@metamynd/mmt-graph 0.2.0

package/mmt-graph.evidence-path.mjs

@@ -0,0 +1,65 @@
+/**
+ * Phase 5, first slice: proves the engine can answer evidence-path.ts's core question —
+ * "can a third party verify this decision without us?" — as a graph query, not a
+ * replacement of that file. See docs/design/metamynd-trust-ontology.md Appendix C and the
+ * plan this shipped under for why: blast-radius/accountability/contagion each need real
+ * new work (an Issuer concept, a Human concept, SPARQL aggregates) this slice doesn't
+ * attempt, and even this one isn't wired to any live endpoint — MMT_GRAPH_ENABLED is off
+ * by default, and even on, nothing backfills historical decisions into the graph yet.
+ *
+ * Mirrors evidence-path.ts's exact precedence rule, not a fresh guess at one:
+ * `anchorStatus = batch?.anchorStatus ?? evidence?.anchorStatus ?? null` — a batch's
+ * status, when a batch exists, always wins over the evidence event's own status. The
+ * `FILTER NOT EXISTS` in the direct-status branch below is what enforces "when a batch
+ * exists" — without it, an evidence event with a batch AND a stale direct status could
+ * verify via the wrong branch.
+ */
+
+import { MMT, decisionIri, evidenceIri } from './mmt-graph.project.mjs';
+
+const ANCHORED_STATUSES = ['SUCCESS', 'ANCHORED_BATCH', 'ANCHORED'];
+const STATUS_FILTER = ANCHORED_STATUSES.map((s) => JSON.stringify(s)).join(', ');
+
+/**
+ * @param engine {import('./mmt-graph.engine.mjs').MmtGraphEngine}
+ * @param decisionId {string}
+ * @returns {{ independentlyVerifiable: boolean, hasEvidence: boolean, hasDecisionDigest: boolean }}
+ */
+export function isIndependentlyVerifiable(engine, decisionId) {
+  const decision = decisionIri(decisionId).value;
+
+  const hasDecisionDigest = engine.query(`
+    PREFIX mmt: <${MMT}>
+    ASK { <${decision}> mmt:decisionDigest ?d . }
+  `);
+
+  const hasEvidence = engine.query(`
+    PREFIX mmt: <${MMT}>
+    ASK { <${decision}> mmt:generatedEvidence ?e . }
+  `);
+
+  // Batch status takes priority when a batch exists — the FILTER NOT EXISTS in the first
+  // branch is what makes that true, matching evidence-path.ts's `batch?.anchorStatus ??
+  // evidence?.anchorStatus` precedence rather than treating either status as equally valid.
+  const independentlyVerifiable = engine.query(`
+    PREFIX mmt: <${MMT}>
+    ASK {
+      <${decision}> mmt:generatedEvidence ?evidence .
+      {
+        ?evidence mmt:anchorStatus ?directStatus .
+        FILTER(?directStatus IN (${STATUS_FILTER}))
+        FILTER NOT EXISTS { ?batch mmt:hasMember ?evidence }
+      }
+      UNION
+      {
+        ?batch mmt:hasMember ?evidence ; mmt:anchorStatus ?batchStatus .
+        FILTER(?batchStatus IN (${STATUS_FILTER}))
+      }
+    }
+  `);
+
+  return { independentlyVerifiable, hasEvidence, hasDecisionDigest };
+}
+
+/** Exported for tests that want to construct the evidence IRI without importing project.mjs directly. */
+export { evidenceIri, decisionIri };

package/mmt-graph.merkle.mjs

@@ -0,0 +1,67 @@
+/**
+ * A dependency-light Merkle tree — a direct port of backend/src/features/magp/merkle.ts's
+ * algorithm, not a reinvention: sha256-hex leaves/nodes, Bitcoin-style duplication of a
+ * lone odd node. Ported rather than imported so a batch anchored by this package and one
+ * anchored by the backend's existing evidence rail are verifiable the same way without this
+ * package depending on backend/ — the same reasoning integrations/magp-evidence already
+ * follows for the identical algorithm.
+ *
+ * Pure and deterministic: sha256 only, no clock/IO.
+ */
+
+import { createHash } from 'node:crypto';
+
+/** sha256 → lower-case hex. */
+export function sha256Hex(data) {
+  return createHash('sha256').update(data).digest('hex');
+}
+
+function hashNodes(a, b) {
+  return sha256Hex(Buffer.concat([Buffer.from(a, 'hex'), Buffer.from(b, 'hex')]));
+}
+
+function nextLevel(level) {
+  const next = [];
+  for (let i = 0; i < level.length; i += 2) {
+    const left = level[i];
+    const right = i + 1 < level.length ? level[i + 1] : left;
+    next.push(hashNodes(left, right));
+  }
+  return next;
+}
+
+/** The Merkle root over the ordered leaves. Single leaf → itself; empty → sha256(""). */
+export function merkleRoot(leaves) {
+  if (leaves.length === 0) return sha256Hex('');
+  let level = leaves.slice();
+  while (level.length > 1) level = nextLevel(level);
+  return level[0];
+}
+
+/** @typedef {{ sibling: string, position: 'left' | 'right' }} ProofStep */
+
+/** The inclusion proof for `leaves[index]` — the sibling hashes from leaf to root. */
+export function merkleProof(leaves, index) {
+  if (index < 0 || index >= leaves.length) throw new Error('merkleProof: index out of range');
+  const proof = [];
+  let level = leaves.slice();
+  let idx = index;
+  while (level.length > 1) {
+    const isRightNode = idx % 2 === 1;
+    const pairIdx = isRightNode ? idx - 1 : idx + 1;
+    const sibling = pairIdx < level.length ? level[pairIdx] : level[idx];
+    proof.push({ sibling, position: isRightNode ? 'left' : 'right' });
+    level = nextLevel(level);
+    idx = Math.floor(idx / 2);
+  }
+  return proof;
+}
+
+/** Verify a leaf's inclusion proof reproduces the anchored root. */
+export function verifyMerkleProof(leaf, proof, root) {
+  let computed = leaf;
+  for (const step of proof) {
+    computed = step.position === 'left' ? hashNodes(step.sibling, computed) : hashNodes(computed, step.sibling);
+  }
+  return computed === root;
+}

package/mmt-graph.project.mjs

@@ -0,0 +1,236 @@
+/**
+ * Pure event → RDF quad projectors. No store, no I/O — the engine owns applying quads and
+ * resolving cross-event references (e.g. "which agent does the parent mandate's chain
+ * reach"); these functions only shape data, so they're independently testable and can't
+ * accidentally depend on apply-order.
+ *
+ * Vocabulary note, corrected from the storage-engine spike (integrations/mmt-graph's first
+ * version, PR #382): that spike used `mmt:actsFor` for Mandate→Agent. Domain A of the MMTO
+ * draft already defines `mmt:actsFor` as Agent→Principal ("the Principal is the actor whose
+ * authority the agent exercises"), and the source proposal's own worked example uses a
+ * separate `grantedTo` for Mandate→Agent. This module follows the doc's definition, not the
+ * spike's shortcut — see the spike-fix note in mmt-graph.spike.mjs.
+ */
+
+import oxigraph from 'oxigraph';
+
+const { namedNode, literal, quad } = oxigraph;
+
+export const MMT = 'https://schema.metamynd.ai/trust/v1#';
+const RDF_TYPE = namedNode('http://www.w3.org/1999/02/22-rdf-syntax-ns#type');
+const XSD_INTEGER = namedNode('http://www.w3.org/2001/XMLSchema#integer');
+const XSD_DATETIME = namedNode('http://www.w3.org/2001/XMLSchema#dateTime');
+
+const mmt = (local) => namedNode(MMT + local);
+
+/** DIDs are already IRIs — an agent's or principal's node is its own DID, not a minted one. */
+export const agentIri = (did) => namedNode(did);
+export const principalIri = (did) => namedNode(did);
+export const mandateIri = (policyId) => namedNode(`${MMT}mandate/${policyId}`);
+
+/**
+ * `principalDid`, when given, is the agent's HOME organisation
+ * (`AgentIdentity.organizationPrincipalId` in accountability.ts) — projected onto
+ * `mmt:memberOf`, the same domain A relationship the fourth cohort slice already
+ * established for this exact field (see projectCohortShared's header). Deliberately NOT
+ * `mmt:actsFor`: that predicate is domain A's name for the root mandate's principalDid
+ * (see projectMandateGranted), a different fact that happens to often, but not always,
+ * name the same organisation — accountability.ts reports the two separately (`organization`
+ * vs `delegationRoot`) for exactly this reason.
+ */
+export function projectAgentRegistered(ev) {
+  const quads = [quad(agentIri(ev.agentDid), RDF_TYPE, mmt('AIAgent'))];
+  if (ev.principalDid) quads.push(quad(agentIri(ev.agentDid), mmt('memberOf'), principalIri(ev.principalDid)));
+  return quads;
+}
+
+/**
+ * The verification/representative fields are optional snapshot attributes — see
+ * AgentRegistered's header in mmt-graph.types.mjs for why this isn't a separate event.
+ * `mmt:operatedBy` (Organization → Human) is domain A's already-named relationship list
+ * (`ownedBy`, `operatedBy`, `actsFor`, `controlledBy`, `memberOf`), reused here for "the
+ * human who stands behind this entity's KYB" — the closest existing term to
+ * accountability.ts's own `answerable-by` edge, and never implemented until now.
+ */
+export function projectPrincipalRegistered(ev) {
+  const principal = principalIri(ev.principalDid);
+  const quads = [quad(principal, RDF_TYPE, mmt(ev.principalType ?? 'Organization'))];
+  if (ev.verificationStatus) quads.push(quad(principal, mmt('verificationStatus'), literal(ev.verificationStatus)));
+  if (ev.assuranceLevel) quads.push(quad(principal, mmt('assuranceLevel'), literal(ev.assuranceLevel)));
+  if (ev.verificationExpiresAt) quads.push(quad(principal, mmt('verificationExpiresAt'), literal(ev.verificationExpiresAt, XSD_DATETIME)));
+  if (ev.authorizedRepUserId) quads.push(quad(principal, mmt('operatedBy'), humanIri(ev.authorizedRepUserId)));
+  return quads;
+}
+
+/**
+ * @param ev {import('./mmt-graph.types.mjs').MandateGranted}
+ * @param parentAgentDid {string | null} the DID `mmt:grantedTo` of the mandate named by
+ *   `ev.delegatedFromPolicyId`, resolved by the engine before calling this — undefined/null
+ *   when `ev` is a root mandate (no delegatedFromPolicyId).
+ */
+export function projectMandateGranted(ev, parentAgentDid) {
+  const mandate = mandateIri(ev.policyId);
+  const agent = agentIri(ev.agentDid);
+  const quads = [quad(mandate, RDF_TYPE, mmt('Mandate')), quad(mandate, mmt('grantedTo'), agent)];
+  if (ev.expiresAt) quads.push(quad(mandate, mmt('expiresAt'), literal(ev.expiresAt, XSD_DATETIME)));
+
+  if (ev.delegatedFromPolicyId) {
+    if (!parentAgentDid) {
+      throw new Error(
+        `mandate ${ev.policyId} delegates from ${ev.delegatedFromPolicyId}, but that mandate's ` +
+          `grantee could not be resolved — apply the parent mandate-granted event first`
+      );
+    }
+    quads.push(quad(agent, mmt('derivesAuthorityFrom'), agentIri(parentAgentDid)));
+    quads.push(quad(agent, mmt('delegationDepth'), literal(String(ev.delegationDepth), XSD_INTEGER)));
+  } else if (ev.principalDid) {
+    quads.push(quad(agent, mmt('actsFor'), principalIri(ev.principalDid)));
+    // Domain C already names `mmt:grantsMandate` (Principal -> Mandate, the inverse of
+    // `grantedTo`) and never implements it. `actsFor` above lives on the AGENT node, so it
+    // can't distinguish which of an agent's several mandates was THIS principal's root
+    // grant — blast-radius.ts's `authorizedByPrincipal` is a per-MANDATE fact
+    // (`Policy.principalDid === principal.did`), not a per-agent one, so it needs an edge
+    // on the mandate itself. See mmt-graph.blast-radius.mjs.
+    quads.push(quad(principalIri(ev.principalDid), mmt('grantsMandate'), mandate));
+  }
+
+  return quads;
+}
+
+/** A revocation names what to remove rather than what to add — the engine deletes every quad with this subject. */
+export function projectMandateRevoked(ev) {
+  return { removeSubject: mandateIri(ev.policyId) };
+}
+
+// --- Domain H (runtime activity/evidence) — Phase 5's first slice ------------------
+
+export const decisionIri = (decisionId) => namedNode(`${MMT}decision/${decisionId}`);
+export const evidenceIri = (eventId) => namedNode(`${MMT}evidence/${eventId}`);
+export const batchIri = (batchId) => namedNode(`${MMT}batch/${batchId}`);
+
+/**
+ * `mmt:decidedFor` (Decision → Agent), added in Phase 5's fifth slice: Domain H names no
+ * predicate for "which agent this decision was about" — evidence-path.ts's slice never
+ * needed one. Adopted as the mmt: name for the edge kind accountability.ts's own graph
+ * builder already calls `decided-for` (see mmt-graph.accountability.mjs).
+ */
+export function projectDecisionRecorded(ev) {
+  const decision = decisionIri(ev.decisionId);
+  const quads = [quad(decision, RDF_TYPE, mmt('AuthorizationDecision'))];
+  if (ev.decisionDigest) quads.push(quad(decision, mmt('decisionDigest'), literal(ev.decisionDigest)));
+  if (ev.agentDid) quads.push(quad(decision, mmt('decidedFor'), agentIri(ev.agentDid)));
+  return quads;
+}
+
+/**
+ * @param ev {import('./mmt-graph.types.mjs').EvidenceRecorded}
+ * @param matchingDecisionIriValue {string | null} the IRI (as a string) of the
+ *   mmt:AuthorizationDecision whose mmt:decisionDigest equals ev.decisionDigest, resolved
+ *   by the engine before calling this — mirrors projectMandateGranted's parentAgentDid
+ *   parameter. null when no decision carries this digest (or none was given) — matching
+ *   evidence-path.ts's own "no fallback join, deliberately so" (see that file's header):
+ *   an unmatched digest means no mmt:generatedEvidence edge, not a guessed one.
+ */
+export function projectEvidenceRecorded(ev, matchingDecisionIriValue) {
+  const evidence = evidenceIri(ev.eventId);
+  const quads = [quad(evidence, RDF_TYPE, mmt('Evidence'))];
+  if (ev.anchorStatus) quads.push(quad(evidence, mmt('anchorStatus'), literal(ev.anchorStatus.toUpperCase())));
+  if (matchingDecisionIriValue) {
+    quads.push(quad(namedNode(matchingDecisionIriValue), mmt('generatedEvidence'), evidence));
+  }
+  return quads;
+}
+
+/**
+ * No engine-side resolution needed, unlike delegation: mmt:hasMember only needs the
+ * member IDs, not any of their resolved properties, so referencing an mmt:Evidence node
+ * that hasn't been recorded yet is harmless — the triple is valid RDF regardless of
+ * apply order, unlike derivesAuthorityFrom needing a real grantedTo value to point at.
+ */
+export function projectBatchAnchored(ev) {
+  const batch = batchIri(ev.batchId);
+  const quads = [quad(batch, RDF_TYPE, mmt('EvidenceBatch'))];
+  if (ev.anchorStatus) quads.push(quad(batch, mmt('anchorStatus'), literal(ev.anchorStatus.toUpperCase())));
+  for (const eventId of ev.memberEventIds) quads.push(quad(batch, mmt('hasMember'), evidenceIri(eventId)));
+  return quads;
+}
+
+// --- Domain F/A (governance / actors) — Phase 5's second and fourth slices ---------
+
+/**
+ * `organization`/`unit` map onto mmt:Organization/mmt:AgentGroup — both already named in
+ * Domain A ("mmt:Actor ⊐ mmt:Human, mmt:Organization, mmt:AIAgent, mmt:Service,
+ * mmt:AgentGroup") and never implemented until now. `sop`/`standard` map onto Domain F's
+ * mmt:GovernanceInstrument subtypes, already implemented in name only (see domain F's
+ * "Today" note).
+ */
+const COHORT_TYPE = { sop: 'SOP', standard: 'Standard', organization: 'Organization', unit: 'AgentGroup' };
+
+/** Whether membership in this cohort is also a real mmt:memberOf fact, not just cohort-computation plumbing — see projectCohortShared's header. */
+const MEMBERSHIP_KINDS = new Set(['organization', 'unit']);
+
+/** One node per (kind, key) pair, not per agent — every agent sharing a SOP/Standard points at the SAME cohort node, which is what makes COUNT(DISTINCT ?agent) over it meaningful. */
+export const cohortIri = (kind, key) => namedNode(`${MMT}cohort/${kind}/${encodeURIComponent(key)}`);
+
+/**
+ * Two predicates for organization/unit, one for sop/standard, deliberately not uniform:
+ * `mmt:sharesCohort` is mechanical plumbing this package invented so the contagion
+ * aggregate query can treat all four cohort kinds the same way. `mmt:memberOf` is the
+ * real Domain A relationship the doc already specs for group membership — sharing a SOP
+ * and belonging to an organization are different KINDS of fact, and reusing one edge for
+ * both would blur a distinction the ontology already drew. Emitting both keeps the
+ * mechanical query uniform without pretending organization membership is the same kind
+ * of thing as sharing a governance instrument.
+ */
+export function projectCohortShared(ev) {
+  const agent = agentIri(ev.agentDid);
+  const cohort = cohortIri(ev.kind, ev.key);
+  const quads = [
+    quad(agent, mmt('sharesCohort'), cohort),
+    quad(cohort, RDF_TYPE, mmt(COHORT_TYPE[ev.kind])),
+    quad(cohort, mmt('cohortKey'), literal(ev.key)),
+    quad(cohort, mmt('cohortLabel'), literal(ev.label)),
+  ];
+  if (MEMBERSHIP_KINDS.has(ev.kind)) quads.push(quad(agent, mmt('memberOf'), cohort));
+  if (ev.version !== undefined) quads.push(quad(cohort, mmt('cohortVersion'), literal(String(ev.version), XSD_INTEGER)));
+  return quads;
+}
+
+// --- Domain A (actors), continued — Phase 5's fifth slice ------------------------
+
+/** Humans carry no DID (the User table has none) — a synthetic IRI, same pattern as mandateIri/decisionIri for their own non-DID identifiers. */
+export const humanIri = (userId) => namedNode(`${MMT}human/${encodeURIComponent(userId)}`);
+
+/** Verbatim shape of accountability.ts's own personName() — full name when either part is given, else the email, never a blank label. */
+function personName({ firstName, lastName, email }) {
+  const full = [firstName, lastName].filter(Boolean).join(' ').trim();
+  return full || email;
+}
+
+export function projectHumanRegistered(ev) {
+  const human = humanIri(ev.userId);
+  const quads = [quad(human, RDF_TYPE, mmt('Human')), quad(human, mmt('email'), literal(ev.email))];
+  quads.push(quad(human, mmt('name'), literal(personName(ev))));
+  return quads;
+}
+
+// --- Domain A/B (actors/identity) — Phase 5's sixth slice -------------------------
+
+/** Issuers have real DIDs (issuer.model.ts) — the node is its own DID, same reasoning as agentIri/principalIri, not a minted one. */
+export const issuerIri = (did) => namedNode(did);
+
+/**
+ * `mmt:Issuer` is the one genuinely new class this package adds — see IssuerRegistered's
+ * header in mmt-graph.types.mjs. `mmt:backedBy` (Issuer -> Organization) is a new
+ * predicate too: adopted from blast-radius.ts's own edge-kind name (`backed-by`), the same
+ * precedent as `mmt:decidedFor` — Domain A's relationship list names nothing for "the
+ * entity a credential issuer answers to" specifically enough to reuse without blurring it
+ * into `operatedBy`'s different (day-to-day-operator) sense.
+ */
+export function projectIssuerRegistered(ev) {
+  const issuer = issuerIri(ev.did);
+  const quads = [quad(issuer, RDF_TYPE, mmt('Issuer'))];
+  if (ev.name) quads.push(quad(issuer, mmt('name'), literal(ev.name)));
+  if (ev.principalDid) quads.push(quad(issuer, mmt('backedBy'), principalIri(ev.principalDid)));
+  return quads;
+}

package/mmt-graph.self-host-quickstart.mjs

@@ -0,0 +1,78 @@
+/**
+ * Phase 4: the self-hosting quickstart. Runs the WHOLE lifecycle a tenant running their own
+ * copy of this package would go through — register, validate, query, batch, anchor, verify
+ * — entirely offline except the one line marked NETWORK CALL, which you replace with your
+ * own Hedera client. No MetaMynd backend, no Postgres, no MetaMynd credentials anywhere in
+ * this file or anything it imports: that's the whole point of Phase 1-3's design (see
+ * mmt-graph.engine.mjs/anchor.mjs's own headers) — this script is the proof that it's true.
+ *
+ * Run it:
+ *   npm install @metamynd/mmt-graph
+ *   node node_modules/@metamynd/mmt-graph/mmt-graph.self-host-quickstart.mjs
+ * or, working from a clone of this package directly:
+ *   npm run self-host-quickstart
+ *
+ * For a full worked example that actually submits to Hedera testnet (real @hashgraph/sdk
+ * client, your own operator account), see mmt-graph.anchor-live-demo.mjs — this file's
+ * `submit` below is a stub so the quickstart runs with zero setup and zero network access.
+ */
+
+import { MmtGraphEngine } from './mmt-graph.engine.mjs';
+import { agentRegistered, principalRegistered, mandateGranted } from './mmt-graph.types.mjs';
+import { buildChangelogBatch } from './mmt-graph.changelog.mjs';
+import { anchorBatch } from './mmt-graph.anchor.mjs';
+import { verifyReplayedLog } from './mmt-graph.auditor.mjs';
+
+async function main() {
+  // 1. Register what you already have: your own agents, principals, mandates. In a real
+  //    deployment these calls sit behind whatever event source you already have (a
+  //    Postgres trigger, a migration script, an application hook) — see this package's
+  //    README for how MetaMynd's own backend wires this (mmt-graph.adapter.ts), which you
+  //    are free to copy or ignore entirely.
+  const engine = new MmtGraphEngine();
+  engine.apply(principalRegistered({ principalDid: 'did:hedera:testnet:your-org', principalType: 'Organization' }));
+  engine.apply(agentRegistered({ agentDid: 'did:hedera:testnet:your-agent-1', principalDid: 'did:hedera:testnet:your-org' }));
+  engine.apply(mandateGranted({ policyId: 'mandate-1', agentDid: 'did:hedera:testnet:your-agent-1', principalDid: 'did:hedera:testnet:your-org' }));
+  console.log(`1. Registered ${engine.log.length} event(s).`);
+
+  // 2. Validate: SHACL shapes + the §3 authority-chain invariant, over YOUR data, with no
+  //    call out to MetaMynd — this is the same check mmt-graph.auditor.mjs's replay mode
+  //    runs later, offered here for your own use during normal operation.
+  const report = await engine.validate();
+  console.log(`2. Validated: conforms=${report.conforms}, unreachable agents=${report.unreachableAgents.length}`);
+
+  // 3. Query: this is a real, general-purpose RDF graph, not a fixed set of report
+  //    endpoints — ask it anything expressible in SPARQL 1.1.
+  const rows = [...engine.query('PREFIX mmt: <https://schema.metamynd.ai/trust/v1#> SELECT ?agent WHERE { ?agent a mmt:AIAgent }')];
+  console.log(`3. Queried: ${rows.length} agent(s) known to this graph.`);
+
+  // 4. Batch: hash the event log into a Merkle root ready to anchor. Only the root needs
+  //    to leave your infrastructure.
+  const batch = buildChangelogBatch(engine.log);
+  console.log(`4. Batched: root=${batch.root.slice(0, 16)}… (${batch.size} event(s))`);
+
+  // 5. Anchor: `submit` is the ENTIRE seam between this package and Hedera. Replace this
+  //    stub with your own @hashgraph/sdk client — see mmt-graph.anchor-live-demo.mjs for a
+  //    complete, real example (topic creation, transaction signing, receipt handling)
+  //    against your own testnet or mainnet account. Nothing else in this package needs to
+  //    change: anchorBatch() only ever calls the function you give it.
+  async function submit(message) {
+    // <-- NETWORK CALL: replace this stub with a real Hedera TopicMessageSubmitTransaction.
+    console.log(`   (stub submit — in a real deployment this line submits "${message.slice(0, 40)}…" to YOUR HCS topic)`);
+    return { transactionId: 'stub-tx-id', status: 'STUB_NOT_SUBMITTED' };
+  }
+  const receipt = await anchorBatch(batch, submit);
+  console.log(`5. Anchored (stub): status=${receipt.status}`);
+
+  // 6. Verify: prove to anyone — a regulator, an auditor, yourself six months from now —
+  //    that this exact log is what was anchored, and that the graph it produces is sound,
+  //    without needing this script, this engine instance, or MetaMynd to still exist.
+  const verification = await verifyReplayedLog(engine.log, batch.root);
+  console.log(`6. Verified independently: valid=${verification.valid}`);
+  for (const c of verification.checks) console.log(`   ${c.ok ? '✓' : '✗'} ${c.check}`);
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exitCode = 1;
+});

package/mmt-graph.shapes.ttl

@@ -0,0 +1,39 @@
+# SHACL shapes for the MMTO reference engine. Structural, per-node invariants only — the
+# graph-wide reachability property (does an agent's chain actually terminate at a
+# Principal) is not expressible as a shape over a `+` path with SHACL alone, so it stays a
+# SPARQL ASK in mmt-graph.engine.mjs. That split is what the storage-engine spike proved
+# out (PR #382), not a new design.
+#
+# See docs/design/metamynd-trust-ontology.md Appendix A for the ODRL operator vocabulary
+# and §3 for the authority-chain invariant these shapes are a structural piece of.
+
+@prefix mmt: <https://schema.metamynd.ai/trust/v1#> .
+@prefix sh: <http://www.w3.org/ns/shacl#> .
+@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .
+
+# Every mandate was granted to exactly one agent. Domain C, and the closest thing to a
+# universal invariant a Mandate row has: mandate.types.ts's Mandate type has no notion of
+# "granted to nobody" or "granted to more than one agent" — a Policy row's agentIdentityId
+# is a single column, not a list.
+mmt:MandateShape a sh:NodeShape ;
+  sh:targetClass mmt:Mandate ;
+  sh:property [
+    sh:path mmt:grantedTo ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+  ] .
+
+# Mirrors policy-core/delegation.ts's MAX_DELEGATION_DEPTH = 3: depth exactly 3 is valid,
+# depth 4 is refused. Every agent carrying a recorded delegation depth must be within
+# bounds — this is a structural check on the literal the projector attaches, not a walk of
+# the derivesAuthorityFrom chain itself (SHACL can't count `+` path length).
+mmt:DelegationDepthShape a sh:NodeShape ;
+  sh:targetSubjectsOf mmt:delegationDepth ;
+  sh:property [
+    sh:path mmt:delegationDepth ;
+    sh:datatype xsd:integer ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+    sh:minInclusive 1 ;
+    sh:maxInclusive 3 ;
+  ] .