@mcpose/audit 2.0.2 → 3.0.0

package/src/__tests__/middleware.test.ts

@@ -0,0 +1,1121 @@
+import { describe, it, expect, vi } from 'vitest';
+import { createHash, createHmac, createDecipheriv } from 'node:crypto';
+import { createAuditMiddleware } from '../middleware.js';
+import { createDefaultSigningKeyProvider } from '../signingKey.js';
+import { createSensitivityResolver } from '../sensitivity.js';
+import { createInMemorySubjectKeyStore } from '../subjectKeyStore.js';
+import { sha256hex, stableStringify } from '../chain.js';
+import { verifyAuditChain, verifyManifestSignature } from '../verify.js';
+import type { AuditEvent, AuditOptions, ReplayManifest } from '../types.js';
+import type { Identity } from 'mcpose';
+import { createProxyContext } from 'mcpose';
+
+const identity: Identity = {
+  sub: 'user-1',
+  type: 'human',
+  roles: ['analyst'],
+  claims: {},
+  resolvedAt: '2026-06-01T00:00:00.000Z',
+  source: 'jwt',
+};
+
+function makeOptions(overrides: Partial<AuditOptions> = {}): AuditOptions {
+  return {
+    signingKey: createDefaultSigningKeyProvider('test-secret'),
+    sensitivityResolver: createSensitivityResolver({
+      search: 'low',
+      transfer: 'high',
+    }),
+    onEvent: vi.fn(),
+    ...overrides,
+  };
+}
+
+// Every context carries a proxy identity: it is a required covered field, and
+// the middleware rejects a context without one at the pre-call stage (ADR-0019).
+const defaultProxy = { name: 'test-proxy', version: '0.0.0' };
+
+function makeCtx(sessionId?: string) {
+  return createProxyContext({
+    transport: 'http',
+    identity,
+    sessionId,
+    proxy: defaultProxy,
+  });
+}
+
+function makeReq(tool: string, args: Record<string, unknown> = {}) {
+  return {
+    method: 'tools/call' as const,
+    params: { name: tool, arguments: args },
+  };
+}
+
+describe('createAuditMiddleware — tracer bullet', () => {
+  it('calls onEvent after a successful tool call', async () => {
+    const onEvent = vi.fn<AuditOptions['onEvent']>();
+    const { middleware } = createAuditMiddleware(makeOptions({ onEvent }));
+    const ctx = makeCtx('session-1');
+
+    await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
+
+    expect(onEvent).toHaveBeenCalledOnce();
+    const event: AuditEvent = onEvent.mock.calls[0]![0];
+    expect(event.tool).toBe('search');
+    expect(event.outcome).toBe('success');
+    expect(event.identity.sub).toBe('user-1');
+    expect(event.sessionId).toBe('session-1');
+    expect(event.sensitivityTier).toBe('low');
+  });
+
+  it('records error outcome when next throws', async () => {
+    const onEvent = vi.fn<AuditOptions['onEvent']>();
+    const { middleware } = createAuditMiddleware(makeOptions({ onEvent }));
+
+    await expect(
+      middleware(
+        makeReq('search'),
+        async () => {
+          throw new Error('upstream down');
+        },
+        makeCtx(),
+      ),
+    ).rejects.toThrow('upstream down');
+
+    const event: AuditEvent = onEvent.mock.calls[0]![0];
+    expect(event.outcome).toBe('error');
+  });
+
+  it('sets replayManifestPosition sequentially within a session', async () => {
+    const events: AuditEvent[] = [];
+    const { middleware } = createAuditMiddleware(
+      makeOptions({
+        onEvent: (e) => {
+          events.push(e);
+        },
+      }),
+    );
+    const ctx = makeCtx('sess-seq');
+
+    await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
+    await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
+    await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
+
+    expect(events.map((e) => e.replayManifestPosition)).toEqual([0, 1, 2]);
+  });
+});
+
+describe('createAuditMiddleware — HMAC chain', () => {
+  it('first event chainHash is non-empty', async () => {
+    const events: AuditEvent[] = [];
+    const { middleware } = createAuditMiddleware(
+      makeOptions({
+        onEvent: (e) => {
+          events.push(e);
+        },
+      }),
+    );
+    await middleware(
+      makeReq('search'),
+      async () => ({ content: [] }),
+      makeCtx('s1'),
+    );
+    expect(events[0]!.chainHash).toBeTruthy();
+    expect(events[0]!.chainHash.length).toBeGreaterThan(0);
+  });
+
+  it('each chainHash differs from the previous (chain advances)', async () => {
+    const events: AuditEvent[] = [];
+    const { middleware } = createAuditMiddleware(
+      makeOptions({
+        onEvent: (e) => {
+          events.push(e);
+        },
+      }),
+    );
+    const ctx = makeCtx('s2');
+    for (let i = 0; i < 5; i++) {
+      await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
+    }
+    const hashes = events.map((e) => e.chainHash);
+    const unique = new Set(hashes);
+    expect(unique.size).toBe(5);
+  });
+});
+
+describe('createAuditMiddleware — sensitivity tiers', () => {
+  it('low-tier event has inputRaw and outputRaw', async () => {
+    const events: AuditEvent[] = [];
+    const { middleware } = createAuditMiddleware(
+      makeOptions({
+        onEvent: (e) => {
+          events.push(e);
+        },
+      }),
+    );
+    await middleware(
+      makeReq('search', { q: 'hello' }),
+      async () => ({ content: [{ type: 'text', text: 'result' }] }),
+      makeCtx(),
+    );
+    const event = events[0]!;
+    expect(event.sensitivityTier).toBe('low');
+    if (event.sensitivityTier === 'low') {
+      expect(event.inputRaw).toEqual({ q: 'hello' });
+    }
+  });
+
+  it('high-tier event has encrypted fields, no inputRaw/outputRaw', async () => {
+    const events: AuditEvent[] = [];
+    const { middleware } = createAuditMiddleware(
+      makeOptions({
+        onEvent: (e) => {
+          events.push(e);
+        },
+      }),
+    );
+    await middleware(
+      makeReq('transfer', { amount: 1000 }),
+      async () => ({ content: [] }),
+      makeCtx(),
+    );
+    const event = events[0]!;
+    expect(event.sensitivityTier).toBe('high');
+    if (event.sensitivityTier === 'high') {
+      expect(typeof event.inputEncrypted).toBe('string');
+      expect(typeof event.outputEncrypted).toBe('string');
+      expect('inputRaw' in event).toBe(false);
+    }
+  });
+});
+
+describe('createAuditMiddleware — closeSession', () => {
+  it('returns undefined for unknown session', async () => {
+    const { closeSession } = createAuditMiddleware(makeOptions());
+    const result = await closeSession('no-such-session');
+    expect(result).toBeUndefined();
+  });
+
+  it('returns undefined for session with no events', async () => {
+    const { closeSession } = createAuditMiddleware(makeOptions());
+    const result = await closeSession('empty-session');
+    expect(result).toBeUndefined();
+  });
+
+  it('returns ReplayManifest with correct fields after events', async () => {
+    const onManifest = vi.fn();
+    const { middleware, closeSession } = createAuditMiddleware(
+      makeOptions({ onManifest }),
+    );
+    const ctx = makeCtx('sess-manifest');
+    await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
+    await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
+
+    const manifest = await closeSession('sess-manifest');
+
+    expect(manifest).toBeDefined();
+    expect(manifest!.sessionId).toBe('sess-manifest');
+    expect(manifest!.eventCount).toBe(2);
+    expect(manifest!.merkleRoot).toBeTruthy();
+    expect(manifest!.merkleProofs).toHaveLength(2);
+    expect(manifest!.signature).toBeTruthy();
+    expect(manifest!.signedBy).toBeTruthy();
+    expect(onManifest).toHaveBeenCalledOnce();
+    expect(onManifest.mock.calls[0]![0]).toEqual(manifest);
+  });
+});
+
+describe('createAuditMiddleware — Merkle proof', () => {
+  it('proof for each event verifies against the merkle root', async () => {
+    const { verifyMerkleProof } = await import('../chain.js');
+    const events: AuditEvent[] = [];
+    const { middleware, closeSession } = createAuditMiddleware(
+      makeOptions({
+        onEvent: (e) => {
+          events.push(e);
+        },
+      }),
+    );
+    const ctx = makeCtx('sess-merkle');
+    for (let i = 0; i < 4; i++) {
+      await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
+    }
+    const manifest = await closeSession('sess-merkle');
+    expect(manifest).toBeDefined();
+
+    for (let i = 0; i < events.length; i++) {
+      const valid = verifyMerkleProof(
+        events[i]!.chainHash,
+        manifest!.merkleProofs[i]!,
+        manifest!.merkleRoot,
+      );
+      expect(valid).toBe(true);
+    }
+  });
+});
+
+function aesGcmDecrypt(b64: string, key: Buffer, aad: string): string {
+  const buf = Buffer.from(b64, 'base64');
+  const iv = buf.subarray(0, 12);
+  const tag = buf.subarray(12, 28);
+  const ciphertext = buf.subarray(28);
+  const decipher = createDecipheriv('aes-256-gcm', key.subarray(0, 32), iv);
+  decipher.setAAD(Buffer.from(aad));
+  decipher.setAuthTag(tag);
+  return Buffer.concat([
+    decipher.update(ciphertext),
+    decipher.final(),
+  ]).toString('utf8');
+}
+
+/** Reproduces the documented v2 event-key derivation (see ADR-0004). */
+function deriveEventKey(
+  encRoot: Buffer,
+  sessionId: string | undefined,
+  position: number,
+  eventId: string,
+): Buffer {
+  return createHmac('sha256', encRoot)
+    .update(`mcpose/v2/eventkey\0${sessionId ?? ''}\0${position}\0${eventId}`)
+    .digest();
+}
+
+describe('createAuditMiddleware — proxy identity (ADR-0012)', () => {
+  const proxy = { name: 'payments-proxy', version: '1.2.3' };
+
+  function makeProxyCtx(sessionId?: string) {
+    return createProxyContext({
+      transport: 'http',
+      identity,
+      sessionId,
+      proxy,
+    });
+  }
+
+  it('stamps ctx.proxy onto every event and the session manifest', async () => {
+    const events: AuditEvent[] = [];
+    const { middleware, closeSession } = createAuditMiddleware(
+      makeOptions({
+        onEvent: (e) => {
+          events.push(e);
+        },
+      }),
+    );
+    const ctx = makeProxyCtx('sess-proxy');
+    await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
+    await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
+
+    const manifest = await closeSession('sess-proxy');
+
+    expect(events.map((e) => e.proxy)).toEqual([proxy, proxy]);
+    expect(manifest!.proxy).toEqual(proxy);
+  });
+
+  it('keeps the first proxy identity seen when later contexts differ', async () => {
+    const { middleware, closeSession } = createAuditMiddleware(makeOptions());
+    const other = { name: 'other-proxy', version: '0.0.1' };
+    await middleware(
+      makeReq('search'),
+      async () => ({ content: [] }),
+      makeProxyCtx('sess-first-wins'),
+    );
+    await middleware(
+      makeReq('search'),
+      async () => ({ content: [] }),
+      createProxyContext({
+        transport: 'http',
+        identity,
+        sessionId: 'sess-first-wins',
+        proxy: other,
+      }),
+    );
+
+    const manifest = await closeSession('sess-first-wins');
+
+    expect(manifest!.proxy).toEqual(proxy);
+  });
+
+  it('fails the call at the pre-call stage when ctx.proxy is missing', async () => {
+    // A missing proxy identity is a configuration error, not a runtime
+    // condition: it is handled beside subkey derivation, the one pre-call
+    // failure allowed to fail the call. Degrading to a sentinel would write a
+    // silently unattributable trail, and throwing post-call would mask the
+    // tool result (ADR-0019).
+    const onEvent = vi.fn<AuditOptions['onEvent']>();
+    const next = vi.fn(async () => ({ content: [] }));
+    const { middleware, closeSession } = createAuditMiddleware(
+      makeOptions({ onEvent }),
+    );
+    const ctxWithoutProxy = createProxyContext({
+      transport: 'http',
+      identity,
+      sessionId: 'sess-no-proxy',
+    });
+
+    await expect(
+      middleware(makeReq('search'), next, ctxWithoutProxy),
+    ).rejects.toThrow(/ctx\.proxy is required/);
+
+    // Pre-call means exactly that: the upstream was never reached, no event
+    // was recorded, and no session was opened.
+    expect(next).not.toHaveBeenCalled();
+    expect(onEvent).not.toHaveBeenCalled();
+    await expect(closeSession('sess-no-proxy')).resolves.toBeUndefined();
+  });
+
+  it('fails a prompt call the same way when ctx.proxy is missing', async () => {
+    const { promptMiddleware } = createAuditMiddleware(makeOptions());
+    await expect(
+      promptMiddleware(
+        { method: 'prompts/get' as const, params: { name: 'greet' } },
+        async () => ({ messages: [] }),
+        createProxyContext({ transport: 'http', identity }),
+      ),
+    ).rejects.toThrow(/ctx\.proxy is required/);
+  });
+
+  it('a tampered proxy field breaks keyed chain verification', async () => {
+    const { verifyAuditChain } = await import('../verify.js');
+    const events: AuditEvent[] = [];
+    const signingKey = createDefaultSigningKeyProvider('test-secret');
+    const { middleware } = createAuditMiddleware(
+      makeOptions({
+        signingKey,
+        onEvent: (e) => {
+          events.push(e);
+        },
+      }),
+    );
+    const ctx = makeProxyCtx('sess-tamper');
+    await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
+    await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
+
+    await expect(verifyAuditChain(events, signingKey)).resolves.toEqual({
+      valid: true,
+    });
+
+    const tampered = events.map((e, i) =>
+      i === 1 ? { ...e, proxy: { ...proxy, name: 'rogue-proxy' } } : e,
+    );
+    await expect(verifyAuditChain(tampered, signingKey)).resolves.toEqual({
+      valid: false,
+      index: 1,
+      reason: 'chainHash mismatch',
+    });
+
+    // The version alone is enough: provenance is the whole {name, version}.
+    const versionTampered = events.map((e, i) =>
+      i === 1 ? { ...e, proxy: { ...proxy, version: '9.9.9' } } : e,
+    );
+    await expect(
+      verifyAuditChain(versionTampered, signingKey),
+    ).resolves.toEqual({
+      valid: false,
+      index: 1,
+      reason: 'chainHash mismatch',
+    });
+  });
+
+  it('a proxy field stripped from a recorded event breaks verification at that index', async () => {
+    // The gap #123 closes. While `proxy` was omitted when absent, an event
+    // that never had one and an event whose one was deleted produced the same
+    // preimage, so removing recorded provenance verified clean.
+    const { verifyAuditChain } = await import('../verify.js');
+    const events: AuditEvent[] = [];
+    const signingKey = createDefaultSigningKeyProvider('test-secret');
+    const { middleware } = createAuditMiddleware(
+      makeOptions({
+        signingKey,
+        onEvent: (e) => {
+          events.push(e);
+        },
+      }),
+    );
+    const ctx = makeProxyCtx('sess-strip');
+    await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
+    await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
+
+    await expect(verifyAuditChain(events, signingKey)).resolves.toEqual({
+      valid: true,
+    });
+
+    const stripped = events.map((e, i) => {
+      if (i !== 1) return e;
+      const { proxy: _dropped, ...rest } = e;
+      return rest as AuditEvent;
+    });
+    expect('proxy' in stripped[1]!).toBe(false);
+    await expect(verifyAuditChain(stripped, signingKey)).resolves.toEqual({
+      valid: false,
+      index: 1,
+      reason: 'chainHash mismatch',
+    });
+  });
+
+  it('a tampered manifest proxy field breaks the signature', async () => {
+    const { verifyManifestSignature } = await import('../verify.js');
+    const signingKey = createDefaultSigningKeyProvider('test-secret');
+    const { middleware, closeSession } = createAuditMiddleware(
+      makeOptions({ signingKey }),
+    );
+    await middleware(
+      makeReq('search'),
+      async () => ({ content: [] }),
+      makeProxyCtx('sess-manifest-tamper'),
+    );
+
+    const manifest = await closeSession('sess-manifest-tamper');
+
+    await expect(verifyManifestSignature(manifest!, signingKey)).resolves.toBe(
+      true,
+    );
+    await expect(
+      verifyManifestSignature(
+        { ...manifest!, proxy: { ...proxy, name: 'rogue-proxy' } },
+        signingKey,
+      ),
+    ).resolves.toBe(false);
+    await expect(
+      verifyManifestSignature(
+        { ...manifest!, proxy: { ...proxy, version: '9.9.9' } },
+        signingKey,
+      ),
+    ).resolves.toBe(false);
+
+    // Stripping it is detected too, which the omission pattern could not do:
+    // the rebuilt payload used to match the one signed without a proxy.
+    const { proxy: _dropped, ...withoutProxy } = manifest!;
+    await expect(
+      verifyManifestSignature(withoutProxy as ReplayManifest, signingKey),
+    ).resolves.toBe(false);
+  });
+});
+
+describe('createAuditMiddleware — subkey confidentiality (regression)', () => {
+  // Guards the fix for the keyId-as-key-material footgun: subkeys must derive
+  // from the SECRET via the sign() oracle, never from the public keyId (which is
+  // published in ReplayManifest.signedBy). If this regresses, a manifest-holder
+  // can decrypt high-tier payloads. See ADR-0003 and ADR-0004.
+  it('high-tier payload is NOT decryptable from the public keyId, but IS from the secret-derived key', async () => {
+    const events: AuditEvent[] = [];
+    const signingKey = createDefaultSigningKeyProvider('test-secret');
+    const { middleware } = createAuditMiddleware(
+      makeOptions({
+        signingKey,
+        onEvent: (e) => {
+          events.push(e);
+        },
+      }),
+    );
+
+    await middleware(
+      makeReq('transfer', { acct: 'secret-acct' }),
+      async () => ({ content: [] }),
+      makeCtx(),
+    );
+
+    const event = events[0]!;
+    if (event.sensitivityTier !== 'high') throw new Error('expected high tier');
+    const aad = `mcpose/v2/aad\0${event.id}\0input`;
+
+    // Attacker path: keyId is public (== manifest.signedBy). The OLD scheme keyed
+    // encryption off SHA256(keyIdBytes ‖ id). Prove that path no longer decrypts.
+    const publicKeyId = Buffer.from(signingKey.keyId, 'hex');
+    const forgedKey = createHash('sha256')
+      .update(publicKeyId)
+      .update(event.id)
+      .digest();
+    expect(() => aesGcmDecrypt(event.inputEncrypted, forgedKey, aad)).toThrow();
+
+    // Legitimate path: encRoot is derived from the secret through the oracle and
+    // is never published; only a secret-holder can reproduce it.
+    const encRoot = await signingKey.sign(Buffer.from('mcpose/v2/enc'));
+    const realKey = deriveEventKey(encRoot, undefined, 0, event.id);
+    expect(
+      JSON.parse(aesGcmDecrypt(event.inputEncrypted, realKey, aad)),
+    ).toEqual({ acct: 'secret-acct' });
+  });
+
+  it('input and output ciphertexts are not swappable within an event (AAD binding)', async () => {
+    const events: AuditEvent[] = [];
+    const signingKey = createDefaultSigningKeyProvider('test-secret');
+    const { middleware } = createAuditMiddleware(
+      makeOptions({
+        signingKey,
+        onEvent: (e) => {
+          events.push(e);
+        },
+      }),
+    );
+
+    await middleware(
+      makeReq('transfer', { acct: 'in' }),
+      async () => ({ content: [{ type: 'text', text: 'out' }] }),
+      makeCtx(),
+    );
+
+    const event = events[0]!;
+    if (event.sensitivityTier !== 'high') throw new Error('expected high tier');
+    const encRoot = await signingKey.sign(Buffer.from('mcpose/v2/enc'));
+    const key = deriveEventKey(encRoot, undefined, 0, event.id);
+
+    // Correct AAD decrypts; the OTHER field's AAD must not authenticate.
+    const inputAad = `mcpose/v2/aad\0${event.id}\0input`;
+    const outputAad = `mcpose/v2/aad\0${event.id}\0output`;
+    expect(() =>
+      aesGcmDecrypt(event.inputEncrypted, key, inputAad),
+    ).not.toThrow();
+    expect(() => aesGcmDecrypt(event.inputEncrypted, key, outputAad)).toThrow();
+    expect(() => aesGcmDecrypt(event.outputEncrypted, key, inputAad)).toThrow();
+  });
+
+  it('events at different positions get distinct keys even with a reused requestId', async () => {
+    const events: AuditEvent[] = [];
+    const signingKey = createDefaultSigningKeyProvider('test-secret');
+    const { middleware } = createAuditMiddleware(
+      makeOptions({
+        signingKey,
+        sensitivityResolver: () => 'high',
+        onEvent: (e) => {
+          events.push(e);
+        },
+      }),
+    );
+
+    // Deliberately reuse ONE context (and therefore one requestId).
+    const ctx = makeCtx('reused-ctx-session');
+    await middleware(
+      makeReq('transfer', { n: 1 }),
+      async () => ({ content: [] }),
+      ctx,
+    );
+    await middleware(
+      makeReq('transfer', { n: 2 }),
+      async () => ({ content: [] }),
+      ctx,
+    );
+
+    expect(events[0]!.id).toBe(events[1]!.id);
+    const encRoot = await signingKey.sign(Buffer.from('mcpose/v2/enc'));
+    const key0 = deriveEventKey(
+      encRoot,
+      'reused-ctx-session',
+      0,
+      events[0]!.id,
+    );
+    const key1 = deriveEventKey(
+      encRoot,
+      'reused-ctx-session',
+      1,
+      events[1]!.id,
+    );
+    expect(key0.equals(key1)).toBe(false);
+
+    // Each event decrypts only under its own positional key.
+    const [first, second] = events;
+    if (
+      first?.sensitivityTier !== 'high' ||
+      second?.sensitivityTier !== 'high'
+    ) {
+      throw new Error('expected high tier');
+    }
+    const aad0 = `mcpose/v2/aad\0${first.id}\0input`;
+    expect(JSON.parse(aesGcmDecrypt(first.inputEncrypted, key0, aad0))).toEqual(
+      { n: 1 },
+    );
+    expect(() => aesGcmDecrypt(second.inputEncrypted, key0, aad0)).toThrow();
+  });
+
+  // The same posture extends to erasable mode (ADR-0018): the stored subject
+  // key and the hash subkey derived from it are private key material, with the
+  // handling rules the signing secret has. If either leaks into a record, an
+  // erasure is theatre — whoever holds the leaked record can still read and
+  // confirm the payloads the key was destroyed to protect.
+  it('neither the subject key nor its hash subkey appears in any event, manifest, or error', async () => {
+    const events: AuditEvent[] = [];
+    const manifests: ReplayManifest[] = [];
+    const auditErrors: unknown[] = [];
+    const keyStore = createInMemorySubjectKeyStore();
+    const { middleware, closeSession } = createAuditMiddleware(
+      makeOptions({
+        keyStore,
+        sensitivityResolver: () => 'high',
+        onEvent: (e) => {
+          events.push(e);
+          // A sink that throws routes through onAuditError; the error it
+          // reports must be as key-free as the event itself.
+          throw new Error('sink exploded');
+        },
+        onManifest: (m) => {
+          manifests.push(m);
+        },
+        onAuditError: (err) => {
+          auditErrors.push(err);
+        },
+      }),
+    );
+
+    await middleware(
+      makeReq('transfer', { acct: 'secret-acct' }),
+      async () => ({ content: [] }),
+      makeCtx('sess-subject-confidentiality'),
+    );
+    await closeSession('sess-subject-confidentiality');
+
+    expect(events).toHaveLength(1);
+    expect(manifests).toHaveLength(1);
+    expect(auditErrors).toHaveLength(1);
+
+    const subjectKey = await keyStore.getOrCreate('user-1');
+    const hashSubkey = createHmac('sha256', subjectKey)
+      .update('mcpose/v2/hashkey')
+      .digest();
+    const secrets = [subjectKey, hashSubkey].flatMap((key) => [
+      key.toString('hex'),
+      key.toString('base64'),
+      key.toString('base64url'),
+    ]);
+
+    const haystack = [
+      JSON.stringify(events),
+      JSON.stringify(manifests),
+      auditErrors.map((err) => String(err) + JSON.stringify(err)).join(''),
+    ].join('');
+
+    for (const secret of secrets) {
+      expect(secret).not.toBe('');
+      expect(haystack).not.toContain(secret);
+    }
+  });
+});
+
+// ── Prompt calls (ADR-0014) ──────────────────────────────────────────────────
+
+/**
+ * Shaped like an McpError from rejectionMcpError() without importing the SDK:
+ * the middleware duck-types `err.data.rejectionReason`.
+ */
+function rejectionError(reason: string, message: string): Error {
+  return Object.assign(new Error(message), {
+    code: -32601,
+    data: { rejectionReason: reason },
+  });
+}
+
+function makePromptReq(name: string, args: Record<string, string> = {}) {
+  return {
+    method: 'prompts/get' as const,
+    params: { name, arguments: args },
+  };
+}
+
+const promptResult = { messages: [] };
+
+describe('createAuditMiddleware — prompt calls', () => {
+  it("marks prompt events with kind 'prompt' and leaves tool events without the key", async () => {
+    const events: AuditEvent[] = [];
+    const { middleware, promptMiddleware } = createAuditMiddleware(
+      makeOptions({
+        onEvent: (e) => {
+          events.push(e);
+        },
+      }),
+    );
+    const ctx = makeCtx('sess-kind');
+
+    await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
+    await promptMiddleware(
+      makePromptReq('brief'),
+      async () => promptResult,
+      ctx,
+    );
+
+    expect('kind' in events[0]!).toBe(false);
+    expect(events[1]!.kind).toBe('prompt');
+    // The prompt name lands in `tool`; `kind` is what tells them apart.
+    expect(events[1]!.tool).toBe('brief');
+  });
+
+  it('resolves sensitivity from the prompt name, failing closed for an unknown one', async () => {
+    const events: AuditEvent[] = [];
+    const sensitivityResolver = vi.fn(
+      createSensitivityResolver({ search: 'low' }),
+    );
+    const { promptMiddleware } = createAuditMiddleware(
+      makeOptions({
+        sensitivityResolver,
+        onEvent: (e) => {
+          events.push(e);
+        },
+      }),
+    );
+
+    // The sentinel carries `-` and `!`, neither of which is in the base64
+    // alphabet, so it can never collide with a ciphertext substring.
+    const sentinel = 'q3-secret-plaintext!';
+    await promptMiddleware(
+      makePromptReq('brief', { topic: sentinel }),
+      async () => promptResult,
+      makeCtx('sess-prompt-tier'),
+    );
+
+    expect(sensitivityResolver).toHaveBeenCalledWith('brief', identity, {
+      topic: sentinel,
+    });
+    const event = events[0]!;
+    expect(event.sensitivityTier).toBe('high');
+    if (event.sensitivityTier === 'high') {
+      expect(typeof event.inputEncrypted).toBe('string');
+      expect(typeof event.outputEncrypted).toBe('string');
+      expect('inputRaw' in event).toBe(false);
+      expect('outputRaw' in event).toBe(false);
+      // The plaintext arguments must not survive anywhere on the event.
+      expect(JSON.stringify(event)).not.toContain(sentinel);
+    }
+  });
+
+  it('audits a rejected prompt call with its rejectionReason', async () => {
+    const events: AuditEvent[] = [];
+    const { promptMiddleware } = createAuditMiddleware(
+      makeOptions({
+        onEvent: (e) => {
+          events.push(e);
+        },
+      }),
+    );
+
+    await expect(
+      promptMiddleware(
+        makePromptReq('brief'),
+        async () => {
+          throw rejectionError('BACKEND_UNROUTABLE', 'Prompt not found: brief');
+        },
+        makeCtx('sess-prompt-reject'),
+      ),
+    ).rejects.toThrow('Prompt not found: brief');
+
+    expect(events).toHaveLength(1);
+    expect(events[0]!.kind).toBe('prompt');
+    expect(events[0]!.outcome).toBe('rejected');
+    expect(events[0]!.rejectionReason).toBe('BACKEND_UNROUTABLE');
+  });
+
+  it('interleaves tool and prompt events in one session chain, sequentially', async () => {
+    const { verifyAuditChain } = await import('../verify.js');
+    const events: AuditEvent[] = [];
+    const signingKey = createDefaultSigningKeyProvider('test-secret');
+    const { middleware, promptMiddleware } = createAuditMiddleware(
+      makeOptions({
+        signingKey,
+        onEvent: (e) => {
+          events.push(e);
+        },
+      }),
+    );
+    const ctx = makeCtx('sess-interleaved');
+
+    await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
+    await promptMiddleware(
+      makePromptReq('brief'),
+      async () => promptResult,
+      ctx,
+    );
+    await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
+    await promptMiddleware(
+      makePromptReq('summary'),
+      async () => promptResult,
+      ctx,
+    );
+
+    expect(events.map((e) => e.replayManifestPosition)).toEqual([0, 1, 2, 3]);
+    expect(events.map((e) => e.kind)).toEqual([
+      undefined,
+      'prompt',
+      undefined,
+      'prompt',
+    ]);
+    await expect(verifyAuditChain(events, signingKey)).resolves.toEqual({
+      valid: true,
+    });
+  });
+
+  it('detects adding, removing, or changing kind at that exact index', async () => {
+    const { verifyAuditChain } = await import('../verify.js');
+    const events: AuditEvent[] = [];
+    const signingKey = createDefaultSigningKeyProvider('test-secret');
+    const { middleware, promptMiddleware } = createAuditMiddleware(
+      makeOptions({
+        signingKey,
+        onEvent: (e) => {
+          events.push(e);
+        },
+      }),
+    );
+    const ctx = makeCtx('sess-kind-tamper');
+
+    await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
+    await promptMiddleware(
+      makePromptReq('brief'),
+      async () => promptResult,
+      ctx,
+    );
+
+    await expect(verifyAuditChain(events, signingKey)).resolves.toEqual({
+      valid: true,
+    });
+
+    // Adding kind to a tool event.
+    const added = events.map((e, i) =>
+      i === 0 ? { ...e, kind: 'prompt' as const } : e,
+    );
+    await expect(verifyAuditChain(added, signingKey)).resolves.toEqual({
+      valid: false,
+      index: 0,
+      reason: 'chainHash mismatch',
+    });
+
+    // Stripping kind from a prompt event.
+    const stripped = events.map((e, i) => {
+      if (i !== 1) return e;
+      const { kind: _kind, ...rest } = e;
+      return rest;
+    });
+    await expect(verifyAuditChain(stripped, signingKey)).resolves.toEqual({
+      valid: false,
+      index: 1,
+      reason: 'chainHash mismatch',
+    });
+
+    // Changing kind to another value.
+    const changed = events.map((e, i) =>
+      i === 1 ? ({ ...e, kind: 'tool' } as unknown as AuditEvent) : e,
+    );
+    await expect(verifyAuditChain(changed, signingKey)).resolves.toEqual({
+      valid: false,
+      index: 1,
+      reason: 'chainHash mismatch',
+    });
+  });
+
+  it('signs a manifest over an interleaved session whose proofs all verify', async () => {
+    const { verifyManifestSignature } = await import('../verify.js');
+    const { computeMerkleRoot, verifyMerkleProof } =
+      await import('../chain.js');
+    const events: AuditEvent[] = [];
+    const signingKey = createDefaultSigningKeyProvider('test-secret');
+    const { middleware, promptMiddleware, closeSession } =
+      createAuditMiddleware(
+        makeOptions({
+          signingKey,
+          onEvent: (e) => {
+            events.push(e);
+          },
+        }),
+      );
+    const ctx = makeCtx('sess-prompt-manifest');
+
+    await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
+    await promptMiddleware(
+      makePromptReq('brief'),
+      async () => promptResult,
+      ctx,
+    );
+    await middleware(makeReq('transfer'), async () => ({ content: [] }), ctx);
+
+    const manifest = await closeSession('sess-prompt-manifest');
+
+    expect(manifest!.eventCount).toBe(3);
+    await expect(verifyManifestSignature(manifest!, signingKey)).resolves.toBe(
+      true,
+    );
+
+    const hashes = events.map((e) => e.chainHash);
+    expect(manifest!.merkleRoot).toBe(computeMerkleRoot(hashes));
+    expect(manifest!.merkleProofs).toHaveLength(3);
+    for (const [i, proof] of manifest!.merkleProofs.entries()) {
+      expect(verifyMerkleProof(hashes[i]!, proof, manifest!.merkleRoot)).toBe(
+        true,
+      );
+    }
+  });
+});
+
+describe('createAuditMiddleware — in-band tool errors (#171)', () => {
+  // MCP reports a tool failure in the result (`isError: true`) rather than by
+  // throwing, so the audit record must say `error` where telemetry does.
+  const inBandError = {
+    content: [{ type: 'text' as const, text: 'boom' }],
+    isError: true,
+  };
+
+  function record() {
+    const events: AuditEvent[] = [];
+    const signingKey = createDefaultSigningKeyProvider('test-secret');
+    const handle = createAuditMiddleware(
+      makeOptions({
+        signingKey,
+        onEvent: (e) => {
+          events.push(e);
+        },
+      }),
+    );
+    return { events, signingKey, ...handle };
+  }
+
+  it('records an isError tool result as error and returns it untouched', async () => {
+    const { events, middleware } = record();
+
+    const returned = await middleware(
+      makeReq('search'),
+      async () => inBandError,
+      makeCtx(),
+    );
+
+    expect(returned).toBe(inBandError);
+    expect(events[0]!.outcome).toBe('error');
+    expect(events[0]!.error).toEqual({
+      name: 'ToolError',
+      message: 'Tool result returned isError: true',
+    });
+    expect(events[0]!.outputHash).toBe(sha256hex(stableStringify(inBandError)));
+  });
+
+  it('does not copy the tool text into the unencrypted error detail', async () => {
+    const { events, middleware } = record();
+
+    await middleware(
+      makeReq('transfer'),
+      async () => ({
+        content: [{ type: 'text' as const, text: 'IBAN DK5000400440116243' }],
+        isError: true,
+      }),
+      makeCtx(),
+    );
+
+    expect(events[0]!.sensitivityTier).toBe('high');
+    expect(JSON.stringify(events[0]!.error)).not.toContain('IBAN');
+  });
+
+  it('records success for a tool result without isError', async () => {
+    const { events, middleware } = record();
+
+    await middleware(
+      makeReq('search'),
+      async () => ({ content: [] }),
+      makeCtx(),
+    );
+
+    expect(events[0]!.outcome).toBe('success');
+    expect(events[0]!.error).toBeUndefined();
+  });
+
+  it('never classifies a prompt result as an in-band error', async () => {
+    const { events, promptMiddleware } = record();
+
+    await promptMiddleware(
+      { method: 'prompts/get' as const, params: { name: 'greet' } },
+      async () => ({ messages: [], isError: true }),
+      makeCtx(),
+    );
+
+    expect(events[0]!.outcome).toBe('success');
+    expect(events[0]!.error).toBeUndefined();
+  });
+
+  it('still records a thrown error with its own name and message', async () => {
+    const { events, middleware } = record();
+
+    await expect(
+      middleware(
+        makeReq('search'),
+        async () => {
+          throw new TypeError('upstream down');
+        },
+        makeCtx(),
+      ),
+    ).rejects.toThrow('upstream down');
+
+    expect(events[0]!.outcome).toBe('error');
+    expect(events[0]!.error).toEqual({
+      name: 'TypeError',
+      message: 'upstream down',
+    });
+  });
+
+  it('still records a structured rejection as rejected without an error', async () => {
+    const { events, middleware } = record();
+    const rejection = Object.assign(new Error('hidden'), {
+      code: -32601,
+      data: { rejectionReason: 'TOOL_HIDDEN' },
+    });
+
+    await expect(
+      middleware(
+        makeReq('search'),
+        async () => {
+          throw rejection;
+        },
+        makeCtx(),
+      ),
+    ).rejects.toBe(rejection);
+
+    expect(events[0]!.outcome).toBe('rejected');
+    expect(events[0]!.rejectionReason).toBe('TOOL_HIDDEN');
+    expect(events[0]!.error).toBeUndefined();
+  });
+
+  it('chains all four outcomes into a session that verifies', async () => {
+    const { events, signingKey, middleware, closeSession } = record();
+    const ctx = makeCtx('session-171');
+    const rejection = Object.assign(new Error('hidden'), {
+      data: { rejectionReason: 'TOOL_HIDDEN' },
+    });
+
+    await middleware(makeReq('search'), async () => ({ content: [] }), ctx);
+    await middleware(makeReq('search'), async () => inBandError, ctx);
+    await middleware(
+      makeReq('search'),
+      async () => {
+        throw new Error('upstream down');
+      },
+      ctx,
+    ).catch(() => undefined);
+    await middleware(
+      makeReq('search'),
+      async () => {
+        throw rejection;
+      },
+      ctx,
+    ).catch(() => undefined);
+
+    expect(events.map((e) => e.outcome)).toEqual([
+      'success',
+      'error',
+      'error',
+      'rejected',
+    ]);
+    await expect(verifyAuditChain(events, signingKey)).resolves.toEqual({
+      valid: true,
+    });
+    const manifest = await closeSession('session-171');
+    expect(manifest?.eventCount).toBe(4);
+    await expect(verifyManifestSignature(manifest!, signingKey)).resolves.toBe(
+      true,
+    );
+  });
+
+  it('breaks verification when an in-band error is rewritten as success', async () => {
+    const { events, signingKey, middleware } = record();
+    const ctx = makeCtx('session-171-tamper');
+
+    await middleware(makeReq('search'), async () => inBandError, ctx);
+    const { error: _error, ...rest } = events[0]!;
+    const forged: AuditEvent = { ...rest, outcome: 'success' };
+
+    await expect(verifyAuditChain([forged], signingKey)).resolves.toEqual({
+      valid: false,
+      index: 0,
+      reason: 'chainHash mismatch',
+    });
+  });
+});