@tenova/swt3-ai 0.5.0 → 0.5.1

package/README.md

@@ -216,6 +216,35 @@ witness.witnessQuantization("gptq", { bits: 4, groupSize: 128 });
 
 Maps to: EU AI Act Art. 15(4) (resilience against modification), Art. 12(2)(b) (version logging).
 
+## Environmental Attestation (Residential and Edge AI)
+
+Witness the physical compute environment for distributed, edge-deployed, or residential AI nodes. Proves the hardware operated within safe thermal and power bounds during inference:
+
+```typescript
+// Zero-config: auto-detects Linux thermal sensors
+witness.witnessEnvironment();
+
+// Manual readings from smart panel APIs or IPMI
+witness.witnessEnvironment({
+  temperatureCelsius: 42,
+  thresholdCelsius: 75,
+  nodeType: "residential",
+});
+
+// Power integrity: draw vs capacity
+witness.witnessEnergyDraw({
+  powerWatts: 1200,
+  capacityWatts: 2400,
+  nodeType: "edge",
+});
+```
+
+If no sensors are available (dev machine, cloud VM), returns a valid anchor with zero readings. No crash, no error.
+
+Use case: enterprises renting compute on distributed residential nodes need cryptographic proof that the node was operating within safe bounds, was not throttled, and was not physically tampered with during their inference window.
+
+Maps to: NIST 800-53 PE-14 (environmental controls), EU AI Act Annex I (product safety for home-integrated AI).
+
 ## Skill Manifest Attestation
 
 Witness which skills, tools, and plugins are loaded in your agent:
@@ -291,6 +320,55 @@ The `agentId` survives all clearing levels. The `signingKey` produces an HMAC-SH
 
 Receipts include `signature_verified: true` when the server confirms the signature.
 
+## Trust Mesh (Mutual Agent Verification)
+
+Before two agents exchange data or invoke each other's tools, each verifies the other's compliance posture. No anchor, no handshake.
+
+```typescript
+// Agent A: present a signed credential
+const credentialA = witnessA.presentCredential();
+// Send credentialA to Agent B over your transport layer
+
+// Agent B: verify Agent A's credential
+witnessB.trustRegistry.trustTenant("TENANT_A");
+witnessB.trustRegistry.registerSigningKey("agent-alpha", "shared-secret-a");
+const result = witnessB.verifyTrust(credentialA);
+
+if (result.granted) {
+  // Trust level: 1=basic, 2=verified, 3=attested, 4=sovereign
+  console.log(`Trusted at level ${result.trustLevel}`);
+} else {
+  console.log(`Denied: ${result.denialReason}`);
+}
+```
+
+**Trust levels:**
+
+| Level | Name | Requires |
+|-------|------|----------|
+| 1 | Basic | Valid credential, unsigned or unverifiable |
+| 2 | Verified | Valid credential + verified HMAC signature |
+| 3 | Attested | Verified + hardware attestation + guardrails |
+| 4 | Sovereign | Attested + clearing level >= 2 |
+
+Unsigned credentials are automatically capped at TRUST_BASIC. You cannot claim a higher trust level without a verified signature.
+
+**Key exchange:** Exchange signing keys out-of-band (environment variables, secrets manager, KMS). Never send keys over the wire alongside credentials. Each agent registers the counterpart's key:
+
+```typescript
+// Agent A registers B's key, B registers A's key
+witnessA.trustRegistry.registerSigningKey("agent-beta", process.env.AGENT_B_KEY!);
+witnessB.trustRegistry.registerSigningKey("agent-alpha", process.env.AGENT_A_KEY!);
+```
+
+**Zero-friction path:** Trust mesh works without signing keys. Agents without keys get TRUST_BASIC (level 1), which is sufficient for non-sensitive coordination. Add keys when you need verified or attested trust.
+
+**Credential auto-population:** `presentCredential()` automatically includes which procedures the agent has witnessed and whether hardware attestation (AI-HW.1) has been performed. No manual tracking needed.
+
+Every verification (pass or fail) mints AI-TRUST.1 + AI-TRUST.2 anchors. Denials produce evidence too.
+
+Maps to: EU AI Act Art. 14 (human oversight and mutual accountability between AI systems).
+
 ## Gatekeeper Mode (Pre-Call Enforcement)
 
 New in v0.3.4. Require guardrails to be active *before* the model is called, not just observed after:
@@ -640,6 +718,18 @@ Your prompts and responses **never leave your infrastructure**. The SDK computes
 
 ---
 
+## Upgrading to v0.5.1
+
+**Trust Mesh (new):** `presentCredential()` and `verifyTrust()` are new methods. No breaking changes for existing code.
+
+**Credential signing (behavioral change):** If your Witness has a `signingKey`, credentials are now HMAC-signed automatically. Counterpart agents must register your key via `trustRegistry.registerSigningKey()` to verify the signature. Without key registration, signed credentials are denied with `signature_unverifiable`. If you were using trust mesh in v0.5.0 without signing keys, credentials are now capped at TRUST_BASIC (level 1). To restore full trust levels, both sides must exchange and register signing keys.
+
+**Environmental attestation (new):** `witnessEnvironment()` and `witnessEnergyDraw()` are new methods for AI-ENV.1/AI-ENV.2. No breaking changes.
+
+**MCP server:** 16 procedure keyword suggestions (was 8). No breaking changes.
+
+---
+
 ## Documentation
 
 - [SDK Reference](https://sovereign.tenova.io/docs/) -- full API, all providers, clearing levels, configuration
@@ -649,6 +739,9 @@ Your prompts and responses **never leave your infrastructure**. The SDK computes
 - [UCT Registry](https://sovereign.tenova.io/registry) -- 162 procedures, full factor definitions
 - [Anchor Verifier](https://sovereign.tenova.io/verify) -- verify any anchor, zero server calls
 - [EU AI Act Regulatory Architecture](https://sovereign.tenova.io/guides/futurium-submission.html) -- VI+CJT+ALF+LAVR framework mapping for conformity assessment bodies
+- [Five Eyes Agentic AI Overlay](https://sovereign.tenova.io/guides/five-eyes-overlay.html) -- CISA/NSA guidance mapped to SWT3 procedures
+- [CMMC Compliance Overlay](https://sovereign.tenova.io/guides/cmmc-overlay.html) -- clearing levels mapped to CMMC and NIST 800-171
+- [SR 11-7 Model Risk Overlay](https://sovereign.tenova.io/guides/sr-11-7-overlay.html) -- clearing levels mapped to SR 11-7 requirements
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tenova/swt3-ai",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "SWT3 AI Witness SDK: cryptographic attestation for AI inference",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",