@metamynd/agentsafe-guard 0.4.0 → 0.4.5

package/README.md

@@ -15,6 +15,21 @@ compliance team edits in the dashboard, changeable live with no redeploy.
   `policy-core` the gate runs (MAGP §9.2 cooperative mode) — identical inputs give the identical
   verdict, with no network round-trip. See §4.
 
+## The protocol
+
+This guard is one implementation of an open specification. You do not have to use it — the
+protocol is published so you can implement it yourself, verify a verdict independently, or
+re-implement the gate:
+
+**[MAGP v1.0 — MetaMynd Agentic Governance Protocol](https://metamynd.ai/en/developers/spec)**
+([markdown](https://metamynd.ai/specs/magp-v1.0.md))
+
+It defines agent identity, the canonical signed message (§8.3), the sixteen-stage order of
+checks (§8.5), all 59 reason codes (Appendix A), delegation narrowing (§5.4), and evidence
+you can verify offline without MetaMynd (§13.4). If you are writing a client in a language
+other than JavaScript, read §8.3.3–8.3.5 first: key encoding, number stringification and
+signed-vs-sent field identity each surface only as `SIGNATURE_INVALID`.
+
 ## Try it first — no account, no network
 
 ```bash

package/agentsafe-guard.mjs

@@ -491,7 +491,7 @@ export function createGuard(opts = {}) {
     return {
       hello() {
         const nonceA = crypto.randomUUID();
-        return { nonceA, message: { fromDid: agentDid, nonceA, protoVersion: '0.4' } };
+        return { nonceA, message: { fromDid: agentDid, nonceA, protoVersion: '1.0' } };
       },
       prove({ nonceA, challenge } = {}) {
         const { toDid, nonceB, sigB, handshakeId } = challenge ?? {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metamynd/agentsafe-guard",
-  "version": "0.4.0",
+  "version": "0.4.5",
   "description": "Zero-dependency runtime governance for any Node AI agent \u2014 gate tool calls through MetaMynd/AgentSafe (allow / block / escalate) against the agent's mandate, enforced Standards, and SOPs. Ed25519-signed, deterministic, fail-closed.",
   "type": "module",
   "main": "./agentsafe-guard.mjs",
@@ -48,8 +48,13 @@
   "author": "MetaMynd",
   "license": "MIT",
   "homepage": "https://metamynd.ai",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Metamynd/agentsafe-guard.git",
+    "directory": "packages/agentsafe-guard"
+  },
   "bugs": {
-    "url": "https://metamynd.ai/en/support/contact"
+    "url": "https://github.com/Metamynd/agentsafe-guard/issues"
   },
   "publishConfig": {
     "access": "public"

package/policy-core.mjs

@@ -334,6 +334,13 @@ function constraintSatisfied(c, req) {
 function targetOf(rule, mandate) {
   return rule.target ?? mandate.target;
 }
+function isAuthorityFailure(result) {
+  return result.matched?.kind === "expiry" || result.matched?.kind === "no-permission";
+}
+function authorityFailure(mandate, target, now) {
+  const result = evaluateMandate(mandate, { target, now, values: {} });
+  return isAuthorityFailure(result) ? { ...result, decision: "block" } : null;
+}
 function evaluateMandate(mandate, req) {
   const now = toTime(req.now);
   if (mandate.validFrom && now < toTime(mandate.validFrom)) {
@@ -402,14 +409,14 @@ function evaluate(input) {
       reasonCode = code;
     }
   };
+  const m = input.mandate && input.mandateRequest ? evaluateMandate(input.mandate, input.mandateRequest) : null;
+  const authority = m !== null && isAuthorityFailure(m);
+  if (m && authority) consider(m.decision, m.reasonCode);
   const std = evaluateBoundStandards(input.standards ?? [], input.context);
   if (std.decision !== "allow") consider(std.decision, std.reasonCode ?? "STANDARD_RULE");
   const sop = evaluateBoundStandards(input.sops ?? [], input.context);
   if (sop.decision !== "allow") consider(sop.decision, sop.reasonCode ?? "SOP_RULE");
-  if (input.mandate && input.mandateRequest) {
-    const m = evaluateMandate(input.mandate, input.mandateRequest);
-    if (m.decision !== "allow") consider(m.decision, m.reasonCode);
-  }
+  if (m && !authority && m.decision !== "allow") consider(m.decision, m.reasonCode);
   return { decision, reasonCode, authorizationId: null, remaining: null, proofRef: null };
 }
 
@@ -472,12 +479,14 @@ export {
   applyHold,
   applySignedLast,
   asOperatingMode,
+  authorityFailure,
   buildAuthMessage,
   canAuthorize,
   evaluate,
   evaluateBoundStandards,
   evaluateMandate,
   evaluateStandardRules,
+  isAuthorityFailure,
   isOperatingMode,
   moleculeFires,
   moreRestrictive,