@twin3-ai/agent-id 0.3.13 → 0.3.14

package/bin/agent-id.js

@@ -3,7 +3,7 @@ const { configuredEndpoint, TRUSTED_ISSUER_KEY_SHA256 } = require("../runtime-co
 const endpoint = configuredEndpoint();
 const fs = require("fs");
 const path = require("path");
-const { buildInstallPlan, preflightInstallPlan, applyInstallPlan, resumeInstall, uninstallInstall, enterpriseInstallStatus, prepareEnterpriseSecretDirectory, writeEnterpriseBootstrapCredential, readEnterpriseBootstrapCredential, replaceEnterpriseBootstrapCredential, removeEnterpriseBootstrapCredential, writeEnterpriseEnrollmentState } = require("../installer.js");
+const { buildInstallPlan, preflightInstallPlan, applyInstallPlan, resumeInstall, uninstallInstall, enterpriseInstallStatus, prepareEnterpriseSecretDirectory, writeEnterpriseVerificationCapability, readEnterpriseVerificationCapability, removeEnterpriseVerificationCapability, writeEnterpriseBootstrapCredential, readEnterpriseBootstrapCredential, replaceEnterpriseBootstrapCredential, removeEnterpriseBootstrapCredential, writeEnterpriseEnrollmentState } = require("../installer.js");
 const { buildRepositoryPatch, applyRepositoryPatch, rollbackRepositoryPatch } = require("../repository-connector.js");
 const { createRepositoryConnector } = require("../repository-connector.js");
 const { generateSiteAgentIdentity, createEnterpriseSession } = require("../enterprise-identity.js");
@@ -67,6 +67,42 @@ function readCsvFlag(argv, flag) {
   return value ? value.split(",").map((item) => item.trim()).filter(Boolean) : undefined;
 }
 
+function readSecretFileOrEnv(argv, flag, envName, label) {
+  const file = readFlagValue(argv, flag);
+  const value = file
+    ? fs.readFileSync(path.resolve(file), "utf8").trim()
+    : String(process.env[envName] || "").trim();
+  if (!value) throw new Error(`${label} is required via ${flag} or ${envName}`);
+  return value;
+}
+
+function reserveSecretOutput(target, label) {
+  if (!target) throw new Error(`${label} requires an explicit output file`);
+  const absolute = path.resolve(target);
+  const parent = path.dirname(absolute);
+  fs.mkdirSync(parent, { recursive: true, mode: 0o700 });
+  const descriptor = fs.openSync(absolute, "wx", 0o600);
+  fs.closeSync(descriptor);
+  fs.chmodSync(absolute, 0o600);
+  let committed = false;
+  return {
+    path: absolute,
+    commit(value) {
+      fs.writeFileSync(absolute, String(value), { encoding: "utf8", mode: 0o600 });
+      fs.chmodSync(absolute, 0o600);
+      committed = true;
+    },
+    abort() {
+      if (!committed) fs.rmSync(absolute, { force: true });
+    },
+  };
+}
+
+function printSiteKeyLifecycle(value, lines) {
+  if (process.argv.includes("--json")) return print(value);
+  console.log([...lines, "Use --json for the complete non-secret receipt."].join("\n"));
+}
+
 async function enterpriseSessionForProject(projectRoot) {
   const root = path.resolve(projectRoot || process.cwd());
   const state = JSON.parse(fs.readFileSync(path.join(root, ".agent-id", "enterprise-state.json"), "utf8"));
@@ -183,6 +219,7 @@ function enrollmentArtifactSnapshot(projectRoot, publicRoot) {
   const proof = resolveProofTarget({ projectRoot: project, publicRoot }).target;
   const files = [
     path.join(project, ".agent-id", "secrets", "enterprise-ed25519.pem"),
+    path.join(project, ".agent-id", "secrets", "domain-verification-capability.json"),
     path.join(project, ".agent-id", "secrets", ".gitignore"),
     path.join(project, ".agent-id", "enterprise-state.json"),
     proof,
@@ -261,6 +298,13 @@ async function createEnterpriseEnrollment({ siteUrl, projectRoot, publicRoot, en
     });
     const challenge = response && response.challenge;
     if (!challenge || !challenge.challenge_id) throw new Error(response && response.error || "enterprise_enrollment_failed");
+    const verificationCapability = String(response && response.verification_capability || "");
+    if (!verificationCapability.startsWith("dvc_")) throw new Error("enterprise_verification_capability_missing");
+    const capabilityReceipt = await writeEnterpriseVerificationCapability(
+      projectRoot,
+      challenge.challenge_id,
+      verificationCapability,
+    );
     const domainProof = method === "well_known" ? buildWellKnownProofDocument(challenge) : null;
     await writeEnterpriseEnrollmentState(projectRoot, {
       status: "challenge_pending",
@@ -288,6 +332,11 @@ async function createEnterpriseEnrollment({ siteUrl, projectRoot, publicRoot, en
       challenge,
       domain_proof: domainProof,
       proof_receipt: proofReceipt,
+      verification_capability: {
+        sealed_locally: true,
+        encrypted_at_rest: capabilityReceipt.encrypted_at_rest,
+        mode: capabilityReceipt.mode,
+      },
       identity: {
         algorithm: identity.algorithm,
         public_key_pem: identity.public_key_pem,
@@ -1357,6 +1406,9 @@ async function runCli(argv) {
       "  agent-id google-marketplace-runtime-ledger [receipt-json-file]",
       "  agent-id google-marketplace-runtime-evidence [url|evidence-json-file]",
       "  agent-id google-marketplace-test-billing",
+      "  agent-id google-operations-evidence <source-manifest.json> --operator-token-file <oidc-token-file>",
+      "  agent-id google-a2a-conformance --operator-token-file <oidc-token-file>",
+      "  agent-id google-marketplace-submit-ready <evidence-manifest.json> --operator-token-file <oidc-token-file>",
       "  agent-id google-marketplace-agent-card-validate [evidence-json-file]",
       "  agent-id google-marketplace-agent-card-gcs-pack [evidence-json-file]",
       "  agent-id google-marketplace-product-details-review [evidence-json-file]",
@@ -1461,6 +1513,9 @@ async function runCli(argv) {
       "  agent-id job-submit <job-id>",
       "  agent-id job-evaluate <job-id>",
       "  agent-id register <url>",
+      "  agent-id site-key-recovery-start <url> --capability-out <secret-file>",
+      "  agent-id site-key-recovery-complete <url> --challenge <id> --capability-file <secret-file> --key-out <secret-file>",
+      "  agent-id site-key-rotate <url> --key-file <secret-file> --key-out <secret-file> --approve",
       "  agent-id install-guide <url>",
       "  agent-id install <url> [--modules identity,audit,measurement,optimization,automation] [--grant identity_publish,public_read,telemetry_submit,insights_read,ai_files_write] [--project-root <dir>] [--public-root <dir>] [--apply]",
       "  agent-id install-resume [--project-root <dir>]",
@@ -1930,6 +1985,49 @@ async function runCli(argv) {
     }
     return print(await get("/api/agent/google_marketplace_test_billing_gate"));
   }
+  if (cmd === "google-operations-evidence") {
+    if (!url || String(url).startsWith("--")) throw new Error("source manifest JSON file is required");
+    const payload = JSON.parse(fs.readFileSync(path.resolve(url), "utf8"));
+    const token = readSecretFileOrEnv(
+      argv,
+      "--operator-token-file",
+      "AGENT_ID_OPERATOR_ID_TOKEN",
+      "Google operator OIDC token",
+    );
+    return print(await post(
+      "/api/agent/google_operations_evidence_collect",
+      payload,
+      { authorization: `Bearer ${token}` },
+    ));
+  }
+  if (cmd === "google-a2a-conformance") {
+    const token = readSecretFileOrEnv(
+      argv,
+      "--operator-token-file",
+      "AGENT_ID_OPERATOR_ID_TOKEN",
+      "Google operator OIDC token",
+    );
+    return print(await post(
+      "/api/agent/google_a2a_local_conformance",
+      {},
+      { authorization: `Bearer ${token}` },
+    ));
+  }
+  if (cmd === "google-marketplace-submit-ready") {
+    if (!url || String(url).startsWith("--")) throw new Error("evidence manifest JSON file is required");
+    const payload = JSON.parse(fs.readFileSync(path.resolve(url), "utf8"));
+    const token = readSecretFileOrEnv(
+      argv,
+      "--operator-token-file",
+      "AGENT_ID_OPERATOR_ID_TOKEN",
+      "Google operator OIDC token",
+    );
+    return print(await post(
+      "/api/agent/google_marketplace_submit_ready_decision",
+      payload,
+      { authorization: `Bearer ${token}` },
+    ));
+  }
   if (cmd === "google-marketplace-agent-card-validate") {
     const evidenceFile = url && !String(url).startsWith("--") ? url : "";
     if (evidenceFile) {
@@ -2625,6 +2723,85 @@ async function runCli(argv) {
     }));
   }
   if (cmd === "checkout") return print(await post("/api/agent/checkout", { plan: url }));
+  if (cmd === "site-key-recovery-start") {
+    if (!url) throw new Error("site-key-recovery-start requires a site URL");
+    const output = reserveSecretOutput(readFlagValue(argv, "--capability-out"), "site-key-recovery-start");
+    try {
+      const result = await post("/api/site_agents/key_recovery/start", { url });
+      if (!result.ok || !result.recovery_capability) throw new Error(result.error || "site_key_recovery_start_failed");
+      output.commit(result.recovery_capability);
+      const safe = { ...result, recovery_capability: undefined, recovery_capability_file: output.path };
+      delete safe.recovery_capability;
+      return printSiteKeyLifecycle(safe, [
+        "Site Agent Key recovery: CHALLENGE CREATED",
+        `Site: ${safe.host}`,
+        `Challenge: ${safe.challenge_id}`,
+        `DNS TXT name: ${safe.dns_txt.name}`,
+        `DNS TXT value: ${safe.dns_txt.value}`,
+        `Private capability saved: ${output.path}`,
+        `Complete: ${pinnedCliCommand("site-key-recovery-complete", [url, "--challenge", safe.challenge_id, "--capability-file", output.path, "--key-out", "<new-secret-file>"])}`,
+      ]);
+    } catch (error) {
+      output.abort();
+      throw error;
+    }
+  }
+  if (cmd === "site-key-recovery-complete") {
+    if (!url) throw new Error("site-key-recovery-complete requires a site URL");
+    const challengeId = readFlagValue(argv, "--challenge");
+    if (!challengeId) throw new Error("site-key-recovery-complete requires --challenge");
+    const capability = readSecretFileOrEnv(
+      argv, "--capability-file", "AGENT_ID_RECOVERY_CAPABILITY", "recovery capability",
+    );
+    const output = reserveSecretOutput(readFlagValue(argv, "--key-out"), "site-key-recovery-complete");
+    try {
+      const result = await post("/api/site_agents/key_recovery/complete", {
+        url,
+        challenge_id: challengeId,
+        recovery_capability: capability,
+      });
+      if (!result.ok || !result.agent_key) throw new Error(result.error || "site_key_recovery_complete_failed");
+      output.commit(result.agent_key);
+      const safe = { ...result, agent_key: undefined, agent_key_file: output.path };
+      delete safe.agent_key;
+      return printSiteKeyLifecycle(safe, [
+        "Site Agent Key recovery: COMPLETE",
+        `Site: ${safe.host}`,
+        `New key saved: ${output.path}`,
+        `Receipt: ${(safe.receipt || {}).receipt_id || "recorded"}`,
+        `Old credentials: ${safe.old_credential_status}`,
+      ]);
+    } catch (error) {
+      output.abort();
+      throw error;
+    }
+  }
+  if (cmd === "site-key-rotate") {
+    if (!url) throw new Error("site-key-rotate requires a site URL");
+    if (!argv.includes("--approve")) throw new Error("site-key-rotate requires --approve");
+    const currentKey = readSecretFileOrEnv(argv, "--key-file", "AEO_AGENT_KEY", "current Site Agent Key");
+    const output = reserveSecretOutput(readFlagValue(argv, "--key-out"), "site-key-rotate");
+    try {
+      const result = await post(
+        "/api/site_agents/key_rotate",
+        { url, approved: true },
+        { Authorization: `Bearer ${currentKey}` },
+      );
+      if (!result.ok || !result.agent_key) throw new Error(result.error || "site_key_rotation_failed");
+      output.commit(result.agent_key);
+      const safe = { ...result, agent_key: undefined, agent_key_file: output.path };
+      delete safe.agent_key;
+      return printSiteKeyLifecycle(safe, [
+        "Site Agent Key rotation: COMPLETE",
+        `Site: ${safe.host}`,
+        `New key saved: ${output.path}`,
+        `Receipt: ${(safe.receipt || {}).receipt_id || "recorded"}`,
+      ]);
+    } catch (error) {
+      output.abort();
+      throw error;
+    }
+  }
   if (cmd === "register") return print(await post("/api/site_agents/register", { url }));
   if (cmd === "install-guide") return print(await get(url ? `/api/site_agents/install_guide?url=${encodeURIComponent(url)}` : "/api/site_agents/install_guide"));
   if (cmd === "install") {
@@ -2648,8 +2825,9 @@ async function runCli(argv) {
     }
     const publicProofPath = path.posix.join(...relativePublicRoot.split(path.sep).filter(Boolean), ".well-known", "agent-id.json");
     const privateKeyPath = ".agent-id/secrets/enterprise-ed25519.pem";
+    const capabilityPath = ".agent-id/secrets/domain-verification-capability.json";
     const managedFiles = detectedPlan.files.map(({ path: filePath, mode, sha256 }) => ({ path: filePath, mode, sha256 }));
-    const plannedWrites = [...new Set([privateKeyPath, ".agent-id/enterprise-state.json", publicProofPath, ...managedFiles.map((item) => item.path)])];
+    const plannedWrites = [...new Set([privateKeyPath, capabilityPath, ".agent-id/enterprise-state.json", publicProofPath, ...managedFiles.map((item) => item.path)])];
     const plan = {
       schema: "agentx-signed-install-plan-v1",
       site_url: detectedPlan.site_url,
@@ -2803,7 +2981,11 @@ async function runCli(argv) {
         next_command: pinnedCliCommand("enterprise-identity-publish", ["--project-root", projectRoot, "--public-root", projectRoot])
       });
     }
-    const response = await post("/api/site_agents/v1/challenges/verify", { challenge_id: state.challenge_id });
+    const sealedCapability = await readEnterpriseVerificationCapability(projectRoot, state.challenge_id);
+    const response = await post("/api/site_agents/v1/challenges/verify", {
+      challenge_id: state.challenge_id,
+      verification_capability: sealedCapability.capability,
+    });
     if (!response || response.ok !== true) return print(response || { ok: false, error: "domain_verification_failed" });
     let secretReceipt;
     try {
@@ -2812,6 +2994,7 @@ async function runCli(argv) {
         response.credential,
         response.bootstrap_secret
       );
+      await removeEnterpriseVerificationCapability(projectRoot, state.challenge_id);
     } catch (_error) {
       throw new Error(`enterprise_credential_delivery_failed; request a new single-use challenge with: ${pinnedCliCommand("enterprise-enroll", [state.site_url, "--environment", state.environment, "--method", "well_known", "--project-root", projectRoot])}`);
     }

package/enterprise-identity.js

@@ -159,6 +159,14 @@ function createEnterpriseSession({ serviceOrigin, siteUrl, environment, credenti
     return responseJson(await fetcher(`${origin}/api/site_agents/v1/dashboard${pathname}`, request));
   }
 
+  async function decisionRequest(pathname = "", { method = "GET", body = null } = {}) {
+    const scope = method === "GET" ? "insights:read" : "evidence:write";
+    const accessToken = await session.getAccessToken([scope]);
+    const request = { method, headers: { "content-type": "application/json", authorization: `Bearer ${accessToken}` } };
+    if (body !== null) request.body = JSON.stringify(body);
+    return responseJson(await fetcher(`${origin}/api/site_agents/v1/decision${pathname}`, request));
+  }
+
   const session = {
     schema: "agentx-enterprise-session-v1",
     site_url: site.url,
@@ -211,6 +219,18 @@ function createEnterpriseSession({ serviceOrigin, siteUrl, environment, credenti
     async createDashboardPairing() {
       return dashboardRequest("/pairings", { method: "POST", body: {} });
     },
+    async getDecisionIntelligence() {
+      return decisionRequest();
+    },
+    async collectPublicAudit() {
+      return decisionRequest("/observations", { method: "POST", body: { kind: "public_audit" } });
+    },
+    async submitDecisionEvidence(kind, evidence) {
+      const normalizedKind = String(kind || "").trim();
+      if (!["connector", "provider_decision"].includes(normalizedKind)) throw enterpriseError("decision_evidence_kind_unsupported");
+      if (!evidence || typeof evidence !== "object" || Array.isArray(evidence)) throw enterpriseError("decision_evidence_mapping_required");
+      return decisionRequest("/observations", { method: "POST", body: { kind: normalizedKind, evidence } });
+    },
     async listTasks() {
       return taskRequest("");
     },

package/installer.js

@@ -17,6 +17,8 @@ const TRANSACTION_JOURNAL = `${TRANSACTION_DIR}/active.json`;
 const TRANSACTION_LOCK = `${TRANSACTION_DIR}/active.lock`;
 const COMMIT_MARKER = `${MANAGED_DIR}/install-commit.json`;
 const SECRET_IGNORE = "*\n!.gitignore\n";
+const VERIFICATION_CAPABILITY_SCHEMA = "agentx-domain-verification-capability-sealed-v1";
+const VERIFICATION_CAPABILITY_AAD = "agent-id-domain-verification-capability-local-wrap-v1";
 const INSTALL_MODULES = Object.freeze({
   identity: Object.freeze({ permission: "identity_publish", label: "Domain-bound Agent identity" }),
   audit: Object.freeze({ permission: "public_read", label: "SEO / AEO / GEO / AGO public audit" }),
@@ -641,10 +643,95 @@ async function prepareEnterpriseSecretDirectory(projectRoot = process.cwd()) {
   return {
     secret_directory: secretDirectory,
     key_path: path.join(secretDirectory, "enterprise-ed25519.pem"),
-    credential_path: path.join(secretDirectory, "enterprise-credential.json")
+    credential_path: path.join(secretDirectory, "enterprise-credential.json"),
+    verification_capability_path: path.join(secretDirectory, "domain-verification-capability.json")
   };
 }
 
+async function enterpriseCapabilityWrapKey(paths) {
+  const stat = await fs.lstat(paths.key_path).catch((error) => {
+    if (error.code === "ENOENT") throw installError("ENTERPRISE_PRIVATE_KEY_MISSING", "Enterprise private key is required to protect the verification capability.");
+    throw error;
+  });
+  if (stat.isSymbolicLink() || !stat.isFile() || (stat.mode & 0o777) !== 0o600) {
+    throw installError("ENTERPRISE_PRIVATE_KEY_INVALID", "Enterprise private key must be a regular 0600 file.");
+  }
+  const privateKey = await fs.readFile(paths.key_path);
+  return crypto.createHash("sha256").update(VERIFICATION_CAPABILITY_AAD).update("\0").update(privateKey).digest();
+}
+
+async function writeEnterpriseVerificationCapability(projectRoot, challengeId, capability) {
+  const challenge = String(challengeId || "");
+  const secret = String(capability || "");
+  if (!challenge.startsWith("dch_") || !secret.startsWith("dvc_") || secret.length < 48) {
+    throw installError("INVALID_VERIFICATION_CAPABILITY", "A complete one-time verification capability is required.");
+  }
+  const paths = await prepareEnterpriseSecretDirectory(projectRoot);
+  const key = await enterpriseCapabilityWrapKey(paths);
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
+  cipher.setAAD(Buffer.from(`${VERIFICATION_CAPABILITY_AAD}\0${challenge}`, "utf8"));
+  const ciphertext = Buffer.concat([cipher.update(secret, "utf8"), cipher.final()]);
+  const sealed = {
+    schema: VERIFICATION_CAPABILITY_SCHEMA,
+    challenge_id: challenge,
+    algorithm: "aes-256-gcm",
+    iv: iv.toString("base64url"),
+    ciphertext: ciphertext.toString("base64url"),
+    auth_tag: cipher.getAuthTag().toString("base64url"),
+  };
+  const serialized = JSON.stringify(sealed, null, 2) + "\n";
+  if (serialized.includes(secret)) {
+    throw installError("VERIFICATION_CAPABILITY_SEAL_FAILED", "The verification capability must not be persisted in plaintext.");
+  }
+  await writeAtomic(paths.verification_capability_path, serialized, "private");
+  return {
+    schema: "agentx-domain-verification-capability-write-receipt-v1",
+    challenge_id: challenge,
+    path: paths.verification_capability_path,
+    encrypted_at_rest: true,
+    mode: "0600",
+  };
+}
+
+async function readEnterpriseVerificationCapability(projectRoot, expectedChallengeId) {
+  const challenge = String(expectedChallengeId || "");
+  const paths = await prepareEnterpriseSecretDirectory(projectRoot);
+  let stat;
+  try { stat = await fs.lstat(paths.verification_capability_path); }
+  catch (error) {
+    if (error.code === "ENOENT") throw installError("VERIFICATION_CAPABILITY_MISSING", "This enrollment predates private verification capabilities; run enterprise-enroll again.");
+    throw error;
+  }
+  if (stat.isSymbolicLink() || !stat.isFile() || (stat.mode & 0o777) !== 0o600) {
+    throw installError("VERIFICATION_CAPABILITY_FILE_INVALID", "The sealed verification capability must be a regular 0600 file.");
+  }
+  const sealed = await readJson(paths.verification_capability_path);
+  if (!sealed || sealed.schema !== VERIFICATION_CAPABILITY_SCHEMA || sealed.algorithm !== "aes-256-gcm" || sealed.challenge_id !== challenge) {
+    throw installError("VERIFICATION_CAPABILITY_FILE_INVALID", "The sealed verification capability does not match this enrollment.");
+  }
+  try {
+    const key = await enterpriseCapabilityWrapKey(paths);
+    const decipher = crypto.createDecipheriv("aes-256-gcm", key, Buffer.from(sealed.iv, "base64url"));
+    decipher.setAAD(Buffer.from(`${VERIFICATION_CAPABILITY_AAD}\0${challenge}`, "utf8"));
+    decipher.setAuthTag(Buffer.from(sealed.auth_tag, "base64url"));
+    const capability = Buffer.concat([
+      decipher.update(Buffer.from(sealed.ciphertext, "base64url")),
+      decipher.final(),
+    ]).toString("utf8");
+    if (!capability.startsWith("dvc_") || capability.length < 48) throw new Error("invalid capability");
+    return { capability, path: paths.verification_capability_path };
+  } catch (_error) {
+    throw installError("VERIFICATION_CAPABILITY_DECRYPT_FAILED", "The verification capability could not be opened with this site's private key.");
+  }
+}
+
+async function removeEnterpriseVerificationCapability(projectRoot, expectedChallengeId) {
+  const opened = await readEnterpriseVerificationCapability(projectRoot, expectedChallengeId);
+  await fs.rm(opened.path, { force: true });
+  return { removed: true, challenge_id: String(expectedChallengeId || "") };
+}
+
 async function writeEnterpriseBootstrapCredential(projectRoot, credential, bootstrapSecret) {
   const details = credential && typeof credential === "object" ? credential : {};
   const secret = String(bootstrapSecret || "");
@@ -1346,6 +1433,9 @@ module.exports = {
   uninstallInstall,
   enterpriseInstallStatus,
   prepareEnterpriseSecretDirectory,
+  writeEnterpriseVerificationCapability,
+  readEnterpriseVerificationCapability,
+  removeEnterpriseVerificationCapability,
   writeEnterpriseBootstrapCredential,
   replaceEnterpriseBootstrapCredential,
   removeEnterpriseBootstrapCredential,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twin3-ai/agent-id",
-  "version": "0.3.13",
+  "version": "0.3.14",
   "description": "Domain-bound AgentX portable alias, AEO evidence, and website-Agent integration SDK.",
   "license": "UNLICENSED",
   "private": false,

package/production-preflight.js

@@ -1,7 +1,7 @@
 "use strict";
 
 const net = require("node:net");
-const { verifyReleaseManifest, verifyProductionReleaseReceipt, sha256 } = require("./release-verifier.js");
+const { verifyReleaseManifest, verifyProductionReleaseReceipt, canonical, sha256 } = require("./release-verifier.js");
 
 const PACKAGE_NAME = "@twin3-ai/agent-id";
 
@@ -83,6 +83,16 @@ async function runProductionPreflight({ endpoint, packageVersion, expectedIssuer
   const health = healthResponse.ok && healthResponse.body && healthResponse.body.ok !== false;
   const agentCard = cardResponse.ok && typeof cardResponse.body?.name === "string" && cardResponse.body.name.length > 0;
   const installManifest = installResponse.ok && installResponse.body?.schema === "xagent-install-manifest-v1";
+  const installRelease = installResponse.body?.release || {};
+  const installReleaseBinding = installManifest
+    && installRelease.package === manifest?.package?.name
+    && installRelease.version === manifest?.package?.version
+    && installRelease.integrity === manifest?.package?.integrity
+    && installRelease.commit === manifest?.release_commit
+    && installRelease.api_origin === manifest?.api_origin
+    && installRelease.manifest_hash === manifest?.content_hash
+    && canonical(installRelease.compatibility || {}) === canonical(manifest?.compatibility || {})
+    && canonical(installRelease.rollback || {}) === canonical(manifest?.rollback || {});
   const openapi = openapiResponse.ok && openapiResponse.body?.openapi === "3.1.0";
   const productionReceipt = receiptResponse.ok && receiptResponse.body
     ? verifyProductionReleaseReceipt({
@@ -116,6 +126,7 @@ async function runProductionPreflight({ endpoint, packageVersion, expectedIssuer
     health_endpoint: health,
     agent_card: agentCard,
     install_manifest: installManifest,
+    install_release_binding: installReleaseBinding,
     openapi,
   };
   const blockers = [...release.blockers, ...productionReceipt.blockers];
@@ -128,6 +139,7 @@ async function runProductionPreflight({ endpoint, packageVersion, expectedIssuer
   if (apiReachable && !health) blockers.push("health_endpoint_unavailable");
   if (apiReachable && !agentCard) blockers.push("agent_card_unavailable");
   if (apiReachable && !installManifest) blockers.push("install_manifest_unavailable");
+  if (installManifest && !installReleaseBinding) blockers.push("install_manifest_release_truth_mismatch");
   if (apiReachable && !openapi) blockers.push("openapi_unavailable");
   if (productionReceipt.ok && !artifactBindings) blockers.push("production_artifact_hash_mismatch");
 

package/release-verifier.js

@@ -47,6 +47,10 @@ function verifyReleaseManifest({ manifest, issuerDescriptor, expectedOrigin, pac
   const expectedVersionUrl = `https://www.npmjs.com/package/${PACKAGE_NAME}/v/${String(packageVersion || "")}`;
   if (manifest?.package?.version_url !== expectedVersionUrl) blockers.push("npm_version_url_mismatch");
   if (manifest?.supply_chain?.npm_provenance !== "not_claimed_private_repository") blockers.push("npm_provenance_claim_mismatch");
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(String(manifest?.rollback?.version || ""))) blockers.push("rollback_version_missing");
+  if (manifest?.rollback?.version === manifest?.package?.version) blockers.push("rollback_version_must_differ");
+  if (!/^sha512-[A-Za-z0-9+/=]{80,120}$/.test(String(manifest?.rollback?.integrity || ""))) blockers.push("rollback_integrity_missing");
+  if (manifest?.rollback?.package !== PACKAGE_NAME || manifest?.rollback?.source !== "previous_production_release") blockers.push("rollback_contract_mismatch");
 
   const proof = manifest && typeof manifest.proof === "object" ? manifest.proof : {};
   const unsigned = manifest && typeof manifest === "object"
@@ -89,6 +93,7 @@ function verifyProductionReleaseReceipt({ receipt, issuerDescriptor, releaseMani
   if (!expected || normalizedOrigin(receipt?.api_origin) !== expected) blockers.push("production_receipt_origin_mismatch");
   if (receipt?.package?.name !== PACKAGE_NAME || receipt?.package?.version !== String(packageVersion || "")) blockers.push("production_receipt_package_mismatch");
   if (receipt?.package?.integrity !== releaseManifest?.package?.integrity) blockers.push("production_receipt_integrity_mismatch");
+  if (canonical(receipt?.rollback || {}) !== canonical(releaseManifest?.rollback || {})) blockers.push("production_receipt_rollback_mismatch");
   if (receipt?.source?.release_commit !== releaseManifest?.release_commit) blockers.push("production_receipt_commit_mismatch");
   if (receipt?.source?.release_manifest_sha256 !== releaseManifest?.content_hash) blockers.push("production_receipt_manifest_hash_mismatch");
   if (!/^sha256:[0-9a-f]{64}$/.test(String(receipt?.deployment?.image_digest || ""))) blockers.push("production_receipt_image_digest_missing");