enigma-memory 0.1.17 → 0.1.22

package/scripts/scan-secrets.mjs

@@ -0,0 +1,178 @@
+#!/usr/bin/env node
+// Enigma Memory — working-tree secret scanner.
+// Scans for PEM private keys, bearer-token patterns, DSNs, AWS-style keys,
+// and literal SECURITY.md placeholders. Approved test fixtures must carry an
+// explicit approval comment on the same or previous non-empty line:
+//   // secret-scan:approved
+//   # secret-scan:approved
+// This script exits non-zero when any unapproved detection remains.
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+const __filename = fileURLToPath(import.meta.url)
+const APPROVAL_MARKERS = [
+  /secret-scan:(?:approved|ignore)/i,
+  /\bno[-_]?secret[-_]?scan\b/i,
+]
+
+const SKIP_DIRS = new Set([
+  'node_modules',
+  '.git',
+  '.enigma',
+  '.enigma-review-packet',
+  '.enigma-review-packet-debug',
+  'coverage',
+  'dist',
+  'build',
+  '.cache',
+  'tmp',
+  '.vscode',
+  '.idea',
+  '.next',
+])
+
+const SKIP_EXTENSIONS = new Set([
+  '.png',
+  '.jpg',
+  '.jpeg',
+  '.gif',
+  '.webp',
+  '.svg',
+  '.ico',
+  '.pdf',
+  '.zip',
+  '.tar',
+  '.gz',
+  '.tgz',
+  '.woff',
+  '.woff2',
+  '.ttf',
+  '.otf',
+  '.eot',
+  '.mp4',
+  '.webm',
+  '.mp3',
+  '.ogg',
+])
+
+// The security-placeholder detector matches its own pattern literal below.
+// The preceding comment marks that line as an approved self-reference.
+const DETECTORS = [
+  {
+    id: 'pem-private-key',
+    pattern: /-----BEGIN\s+(?:RSA\s+|EC\s+|DSA\s+|OPENSSH\s+|ENCRYPTED\s+)?PRIVATE\s+KEY-----/i,
+  },
+  {
+    id: 'aws-access-key-id',
+    pattern: /\b(?:AKIA|ASIA|AROA|AIDA)[0-9A-Z]{16}\b/,
+  },
+  {
+    id: 'aws-secret-access-key',
+    pattern: /\b(?:aws[_-]?secret[_-]?access[_-]?key|AWS[_-]?SECRET[_-]?ACCESS[_-]?KEY)\s*[=:]\s*["'][A-Za-z0-9/+=]{40}["']/i,
+  },
+  {
+    id: 'bearer-token',
+    // Skip placeholders like <token>, ${var}, and $ENV_VAR.
+    pattern: /(?:Authorization\s*:\s*Bearer\s+(?![<$\(])\S{8,}|\bbearer\s+[:=]\s*["']?[a-zA-Z0-9_\-]{16,}|\bapi[_-]?token\s*[:=]\s*["'][a-zA-Z0-9_\-]{16,}["'])/i,
+  },
+  {
+    id: 'dsn-with-password',
+    pattern: /\b(?:postgres|postgresql|mysql|mysql2|mongodb|redis|amqp|amqps):\/\/[^:]+:[^@\s]+@[^\/\s]+/i,
+  },
+  {
+    id: 'security-placeholder',
+    pattern: /REPLACE-WITH/i, // secret-scan:approved self-reference pattern
+  },
+]
+
+function hasApprovalComment(line) {
+  return APPROVAL_MARKERS.some((m) => m.test(line))
+}
+
+function isApproved(lines, index) {
+  if (hasApprovalComment(lines[index])) return true
+  for (let i = index - 1; i >= 0; i -= 1) {
+    const trimmed = lines[i].trim()
+    if (trimmed === '') continue
+    return hasApprovalComment(trimmed)
+  }
+  return false
+}
+
+function isSkippableFile(rel) {
+  const ext = path.extname(rel).toLowerCase()
+  if (SKIP_EXTENSIONS.has(ext)) return true
+  const base = path.basename(rel)
+  if (base === 'package-lock.json') return true
+  return false
+}
+
+function* walk(root) {
+  const entries = fs.readdirSync(root, { withFileTypes: true })
+  for (const entry of entries) {
+    const full = path.join(root, entry.name)
+    if (entry.isDirectory()) {
+      if (SKIP_DIRS.has(entry.name)) continue
+      yield* walk(full)
+    } else if (entry.isFile()) {
+      yield full
+    }
+  }
+}
+
+export function scanForSecrets(root) {
+  const findings = []
+  const rootResolved = path.resolve(root)
+  for (const fullPath of walk(rootResolved)) {
+    const rel = path.relative(rootResolved, fullPath)
+    if (isSkippableFile(rel)) continue
+    let text
+    try {
+      text = fs.readFileSync(fullPath, 'utf8')
+    } catch {
+      continue
+    }
+    const lines = text.split(/\r?\n/)
+    for (let i = 0; i < lines.length; i += 1) {
+      const line = lines[i]
+      if (isApproved(lines, i)) continue
+      for (const detector of DETECTORS) {
+        if (detector.pattern.test(line)) {
+          findings.push({
+            file: rel,
+            line: i + 1,
+            type: detector.id,
+          })
+          break
+        }
+      }
+    }
+  }
+  return findings
+}
+
+function formatFindings(findings) {
+  return findings
+    .map((f) => `${f.file}:${f.line}: ${f.type}`)
+    .join('\n')
+}
+
+function main() {
+  const rootArg = process.argv.includes('--root')
+    ? process.argv[process.argv.indexOf('--root') + 1]
+    : path.resolve(path.dirname(__filename), '..')
+  const root = path.resolve(rootArg)
+  const findings = scanForSecrets(root)
+  if (findings.length > 0) {
+    process.stderr.write(`secret-scan: ${findings.length} unapproved detection(s)\n`)
+    process.stderr.write(formatFindings(findings) + '\n')
+    process.exit(1)
+  }
+  process.stdout.write('secret-scan ok\n')
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main()
+}

package/scripts/simulate-production-env.mjs

@@ -5,13 +5,15 @@
 // are not production secrets, HSM custody, or real operator evidence.
 
 import { spawnSync } from 'node:child_process'
-import { generateKeyPairSync, randomUUID } from 'node:crypto'
+import { createHash, generateKeyPairSync, randomUUID } from 'node:crypto'
 import fs from 'node:fs'
+import os from 'node:os'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
-const DEFAULT_SECRETS_DIR = path.join(ROOT, 'deploy', 'secrets-simulation')
+const DEFAULT_SECRETS_DIR = path.join(os.homedir(), '.enigma', 'simulation-secrets')
+const DOCKER_READABLE_SECRET_MODE = 0o644
 
 const REQUIRED_SECRET_FILES = [
   'relay-signing-key',
@@ -27,6 +29,11 @@ const REQUIRED_SECRET_FILES = [
   'tls.key',
 ]
 
+const BEARER_FILES_FOR_DIGEST = {
+  'gateway-admin-auth-bearer': 'ENIGMA_GATEWAY_ADMIN_AUTH_BEARER_SHA256',
+  'gateway-data-plane-auth-bearer': 'ENIGMA_GATEWAY_DATA_PLANE_AUTH_BEARER_SHA256',
+}
+
 function parseArgs(argv) {
   const flags = { check: false, secretsDir: DEFAULT_SECRETS_DIR }
   for (let i = 0; i < argv.length; i += 1) {
@@ -41,8 +48,9 @@ function parseArgs(argv) {
       process.stdout.write(
         'Usage: node scripts/simulate-production-env.mjs [--check] [--secrets-dir <dir>]\n' +
           '\n' +
-          'Generates local-simulation secret files and a self-signed TLS certificate\n' +
-          `under ${DEFAULT_SECRETS_DIR} (customizable with --secrets-dir).\n` +
+          'Generates local-simulation secret files and a self-signed TLS certificate.\n' +
+          `By default files are written outside the repo to ${DEFAULT_SECRETS_DIR}.\n` +
+          'A path inside the repository is rejected to prevent accidental commits.\n' +
           'Run with --check to verify required files exist and are non-empty.\n'
       )
       process.exit(0)
@@ -51,6 +59,22 @@ function parseArgs(argv) {
   return flags
 }
 
+function isPathInside(child, parent) {
+  const c = path.resolve(child)
+  const p = path.resolve(parent)
+  const rel = path.relative(p, c)
+  return rel === '' || !rel.startsWith('..')
+}
+
+function assertSecretsDirOutsideRepo(secretsDir) {
+  if (isPathInside(secretsDir, ROOT)) {
+    throw new Error(
+      `Refusing to use secrets directory inside the repository: ${secretsDir}\n` +
+        'Choose a path outside the repo (e.g. --secrets-dir ~/.enigma/simulation-secrets).'
+    )
+  }
+}
+
 function generateKmsKeyRef() {
   const pair = generateKeyPairSync('ed25519', {
     privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
@@ -75,6 +99,7 @@ function generateKmsKeyRef() {
 const SECRET_GENERATORS = {
   'relay-signing-key': () => 'local-simulation-relay-signing-key-ref\n',
   'gateway-signing-key': () => 'local-simulation-gateway-signing-key-ref\n',
+  // Simulation-only DSN. Never a real credential. secret-scan:approved
   'external-storage-dsn': () => 'postgres://enigma:enigma@postgres:5432/enigma?sslmode=disable\n',
   'kms-key-ref': generateKmsKeyRef,
   'backup-target-uri': () => 'file:///tmp/enigma-backups\n',
@@ -85,7 +110,8 @@ const SECRET_GENERATORS = {
 }
 
 function ensureDir(dir) {
-  fs.mkdirSync(dir, { recursive: true })
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 })
+  if (process.platform !== 'win32') fs.chmodSync(dir, 0o700)
 }
 
 function isMissingOrEmpty(filePath) {
@@ -97,6 +123,28 @@ function isMissingOrEmpty(filePath) {
   }
 }
 
+function sha256Hex(bufferOrString) {
+  return createHash('sha256').update(bufferOrString).digest('hex')
+}
+
+function gatewayBearerSha256(filePath) {
+  const token = fs.readFileSync(filePath)
+  return `sha256:${sha256Hex(token)}`
+}
+
+function writeSimulationEnv(secretsDir) {
+  const lines = [
+    '# Generated by scripts/simulate-production-env.mjs',
+    '# This file contains simulation-only digests, not production secrets.',
+    '# It is kept next to the other simulation secrets outside the repo.',
+  ]
+  for (const [name, envVar] of Object.entries(BEARER_FILES_FOR_DIGEST)) {
+    const digest = gatewayBearerSha256(path.join(secretsDir, name))
+    lines.push(`${envVar}=${digest}`)
+  }
+  fs.writeFileSync(path.join(secretsDir, 'simulation.env'), lines.join('\n') + '\n', { mode: 0o600 })
+}
+
 function generateTlsCerts(secretsDir) {
   const key = path.join(secretsDir, 'tls.key')
   const cert = path.join(secretsDir, 'tls.crt')
@@ -149,18 +197,23 @@ function generateTlsCerts(secretsDir) {
 
 function generateSecrets(secretsDir) {
   ensureDir(secretsDir)
+  assertSecretsDirOutsideRepo(secretsDir)
   for (const name of REQUIRED_SECRET_FILES) {
     if (name === 'tls.crt' || name === 'tls.key') continue
     const filePath = path.join(secretsDir, name)
     if (isMissingOrEmpty(filePath)) {
-      fs.writeFileSync(filePath, SECRET_GENERATORS[name](), { mode: 0o600 })
+      fs.writeFileSync(filePath, SECRET_GENERATORS[name](), { mode: DOCKER_READABLE_SECRET_MODE })
     }
+    // Compose file-backed secrets preserve host file bits. The parent directory
+    // remains owner-only while non-root simulation containers receive read access.
+    if (process.platform !== 'win32') fs.chmodSync(filePath, DOCKER_READABLE_SECRET_MODE)
   }
   const keyPath = path.join(secretsDir, 'tls.key')
   const certPath = path.join(secretsDir, 'tls.crt')
   if (isMissingOrEmpty(keyPath) || isMissingOrEmpty(certPath)) {
     generateTlsCerts(secretsDir)
   }
+  writeSimulationEnv(secretsDir)
 }
 
 function check(secretsDir) {
@@ -177,10 +230,17 @@ function check(secretsDir) {
   )
 }
 
-function printStartInstructions() {
+function printStartInstructions(secretsDir) {
+  process.stdout.write('\n')
+  process.stdout.write('Simulation secrets written outside the repo to:\n')
+  process.stdout.write(`  ${secretsDir}\n`)
+  process.stdout.write('\n')
+  process.stdout.write('To start the local production simulation, set the secrets path and run:\n')
+  process.stdout.write(`  export ENIGMA_SIM_SECRETS_DIR=${secretsDir}\n`)
+  process.stdout.write(`  docker compose -f deploy/docker-compose.local-production-simulation.yml --env-file ${path.join(secretsDir, 'simulation.env')} up --build -d\n`)
   process.stdout.write('\n')
-  process.stdout.write('To start the local production simulation, run:\n')
-  process.stdout.write('  docker compose -f deploy/docker-compose.local-production-simulation.yml up --build -d\n')
+  process.stdout.write('To tear down, use the same env file so the gateway bearer hashes resolve:\n')
+  process.stdout.write(`  docker compose -f deploy/docker-compose.local-production-simulation.yml --env-file ${path.join(secretsDir, 'simulation.env')} down -v --remove-orphans\n`)
   process.stdout.write('\n')
   process.stdout.write('To make the public-looking domain resolve locally, add this line to /etc/hosts\n')
   process.stdout.write('(or C:\\Windows\\System32\\drivers\\etc\\hosts on Windows):\n')
@@ -198,13 +258,14 @@ function printStartInstructions() {
 
 function main() {
   const flags = parseArgs(process.argv.slice(2))
+  assertSecretsDirOutsideRepo(flags.secretsDir)
   if (flags.check) {
     check(flags.secretsDir)
     return
   }
   generateSecrets(flags.secretsDir)
   check(flags.secretsDir)
-  printStartInstructions()
+  printStartInstructions(flags.secretsDir)
 }
 
 main()

package/scripts/validate-hosted-backend-live.mjs

@@ -5,6 +5,9 @@ import { fileURLToPath } from 'node:url';
 
 export const HOSTED_BACKEND_LIVE_EVIDENCE_SCHEMA = 'enigma.hosted_backend_live_evidence.v1';
 export const HOSTED_BACKEND_LIVE_RESULT_SCHEMA = 'enigma.hosted_backend_live_result.v1';
+export const HOSTED_BACKEND_RUNTIME_CAPABILITY_SCHEMA = 'enigma.hosted_backend_runtime_capability.v1';
+export const HOSTED_BACKEND_AUTHENTICATED_DATA_PLANE_SCHEMA = 'enigma.hosted_backend_authenticated_data_plane.v1';
+export const PRIVATE_DATA_PLANE_RUNTIME_MARKER = 'enigma.private_data_plane.runtime.v1';
 
 export const REQUIRED_REF_KEYS = Object.freeze([
   'backend_host',
@@ -35,6 +38,11 @@ export const REQUIRED_REF_KEYS = Object.freeze([
 ]);
 
 const REQUIRED_PROBES = Object.freeze(['relay_livez', 'relay_readyz', 'gateway_livez', 'gateway_readyz']);
+const RUNTIME_SERVICES = Object.freeze(['relay', 'gateway']);
+const DATA_PLANE_ROUTES = Object.freeze({
+  relay: Object.freeze(['/relay/records', '/pairing/challenge', '/pairing/complete']),
+  gateway: Object.freeze(['/policy', '/gateway/evaluate', '/gateway/decision', '/siem/export']),
+});
 const ACCEPTED_STATUSES = new Set(['observed', 'verified', 'go', 'accepted']);
 const SECRET_VALUE_RE = /(?:Bearer\s+[A-Za-z0-9._~+/=-]{12,}|Basic\s+[A-Za-z0-9+/=-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|https?:\/\/[^\s/@]+:[^\s/@]+@|raw memory|private prompt|full transcript|decrypted capsule|sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16})/iu;
 const FORBIDDEN_KEY_RE = /(?:password|passwd|pwd|token|api[_-]?key|private[_-]?key|secret|raw[_-]?memory|plaintext|plain[_-]?text|prompt|completion|transcript|embedding|provider[_-]?response|cookie|session)/iu;
@@ -151,6 +159,12 @@ function validateEnvironment(environment, blockers) {
   for (const field of ['environment_id', 'cloud_provider', 'region', 'owner', 'status']) {
     if (!nonEmptyString(environment[field])) blockers.push(blocker(`environment.${field} is required`, `environment.${field}`));
   }
+  if (environment.local_simulation !== false) {
+    blockers.push(blocker('environment.local_simulation must be false for hosted production evidence', 'environment.local_simulation'));
+  }
+  if (nonEmptyString(environment.cloud_provider) && environment.cloud_provider.trim().toLowerCase() === 'local') {
+    blockers.push(blocker('environment.cloud_provider must identify a non-simulation production provider', 'environment.cloud_provider'));
+  }
   if (!statusAccepted(environment.status)) blockers.push(blocker('environment.status must be observed/verified/go/accepted', 'environment.status'));
   return { domain };
 }
@@ -179,6 +193,9 @@ function validateProbe(probe, expectedName, domain, blockers) {
     if (probe.body.hosted_probe_only === true || probe.body.pages_edge_probe_only === true) {
       blockers.push(blocker(`${path}.body must not be an edge-probe-only payload`, `${path}.body`));
     }
+    if (probe.body.hosted_backend_live === false || probe.body.private_data_plane_operational === false || probe.body.runtime_capability?.bootstrap_worker === true) {
+      blockers.push(blocker(`${path}.body declares the private data plane closed or bootstrap-only`, `${path}.body.runtime_capability`));
+    }
     if (probe.body.service !== expectedService) blockers.push(blocker(`${path}.body.service must be ${expectedService}`, `${path}.body.service`));
     if (probe.body.ok !== true) blockers.push(blocker(`${path}.body.ok must be true`, `${path}.body.ok`));
     if (expectedName.endsWith('readyz')) {
@@ -203,6 +220,94 @@ function validateProbes(probes, domain, blockers) {
   return { covered };
 }
 
+function validateRuntimeCapability(capability, blockers) {
+  if (!isPlainObject(capability)) {
+    blockers.push(blocker('runtime_capability object is required', 'runtime_capability'));
+    return { covered: 0 };
+  }
+  if (capability.schema !== HOSTED_BACKEND_RUNTIME_CAPABILITY_SCHEMA) blockers.push(blocker(`runtime_capability.schema must be ${HOSTED_BACKEND_RUNTIME_CAPABILITY_SCHEMA}`, 'runtime_capability.schema'));
+  if (capability.marker !== PRIVATE_DATA_PLANE_RUNTIME_MARKER) blockers.push(blocker(`runtime_capability.marker must be ${PRIVATE_DATA_PLANE_RUNTIME_MARKER}`, 'runtime_capability.marker'));
+  if (!isoLike(capability.observed_at)) blockers.push(blocker('runtime_capability.observed_at must be ISO time', 'runtime_capability.observed_at'));
+  if (!isPlainObject(capability.services)) {
+    blockers.push(blocker('runtime_capability.services object is required', 'runtime_capability.services'));
+    return { covered: 0 };
+  }
+  let covered = 0;
+  for (const serviceKey of RUNTIME_SERVICES) {
+    const path = `runtime_capability.services.${serviceKey}`;
+    const service = capability.services[serviceKey];
+    if (!isPlainObject(service)) {
+      blockers.push(blocker(`${path} object is required`, path));
+      continue;
+    }
+    const expectedService = serviceKey === 'relay' ? 'enigma-relay' : 'enigma-gateway';
+    if (service.service !== expectedService) blockers.push(blocker(`${path}.service must be ${expectedService}`, `${path}.service`));
+    if (service.private_data_plane_operational !== true) blockers.push(blocker(`${path}.private_data_plane_operational must be true`, `${path}.private_data_plane_operational`));
+    if (service.authentication_enforced !== true) blockers.push(blocker(`${path}.authentication_enforced must be true`, `${path}.authentication_enforced`));
+    if (service.bootstrap_worker !== false) blockers.push(blocker(`${path}.bootstrap_worker must be false`, `${path}.bootstrap_worker`));
+    if (!nonEmptyString(service.evidence_ref)) blockers.push(blocker(`${path}.evidence_ref is required`, `${path}.evidence_ref`));
+    covered += 1;
+  }
+  return { covered };
+}
+
+function authenticatedDataPlaneUrl(value, serviceKey, domain, path, blockers) {
+  if (!nonEmptyString(value)) {
+    blockers.push(blocker(`${path} is required`, path));
+    return null;
+  }
+  try {
+    const url = new URL(value);
+    if (url.protocol !== 'https:') blockers.push(blocker(`${path} must use https`, path));
+    if (url.username || url.password) blockers.push(blocker(`${path} must not include credentials`, path));
+    if (url.search || url.hash) blockers.push(blocker(`${path} must not include query strings or fragments`, path));
+    if (isPrivateHost(url.hostname)) blockers.push(blocker(`${path} must not target localhost or private network host`, path));
+    const hostname = url.hostname.toLowerCase();
+    if (domain && hostname !== domain && !hostname.endsWith(`.${domain}`)) blockers.push(blocker(`${path} host must be the domain or a subdomain`, path));
+    if (!DATA_PLANE_ROUTES[serviceKey].includes(url.pathname)) blockers.push(blocker(`${path} must target a ${serviceKey} private data-plane route`, path));
+    return url;
+  } catch {
+    blockers.push(blocker(`${path} must be a valid URL`, path));
+    return null;
+  }
+}
+
+function validateAuthenticatedDataPlane(evidence, domain, blockers) {
+  if (!isPlainObject(evidence)) {
+    blockers.push(blocker('authenticated_data_plane object is required', 'authenticated_data_plane'));
+    return { covered: 0 };
+  }
+  if (evidence.schema !== HOSTED_BACKEND_AUTHENTICATED_DATA_PLANE_SCHEMA) blockers.push(blocker(`authenticated_data_plane.schema must be ${HOSTED_BACKEND_AUTHENTICATED_DATA_PLANE_SCHEMA}`, 'authenticated_data_plane.schema'));
+  if (!isoLike(evidence.observed_at)) blockers.push(blocker('authenticated_data_plane.observed_at must be ISO time', 'authenticated_data_plane.observed_at'));
+  if (!isPlainObject(evidence.proofs)) {
+    blockers.push(blocker('authenticated_data_plane.proofs object is required', 'authenticated_data_plane.proofs'));
+    return { covered: 0 };
+  }
+  let covered = 0;
+  for (const serviceKey of RUNTIME_SERVICES) {
+    const path = `authenticated_data_plane.proofs.${serviceKey}`;
+    const proof = evidence.proofs[serviceKey];
+    if (!isPlainObject(proof)) {
+      blockers.push(blocker(`${path} object is required`, path));
+      continue;
+    }
+    const expectedService = serviceKey === 'relay' ? 'enigma-relay' : 'enigma-gateway';
+    if (proof.service !== expectedService) blockers.push(blocker(`${path}.service must be ${expectedService}`, `${path}.service`));
+    authenticatedDataPlaneUrl(proof.url, serviceKey, domain, `${path}.url`, blockers);
+    if (!['GET', 'POST', 'PUT', 'DELETE'].includes(proof.method)) blockers.push(blocker(`${path}.method must be GET/POST/PUT/DELETE`, `${path}.method`));
+    if (!Number.isSafeInteger(proof.status_code) || proof.status_code < 200 || proof.status_code >= 300) blockers.push(blocker(`${path}.status_code must be a successful 2xx response`, `${path}.status_code`));
+    if (proof.authenticated !== true) blockers.push(blocker(`${path}.authenticated must be true`, `${path}.authenticated`));
+    if (proof.authorization_result !== 'allowed') blockers.push(blocker(`${path}.authorization_result must be allowed`, `${path}.authorization_result`));
+    if (!isoLike(proof.observed_at)) blockers.push(blocker(`${path}.observed_at must be ISO time`, `${path}.observed_at`));
+    for (const field of ['request_hash', 'response_hash']) {
+      if (!nonEmptyString(proof[field]) || !/^sha256:[a-f0-9]{64}$/i.test(proof[field])) blockers.push(blocker(`${path}.${field} must be sha256:<64 hex>`, `${path}.${field}`));
+    }
+    if (!nonEmptyString(proof.evidence_ref)) blockers.push(blocker(`${path}.evidence_ref is required`, `${path}.evidence_ref`));
+    covered += 1;
+  }
+  return { covered };
+}
+
 function validateOperator(operatorAcceptance, blockers) {
   if (!isPlainObject(operatorAcceptance)) {
     blockers.push(blocker('operator_acceptance object is required', 'operator_acceptance'));
@@ -238,6 +343,8 @@ export function validateHostedBackendLiveEvidence(evidence, options = {}) {
   const env = validateEnvironment(evidence.environment, blockers);
   const refs = validateRefs(evidence.refs, blockers);
   const probes = validateProbes(evidence.probes, env.domain, blockers);
+  const runtimeCapability = validateRuntimeCapability(evidence.runtime_capability, blockers);
+  const authenticatedDataPlane = validateAuthenticatedDataPlane(evidence.authenticated_data_plane, env.domain, blockers);
   validateOperator(evidence.operator_acceptance, blockers);
   validateClaimBoundary(evidence.claim_boundary, blockers);
   const result = {
@@ -253,11 +360,15 @@ export function validateHostedBackendLiveEvidence(evidence, options = {}) {
       refs_missing: refs.missing,
       required_probes: REQUIRED_PROBES.length,
       probes_covered: probes.covered,
+      runtime_services_required: RUNTIME_SERVICES.length,
+      runtime_services_covered: runtimeCapability.covered,
+      authenticated_data_plane_proofs_required: RUNTIME_SERVICES.length,
+      authenticated_data_plane_proofs_covered: authenticatedDataPlane.covered,
       operator_decision: evidence.operator_acceptance?.decision ?? null,
     },
     claim_boundary: [
       'Hosted backend live validation checks supplied evidence only; it does not deploy infrastructure, mutate Cloudflare, create DNS records, or generate credentials.',
-      'A pass result requires public HTTPS /livez and /readyz probe evidence for relay and gateway plus all required production refs and operator acceptance go.',
+      'A pass result requires public HTTPS /livez and /readyz probes, an explicit operational private-runtime capability marker, successful authenticated relay and gateway data-plane proofs, all required production refs, and operator acceptance go.',
       'Credentials, bearer tokens, API tokens, private memory payloads, prompts, transcripts, provider responses, and personal contact data must remain outside hosted backend live evidence.',
     ],
   };

package/specs/antibody-pack-v1.schema.json

@@ -0,0 +1,95 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.enigma.ai/antibody-pack-v1.schema.json",
+  "title": "Enigma Antibody Pack v1",
+  "type": "object",
+  "required": [
+    "schema",
+    "antibody_pack_id",
+    "created_at",
+    "version",
+    "policy_fingerprints",
+    "pack_root",
+    "signatures",
+    "public_payload_only",
+    "private_inputs_included"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "schema": { "const": "enigma.antibody_pack.v1" },
+    "antibody_pack_id": { "$ref": "#/$defs/publicId" },
+    "created_at": { "type": "string", "format": "date-time" },
+    "version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:[-+][A-Za-z0-9.-]+)?$" },
+    "policy_fingerprints": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/policyFingerprint" }
+    },
+    "pack_root": { "$ref": "#/$defs/sha256Digest" },
+    "signatures": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/signatureRef" }
+    },
+    "public_payload_only": { "const": true },
+    "private_inputs_included": { "const": false }
+  },
+  "$defs": {
+    "sha256Digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "publicId": { "type": "string", "pattern": "^[a-z0-9][a-z0-9._:-]{7,127}$" },
+    "publicRef": { "type": "string", "pattern": "^ref:[A-Za-z0-9][A-Za-z0-9._~:@#?=&%+-]{0,255}$" },
+    "detectorId": { "type": "string", "pattern": "^detector:[A-Za-z0-9][A-Za-z0-9._~:@#?=&%+-]{0,191}$" },
+    "policyId": { "type": "string", "pattern": "^policy:[A-Za-z0-9][A-Za-z0-9._~:@#?=&%+-]{0,191}$" },
+    "signerRef": { "type": "string", "pattern": "^signer:[A-Za-z0-9][A-Za-z0-9._~:@#?=&%+-]{0,191}$" },
+    "signaturePublicRef": { "type": "string", "pattern": "^sigref:[A-Za-z0-9][A-Za-z0-9._~:@#?=&%+-]{0,191}$" },
+    "policyFingerprint": {
+      "type": "object",
+      "required": [
+        "policy_id",
+        "detector_id",
+        "detector_ref",
+        "policy_hash",
+        "risk_labels",
+        "threshold_commitment",
+        "private_inputs_included"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "policy_id": { "$ref": "#/$defs/policyId" },
+        "detector_id": { "$ref": "#/$defs/detectorId" },
+        "detector_ref": { "$ref": "#/$defs/publicRef" },
+        "policy_hash": { "$ref": "#/$defs/sha256Digest" },
+        "risk_labels": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/riskLabel" },
+          "uniqueItems": true
+        },
+        "threshold_commitment": { "$ref": "#/$defs/sha256Digest" },
+        "private_inputs_included": { "const": false }
+      }
+    },
+    "signatureRef": {
+      "type": "object",
+      "required": ["signer_ref", "signature_ref", "signature_hash", "alg"],
+      "additionalProperties": false,
+      "properties": {
+        "signer_ref": { "$ref": "#/$defs/signerRef" },
+        "signature_ref": { "$ref": "#/$defs/signaturePublicRef" },
+        "signature_hash": { "$ref": "#/$defs/sha256Digest" },
+        "alg": { "type": "string", "enum": ["Ed25519", "ECDSA-P256-SHA256"] }
+      }
+    },
+    "riskLabel": {
+      "type": "string",
+      "enum": [
+        "untrusted_origin",
+        "prompt_injection",
+        "data_exfiltration",
+        "secret_material",
+        "memory_poisoning",
+        "policy_violation",
+        "unknown"
+      ]
+    }
+  }
+}