forge-trust-chain 0.3.0 → 0.5.0

package/src/cli/index.js

@@ -18,10 +18,24 @@ import { scan, formatScanResults } from "../scanner/index.js";
 import { TrustChain, findDivergence } from "../core/chain.js";
 import { Store } from "../store/store.js";
 import { hash } from "../core/trust-pixel.js";
-import { verifyAtom, formatAtom, createAtom } from "../core/trust-atom.js";
+import { verifyAtom, formatAtom, createAtom, createSignedAtom, verifyAtomSignature, verifyChain } from "../core/trust-atom.js";
+import { initializeKeys, loadKeys, hasKeys, exportIdentity as exportKeysIdentity, importTrustedKey, listTrustedKeys, getFingerprint } from "../core/keys.js";
 import { execSync } from "node:child_process";
 import { hostname, userInfo } from "node:os";
 import { submitToOTS, checkOTSUpgrade, witnessSummary, createBilateralWitness, witnessLevel } from "../core/witness.js";
+import {
+  createGenesis,
+  registerInstance,
+  loadGenesis,
+  loadCurrentInstance,
+  loadInstances,
+  verifyIdentityChain,
+  exportIdentity,
+  getForgeIdentity,
+  hasForgeId,
+  hasInstance,
+  signAtomProof,
+} from "../core/identity.js";
 
 /* ================================================================
    STATE SNAPSHOT — captures system state for from/to fields
@@ -46,6 +60,11 @@ function stateSnapshot() {
 }
 
 function getIdentity() {
+  // Use ForgeID when initialized and instance registered
+  const forgeIdentity = getForgeIdentity();
+  if (forgeIdentity !== null) return forgeIdentity;
+
+  // Fallback to legacy identity
   try {
     const user = userInfo().username;
     const host = hostname();
@@ -59,6 +78,134 @@ function getIdentity() {
    COMMANDS
    ================================================================ */
 
+function cmdInit(name) {
+  console.log("");
+  console.log("  ── FORGE Identity Initialization ──");
+  console.log("");
+
+  if (hasKeys()) {
+    const keys = loadKeys();
+    console.log("  ⚠️  Keys already exist!");
+    console.log(`  Fingerprint: ${keys.fingerprint}`);
+    console.log("");
+    console.log("  To regenerate (WARNING: invalidates all your signed atoms):");
+    console.log("    rm -rf ~/.forge/keys && forge init");
+    console.log("");
+    return;
+  }
+
+  const identity = {
+    name: name || getIdentity(),
+    created_by: "forge-cli",
+  };
+
+  try {
+    const result = initializeKeys(identity);
+
+    console.log("  ✓ Ed25519 key pair generated");
+    console.log("");
+    console.log(`  Fingerprint: ${result.fingerprint}`);
+    console.log(`  Identity:    ${identity.name}`);
+    console.log("");
+    console.log("  Files created:");
+    console.log("    ~/.forge/keys/private.key  (NEVER share this!)");
+    console.log("    ~/.forge/keys/public.key   (share for verification)");
+    console.log("");
+    console.log("  From now on, all atoms will be signed with your private key.");
+    console.log("  Others can verify your atoms using your public key.");
+    console.log("");
+    console.log("  Share your identity:");
+    console.log("    forge identity --export > my-identity.json");
+    console.log("");
+  } catch (err) {
+    console.error(`  ✗ Error: ${err.message}`);
+    process.exit(1);
+  }
+}
+
+function cmdIdentity(subArgs) {
+  if (subArgs.includes("--export")) {
+    const identity = exportKeysIdentity();
+    if (!identity) {
+      console.error("  No identity found. Run 'forge init' first.");
+      process.exit(1);
+    }
+    console.log(JSON.stringify(identity, null, 2));
+    return;
+  }
+
+  if (subArgs.includes("--import")) {
+    const filePath = subArgs[subArgs.indexOf("--import") + 1];
+    if (!filePath) {
+      console.error("  Usage: forge identity --import <file.json> [--alias <name>]");
+      process.exit(1);
+    }
+
+    try {
+      const { readFileSync } = require("node:fs");
+      const data = JSON.parse(readFileSync(filePath, "utf8"));
+      const alias = subArgs.includes("--alias")
+        ? subArgs[subArgs.indexOf("--alias") + 1]
+        : data.identity?.name || null;
+
+      const result = importTrustedKey(data.public_key, alias);
+      console.log("");
+      console.log("  ✓ Trusted identity imported");
+      console.log(`  Fingerprint: ${result.fingerprint}`);
+      console.log(`  Alias:       ${result.alias || "(none)"}`);
+      console.log("");
+    } catch (err) {
+      console.error(`  ✗ Error: ${err.message}`);
+      process.exit(1);
+    }
+    return;
+  }
+
+  if (subArgs.includes("--list")) {
+    const trusted = listTrustedKeys();
+    console.log("");
+    console.log("  ── Trusted Identities ──");
+    console.log("");
+
+    if (trusted.length === 0) {
+      console.log("  No trusted identities. Import with:");
+      console.log("    forge identity --import <file.json>");
+    } else {
+      for (const t of trusted) {
+        console.log(`  ${t.fingerprint}`);
+        if (t.alias) console.log(`    Alias: ${t.alias}`);
+        console.log(`    Imported: ${new Date(t.imported_at).toISOString()}`);
+        console.log("");
+      }
+    }
+    return;
+  }
+
+  // Show current identity
+  if (!hasKeys()) {
+    console.log("");
+    console.log("  No identity found. Create one with:");
+    console.log("    forge init");
+    console.log("");
+    return;
+  }
+
+  const keys = loadKeys();
+  console.log("");
+  console.log("  ── Your FORGE Identity ──");
+  console.log("");
+  console.log(`  Fingerprint: ${keys.fingerprint}`);
+  console.log(`  Name:        ${keys.identity?.name || "(not set)"}`);
+  console.log(`  Created:     ${new Date(keys.identity?.created_at).toISOString()}`);
+  console.log(`  Algorithm:   Ed25519`);
+  console.log("");
+  console.log("  Commands:");
+  console.log("    forge identity --export    Export public key for sharing");
+  console.log("    forge identity --import    Import trusted identity");
+  console.log("    forge identity --list      List trusted identities");
+  console.log("");
+}
+
 function cmdScan() {
   const results = scan();
   console.log(formatScanResults(results));
@@ -78,24 +225,65 @@ function cmdLog(action) {
 
   const prev = store.lastProof();
 
-  const atom = createAtom({
-    who: identity,
-    from: stateBefore,
-    action,
-    to: stateSnapshot(),
-    prev,
-  });
+  // Signing priority: ForgeID instance > keys.js > unsigned
+  let atom;
+  let signed = false;
+  let signerInfo = null;
+
+  if (hasInstance()) {
+    atom = createAtom({
+      who: identity,
+      from: stateBefore,
+      action,
+      to: stateSnapshot(),
+      prev,
+      sign: signAtomProof,
+    });
+    signed = !!atom.signature;
+    signerInfo = "ForgeID";
+  } else {
+    const keys = loadKeys();
+    if (keys) {
+      atom = createSignedAtom({
+        who: identity,
+        from: stateBefore,
+        action,
+        to: stateSnapshot(),
+        prev,
+      });
+      signed = true;
+      signerInfo = keys.fingerprint;
+    } else {
+      atom = createAtom({
+        who: identity,
+        from: stateBefore,
+        action,
+        to: stateSnapshot(),
+        prev,
+      });
+    }
+  }
 
   const index = store.appendAtom(atom);
 
+  // Save plaintext action to local index (never exported)
+  store.saveAction(atom.action, action, { who: identity });
+
   console.log("");
   console.log("  ✓ TrustAtom recorded");
   console.log(`  Index:  #${index}`);
-  console.log(`  Who:    ${identity} → ${atom.who.slice(0, 16)}…`);
+  console.log(`  Who:    ${identity.length > 32 ? identity.slice(0, 16) + "…" : identity} → ${atom.who.slice(0, 16)}…`);
   console.log(`  Action: ${action}`);
   console.log(`  Proof:  ${atom.proof.slice(0, 32)}…`);
   console.log(`  Chain:  ${store.atomCount} atoms total`);
   console.log(`  Prev:   ${prev === "genesis" ? "genesis" : prev.slice(0, 16) + "…"}`);
+
+  if (signed) {
+    console.log(`  Signed: ✓ ${signerInfo}`);
+  } else {
+    console.log(`  Signed: ✗ (run 'forge init' or 'forge id init' to enable signing)`);
+  }
+
   console.log("");
   console.log("  Witness: self (local only)");
   console.log("  → Run 'forge seal' to create Merkle block");
@@ -115,25 +303,40 @@ function cmdVerify() {
   console.log("  Verifying chain integrity…");
   console.log(`  Atoms: ${atoms.length}`);
 
-  // Verify each atom
-  let broken = -1;
-  for (let i = 0; i < atoms.length; i++) {
-    if (!verifyAtom(atoms[i])) {
-      broken = i;
-      break;
-    }
-    if (i > 0 && !atoms[i].prev.includes(atoms[i - 1].proof)) {
-      broken = i;
-      break;
-    }
-  }
+  // Use new verifyChain with signature support
+  const result = verifyChain(atoms);
 
-  if (broken >= 0) {
-    console.log(`  ✗ CHAIN BROKEN at atom #${broken}`);
+  if (!result.valid) {
+    console.log(`  ✗ CHAIN BROKEN at atom #${result.broken_at}`);
+    console.log(`    Reason: ${result.reason}`);
     console.log(`    This means records have been tampered with.`);
   } else {
     console.log("  ✓ CHAIN VALID — all atoms verified, all links intact.");
   }
+
+  // Signature summary
+  const signed = atoms.filter(a => a.signature).length;
+  const unsigned = atoms.length - signed;
+
+  console.log("");
+  console.log("  Signature status:");
+  console.log(`    Signed:   ${signed} atoms`);
+  console.log(`    Unsigned: ${unsigned} atoms`);
+
+  if (result.signatures && result.signatures.length > 0) {
+    const valid = result.signatures.filter(s => s.valid).length;
+    const invalid = result.signatures.filter(s => !s.valid).length;
+
+    if (invalid > 0) {
+      console.log(`    ⚠️  ${invalid} signature(s) could not be verified`);
+      for (const sig of result.signatures.filter(s => !s.valid)) {
+        console.log(`       #${sig.index}: ${sig.reason}${sig.signer ? ` (${sig.signer})` : ""}`);
+      }
+    } else if (valid > 0) {
+      console.log(`    ✓ All ${valid} signature(s) verified`);
+    }
+  }
+
   console.log("");
 }
 
@@ -177,7 +380,19 @@ function cmdStatus() {
 
   console.log("");
   console.log("  ── FORGE Chain Status ──");
-  console.log(`  Identity: ${getIdentity()}`);
+
+  const genesis = loadGenesis();
+  if (genesis) {
+    console.log(`  ForgeID:  ${genesis.forge_id.slice(0, 16)}…`);
+    const inst = loadCurrentInstance();
+    if (inst) {
+      console.log(`  Instance: #${inst.instance_seq} (${inst.label})`);
+    } else {
+      console.log(`  Instance: not registered on this server`);
+    }
+  } else {
+    console.log(`  Identity: ${getIdentity()} (legacy — run 'forge id init' for ForgeID)`);
+  }
   console.log(`  Atoms:    ${atoms.length}`);
   console.log(`  Blocks:   ${blocks.length}`);
   console.log(`  Store:    ~/.forge/chain.json`);
@@ -307,6 +522,29 @@ function cmdWitness(subArgs) {
   }
 }
 
+function cmdHistory(limit = 20) {
+  const store = new Store();
+  const history = store.getHistory(parseInt(limit) || 20);
+
+  if (history.length === 0) {
+    console.log("\n  No history. Run 'forge log' first.\n");
+    return;
+  }
+
+  console.log("");
+  console.log("  ── FORGE History (local plaintext) ──");
+  console.log("  ⚠️  This data is LOCAL ONLY. Never share actions.json.");
+  console.log("");
+
+  for (const entry of history) {
+    const time = new Date(entry.when).toISOString().slice(0, 19);
+    console.log(`  #${entry.index} [${time}]`);
+    console.log(`     ${entry.action_text}`);
+    console.log(`     proof: ${entry.proof.slice(0, 24)}…`);
+    console.log("");
+  }
+}
+
 function cmdDemo() {
   console.log("");
   console.log("╔══════════════════════════════════════════════════════╗");
@@ -463,6 +701,165 @@ function cmdDemo() {
   console.log("");
 }
 
+/* ================================================================
+   IDENTITY COMMANDS
+   ================================================================ */
+
+function cmdIdInit(args) {
+  const proofIdx = args.indexOf("--proof");
+  const proofText = proofIdx >= 0 ? args.slice(proofIdx + 1).join(" ") : "";
+
+  try {
+    const genesis = createGenesis(proofText);
+    console.log("");
+    console.log("  ✓ ForgeID Genesis Created");
+    console.log(`  ForgeID:     ${genesis.forge_id}`);
+    console.log(`  Master Key:  ${genesis.master_public_key.slice(0, 24)}…`);
+    if (proofText) console.log(`  PoE:         ${proofText}`);
+    console.log(`  Created:     ${genesis.created_at}`);
+    console.log("");
+    console.log("  ⚠️  ~/.forge/identity/master.key contains your master private key.");
+    console.log("  Move it to COLD STORAGE after registering all initial instances.");
+    console.log("  Anyone with this key can register new instances under your ForgeID.");
+    console.log("");
+    console.log("  Next: forge id register [label]");
+    console.log("");
+  } catch (err) {
+    console.error(`  Error: ${err.message}`);
+    process.exit(1);
+  }
+}
+
+function cmdIdRegister(args) {
+  const label = args.join(" ") || "";
+
+  try {
+    const instance = registerInstance(label);
+    console.log("");
+    console.log("  ✓ Instance Registered");
+    console.log(`  ForgeID:     ${instance.forge_id.slice(0, 16)}…`);
+    console.log(`  Instance:    #${instance.instance_seq}`);
+    console.log(`  Label:       ${instance.label}`);
+    console.log(`  Instance ID: ${instance.instance_id.slice(0, 32)}…`);
+    console.log(`  Registered:  ${instance.registered_at}`);
+    console.log("");
+    console.log("  All TrustAtoms will now be signed with this instance's Ed25519 key.");
+    console.log("  The master.key can now be moved to cold storage.");
+    console.log("");
+  } catch (err) {
+    console.error(`  Error: ${err.message}`);
+    process.exit(1);
+  }
+}
+
+function cmdIdShow() {
+  const genesis = loadGenesis();
+  if (!genesis) {
+    console.log("\n  No ForgeID found. Run 'forge id init' first.\n");
+    return;
+  }
+
+  console.log("");
+  console.log("  ── ForgeID ──");
+  console.log(`  ForgeID:  ${genesis.forge_id}`);
+  console.log(`  Master:   ${genesis.master_public_key.slice(0, 24)}…`);
+  if (genesis.proof_of_existence) console.log(`  PoE:      ${genesis.proof_of_existence}`);
+  console.log(`  Created:  ${genesis.created_at}`);
+
+  const instance = loadCurrentInstance();
+  if (instance) {
+    console.log("");
+    console.log("  ── Current Instance ──");
+    console.log(`  Seq:      #${instance.instance_seq}`);
+    console.log(`  Label:    ${instance.label}`);
+    console.log(`  ID:       ${instance.instance_id}`);
+  } else {
+    console.log("\n  No instance registered on this server.");
+    console.log("  Run 'forge id register [label]' to register.");
+  }
+  console.log("");
+}
+
+function cmdIdList() {
+  const genesis = loadGenesis();
+  if (!genesis) {
+    console.log("\n  No ForgeID found. Run 'forge id init' first.\n");
+    return;
+  }
+
+  const instances = loadInstances();
+  console.log("");
+  console.log(`  ForgeID: ${genesis.forge_id.slice(0, 32)}…`);
+  console.log(`  Instances: ${instances.length}`);
+  console.log("");
+
+  if (instances.length === 0) {
+    console.log("  No instances registered.");
+  } else {
+    const current = loadCurrentInstance();
+    for (const inst of instances) {
+      const marker = current && current.instance_seq === inst.instance_seq ? " ← this server" : "";
+      console.log(`  #${inst.instance_seq}  ${inst.label.padEnd(20)} ${inst.instance_id.slice(0, 16)}…${marker}`);
+    }
+  }
+  console.log("");
+}
+
+function cmdIdVerify() {
+  const result = verifyIdentityChain();
+  console.log("");
+  if (result.valid) {
+    console.log("  ✓ Identity chain VALID");
+    console.log(`    Genesis signature verified`);
+    const instances = loadInstances();
+    console.log(`    ${instances.length} instance registration(s) verified`);
+  } else {
+    console.log("  ✗ Identity chain BROKEN");
+    for (const err of result.errors) {
+      console.log(`    ✗ ${err}`);
+    }
+  }
+  console.log("");
+}
+
+function cmdIdExport() {
+  const data = exportIdentity();
+  if (!data) {
+    console.log("\n  No ForgeID found. Run 'forge id init' first.\n");
+    return;
+  }
+  console.log(JSON.stringify(data, null, 2));
+}
+
+function cmdId(subArgs) {
+  const subCmd = subArgs[0] || "show";
+  const rest = subArgs.slice(1);
+  switch (subCmd) {
+    case "init":
+      cmdIdInit(rest);
+      break;
+    case "register":
+      cmdIdRegister(rest);
+      break;
+    case "show":
+      cmdIdShow();
+      break;
+    case "list":
+      cmdIdList();
+      break;
+    case "verify":
+      cmdIdVerify();
+      break;
+    case "export":
+      cmdIdExport();
+      break;
+    default:
+      console.log(`  Unknown id command: ${subCmd}`);
+      console.log("  Available: init, register, show, list, verify, export");
+      break;
+  }
+}
+
 /* ================================================================
    MAIN
    ================================================================ */
@@ -471,6 +868,14 @@ const args = process.argv.slice(2);
 const command = args[0] || "help";
 
 switch (command) {
+  case "init":
+    cmdInit(args[1]);
+    break;
+
+  case "identity":
+    cmdIdentity(args.slice(1));
+    break;
+
   case "scan":
     cmdScan();
     break;
@@ -507,17 +912,45 @@ switch (command) {
     cmdDemo();
     break;
 
+  case "history":
+    cmdHistory(args[1]);
+    break;
+
+  case "mcp":
+    // Start MCP server
+    import("../mcp/server.js");
+    break;
+
+  case "id":
+    cmdId(args.slice(1));
+    break;
+
   case "help":
   default:
     console.log(`
-  FORGE — Trust Chain Protocol v0.1
+  FORGE — Trust Chain Protocol v0.4
 
   Trust = Certainty × Existence
   Every operation produces a verifiable, undeniable fact.
 
-  Commands:
-    forge scan                       Enumerate trust assumptions on this system
-    forge log <action>               Record a TrustAtom (one state transition)
+  Signing (Ed25519 — simple):
+    forge init [name]                Generate signing key pair
+    forge identity                   Show your identity
+    forge identity --export          Export public key for sharing
+    forge identity --import <file>   Import trusted identity
+    forge identity --list            List trusted identities
+
+  Identity (ForgeID — genesis/instance):
+    forge id init [--proof "text"]   Create ForgeID genesis (master keypair)
+    forge id register [label]        Register this server as instance
+    forge id show                    Show ForgeID and current instance
+    forge id list                    List all registered instances
+    forge id verify                  Verify identity chain integrity
+    forge id export                  Export public identity (no private keys)
+
+  Operations:
+    forge scan                       Capture trust baseline (system assumptions)
+    forge log <action>               Record a TrustAtom (signed if keys/ForgeID exist)
     forge verify                     Verify chain integrity
     forge seal                       Seal atoms into a Merkle block
     forge anchor                     Submit Merkle root to OTS calendars (Level 3)
@@ -525,8 +958,10 @@ switch (command) {
     forge witness                    Show witness status for latest block
     forge witness --bilateral <id>   Create bilateral witness receipt
     forge status                     Show chain status
-    forge export                     Export chain as JSON
+    forge history [n]                Show recent operations with plaintext (local only)
+    forge export                     Export chain as JSON (no plaintext)
     forge demo                       Run full demonstration
+    forge mcp                        Start MCP server (for Claude Code)
 
   Witness Hierarchy:
     Level 1: Self        — Only you hold the hash (can be deleted)
@@ -535,13 +970,11 @@ switch (command) {
     Level 4: Anchored    — Bitcoin blockchain (computationally undeletable)
 
   Examples:
-    forge scan
+    forge init                              # simple signing
+    forge id init --proof "BBC News 2026"   # ForgeID genesis
+    forge id register "prod-server"
     forge log "deployed nginx config"
-    forge log "opened port 443"
-    forge verify
-    forge seal
-    forge anchor
-    forge witness --bilateral ops@provider.com
+    forge seal && forge anchor
 `);
     break;
 }

package/src/core/chain.js

@@ -11,8 +11,9 @@ import { createAtom, verifyAtom, verifyChain, formatAtom } from "./trust-atom.js
 import { treeFromAtoms, createBlock, getMerkleProof, verifyMerkleProof } from "./merkle.js";
 
 export class TrustChain {
-  constructor(identity) {
+  constructor(identity, signFn = null) {
     this.identity = identity;
+    this.signFn = signFn;
     this.atoms = [];
     this.blocks = [];
   }
@@ -34,6 +35,7 @@ export class TrustChain {
       action,
       to,
       prev,
+      sign: this.signFn,
     });
 
     this.atoms.push(atom);