create-metamynd-agent 0.14.2 → 0.14.6

package/README.md

@@ -175,6 +175,11 @@ the whole protocol.
 Named precisely, not left implicit:
 
 - **Direct call.** `bookFlight()` doesn't exist in the agent's process.
+- **Forged or replayed policy (every gateway is pinned, 0.14.3).** The gateway's `policyPublicKey` is baked in from your
+  provisioning response (or, from an older API, `GET /magp/policy/pubkey`), and with `@metamynd/agentsafe-mcp-guard` 0.18.1 an
+  unsigned, tampered or stale bundle is refused for every action, amount 0 included — so a non-financial gateway cannot be granted
+  an action by whoever sits on its bundle fetch. If no key can be had, the CLI scaffolds no gateway at all (it keeps the
+  provisioned config and says so) rather than writing an unpinned one.
 - **Payload binding is ON by default (0.11.0, MAGP §8.3.9).** The generated agent signs the COMPLETE body it sends as a payload, the
   authorization it gets from the gate is bound to that same body, and the generated gateway sets `requirePayloadBinding: true`: it
   digests the body it is about to run and the issuer refuses the claim unless that is the digest the agent signed. The eight
@@ -428,9 +433,12 @@ signed value only and ignores one in the context. Scaffolds pin `@metamynd/agent
 
 The starter rules include a high-risk review. A request that sends **no** `riskLevel` (or an unrecognised one)
 is no longer waved through: it is **escalated** (`CONTEXT_UNVERIFIABLE`) for a human, because an agent that omits
-its risk is indistinguishable from one hiding it. The scaffolded financial examples send `riskLevel` (`'low'`
-unless you say otherwise) — that default is a placeholder, not an assessment — and the neutral template passes
-your own `args` as the context, so include it there. A real integration should send an honest one — or, better, not depend on the agent at all: a mandate
+its risk is indistinguishable from one hiding it. The scaffolded examples pass the tool call's own `riskLevel`
+through **unchanged** — there is no default, so a call that does not say is sent for review rather than treated as
+`'low'` (the demo steps each state their risk explicitly). The neutral template passes your own `args` as the
+context, so include it there. Either way `riskLevel` is **the agent's own claim**: it travels in the request
+context, and even when the agent's key signs that context, the signature proves who said it, not that it is true —
+nothing checks the value unless your owner configures provenance for it. A real integration should send an honest one — or, better, not depend on the agent at all: a mandate
 permission can carry an owner-set `riskTier` that no claim can lower, and a gateway route can derive the risk
 itself with `route.trustedContext` (`@metamynd/agentsafe-http-gateway` 0.10.0). See MAGP §6.3.
 

package/index.mjs

@@ -59,7 +59,9 @@ const GUARD_PKG = '@metamynd/agentsafe-guard';
 // 0.17.0 signs the agent's context (envelopeSignature, MAGP 8.3.13) by default; the scaffolded agent gets it with no template
 // change (signContext: false opts out). A daemon-custody agent needs agentsafe-signer >= 0.19.0 for its no-amount requests.
 // 0.18.0 exports keepAliveFetch. No template change.
-const GUARD_VERSION = '^0.18.0';
+// 0.18.1 parks a local-first ESCALATE at the gate. Required: every scaffold's demo says "approve it in the dashboard and
+// the action resumes", and below this the escalation never reached the owner's queue (decided in-process, no escalationId).
+const GUARD_VERSION = '^0.18.1';
 /** The harness entry point's config load, shared by both harness templates: a fresh clone has no
  *  agent.metamynd.json (it is gitignored), so say what to do instead of a bare ENOENT (BR-004). */
 function harnessConfigLoad() {
@@ -120,7 +122,10 @@ const MCP_GUARD_PKG = '@metamynd/agentsafe-mcp-guard';
 // requireContextSignature option. No template change (the scaffolded agent does not sign its context by default).
 // 0.18.0: an opt-in bundleCache (push-invalidated by the issuer's events stream) and keepAliveFetch exported. No
 // template change (the scaffolded gateways don't enable the cache).
-const MCP_GUARD_VERSION = '^0.18.0';
+// 0.18.1: the pinned policyPublicKey every scaffolded gateway sets now refuses an unsigned or stale bundle for an
+// amount-0 action too. Required: the non-financial gateway's every request is amount 0, so below this a stripped
+// bundle could grant it an action the agent never had.
+const MCP_GUARD_VERSION = '^0.18.1';
 const GATEWAY_PKG = '@metamynd/agentsafe-http-gateway';
 // 0.2.0 fixes a confused-deputy gap (payload not bound to the signed request) — the CLI must
 // never scaffold a range that could resolve below it.
@@ -369,6 +374,16 @@ function loadConfigFile(path) {
   return json;
 }
 
+// Written into every financial scaffold's README. The generated code passes the tool call's riskLevel through
+// unchanged (no `?? 'low'`): a missing one must reach the gate as missing, where it escalates by design.
+const RISK_LEVEL_NOTE = `## Risk level: the agent's own claim
+
+\`riskLevel\` is **the agent's own claim**. It travels in the request's context: the agent's key may sign that context,
+which proves who said it, not that it is true, and nothing checks the value unless your owner configures provenance for it (an owner-set \`riskTier\` on the mandate permission, or a
+gateway route's \`trustedContext\`). \`index.mjs\` passes the tool call's own \`riskLevel\` through unchanged —
+there is **no default**. A call that does not state one (or states one the gate does not recognise) is **sent
+for review** (\`CONTEXT_UNVERIFIABLE\`), never treated as \`low\`. The demo steps each state their risk explicitly.`;
+
 // A rule needs `when.predicate` (the atom) and `then` (the decision the gate should return
 // when it fires) — everything else is optional sugar. See backend's atom-catalog.ts for the
 // full predicate list (amount-over, risk-at-or-above, jurisdiction-not-allowed, ...).
@@ -471,10 +486,27 @@ function defaultNeutralDemo() {
   return demo;
 }
 
+/**
+ * Where an agent's rules are edited in the dashboard. SOPs belong to the legal entity, so the page is
+ * VeriFAI → Legal Entities (/dashboard/organization), SOPs tab; the AgentSafe sidebar group links the same
+ * tab as "SOPs". This said "Legal Entity → SOPs", a path no menu had (2026-10-02 eval, L-1).
+ */
+const SOPS_PATH = 'Dashboard → VeriFAI → Legal Entities → SOPs tab (also linked as AgentSafe → SOPs)';
+/** The same path for the generated demo's console output, which stays ASCII. */
+const SOPS_PATH_ASCII = 'Dashboard -> VeriFAI -> Legal Entities -> SOPs';
+/**
+ * A --sandbox scaffold runs as the SHARED sandbox agent, which no user has dashboard access to, so "change
+ * the rules in the dashboard" sent them somewhere they could not go (L-7). Say how to get an agent whose
+ * rules they CAN change instead.
+ */
+const SANDBOX_RULES_FIXED = "This is the shared sandbox agent: its rules are fixed and nobody can edit them. To change the rules, provision your own agent — re-run without --sandbox (it signs you up and creates an agent whose SOPs you own, edited at " + SOPS_PATH + "), or use --harness for a free local agent whose rules you edit by hand.";
+
 /** A --config file's rules cannot reach an agent the caller does not provision themselves: say so instead of implying they apply. */
-function warnRulesNotApplied(fileConfig, where) {
+function warnRulesNotApplied(fileConfig, where, { shared = false } = {}) {
   if (policyMolecules(fileConfig).length === 0) return;
-  console.log(`  ${c.yellow('!')} the rules in ${c.b('the config file')} are not applied to ${where} — its rules are the platform's defaults. Set your own in the dashboard (Legal Entity → SOPs), or provision your own agent (drop this flag) to author them here.`);
+  console.log(shared
+    ? `  ${c.yellow('!')} the rules in ${c.b('the config file')} are not applied to ${where} — its rules are the platform's defaults, and nobody can change them. Provision your own agent (drop this flag) to author them here.`
+    : `  ${c.yellow('!')} the rules in ${c.b('the config file')} are not applied to ${where} — its rules are the platform's defaults. Its owner sets them in the dashboard (${SOPS_PATH}), or provision your own agent (drop this flag) to author them here.`);
 }
 
 /**
@@ -972,6 +1004,50 @@ async function registerGatewayCounterparty(base, token, did, label) {
   }
 }
 
+/**
+ * Every scaffolded gateway pins the issuer's policy-signing key, so it refuses any bundle MetaMynd did not sign —
+ * an unpinned gateway trusts whatever its bundle fetch returns, and over plain http:// that is whatever an
+ * interceptor wrote (mcp-guard only refuses VALUE-bearing actions there, and a non-financial agent has none).
+ * The provisioning response carries the key (`issuer.policyKey`); when it does not (an older backend), it is read
+ * from GET /magp/policy/pubkey on the same API this CLI just provisioned through, then saved into the config.
+ * Returns the key, or null when neither source has one — the caller must then not scaffold a gateway.
+ */
+async function ensurePolicyKey(config, base) {
+  const isKey = (k) => typeof k === 'string' && /^[0-9a-f]{64}$/i.test(k);
+  if (isKey(config.issuer?.policyKey)) return config.issuer.policyKey;
+  let key = null;
+  try {
+    const res = await fetch(`${String(base).replace(/\/+$/, '')}/magp/policy/pubkey`);
+    key = (await res.json().catch(() => null))?.data?.publicKey ?? null;
+  } catch {
+    key = null;
+  }
+  if (!isKey(key)) return null;
+  config.issuer = { ...(config.issuer ?? {}), policyKey: key.toLowerCase() };
+  return config.issuer.policyKey;
+}
+
+const NO_POLICY_KEY = (base) =>
+  `Could not get MetaMynd's policy-signing key: the provisioning response carried none, and GET ${base}/magp/policy/pubkey ` +
+  'did not return one. A gateway without it would trust whatever policy bundle its network fetch returns, so none was ' +
+  'scaffolded. Retry when the API is reachable, or pass --no-gateway for the single-process example (not an enforcement boundary).';
+
+/**
+ * Stop after provisioning WITHOUT losing what it returned: a managed agent key is handed back once and cannot be
+ * fetched again. Saves the config into the project directory (never over an existing file), then fails with `why`.
+ */
+function keepConfigAndFail(outDir, config, why) {
+  let kept = null;
+  try {
+    mkdirSync(outDir, { recursive: true });
+    kept = join(outDir, existsSync(join(outDir, 'agent.metamynd.json')) ? `agent.metamynd.${Date.now()}.json` : 'agent.metamynd.json');
+    writeFileSync(kept, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+  } catch {
+    kept = null;
+  }
+  fail(`${why}${kept ? `\n  The agent was provisioned; its config (with its key) was saved to ${kept.replace(/\\/g, '/')}.` : ''}`);
+}
+
 // ---------- scaffolding ----------
 /**
  * The --no-gateway / --sandbox variant: the tool is a local function in the SAME process as
@@ -983,7 +1059,7 @@ async function registerGatewayCounterparty(base, token, did, label) {
  * it — the same shape of gap --harness's README documents. See exampleIndex() below, which is
  * what the real (non-sandbox) flow scaffolds by default instead.
  */
-function exampleIndexNoGateway(scope, perTxnMax, currency, merchant) {
+function exampleIndexNoGateway(scope, perTxnMax, currency, merchant, sandbox = false) {
   const under = Math.max(1, Math.round(perTxnMax * 0.5));
   const over = Math.round(perTxnMax + 100);
   return `// index.mjs — your agent, governed by MetaMynd/AgentSafe.
@@ -1012,7 +1088,10 @@ const gatedBookFlight = guard.guardTool(
     amount: a.amount,
     currency: '${currency}',
     merchant: a.merchant,
-    context: { tool: 'book-flight', riskLevel: a.riskLevel ?? 'low' },
+    // riskLevel is the agent's OWN claim: signing it proves who said it, not that it is true, and nothing checks it unless
+    // the owner configures provenance. Passed through as-is: when the agent does not say, it stays absent and the gate sends
+    // the action for review — never 'low'.
+    context: { tool: 'book-flight', riskLevel: a.riskLevel },
   }),
 );
 
@@ -1127,8 +1206,12 @@ console.log(bold('  Without MetaMynd, you can be bypassed.') + ' bookFlight() ru
 console.log(dim('  call it directly instead of gatedBookFlight and nothing above stops you.'));
 console.log(dim('  Re-scaffold without --sandbox/--no-gateway for the default shape, which does.'));
 console.log('');
-console.log('  Change the cap in the dashboard (Legal Entity -> SOPs) and run again.');
-console.log(dim('  The outcome changes. This file does not. That is the point.'));
+${sandbox ? `console.log('  This is the SHARED sandbox agent: its rules are fixed and nobody can edit them.');
+console.log(dim('  To change the cap, provision your own agent: re-run create-metamynd-agent'));
+console.log(dim('  without --sandbox (it signs you up), then change the cap in your dashboard'));
+console.log(dim('  (${SOPS_PATH_ASCII}) and run again.'));
+console.log(dim('  The outcome changes. Your code does not. That is the point.'));` : `console.log('  Change the cap in the dashboard (${SOPS_PATH_ASCII}) and run again.');
+console.log(dim('  The outcome changes. This file does not. That is the point.'));`}
 console.log('');
 `;
 }
@@ -1173,7 +1256,8 @@ async function bookFlightViaGateway(args, decision) {
     amount: args.amount,
     currency: args.currency ?? '${currency}',
     merchant: args.merchant,
-    context: { tool: 'book-flight', riskLevel: args.riskLevel ?? 'low' },
+    // Passed through as-is (never defaulted): a missing riskLevel must reach the gateway as missing.
+    context: { tool: 'book-flight', riskLevel: args.riskLevel },
     payload,
   });
   signed.authorizationId = decision?.authorizationId;
@@ -1201,7 +1285,10 @@ const gatedBookFlight = guard.guardTool(
     amount: a.amount,
     currency: a.currency ?? '${currency}',
     merchant: a.merchant,
-    context: { tool: 'book-flight', riskLevel: a.riskLevel ?? 'low' },
+    // riskLevel is the agent's OWN claim: signing it proves who said it, not that it is true, and nothing checks it unless
+    // the owner configures provenance. Passed through as-is: when the agent does not say, it stays absent and the gate sends
+    // the action for review — never 'low'.
+    context: { tool: 'book-flight', riskLevel: a.riskLevel },
     // The authorization is bound to the SAME body bookFlightViaGateway() sends, so the gate records what this agent
     // signed and the gateway can prove it is running exactly that. Keep the two in step if you add a field.
     payload: { amount: a.amount, merchant: a.merchant, currency: a.currency ?? '${currency}' },
@@ -1324,7 +1411,7 @@ console.log('');
 console.log(bold('  With MetaMynd, you can\\'t be bypassed.') + ' ./gateway is why - it independently');
 console.log(dim('  re-verified step 1 before running it, and holds the tool this file never can.'));
 console.log('');
-console.log('  Change the cap in the dashboard (Legal Entity -> SOPs) and run again.');
+console.log('  Change the cap in the dashboard (${SOPS_PATH_ASCII}) and run again.');
 console.log(dim('  The outcome changes. This file does not. That is the point.'));
 console.log('');
 `;
@@ -1357,7 +1444,7 @@ If a committed \`package-lock.json\` pins an older \`${GUARD_PKG}\` than this pr
  * with `gatewayPort` the tool lives in a separate process (./gateway, the real enforcement
  * boundary); without it (--no-gateway) the tool is a local function in this process.
  */
-function exampleIndexNeutral({ scope, gatewayPort, demo, merchant }) {
+function exampleIndexNeutral({ scope, gatewayPort, demo, merchant, sandbox = false }) {
   const withGateway = gatewayPort != null;
   const steps = [
     ...demo.cases,
@@ -1504,8 +1591,12 @@ console.log(bold('  Without MetaMynd, you can be bypassed.') + ' performAction()
 console.log(dim('  call it directly instead of gatedAction and nothing above stops you.'));
 console.log(dim('  Re-scaffold without --no-gateway for the default shape, which closes that.'));`}
 console.log('');
-console.log('  Change your rules in the dashboard (Legal Entity -> SOPs) and run again.');
-console.log(dim('  The outcome changes. This file does not. That is the point.'));
+${sandbox ? `console.log('  This is the SHARED sandbox agent: its rules are fixed and nobody can edit them.');
+console.log(dim('  To change them, provision your own agent: re-run create-metamynd-agent'));
+console.log(dim('  without --sandbox (it signs you up), then change its rules in your dashboard'));
+console.log(dim('  (${SOPS_PATH_ASCII}) and run again.'));
+console.log(dim('  The outcome changes. Your code does not. That is the point.'));` : `console.log('  Change your rules in the dashboard (${SOPS_PATH_ASCII}) and run again.');
+console.log(dim('  The outcome changes. This file does not. That is the point.'));`}
 console.log('');
 `;
 }
@@ -1561,7 +1652,7 @@ const routes = [{ method: 'POST', path: '/perform', action: '${scope}', valueFie
 // forged bundle). Without it, verifyBundle() never runs at all: an attacker who can intercept the
 // fetch to \`\${MAGP_API}/policy/bundle/...\` — a MITM, a compromised DNS/proxy — can hand this gateway
 // a bundle with a higher cap or no rules, and it would be trusted the same as the real one.
-const guard = createMcpGuard({ serviceDid: 'did:local:${scope}-gateway', issuerApi: MAGP_API, requireAuthorization: false${policyKey ? `, policyPublicKey: '${policyKey}'` : ''} });
+const guard = createMcpGuard({ serviceDid: 'did:local:${scope}-gateway', issuerApi: MAGP_API, requireAuthorization: false, policyPublicKey: '${policyKey}' });
 
 const gateway = createHttpGateway({
   guard,
@@ -1684,7 +1775,15 @@ Replace \`performAction()\` in \`server.mjs\` with your implementation and put a
 }
 
 /** The README for a non-financial hosted scaffold. `withGateway` selects the two-process shape. */
-function exampleReadmeNeutral(slug, scope, withGateway, gatewayPort, daemonKey, demo) {
+/** The generated README's "Change the rules" body: the dashboard path, or — for the shared sandbox agent — how to get an agent whose rules you can change. */
+function changeRulesSection(sandbox) {
+  return sandbox
+    ? `${SANDBOX_RULES_FIXED} An \`escalate\` verdict is held for an owner to approve; poll \`guard.escalationStatus(id)\`.`
+    : `Edit the agent's SOPs in the dashboard (${SOPS_PATH}). The agent's behaviour changes live —
+no redeploy. An \`escalate\` verdict is held for an owner to approve; poll \`guard.escalationStatus(id)\`.`;
+}
+
+function exampleReadmeNeutral(slug, scope, withGateway, gatewayPort, daemonKey, demo, sandbox = false) {
   const configLine = daemonKey
     ? `- \`agent.metamynd.json\` — your portable guard config (identity, mandate scope \`${scope}\`, issuer keys).
   **Holds no secret key.** Signing goes through your already-running agentsafe-signer daemon instead.`
@@ -1763,8 +1862,7 @@ ${clonedFreshSection(daemonKey)}
 
 ## Change the rules
 
-Edit the agent's SOPs in the dashboard (Legal Entity → SOPs). The agent's behaviour changes live —
-no redeploy. An \`escalate\` verdict is held for an owner to approve; poll \`guard.escalationStatus(id)\`.
+${changeRulesSection(sandbox)}
 
 ## What this is not
 
@@ -1801,7 +1899,7 @@ function examplePackageJson(slug, neutral = false) {
   ) + '\n';
 }
 
-function exampleReadme(slug, scope, withGateway, gatewayPort, daemonKey = false) {
+function exampleReadme(slug, scope, withGateway, gatewayPort, daemonKey = false, sandbox = false) {
   const configFileLine = daemonKey
     ? `- \`agent.metamynd.json\` — your portable guard config (identity, mandate scope \`${scope}\`, issuer keys).
   **Holds no secret key.** Signing goes through your already-running agentsafe-signer daemon
@@ -1828,6 +1926,8 @@ You should see an ALLOW (fulfilled by \`./gateway\`), a BLOCK (over the per-tran
 an ESCALATE (high risk). The BLOCK and ESCALATE never reach the gateway at all — this file's own
 \`guard.guardTool()\` refuses them first. Only the ALLOW crosses into the other process.
 
+${RISK_LEVEL_NOTE}
+
 ## Files
 
 ${configFileLine}
@@ -1849,6 +1949,8 @@ npm start
 
 You should see an ALLOW, a BLOCK (over the per-transaction cap), and an ESCALATE (high risk).
 
+${RISK_LEVEL_NOTE}
+
 ## Files
 
 ${configFileLine}
@@ -1891,8 +1993,7 @@ ${clonedFreshSection(daemonKey)}
 
 ## Change the rules
 
-Edit the agent's SOPs in the dashboard (Legal Entity → SOPs). The agent's behaviour changes live —
-no redeploy. An \`escalate\` verdict is held for an owner to approve; poll \`guard.escalationStatus(id)\`.
+${changeRulesSection(sandbox)}
 
 Full integration guide: \`docs/integration/INTEGRATE-WITH-METAMYND.md\`.
 `;
@@ -1966,7 +2067,7 @@ const identity = JSON.parse(readFileSync(new URL('./service.metamynd.json', impo
 // forged bundle). Without it, verifyBundle() never runs at all: an attacker who can intercept the
 // fetch to \`\${MAGP_API}/policy/bundle/...\` — a MITM, a compromised DNS/proxy — can hand this gateway
 // a bundle with a higher cap or no rules, and it would be trusted the same as the real one.
-const guard = createMcpGuard({ serviceDid: identity.serviceDid, serviceKey: identity.serviceKey ?? undefined, issuerApi: MAGP_API, requireAuthorization: true${policyKey ? `, policyPublicKey: '${policyKey}'` : ''} });
+const guard = createMcpGuard({ serviceDid: identity.serviceDid, serviceKey: identity.serviceKey ?? undefined, issuerApi: MAGP_API, requireAuthorization: true, policyPublicKey: '${policyKey}' });
 
 const gateway = createHttpGateway({
   guard,
@@ -2233,10 +2334,10 @@ function scaffoldProject({ outDir, config, slug, scope, perTxnMax, currency = 'U
     outDir,
     'index.mjs',
     neutral
-      ? exampleIndexNeutral({ scope, gatewayPort: withGateway ? gatewayPort : null, demo, merchant })
+      ? exampleIndexNeutral({ scope, gatewayPort: withGateway ? gatewayPort : null, demo, merchant, sandbox: !!sandbox })
       : withGateway
         ? exampleIndex(scope, perTxnMax, gatewayPort, currency, paymentMerchant)
-        : exampleIndexNoGateway(scope, perTxnMax, currency, paymentMerchant),
+        : exampleIndexNoGateway(scope, perTxnMax, currency, paymentMerchant, !!sandbox),
     force,
   );
   writeFileSafe(outDir, 'package.json', examplePackageJson(slug, neutral), force);
@@ -2245,8 +2346,8 @@ function scaffoldProject({ outDir, config, slug, scope, perTxnMax, currency = 'U
     outDir,
     'README.md',
     neutral
-      ? exampleReadmeNeutral(slug, scope, withGateway, gatewayPort, config.keyProvider === 'daemon', demo)
-      : exampleReadme(slug, scope, withGateway, gatewayPort, config.keyProvider === 'daemon'),
+      ? exampleReadmeNeutral(slug, scope, withGateway, gatewayPort, config.keyProvider === 'daemon', demo, !!sandbox)
+      : exampleReadme(slug, scope, withGateway, gatewayPort, config.keyProvider === 'daemon', !!sandbox),
     force,
   );
   // `npm test` (agentsafe-guard verify --context) needs the request inputs of a compliant request:
@@ -2262,12 +2363,14 @@ function scaffoldProject({ outDir, config, slug, scope, perTxnMax, currency = 'U
 
   if (withGateway) {
     const apiBase = config.apiBase ?? config.api ?? DEFAULT_API;
-    // The key that signs every policy bundle (magp.policy-signer.ts) — present on every provisioning
-    // response that talks to a real backend (full account, sandbox, delegated-claim). Baked into the
-    // generated gateway so it pins the bundle rather than trusting whatever the fetch returns; absent
-    // only for a config predating this field (an older scaffold's saved agent.metamynd.json), where
-    // the generated gateway is unchanged from before rather than baking in nothing and crashing.
+    // The key that signs every policy bundle (magp.policy-signer.ts), baked into the generated gateway so it pins the
+    // bundle rather than trusting whatever the fetch returns. REQUIRED: an unpinned gateway takes an interceptor's
+    // bundle as its rules (2026-10-02 — a non-financial gateway executed an action the agent was never granted). The
+    // interactive flows fill it in with ensurePolicyKey() before calling this, so a missing key here is a caller bug.
     const policyKey = config.issuer?.policyKey ?? null;
+    if (!policyKey) {
+      throw new Error("scaffoldProject: a gateway needs the issuer's policy-signing key (config.issuer.policyKey) to pin its bundle — call ensurePolicyKey() first, or pass withGateway: false");
+    }
     const gwDir = join(outDir, 'gateway');
     if (!existsSync(gwDir)) mkdirSync(gwDir, { recursive: true });
     if (!neutral) {
@@ -2315,7 +2418,9 @@ function scaffoldProject({ outDir, config, slug, scope, perTxnMax, currency = 'U
     console.log(c.dim('                 · BLOCK (the agent asking to raise its OWN limit)\n'));
   }
   console.log(c.cyan(`    npm test`) + c.dim('    → assert it CANNOT exceed its mandate. Put this in CI.\n'));
-  console.log(c.dim(`  Change the rules any time in the dashboard (Legal Entity → SOPs) — no redeploy.\n`));
+  console.log(c.dim(sandbox
+    ? `  ${SANDBOX_RULES_FIXED}\n`
+    : `  Change the rules any time in the dashboard (${SOPS_PATH}) — no redeploy.\n`));
 }
 
 /** --sandbox: no login, no KYB — fetch the shared sandbox agent config and scaffold. */
@@ -2330,7 +2435,7 @@ async function runSandbox(args) {
   const fileConfig = typeof args.config === 'string' ? loadConfigFile(args.config) : null;
   if (fileConfig) console.log(`  ${c.green('✓')} loaded policy config ${c.dim(args.config)}`);
   const { financial } = announceFinancial(args, fileConfig);
-  warnRulesNotApplied(fileConfig, 'the shared sandbox agent');
+  warnRulesNotApplied(fileConfig, 'the shared sandbox agent', { shared: true });
   if (!financial && typeof fileConfig?.scope === 'string' && fileConfig.scope !== 'perform-action') {
     console.log(`  ${c.yellow('!')} the scope "${fileConfig.scope}" in the config file is not used: the shared sandbox agent's scope is "perform-action".`);
   }
@@ -3044,7 +3149,8 @@ async function callGateway(path, action, args) {
   // The COMPLETE body the tool receives, signed as a payload (MAGP 8.3.9): the eight signed fields cover amount and merchant
   // only, and this gateway refuses to run the tool on a body that is not exactly the one signed here.
   const payload = { amount: args.amount, merchant: args.merchant, currency: args.currency ?? '${currency}' };
-  const signed = await guard.buildSignedRequest({ action, amount: args.amount, currency: args.currency ?? '${currency}', merchant: args.merchant, context: { tool: '${scope}', riskLevel: args.riskLevel ?? 'low' }, payload });
+  // riskLevel is passed through as-is (never defaulted): a missing one must reach the gateway as missing.
+  const signed = await guard.buildSignedRequest({ action, amount: args.amount, currency: args.currency ?? '${currency}', merchant: args.merchant, context: { tool: '${scope}', riskLevel: args.riskLevel }, payload });
   const res = await fetch(GATEWAY + path, { method: 'POST', headers: { 'content-type': 'application/json', 'x-magp-request': JSON.stringify(signed) }, body: JSON.stringify(payload) });
   const body = await res.json().catch(() => null);
   if (!res.ok) {
@@ -3069,7 +3175,10 @@ const gatedBookFlight = guard.guardToolLocal(
     amount: a.amount,
     currency: a.currency ?? '${currency}',
     merchant: a.merchant,
-    context: { tool: 'book-flight', riskLevel: a.riskLevel ?? 'low' },
+    // riskLevel is the agent's OWN claim: signing it proves who said it, not that it is true, and nothing checks it unless
+    // the owner configures provenance. Passed through as-is: when the agent does not say, it stays absent and the gate sends
+    // the action for review — never 'low'.
+    context: { tool: 'book-flight', riskLevel: a.riskLevel },
   }),
   getBundle,
 );
@@ -3423,7 +3532,9 @@ action outside the mandate entirely. Every step says what it expects and flags a
     : `None of your rules could be staged in the demo (see below), so it shows only a BLOCK for an
 action outside the mandate. Your rules are still enforced; see \`metamynd-rules.json\`.`)
   : `You should see an ALLOW, a BLOCK (over the per-transaction cap), an ESCALATE (high risk —
-open the dashboard to approve it), and a BLOCK (an action outside the mandate entirely).`}
+open the dashboard to approve it), and a BLOCK (an action outside the mandate entirely).
+
+${RISK_LEVEL_NOTE}`}
 
 ## Files
 
@@ -3784,6 +3895,7 @@ async function runClaim(args) {
   if (args.financial && issuedNonFinancial) {
     keepConfigAndStop('--financial was passed, but the approved agent has NO spending authority (the request was non-financial).');
   }
+  if (!args['no-gateway'] && !(await ensurePolicyKey(config, config.apiBase ?? base))) keepConfigAndStop(NO_POLICY_KEY(base));
   const slug = slugify(state.name || 'metamynd-agent');
   const outDir = resolve(String(args.out || `./${slug}`));
   if (issuedNonFinancial) {
@@ -4019,6 +4131,7 @@ async function main() {
     console.log(`  ${c.green('✓')} derived ${demo.cases.length} demo case(s) from your rules`);
     for (const n of demo.notDemonstrated) console.log(`  ${c.yellow('!')} not staged in the demo: ${n.rule} ${c.dim('— ' + n.why + '; still enforced')}`);
   }
+  if (!args['no-gateway'] && !(await ensurePolicyKey(config, config.apiBase ?? base))) keepConfigAndFail(outDir, config, NO_POLICY_KEY(base));
   scaffoldProject({ demo, outDir, config, slug, scope, perTxnMax, currency, merchant: financial ? merchants[0] || 'demo-merchant' : merchants[0], sandbox: false, withGateway: !args['no-gateway'], gatewayPort: Number(args['gateway-port']) || DEFAULT_GATEWAY_PORT, force: !!args.force, gatewayIdentity });
 }
 
@@ -4028,6 +4141,7 @@ export {
   buildPolicyCases, resolveFinancial, policyMolecules, ruleToMolecule,
   generateAgentKeypair, harnessAgentDid, harnessMandate, harnessRulesFile, harnessDefaultSopNeutral,
   scaffoldProject, defaultNeutralDemo, exampleIndexNeutral, exampleReadmeNeutral, gatewayServerFileNeutral, gatewayReadmeNeutral,
+  ensurePolicyKey,
 };
 if (!process.env.CREATE_METAMYND_AGENT_NO_MAIN) {
   // fail() can also be reached from a callback outside main()'s promise chain (readline, child process).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-metamynd-agent",
-  "version": "0.14.2",
+  "version": "0.14.6",
   "description": "Scaffold a MetaMynd/AgentSafe-governed AI agent in one command — logs in, provisions the agent (identity + mandate + SOP + Standards) in a single call, writes agent.metamynd.json plus a runnable agent + separate tool-gateway process that closes direct-call, confused-deputy, replay, and cumulative-spend bypasses. --harness scaffolds a free, local, zero-network governance harness instead.",
   "type": "module",
   "bin": {