instar 1.3.269 → 1.3.271

package/dist/coordination/MandateAudit.d.ts

@@ -0,0 +1,48 @@
+/**
+ * MandateAudit — append-only, hash-chained audit of every mandate gate decision.
+ *
+ * Every gate decision (ALLOW and DENY alike) is recorded. The hash chain (each
+ * entry embeds the hash of the previous one) makes a deletion or edit detectable
+ * (threat-model T8): break any link and `verifyChain()` reports the first broken
+ * index. The chain head is surfaced read-only for the operator. An external,
+ * out-of-process sink is a follow-on hardening, called out in the spec.
+ *
+ * Accountability after the fact is what makes ahead-of-time delegation safe: a
+ * misbehaving mandate is killable AND every action it authorized is reconstructable.
+ */
+import type { MandateAuditEntry, MandateDecision } from './types.js';
+/** Canonical bytes an entry's hash covers — field-ordered, hash EXCLUDED. */
+export declare function canonicalAuditEntry(e: Omit<MandateAuditEntry, 'hash'>): string;
+export interface MandateAuditDeps {
+    filePath: string;
+    now?: () => number;
+}
+export declare class MandateAudit {
+    private readonly d;
+    constructor(deps: MandateAuditDeps);
+    /** Append a decision, chaining it to the current head. Returns the new entry. */
+    record(input: {
+        mandateId: string;
+        agentFp: string;
+        action: string;
+        decision: MandateDecision;
+        reason: string;
+        conditionResult?: boolean | null;
+    }): MandateAuditEntry;
+    /** All entries (oldest→newest). Tolerant of a missing file / a torn trailing line. */
+    all(): MandateAuditEntry[];
+    /** The current chain head hash ('' when empty). */
+    headHash(): string;
+    /**
+     * Verify the hash chain end-to-end. Returns `{ ok: true }` when intact, else
+     * `{ ok: false, brokenAt }` with the index of the first entry whose recomputed
+     * hash (or prevHash linkage) does not match — the tamper signal.
+     */
+    verifyChain(): {
+        ok: true;
+    } | {
+        ok: false;
+        brokenAt: number;
+    };
+}
+//# sourceMappingURL=MandateAudit.d.ts.map

package/dist/coordination/MandateAudit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MandateAudit.d.ts","sourceRoot":"","sources":["../../src/coordination/MandateAudit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAErE,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,GAAG,MAAM,CAK9E;AAMD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAmB;gBACzB,IAAI,EAAE,gBAAgB;IAIlC,iFAAiF;IACjF,MAAM,CAAC,KAAK,EAAE;QACZ,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,eAAe,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC;QACf,eAAe,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;KAClC,GAAG,iBAAiB;IAmBrB,sFAAsF;IACtF,GAAG,IAAI,iBAAiB,EAAE;IAW1B,mDAAmD;IACnD,QAAQ,IAAI,MAAM;IAKlB;;;;OAIG;IACH,WAAW,IAAI;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;CAY9D"}

package/dist/coordination/MandateAudit.js

@@ -0,0 +1,95 @@
+/**
+ * MandateAudit — append-only, hash-chained audit of every mandate gate decision.
+ *
+ * Every gate decision (ALLOW and DENY alike) is recorded. The hash chain (each
+ * entry embeds the hash of the previous one) makes a deletion or edit detectable
+ * (threat-model T8): break any link and `verifyChain()` reports the first broken
+ * index. The chain head is surfaced read-only for the operator. An external,
+ * out-of-process sink is a follow-on hardening, called out in the spec.
+ *
+ * Accountability after the fact is what makes ahead-of-time delegation safe: a
+ * misbehaving mandate is killable AND every action it authorized is reconstructable.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+/** Canonical bytes an entry's hash covers — field-ordered, hash EXCLUDED. */
+export function canonicalAuditEntry(e) {
+    return JSON.stringify([
+        e.ts, e.mandateId, e.agentFp, e.action, e.decision, e.reason,
+        e.conditionResult, e.prevHash,
+    ]);
+}
+function sha256(s) {
+    return createHash('sha256').update(s).digest('hex');
+}
+export class MandateAudit {
+    d;
+    constructor(deps) {
+        this.d = deps;
+    }
+    /** Append a decision, chaining it to the current head. Returns the new entry. */
+    record(input) {
+        const prevHash = this.headHash();
+        const ts = new Date(this.d.now ? this.d.now() : Date.now()).toISOString();
+        const unsigned = {
+            ts,
+            mandateId: input.mandateId,
+            agentFp: input.agentFp,
+            action: input.action,
+            decision: input.decision,
+            reason: input.reason,
+            conditionResult: input.conditionResult ?? null,
+            prevHash,
+        };
+        const entry = { ...unsigned, hash: sha256(prevHash + canonicalAuditEntry(unsigned)) };
+        fs.mkdirSync(path.dirname(this.d.filePath), { recursive: true });
+        fs.appendFileSync(this.d.filePath, JSON.stringify(entry) + '\n');
+        return entry;
+    }
+    /** All entries (oldest→newest). Tolerant of a missing file / a torn trailing line. */
+    all() {
+        let content;
+        try {
+            content = fs.readFileSync(this.d.filePath, 'utf8');
+        }
+        catch { /* @silent-fallback-ok — audit file may not exist yet; empty history is the natural default */
+            return [];
+        }
+        const out = [];
+        for (const line of content.split('\n')) {
+            if (!line.trim())
+                continue;
+            try {
+                out.push(JSON.parse(line));
+            }
+            catch { /* @silent-fallback-ok — torn-trailing-line tolerance; a crash mid-append must not poison reads */ }
+        }
+        return out;
+    }
+    /** The current chain head hash ('' when empty). */
+    headHash() {
+        const all = this.all();
+        return all.length ? all[all.length - 1].hash : '';
+    }
+    /**
+     * Verify the hash chain end-to-end. Returns `{ ok: true }` when intact, else
+     * `{ ok: false, brokenAt }` with the index of the first entry whose recomputed
+     * hash (or prevHash linkage) does not match — the tamper signal.
+     */
+    verifyChain() {
+        const all = this.all();
+        let prevHash = '';
+        for (let i = 0; i < all.length; i++) {
+            const { hash, ...unsigned } = all[i];
+            if (unsigned.prevHash !== prevHash)
+                return { ok: false, brokenAt: i };
+            const expected = sha256(prevHash + canonicalAuditEntry(unsigned));
+            if (expected !== hash)
+                return { ok: false, brokenAt: i };
+            prevHash = hash;
+        }
+        return { ok: true };
+    }
+}
+//# sourceMappingURL=MandateAudit.js.map

package/dist/coordination/MandateAudit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MandateAudit.js","sourceRoot":"","sources":["../../src/coordination/MandateAudit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,CAAkC;IACpE,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM;QAC5D,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,QAAQ;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtD,CAAC;AAOD,MAAM,OAAO,YAAY;IACN,CAAC,CAAmB;IACrC,YAAY,IAAsB;QAChC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC;IAED,iFAAiF;IACjF,MAAM,CAAC,KAON;QACC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1E,MAAM,QAAQ,GAAoC;YAChD,EAAE;YACF,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;YAC9C,QAAQ;SACT,CAAC;QACF,MAAM,KAAK,GAAsB,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACzG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sFAAsF;IACtF,GAAG;QACD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,8FAA8F;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC;QAC/K,MAAM,GAAG,GAAwB,EAAE,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAS;YAC3B,IAAI,CAAC;gBAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsB,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kGAAkG,CAAC,CAAC;QACvK,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,mDAAmD;IACnD,QAAQ;QACN,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,WAAW;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAClE,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YACzD,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;CACF"}

package/dist/coordination/MandateGate.d.ts

@@ -0,0 +1,48 @@
+/**
+ * MandateGate — the deny-by-default enforcement point for autonomous A2A actions.
+ *
+ * `evaluate()` runs the spec's ordered checks (§4) and AUDITS every decision (allow
+ * AND deny). With NO valid mandate loaded the gate denies everything — so the system
+ * is inert (weakens nothing) until Justin authors a mandate through the PIN-gated path.
+ *
+ * Order (any miss → deny, audited):
+ *   1. mandate exists
+ *   2. authorship valid (T1/T2)
+ *   3. not expired (T4)
+ *   4. not revoked (T5)
+ *   5. caller is a named party (T6/T9)
+ *   6. an Authority matches `action` AND `params` are within `bounds`
+ *   7. if the Authority requires a condition, it evaluates true from REAL state (T7/T10)
+ *   8. → allow
+ *
+ * The agent's "judgment" never authorizes anything — the mandate (a human-authored
+ * policy) and the objective conditions do. This is `requester ≠ authorizer` preserved.
+ */
+import type { MandateStore } from './MandateStore.js';
+import type { ConditionsRegistry } from './conditions.js';
+import type { MandateAudit } from './MandateAudit.js';
+import type { MandateEvaluation, MandateAuditEntry } from './types.js';
+export interface MandateGateResult {
+    decision: 'allow' | 'deny';
+    reason: string;
+    conditionResult: boolean | null;
+    audit: MandateAuditEntry;
+}
+/** Every key in `bounds` must be present in `params` with a deeply-equal value.
+ *  `params` MAY carry extra keys — the bounds only constrain the keys they name. */
+export declare function paramsSatisfyBounds(params: Record<string, unknown>, bounds: Record<string, unknown>): boolean;
+export interface MandateGateDeps {
+    store: MandateStore;
+    conditions: ConditionsRegistry;
+    audit: MandateAudit;
+    now?: () => number;
+}
+export declare class MandateGate {
+    private readonly d;
+    constructor(deps: MandateGateDeps);
+    private nowMs;
+    private deny;
+    private allow;
+    evaluate(ev: MandateEvaluation): MandateGateResult;
+}
+//# sourceMappingURL=MandateGate.d.ts.map

package/dist/coordination/MandateGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MandateGate.d.ts","sourceRoot":"","sources":["../../src/coordination/MandateGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAa,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAElF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,OAAO,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,iBAAiB,CAAC;CAC1B;AAUD;oFACoF;AACpF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAM7G;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAC;IACpB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,KAAK,EAAE,YAAY,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAkB;gBACxB,IAAI,EAAE,eAAe;IAIjC,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,IAAI;IAQZ,OAAO,CAAC,KAAK;IAQb,QAAQ,CAAC,EAAE,EAAE,iBAAiB,GAAG,iBAAiB;CAmDnD"}

package/dist/coordination/MandateGate.js

@@ -0,0 +1,104 @@
+/**
+ * MandateGate — the deny-by-default enforcement point for autonomous A2A actions.
+ *
+ * `evaluate()` runs the spec's ordered checks (§4) and AUDITS every decision (allow
+ * AND deny). With NO valid mandate loaded the gate denies everything — so the system
+ * is inert (weakens nothing) until Justin authors a mandate through the PIN-gated path.
+ *
+ * Order (any miss → deny, audited):
+ *   1. mandate exists
+ *   2. authorship valid (T1/T2)
+ *   3. not expired (T4)
+ *   4. not revoked (T5)
+ *   5. caller is a named party (T6/T9)
+ *   6. an Authority matches `action` AND `params` are within `bounds`
+ *   7. if the Authority requires a condition, it evaluates true from REAL state (T7/T10)
+ *   8. → allow
+ *
+ * The agent's "judgment" never authorizes anything — the mandate (a human-authored
+ * policy) and the objective conditions do. This is `requester ≠ authorizer` preserved.
+ */
+/** Deterministic, key-sorted serialization for value comparison. */
+function stableStringify(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return '[' + value.map(stableStringify).join(',') + ']';
+    const obj = value;
+    return '{' + Object.keys(obj).sort().map((k) => JSON.stringify(k) + ':' + stableStringify(obj[k])).join(',') + '}';
+}
+/** Every key in `bounds` must be present in `params` with a deeply-equal value.
+ *  `params` MAY carry extra keys — the bounds only constrain the keys they name. */
+export function paramsSatisfyBounds(params, bounds) {
+    for (const key of Object.keys(bounds)) {
+        if (!(key in params))
+            return false;
+        if (stableStringify(params[key]) !== stableStringify(bounds[key]))
+            return false;
+    }
+    return true;
+}
+export class MandateGate {
+    d;
+    constructor(deps) {
+        this.d = deps;
+    }
+    nowMs() {
+        return this.d.now ? this.d.now() : Date.now();
+    }
+    deny(ev, reason, conditionResult = null) {
+        const audit = this.d.audit.record({
+            mandateId: ev.mandateId, agentFp: ev.agentFp, action: ev.action,
+            decision: 'deny', reason, conditionResult,
+        });
+        return { decision: 'deny', reason, conditionResult, audit };
+    }
+    allow(ev, reason, conditionResult) {
+        const audit = this.d.audit.record({
+            mandateId: ev.mandateId, agentFp: ev.agentFp, action: ev.action,
+            decision: 'allow', reason, conditionResult,
+        });
+        return { decision: 'allow', reason, conditionResult, audit };
+    }
+    evaluate(ev) {
+        // 1. exists
+        const mandate = this.d.store.get(ev.mandateId);
+        if (!mandate)
+            return this.deny(ev, `mandate "${ev.mandateId}" not found`);
+        // 2. authorship valid
+        if (!this.d.store.verifyAuthorship(mandate)) {
+            return this.deny(ev, 'mandate authorship proof is invalid (forged or edited)');
+        }
+        // 3. not expired
+        if (this.nowMs() > Date.parse(mandate.expiresAt)) {
+            return this.deny(ev, `mandate expired at ${mandate.expiresAt}`);
+        }
+        // 4. not revoked
+        if (mandate.revoked) {
+            return this.deny(ev, `mandate revoked at ${mandate.revoked.at}: ${mandate.revoked.reason}`);
+        }
+        // 5. caller is a named party
+        if (!mandate.agents.includes(ev.agentFp)) {
+            return this.deny(ev, `agent ${ev.agentFp} is not a named party to this mandate`);
+        }
+        // 6. an authority matches action + params within bounds
+        const matching = mandate.authorities.find((a) => a.action === ev.action && paramsSatisfyBounds(ev.params, a.bounds));
+        if (!matching) {
+            const sameAction = mandate.authorities.some((a) => a.action === ev.action);
+            return this.deny(ev, sameAction
+                ? `params exceed the bounds of authority "${ev.action}"`
+                : `no authority for action "${ev.action}" in this mandate`);
+        }
+        // 7. condition (if any) evaluates true from real state
+        if (matching.requiresCondition) {
+            const ok = this.d.conditions.evaluate(matching.requiresCondition);
+            if (!ok) {
+                return this.deny(ev, `objective condition "${matching.requiresCondition}" not met`, false);
+            }
+            return this.allow(ev, `authority "${ev.action}" granted (condition "${matching.requiresCondition}" met)`, true);
+        }
+        // 8. allow (no condition)
+        return this.allow(ev, `authority "${ev.action}" granted`, null);
+    }
+}
+//# sourceMappingURL=MandateGate.js.map

package/dist/coordination/MandateGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MandateGate.js","sourceRoot":"","sources":["../../src/coordination/MandateGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAcH,oEAAoE;AACpE,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAClF,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AACrH,CAAC;AAED;oFACoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,MAA+B,EAAE,MAA+B;IAClG,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AASD,MAAM,OAAO,WAAW;IACL,CAAC,CAAkB;IACpC,YAAY,IAAqB;QAC/B,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC;IAEO,KAAK;QACX,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IAChD,CAAC;IAEO,IAAI,CAAC,EAAqB,EAAE,MAAc,EAAE,kBAAkC,IAAI;QACxF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;YAChC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM;YAC/D,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe;SAC1C,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAEO,KAAK,CAAC,EAAqB,EAAE,MAAc,EAAE,eAA+B;QAClF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;YAChC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM;YAC/D,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe;SAC3C,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IAC/D,CAAC;IAED,QAAQ,CAAC,EAAqB;QAC5B,YAAY;QACZ,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,CAAC,SAAS,aAAa,CAAC,CAAC;QAE1E,sBAAsB;QACtB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,wDAAwD,CAAC,CAAC;QACjF,CAAC;QAED,iBAAiB;QACjB,IAAI,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,sBAAsB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,iBAAiB;QACjB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,sBAAsB,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9F,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,OAAO,uCAAuC,CAAC,CAAC;QACnF,CAAC;QAED,wDAAwD;QACxD,MAAM,QAAQ,GAA0B,OAAO,CAAC,WAAW,CAAC,IAAI,CAC9D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAC1E,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC;YAC3E,OAAO,IAAI,CAAC,IAAI,CACd,EAAE,EACF,UAAU;gBACR,CAAC,CAAC,0CAA0C,EAAE,CAAC,MAAM,GAAG;gBACxD,CAAC,CAAC,4BAA4B,EAAE,CAAC,MAAM,mBAAmB,CAC7D,CAAC;QACJ,CAAC;QAED,uDAAuD;QACvD,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;YAClE,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,wBAAwB,QAAQ,CAAC,iBAAiB,WAAW,EAAE,KAAK,CAAC,CAAC;YAC7F,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,EAAE,CAAC,MAAM,yBAAyB,QAAQ,CAAC,iBAAiB,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClH,CAAC;QAED,0BAA0B;QAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,EAAE,CAAC,MAAM,WAAW,EAAE,IAAI,CAAC,CAAC;IAClE,CAAC;CACF"}

package/dist/coordination/MandateStore.d.ts

@@ -0,0 +1,60 @@
+/**
+ * MandateStore — persists Coordination Mandates and verifies their authorship.
+ *
+ * A mandate is valid only if its `authProof` verifies (threat-model T1/T2): the proof
+ * is produced ONLY by the PIN-gated issuance path (the human-authenticated surface,
+ * Justin's decision A on issuance), so an agent holding only its Bearer token cannot
+ * mint or widen a mandate. The proof covers the AUTHORED, immutable fields; `revoked`
+ * is a store-managed flag (a later mutation), so it is excluded from the proof and
+ * checked separately on every gate evaluation.
+ *
+ * The signer/verifier are INJECTED (like the other signed stores): tests use a
+ * deterministic stub; production uses an HMAC over the server's issuance secret.
+ *
+ * Trust boundary (stated, not hidden): integrity of the on-disk mandate + revocation
+ * flag against an attacker with LOCAL write access is the same trust root as today
+ * (threat-model T12, out of scope) — the proof stops a forged/edited AUTHORED mandate;
+ * local-file tamper of server-managed state is the baseline trust boundary.
+ */
+import type { Authority, CoordinationMandate } from './types.js';
+/** Canonical bytes the authProof covers — the AUTHORED fields only (proof + revoked excluded). */
+export declare function canonicalMandate(m: Omit<CoordinationMandate, 'authProof' | 'revoked'>): string;
+export interface MandateStoreDeps {
+    /** Absolute path to the mandates JSON file. */
+    filePath: string;
+    /** Sign the canonical mandate bytes (HMAC over the issuance secret in production). */
+    sign: (canonical: string) => string;
+    /** Verify a proof against the canonical mandate bytes. */
+    verifySig: (canonical: string, proof: string) => boolean;
+    now?: () => number;
+    /** Mandate id generator (default: random). Injected for deterministic tests. */
+    genId?: () => string;
+}
+export interface IssueMandateInput {
+    scope: string;
+    agents: [string, string];
+    authorities: Authority[];
+    author: string;
+    expiresAt: string;
+    id?: string;
+    createdAt?: string;
+}
+export declare class MandateStore {
+    private readonly d;
+    constructor(deps: MandateStoreDeps);
+    private nowIso;
+    private readAll;
+    private writeAll;
+    /**
+     * Issue (author) a mandate. ONLY the PIN-gated route should call this. Signs the
+     * authored bytes, persists, returns the mandate.
+     */
+    issue(input: IssueMandateInput): CoordinationMandate;
+    /** Verify a mandate's authorship proof (T1/T2). */
+    verifyAuthorship(m: CoordinationMandate): boolean;
+    get(id: string): CoordinationMandate | undefined;
+    list(): CoordinationMandate[];
+    /** Revoke a mandate (idempotent). Returns the updated mandate, or undefined if absent. */
+    revoke(id: string, reason: string): CoordinationMandate | undefined;
+}
+//# sourceMappingURL=MandateStore.d.ts.map

package/dist/coordination/MandateStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MandateStore.d.ts","sourceRoot":"","sources":["../../src/coordination/MandateStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAYjE,kGAAkG;AAClG,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,WAAW,GAAG,SAAS,CAAC,GAAG,MAAM,CAM9F;AAED,MAAM,WAAW,gBAAgB;IAC/B,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,sFAAsF;IACtF,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,0DAA0D;IAC1D,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IACzD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzB,WAAW,EAAE,SAAS,EAAE,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAmB;gBACzB,IAAI,EAAE,gBAAgB;IAIlC,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,OAAO;IAOf,OAAO,CAAC,QAAQ;IAKhB;;;OAGG;IACH,KAAK,CAAC,KAAK,EAAE,iBAAiB,GAAG,mBAAmB;IAkBpD,mDAAmD;IACnD,gBAAgB,CAAC,CAAC,EAAE,mBAAmB,GAAG,OAAO;IAKjD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS;IAIhD,IAAI,IAAI,mBAAmB,EAAE;IAI7B,0FAA0F;IAC1F,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS;CAUpE"}

package/dist/coordination/MandateStore.js

@@ -0,0 +1,106 @@
+/**
+ * MandateStore — persists Coordination Mandates and verifies their authorship.
+ *
+ * A mandate is valid only if its `authProof` verifies (threat-model T1/T2): the proof
+ * is produced ONLY by the PIN-gated issuance path (the human-authenticated surface,
+ * Justin's decision A on issuance), so an agent holding only its Bearer token cannot
+ * mint or widen a mandate. The proof covers the AUTHORED, immutable fields; `revoked`
+ * is a store-managed flag (a later mutation), so it is excluded from the proof and
+ * checked separately on every gate evaluation.
+ *
+ * The signer/verifier are INJECTED (like the other signed stores): tests use a
+ * deterministic stub; production uses an HMAC over the server's issuance secret.
+ *
+ * Trust boundary (stated, not hidden): integrity of the on-disk mandate + revocation
+ * flag against an attacker with LOCAL write access is the same trust root as today
+ * (threat-model T12, out of scope) — the proof stops a forged/edited AUTHORED mandate;
+ * local-file tamper of server-managed state is the baseline trust boundary.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+/** Deterministic, key-sorted serialization so the proof survives JSON round-trips
+ *  and key reordering. */
+function stableStringify(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return '[' + value.map(stableStringify).join(',') + ']';
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    return '{' + keys.map((k) => JSON.stringify(k) + ':' + stableStringify(obj[k])).join(',') + '}';
+}
+/** Canonical bytes the authProof covers — the AUTHORED fields only (proof + revoked excluded). */
+export function canonicalMandate(m) {
+    return stableStringify([
+        m.id, m.scope, m.agents,
+        m.authorities.map((a) => [a.action, a.bounds, a.requiresCondition ?? '']),
+        m.author, m.createdAt, m.expiresAt,
+    ]);
+}
+export class MandateStore {
+    d;
+    constructor(deps) {
+        this.d = deps;
+    }
+    nowIso() {
+        return new Date(this.d.now ? this.d.now() : Date.now()).toISOString();
+    }
+    readAll() {
+        try {
+            const raw = JSON.parse(fs.readFileSync(this.d.filePath, 'utf8'));
+            return Array.isArray(raw) ? raw : [];
+        }
+        catch { /* @silent-fallback-ok — mandates file may not exist yet; an empty store is DENY-BY-DEFAULT (the safe state) */
+            return [];
+        }
+    }
+    writeAll(mandates) {
+        fs.mkdirSync(path.dirname(this.d.filePath), { recursive: true });
+        fs.writeFileSync(this.d.filePath, JSON.stringify(mandates, null, 2));
+    }
+    /**
+     * Issue (author) a mandate. ONLY the PIN-gated route should call this. Signs the
+     * authored bytes, persists, returns the mandate.
+     */
+    issue(input) {
+        const id = input.id ?? (this.d.genId ? this.d.genId() : `mandate-${Math.random().toString(36).slice(2, 10)}`);
+        const createdAt = input.createdAt ?? this.nowIso();
+        const authored = {
+            id, scope: input.scope, agents: input.agents, authorities: input.authorities,
+            author: input.author, createdAt, expiresAt: input.expiresAt,
+        };
+        const mandate = {
+            ...authored,
+            revoked: null,
+            authProof: this.d.sign(canonicalMandate(authored)),
+        };
+        const all = this.readAll().filter((m) => m.id !== id);
+        all.push(mandate);
+        this.writeAll(all);
+        return mandate;
+    }
+    /** Verify a mandate's authorship proof (T1/T2). */
+    verifyAuthorship(m) {
+        const { authProof, revoked, ...authored } = m;
+        return this.d.verifySig(canonicalMandate(authored), authProof);
+    }
+    get(id) {
+        return this.readAll().find((m) => m.id === id);
+    }
+    list() {
+        return this.readAll();
+    }
+    /** Revoke a mandate (idempotent). Returns the updated mandate, or undefined if absent. */
+    revoke(id, reason) {
+        const all = this.readAll();
+        const idx = all.findIndex((m) => m.id === id);
+        if (idx < 0)
+            return undefined;
+        if (!all[idx].revoked) {
+            all[idx].revoked = { at: this.nowIso(), reason };
+            this.writeAll(all);
+        }
+        return all[idx];
+    }
+}
+//# sourceMappingURL=MandateStore.js.map

package/dist/coordination/MandateStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MandateStore.js","sourceRoot":"","sources":["../../src/coordination/MandateStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B;0BAC0B;AAC1B,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAClF,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AAClG,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,gBAAgB,CAAC,CAAqD;IACpF,OAAO,eAAe,CAAC;QACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM;QACvB,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS;KACnC,CAAC,CAAC;AACL,CAAC;AAwBD,MAAM,OAAO,YAAY;IACN,CAAC,CAAmB;IACrC,YAAY,IAAsB;QAChC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC;IAEO,MAAM;QACZ,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACxE,CAAC;IAEO,OAAO;QACb,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YACjE,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC,CAAC,+GAA+G;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC;IACxI,CAAC;IAEO,QAAQ,CAAC,QAA+B;QAC9C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAwB;QAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9G,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAuD;YACnE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW;YAC5E,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS;SAC5D,CAAC;QACF,MAAM,OAAO,GAAwB;YACnC,GAAG,QAAQ;YACX,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;SACnD,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,mDAAmD;IACnD,gBAAgB,CAAC,CAAsB;QACrC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;IACjE,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,0FAA0F;IAC1F,MAAM,CAAC,EAAU,EAAE,MAAc;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACtB,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;CACF"}

package/dist/coordination/ReviewExchange.d.ts

@@ -0,0 +1,135 @@
+/**
+ * ReviewExchange — the autonomous code-review protocol (spec §7 G2.3).
+ *
+ * A ReviewExchange is one mutual, mandate-gated sign-off of a review artifact
+ * between the two agents named in a Coordination Mandate. It is how Phase-1's
+ * "code-owner review" happens WITHOUT the human relaying: the owner agent delivers
+ * a review package over Threadline, the peer reviews and returns an authenticated
+ * verdict, and BOTH sign-offs are checked against the mandate's `sign-code-review`
+ * authority (bounds e.g. `{ artifact: 'migration-port', mutual: true }`) before
+ * they are accepted. Every accepted signature carries the audit hash of the gate
+ * decision that authorized it — the trail Justin reviews.
+ *
+ * Asymmetry, stated honestly: the peer's instance may not run this engine yet, so
+ * the peer's "signature" is their authenticated Threadline verdict message
+ * (Ed25519-authenticated sender → fingerprint), recorded verbatim by reference —
+ * kind 'authenticated-peer-verdict'. The local agent's signature goes through the
+ * local gate — kind 'mandate-gated-local'. BOTH are gate-evaluated here (named
+ * party, bounds, expiry, revocation), so a stranger's verdict or an out-of-bounds
+ * artifact is refused identically.
+ *
+ * State machine (linear, no skips):
+ *   proposed → delivered → verdict-recorded → complete
+ *                      ↘ changes-requested (terminal: rework = a NEW exchange)
+ *
+ * The review package is content-addressed: `packageSha256` is fixed at creation
+ * and signatures bind to the record that carries it — a different package is a
+ * different exchange. Deny-by-default is inherited: with no mandate issued, every
+ * sign/verdict path denies.
+ */
+import type { MandateGate } from './MandateGate.js';
+export type ReviewExchangeState = 'proposed' | 'delivered' | 'verdict-recorded' | 'complete' | 'changes-requested';
+export interface ReviewSignature {
+    /** The signing agent's routing fingerprint (a named party of the mandate). */
+    agentFp: string;
+    signedAt: string;
+    /** 'mandate-gated-local' = this server's own agent, allowed by the local gate;
+     *  'authenticated-peer-verdict' = the peer's sign-off, carried by their
+     *  authenticated Threadline verdict message (recorded by reference). */
+    kind: 'mandate-gated-local' | 'authenticated-peer-verdict';
+    /** Hash of the audit entry for the gate decision that authorized this signature. */
+    auditHash: string;
+    /** Evidence reference — e.g. a Threadline message/thread ref for peer signatures. */
+    evidence: string | null;
+}
+export interface PeerVerdict {
+    verdict: 'approve' | 'request-changes';
+    summary: string;
+    /** Authenticated-source reference (Threadline message/thread id). */
+    evidence: string;
+    recordedAt: string;
+}
+export interface ReviewExchangeRecord {
+    id: string;
+    /** The mandate whose `sign-code-review` authority governs this exchange. */
+    mandateId: string;
+    /** The artifact under review — must match the authority's bounds (e.g. 'migration-port'). */
+    artifact: string;
+    /** Human-readable pointer to the review package (repo path or URL). */
+    packageRef: string;
+    /** sha256 of the package content — what the signatures bind to. Immutable. */
+    packageSha256: string;
+    /** [ownerFp, peerFp] — owner delivers, peer reviews. Both must be mandate parties. */
+    parties: [string, string];
+    state: ReviewExchangeState;
+    /** Delivery evidence (e.g. Threadline message id), set by markDelivered. */
+    deliveredEvidence: string | null;
+    peerVerdict: PeerVerdict | null;
+    signatures: ReviewSignature[];
+    createdAt: string;
+    updatedAt: string;
+}
+/** Uniform method result — gate denials and state errors come back as data, not throws. */
+export type ExchangeResult = {
+    ok: true;
+    record: ReviewExchangeRecord;
+} | {
+    ok: false;
+    reason: string;
+};
+export interface ReviewExchangeEngineDeps {
+    /** Absolute path to the exchanges JSON file. */
+    filePath: string;
+    /** The mandate gate — EVERY sign-off is evaluated through it. */
+    gate: MandateGate;
+    now?: () => number;
+    /** Exchange id generator (default: random). Injected for deterministic tests. */
+    genId?: () => string;
+}
+export interface CreateExchangeInput {
+    mandateId: string;
+    artifact: string;
+    packageRef: string;
+    packageSha256: string;
+    parties: [string, string];
+    id?: string;
+}
+export declare class ReviewExchangeEngine {
+    private readonly d;
+    constructor(deps: ReviewExchangeEngineDeps);
+    private nowIso;
+    private readAll;
+    private writeAll;
+    private save;
+    /** Evaluate `sign-code-review` for one party through the mandate gate. */
+    private gateSignOff;
+    /** Create a new exchange in `proposed`. Validation only — no gate call yet
+     *  (creating a record delegates nothing; the sign-offs are what the mandate governs). */
+    create(input: CreateExchangeInput): ExchangeResult;
+    /** proposed → delivered. Records the delivery evidence (Threadline message ref). */
+    markDelivered(id: string, evidence: string): ExchangeResult;
+    /**
+     * delivered → verdict-recorded | changes-requested.
+     *
+     * Records the PEER's authenticated verdict. An 'approve' verdict IS the peer's
+     * sign-off, so it is MANDATE-GATED for the peer's fingerprint (named party,
+     * bounds, expiry, revocation — a deny refuses the verdict). A 'request-changes'
+     * verdict delegates nothing (it is a refusal), so it is recorded ungated — but
+     * only from the exchange's named peer.
+     */
+    recordPeerVerdict(id: string, input: {
+        verdict: 'approve' | 'request-changes';
+        summary: string;
+        evidence: string;
+        peerFp: string;
+    }): ExchangeResult;
+    /**
+     * verdict-recorded → complete. The OWNER's countersignature, mandate-gated for
+     * the owner's fingerprint. Completion requires the mutual pair: the peer's
+     * approve-signature already present + this one.
+     */
+    sign(id: string, agentFp: string): ExchangeResult;
+    get(id: string): ReviewExchangeRecord | undefined;
+    list(): ReviewExchangeRecord[];
+}
+//# sourceMappingURL=ReviewExchange.d.ts.map

package/dist/coordination/ReviewExchange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ReviewExchange.d.ts","sourceRoot":"","sources":["../../src/coordination/ReviewExchange.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,MAAM,mBAAmB,GAC3B,UAAU,GACV,WAAW,GACX,kBAAkB,GAClB,UAAU,GACV,mBAAmB,CAAC;AAExB,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB;;4EAEwE;IACxE,IAAI,EAAE,qBAAqB,GAAG,4BAA4B,CAAC;IAC3D,oFAAoF;IACpF,SAAS,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,SAAS,GAAG,iBAAiB,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,aAAa,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,EAAE,mBAAmB,CAAC;IAC3B,4EAA4E;IAC5E,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2FAA2F;AAC3F,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAC1C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC,MAAM,WAAW,wBAAwB;IACvC,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1B,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAID,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAA2B;gBACjC,IAAI,EAAE,wBAAwB;IAI1C,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,OAAO;IAOf,OAAO,CAAC,QAAQ;IAKhB,OAAO,CAAC,IAAI;IAQZ,0EAA0E;IAC1E,OAAO,CAAC,WAAW;IASnB;6FACyF;IACzF,MAAM,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc;IAuBlD,oFAAoF;IACpF,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc;IAY3D;;;;;;;;OAQG;IACH,iBAAiB,CACf,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,OAAO,EAAE,SAAS,GAAG,iBAAiB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GACnG,cAAc;IAoCjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc;IA0BjD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS;IAIjD,IAAI,IAAI,oBAAoB,EAAE;CAG/B"}