@shield-agent/kya 0.5.0 → 0.6.0

package/.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.5.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.6.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/LIMITATIONS.md

@@ -32,3 +32,4 @@
 - Grok (grok.com) custom connectors need a public HTTPS URL. Localhost and private IPs are rejected. If the UI only offers OAuth or no auth, use Codex, Gemini CLI, or the xAI SDK instead of turning auth off.
 - Local HTTP MCP remains loopback-only. Do not bind it to a public interface.
 - Optional `kya sandbox` (Firecracker) is a runtime wrap beside the gate, not a hypervisor product. Binaries are not in npm. Default off (`KYA_SANDBOX`). MCP still never executes spawn/exec. Kernel bugs and unwrapped shells remain residual risk (see ADR 0007).
+- `kya certify` is evidence-only: it reads local state (trail, ORR, wired hosts, sandboxes, receipts, showback, attestations) and writes a gap report. It never ALLOWs, DENYs, approves, or blocks a tool call, and it is not a second PEP. `pass` means "local evidence shows no gap" — not certification by any third party. Signed evidence bundles (`--sign`) are self-signed: they prove integrity and continuity of a key, not identity; identity binding is the hosted verification product. Attestations are unverified operator statements recorded locally in `.kya/attestations.json`.

package/README.md

@@ -130,10 +130,18 @@ Tag sessions with `KYA_HOST=ide` or `KYA_HOST=runtime`. Same policy path either
 | `KYA_AGENT_ID` | After register | Agent principal id |
 | `KYA_MCP_PORT` | No (default `3920`) | HTTP MCP listen port |
 | `KYA_OFFLINE` | No | `1`/`true` for sample evaluate |
+| `KYA_HOLD` | No | `1`/`true` for the org Hold path (REQUIRE_APPROVE opens a human ticket) |
 | `KYA_DASH_PLAN` | No | `enterprise` unlocks licensed TUI panes |
 | `KYA_DIFF_PREVIEW` | No | `0` disables clipped change previews on the receipt |
 | `KYA_RECEIPT_AUTO` | No | `0` disables auto-open receipt after wrap; `1` forces |
 
+Gate mode can also be pinned in the project's `.kya/config.json`:
+`{"gateMode": "hold"}` or `{"gateMode": "offline"}` (exact values only —
+anything else is ignored). The gate itself (wrap / hook / eval) honors it
+with the precedence flags > env > config > observe, and `kya certify`
+reports through the same resolver, so a certify pass on gate mode always
+reflects how the gate actually runs.
+
 ## MCP tools
 
 | Tool | Role |
@@ -149,7 +157,7 @@ MCP Registry entry: `server.json` plus package `mcpName` `io.github.The-Pixel-Bo
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.5.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.6.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "http://127.0.0.1:8090",
         "KYA_API_KEY": "${KYA_API_KEY}",
@@ -176,7 +184,7 @@ npx @shield-agent/kya reject --id <approval-id>
 
 ```bash
 # Prefer a preinstalled package (no registry auto-install):
-npx --no-install @shield-agent/kya@0.5.0 serve-mcp --stdio
+npx --no-install @shield-agent/kya@0.6.0 serve-mcp --stdio
 # Or after npm i -g / local install:
 kya serve-mcp --stdio
 ```
@@ -187,7 +195,7 @@ Copy `claude/claude_desktop_config.example.json` into Claude Desktop MCP setting
 
 ## OpenAI (Codex / Responses)
 
-**Codex CLI / IDE:** copy `openai/codex.config.example.toml` into `~/.codex/config.toml`. Local stdio uses `npx --no-install @shield-agent/kya@0.5.0 serve-mcp --stdio`. Hosted Codex uses `url = "https://shield-agent.com/mcp"` with `bearer_token_env_var = "KYA_API_KEY"`.
+**Codex CLI / IDE:** copy `openai/codex.config.example.toml` into `~/.codex/config.toml`. Local stdio uses `npx --no-install @shield-agent/kya@0.6.0 serve-mcp --stdio`. Hosted Codex uses `url = "https://shield-agent.com/mcp"` with `bearer_token_env_var = "KYA_API_KEY"`.
 
 **Responses API:** see `openai/responses-mcp.example.json` (`server_url` + `Authorization: Bearer <KYA_API_KEY>`).
 
@@ -237,6 +245,24 @@ npx @shield-agent/kya orr run --path . --out ./orr-report --producer harness.age
 
 ORR is a reporting board. Scanners, `--scorecard`, and `harness.agentshield` are evidence. They never ALLOW a high-stakes side effect, so they are not a second policy gate. AgentShield is optional and read-only: no `--fix`, no MiniClaw, no runtime hook. This package does not depend on `ecc-agentshield`. If you pass `--producer harness.agentshield` and have neither `--agentshield-json` nor an `agentshield` binary, ORR records a coverage gap and still exits 0. Explicit `--producer` always attempts; `--skip-optional-producers` only skips producers you did not ask for.
 
+## Certify (continuous agent assurance)
+
+`kya certify` evaluates the open **Agent Trust Baseline** catalog (`catalog/agent-trust-baseline-v0.json` — 30 requirements across Data & Privacy, Security, Safety, Reliability, Accountability, Society) against local evidence: the global trail, ORR output, wired hosts, sandbox inventory, receipts, showback, and your recorded attestations. It writes a gap report to `.kya/certify/` (JSON + Markdown + HTML). The gap list is your work plan.
+
+```bash
+npx @shield-agent/kya certify                  # gap report; exit 1 when gaps exist (CI-friendly)
+npx @shield-agent/kya certify --open           # open the HTML report
+npx @shield-agent/kya certify --fail-on never  # report only, always exit 0
+npx @shield-agent/kya certify --attest SOC-01 --text "Acceptable-use policy: https://example.com/aup"
+npx @shield-agent/kya certify --sign           # also emit a signed evidence-bundle.json
+```
+
+Certify is **evidence-only**. It never ALLOWs, DENYs, or blocks anything — the sole PEP remains Shield KYA. Trail-based machine checks never pass on an empty trail (they report `insufficient_evidence`). What a machine cannot check is covered by explicit local attestations (`--attest`), recorded in `.kya/attestations.json` — unverified operator statements, labeled as such.
+
+`--sign` emits `evidence-bundle.json`: canonical JSON, ed25519-signed by a locally generated key (`~/.kya/keys/evidence-ed25519.json`, mode 0600, auto-created on first use). Each `--sign` run prints the signing key fingerprint; when the key was just created the CLI notes that key continuity resets there (earlier bundles stay verifiable only under the old pubkey). A self-signed developer key proves bundle **integrity** and **continuity of a key** — **not identity**. Identity binding and the verified badge are the hosted verification product (separate). The bundle format is open and documented in `docs/certify.md`; anyone can verify a bundle offline with the embedded pubkey.
+
+Everything here is local, free, and offline: no account, no network calls, no license check. The catalog is MIT-licensed and PRs are welcome.
+
 ## Optional sandbox wrap (Firecracker)
 
 Beside the gate, not inside MCP. Opt-in only:
@@ -272,6 +298,7 @@ pnpm build
 - [Per-host recipes (23 hosts)](docs/hosts/)
 - [OTLP metrics (OSS + hosted)](docs/otlp.md)
 - [OWASP MCP governance map](docs/owasp-mcp-governance.md)
+- [kya certify — Agent Trust Baseline gap reports](docs/certify.md)
 - [Hosted operator SSO / SCIM (not in OSS CLI)](docs/hosted-operator-sso.md)
 - See also `LIMITATIONS.md` in this repo
 

package/amp/settings.example.json

@@ -2,7 +2,7 @@
   "amp.mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.5.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.6.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/catalog/agent-trust-baseline-v0.json

@@ -0,0 +1,103 @@
+{
+  "id": "agent-trust-baseline",
+  "version": "0.1.0",
+  "updated": "2026-09-18",
+  "domains": ["data-privacy", "security", "safety", "reliability", "accountability", "society"],
+  "requirements": [
+    { "id": "DP-01", "domain": "data-privacy", "title": "Agent tool calls are intercepted and recorded",
+      "text": "At least one coding host is wired to the KYA gate or PreToolUse hook, so agent tool calls are evaluated and written to the trail before execution.",
+      "severity": "high", "check": { "kind": "hooks_wired", "min": 1 } },
+    { "id": "DP-02", "domain": "data-privacy", "title": "No high-stakes writes allowed in hold mode",
+      "text": "In hold mode the gate must not ALLOW high-stakes writes; every HIGH_STAKES_WRITE must be DENY or REQUIRE_APPROVE.",
+      "severity": "critical", "check": { "kind": "trail_zero", "windowDays": 30, "match": { "verdict": "ALLOW", "reasonCode": "HIGH_STAKES_WRITE", "mode": "hold" } } },
+    { "id": "DP-03", "domain": "data-privacy", "title": "No shell execution allowed in hold mode",
+      "text": "In hold mode the gate must not ALLOW shell execution; every SHELL_EXEC must be DENY or REQUIRE_APPROVE.",
+      "severity": "critical", "check": { "kind": "trail_zero", "windowDays": 30, "match": { "verdict": "ALLOW", "reasonCode": "SHELL_EXEC", "mode": "hold" } } },
+    { "id": "DP-04", "domain": "data-privacy", "title": "Redaction by construction",
+      "text": "Raw tool arguments and secrets are never persisted to the trail, receipts, or reports; only hashes and clipped redacted previews.",
+      "severity": "high", "check": { "kind": "attest", "prompt": "Confirm the agent configuration never persists raw secrets or full arguments to local evidence stores." } },
+    { "id": "DP-05", "domain": "data-privacy", "title": "Bounded local evidence retention",
+      "text": "Trail and receipt retention is bounded (rotation or operator deletion policy) and the retention window is known.",
+      "severity": "medium", "check": { "kind": "attest", "prompt": "Confirm trail/receipt retention is bounded and state the retention window." } },
+
+    { "id": "SEC-01", "domain": "security", "title": "Gate enforces, not observe-only",
+      "text": "The policy gate runs in an enforcing mode (hold or offline), not observe-only.",
+      "severity": "high", "check": { "kind": "config_mode", "not": "observe" } },
+    { "id": "SEC-02", "domain": "security", "title": "Deny path is exercised",
+      "text": "At least one DENY verdict in the last 90 days proves enforcement is live, not theoretical.",
+      "severity": "medium", "check": { "kind": "trail_min", "windowDays": 90, "match": { "verdict": "DENY" }, "min": 1 } },
+    { "id": "SEC-03", "domain": "security", "title": "Human approval path is exercised",
+      "text": "At least one REQUIRE_APPROVE verdict in the last 90 days proves the human gate is reachable.",
+      "severity": "medium", "check": { "kind": "trail_min", "windowDays": 90, "match": { "verdict": "REQUIRE_APPROVE" }, "min": 1 } },
+    { "id": "SEC-04", "domain": "security", "title": "ORR security posture is not red",
+      "text": "The security_platform category of the latest ORR report is green or amber.",
+      "severity": "high", "check": { "kind": "orr_category", "id": "security_platform", "max": "amber" } },
+    { "id": "SEC-05", "domain": "security", "title": "No unknown tools allowed in hold mode",
+      "text": "In hold mode the gate must not ALLOW calls it cannot classify (UNKNOWN_TOOL).",
+      "severity": "high", "check": { "kind": "trail_zero", "windowDays": 30, "match": { "verdict": "ALLOW", "reasonCode": "UNKNOWN_TOOL", "mode": "hold" } } },
+
+    { "id": "SAFE-01", "domain": "safety", "title": "Never-events are never allowed",
+      "text": "Tools on the never-list were never ALLOWed in the last 365 days.",
+      "severity": "critical", "check": { "kind": "trail_zero", "windowDays": 365, "match": { "verdict": "ALLOW", "neverEvent": true } } },
+    { "id": "SAFE-02", "domain": "safety", "title": "Sandbox available for high-risk execution",
+      "text": "At least one sandbox record exists for isolating high-risk tool execution.",
+      "severity": "medium", "check": { "kind": "sandbox_inventory", "min": 1 } },
+    { "id": "SAFE-03", "domain": "safety", "title": "Latest ORR overall is not red",
+      "text": "The overall rating of the latest ORR report is green or amber.",
+      "severity": "high", "check": { "kind": "orr_overall", "max": "amber" } },
+    { "id": "SAFE-04", "domain": "safety", "title": "Destructive operations require human approval",
+      "text": "Destructive or irreversible tool calls map to REQUIRE_APPROVE or DENY in policy, never silent ALLOW.",
+      "severity": "critical", "check": { "kind": "attest", "prompt": "Confirm destructive/irreversible tool calls map to REQUIRE_APPROVE or DENY, never silent ALLOW." } },
+    { "id": "SAFE-05", "domain": "safety", "title": "Blocked actions have a retry policy",
+      "text": "A documented policy bounds automated retries of DENYed or held actions so blocks cannot be brute-forced.",
+      "severity": "medium", "check": { "kind": "attest", "prompt": "Confirm a policy bounds automated retries of blocked actions (no bypass loops)." } },
+
+    { "id": "REL-01", "domain": "reliability", "title": "Trail recording is active",
+      "text": "At least one trail event in the last 7 days proves the evidence pipeline is live.",
+      "severity": "high", "check": { "kind": "trail_min", "windowDays": 7, "match": {}, "min": 1 } },
+    { "id": "REL-02", "domain": "reliability", "title": "Unknown-tool rate is bounded",
+      "text": "UNKNOWN_TOOL calls stay at or below 5% of evaluations over the last 30 days.",
+      "severity": "medium", "check": { "kind": "trail_ratio", "windowDays": 30, "match": { "reasonCode": "UNKNOWN_TOOL" }, "maxRatio": 0.05 } },
+    { "id": "REL-03", "domain": "reliability", "title": "ORR evidence is fresh (30 days)",
+      "text": "The latest ORR report is at most 30 days old.",
+      "severity": "medium", "check": { "kind": "orr_fresh", "maxAgeDays": 30 } },
+    { "id": "REL-04", "domain": "reliability", "title": "Evidence pipeline continuity is monitored",
+      "text": "The report daemon / evidence pipeline restarts on failure under a named supervisor (pm2, systemd, monit, launchd).",
+      "severity": "low", "check": { "kind": "attest", "prompt": "Name the supervisor that restarts the evidence pipeline on failure." } },
+    { "id": "REL-05", "domain": "reliability", "title": "Receipts are generated",
+      "text": "At least one activity receipt exists in .kya/receipts.",
+      "severity": "low", "check": { "kind": "receipts_present", "min": 1 } },
+
+    { "id": "ACC-01", "domain": "accountability", "title": "Session identity on all events",
+      "text": "Every trail event carries a sessionId (schema-enforced) traceable to an operator or run.",
+      "severity": "high", "check": { "kind": "attest", "prompt": "Confirm every trail event carries a sessionId (schema-enforced) and sessions are traceable to an operator or run." } },
+    { "id": "ACC-02", "domain": "accountability", "title": "Project attribution on events",
+      "text": "Trail events carry project attribution (working-directory basename) and projects map to owned repositories.",
+      "severity": "medium", "check": { "kind": "attest", "prompt": "Confirm trail events carry project attribution and projects map to owned repositories." } },
+    { "id": "ACC-03", "domain": "accountability", "title": "ORR evidence exists (90 days)",
+      "text": "An ORR report exists and is at most 90 days old.",
+      "severity": "medium", "check": { "kind": "orr_fresh", "maxAgeDays": 90 } },
+    { "id": "ACC-04", "domain": "accountability", "title": "Cost showback is available",
+      "text": "A showback card (.kya/usage.json) exists for cost review.",
+      "severity": "low", "check": { "kind": "showback_present" } },
+    { "id": "ACC-05", "domain": "accountability", "title": "Named human policy owner",
+      "text": "A named human is accountable for the agent's policy configuration and is reachable.",
+      "severity": "high", "check": { "kind": "attest", "prompt": "Name the human accountable for the agent's policy configuration and how they are reached." } },
+
+    { "id": "SOC-01", "domain": "society", "title": "Acceptable-use policy",
+      "text": "An acceptable-use policy bounds what the agent may do.",
+      "severity": "high", "check": { "kind": "attest", "prompt": "Link or quote the acceptable-use policy bounding what the agent may do." } },
+    { "id": "SOC-02", "domain": "society", "title": "Incident-response runbook",
+      "text": "An incident-response runbook covers agent misbehavior.",
+      "severity": "high", "check": { "kind": "attest", "prompt": "Link or quote the incident-response runbook covering agent misbehavior." } },
+    { "id": "SOC-03", "domain": "society", "title": "Third-party model disclosure",
+      "text": "The third-party models/providers the agent uses are disclosed to users.",
+      "severity": "medium", "check": { "kind": "attest", "prompt": "List the third-party models/providers the agent uses and where this is disclosed." } },
+    { "id": "SOC-04", "domain": "society", "title": "Data-processing terms",
+      "text": "Data-processing terms cover user data handled by the agent.",
+      "severity": "high", "check": { "kind": "attest", "prompt": "Link or quote the data-processing terms covering user data handled by the agent." } },
+    { "id": "SOC-05", "domain": "society", "title": "Human escalation contact",
+      "text": "A human escalation contact is published for agent-caused harm.",
+      "severity": "medium", "check": { "kind": "attest", "prompt": "Publish the human escalation contact for agent-caused harm." } }
+  ]
+}

package/claude/claude_desktop_config.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.5.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.6.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/cline/cline_mcp_settings.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.5.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.6.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/copilot/mcp-config.example.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "shield-kya": {
       "command": "npx",
-      "args": ["--no-install", "@shield-agent/kya@0.5.0", "serve-mcp", "--stdio"],
+      "args": ["--no-install", "@shield-agent/kya@0.6.0", "serve-mcp", "--stdio"],
       "env": {
         "KYA_BASE_URL": "https://shield-agent.com",
         "KYA_API_KEY": "${KYA_API_KEY}",

package/dist/certify/attest.d.ts

@@ -0,0 +1,10 @@
+export interface AttestationRecord {
+    readonly requirementId: string;
+    readonly text: string;
+    readonly at: string;
+}
+export declare function attestationsPath(cwd: string): string;
+/** Latest attestation per requirement id wins. Corrupt/oversize file → empty map. */
+export declare function loadAttestations(cwd: string): Map<string, AttestationRecord>;
+export declare function recordAttestation(cwd: string, requirementId: string, text: string): AttestationRecord;
+//# sourceMappingURL=attest.d.ts.map

package/dist/certify/attest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest.d.ts","sourceRoot":"","sources":["../../src/certify/attest.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AASD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,qFAAqF;AACrF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAqC5E;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,MAAM,GACX,iBAAiB,CAwCnB"}

package/dist/certify/attest.js

@@ -0,0 +1,105 @@
+/**
+ * Operator attestations — the explicit escape hatch for requirements a machine
+ * cannot check. Local file only (<cwd>/.kya/attestations.json); never uploaded,
+ * never a PEP. Latest attestation per requirement id wins.
+ */
+import { chmodSync, mkdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { configDir } from "../config.js";
+import { assertNoSecrets, stripEscapes } from "../dash/render.js";
+import { UsageError } from "../errors.js";
+import { atomicWriteSync } from "../fs-atomic.js";
+const MAX_ATTESTATIONS_BYTES = 256 * 1024;
+const MAX_TEXT_CHARS = 2000;
+const REQ_ID = /^[A-Z]+-\d+$/;
+// Attestation text and timestamps are interpolated into single-line evidence
+// strings, reports, and signed bundles — same rule as catalog attest prompts.
+const CONTROL_CHARS = /[\x00-\x1f\x7f]/;
+export function attestationsPath(cwd) {
+    return join(configDir(cwd), "attestations.json");
+}
+/** Latest attestation per requirement id wins. Corrupt/oversize file → empty map. */
+export function loadAttestations(cwd) {
+    const map = new Map();
+    try {
+        const path = attestationsPath(cwd);
+        const st = statSync(path); // ENOENT/EACCES land in catch → empty map
+        if (!st.isFile() || st.size > MAX_ATTESTATIONS_BYTES)
+            return map;
+        const raw = JSON.parse(readFileSync(path, "utf8"));
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            return map;
+        const list = raw.attestations;
+        if (!Array.isArray(list))
+            return map;
+        for (const item of list) {
+            if (!item || typeof item !== "object" || Array.isArray(item))
+                continue;
+            const r = item;
+            if (typeof r.requirementId !== "string" ||
+                typeof r.text !== "string" ||
+                typeof r.at !== "string") {
+                continue;
+            }
+            // The store file is operator-editable; refuse entries that would break
+            // the single-line evidence contract downstream, and apply the same
+            // bidi/zero-width sanitization record applies so hand-edited entries
+            // cannot smuggle display spoofing into evidence.
+            if (CONTROL_CHARS.test(r.text) || CONTROL_CHARS.test(r.at))
+                continue;
+            const text = stripEscapes(r.text).trim();
+            if (text.length === 0)
+                continue;
+            map.set(r.requirementId, {
+                requirementId: r.requirementId,
+                text,
+                at: stripEscapes(r.at),
+            });
+        }
+    }
+    catch {
+        return new Map();
+    }
+    return map;
+}
+export function recordAttestation(cwd, requirementId, text) {
+    const id = requirementId.trim();
+    if (!REQ_ID.test(id)) {
+        throw new UsageError(`--attest id must look like DP-01, got ${JSON.stringify(requirementId)}`);
+    }
+    if (CONTROL_CHARS.test(text)) {
+        throw new UsageError("--text must not contain control characters");
+    }
+    const clean = stripEscapes(text).trim();
+    if (clean.length === 0)
+        throw new UsageError("--text must not be empty");
+    if (clean.length > MAX_TEXT_CHARS) {
+        throw new UsageError(`--text exceeds ${MAX_TEXT_CHARS} chars`);
+    }
+    try {
+        assertNoSecrets(clean);
+    }
+    catch {
+        throw new UsageError("--text looks like it contains a secret — attestations describe policy, never credentials");
+    }
+    const record = {
+        requirementId: id,
+        text: clean,
+        at: new Date().toISOString(),
+    };
+    const others = [...loadAttestations(cwd).values()].filter((r) => r.requirementId !== id);
+    const store = { version: 1, attestations: [...others, record] };
+    mkdirSync(configDir(cwd), { recursive: true, mode: 0o700 });
+    // Atomic tmp+rename: a crash or concurrent run must never truncate the
+    // store — the fail-safe load would silently discard all attestation history.
+    const path = attestationsPath(cwd);
+    atomicWriteSync(path, `${JSON.stringify(store, null, 2)}\n`);
+    try {
+        chmodSync(path, 0o600); // operator statements are sensitive — evidence-bundle perms
+    }
+    catch {
+        /* best-effort on non-POSIX */
+    }
+    return record;
+}
+//# sourceMappingURL=attest.js.map

package/dist/certify/attest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest.js","sourceRoot":"","sources":["../../src/certify/attest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAQlD,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,CAAC;AAC1C,MAAM,cAAc,GAAG,IAAI,CAAC;AAC5B,MAAM,MAAM,GAAG,cAAc,CAAC;AAC9B,6EAA6E;AAC7E,8EAA8E;AAC9E,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAExC,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,mBAAmB,CAAC,CAAC;AACnD,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,EAA6B,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,0CAA0C;QACrE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,sBAAsB;YAAE,OAAO,GAAG,CAAC;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;QAC9D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QACtE,MAAM,IAAI,GAAI,GAA+B,CAAC,YAAY,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,SAAS;YACvE,MAAM,CAAC,GAAG,IAA+B,CAAC;YAC1C,IACE,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;gBACnC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAC1B,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,EACxB,CAAC;gBACD,SAAS;YACX,CAAC;YACD,uEAAuE;YACvE,mEAAmE;YACnE,qEAAqE;YACrE,iDAAiD;YACjD,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAE,SAAS;YACrE,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAChC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE;gBACvB,aAAa,EAAE,CAAC,CAAC,aAAa;gBAC9B,IAAI;gBACJ,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,GAAW,EACX,aAAqB,EACrB,IAAY;IAEZ,MAAM,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,UAAU,CAAC,yCAAyC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,UAAU,CAAC,4CAA4C,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,0BAA0B,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,IAAI,UAAU,CAAC,kBAAkB,cAAc,QAAQ,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC;QACH,eAAe,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAClB,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAsB;QAChC,aAAa,EAAE,EAAE;QACjB,IAAI,EAAE,KAAK;QACX,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7B,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CACvD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,EAAE,CAC9B,CAAC;IACF,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAChE,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,uEAAuE;IACvE,6EAA6E;IAC7E,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACnC,eAAe,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,4DAA4D;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/certify/catalog.d.ts

@@ -0,0 +1,70 @@
+export type RequirementSeverity = "critical" | "high" | "medium" | "low";
+export interface TrailMatch {
+    readonly verdict?: string;
+    readonly reasonCode?: string;
+    readonly mode?: "observe" | "hold" | "offline";
+    readonly neverEvent?: boolean;
+}
+export type RequirementCheck = {
+    readonly kind: "config_mode";
+    readonly not: "observe";
+} | {
+    readonly kind: "hooks_wired";
+    readonly min: number;
+} | {
+    readonly kind: "trail_zero";
+    readonly windowDays: number;
+    readonly match: TrailMatch;
+} | {
+    readonly kind: "trail_min";
+    readonly windowDays: number;
+    readonly match: TrailMatch;
+    readonly min: number;
+} | {
+    readonly kind: "trail_ratio";
+    readonly windowDays: number;
+    readonly match: TrailMatch;
+    readonly maxRatio: number;
+} | {
+    readonly kind: "orr_overall";
+    readonly max: "green" | "amber";
+} | {
+    readonly kind: "orr_category";
+    readonly id: string;
+    readonly max: "green" | "amber";
+} | {
+    readonly kind: "orr_fresh";
+    readonly maxAgeDays: number;
+} | {
+    readonly kind: "sandbox_inventory";
+    readonly min: number;
+} | {
+    readonly kind: "receipts_present";
+    readonly min: number;
+} | {
+    readonly kind: "showback_present";
+} | {
+    readonly kind: "attest";
+    readonly prompt: string;
+};
+export interface CatalogRequirement {
+    readonly id: string;
+    readonly domain: string;
+    readonly title: string;
+    readonly text: string;
+    readonly severity: RequirementSeverity;
+    readonly check: RequirementCheck;
+}
+export interface Catalog {
+    readonly id: string;
+    readonly version: string;
+    readonly updated: string;
+    readonly domains: readonly string[];
+    readonly requirements: readonly CatalogRequirement[];
+}
+export declare const MAX_CATALOG_BYTES: number;
+/** Bundled catalog: <pkg>/catalog/… — works from both src/ (vitest) and dist/ (built). */
+export declare function defaultCatalogPath(): string;
+export declare function loadCatalog(path?: string): Catalog;
+export declare function validateCatalog(raw: unknown): Catalog;
+//# sourceMappingURL=catalog.d.ts.map

package/dist/certify/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/certify/catalog.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEzE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GACxF;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC7G;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACpH;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAA;CAAE,GACjE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAA;CAAE,GACvF;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE,GACrC;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;CAClC;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACtD;AAED,eAAO,MAAM,iBAAiB,QAAa,CAAC;AAqB5C,0FAA0F;AAC1F,wBAAgB,kBAAkB,IAAI,MAAM,CAI3C;AAED,wBAAgB,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAqBlD;AAsID,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CA2DrD"}