@prooflane/inspector-beta 0.1.0-beta.0

package/README.md

@@ -0,0 +1,146 @@
+# @prooflane/inspector-beta
+
+The **Prooflane Inspector Beta** — a local MCP assurance console that runs on your
+machine and connects to Prooflane's hosted intelligence.
+
+```bash
+npx @prooflane/inspector-beta@beta
+```
+
+This starts the console at `http://localhost:7357` and opens it in your browser.
+Sign in with your Prooflane account, connect an MCP server, and go.
+
+## What it does
+
+- **MCP Inspector, Contracts, Prompts, Performance, HTTP** — run locally against
+  your MCP server with your own keys.
+- **Security & RAG** — run **signed hosted-Intelligence tasks**: the Control Plane
+  issues a short-lived task, your local runner executes it with your own MCP/LLM
+  credentials, and only compact evidence is returned. *(Scale plan and above.)*
+- **Governed Gates / CI** — capture and tag tests locally, compose their logical
+  references into a project-scoped Cloud Suite, review and approve its immutable
+  signed version, then create a Gate that pins that exact Suite and Policy. Run
+  the same approved signed Gate from the UI, another machine, or GitHub Actions
+  without copying a local Gate or Suite file:
+
+  ```bash
+  npx --yes @prooflane/cli@latest gate "$MCP_CONFIG" --gate production --github
+  ```
+
+  The signed Cloud manifest carries logical references only. The matching local
+  `.prooflane/tags.json`, MCP configuration, credentials, and raw evidence stay
+  on the Runner. Configure the project's GitHub OIDC trust in Settings, set
+  `PROOFLANE_PROJECT`, and grant the workflow `id-token: write` plus
+  `checks: write`; no long-lived Prooflane repository secret is required. The
+  Runner resolves and verifies the exact signed Gate, Suite, and Policy before
+  target access, writes a sanitized Step Summary and native Check linked to the
+  governed Run, and synchronizes only compact Run metadata. The Gate card's **Run connected
+  target** action records a `LOCAL_UI` Run. **Run on private Runner** dispatches
+  the same exact signed Gate graph to a registered customer-local worker; that
+  worker invokes the same generic executor/evaluator and returns only structured
+  progress plus compact evidence under one governed Run ID.
+
+  Execution errors never become passing facts. Performance with no completed
+  requests is not evaluated, and performance with zero successful requests is
+  always blocking before customer thresholds are considered.
+
+  A signature alone does not earn `CI READY`. Gate approval verifies that every
+  required control has a public Runner adapter and a pinned target surface; a
+  local readiness Run then proves the exact tagged tests/project assets and
+  live MCP capability fingerprints before any control call. Non-exact target
+  drift is classified and produces a reviewable DRAFT vN+1. The approved vN is
+  never mutated or silently weakened.
+
+  ```bash
+  prooflane runner register "$MCP_CONFIG" --project "$PROOFLANE_PROJECT" --name production-private
+  prooflane runner start "$MCP_CONFIG"
+  ```
+
+  The owner-only Runner credential stays local at
+  `~/.prooflane/remote-runner.json` by default. Signed jobs are bound to the
+  registered Runner and target fingerprint and expire if not claimed. MCP
+  configuration, credentials, prompts, documents, and tool inputs/outputs never
+  enter the job/event/Run envelopes. Online `LEASED_INTELLIGENCE` controls use
+  the same path on every surface: the private Control Plane selects one bounded
+  step, signs a five-minute one-use lease bound to the exact Run/Runner/artifact
+  graph and target/capability fingerprints, and the shared Core executor
+  verifies it before the local MCP call. Only compact outcome, timing,
+  counts/booleans, and a one-way output hash return; raw output stays local.
+
+  Online resolution also populates an owner-only immutable artifact cache.
+  `prooflane suites cache` inspects only sanitized Gate/Suite/Policy identities.
+  An exact reference can run without Control Plane access:
+
+  ```bash
+  prooflane gate "$MCP_CONFIG" --gate production@12 --offline --github
+  ```
+
+  Offline mode never accepts a symbolic alias. In GitHub it requires a
+  prior-online, token-bound CI continuity record and writes compact pending Run
+  sync only. A later authenticated online invocation replays it idempotently;
+  no raw evidence, credential, token, or target configuration enters the cache
+  or queue. Leased controls explicitly fail before target access offline because
+  fresh Control Plane issuance and authoritative nonce consumption are required.
+
+  Existing `.prooflane/suites/*.json` files are preserved through an explicit
+  migration review:
+
+  ```bash
+  prooflane suites status
+  prooflane suites diff
+  prooflane suites sync        # preview only
+  prooflane suites sync --yes  # Cloud DRAFTs only
+  ```
+
+  The Inspector's Gates screen shows the same **Review & Sync** plan. Neither
+  surface edits/deletes local files or silently approves anything. Full local
+  test bodies stay on the device; only a fingerprint, aggregate pillar counts,
+  and logical project-asset controls enter the Cloud DRAFT. A different existing
+  Cloud DRAFT is a conflict, not an overwrite. After separate Cloud review,
+  Policy pinning, and approval, use the unambiguous compatibility source:
+
+  ```bash
+  prooflane gate "$MCP_CONFIG" --suite-file .prooflane/suites/rag-nightly.json
+  ```
+
+  The approved signed Cloud manifest must match the exact file fingerprint
+  before target access. Unsupported private/legacy controls fail closed.
+
+- **Governed learning** — after a completed Gate-bound Run records compact
+  REVIEW or BLOCK pillar findings, the Gates screen can approve an attributed
+  immutable disposition and request the next learning generation. The private
+  Control Plane may propose DRAFT regression, evolution, or suppression-
+  validation tests, each linked to the exact historical Run, finding,
+  disposition, Gate, Suite, Policy, target fingerprint, and evidence
+  fingerprint. Creator, reviewer, and approver are distinct identities.
+  Ambiguous lineage is skipped. Raw prompts, responses, documents, MCP/tool
+  traffic, credentials, provider routing, and local paths remain on the device;
+  learning is optional and cannot block Gate execution or Run synchronization.
+
+The local Runner is designed to keep MCP connection configuration and provider
+credentials on this device. Data handling for optional hosted workflows is
+shown before those workflows are enabled.
+
+## Execution boundary
+
+The package includes the public generic local execution primitives and signed
+Cloud Gate/Suite/Policy resolvers. It does not ship Prooflane's proprietary Security/RAG
+catalogues or silently fall back to mutable repository-local Suite governance.
+Provider credentials and MCP authentication remain process-local. Raw prompts,
+responses, tool inputs, and credentials are not part of a Cloud Gate/Suite or
+compact governed Run.
+
+Runs and Deployment Assurance consume the same merged local/governed evidence
+projection. Signed executions retain the exact Run ID and Gate/Suite/Policy
+version IDs, versions, hashes, runner type, target fingerprint, and compact
+evidence fingerprint. Pillar-specific detailed reports remain local; they do
+not create a second cloud Gate history.
+
+## Options
+
+| Flag / env | Default |
+|---|---|
+| `--port` / `KAWACH_UI_PORT` | `7357` |
+| `--control-plane` / `KAWACH_CONTROL_PLANE_URL` | production Control Plane (`https://api.prooflane.ai`) |
+
+Requires **Node 24+**.

package/bin/prooflane.mjs

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+// Prooflane Inspector launcher.
+//
+// Starts the bundled thin local server, pointed at the Prooflane
+// Control Plane, and opens the console in your browser. The local runner holds
+// your MCP credentials. Security/RAG Intelligence is leased from the Prooflane
+// Control Plane and executed through bounded generic local primitives.
+//
+//   npx @prooflane/inspector-beta@beta
+//   npx @prooflane/inspector-beta@beta --port 7400 --control-plane https://api.prooflane.ai
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const dist = join(here, "..", "dist");
+
+const args = process.argv.slice(2);
+const flag = (name) => {
+  const i = args.indexOf(name);
+  return i >= 0 ? args[i + 1] : undefined;
+};
+
+// The same npm package serves both experiences: no command opens the Inspector;
+// CLI commands execute headlessly and never start a browser or local web server.
+const cliCommands = new Set(["gate", "runs", "auth", "perf", "debug", "doctor", "version", "sammy"]);
+const cliMode = cliCommands.has(args[0]);
+if (cliMode) {
+  await import(join(dist, "cli.mjs"));
+} else {
+
+// The public beta release uses production identity, entitlements, and hosted
+// intelligence. Explicit --control-plane / KAWACH_CONTROL_PLANE_URL overrides
+// remain available for operator-owned staging verification.
+const PRODUCTION_CONTROL_PLANE = "https://api.prooflane.ai";
+
+// Public Prooflane Auth0 SPA config (PKCE — these are public values, not secrets).
+const AUTH0_DOMAIN = "auth.prooflane.ai";
+const AUTH0_CLIENT_ID = "H00LlLQ4HFNUdkeDSgXxWpLmxqjUiU7W";
+const AUTH0_AUDIENCE = "https://api.kawach.io";
+
+const env = process.env;
+env.KAWACH_CONTROL_PLANE_URL = flag("--control-plane") ?? env.KAWACH_CONTROL_PLANE_URL ?? PRODUCTION_CONTROL_PLANE;
+env.KAWACH_UI_DIST = env.KAWACH_UI_DIST ?? join(dist, "ui");
+env.KAWACH_UI_PORT = flag("--port") ?? env.KAWACH_UI_PORT ?? "7357";
+// This is a public production package, never an internal compatibility build.
+// Override any inherited value so a caller cannot re-enable local proprietary
+// orchestration through an environment variable.
+env.KAWACH_INTELLIGENCE_MODE = "hosted";
+env.AUTH0_DOMAIN = env.AUTH0_DOMAIN ?? AUTH0_DOMAIN;
+env.AUTH0_CLIENT_ID = env.AUTH0_CLIENT_ID ?? AUTH0_CLIENT_ID;
+env.AUTH0_AUDIENCE = env.AUTH0_AUDIENCE ?? AUTH0_AUDIENCE;
+
+const port = env.KAWACH_UI_PORT;
+const url = `http://localhost:${port}`;
+
+async function openBrowser() {
+  const { spawn } = await import("node:child_process");
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const cmdArgs = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    spawn(cmd, cmdArgs, { stdio: "ignore", detached: true }).unref();
+  } catch {
+    /* the URL is printed below regardless */
+  }
+}
+
+console.log(`\n  Prooflane Inspector Beta → ${url}`);
+console.log(`  Control Plane: ${env.KAWACH_CONTROL_PLANE_URL}`);
+console.log("  Intelligence mode: hosted relay + local private execution");
+console.log(`  Sign in with your Prooflane account to run Security / RAG and generate CI tokens.\n`);
+
+// Start the bundled server (it binds 127.0.0.1:KAWACH_UI_PORT), then open the UI.
+await import(join(dist, "server.mjs"));
+setTimeout(() => void openBrowser(), 1200);
+}