@iamnotdou/ccp 0.1.0

package/.env.example

@@ -0,0 +1,29 @@
+# Hedera Testnet
+HEDERA_ACCOUNT_ID=0.0.XXXXX
+HEDERA_PRIVATE_KEY=302e...
+HEDERA_NETWORK=testnet
+
+# Hedera JSON-RPC (for EVM calls via viem)
+HEDERA_RPC_URL=https://testnet.hashio.io/api
+HEDERA_CHAIN_ID=296
+
+# HCS Topic ID (created during setup)
+HCS_TOPIC_ID=0.0.XXXXX
+
+# Contract Addresses (deployed during setup)
+REGISTRY_ADDRESS=0x...
+RESERVE_VAULT_ADDRESS=0x...
+SPENDING_LIMIT_ADDRESS=0x...
+AUDITOR_STAKING_ADDRESS=0x...
+FEE_ESCROW_ADDRESS=0x...
+CHALLENGE_MANAGER_ADDRESS=0x...
+USDC_ADDRESS=0x...
+
+# Actor Private Keys (Hedera testnet only)
+OPERATOR_PRIVATE_KEY=0x...
+AUDITOR_PRIVATE_KEY=0x...
+AGENT_PRIVATE_KEY=0x...
+LEDGER_PRIVATE_KEY=0x...
+
+# ENS (on Sepolia)
+ENS_RPC_URL=https://sepolia.infura.io/v3/YOUR_KEY

package/dist/auditor/attest.js

@@ -0,0 +1,141 @@
+import { formatUnits } from "viem";
+import { publicClient, getWalletClient } from "../client.js";
+import { AuditorStakingABI, ReserveVaultABI, SpendingLimitABI } from "../contracts/index.js";
+import { addresses, keys } from "../config.js";
+import { ledgerSignAttestation } from "../ledger/cosigner.js";
+import { publishAttestationSigned } from "../hcs/publisher.js";
+/**
+ * Automated containment audit checks.
+ * In production: auditor reviews these results + manual analysis.
+ * For demo: automated checks against SpendingLimit and ReserveVault.
+ */
+export async function auditContainment(spendingLimitAddress, reserveVaultAddress, expectedBound) {
+    const findings = [];
+    let passed = true;
+    console.log("  [Auditor] Starting containment audit...");
+    // Check 1: SpendingLimit configuration
+    const maxSingle = await publicClient.readContract({
+        address: spendingLimitAddress,
+        abi: SpendingLimitABI,
+        functionName: "maxSingleAction",
+    });
+    const maxPeriodic = await publicClient.readContract({
+        address: spendingLimitAddress,
+        abi: SpendingLimitABI,
+        functionName: "maxPeriodicLoss",
+    });
+    const cosignThreshold = await publicClient.readContract({
+        address: spendingLimitAddress,
+        abi: SpendingLimitABI,
+        functionName: "cosignThreshold",
+    });
+    const ledgerCosigner = await publicClient.readContract({
+        address: spendingLimitAddress,
+        abi: SpendingLimitABI,
+        functionName: "ledgerCosigner",
+    });
+    findings.push(`  SpendingLimit: maxSingle=${formatUnits(maxSingle, 6)} USDC`);
+    findings.push(`  SpendingLimit: maxPeriodic=${formatUnits(maxPeriodic, 6)} USDC`);
+    findings.push(`  SpendingLimit: cosignThreshold=${formatUnits(cosignThreshold, 6)} USDC`);
+    findings.push(`  SpendingLimit: ledgerCosigner=${ledgerCosigner}`);
+    // Verify containment bound matches
+    if (maxPeriodic > expectedBound) {
+        findings.push("  FAIL: maxPeriodicLoss > stated containment bound");
+        passed = false;
+    }
+    // Check 2: Ledger cosigner is set (agent-independent constraint)
+    if (ledgerCosigner === "0x0000000000000000000000000000000000000000") {
+        findings.push("  FAIL: No ledger cosigner configured — not agent-independent");
+        passed = false;
+    }
+    // Check 3: Reserve adequacy
+    const reserveBalance = await publicClient.readContract({
+        address: reserveVaultAddress,
+        abi: ReserveVaultABI,
+        functionName: "getReserveBalance",
+    });
+    const isAdequate = await publicClient.readContract({
+        address: reserveVaultAddress,
+        abi: ReserveVaultABI,
+        functionName: "isAdequate",
+        args: [expectedBound, 30000], // 3x for C2
+    });
+    const isLocked = await publicClient.readContract({
+        address: reserveVaultAddress,
+        abi: ReserveVaultABI,
+        functionName: "isLocked",
+    });
+    findings.push(`  Reserve: balance=${formatUnits(reserveBalance, 6)} USDC`);
+    findings.push(`  Reserve: adequate (3x)=${isAdequate}`);
+    findings.push(`  Reserve: locked=${isLocked}`);
+    if (!isAdequate) {
+        findings.push("  FAIL: Reserve insufficient for C2 (need 3x containment bound)");
+        passed = false;
+    }
+    if (!isLocked) {
+        findings.push("  FAIL: Reserve not locked");
+        passed = false;
+    }
+    const certClass = passed ? "C2" : "UNCLASSIFIED";
+    console.log(`  [Auditor] Audit ${passed ? "PASSED" : "FAILED"} — class: ${certClass}`);
+    findings.forEach((f) => console.log(`    ${f}`));
+    return { passed, findings, certClass };
+}
+/**
+ * Full auditor attestation workflow:
+ * 1. Audit containment (automated checks)
+ * 2. Stake capital
+ * 3. Sign attestation (via Ledger)
+ * 4. Publish HCS event
+ * 5. Return signature to operator
+ */
+export async function attestCertificate(certHash, spendingLimitAddress, reserveVaultAddress, containmentBound, stakeAmount) {
+    // Step 1: Audit
+    const auditResult = await auditContainment(spendingLimitAddress, reserveVaultAddress, containmentBound);
+    if (!auditResult.passed) {
+        throw new Error("Audit failed — cannot attest");
+    }
+    // Step 2: Stake
+    console.log(`  [Auditor] Staking ${formatUnits(stakeAmount, 6)} USDC...`);
+    const auditorWallet = getWalletClient(keys.auditor);
+    // Approve staking contract
+    const erc20Abi = [
+        {
+            name: "approve",
+            type: "function",
+            inputs: [
+                { name: "spender", type: "address" },
+                { name: "amount", type: "uint256" },
+            ],
+            outputs: [{ type: "bool" }],
+            stateMutability: "nonpayable",
+        },
+    ];
+    const approveTx = await auditorWallet.writeContract({
+        address: addresses.usdc,
+        abi: erc20Abi,
+        functionName: "approve",
+        args: [addresses.auditorStaking, stakeAmount],
+    });
+    console.log(`  [Auditor] Approve tx: ${approveTx}`);
+    await publicClient.waitForTransactionReceipt({ hash: approveTx });
+    const stakeTx = await auditorWallet.writeContract({
+        address: addresses.auditorStaking,
+        abi: AuditorStakingABI,
+        functionName: "stake",
+        args: [certHash, stakeAmount],
+    });
+    await publicClient.waitForTransactionReceipt({ hash: stakeTx });
+    console.log(`  [Auditor] Staked ${formatUnits(stakeAmount, 6)} USDC for cert ${certHash.slice(0, 18)}...`);
+    // Step 3: Sign attestation (via Ledger)
+    const signature = await ledgerSignAttestation(certHash);
+    // Step 4: Publish HCS event (non-fatal — demo continues if HCS fails)
+    try {
+        await publishAttestationSigned(certHash, auditorWallet.account.address, auditResult.certClass);
+    }
+    catch (e) {
+        console.log(`  [HCS] Event publish skipped: ${e.message?.slice(0, 60)}`);
+    }
+    return { signature, auditResult };
+}
+//# sourceMappingURL=attest.js.map

package/dist/auditor/attest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest.js","sourceRoot":"","sources":["../../src/auditor/attest.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,WAAW,EAA2B,MAAM,MAAM,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAS/D;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,oBAA6B,EAC7B,mBAA4B,EAC5B,aAAqB;IAErB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,MAAM,GAAG,IAAI,CAAC;IAElB,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IAEzD,uCAAuC;IACvC,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC;QAChD,OAAO,EAAE,oBAAoB;QAC7B,GAAG,EAAE,gBAAgB;QACrB,YAAY,EAAE,iBAAiB;KAChC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC;QAClD,OAAO,EAAE,oBAAoB;QAC7B,GAAG,EAAE,gBAAgB;QACrB,YAAY,EAAE,iBAAiB;KAChC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC;QACtD,OAAO,EAAE,oBAAoB;QAC7B,GAAG,EAAE,gBAAgB;QACrB,YAAY,EAAE,iBAAiB;KAChC,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC;QACrD,OAAO,EAAE,oBAAoB;QAC7B,GAAG,EAAE,gBAAgB;QACrB,YAAY,EAAE,gBAAgB;KAC/B,CAAC,CAAC;IAEH,QAAQ,CAAC,IAAI,CAAC,8BAA8B,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9E,QAAQ,CAAC,IAAI,CAAC,gCAAgC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IAClF,QAAQ,CAAC,IAAI,CAAC,oCAAoC,WAAW,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1F,QAAQ,CAAC,IAAI,CAAC,mCAAmC,cAAc,EAAE,CAAC,CAAC;IAEnE,mCAAmC;IACnC,IAAI,WAAW,GAAG,aAAa,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACpE,MAAM,GAAG,KAAK,CAAC;IACjB,CAAC;IAED,iEAAiE;IACjE,IAAI,cAAc,KAAK,4CAA4C,EAAE,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;QAC/E,MAAM,GAAG,KAAK,CAAC;IACjB,CAAC;IAED,4BAA4B;IAC5B,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC;QACrD,OAAO,EAAE,mBAAmB;QAC5B,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE,mBAAmB;KAClC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC;QACjD,OAAO,EAAE,mBAAmB;QAC5B,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE,YAAY;QAC1B,IAAI,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,YAAY;KAC3C,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC;QAC/C,OAAO,EAAE,mBAAmB;QAC5B,GAAG,EAAE,eAAe;QACpB,YAAY,EAAE,UAAU;KACzB,CAAC,CAAC;IAEH,QAAQ,CAAC,IAAI,CAAC,sBAAsB,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IAC3E,QAAQ,CAAC,IAAI,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;IACxD,QAAQ,CAAC,IAAI,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;IAE/C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;QACjF,MAAM,GAAG,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC5C,MAAM,GAAG,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,aAAa,SAAS,EAAE,CAAC,CAAC;IACvF,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAEjD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAc,EACd,oBAA6B,EAC7B,mBAA4B,EAC5B,gBAAwB,EACxB,WAAmB;IAEnB,gBAAgB;IAChB,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,oBAAoB,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;IAExG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,gBAAgB;IAChB,OAAO,CAAC,GAAG,CAAC,uBAAuB,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IAC1E,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEpD,2BAA2B;IAC3B,MAAM,QAAQ,GAAG;QACf;YACE,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;gBACpC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;aACpC;YACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC3B,eAAe,EAAE,YAAY;SAC9B;KACO,CAAC;IAEX,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC;QAClD,OAAO,EAAE,SAAS,CAAC,IAAI;QACvB,GAAG,EAAE,QAAQ;QACb,YAAY,EAAE,SAAS;QACvB,IAAI,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,WAAW,CAAC;KAC9C,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,2BAA2B,SAAS,EAAE,CAAC,CAAC;IACpD,MAAM,YAAY,CAAC,yBAAyB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAElE,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC;QAChD,OAAO,EAAE,SAAS,CAAC,cAAc;QACjC,GAAG,EAAE,iBAAiB;QACtB,YAAY,EAAE,OAAO;QACrB,IAAI,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;KAC9B,CAAC,CAAC;IACH,MAAM,YAAY,CAAC,yBAAyB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAEhE,OAAO,CAAC,GAAG,CAAC,sBAAsB,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,kBAAkB,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IAE3G,wCAAwC;IACxC,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAExD,sEAAsE;IACtE,IAAI,CAAC;QACH,MAAM,wBAAwB,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACpC,CAAC"}