@vorionsys/atsf-core 0.2.4 → 0.3.0

package/CHANGELOG.md

@@ -62,6 +62,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Fastify-based governance API server (`createServer`, `startServer`)
 - Comprehensive test suite (401+ tests)
 
+[0.2.2]: https://github.com/vorionsys/vorion/compare/atsf-core-v0.2.1...atsf-core-v0.2.2
 [0.2.1]: https://github.com/vorionsys/vorion/compare/atsf-core-v0.2.0...atsf-core-v0.2.1
 [0.2.0]: https://github.com/vorionsys/vorion/compare/atsf-core-v0.1.0...atsf-core-v0.2.0
 [0.1.0]: https://github.com/vorionsys/vorion/releases/tag/atsf-core-v0.1.0

package/LICENSE

@@ -175,7 +175,7 @@
 
    END OF TERMS AND CONDITIONS
 
-   Copyright 2024-2026 Vorion
+   Copyright 2024-2026 Vorion Systems
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

package/README.md

@@ -1,6 +1,11 @@
 # @vorionsys/atsf-core
 
-Agentic Trust Scoring Framework (ATSF) -- the core runtime for AI agent governance, trust scoring, and policy enforcement. Implements the complete 8-tier trust model (T0-T7) on a 0-1000 scale with behavioral signal processing, time-based Readiness Degree adjustments, recovery mechanics, and immutable audit trails.
+![Developer Preview](https://img.shields.io/badge/status-developer%20preview-blue)
+![License](https://img.shields.io/badge/license-Apache%202.0-green)
+![npm](https://img.shields.io/npm/v/@vorionsys/atsf-core)
+![TypeScript](https://img.shields.io/badge/TypeScript-first-3178C6)
+
+Agentic Trust Scoring Framework (ATSF) -- the core runtime for AI agent governance, trust scoring, and policy enforcement. Implements the complete 8-tier trust model (T0-T7) on a 0-1000 scale with behavioral signal processing, time-based decay, recovery mechanics, and immutable audit trails.
 
 ## Installation
 
@@ -19,8 +24,8 @@ ATSF continuously evaluates agent behavior across multiple dimensions and assign
 Key principles:
 
 - **Trust is earned, not granted.** Agents start at low trust and must demonstrate competence to advance.
-- **Readiness adjusts over time.** Idle agents can lose readiness; active, well-behaved agents maintain or gain it.
-- **Readiness reduction is asymmetric.** Trust dynamics are configurable by policy profile, with stricter readiness and recovery behavior at higher assurance requirements.
+- **Trust decays over time.** Idle agents lose trust; active, well-behaved agents maintain or gain it.
+- **Trust loss is asymmetric.** Trust is hard to gain and easy to lose (10:1 ratio per ATSF v2.0).
 - **Every decision is auditable.** An immutable proof chain records all governance decisions.
 
 ## The 8-Tier Trust Model (T0-T7)
@@ -56,31 +61,47 @@ The runtime trust engine also tracks four signal component categories (`behavior
 
 ## Quick Start
 
+> **Scenario:** Your data pipeline agent runs nightly ETL jobs. You want trust to build over successful runs and drop hard on failures.
+
+```bash
+npm install @vorionsys/atsf-core
+```
+
 ```typescript
 import { createTrustEngine } from '@vorionsys/atsf-core';
 
-// Create a trust engine
+// 1. Create a trust engine
 const engine = createTrustEngine();
 
-// Initialize an agent at T1 (Observed)
-const agent = await engine.initializeEntity('agent-001', 1);
-console.log(agent.score); // 200 (T1 minimum)
-console.log(agent.level); // 1
+// 2. Register the ETL agent at T1 (Observed)
+const agent = await engine.initializeEntity('etl-pipeline-01', 1);
+console.log(`Starting tier: T${agent.level} (${engine.getLevelName(agent.level)})`);
 
-// Record a behavioral signal
+// 3. Nightly run succeeds — record a positive signal
 await engine.recordSignal({
   id: crypto.randomUUID(),
-  entityId: 'agent-001',
+  entityId: 'etl-pipeline-01',
   type: 'behavioral.task_completed',
-  value: 0.9,
-  source: 'system',
+  value: 0.95, // high confidence outcome
+  source: 'scheduler',
   timestamp: new Date().toISOString(),
-  metadata: { task: 'data-analysis' },
+  metadata: { job: 'nightly-etl', rows: 48_000 },
 });
 
-// Get the updated score (includes automatic Readiness Degree adjustment)
-const record = await engine.getScore('agent-001');
-console.log(record?.score, record?.level);
+// 4. Something goes wrong — record a violation
+await engine.recordSignal({
+  id: crypto.randomUUID(),
+  entityId: 'etl-pipeline-01',
+  type: 'behavioral.policy_violation',
+  value: 0.1, // low value = bad outcome
+  source: 'scheduler',
+  timestamp: new Date().toISOString(),
+  metadata: { job: 'nightly-etl', error: 'wrote to unauthorized table' },
+});
+
+// 5. Check updated trust score and tier
+const record = await engine.getScore('etl-pipeline-01');
+console.log(`Score: ${record?.score}, Tier: T${record?.level}`);
 ```
 
 ## Usage Examples
@@ -90,12 +111,11 @@ console.log(record?.score, record?.level);
 ```typescript
 import { createTrustEngine } from '@vorionsys/atsf-core';
 
+// Trust decay uses stepped milestones (not configurable — consistent across ecosystem):
+// Days 7/14/28/42/56 → 6% drop each, Days 84/112/140/182 → 5% drop each
+// 182-day half-life: score = 50% of pre-decay value
 const engine = createTrustEngine({
-  decayRate: 0.01,                 // 1% decay per interval
-  decayIntervalMs: 60000,         // 1-minute intervals
   failureThreshold: 0.3,          // Signals below 0.3 = failure
-  acceleratedDecayMultiplier: 1.0, // No extra decay multiplier by default
-  readinessMode: 'checkpoint_schedule', // Preferred neutral mode naming
   successThreshold: 0.7,          // Signals above 0.7 = success
   recoveryRate: 0.02,             // 2% recovery per success signal
 });
@@ -167,7 +187,7 @@ engine.on('trust:tier_changed', (event) => {
 engine.on('trust:failure_detected', (event) => {
   console.log(`Failure #${event.failureCount} for ${event.entityId}`);
   if (event.acceleratedDecayActive) {
-    console.log('Additional decay multiplier is active for this policy profile');
+    console.log('Accelerated decay is now active (3x normal rate)');
   }
 });
 
@@ -371,9 +391,7 @@ Import from the package root or via deep imports:
 | `trust:signal_recorded` | Behavioral signal recorded |
 | `trust:score_changed` | Score changes by 5+ points |
 | `trust:tier_changed` | Entity promoted or demoted |
-| `trust:readiness_adjusted` | Readiness Degree adjusted (primary neutral event) |
-| `trust:freshness_adjusted` | Backward-compatible readiness alias |
-| `trust:decay_applied` | Legacy compatibility alias (includes `accelerated` flag) |
+| `trust:decay_applied` | Trust decayed (includes `accelerated` flag) |
 | `trust:failure_detected` | Signal value below failure threshold |
 | `trust:recovery_applied` | Recovery from successful signal |
 | `trust:recovery_milestone` | Tier restored, full recovery, or accelerated recovery earned |
@@ -446,7 +464,7 @@ Same ACI → CAR rename — aliases in `@vorionsys/car-client` follow the identi
 
 ```
 @vorionsys/atsf-core
-  |-- trust-engine/     Trust scoring with 8-tier model, readiness adjustments, and recovery
+  |-- trust-engine/     Trust scoring with 8-tier model, decay, and recovery
   |-- basis/            BASIS rule evaluation engine
   |-- intent/           Intent submission and lifecycle tracking
   |-- enforce/          Policy decision point (allow/deny/escalate)
@@ -465,6 +483,39 @@ Same ACI → CAR rename — aliases in `@vorionsys/car-client` follow the identi
   |-- phase6/           Trust engine hardening (advanced)
 ```
 
+## Cognitive Envelope (ParameSphere)
+
+The **Cognitive Envelope** is a hyper-rectangle breach detector that monitors an AI model's characteristic vector across 6 dimensions (weight geometry, activation clustering, embedding drift, attention entropy, gradient norm, effective dimensionality). It is part of the ParameSphere subsystem.
+
+### How it works
+
+1. **Baseline** -- Call `baselineFromObservations()` with a set of known-good measurement vectors. The envelope computes per-dimension mean and standard deviation, then sets bounds at `mu +/- k * sigma` (default k=3, giving 99.7% single-dimension coverage).
+2. **Check** -- Call `checkBreach()` with a current characteristic vector. If any dimension falls outside the bounds, the breach counter increments; a clean check decrements it by 1.
+3. **Breach** -- When the counter reaches `breachThreshold` (default: 3), the trust multiplier drops from 1.0 to 0.7.
+
+### The `maxBreachCounter` cap
+
+During a sustained attack, the breach counter could grow without bound -- and since recovery decrements it by only 1 per clean check, an attacker who racks up thousands of breaches could lock the agent into a breached state indefinitely. `maxBreachCounter` (default: 100) clamps the counter so recovery takes at most 100 clean checks, not thousands.
+
+### `reset()` as the escape valve
+
+When an operator confirms that the root cause of a breach has been resolved (model rollback, config fix, etc.), calling `reset()` zeroes the breach counter and the rate-limit timer without touching the baseline. The next `checkBreach()` evaluates immediately with a clean slate.
+
+```typescript
+import { CognitiveEnvelope } from '@vorionsys/atsf-core';
+
+const envelope = new CognitiveEnvelope({ maxBreachCounter: 50 });
+envelope.baselineFromObservations(observations);
+
+const result = envelope.checkBreach(currentVector);
+if (result.breached) {
+  console.log(`Breach detected (counter: ${result.breachCounter})`);
+}
+
+// After operator confirms root cause resolved:
+envelope.reset();
+```
+
 ## Peer Dependencies
 
 | Package | Required | Purpose |
@@ -475,7 +526,7 @@ Same ACI → CAR rename — aliases in `@vorionsys/car-client` follow the identi
 
 ## Testing
 
-The package has comprehensive test coverage with **401+ tests** covering trust scoring, readiness-adjustment mechanics, recovery paths, governance pipelines, security layers, and edge cases.
+The package has comprehensive test coverage with **401+ tests** covering trust scoring, decay mechanics, recovery paths, governance pipelines, security layers, and edge cases.
 
 ```bash
 # Run all tests
@@ -485,11 +536,13 @@ npm test
 npm run test:watch
 ```
 
-## License
+## Documentation
+
+Full platform documentation is available at [https://vorion.org/docs](https://vorion.org/docs).
 
-[Apache-2.0](https://www.apache.org/licenses/LICENSE-2.0)
+## License
 
-Copyright 2024-2026 Vorion
+[Apache-2.0](https://www.apache.org/licenses/LICENSE-2.0) -- Copyright 2024-2026 Vorion LLC
 
 ## Links
 

package/dist/adapters/base-adapter.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Base adapter implementation for observability platform integration.
+ *
+ * Converts external ObservabilityEvents into Vorion trust signals and
+ * provides trust queries and enforcement decisions via the trust engine.
+ *
+ * Platform-specific adapters can extend this class to customize signal
+ * mapping, risk normalization, or enforcement logic.
+ *
+ * @packageDocumentation
+ */
+import { TrustEngine } from '../trust-engine/index.js';
+import type { TrustLevel, TrustSignal } from '../common/types.js';
+import type { ObservabilityAdapter, ObservabilityEvent, TrustQueryResponse, EnforcementRequest, EnforcementResponse } from './types.js';
+/**
+ * Configuration for creating a BaseObservabilityAdapter.
+ */
+export interface BaseAdapterConfig {
+    /** Platform name (e.g., 'geordie', 'prompt-security', 'calypso') */
+    name: string;
+    /** Trust engine instance to route signals into */
+    engine: TrustEngine;
+    /** Default trust tier for auto-initializing unknown entities (default: 0) */
+    defaultInitialTier?: TrustLevel;
+}
+/**
+ * Base implementation of ObservabilityAdapter.
+ *
+ * Translates external platform events into Vorion trust signals and
+ * provides trust querying and enforcement. Extend this class for
+ * platform-specific signal mapping or enrichment.
+ */
+export declare class BaseObservabilityAdapter implements ObservabilityAdapter {
+    readonly name: string;
+    protected readonly engine: TrustEngine;
+    private readonly defaultInitialTier;
+    private idCounter;
+    constructor(config: BaseAdapterConfig);
+    /**
+     * Generate a unique signal ID for the trust engine.
+     */
+    private generateSignalId;
+    /**
+     * Convert an ObservabilityEvent into a Vorion TrustSignal.
+     *
+     * The signal value is derived from:
+     * 1. A base value per outcome type (success=0.8, failure=0.1, etc.)
+     * 2. Adjusted by the platform's risk score when provided
+     *
+     * Override this method in platform-specific adapters for custom mapping.
+     */
+    protected mapEventToSignal(event: ObservabilityEvent): TrustSignal;
+    /**
+     * Ensure the entity exists in the trust engine, auto-initializing if needed.
+     */
+    private ensureEntity;
+    /**
+     * Ingest a single behavioral event from the external platform.
+     *
+     * Converts the event to a trust signal and records it in the trust engine.
+     */
+    ingestEvent(event: ObservabilityEvent): Promise<void>;
+    /**
+     * Ingest a batch of behavioral events.
+     *
+     * Events are processed sequentially to maintain signal ordering.
+     */
+    ingestBatch(events: ObservabilityEvent[]): Promise<void>;
+    /**
+     * Query the current trust state for an entity.
+     *
+     * Returns the trust score, tier, tier name, and available capabilities.
+     */
+    queryTrust(entityId: string): Promise<TrustQueryResponse>;
+    /**
+     * Make an enforcement decision based on trust level.
+     *
+     * The decision logic:
+     * 1. Look up the entity's current trust tier
+     * 2. Check if the requested action has a minimum tier requirement
+     * 3. If the entity's tier meets or exceeds the requirement, allow
+     * 4. If the entity is one tier below, constrain with limitations
+     * 5. Otherwise deny
+     */
+    enforce(request: EnforcementRequest): Promise<EnforcementResponse>;
+}
+/**
+ * Create a base observability adapter.
+ *
+ * @param config - Adapter configuration including platform name and trust engine
+ * @returns A configured BaseObservabilityAdapter instance
+ */
+export declare function createObservabilityAdapter(config: BaseAdapterConfig): BaseObservabilityAdapter;
+//# sourceMappingURL=base-adapter.d.ts.map

package/dist/adapters/base-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/base-adapter.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAuC,MAAM,0BAA0B,CAAC;AAC5F,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,YAAY,CAAC;AA+CpB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,MAAM,EAAE,WAAW,CAAC;IACpB,6EAA6E;IAC7E,kBAAkB,CAAC,EAAE,UAAU,CAAC;CACjC;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,YAAW,oBAAoB;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IACvC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAa;IAChD,OAAO,CAAC,SAAS,CAAK;gBAEV,MAAM,EAAE,iBAAiB;IAMrC;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAKxB;;;;;;;;OAQG;IACH,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,WAAW;IA8BlE;;OAEG;YACW,YAAY;IAO1B;;;;OAIG;IACG,WAAW,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAM3D;;;;OAIG;IACG,WAAW,CAAC,MAAM,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAM9D;;;;OAIG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAsB/D;;;;;;;;;OASG;IACG,OAAO,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAiDzE;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,iBAAiB,GAAG,wBAAwB,CAE9F"}

package/dist/adapters/base-adapter.js

@@ -0,0 +1,233 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2024-2026 Vorion LLC
+/**
+ * Base adapter implementation for observability platform integration.
+ *
+ * Converts external ObservabilityEvents into Vorion trust signals and
+ * provides trust queries and enforcement decisions via the trust engine.
+ *
+ * Platform-specific adapters can extend this class to customize signal
+ * mapping, risk normalization, or enforcement logic.
+ *
+ * @packageDocumentation
+ */
+import { TRUST_LEVEL_NAMES } from '../trust-engine/index.js';
+/**
+ * Maps event outcomes to trust signal type prefixes.
+ *
+ * - success  -> behavioral.task_success  (high value = trust gain)
+ * - failure  -> behavioral.task_failure  (low value = trust loss)
+ * - blocked  -> compliance.policy_block  (low value = trust loss)
+ * - escalated -> behavioral.escalation   (moderate value = neutral/slight loss)
+ */
+const OUTCOME_SIGNAL_MAP = {
+    success: { type: 'behavioral.task_success', baseValue: 0.8 },
+    failure: { type: 'behavioral.task_failure', baseValue: 0.1 },
+    blocked: { type: 'compliance.policy_block', baseValue: 0.15 },
+    escalated: { type: 'behavioral.escalation', baseValue: 0.4 },
+};
+/**
+ * Tier-based capability definitions.
+ *
+ * Each tier unlocks additional capabilities. Higher tiers include
+ * all capabilities from lower tiers.
+ */
+const TIER_CAPABILITIES = {
+    0: ['sandbox_execute'],
+    1: ['sandbox_execute', 'read_data'],
+    2: ['sandbox_execute', 'read_data', 'write_data_supervised'],
+    3: ['sandbox_execute', 'read_data', 'write_data_supervised', 'write_data'],
+    4: ['sandbox_execute', 'read_data', 'write_data_supervised', 'write_data', 'external_api'],
+    5: ['sandbox_execute', 'read_data', 'write_data_supervised', 'write_data', 'external_api', 'cross_agent'],
+    6: ['sandbox_execute', 'read_data', 'write_data_supervised', 'write_data', 'external_api', 'cross_agent', 'admin_tasks'],
+    7: ['sandbox_execute', 'read_data', 'write_data_supervised', 'write_data', 'external_api', 'cross_agent', 'admin_tasks', 'autonomous'],
+};
+/**
+ * Actions that require a minimum trust tier to be allowed.
+ */
+const ACTION_MIN_TIER = {
+    'sandbox_execute': 0,
+    'read_data': 1,
+    'write_data': 3,
+    'external_api': 4,
+    'cross_agent': 5,
+    'admin_tasks': 6,
+    'autonomous': 7,
+};
+/**
+ * Base implementation of ObservabilityAdapter.
+ *
+ * Translates external platform events into Vorion trust signals and
+ * provides trust querying and enforcement. Extend this class for
+ * platform-specific signal mapping or enrichment.
+ */
+export class BaseObservabilityAdapter {
+    name;
+    engine;
+    defaultInitialTier;
+    idCounter = 0;
+    constructor(config) {
+        this.name = config.name;
+        this.engine = config.engine;
+        this.defaultInitialTier = config.defaultInitialTier ?? 0;
+    }
+    /**
+     * Generate a unique signal ID for the trust engine.
+     */
+    generateSignalId(event) {
+        this.idCounter += 1;
+        return `${this.name}:${event.externalId}:${this.idCounter}`;
+    }
+    /**
+     * Convert an ObservabilityEvent into a Vorion TrustSignal.
+     *
+     * The signal value is derived from:
+     * 1. A base value per outcome type (success=0.8, failure=0.1, etc.)
+     * 2. Adjusted by the platform's risk score when provided
+     *
+     * Override this method in platform-specific adapters for custom mapping.
+     */
+    mapEventToSignal(event) {
+        const mapping = OUTCOME_SIGNAL_MAP[event.outcome] ?? OUTCOME_SIGNAL_MAP['failure'];
+        let value = mapping.baseValue;
+        // If the source platform provides a risk score, blend it in.
+        // High risk (close to 1) pulls the value down; low risk pulls it up.
+        if (event.riskScore !== undefined && event.riskScore >= 0 && event.riskScore <= 1) {
+            value = mapping.baseValue * (1 - event.riskScore * 0.5);
+        }
+        // Clamp to [0, 1]
+        value = Math.max(0, Math.min(1, value));
+        return {
+            id: this.generateSignalId(event),
+            entityId: event.entityId,
+            type: mapping.type,
+            value,
+            source: `adapter:${this.name}:${event.source}`,
+            timestamp: event.timestamp,
+            metadata: {
+                externalId: event.externalId,
+                eventType: event.eventType,
+                outcome: event.outcome,
+                riskScore: event.riskScore,
+                ...(event.metadata ?? {}),
+            },
+        };
+    }
+    /**
+     * Ensure the entity exists in the trust engine, auto-initializing if needed.
+     */
+    async ensureEntity(entityId) {
+        const record = await this.engine.getScore(entityId);
+        if (!record) {
+            await this.engine.initializeEntity(entityId, this.defaultInitialTier);
+        }
+    }
+    /**
+     * Ingest a single behavioral event from the external platform.
+     *
+     * Converts the event to a trust signal and records it in the trust engine.
+     */
+    async ingestEvent(event) {
+        await this.ensureEntity(event.entityId);
+        const signal = this.mapEventToSignal(event);
+        await this.engine.recordSignal(signal);
+    }
+    /**
+     * Ingest a batch of behavioral events.
+     *
+     * Events are processed sequentially to maintain signal ordering.
+     */
+    async ingestBatch(events) {
+        for (const event of events) {
+            await this.ingestEvent(event);
+        }
+    }
+    /**
+     * Query the current trust state for an entity.
+     *
+     * Returns the trust score, tier, tier name, and available capabilities.
+     */
+    async queryTrust(entityId) {
+        const record = await this.engine.getScore(entityId);
+        if (!record) {
+            return {
+                entityId,
+                score: 0,
+                tier: 0,
+                tierName: TRUST_LEVEL_NAMES[0],
+                capabilities: TIER_CAPABILITIES[0] ?? [],
+            };
+        }
+        return {
+            entityId,
+            score: record.score,
+            tier: record.level,
+            tierName: TRUST_LEVEL_NAMES[record.level] ?? 'Unknown',
+            capabilities: TIER_CAPABILITIES[record.level] ?? [],
+        };
+    }
+    /**
+     * Make an enforcement decision based on trust level.
+     *
+     * The decision logic:
+     * 1. Look up the entity's current trust tier
+     * 2. Check if the requested action has a minimum tier requirement
+     * 3. If the entity's tier meets or exceeds the requirement, allow
+     * 4. If the entity is one tier below, constrain with limitations
+     * 5. Otherwise deny
+     */
+    async enforce(request) {
+        const record = await this.engine.getScore(request.entityId);
+        const score = record?.score ?? 0;
+        const tier = record?.level ?? 0;
+        const requiredTier = ACTION_MIN_TIER[request.action] ?? 0;
+        // Entity meets the required tier
+        if (tier >= requiredTier) {
+            return {
+                allowed: true,
+                decision: 'allow',
+                trustScore: score,
+                reason: `Entity at tier ${tier} (${TRUST_LEVEL_NAMES[tier]}) meets requirement for '${request.action}' (min tier ${requiredTier})`,
+            };
+        }
+        // Entity is exactly one tier below — constrain with limitations
+        if (tier === requiredTier - 1) {
+            return {
+                allowed: false,
+                decision: 'constrain',
+                trustScore: score,
+                reason: `Entity at tier ${tier} is one tier below the requirement for '${request.action}' (min tier ${requiredTier})`,
+                constraints: [
+                    'requires_supervision',
+                    'rate_limited',
+                    `upgrade_to_tier_${requiredTier}`,
+                ],
+            };
+        }
+        // Entity is too far below the required tier — escalate if close, deny otherwise
+        if (tier >= requiredTier - 2) {
+            return {
+                allowed: false,
+                decision: 'escalate',
+                trustScore: score,
+                reason: `Entity at tier ${tier} requires escalation for '${request.action}' (min tier ${requiredTier})`,
+            };
+        }
+        return {
+            allowed: false,
+            decision: 'deny',
+            trustScore: score,
+            reason: `Entity at tier ${tier} (${TRUST_LEVEL_NAMES[tier]}) does not meet requirement for '${request.action}' (min tier ${requiredTier})`,
+        };
+    }
+}
+/**
+ * Create a base observability adapter.
+ *
+ * @param config - Adapter configuration including platform name and trust engine
+ * @returns A configured BaseObservabilityAdapter instance
+ */
+export function createObservabilityAdapter(config) {
+    return new BaseObservabilityAdapter(config);
+}
+//# sourceMappingURL=base-adapter.js.map

package/dist/adapters/base-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-adapter.js","sourceRoot":"","sources":["../../src/adapters/base-adapter.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;GAUG;AAEH,OAAO,EAAe,iBAAiB,EAAoB,MAAM,0BAA0B,CAAC;AAU5F;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAwD;IAC9E,OAAO,EAAI,EAAE,IAAI,EAAE,yBAAyB,EAAG,SAAS,EAAE,GAAG,EAAE;IAC/D,OAAO,EAAI,EAAE,IAAI,EAAE,yBAAyB,EAAI,SAAS,EAAE,GAAG,EAAE;IAChE,OAAO,EAAI,EAAE,IAAI,EAAE,yBAAyB,EAAI,SAAS,EAAE,IAAI,EAAE;IACjE,SAAS,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAM,SAAS,EAAE,GAAG,EAAE;CACjE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,iBAAiB,GAA6B;IAClD,CAAC,EAAE,CAAC,iBAAiB,CAAC;IACtB,CAAC,EAAE,CAAC,iBAAiB,EAAE,WAAW,CAAC;IACnC,CAAC,EAAE,CAAC,iBAAiB,EAAE,WAAW,EAAE,uBAAuB,CAAC;IAC5D,CAAC,EAAE,CAAC,iBAAiB,EAAE,WAAW,EAAE,uBAAuB,EAAE,YAAY,CAAC;IAC1E,CAAC,EAAE,CAAC,iBAAiB,EAAE,WAAW,EAAE,uBAAuB,EAAE,YAAY,EAAE,cAAc,CAAC;IAC1F,CAAC,EAAE,CAAC,iBAAiB,EAAE,WAAW,EAAE,uBAAuB,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,CAAC;IACzG,CAAC,EAAE,CAAC,iBAAiB,EAAE,WAAW,EAAE,uBAAuB,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,CAAC;IACxH,CAAC,EAAE,CAAC,iBAAiB,EAAE,WAAW,EAAE,uBAAuB,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,CAAC;CACvI,CAAC;AAEF;;GAEG;AACH,MAAM,eAAe,GAA2B;IAC9C,iBAAiB,EAAE,CAAC;IACpB,WAAW,EAAE,CAAC;IACd,YAAY,EAAE,CAAC;IACf,cAAc,EAAE,CAAC;IACjB,aAAa,EAAE,CAAC;IAChB,aAAa,EAAE,CAAC;IAChB,YAAY,EAAE,CAAC;CAChB,CAAC;AAcF;;;;;;GAMG;AACH,MAAM,OAAO,wBAAwB;IAC1B,IAAI,CAAS;IACH,MAAM,CAAc;IACtB,kBAAkB,CAAa;IACxC,SAAS,GAAG,CAAC,CAAC;IAEtB,YAAY,MAAyB;QACnC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,KAAyB;QAChD,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;QACpB,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;IAC9D,CAAC;IAED;;;;;;;;OAQG;IACO,gBAAgB,CAAC,KAAyB;QAClD,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACnF,IAAI,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC;QAE9B,6DAA6D;QAC7D,qEAAqE;QACrE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;YAClF,KAAK,GAAG,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;QAC1D,CAAC;QAED,kBAAkB;QAClB,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QAExC,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK;YACL,MAAM,EAAE,WAAW,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE;YAC9C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE;gBACR,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;aAC1B;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,YAAY,CAAC,QAAgB;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,KAAyB;QACzC,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,MAA4B;QAC5C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,QAAQ;gBACR,KAAK,EAAE,CAAC;gBACR,IAAI,EAAE,CAAC;gBACP,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC;gBAC9B,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE;aACzC,CAAC;QACJ,CAAC;QAED,OAAO;YACL,QAAQ;YACR,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,KAAK;YAClB,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAAmB,CAAC,IAAI,SAAS;YACpE,YAAY,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;SACpD,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,OAAO,CAAC,OAA2B;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC;QAEhC,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAE1D,iCAAiC;QACjC,IAAI,IAAI,IAAI,YAAY,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,OAAO;gBACjB,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,kBAAkB,IAAI,KAAK,iBAAiB,CAAC,IAAkB,CAAC,4BAA4B,OAAO,CAAC,MAAM,eAAe,YAAY,GAAG;aACjJ,CAAC;QACJ,CAAC;QAED,gEAAgE;QAChE,IAAI,IAAI,KAAK,YAAY,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,WAAW;gBACrB,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,kBAAkB,IAAI,2CAA2C,OAAO,CAAC,MAAM,eAAe,YAAY,GAAG;gBACrH,WAAW,EAAE;oBACX,sBAAsB;oBACtB,cAAc;oBACd,mBAAmB,YAAY,EAAE;iBAClC;aACF,CAAC;QACJ,CAAC;QAED,gFAAgF;QAChF,IAAI,IAAI,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,UAAU;gBACpB,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,kBAAkB,IAAI,6BAA6B,OAAO,CAAC,MAAM,eAAe,YAAY,GAAG;aACxG,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,kBAAkB,IAAI,KAAK,iBAAiB,CAAC,IAAkB,CAAC,oCAAoC,OAAO,CAAC,MAAM,eAAe,YAAY,GAAG;SACzJ,CAAC;IACJ,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAyB;IAClE,OAAO,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC9C,CAAC"}

package/dist/adapters/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Observability platform adapters for Vorion trust engine integration.
+ *
+ * @packageDocumentation
+ */
+export type { ObservabilityEvent, TrustQueryResponse, EnforcementRequest, EnforcementResponse, ObservabilityAdapter, } from './types.js';
+export { BaseObservabilityAdapter, createObservabilityAdapter, type BaseAdapterConfig, } from './base-adapter.js';
+export { handleWebhook, createWebhookHandler, isValidEvent, type WebhookRequest, type WebhookResponse, type WebhookHandlerConfig, } from './webhook-handler.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AAEH,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,oBAAoB,GAC1B,MAAM,sBAAsB,CAAC"}

package/dist/adapters/index.js

@@ -0,0 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2024-2026 Vorion LLC
+export { BaseObservabilityAdapter, createObservabilityAdapter, } from './base-adapter.js';
+export { handleWebhook, createWebhookHandler, isValidEvent, } from './webhook-handler.js';
+//# sourceMappingURL=index.js.map

package/dist/adapters/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAgBjC,OAAO,EACL,wBAAwB,EACxB,0BAA0B,GAE3B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,YAAY,GAIb,MAAM,sBAAsB,CAAC"}

package/dist/adapters/types.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Generic adapter interface for agent observability platforms.
+ *
+ * Any platform that monitors AI agent behavior can feed signals
+ * into Vorion's trust engine through this interface.
+ *
+ * Supported patterns:
+ * - Behavioral telemetry -> trust signals (platform tells Vorion what agents did)
+ * - Trust score queries (platform asks Vorion for current trust level)
+ * - Enforcement decisions (platform asks Vorion whether an action should be allowed)
+ *
+ * @packageDocumentation
+ */
+/**
+ * A behavioral event from an external observability platform.
+ *
+ * Represents a single agent action or outcome that should be evaluated
+ * by the Vorion trust engine.
+ */
+export interface ObservabilityEvent {
+    /** Unique event ID from the source platform */
+    externalId: string;
+    /** Agent/entity identifier */
+    entityId: string;
+    /** Event type: tool_call, inference, data_access, policy_violation, etc. */
+    eventType: string;
+    /** Outcome: success, failure, blocked, escalated */
+    outcome: 'success' | 'failure' | 'blocked' | 'escalated';
+    /** Risk score from the source platform (0-1, normalized) */
+    riskScore?: number;
+    /** Timestamp in ISO 8601 format */
+    timestamp: string;
+    /** Source platform identifier */
+    source: string;
+    /** Arbitrary metadata from the source */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Response from a trust query, summarizing an entity's current standing.
+ */
+export interface TrustQueryResponse {
+    entityId: string;
+    score: number;
+    tier: number;
+    tierName: string;
+    capabilities: string[];
+}
+/**
+ * Request for an enforcement decision from the trust engine.
+ */
+export interface EnforcementRequest {
+    entityId: string;
+    action: string;
+    resource: string;
+    context?: Record<string, unknown>;
+}
+/**
+ * Enforcement decision returned by the adapter.
+ */
+export interface EnforcementResponse {
+    allowed: boolean;
+    decision: 'allow' | 'deny' | 'constrain' | 'escalate';
+    trustScore: number;
+    reason?: string;
+    constraints?: string[];
+}
+/**
+ * Generic adapter interface that any agent observability platform
+ * implements to integrate with Vorion's trust engine and enforcement pipeline.
+ */
+export interface ObservabilityAdapter {
+    /** Platform name (e.g., 'geordie', 'prompt-security', 'calypso') */
+    name: string;
+    /** Ingest a behavioral event and convert it to a trust signal */
+    ingestEvent(event: ObservabilityEvent): Promise<void>;
+    /** Ingest a batch of events */
+    ingestBatch(events: ObservabilityEvent[]): Promise<void>;
+    /** Query current trust state for an entity */
+    queryTrust(entityId: string): Promise<TrustQueryResponse>;
+    /** Request an enforcement decision */
+    enforce(request: EnforcementRequest): Promise<EnforcementResponse>;
+}
+//# sourceMappingURL=types.d.ts.map