@rigour-labs/core 6.2.0 → 6.2.1

package/dist/firewall/trusted-control.d.ts

@@ -29,6 +29,7 @@ interface GrantInput {
     parentCapabilityId?: string;
 }
 export declare function loadTrustedGrant(cwd: string, id: string, controlRoot?: string): Promise<CapabilityGrant | null>;
+export declare function listTrustedGrants(cwd: string, limit?: number, controlRoot?: string): Promise<CapabilityGrant[]>;
 export declare function issueTrustedGrant(cwd: string, input: GrantInput, controlRoot?: string): Promise<CapabilityGrant>;
 export declare function consumeTrustedGrant(cwd: string, input: {
     id: string;

package/dist/firewall/trusted-control.js

@@ -117,6 +117,25 @@ export async function loadTrustedGrant(cwd, id, controlRoot) {
         return null;
     return fs.readJson(source);
 }
+export async function listTrustedGrants(cwd, limit = 100, controlRoot) {
+    const grantsDir = path.join(getTrustedControlDir(cwd, controlRoot), 'capabilities');
+    if (!await fs.pathExists(grantsDir))
+        return [];
+    const files = (await fs.readdir(grantsDir))
+        .filter((file) => /^[0-9a-f-]{36}\.json$/i.test(file));
+    const grants = await Promise.all(files.map(async (file) => {
+        try {
+            return await fs.readJson(path.join(grantsDir, file));
+        }
+        catch {
+            return null;
+        }
+    }));
+    const requested = Number.isFinite(limit) ? Math.max(1, Math.floor(limit)) : 100;
+    return grants.filter((grant) => grant !== null)
+        .sort((a, b) => b.expiresAt - a.expiresAt)
+        .slice(0, requested);
+}
 function assertDelegationSubset(parent, input) {
     if (parent.used)
         throw new Error('Parent capability is already consumed');

package/dist/firewall/trusted-control.test.js

@@ -2,7 +2,7 @@ import { afterEach, describe, expect, it } from 'vitest';
 import fs from 'fs-extra';
 import os from 'os';
 import path from 'path';
-import { appendExecutionReceipt, consumeTrustedGrant, getTrustedControlDir, issueTrustedGrant, normalizeMcpAction, saveGatewayConfig, verifyExecutionReceiptChain, } from './index.js';
+import { appendExecutionReceipt, consumeTrustedGrant, getTrustedControlDir, issueTrustedGrant, listTrustedGrants, normalizeMcpAction, saveGatewayConfig, verifyExecutionReceiptChain, } from './index.js';
 const repositories = [];
 const controlRoots = [];
 async function repository() {
@@ -37,6 +37,19 @@ describe('trusted gateway control', () => {
         expect(location.startsWith(cwd)).toBe(false);
         expect(await fs.pathExists(location)).toBe(true);
     });
+    it('lists valid grants without failing on malformed control files', async () => {
+        const cwd = await repository();
+        const root = await controlRoot();
+        const grant = await issueTrustedGrant(cwd, {
+            issuerId: 'owner', subjectId: 'agent-1', taskId: 'task-1',
+            action: 'mcp.call', resource: 'mcp://files/read', ttlMs: 60_000,
+        }, root);
+        const grantsDir = path.join(getTrustedControlDir(cwd, root), 'capabilities');
+        await fs.writeFile(path.join(grantsDir, 'not-a-grant.json'), '{broken');
+        await expect(listTrustedGrants(cwd, 10, root)).resolves.toEqual([
+            expect.objectContaining({ id: grant.id, resource: 'mcp://files/read' }),
+        ]);
+    });
     it('consumes a capability exactly once', async () => {
         const cwd = await repository();
         const root = await controlRoot();

package/dist/services/engineering-knowledge-graph.d.ts

@@ -1,7 +1,8 @@
 import type { DependencyGraph } from '../context/dependency-graph.js';
+import type { CapabilityGrant, ExecutionReceipt } from '../firewall/types.js';
 import type { LessonRecord } from '../storage/lessons.js';
 import type { AgentHistoryEvent, AgentRun } from './agent-history.js';
-export type KnowledgeNodeType = 'repository' | 'file' | 'agent' | 'task' | 'run' | 'advice' | 'pattern' | 'memory' | 'lesson' | 'policy' | 'outcome';
+export type KnowledgeNodeType = 'repository' | 'file' | 'agent' | 'task' | 'run' | 'gateway' | 'action' | 'capability' | 'advice' | 'pattern' | 'memory' | 'lesson' | 'policy' | 'outcome';
 export interface KnowledgeNode {
     id: string;
     type: KnowledgeNodeType;
@@ -16,7 +17,7 @@ export interface KnowledgeEdge {
     id: string;
     from: string;
     to: string;
-    type: 'contains' | 'imports' | 'performed' | 'belongs_to' | 'touched' | 'produced' | 'resulted_in' | 'defined_in' | 'protects' | 'remembered' | 'guided' | 'informed';
+    type: 'contains' | 'imports' | 'performed' | 'belongs_to' | 'touched' | 'produced' | 'resulted_in' | 'defined_in' | 'protects' | 'remembered' | 'guided' | 'informed' | 'routes_through' | 'governed_by' | 'authorized_by' | 'delegated_from';
 }
 export interface EngineeringKnowledgeGraph {
     schemaVersion: 1;
@@ -49,6 +50,18 @@ interface GraphInput {
         detail?: string;
         source?: string;
     }>;
+    gateway?: {
+        mode: 'observe' | 'enforce';
+        agentId: string;
+        taskId: string;
+        serverCount: number;
+        toolCount: number;
+        chainValid: boolean;
+        receiptCount: number;
+        chainReason?: string;
+    } | null;
+    receipts?: ExecutionReceipt[];
+    capabilities?: CapabilityGrant[];
     maxFiles?: number;
 }
 export declare function buildEngineeringKnowledgeGraph(input: GraphInput): EngineeringKnowledgeGraph;

package/dist/services/engineering-knowledge-graph.js

@@ -5,6 +5,100 @@ function shortPath(value) {
 function shortLabel(value, limit = 72) {
     return value.length > limit ? `${value.slice(0, limit - 1)}…` : value;
 }
+function addGatewayFoundation(input, repoId, addNode, addEdge) {
+    const gatewayId = 'gateway:rigour-mcp';
+    const policyId = 'policy:rigour-mcp-gateway';
+    const gateway = input.gateway;
+    addNode({
+        id: gatewayId,
+        type: 'gateway',
+        label: 'Trusted MCP gateway',
+        detail: `${gateway.serverCount} servers · ${gateway.toolCount} allowed tools`,
+        state: gateway.mode,
+        repositoryId: input.repository.id,
+        weight: 8,
+        evidence: { chainValid: gateway.chainValid, receiptCount: gateway.receiptCount, chainReason: gateway.chainReason },
+    });
+    addNode({ id: policyId, type: 'policy', label: 'MCP capability policy', detail: `${gateway.mode} mode`, state: gateway.mode, weight: 7 });
+    addEdge(gatewayId, policyId, 'governed_by');
+    addEdge(policyId, repoId, 'protects');
+    const agentId = `agent:${gateway.agentId}`;
+    const taskId = `task:${gateway.taskId}`;
+    addNode({ id: agentId, type: 'agent', label: gateway.agentId, weight: 5 });
+    addNode({ id: taskId, type: 'task', label: gateway.taskId, weight: 4 });
+    addEdge(agentId, taskId, 'performed');
+    return { gatewayId, policyId };
+}
+function addCapabilityEvidence(capabilities, gatewayId, writer) {
+    const { addNode, addEdge } = writer;
+    const selected = capabilities.slice(0, 100);
+    const selectedIds = new Set(selected.map(capability => capability.id));
+    for (const capability of selected) {
+        const capabilityId = `capability:${capability.id}`;
+        const state = capability.used ? 'consumed' : capability.expiresAt < Date.now() ? 'expired' : 'available';
+        addNode({
+            id: capabilityId,
+            type: 'capability',
+            label: `${capability.action} · ${shortLabel(capability.resource, 48)}`,
+            detail: `${capability.subjectId ?? capability.agentId ?? 'unknown actor'} · ${state}`,
+            state,
+            weight: 3,
+            evidence: { expiresAt: capability.expiresAt, issuerId: capability.issuerId, subjectId: capability.subjectId },
+        });
+        addEdge(capabilityId, gatewayId, 'authorized_by');
+        if (capability.parentCapabilityId) {
+            const parentId = `capability:${capability.parentCapabilityId}`;
+            if (!selectedIds.has(capability.parentCapabilityId)) {
+                addNode({ id: parentId, type: 'capability', label: 'Parent capability', detail: 'Referenced by delegated grant', state: 'referenced', weight: 2 });
+            }
+            addEdge(capabilityId, parentId, 'delegated_from');
+        }
+    }
+}
+function addReceiptEvidence(receipts, repositoryId, gatewayId, policyId, writer) {
+    const { addNode, addEdge } = writer;
+    for (const receipt of receipts.slice(-100)) {
+        const actionId = `action:${receipt.id}`;
+        const agentId = `agent:${receipt.action.actorId}`;
+        const taskId = `task:${receipt.action.taskId}`;
+        const outcomeId = `outcome:receipt:${receipt.id}`;
+        addNode({ id: agentId, type: 'agent', label: receipt.action.actorId, weight: 5 });
+        addNode({ id: taskId, type: 'task', label: receipt.action.taskId, weight: 4 });
+        addNode({
+            id: actionId,
+            type: 'action',
+            label: receipt.action.operation,
+            detail: `${receipt.action.resource} · ${receipt.mode}`,
+            state: receipt.simulatedDecision ? `would ${receipt.simulatedDecision}` : receipt.decision,
+            repositoryId,
+            weight: receipt.outcome === 'denied' ? 5 : 3,
+            evidence: {
+                receiptId: receipt.id,
+                outcome: receipt.outcome,
+                mode: receipt.mode,
+                decision: receipt.decision,
+                simulatedDecision: receipt.simulatedDecision,
+                createdAt: receipt.createdAt,
+            },
+        });
+        addNode({ id: outcomeId, type: 'outcome', label: receipt.outcome, detail: receipt.reason, state: receipt.outcome, weight: 3 });
+        addEdge(agentId, actionId, 'performed');
+        addEdge(actionId, taskId, 'belongs_to');
+        addEdge(actionId, gatewayId, 'routes_through');
+        addEdge(actionId, policyId, 'governed_by');
+        addEdge(actionId, outcomeId, 'resulted_in');
+        if (receipt.capabilityId)
+            addEdge(actionId, `capability:${receipt.capabilityId}`, 'authorized_by');
+    }
+}
+function addGatewayEvidence(input, repoId, addNode, addEdge) {
+    if (!input.gateway)
+        return;
+    const { gatewayId, policyId } = addGatewayFoundation(input, repoId, addNode, addEdge);
+    const writer = { addNode, addEdge };
+    addCapabilityEvidence(input.capabilities ?? [], gatewayId, writer);
+    addReceiptEvidence(input.receipts ?? [], input.repository.id, gatewayId, policyId, writer);
+}
 export function buildEngineeringKnowledgeGraph(input) {
     const nodes = new Map();
     const edges = new Map();
@@ -100,6 +194,7 @@ export function buildEngineeringKnowledgeGraph(input) {
         });
         addEdge(repoId, memoryId, 'remembered');
     }
+    addGatewayEvidence(input, repoId, addNode, addEdge);
     for (const event of input.events) {
         if (!event.guidance)
             continue;
@@ -171,7 +266,9 @@ export function buildEngineeringKnowledgeGraph(input) {
             || input.runs.length > 100
             || input.lessons.length > 150
             || (input.patterns?.length ?? 0) > 120
-            || (input.memories?.length ?? 0) > 100,
+            || (input.memories?.length ?? 0) > 100
+            || (input.receipts?.length ?? 0) > 100
+            || (input.capabilities?.length ?? 0) > 100,
         counts,
     };
 }

package/dist/services/engineering-knowledge-graph.test.js

@@ -56,4 +56,21 @@ describe('engineering knowledge graph', () => {
         expect(graph.edges).toContainEqual(expect.objectContaining({ from: 'run:run-1', to: 'advice:run-1', type: 'guided' }));
         expect(graph.edges).toContainEqual(expect.objectContaining({ from: 'pattern:pattern-1', to: 'advice:run-1', type: 'informed' }));
     });
+    it('shows trusted gateway receipts, simulated denials and capability lineage', () => {
+        const graph = buildEngineeringKnowledgeGraph({
+            repository: { id: 'repo-a', name: 'payments' }, events: [], runs: [], lessons: [],
+            gateway: { mode: 'observe', agentId: 'agent-1', taskId: 'task-1', serverCount: 1, toolCount: 2, chainValid: true, receiptCount: 1 },
+            capabilities: [{ id: 'child', action: 'mcp.call', resource: 'mcp://github/get_issue', expiresAt: Date.now() + 1000, policyHash: 'hash', used: false, issuerId: 'owner', subjectId: 'agent-1', parentCapabilityId: 'parent' }],
+            receipts: [{
+                    version: 1, id: 'receipt-1', repositoryId: 'repo-a', mode: 'observe', decision: 'allow', simulatedDecision: 'deny',
+                    reason: 'would deny', policyHash: 'hash', outcome: 'forwarded', createdAt: '2026-01-01T00:00:00Z', digest: 'digest', signature: 'signature',
+                    action: { version: 1, actorId: 'agent-1', taskId: 'task-1', channel: 'mcp', operation: 'github__get_issue', resource: 'mcp://github/get_issue', environment: 'local', sideEffect: 'read', reversibility: 'high', sensitivity: 'normal', blastRadius: 'single-resource' },
+                    capabilityId: 'child',
+                }],
+        });
+        expect(graph.nodes).toContainEqual(expect.objectContaining({ type: 'gateway', evidence: expect.objectContaining({ chainValid: true }) }));
+        expect(graph.nodes).toContainEqual(expect.objectContaining({ type: 'action', state: 'would deny' }));
+        expect(graph.edges).toContainEqual(expect.objectContaining({ from: 'capability:child', to: 'capability:parent', type: 'delegated_from' }));
+        expect(graph.edges).toContainEqual(expect.objectContaining({ from: 'action:receipt-1', to: 'gateway:rigour-mcp', type: 'routes_through' }));
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "6.2.0",
+  "version": "6.2.1",
   "description": "AI-native quality gate engine with local Bayesian learning. AST analysis, drift detection, Fix Packet generation, and agent self-healing across TypeScript, JavaScript, Python, Go, Ruby, and C#.",
   "license": "MIT",
   "homepage": "https://rigour.run",
@@ -67,11 +67,11 @@
     "pg": "^8.16.3",
     "sqlite3": "^5.1.7",
     "openai": "^4.104.0",
-    "@rigour-labs/brain-darwin-arm64": "6.2.0",
-    "@rigour-labs/brain-linux-arm64": "6.2.0",
-    "@rigour-labs/brain-darwin-x64": "6.2.0",
-    "@rigour-labs/brain-win-x64": "6.2.0",
-    "@rigour-labs/brain-linux-x64": "6.2.0"
+    "@rigour-labs/brain-darwin-arm64": "6.2.1",
+    "@rigour-labs/brain-darwin-x64": "6.2.1",
+    "@rigour-labs/brain-linux-arm64": "6.2.1",
+    "@rigour-labs/brain-linux-x64": "6.2.1",
+    "@rigour-labs/brain-win-x64": "6.2.1"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",