axis-platform-sdk 0.2.1 → 0.3.0

package/CASE-STUDY-offworld.md

@@ -0,0 +1,56 @@
+# Case study: gating comments on a live news site
+
+> **This is a case study — an example of using `axis-platform-sdk`, not the
+> product.** The product is the SDK and the drop-in starters in
+> [`templates/`](templates/). This page shows what one real integration looks
+> like, so you can picture your own.
+
+## The platform
+
+**Offworld News** is a (fictional) news site that wanted to let AI agents post
+comments — but only agents with a real, accountable identity and explicit
+permission to comment, not anonymous bots. Classic bouncer problem: an API key
+can't say *which operator stands behind this agent* or *whether this agent was
+actually allowed to comment*, and you can't revoke one bad agent without
+disrupting everyone.
+
+## The integration
+
+The comment endpoint is wrapped exactly the way the starters are:
+
+1. **Published a door policy** at `/.well-known/axis-access` declaring the
+   platform's audience and that commenting requires the standard
+   `content:comment` scope at `email` tier or above.
+2. **Gated the accept-comment path** with the SDK: pull the agent's AIT off the
+   request → verify against the public registry → check it holds
+   `content:comment` against the trustworthy `effective_scope` → accept or bounce.
+3. **Kept the bouncer state** — an arrivals ledger and a runtime blocklist — using
+   the same record shapes the SDK defines, so a moderator can see who commented
+   and boot a bad agent without a redeploy.
+
+The adapter depends on the **published** package (`axis-platform-sdk@^0.2.1`) — it
+does not vendor or fork the engine. That's the whole point of shipping the SDK as
+a product: a real platform consumes it like any other dependency.
+
+## Two things this case study illustrates
+
+- **Standard scopes matter.** The integration uses `content:comment` (the standard
+  AXIS scope for commenting), not a bespoke `comments:write`. A non-standard scope
+  would fail to match the agent's proven `effective_scope` and the agent would be
+  denied. When you pick `requireScopes`, use the standard vocabulary where one
+  fits.
+- **Self-host is the product; the cloud-hosted version is the same engine.**
+  Offworld runs the gate on its own infrastructure (a Cloudflare Worker) — that is
+  the shipping, day-one path. It also pilots the in-development cloud-hosted version
+  for hosted arrival history and a moderator console. Because the SDK is the port
+  and the cloud-hosted version is being built as an adapter over it, those are the
+  same verification path — not a different system. For everyone else today,
+  self-host is the whole story; the cloud-hosted version is in alpha (Q3 2026).
+
+## What "the product" is, again
+
+If you run a platform and want this, you do **not** start from Offworld's code.
+You start from [`templates/node-express/`](templates/node-express/) or
+[`templates/cloudflare-worker/`](templates/cloudflare-worker/), follow
+[QUICKSTART.md](QUICKSTART.md), and you have your own bouncer in about ten
+minutes. Offworld is just proof that the shape works on a real site.

package/CHANGELOG.md

@@ -1,112 +1,179 @@
-# Changelog
-
-All notable changes to `axis-platform-sdk`. Pre-release; not yet published to npm.
-
-## [0.2.1] — 2026-06-25
-
-### Added — TypeScript declarations
-
-- The package now ships `.d.ts` types (it stays authored in plain JS). A
-  complete `src/index.d.ts` covers the full main-entry surface (verify,
-  authorizer, scope, gate, client, ledger, blocklist, reportback); each subpath
-  export (`./scope`, `./gate`, `./authorizer`, `./ledger`, `./blocklist`,
-  `./reportback`) re-exports its slice. `package.json` exposes them via a
-  top-level `types` field and per-subpath `types` conditions in `exports`.
-- This lets TypeScript consumers (e.g. Owyhee "The Door", swapping its vendored
-  copy for the npm dependency) drop their hand-maintained declaration and get
-  types from the package. Verified by a clean-room install + strict `tsc` of a
-  consumer importing from the root and a subpath.
-
-## [0.2.0] — 2026-06-25
-
-First npm publish + public repo. Adds the stateful half (ledger, blocklist,
-reputation report-back) and reconciles it with Owyhee "The Door" (governor#27)
-so the SDK and the product share one arrival/block shape.
-
-### Added — the stateful half (ledger, blocklist, reputation report-back)
-
-- **`AccessLedger` (`src/ledger.js`)** — the platform's "who showed up" record.
-  Logs every verdict to a pluggable store (default in-memory `MemoryLedgerStore`;
-  documented adapter shape for D1 / SQLite / Postgres). `recent()` / `byOperator()`
-  query helpers. `loggedGate(gate, ledger, fields)` wraps any gate so verdicts are
-  logged as a side effect (a store failure never changes the verdict). Only the
-  trustworthy `effective_scope` is recorded.
-- **`Blocklist` (`src/blocklist.js`)** — a runtime, stateful block list over the
-  same adapter shape. Blocks by `operator_id` AND by `agent_id` (agent-level
-  blocking is the SDK's superset over The Door's operator-only `operator_blocks`).
-  `blockedOperatorIds()` feeds verifyAgent's `blockedOperators`; `checkVerdict()`
-  enforces agent-level blocks post-verify (needs the resolved agent_id).
-  `gatedWithBlocklist(gate, blocklist)` wraps a gate.
-
-### Reconciled with The Door (single source of truth, no duplication)
-
-- The ledger entry shape is now byte-compatible with The Door's `ArrivalRecord`
-  / `arrivals` columns: carries `tier`, `delegation_valid`, `gate_id`,
-  `requested_action`, `display_name`; `created_at` is epoch ms (was an ISO `ts`);
-  `decision` uses the `auto_allow | denied | held | approved | booted` vocabulary
-  (was `accepted | denied`), with the manual-review states available via a
-  `recordEntry(..., { decision })` override.
-- Blocklist meta is `{ reason, created_at }` (epoch ms), matching `operator_blocks`.
-- The SDK is positioned as the **port + in-memory default**; The Door is the
-  canonical **D1-backed adapter**. README documents the mapping table. The SDK
-  ships the genuinely-new pieces The Door lacks (agent-level blocking, reputation
-  emit); The Door keeps its own D1 state layer and, post-publish, depends on this
-  package instead of vendoring it.
-- **Reputation report-back (`src/reportback.js`)** — `reportFlag()` builds a
-  protocol-shaped negative **Trust Attestation** (AXIS Layer 3; SPEC §4.5),
-  signs it with the platform's own Ed25519 key (`getPlatformKey()`, WebCrypto,
-  generated + persisted via a pluggable key store), and POSTs `{ attestation,
-  platform_public_key, signature }` to a configurable `reputationUrl`. OFF by
-  default — unconfigured is a graceful no-op (never throws). `blockAndReport()`
-  blocks locally + reports. `buildAttestation` / `signAttestation` /
-  `verifyAttestation` exposed. Zero-dep (no Buffer; WebCrypto + inline base64url
-  + inline JCS, byte-for-byte matching axis-protocol-sdk's signing convention).
-- **`examples/bouncer-worker.js`** — reference stateful bouncer: a Worker admin
-  over the ledger + blocklist (`/admin/arrivals` enriched for display,
-  `/admin/boot` = block + report, plus a tiny HTML console). A reference, not a
-  product; in-memory stores.
-
-### Notes
-
-- The reputation index is a SEPARATE, future, commercial service — NOT the
-  canonical registry, which stays identity-only (Layer 1 + Layer 2). The
-  `axis-reputation` stub receiver accepts-and-discards until the index is built.
-- New tests for ledger / blocklist / reportback + the Door-compatible shape.
-  Full suite: 40 passing (`node --test`).
-
-## [0.1.0] — 2026-06-16 (unreleased)
-
-First cut of the platform/verifier ("bouncer") side of AXIS.
-
-### Added
-
-- **`verifyAgent(token, opts)`** — verifies an AIT against the registry
-  (signature + revocation + delegation chain, all server-side) and applies a
-  platform's policy (audience match, required scopes against the trustworthy
-  `effective_scope`, blocked/approved operators, minimum verification tier).
-  Returns one structured verdict.
-- **`aitGate(opts)` / `extractToken()` / `denialResponse()`** — a drop-in
-  request gate for Cloudflare Workers (and Request-like objects). Pulls the AIT
-  from `Authorization: Bearer`, `X-AXIS-Token`, or `?ait=`.
-- **`SwitchAuthorizer`** — the free-tier gate engine and the first implementation
-  of the Authorizer port. Config-driven on/off gates with optional minimum tier,
-  required scopes, and operator allow/block lists. Its `policy` object is what a
-  "Door policy" screen edits and saves. The port is engine-agnostic so a paid
-  `EngineAuthorizer` (Permify / OpenFGA sidecar) can drop into the same slot.
-- **`scopeCovers` / `coversAll`** — AXIS scope matcher, ported verbatim from the
-  operator-side gateway so both sides agree on scope semantics.
-- **`enrich()`**, **`loadAccessPolicy()`**, **`decodeAitPayload()`** helpers.
-- Worked example: `examples/toy-platform-worker.js` (a bouncer comments service
-  gated by a `SwitchAuthorizer`).
-
-### Tested
-
-- 15 unit tests (`node --test`) across scope matching, the verify verdict
-  matrix, and the SwitchAuthorizer gate logic. `loadAccessPolicy` additionally
-  verified live against `registry.axisprime.ai`.
-
-### Notes
-
-- Zero runtime dependencies; runs in Node 20+, Cloudflare Workers, browsers.
-- Identity verification is fixed/core; only the authorization decision is
-  pluggable. The demo and the free tier need no external policy engine.
+# Changelog
+
+All notable changes to `axis-platform-sdk`.
+
+## [0.3.0] — Unreleased
+
+Productization pass: repackages the published SDK as a free, drop-in **product
+for platforms** — the platform-side equivalent of the AXIS Prime MCP's tester
+packaging — and adds a first-class Express/Connect adapter. The engine
+(`verify` / `authorizer` / `ledger` / `blocklist` / `reportback`) is unchanged.
+
+### Added — Express/Connect middleware (new subpath export)
+
+- **`axis-platform-sdk/express`** exports **`axisGate(opts)`** (and `extractToken`)
+  — the same verify-and-bounce logic as `aitGate`, but as Express/Connect
+  middleware `(req, res, next)`. On accept it sets `req.axis` and calls `next()`;
+  on deny it responds `401` (no token) / `403` (policy) / `503` (unexpected verify
+  error) with `{ error, message }`. Zero-dependency: it imports nothing from
+  Express, so it also runs on Connect, restify, and bare `http`. Ships
+  `src/express.d.ts` and an `exports` map entry. 6 new unit tests (suite now 46).
+  This is the first-class home for the Node drop-in (previously a copy-paste
+  template file).
+
+### Added — adoption tiers, badge kit, forward-compat docs
+
+- **Adoption tiers (A/B/C)** documented in the README: identity acceptance →
+  access policy → scope/tier enforcement, all the same `verifyAgent` call with more
+  options set.
+- **"Verified by AXIS" badge kit** (`badges/`): three zero-dependency SVGs (light,
+  dark, compact) for platforms that show verification status on agent-authored
+  content, plus a usage README. Shipped in the package `files`.
+- **Forward-compatibility note** on provenance gating: account-age / signup-method /
+  abuse-flag signals are protocol-defined but not yet registry-exposed; when they
+  ship they arrive as additive optional `verifyAgent` options + additive verdict
+  fields — no breaking change for existing integrations.
+- **"Staying up to date"** section: self-host is pull-based (semver + GitHub
+  Releases + CHANGELOG; Dependabot/Renovate); an opt-in integrator updates list is
+  planned.
+
+### Added — product wrapper (docs + drop-in starters)
+
+- **README rewritten as a product pitch** ("let verified agents into your
+  platform; boot the bad ones; free, drop-in, no account required"). The full API
+  reference is preserved lower in the same file. Headlines the free, standalone,
+  registry-only path; positions the cloud-hosted version (in alpha, Q3 2026) as an
+  optional upgrade, not a requirement.
+- **`QUICKSTART.md`** — "gate your platform in 10 minutes": pick a starter →
+  decide audience + scope → drop in the gate → publish `/.well-known/axis-access`
+  → test a deny → test an admit.
+- **`templates/node-express/`** — a complete, runnable Express drop-in: a ~30-line
+  `axisGate(...)` middleware (`axis-gate.js`), a full worked server with door
+  policy + arrivals ledger + runtime blocklist + `/admin` console, and a `smoke`
+  test that asserts the deny paths against the live registry (verified passing).
+- **`templates/cloudflare-worker/`** — the same as a deployable Worker
+  (`wrangler dev` / `wrangler deploy`), promoting `examples/bouncer-worker.js`
+  into a clean starter with `wrangler.toml` + `package.json`.
+- **`CASE-STUDY-offworld.md`** — the Offworld News comment-gating integration,
+  explicitly labeled as a case study (an example of using the tool), not the
+  product.
+
+### Notes
+
+- Standard scope vocabulary: starters and docs use `content:comment` (the standard
+  AXIS scope for commenting), not the older non-standard `comments:write`.
+- `examples/` are left in place as teaching references; `templates/` are the
+  copy-paste starting point. `templates/` is added to the published `files` list.
+- The only code change is the additive `src/express.js` adapter + its `.d.ts` and
+  `exports` entry; the existing engine modules are untouched. The 40 prior tests
+  are unchanged (suite now 46 with the Express tests). The previously published
+  surface remains fully backward-compatible — `/express` is purely additive.
+
+## [0.2.1] — 2026-06-25
+
+### Added — TypeScript declarations
+
+- The package now ships `.d.ts` types (it stays authored in plain JS). A
+  complete `src/index.d.ts` covers the full main-entry surface (verify,
+  authorizer, scope, gate, client, ledger, blocklist, reportback); each subpath
+  export (`./scope`, `./gate`, `./authorizer`, `./ledger`, `./blocklist`,
+  `./reportback`) re-exports its slice. `package.json` exposes them via a
+  top-level `types` field and per-subpath `types` conditions in `exports`.
+- This lets TypeScript consumers (e.g. the cloud-hosted version, swapping its
+  vendored copy for the npm dependency) drop their hand-maintained declaration and get
+  types from the package. Verified by a clean-room install + strict `tsc` of a
+  consumer importing from the root and a subpath.
+
+## [0.2.0] — 2026-06-25
+
+First npm publish + public repo. Adds the stateful half (ledger, blocklist,
+reputation report-back) and reconciles it with the cloud-hosted version so the
+SDK and the cloud product share one arrival/block shape.
+
+### Added — the stateful half (ledger, blocklist, reputation report-back)
+
+- **`AccessLedger` (`src/ledger.js`)** — the platform's "who showed up" record.
+  Logs every verdict to a pluggable store (default in-memory `MemoryLedgerStore`;
+  documented adapter shape for D1 / SQLite / Postgres). `recent()` / `byOperator()`
+  query helpers. `loggedGate(gate, ledger, fields)` wraps any gate so verdicts are
+  logged as a side effect (a store failure never changes the verdict). Only the
+  trustworthy `effective_scope` is recorded.
+- **`Blocklist` (`src/blocklist.js`)** — a runtime, stateful block list over the
+  same adapter shape. Blocks by `operator_id` AND by `agent_id` (agent-level
+  blocking is the SDK's superset over the cloud-hosted version's operator-only `operator_blocks`).
+  `blockedOperatorIds()` feeds verifyAgent's `blockedOperators`; `checkVerdict()`
+  enforces agent-level blocks post-verify (needs the resolved agent_id).
+  `gatedWithBlocklist(gate, blocklist)` wraps a gate.
+
+### Reconciled with the cloud-hosted version (single source of truth, no duplication)
+
+- The ledger entry shape is now byte-compatible with the cloud-hosted version's `ArrivalRecord`
+  / `arrivals` columns: carries `tier`, `delegation_valid`, `gate_id`,
+  `requested_action`, `display_name`; `created_at` is epoch ms (was an ISO `ts`);
+  `decision` uses the `auto_allow | denied | held | approved | booted` vocabulary
+  (was `accepted | denied`), with the manual-review states available via a
+  `recordEntry(..., { decision })` override.
+- Blocklist meta is `{ reason, created_at }` (epoch ms), matching `operator_blocks`.
+- The SDK is positioned as the **port + in-memory default**; the cloud-hosted
+  version is the canonical **D1-backed adapter**. README documents the mapping
+  table. The SDK ships the genuinely-new pieces the cloud-hosted version lacks
+  (agent-level blocking, reputation emit); the cloud-hosted version keeps its own
+  D1 state layer and, post-publish, depends on this package instead of vendoring it.
+- **Reputation report-back (`src/reportback.js`)** — `reportFlag()` builds a
+  protocol-shaped negative **Trust Attestation** (AXIS Layer 3; SPEC §4.5),
+  signs it with the platform's own Ed25519 key (`getPlatformKey()`, WebCrypto,
+  generated + persisted via a pluggable key store), and POSTs `{ attestation,
+  platform_public_key, signature }` to a configurable `reputationUrl`. OFF by
+  default — unconfigured is a graceful no-op (never throws). `blockAndReport()`
+  blocks locally + reports. `buildAttestation` / `signAttestation` /
+  `verifyAttestation` exposed. Zero-dep (no Buffer; WebCrypto + inline base64url
+  + inline JCS, byte-for-byte matching axis-protocol-sdk's signing convention).
+- **`examples/bouncer-worker.js`** — reference stateful bouncer: a Worker admin
+  over the ledger + blocklist (`/admin/arrivals` enriched for display,
+  `/admin/boot` = block + report, plus a tiny HTML console). A reference, not a
+  product; in-memory stores.
+
+### Notes
+
+- The reputation index is a SEPARATE, future, commercial service — NOT the
+  canonical registry, which stays identity-only (Layer 1 + Layer 2). The
+  `axis-reputation` stub receiver accepts-and-discards until the index is built.
+- New tests for ledger / blocklist / reportback + the Door-compatible shape.
+  Full suite: 40 passing (`node --test`).
+
+## [0.1.0] — 2026-06-16 (unreleased)
+
+First cut of the platform/verifier ("bouncer") side of AXIS.
+
+### Added
+
+- **`verifyAgent(token, opts)`** — verifies an AIT against the registry
+  (signature + revocation + delegation chain, all server-side) and applies a
+  platform's policy (audience match, required scopes against the trustworthy
+  `effective_scope`, blocked/approved operators, minimum verification tier).
+  Returns one structured verdict.
+- **`aitGate(opts)` / `extractToken()` / `denialResponse()`** — a drop-in
+  request gate for Cloudflare Workers (and Request-like objects). Pulls the AIT
+  from `Authorization: Bearer`, `X-AXIS-Token`, or `?ait=`.
+- **`SwitchAuthorizer`** — the free-tier gate engine and the first implementation
+  of the Authorizer port. Config-driven on/off gates with optional minimum tier,
+  required scopes, and operator allow/block lists. Its `policy` object is what a
+  "Door policy" screen edits and saves. The port is engine-agnostic so a paid
+  `EngineAuthorizer` (Permify / OpenFGA sidecar) can drop into the same slot.
+- **`scopeCovers` / `coversAll`** — AXIS scope matcher, ported verbatim from the
+  operator-side gateway so both sides agree on scope semantics.
+- **`enrich()`**, **`loadAccessPolicy()`**, **`decodeAitPayload()`** helpers.
+- Worked example: `examples/toy-platform-worker.js` (a bouncer comments service
+  gated by a `SwitchAuthorizer`).
+
+### Tested
+
+- 15 unit tests (`node --test`) across scope matching, the verify verdict
+  matrix, and the SwitchAuthorizer gate logic. `loadAccessPolicy` additionally
+  verified live against `registry.axisprime.ai`.
+
+### Notes
+
+- Zero runtime dependencies; runs in Node 20+, Cloudflare Workers, browsers.
+- Identity verification is fixed/core; only the authorization decision is
+  pluggable. The demo and the free tier need no external policy engine.

package/QUICKSTART.md

@@ -0,0 +1,168 @@
+# Gate your platform in 10 minutes
+
+Goal: an endpoint on your platform that only accepts **AXIS-verified agents** with
+the right permission, turns everyone else away with a clear reason, and lets you
+boot a bad actor without a redeploy.
+
+You need: Node 20+ (or a Cloudflare Workers project). You do **not** need an
+account with us, a Cloudflare account (unless you choose the Worker path), a
+database, or any hosted service. The free path is one outbound HTTPS call to the
+public AXIS registry.
+
+---
+
+## 0. Pick a starter (1 min)
+
+Copy the folder that matches your stack and work inside it:
+
+- **Node / Express** → [`templates/node-express/`](templates/node-express/)
+- **Cloudflare Workers** → [`templates/cloudflare-worker/`](templates/cloudflare-worker/)
+
+Already have an app? Skip the copy and just `npm install axis-platform-sdk`, then
+follow the inline code below.
+
+```
+npm install axis-platform-sdk     # zero dependencies
+```
+
+---
+
+## 1. Decide two things (1 min)
+
+- **Your audience** — a stable id for *your* platform, e.g. `comments.mysite.com`.
+  Agents address their token to this; you reject tokens addressed to anyone else.
+- **The scope an agent must hold** — e.g. `content:comment`. Use a standard AXIS
+  scope where one fits (`content:comment` for commenting). This is checked against
+  the agent's **proven** permission, not what its token claims.
+
+---
+
+## 2. Drop the gate in front of your action (3 min)
+
+**Express:**
+
+```js
+import express from 'express';
+import { axisGate } from 'axis-platform-sdk/express';   // first-class middleware export
+
+const app = express();
+app.use(express.json());
+
+app.post('/comments',
+  axisGate({ audience: 'comments.mysite.com', requireScopes: ['content:comment'] }),
+  (req, res) => {
+    // req.axis.agent_id is a VERIFIED agent id. Run your real handler.
+    res.json({ ok: true, by: req.axis.agent_id });
+  });
+
+app.listen(8787);
+```
+
+**Cloudflare Worker:**
+
+```js
+import { aitGate, denialResponse } from 'axis-platform-sdk';
+
+const gate = aitGate({ audience: 'comments.mysite.com', requireScopes: ['content:comment'] });
+
+export default {
+  async fetch(request) {
+    const verdict = await gate(request);
+    if (!verdict.accepted) return denialResponse(verdict);
+    return Response.json({ ok: true, by: verdict.agent_id });
+  },
+};
+```
+
+The gate pulls the token from `Authorization: Bearer <ait>`, `X-AXIS-Token`, or
+`?ait=`, verifies it against the registry, applies your policy, and either runs
+your handler or returns `401` (no token) / `403` (bounced) with a real reason.
+
+---
+
+## 3. Publish your door policy (2 min)
+
+Tell agents (and their operators) what your platform requires by serving a small
+JSON document at **`/.well-known/axis-access`**:
+
+```js
+// GET /.well-known/axis-access
+{
+  "axis_version": "0.3",
+  "platform_id": "comments.mysite.com",
+  "audience": "comments.mysite.com",
+  "access_policy": {
+    "minimum_verification_level": "email",
+    "required_scopes": ["content:comment"],
+    "allow_unverified": false
+  }
+}
+```
+
+Both starters already serve this. An agent's tooling can read it with
+`loadAccessPolicy('https://comments.mysite.com')` to know how to get in. (For a
+live example, `curl https://registry.axisprime.ai/.well-known/axis-access`.)
+
+---
+
+## 4. Test the deny path — right now, no agent needed (1 min)
+
+A request with no identity must be turned away:
+
+```bash
+curl -i -X POST localhost:8787/comments -H 'content-type: application/json' -d '{"text":"hi"}'
+# HTTP/1.1 401 Unauthorized
+# {"error":"no_token","message":"No AIT presented"}
+```
+
+The Express starter automates this:
+
+```
+npm run smoke
+# PASS — no AIT -> 401 no_token
+# PASS — invalid AIT -> 403 denied
+```
+
+If you see those, your bouncer is live and refusing unidentified traffic. That's
+the free path working end-to-end against the public registry.
+
+---
+
+## 5. Test the accept path — let a real agent in (2 min)
+
+To see a `200`, you need an agent that has actually been **delegated**
+`content:comment` by its operator and presents a token addressed to your
+`audience`. Agents get their identity from the
+**[AXIS Prime MCP](https://github.com/MachinesOfDesire/axis-mcp)** (the agent
+side):
+
+1. The agent onboards via the MCP and registers with an operator.
+2. The operator **grants** it `content:comment` (`axis grant content:comment`).
+3. The agent mints an AIT with `aud = comments.mysite.com` and presents it:
+
+```bash
+curl -X POST https://comments.mysite.com/comments \
+  -H "Authorization: Bearer <the-agents-AIT>" \
+  -H 'content-type: application/json' \
+  -d '{"text":"hello from a verified agent"}'
+# {"ok":true,"posted_by":"axis:acme:bot","operator":"axis:acme:op","scope":["content:comment"], ... }
+```
+
+In the starter's `/admin` console, that arrival turns **green** — and you can
+**boot** it (block + optionally report) with one click if it misbehaves.
+
+---
+
+## Where to go next
+
+- **Require stronger identity:** add `minTier: 'domain'` (or `verified`,
+  `kyb_organization`) to the gate to demand domain- or KYB-verified operators.
+- **Persist arrivals + blocks:** the in-memory stores reset on restart. Implement
+  the store adapter shape (see `ledger.js` / `blocklist.js` in the SDK) against
+  your database. The record shape matches the cloud-hosted version, so moving to
+  it later won't mean reshaping data.
+- **Turn on reputation report-back:** set a `reputationUrl` so booting a bad agent
+  emits a signed Trust Attestation onward. Off by default.
+- **Don't want to host the console + state yourself?** A cloud-hosted version is in
+  alpha testing (planned for Q3 2026) over this exact engine. For now, self-host is
+  the way — and it's the whole product.