegation, behavioral) + internal continuity-chain profile
+  crypto/              # Internal continuity-chain crypto: Ed25519 (node:crypto), SHA-256/blake2b, salt
+  proxy/               # MCP governance proxy (transparent interception + policy enforcement; emits SEP bundles)
+  middleware/          # Governance PEP wrapper (records a signed PERMITTED/DENIED receipt per governed call)
+aga-python/            # Python companion SDK (PyPI: aga-governance)
+independent-verifier/  # @attested-intelligence/aga-verify — standalone SEP verifier, zero AGA imports
+scenarios/             # Demo scenarios (SCADA, autonomous vehicle, AI agent) — emit SEP bundles
+tests/                 # TypeScript test suite (248 tests)
 ```
 
 ## Links

package/SECURITY.md

@@ -0,0 +1,59 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in AGA, please report it responsibly.
+
+**Email:** [admin@attestedintelligence.com](mailto:admin@attestedintelligence.com)
+
+**Subject line:** `[SECURITY] AGA Vulnerability Report`
+
+### What to Include
+
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact assessment
+- Suggested fix (if you have one)
+
+### Response Timeline
+
+- **Acknowledgment:** Within 48 hours of receipt
+- **Initial assessment:** Within 5 business days
+- **Resolution target:** Dependent on severity, typically within 30 days for critical issues
+
+### Scope
+
+This policy covers:
+
+- The AGA reference implementation (`src/`, `independent-verifier/`)
+- The MCP server (`@attested-intelligence/aga-mcp-server`)
+- Cryptographic operations (signing, verification, hash computation, chain integrity)
+- Evidence Bundle generation and verification
+
+### Out of Scope
+
+- The attestedintelligence.com website (report separately to the same email)
+- Third-party dependencies (report to the upstream maintainer, but let us know)
+- Social engineering or phishing attacks
+
+### Cryptographic Considerations
+
+AGA relies on Ed25519 signatures, SHA-256 hashing, BLAKE2b-256 fingerprinting, and Merkle tree anchoring. If you identify a weakness in how these primitives are applied (not the primitives themselves), that is a valid report.
+
+Key areas of concern:
+
+- Sealed hash computation correctness
+- Receipt chain integrity (hash linking)
+- Merkle checkpoint verification
+- Key separation enforcement between Portal and agent
+- Evidence Bundle completeness and tamper detection
+
+### Disclosure
+
+We follow coordinated disclosure. Please do not publicly disclose vulnerabilities until we have released a fix or 90 days have elapsed, whichever comes first.
+
+We do not currently operate a bug bounty program.
+
+---
+
+Attested Intelligence Holdings LLC

package/THREAT_BOUNDARY.md

@@ -0,0 +1,77 @@
+# AGA MCP Server — Threat Boundary & Bypass Surface (honest audit)
+
+**Scope:** `@attested-intelligence/aga-mcp-server` 3.0.0-rc. Written for Sprint 3 CP3.
+**Stance:** defensibility through honesty. This documents what the package **does** guarantee, what it **does not**, and the **residual attack surface** that remains by design or is deferred. Per the project discipline: better a precisely-stated boundary than an overclaim.
+
+---
+
+## 1. The core claim (what is proven + tested)
+
+> Every **governed** decision (PERMITTED *and* DENIED) produces a signed, hash-chained, Merkle-included, **checkpoint-bound** SEP receipt that any third party can verify offline (`aga-verify` / `verify-sep.mjs`), with provenance when the gateway key is pinned.
+
+A denial **cannot be silently erased by the agent**:
+
+| Attack | Defense | Test |
+|---|---|---|
+| Tamper a receipt | Ed25519 signature + leaf-recompute fail | `acceptance.test.ts 9.3`, `_validation/sep-gate.mjs` |
+| Drop the DENIED receipt (truncation) | signed checkpoint binds `leaf_count` + head | `_validation/sep-gate.mjs` (SC4) |
+| Reorder to bury it | `previous_receipt_hash` chain + non-decreasing timestamp | `_validation/sep-gate.mjs` (SC5) |
+| Re-attest to wipe history | SEP ledger is **not** reset on `attest_subject` | `tests/integration/provable-denial.test.ts` |
+| Forge under a different key | receipts checked vs **pinned** key; **all** small-order encodings (10 canonical + non-canonical `y≥p`) rejected | `_validation/sep-gate.mjs` (SC6), `tests/sep/reaudit-fixes.test.ts` |
+| Crash the recorder to erase a decision (deeply-nested arg "depth bomb") | `canonicalize` is **depth-bounded**; the governance wrapper + proxy **fail closed** — an uncanonicalizable call is DENIED *and recorded*, never silently dropped or forwarded | `tests/proxy/dos-failclosed.test.ts`, `tests/sep/reaudit-fixes.test.ts` |
+
+Claim scope is **integrity-of-present-receipts, NOT non-omission**: a PASS proves every *present* receipt is authentic and complete-as-a-set under the checkpoint; it does **not** prove the gateway logged every action it took. Completeness is bounded by the tamper-evidence of the interception point, which is outside the bundle.
+
+---
+
+## 2. Governed vs ungoverned tool surface
+
+**Governed (PEP-gated + SEP-recorded; PERMITTED/DENIED on every call):**
+`measure_integrity`, `revoke_artifact`, `request_claim`, `delegate_to_subagent` — the agent-action tools.
+
+**Ungoverned (by design):**
+| Tool | Why ungoverned (safe) |
+|---|---|
+| `get_server_info`, `get_portal_state`, `get_receipts`, `get_chain_events`, `list_claims`, `verify_chain` | read-only; no side effects on the governed subject |
+| `init_chain`, `attest_subject` | **bootstrap** — they *establish* the governance relationship (chicken-and-egg: cannot be gated by a policy that doesn't exist yet). `attest_subject` sets policy, it does not perform an agent action, and re-attestation **cannot erase** the prior SEP ledger (§1). |
+| `generate_evidence_bundle`, `verify_bundle_offline` | **evidence operations** — must work *especially after* TERMINATION/quarantine (you need to export and verify the record once governance is revoked). Not agent actions; not SEP-recorded. (The legacy `create_checkpoint` continuity tool was removed in P4.) |
+| `measure_behavior` | **detective-only** monitor (§CP2); records a provable drift finding, does not block unless `enforce=true`. |
+
+**Maintenance invariant (must hold for the core claim):** any *new* tool that performs an agent **action** with side effects MUST be added to the governed set (i.e., NOT in `UNGOVERNED_TOOLS`), so it produces a PERMITTED/DENIED receipt. Read/bootstrap/evidence tools stay ungoverned. A CI check that flags new non-ungoverned-listed tools is recommended (future).
+
+---
+
+## 3. Residual attack surface (honest, deferred, or deployment-dependent)
+
+1. **Proxy — mandatory mediation is a deployment property.** `GovernanceProxy` governs the path *through it*; if the agent can reach the upstream MCP server **directly** (network), it bypasses governance entirely. `upstreamUrl` (HTTP) is directly reachable. → **Deployment requirement:** the agent must be network-isolated so the proxy is its *only* route to tools. Documented, not code-enforceable here. *(Empirically demonstrated in CP3 A7: `_validation/redteam/a7-proxy-bypass.mjs` — a direct POST to the upstream fired a side effect with no receipt.)* **See `DEPLOYMENT.md` §1: stdio-upstream is the hardened default — the upstream is a non-network-reachable child process, closing this bypass by construction; HTTP-upstream mode now warns on stderr.**
+2. **Proxy — only `method === "tools/call"` is policy-evaluated; partially mitigated in 3.0-rc.** Other JSON-RPC methods are still forwarded (not policy-evaluated), but they are now recorded as **signed passthrough receipts** in the evidence bundle for auditability — so a side-effecting non-`tools/call` method is no longer *invisible* (the CP3 A7 `admin/deleteAllData` would now appear as a `(passthrough)` receipt with `method` set and `reason: forwarded, not policy-evaluated`). Benign protocol methods (`initialize`, `ping`, `tools/list`, `*/list`, `notifications/*`, …) are excluded by default; an optional `denyMethods` denylist rejects known side-effecting methods (a **DENIED** passthrough receipt, not forwarded). **What this closes:** invisibility — every forwarded non-benign method is now in the tamper-evident, checkpoint-bound bundle. **What it does NOT close:** the method is not policy-evaluated and still *executes* unless explicitly denylisted (this is *visibility, not governance*), and a direct-to-upstream call (§3.1) still bypasses the proxy entirely. Full per-method policy evaluation remains future work.
+3. **Proxy — denial is observable.** A DENIED call returns a distinctive `-32600` error, which an adversary can use as a policy-probing oracle. Low severity; structured denial metadata could be tightened later.
+4. **Key persistence — mitigated in 3.0-rc.** The gateway signing key can be **persisted** via `AGA_GATEWAY_KEY` (64-hex seed) or `AGA_GATEWAY_KEY_FILE` (`DEPLOYMENT.md` §2), so `gateway_public_key` is stable and **pinnable across restarts**. The default remains an ephemeral key (warned on stderr). HSM/KMS backing remains future work. A verifier MUST still pin the key it expects.
+5. **Storage durability (Sprint 5).** Default storage is in-memory → the live chain is lost on **process restart**. The cryptographic record survives via the **exported signed bundle**; durable cross-restart retention needs the SQLite/persistent backend (Sprint 5). The raw quarantine forensic buffer is in-memory by design (only the `arguments_hash` commitment is signed — privacy-preserving and sufficient to *prove* a capture).
+6. **Out of scope entirely (not what AGA does).** AGA does not prevent: model jailbreaks, model-weight theft, credential compromise, or infrastructure compromise. It provides *accountability and provenance* for governed decisions, not prevention of those classes. If an attacker holds the gateway signing key, they can author receipts — protect the key (Sprint 4).
+7. **Verifier-UX / unpinned consumers (NEW — CP3 A5).** A consumer that verifies a bundle **without pinning** the gateway key gets an integrity-only `VERIFIED` with `issuerVerified=false` — *even on a forged, attacker-signed, denial-free bundle*. This is correct (integrity-of-present-receipts ≠ provenance, and the result object/CLI say so explicitly), but a UI that shows a bare "VERIFIED" without prominently propagating `issuerVerified=false` could mislead a non-expert. → Downstream consumers (esp. the website demo) MUST pin the gateway key and never present an unpinned PASS as proof of *who* issued the bundle. **Mitigated in 3.0-rc:** the verify result now carries a prominent `summary` — `VERIFIED (provenance verified …)` vs `VERIFIED (integrity only — NOT provenance …)` — surfaced by `verify_bundle_offline` and the reference/`aga-verify` CLIs; key-pinning ergonomics are in `DEPLOYMENT.md` §2. Consumers must still pin.
+8. **Cross-stack verifier conformance (CLOSED — 2026-06-07).** Earlier in the 3.0 hardening only `src/sep/verify.ts` carried the full strict floor; the reference `verify-sep.mjs`, the published `aga-verify`, Go, and Python lagged. **That asymmetry is now closed.** All six verifiers — engine (`src/sep`), reference (`verify-sep.mjs`), `aga-verify`, Go (`verify.go`), and Python (audited library + pure-stdlib) — apply the identical strict floor and return **byte-identical verdicts**. The shared floor: strict field allowlist; `envelope_consistency` (binds the unsigned `gateway_id`/`merkle_root`/`generated_at` to the signed/recomputed values); checkpoint-algorithm binding; lexicographic-string canonicalization with RFC-8785 integral-number normalization; complete small-order/non-canonical-key rejection; **one library-free canonical-timestamp rule** (exact `.sssZ` UTC form via an ASCII regex + integer-arithmetic calendar + lexicographic ordering — no native date parser); merkle-direction-token strictness (`left`/`right` only, length-matched); unpaired-UTF-16-surrogate rejection; depth-bounded never-throw; and whole-document parse (trailing content rejected). Verified by `npm run conformance:cross-stack` — six verifiers agree on every case in the committed corpus (55 cases incl. raw-byte/file-parse), confirmed across multiple rounds of independent blind differential re-audit. See `fixtures/cross-stack/README.md`. **Residual (by design, not a divergence):** the bundle envelope still carries four *unsigned* metadata fields with no signed counterpart — `bundle_id`, `schema_version`, `policy_reference`, `offline_capable`. They are informational and are **not** security-identity fields (the identity fields `gateway_id`/`merkle_root`/`generated_at` ARE bound); a relying party must still trust only signed/verified values and pin the gateway key (§3.7). Of the four, **`policy_reference` is the only identity-grade one** — but the governing policy IS captured and cryptographically verified inside **every signed receipt's own `policy_reference` field** (one of the 15 signed fields), so the unsigned *envelope* `policy_reference` is only a convenience mirror, not the source of truth. Binding the envelope copy is a recommended near-term (3.1) format revision; a coordinated verifier-output flag that marks these four envelope fields as unsigned/not-verified is a recommended enhancement, deliberately deferred here to avoid adding an untested cross-language output surface immediately after the cross-stack-consistency campaign (the verdict surface already attests only the steps it runs, and never claims these fields). One further residual is **unreachable by construction:** SEP signed fields are strings plus the single integer `leaf_count` (the emit guard `assertSignedReceiptFieldsAreStrings` forbids any other number in a signed field), so a verifier's canonicalization of a *non-integer / exponential* number placed in a signed field — which no conformant gateway can emit — is intentionally left unspecified and MAY differ across language stdlibs; it cannot affect any bundle a conformant gateway produces. Reachable string content is fully cross-stack-consistent (an exhaustive 0..0x10FFFF code-point sweep confirms the only ever-divergent characters, `U+2028`/`U+2029`, are normalized identically by every verifier).
+
+---
+
+## 4. CP3 adversarial verification results (2026-06-06)
+
+A focused adversarial workflow ran **7 independent red-team attacks** on the core claim. Each was attempted *concretely* against the real in-process MCP server / proxy and the **pinned** reference verifier (`verify-sep.mjs`) and published-sound `aga-verify@2.0.0`. A1–A5 were fully adjudicated + agreed in the original workflow. **A6 and A7 — whose original adjudication hit a session usage cap — were re-adjudicated first-hand on 2026-06-07 from the source:** **A6 HELD** — `src/middleware/governance.ts` shows `UNGOVERNED_TOOLS` contains only read/bootstrap/evidence/monitor tools (no mutating agent-action), a tool is GOVERNED iff absent from that set, and every GOVERNED call that is blocked emits a signed DENIED receipt via the `deny()` path (including the fail-closed branch for uncanonicalizable arguments); **A7 RESIDUAL** — the only upstream-reach bypasses are exactly the documented §3.1 (direct upstream HTTP, a deployment/network-isolation property) and §3.2 (non-`tools/call` methods, now recorded as signed passthrough receipts); no new bypass was found. Scripts: `_validation/redteam/`.
+
+| # | Attack | Result | Why |
+|---|---|---|---|
+| A1 | Tamper a DENIED receipt (19 mutations) | **HELD** | every mutation FAILED; signature + leaf-recompute + signed checkpoint each reject |
+| A2 | Truncate (drop the DENIED receipt) | **HELD** | signed checkpoint binds `leaf_count`/head → truncated set fails `signed_checkpoint` |
+| A3 | Reorder to bury the denial | **HELD** | `previous_receipt_hash` chain + checkpoint fail |
+| A4 | Re-attest to erase | **HELD** | SEP ledger is not reset on `attest_subject`; the denial is still present in the export |
+| A5 | Key-forge (attacker re-signs a denial-free bundle) | **HELD** | pinned to the real key → FAIL `gateway_key_match` on **both** verifiers; unpinned → integrity-only PASS with `issuerVerified=false` (by design; see §3.7) |
+| A6 | PEP bypass (ungoverned mutating action) | **HELD** | all 16 tools censused; no ungoverned mutating agent-action; even blocked governed calls emit a DENIED receipt; `measure_behavior` enforcement is coupled to a signed receipt |
+| A7 | Proxy bypass | **RESIDUAL** | every governed `tools/call` gets a receipt (PERMITTED+DENIED; DENIED never reaches upstream); the two bypasses are the already-documented §3.1 (direct upstream reach) and §3.2 (non-`tools/call` methods) |
+
+**Verdict: 0 guarantee-broken — 6 HELD, 1 RESIDUAL (out-of-claim, already documented).** The core claim — *denials cannot be silently erased by the agent through tampering, truncation, reordering, or re-attestation, and forgery is caught when the gateway key is pinned* — **holds under the tested adversarial pressure**, on both the reference verifier and the published-sound `aga-verify@2.0.0`.
+
+---
+
+## 5. Net boundary statement (for public copy)
+
+> Every governed decision produces a signed, chained, checkpoint-bound receipt; denials cannot be silently erased by the agent through tampering, truncation, reordering, or re-attestation, and are independently verifiable offline with provenance. The behavioral monitor is detective-only by default. Mandatory mediation (network isolation), cross-session key persistence, and cross-restart durability are deployment/roadmap properties, documented above. AGA proves *what was governed*; it does not claim to prevent jailbreaks, key theft, or non-`tools/call` side channels.

package/dist/core/behavioral.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"behavioral.d.ts","sourceRoot":"","sources":["../../src/core/behavioral.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,2CAA2C;IAC3C,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,mEAAmE;IACnE,mBAAmB,EAAE,MAAM,EAAE,EAAE,CAAC;IAChC,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEvD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,WAAW,CAAwB;IAC3C,OAAO,CAAC,QAAQ,CAAmC;IAEnD,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAI/C,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI;IAQ3D,OAAO,IAAI,qBAAqB;IA0DhC,KAAK,IAAI,IAAI;CAGd"}
+{"version":3,"file":"behavioral.d.ts","sourceRoot":"","sources":["../../src/core/behavioral.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,2CAA2C;IAC3C,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,mEAAmE;IACnE,mBAAmB,EAAE,MAAM,EAAE,EAAE,CAAC;IAChC,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAEvD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,WAAW,CAAwB;IAC3C,OAAO,CAAC,QAAQ,CAAmC;IAEnD,WAAW,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAI/C,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI;IAQ3D,OAAO,IAAI,qBAAqB;IA0DhC,KAAK,IAAI,IAAI;CAGd"}

package/dist/core/behavioral.js

@@ -1,10 +1,18 @@
 /**
- * Behavioral Drift Detection.
+ * Behavioral Drift Detection — DETECTIVE-ONLY.
+ *
  * NIST-2025-0035: "Governance mechanisms must measure behavioral outputs
  * and decision patterns in addition to static artifacts."
  *
- * Tracks tool invocation patterns and compares against a behavioral
- * baseline sealed in the policy artifact.
+ * Tracks tool invocation patterns and compares against a behavioral baseline
+ * sealed in the policy artifact.
+ *
+ * SCOPE (honest): this monitor OBSERVES and REPORTS — by itself it does NOT block,
+ * deny, or prevent any tool call. It produces statistical drift findings. Enforcement
+ * (drift -> portal quarantine) is OPT-IN and lives in the server's `measure_behavior`
+ * handler (`enforce: true`), OFF by default. When drift is detected, the detection event
+ * is recorded as a signed SEP receipt so the finding itself is provable; whether it was
+ * acted upon is stated explicitly in that receipt's `reason`/`decision`.
  */
 import { sha256Str } from '../crypto/hash.js';
 export class BehavioralMonitor {

package/dist/core/behavioral.js.map

@@ -1 +1 @@
-{"version":3,"file":"behavioral.js","sourceRoot":"","sources":["../../src/core/behavioral.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAkC9C,MAAM,OAAO,iBAAiB;IACpB,WAAW,GAAqB,EAAE,CAAC;IACnC,QAAQ,GAA8B,IAAI,CAAC;IAEnD,WAAW,CAAC,QAA4B;QACtC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,gBAAgB,CAAC,QAAgB,EAAE,QAAiB;QAClD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YACpB,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO;gBACL,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE;gBACjD,UAAU,EAAE,EAAE,EAAE,eAAe,EAAE,SAAS,CAAC,aAAa,CAAC;gBACzD,cAAc,EAAE,KAAK;aACtB,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAClD,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAC/C,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,WAAW,CAC5C,CAAC;QAEF,MAAM,UAAU,GAA0B,EAAE,CAAC;QAE7C,2BAA2B;QAC3B,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3D,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,oBAAoB;QACpB,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;gBACzC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7D,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YAC1D,IAAI,mBAAmB,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC;gBACjD,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClE,MAAM,eAAe,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAE3C,OAAO;YACL,YAAY,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;YACjD,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YACvC,WAAW,EAAE,iBAAiB;YAC9B,UAAU;YACV,eAAe;YACf,cAAc,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC;SACtC,CAAC;IACJ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;IACxB,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,QAAkB,EAAE,MAAgB;IAC/D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACrB,EAAE,EAAE,CAAC;YACL,IAAI,EAAE,KAAK,MAAM,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"behavioral.js","sourceRoot":"","sources":["../../src/core/behavioral.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAkC9C,MAAM,OAAO,iBAAiB;IACpB,WAAW,GAAqB,EAAE,CAAC;IACnC,QAAQ,GAA8B,IAAI,CAAC;IAEnD,WAAW,CAAC,QAA4B;QACtC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,gBAAgB,CAAC,QAAgB,EAAE,QAAiB;QAClD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YACpB,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO;gBACL,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE;gBACjD,UAAU,EAAE,EAAE,EAAE,eAAe,EAAE,SAAS,CAAC,aAAa,CAAC;gBACzD,cAAc,EAAE,KAAK;aACtB,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAClD,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAC/C,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,WAAW,CAC5C,CAAC;QAEF,MAAM,UAAU,GAA0B,EAAE,CAAC;QAE7C,2BAA2B;QAC3B,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3D,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,oBAAoB;QACpB,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;gBACzC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC7D,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC;YAC1D,IAAI,mBAAmB,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC;gBACjD,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClE,MAAM,eAAe,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAE3C,OAAO;YACL,YAAY,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;YACjD,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YACvC,WAAW,EAAE,iBAAiB;YAC9B,UAAU;YACV,eAAe;YACf,cAAc,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC;SACtC,CAAC;IACJ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;IACxB,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,QAAkB,EAAE,MAAgB;IAC/D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACrB,EAAE,EAAE,CAAC;YACL,IAAI,EAAE,KAAK,MAAM,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/core/index.d.ts

@@ -6,8 +6,6 @@ export * from './receipt.js';
 export * from './chain.js';
 export * from './portal.js';
 export * from './quarantine.js';
-export * from './checkpoint.js';
-export * from './bundle.js';
 export * from './disclosure.js';
 export * from './behavioral.js';
 export * from './delegation.js';

package/dist/core/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAGhC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC"}

package/dist/core/index.js

@@ -6,8 +6,8 @@ export * from './receipt.js';
 export * from './chain.js';
 export * from './portal.js';
 export * from './quarantine.js';
-export * from './checkpoint.js';
-export * from './bundle.js';
+// Legacy continuity EVIDENCE path removed (P4): './checkpoint.js' and './bundle.js' (the unsound
+// verifier + non-conformant Merkle) are physically deleted. Canonical path = src/sep.
 export * from './disclosure.js';
 export * from './behavioral.js';
 export * from './delegation.js';

package/dist/core/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,iGAAiG;AACjG,sFAAsF;AACtF,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC"}