@kya-os/mcp-i 1.12.0 → 1.12.2

package/dist/runtime/identity.d.ts

@@ -94,6 +94,17 @@ export declare class IdentityManager {
      * Requirements: 4.2, 4.3
      */
     private loadProdIdentity;
+    /**
+     * Derive the real Ed25519 public key from a raw private key seed.
+     *
+     * Ed25519 public keys are a deterministic function of the private key, so
+     * this recovers the actual key rather than approximating one. A previous
+     * version of this method returned a SHA-256 digest of the private key as
+     * a "placeholder public key" — cryptographically meaningless, and wrong
+     * wherever an AgentIdentity's publicKey is later published or used to
+     * build a kid (e.g. migrate-identity.ts, well-known.ts).
+     */
+    private derivePublicKey;
     /**
      * Validate identity configuration
      */

package/dist/runtime/identity.js

@@ -13,6 +13,11 @@ const fs_1 = require("fs");
 const path_1 = require("path");
 const jose_1 = require("jose");
 const crypto_1 = require("crypto");
+// Minimal DER envelopes Node's crypto module needs to recognize a raw
+// 32-byte Ed25519 key as PKCS8 (private) / SPKI (public). Mirrors the same
+// prefixes used for signing/verification in providers/node-providers.ts.
+const ED25519_PKCS8_PREFIX_HEX = "302e020100300506032b657004220420";
+const ED25519_SPKI_HEADER_BYTES = 12;
 /**
  * Error codes for identity management
  */
@@ -232,14 +237,21 @@ class IdentityManager {
             error.code = exports.IDENTITY_ERRORS.ENOIDENTITY;
             throw error;
         }
-        // For production, we expect the private key to be base64-encoded
-        // We'll derive a placeholder public key since we don't need it for signing
-        // In a real implementation, the public key would be derived properly
-        const privateKeyBuffer = Buffer.from(env.AGENT_PRIVATE_KEY, "base64");
-        // Generate a deterministic public key placeholder from the private key
-        const publicKey = (0, crypto_1.createHash)("sha256")
-            .update(privateKeyBuffer)
-            .digest("base64");
+        // For production, the private key is base64-encoded (raw 32-byte seed,
+        // or a 64-byte seed+public-key pair — see derivePublicKey below). Fail
+        // fast with a clear error on malformed input rather than silently
+        // producing an identity with unusable key material.
+        let publicKey;
+        try {
+            publicKey = this.derivePublicKey(env.AGENT_PRIVATE_KEY);
+        }
+        catch (cause) {
+            const error = new Error("AGENT_PRIVATE_KEY is not a valid Ed25519 private key " +
+                "(must be a base64-encoded 32-byte seed, or a 64-byte seed+public-key pair).");
+            error.code = exports.IDENTITY_ERRORS.ENOIDENTITY;
+            error.cause = cause;
+            throw error;
+        }
         return {
             did: env.AGENT_DID,
             kid: env.AGENT_KEY_ID,
@@ -248,6 +260,43 @@ class IdentityManager {
             createdAt: new Date().toISOString(), // We don't have creation time in prod
         };
     }
+    /**
+     * Derive the real Ed25519 public key from a raw private key seed.
+     *
+     * Ed25519 public keys are a deterministic function of the private key, so
+     * this recovers the actual key rather than approximating one. A previous
+     * version of this method returned a SHA-256 digest of the private key as
+     * a "placeholder public key" — cryptographically meaningless, and wrong
+     * wherever an AgentIdentity's publicKey is later published or used to
+     * build a kid (e.g. migrate-identity.ts, well-known.ts).
+     */
+    derivePublicKey(privateKeyBase64) {
+        const privateKeyBuffer = Buffer.from(privateKeyBase64, "base64");
+        // Handle both raw 32-byte and full 64-byte (seed + public key) Ed25519
+        // private keys, matching providers/node-providers.ts's sign().
+        const seed = privateKeyBuffer.length === 64
+            ? privateKeyBuffer.subarray(0, 32)
+            : privateKeyBuffer;
+        // Wrap the raw seed in a minimal PKCS8 DER envelope so Node's crypto
+        // module recognizes it as an Ed25519 private key.
+        const pkcs8 = Buffer.concat([
+            Buffer.from(ED25519_PKCS8_PREFIX_HEX, "hex"),
+            seed,
+        ]);
+        const privateKeyObject = (0, crypto_1.createPrivateKey)({
+            key: pkcs8,
+            format: "der",
+            type: "pkcs8",
+        });
+        const publicKeyDer = (0, crypto_1.createPublicKey)(privateKeyObject).export({
+            format: "der",
+            type: "spki",
+        });
+        // Strip the fixed-length SPKI header to get the raw 32-byte public key.
+        return publicKeyDer
+            .subarray(ED25519_SPKI_HEADER_BYTES)
+            .toString("base64");
+    }
     /**
      * Validate identity configuration
      */

package/dist/runtime/index.d.ts

@@ -18,7 +18,7 @@ export { type AuthHandshakeConfig, type VerifyOrHintsResult, type AgentReputatio
 export { createResumeTokenStore, type ResumeTokenStoreConfig, } from "./resume-token-store";
 export { CloudflareKVResumeTokenStore, type ResumeTokenKVNamespace, } from "./resume-token-store-kv";
 export { ensureOutboundIdentityBridge } from "./outbound-identity-bridge";
-export { type ProofDestination, type ProofBatchQueueConfig, ProofBatchQueue, KTAProofDestination, AgentShieldProofDestination, createProofBatchQueue, } from "./proof-batch-queue";
+export { type ProofDestination, type ProofSubmission, type ProofBatchQueueConfig, ProofBatchQueue, KTAProofDestination, AgentShieldProofDestination, PartialProofSubmissionError, createProofBatchQueue, } from "./proof-batch-queue";
 export { CloudflareKVDelegationVerifier, } from "./delegation-verifier-kv";
 export { AgentShieldAPIDelegationVerifier, } from "./delegation-verifier-agentshield";
 export { MemoryDelegationVerifier, } from "./delegation-verifier-memory";

package/dist/runtime/index.js

@@ -6,8 +6,8 @@
  * canonical audit trails, and well-known endpoints.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.toolProtectionRegistry = exports.AgentShieldToolProtectionSource = exports.FileToolProtectionSource = exports.InlineToolProtectionSource = exports.createToolProtectionResolver = exports.ToolProtectionResolver = exports.MemoryDelegationVerifier = exports.AgentShieldAPIDelegationVerifier = exports.CloudflareKVDelegationVerifier = exports.createProofBatchQueue = exports.AgentShieldProofDestination = exports.KTAProofDestination = exports.ProofBatchQueue = exports.ensureOutboundIdentityBridge = exports.CloudflareKVResumeTokenStore = exports.createResumeTokenStore = exports.MemoryResumeTokenStore = exports.hasSensitiveScopes = exports.verifyOrHints = exports.extractScopes = exports.validateDelegation = exports.checkScopes = exports.createDelegationVerifier = exports.formatVerifyLink = exports.DemoConsole = exports.createDemoManager = exports.DemoManager = exports.createDebugEndpoint = exports.DebugManager = exports.extractDIDFromPath = exports.validateAgentDocument = exports.validateDIDDocument = exports.createWellKnownHandler = exports.WellKnownManager = exports.extractCanonicalData = exports.createProofResponse = exports.ProofGenerator = exports.validateHandshakeFormat = exports.createHandshakeRequest = exports.defaultSessionManager = exports.SessionManager = exports.IDENTITY_ERRORS = exports.ensureIdentity = exports.defaultIdentityManager = exports.IdentityManager = exports.RUNTIME_ERRORS = exports.RuntimeFactory = exports.createMCPIRuntime = exports.MCPIRuntime = exports.MCPINodeRuntimeWrapper = void 0;
-exports.getToolProtection = exports.isToolProtected = void 0;
+exports.AgentShieldToolProtectionSource = exports.FileToolProtectionSource = exports.InlineToolProtectionSource = exports.createToolProtectionResolver = exports.ToolProtectionResolver = exports.MemoryDelegationVerifier = exports.AgentShieldAPIDelegationVerifier = exports.CloudflareKVDelegationVerifier = exports.createProofBatchQueue = exports.PartialProofSubmissionError = exports.AgentShieldProofDestination = exports.KTAProofDestination = exports.ProofBatchQueue = exports.ensureOutboundIdentityBridge = exports.CloudflareKVResumeTokenStore = exports.createResumeTokenStore = exports.MemoryResumeTokenStore = exports.hasSensitiveScopes = exports.verifyOrHints = exports.extractScopes = exports.validateDelegation = exports.checkScopes = exports.createDelegationVerifier = exports.formatVerifyLink = exports.DemoConsole = exports.createDemoManager = exports.DemoManager = exports.createDebugEndpoint = exports.DebugManager = exports.extractDIDFromPath = exports.validateAgentDocument = exports.validateDIDDocument = exports.createWellKnownHandler = exports.WellKnownManager = exports.extractCanonicalData = exports.createProofResponse = exports.ProofGenerator = exports.validateHandshakeFormat = exports.createHandshakeRequest = exports.defaultSessionManager = exports.SessionManager = exports.IDENTITY_ERRORS = exports.ensureIdentity = exports.defaultIdentityManager = exports.IdentityManager = exports.RUNTIME_ERRORS = exports.RuntimeFactory = exports.createMCPIRuntime = exports.MCPIRuntime = exports.MCPINodeRuntimeWrapper = void 0;
+exports.getToolProtection = exports.isToolProtected = exports.toolProtectionRegistry = void 0;
 // Main runtime - Node.js implementation with providers
 var mcpi_runtime_wrapper_1 = require("./mcpi-runtime-wrapper");
 Object.defineProperty(exports, "MCPINodeRuntimeWrapper", { enumerable: true, get: function () { return mcpi_runtime_wrapper_1.MCPINodeRuntimeWrapper; } });
@@ -75,6 +75,7 @@ var proof_batch_queue_1 = require("./proof-batch-queue");
 Object.defineProperty(exports, "ProofBatchQueue", { enumerable: true, get: function () { return proof_batch_queue_1.ProofBatchQueue; } });
 Object.defineProperty(exports, "KTAProofDestination", { enumerable: true, get: function () { return proof_batch_queue_1.KTAProofDestination; } });
 Object.defineProperty(exports, "AgentShieldProofDestination", { enumerable: true, get: function () { return proof_batch_queue_1.AgentShieldProofDestination; } });
+Object.defineProperty(exports, "PartialProofSubmissionError", { enumerable: true, get: function () { return proof_batch_queue_1.PartialProofSubmissionError; } });
 Object.defineProperty(exports, "createProofBatchQueue", { enumerable: true, get: function () { return proof_batch_queue_1.createProofBatchQueue; } });
 var delegation_verifier_kv_1 = require("./delegation-verifier-kv");
 Object.defineProperty(exports, "CloudflareKVDelegationVerifier", { enumerable: true, get: function () { return delegation_verifier_kv_1.CloudflareKVDelegationVerifier; } });

package/dist/runtime/proof-batch-queue.d.ts

@@ -17,24 +17,61 @@
  * Related: PHASE_1_XMCP_I_SERVER.md Epic 3 (Proof Batching)
  */
 import type { DetachedProof } from "@kya-os/mcp/types" with { "resolution-mode": "import" };
+/**
+ * A proof plus the tool-call context KTA's submission API requires
+ * alongside it. DetachedProof (proof.meta) carries did/kid/ts/nonce/
+ * audience/etc, but not which tool was called or how it turned out —
+ * that context only exists at the call site, so it has to be threaded
+ * through explicitly rather than derived from the proof.
+ */
+export interface ProofSubmission {
+    proof: DetachedProof;
+    toolName: string;
+    outcome: "success" | "failure" | "denied";
+}
 /**
  * Proof submission destination
  */
 export interface ProofDestination {
     /** Destination name (for logging) */
     name: string;
-    /** Submit batch of proofs */
-    submit(proofs: DetachedProof[]): Promise<void>;
+    /** Submit a batch of proof submissions */
+    submit(submissions: ProofSubmission[]): Promise<void>;
+}
+/**
+ * Thrown by a ProofDestination whose submit() made independent per-item
+ * requests (rather than one atomic request for the whole array) when only
+ * some of them failed. Callers that retry on failure MUST retry only
+ * `failed`, not the original full array — retrying everything would
+ * resubmit proofs the destination already accepted.
+ */
+export declare class PartialProofSubmissionError extends Error {
+    readonly failed: ProofSubmission[];
+    readonly succeededCount: number;
+    /** The per-item rejection reason for each entry in `failed`, same order. */
+    readonly causes?: unknown[] | undefined;
+    constructor(message: string, failed: ProofSubmission[], succeededCount: number, 
+    /** The per-item rejection reason for each entry in `failed`, same order. */
+    causes?: unknown[] | undefined);
 }
 /**
  * KTA proof submission destination
+ *
+ * The live KTA API (POST /api/v1/proofs) accepts exactly one proof per
+ * request — there is no /batch endpoint — so a "batch" here means firing
+ * one request per submission, not one request for the whole array. Since
+ * each request is independent, submit() reports PARTIAL failure via
+ * PartialProofSubmissionError rather than treating the whole array as
+ * atomic — a caller that blindly retried everything on any rejection
+ * would resubmit proofs that already succeeded.
  */
 export declare class KTAProofDestination implements ProofDestination {
     name: string;
     private apiUrl;
     private apiKey?;
     constructor(apiUrl: string, apiKey?: string);
-    submit(proofs: DetachedProof[]): Promise<void>;
+    submit(submissions: ProofSubmission[]): Promise<void>;
+    private submitOne;
 }
 /**
  * AgentShield proof submission destination
@@ -47,7 +84,7 @@ export declare class AgentShieldProofDestination implements ProofDestination {
     private apiUrl;
     private apiKey;
     constructor(apiUrl: string, apiKey: string);
-    submit(proofs: DetachedProof[]): Promise<void>;
+    submit(submissions: ProofSubmission[]): Promise<void>;
 }
 /**
  * Proof batch queue configuration
@@ -79,9 +116,26 @@ export declare class ProofBatchQueue {
     private stats;
     constructor(config: ProofBatchQueueConfig);
     /**
-     * Add proof to queue
+     * Add a proof submission to the queue.
+     *
+     * Accepts a bare DetachedProof for backward compatibility with the
+     * pre-#650 API: a plain-JS (or un-upgraded TS) consumer built against
+     * the old `enqueue(proof: DetachedProof)` signature would otherwise have
+     * `toolName`/`outcome` silently come through as `undefined`.
+     */
+    enqueue(item: ProofSubmission | DetachedProof): void;
+    /**
+     * Normalize a bare DetachedProof (the pre-#650 enqueue() shape) into a
+     * ProofSubmission. Derives toolName/outcome from the proof's own signed
+     * meta when present, rather than a hardcoded literal -- a destination's
+     * server-side check compares the submitted toolName/outcome against what
+     * was actually signed into the JWS payload, so a literal that disagrees
+     * with the real signed value is guaranteed to fail verification. When the
+     * proof was never signed with these fields at all (a genuinely pre-#651
+     * proof), no fallback can make the submission succeed, so this warns
+     * rather than silently queueing a doomed submission.
      */
-    enqueue(proof: DetachedProof): void;
+    private submissionFromBareProof;
     /**
      * Flush queue immediately (submit all queued proofs)
      */

package/dist/runtime/proof-batch-queue.js

@@ -18,10 +18,40 @@
  * Related: PHASE_1_XMCP_I_SERVER.md Epic 3 (Proof Batching)
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ProofBatchQueue = exports.AgentShieldProofDestination = exports.KTAProofDestination = void 0;
+exports.ProofBatchQueue = exports.AgentShieldProofDestination = exports.KTAProofDestination = exports.PartialProofSubmissionError = void 0;
 exports.createProofBatchQueue = createProofBatchQueue;
+/**
+ * Thrown by a ProofDestination whose submit() made independent per-item
+ * requests (rather than one atomic request for the whole array) when only
+ * some of them failed. Callers that retry on failure MUST retry only
+ * `failed`, not the original full array — retrying everything would
+ * resubmit proofs the destination already accepted.
+ */
+class PartialProofSubmissionError extends Error {
+    failed;
+    succeededCount;
+    causes;
+    constructor(message, failed, succeededCount, 
+    /** The per-item rejection reason for each entry in `failed`, same order. */
+    causes) {
+        super(message);
+        this.failed = failed;
+        this.succeededCount = succeededCount;
+        this.causes = causes;
+        this.name = "PartialProofSubmissionError";
+    }
+}
+exports.PartialProofSubmissionError = PartialProofSubmissionError;
 /**
  * KTA proof submission destination
+ *
+ * The live KTA API (POST /api/v1/proofs) accepts exactly one proof per
+ * request — there is no /batch endpoint — so a "batch" here means firing
+ * one request per submission, not one request for the whole array. Since
+ * each request is independent, submit() reports PARTIAL failure via
+ * PartialProofSubmissionError rather than treating the whole array as
+ * atomic — a caller that blindly retried everything on any rejection
+ * would resubmit proofs that already succeeded.
  */
 class KTAProofDestination {
     name = "KTA";
@@ -31,20 +61,61 @@ class KTAProofDestination {
         this.apiUrl = apiUrl.replace(/\/$/, "");
         this.apiKey = apiKey;
     }
-    async submit(proofs) {
+    async submit(submissions) {
+        const results = await Promise.allSettled(submissions.map((submission) => this.submitOne(submission)));
+        const failures = results
+            .map((result, index) => ({ result, submission: submissions[index] }))
+            .filter((entry) => entry.result.status === "rejected");
+        if (failures.length > 0) {
+            const causes = failures.map((entry) => entry.result.reason);
+            const reasons = causes
+                .map((reason) => reason instanceof Error ? reason.message : String(reason))
+                .join("; ");
+            throw new PartialProofSubmissionError(`KTA proof submission failed for ${failures.length}/${submissions.length} proof(s): ${reasons}`, failures.map((entry) => entry.submission), submissions.length - failures.length, causes);
+        }
+    }
+    async submitOne(submission) {
+        const { proof, toolName, outcome } = submission;
         const headers = {
             "Content-Type": "application/json",
         };
         if (this.apiKey) {
-            headers["X-API-Key"] = this.apiKey;
+            headers["Authorization"] = `Bearer ${this.apiKey}`;
         }
-        const response = await fetch(`${this.apiUrl}/api/v1/proofs/batch`, {
+        const response = await fetch(`${this.apiUrl}/api/v1/proofs`, {
             method: "POST",
             headers,
-            body: JSON.stringify({ proofs }),
+            body: JSON.stringify({
+                proof,
+                toolName,
+                outcome,
+                // The live API wants these as top-level fields; both are already
+                // present on the proof itself (ts is Unix-epoch seconds, audience
+                // is documented server-side as the business DID), so derive them
+                // rather than requiring the caller to pass duplicates.
+                timestamp: proof.meta.ts,
+                businessDid: proof.meta.audience,
+            }),
         });
         if (!response.ok) {
-            throw new Error(`KTA proof submission failed: ${response.status} ${response.statusText}`);
+            // The server overloads 409 for two distinct conditions: a duplicate
+            // proofJws (code CONFLICT) means this exact proof is already stored --
+            // almost always a client-side timeout after the server accepted a
+            // prior attempt, and is idempotent success. A replayed nonce (code
+            // NONCE_REUSED) is also a 409 but means the server REFUSED the proof;
+            // treating it as success would silently drop a real replay-protection
+            // signal. Distinguish via the response body's machine-readable code
+            // rather than assuming every 409 means "already stored".
+            let code;
+            if (response.status === 409) {
+                const body = await response.json().catch(() => ({}));
+                code = body.code;
+                if (code === "CONFLICT") {
+                    return;
+                }
+            }
+            throw new Error(`KTA proof submission failed: ${response.status} ${response.statusText}` +
+                (code ? ` (${code})` : ""));
         }
     }
 }
@@ -63,10 +134,11 @@ class AgentShieldProofDestination {
         this.apiUrl = apiUrl.replace(/\/$/, "");
         this.apiKey = apiKey;
     }
-    async submit(proofs) {
-        if (proofs.length === 0) {
+    async submit(submissions) {
+        if (submissions.length === 0) {
             return;
         }
+        const proofs = submissions.map((submission) => submission.proof);
         // Extract session_id from first proof for AgentShield session grouping
         // AgentShield uses this for analytics and detection monitoring
         const sessionId = proofs[0]?.meta?.sessionId || "unknown";
@@ -127,14 +199,20 @@ class ProofBatchQueue {
         this.startRetryTimer();
     }
     /**
-     * Add proof to queue
+     * Add a proof submission to the queue.
+     *
+     * Accepts a bare DetachedProof for backward compatibility with the
+     * pre-#650 API: a plain-JS (or un-upgraded TS) consumer built against
+     * the old `enqueue(proof: DetachedProof)` signature would otherwise have
+     * `toolName`/`outcome` silently come through as `undefined`.
      */
-    enqueue(proof) {
+    enqueue(item) {
+        const submission = "proof" in item ? item : this.submissionFromBareProof(item);
         if (this.closed) {
             console.warn("[ProofBatchQueue] Queue is closed, dropping proof");
             return;
         }
-        this.queue.push(proof);
+        this.queue.push(submission);
         this.stats.queued++;
         if (this.config.debug) {
             console.error(`[ProofBatchQueue] Enqueued proof (queue size: ${this.queue.length})`);
@@ -144,6 +222,48 @@ class ProofBatchQueue {
             this.flush();
         }
     }
+    /**
+     * Normalize a bare DetachedProof (the pre-#650 enqueue() shape) into a
+     * ProofSubmission. Derives toolName/outcome from the proof's own signed
+     * meta when present, rather than a hardcoded literal -- a destination's
+     * server-side check compares the submitted toolName/outcome against what
+     * was actually signed into the JWS payload, so a literal that disagrees
+     * with the real signed value is guaranteed to fail verification. When the
+     * proof was never signed with these fields at all (a genuinely pre-#651
+     * proof), no fallback can make the submission succeed, so this warns
+     * rather than silently queueing a doomed submission.
+     */
+    submissionFromBareProof(proof) {
+        // The published @kya-os/mcp package's DetachedProof/ProofMeta types
+        // predate the toolName/submissionOutcome fields added to
+        // @kya-os/contracts/proof's ProofMeta (#651) -- read them structurally
+        // with a runtime guard rather than waiting on that package to catch up.
+        const meta = proof.meta;
+        const toolName = meta !== null &&
+            typeof meta === "object" &&
+            "toolName" in meta &&
+            typeof meta.toolName === "string"
+            ? meta.toolName
+            : undefined;
+        const submissionOutcome = meta !== null &&
+            typeof meta === "object" &&
+            "submissionOutcome" in meta &&
+            (meta.submissionOutcome === "success" ||
+                meta.submissionOutcome === "failure" ||
+                meta.submissionOutcome === "denied")
+            ? meta.submissionOutcome
+            : undefined;
+        if (toolName === undefined || submissionOutcome === undefined) {
+            console.warn("[ProofBatchQueue] Enqueued a DetachedProof with no signed toolName/submissionOutcome -- " +
+                "the destination's server-side JWS payload check will reject this submission. " +
+                "Generate the proof with { toolName, submissionOutcome } options instead.");
+        }
+        return {
+            proof,
+            toolName: toolName ?? "unknown",
+            outcome: submissionOutcome ?? "success",
+        };
+    }
     /**
      * Flush queue immediately (submit all queued proofs)
      */
@@ -151,14 +271,14 @@ class ProofBatchQueue {
         if (this.queue.length === 0) {
             return;
         }
-        const proofs = this.queue.splice(0, this.config.maxBatchSize);
+        const submissions = this.queue.splice(0, this.config.maxBatchSize);
         if (this.config.debug) {
-            console.error(`[ProofBatchQueue] Flushing ${proofs.length} proofs to ${this.config.destinations.length} destinations`);
+            console.error(`[ProofBatchQueue] Flushing ${submissions.length} proofs to ${this.config.destinations.length} destinations`);
         }
         // Submit to each destination (fire-and-forget)
         for (const destination of this.config.destinations) {
             const batch = {
-                proofs,
+                submissions,
                 destination,
                 retryCount: 0,
             };
@@ -170,29 +290,42 @@ class ProofBatchQueue {
      */
     async submitBatch(batch) {
         try {
-            await batch.destination.submit(batch.proofs);
-            this.stats.submitted += batch.proofs.length;
+            await batch.destination.submit(batch.submissions);
+            this.stats.submitted += batch.submissions.length;
             this.stats.batchesSubmitted++;
             if (this.config.debug) {
-                console.error(`[ProofBatchQueue] Successfully submitted ${batch.proofs.length} proofs to ${batch.destination.name}`);
+                console.error(`[ProofBatchQueue] Successfully submitted ${batch.submissions.length} proofs to ${batch.destination.name}`);
             }
         }
         catch (error) {
             console.error(`[ProofBatchQueue] Failed to submit to ${batch.destination.name}:`, error);
+            // A destination that makes independent per-item requests (KTA) can
+            // fail partially. Only retry the submissions that actually failed —
+            // retrying the whole batch would resubmit ones already accepted,
+            // and would let one permanently-failing proof block good ones from
+            // ever being marked submitted.
+            const isPartialFailure = error instanceof PartialProofSubmissionError;
+            const submissionsToRetry = isPartialFailure
+                ? error.failed
+                : batch.submissions;
+            if (isPartialFailure && error.succeededCount > 0) {
+                this.stats.submitted += error.succeededCount;
+            }
             // Retry with exponential backoff
             if (batch.retryCount < this.config.maxRetries) {
                 batch.retryCount++;
                 const backoffMs = Math.min(1000 * Math.pow(2, batch.retryCount - 1), 16000);
                 batch.nextRetryAt = Date.now() + backoffMs;
+                batch.submissions = submissionsToRetry;
                 this.pendingBatches.push(batch);
                 if (this.config.debug) {
-                    console.error(`[ProofBatchQueue] Scheduling retry ${batch.retryCount}/${this.config.maxRetries} in ${backoffMs}ms`);
+                    console.error(`[ProofBatchQueue] Scheduling retry ${batch.retryCount}/${this.config.maxRetries} in ${backoffMs}ms for ${batch.submissions.length} proof(s)`);
                 }
             }
             else {
-                // Max retries exceeded, drop batch
-                this.stats.failed += batch.proofs.length;
-                console.error(`[ProofBatchQueue] Max retries exceeded for ${batch.destination.name}, dropping ${batch.proofs.length} proofs`);
+                // Max retries exceeded, drop the still-failing submissions
+                this.stats.failed += submissionsToRetry.length;
+                console.error(`[ProofBatchQueue] Max retries exceeded for ${batch.destination.name}, dropping ${submissionsToRetry.length} proofs`);
             }
         }
     }