kcp-harness 0.3.0 → 0.4.0

package/dist/audit-reader.d.ts

@@ -0,0 +1,68 @@
+import type { AuditEvent, AuditEventType } from "./audit.js";
+/** Filter criteria for querying audit events. */
+export interface AuditFilter {
+    /** Filter by session ID. */
+    sessionId?: string;
+    /** Filter by event type(s). */
+    type?: AuditEventType | AuditEventType[];
+    /** Include events from this ISO date (inclusive). */
+    from?: string;
+    /** Include events until this ISO date (inclusive). */
+    to?: string;
+    /** Filter by outcome. */
+    outcome?: AuditEvent["outcome"];
+}
+/** Aggregate statistics from the audit log. */
+export interface AuditSummary {
+    /** Total sessions observed. */
+    sessions: number;
+    /** Total events. */
+    events: number;
+    /** Events targeting governed domains. */
+    governed: number;
+    /** Events that were blocked. */
+    blocked: number;
+    /** Budget exceeded events. */
+    budgetExceeded: number;
+    /** Temporal drift events. */
+    drifts: number;
+    /** Signature-blocked events. */
+    signatureBlocked: number;
+    /** Date range of the log. */
+    dateRange: {
+        first: string;
+        last: string;
+    };
+}
+/** Session summary in the index. */
+export interface SessionEntry {
+    id: string;
+    startedAt: string;
+    endedAt?: string;
+    events: number;
+    governed: number;
+    blocked: number;
+}
+/** Index of all sessions in the audit log. */
+export interface SessionIndex {
+    sessions: SessionEntry[];
+}
+/** Streaming JSONL audit log reader. */
+export declare class AuditReader {
+    private readonly path;
+    constructor(path: string);
+    /** Stream all events, optionally filtered. */
+    stream(filter?: AuditFilter): AsyncIterable<AuditEvent>;
+    /** Read all events into memory (for small-to-medium logs). */
+    readAll(filter?: AuditFilter): Promise<AuditEvent[]>;
+    /** Get aggregate statistics. */
+    summarize(filter?: AuditFilter): Promise<AuditSummary>;
+    /** Get events grouped by session. */
+    sessionIndex(): Promise<SessionIndex>;
+    /** Check if the audit log file exists. */
+    exists(): boolean;
+    /** Get file size in bytes. */
+    size(): number;
+    /** Get the path to the audit log. */
+    getPath(): string;
+}

package/dist/audit-reader.js

@@ -0,0 +1,150 @@
+// Audit reader — streaming JSONL reader with query capabilities.
+//
+// Reads the append-only audit log and provides filtering, summarization,
+// and session indexing. This is the read counterpart to audit.ts's writer.
+// Used by the compliance export (export.ts) and the dashboard (future).
+import { createReadStream, existsSync, statSync } from "node:fs";
+import { createInterface } from "node:readline";
+/** Streaming JSONL audit log reader. */
+export class AuditReader {
+    path;
+    constructor(path) {
+        this.path = path;
+    }
+    /** Stream all events, optionally filtered. */
+    async *stream(filter) {
+        if (!existsSync(this.path))
+            return;
+        const rl = createInterface({
+            input: createReadStream(this.path, "utf-8"),
+            crlfDelay: Infinity,
+        });
+        for await (const line of rl) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            try {
+                const event = JSON.parse(trimmed);
+                if (matchesFilter(event, filter)) {
+                    yield event;
+                }
+            }
+            catch {
+                // Skip malformed lines
+            }
+        }
+    }
+    /** Read all events into memory (for small-to-medium logs). */
+    async readAll(filter) {
+        const events = [];
+        for await (const event of this.stream(filter)) {
+            events.push(event);
+        }
+        return events;
+    }
+    /** Get aggregate statistics. */
+    async summarize(filter) {
+        const sessionIds = new Set();
+        let events = 0;
+        let governed = 0;
+        let blocked = 0;
+        let budgetExceeded = 0;
+        let drifts = 0;
+        let signatureBlocked = 0;
+        let first = "";
+        let last = "";
+        for await (const event of this.stream(filter)) {
+            events++;
+            sessionIds.add(event.sessionId);
+            if (event.timestamp) {
+                if (!first || event.timestamp < first)
+                    first = event.timestamp;
+                if (!last || event.timestamp > last)
+                    last = event.timestamp;
+            }
+            if (event.classification?.governed)
+                governed++;
+            if (event.outcome === "blocked")
+                blocked++;
+            if (event.type === "budget_exceeded")
+                budgetExceeded++;
+            if (event.type === "temporal_drift")
+                drifts++;
+            if (event.outcome === "blocked" && event.signature?.status && event.signature.status !== "verified") {
+                signatureBlocked++;
+            }
+        }
+        return {
+            sessions: sessionIds.size,
+            events,
+            governed,
+            blocked,
+            budgetExceeded,
+            drifts,
+            signatureBlocked,
+            dateRange: { first, last },
+        };
+    }
+    /** Get events grouped by session. */
+    async sessionIndex() {
+        const sessions = new Map();
+        for await (const event of this.stream()) {
+            let entry = sessions.get(event.sessionId);
+            if (!entry) {
+                entry = {
+                    id: event.sessionId,
+                    startedAt: event.timestamp,
+                    events: 0,
+                    governed: 0,
+                    blocked: 0,
+                };
+                sessions.set(event.sessionId, entry);
+            }
+            entry.events++;
+            if (event.timestamp < entry.startedAt)
+                entry.startedAt = event.timestamp;
+            if (!entry.endedAt || event.timestamp > entry.endedAt)
+                entry.endedAt = event.timestamp;
+            if (event.classification?.governed)
+                entry.governed++;
+            if (event.outcome === "blocked")
+                entry.blocked++;
+            if (event.type === "session_end")
+                entry.endedAt = event.timestamp;
+        }
+        return { sessions: Array.from(sessions.values()) };
+    }
+    /** Check if the audit log file exists. */
+    exists() {
+        return existsSync(this.path);
+    }
+    /** Get file size in bytes. */
+    size() {
+        if (!this.exists())
+            return 0;
+        return statSync(this.path).size;
+    }
+    /** Get the path to the audit log. */
+    getPath() {
+        return this.path;
+    }
+}
+/** Check if an event matches the filter criteria. */
+function matchesFilter(event, filter) {
+    if (!filter)
+        return true;
+    if (filter.sessionId && event.sessionId !== filter.sessionId)
+        return false;
+    if (filter.type) {
+        const types = Array.isArray(filter.type) ? filter.type : [filter.type];
+        if (!types.includes(event.type))
+            return false;
+    }
+    if (filter.from && event.timestamp < filter.from)
+        return false;
+    if (filter.to && event.timestamp > filter.to)
+        return false;
+    if (filter.outcome && event.outcome !== filter.outcome)
+        return false;
+    return true;
+}

package/dist/audit.d.ts

@@ -1,3 +1,4 @@
+import type { SignatureResult } from "kcp-agent";
 import type { Classification } from "./classifier.js";
 import type { GovernanceDecision } from "./governor.js";
 import type { LedgerSnapshot } from "./budget-ledger.js";
@@ -39,6 +40,8 @@ export interface AuditEvent {
         movedUnits?: number;
         newPlanAsOf?: string;
     };
+    /** Manifest signature verification result. */
+    signature?: SignatureResult;
 }
 /** Append-only audit log writer. */
 export declare class AuditLog {

package/dist/audit.js

@@ -61,6 +61,7 @@ export function buildEvent(sessionId, sequence, toolName, args, classification,
         outcome,
         durationMs,
         error,
+        signature: governance?.signature,
     };
 }
 /** Build a session lifecycle event. */

package/dist/cli.js

@@ -14,6 +14,8 @@ import { dirname, join } from "node:path";
 import { loadConfig } from "./config.js";
 import { serveProxy } from "./proxy.js";
 import { generate, listAgents } from "./integrations/generate.js";
+import { exportEvidence } from "./export.js";
+import { DashboardServer } from "./dashboard/server.js";
 const USAGE = `kcp-harness — KCP Compliance Harness
 
 Usage:
@@ -22,6 +24,8 @@ Usage:
   kcp-harness check  [--config harness.yaml]   Validate configuration
   kcp-harness integrate <agent> [options]       Generate agent integration files
   kcp-harness integrate --list                  List supported agents
+  kcp-harness export   [options]               Export compliance evidence
+  kcp-harness dashboard [options]              Launch compliance dashboard
   kcp-harness --version                        Show version
   kcp-harness --help                           Show this help
 
@@ -32,7 +36,7 @@ governance for any agent. It intercepts tool calls, classifies them
 as knowledge-navigation or pass-through, and routes governed calls
 through the kcp-agent planner before execution.
 `;
-const VERSION = "0.1.0";
+const VERSION = "0.4.0";
 const TEMPLATE = `# kcp-harness configuration
 version: "1.0"
 
@@ -57,6 +61,9 @@ governance:
     #   currency: USDC
     # context_budget: 50000
     # env: prod
+    # signature_required: true
+    # trusted_keys:
+    #   - "./keys/manifest-key.pem"
 
 downstream:
   # - name: "filesystem"
@@ -161,6 +168,63 @@ async function main() {
             }
             break;
         }
+        case "export": {
+            const config = existsSync(configPath) ? loadConfig(configPath) : null;
+            const auditPath = getFlag(args, "--audit") ?? config?.audit.path ?? ".kcp-harness/audit.jsonl";
+            const outDir = getFlag(args, "--out") ?? "evidence";
+            const format = (getFlag(args, "--format") ?? "both");
+            const org = getFlag(args, "--org");
+            const from = getFlag(args, "--from");
+            const to = getFlag(args, "--to");
+            if (!existsSync(auditPath)) {
+                process.stderr.write(`[kcp-harness] audit log not found: ${auditPath}\n`);
+                process.exit(1);
+            }
+            try {
+                const result = await exportEvidence({
+                    auditPath,
+                    outputDir: outDir,
+                    format,
+                    organization: org,
+                    dateRange: from || to ? { from: from ?? "", to: to ?? "" } : undefined,
+                });
+                process.stderr.write(`[kcp-harness] exported ${result.files.length} files to ${result.outputDir}\n`);
+                process.stderr.write(`[kcp-harness]   ${result.summary.events} events, ${result.summary.sessions} sessions\n`);
+                for (const f of result.files) {
+                    process.stdout.write(`  ${f}\n`);
+                }
+            }
+            catch (e) {
+                const msg = e instanceof Error ? e.message : String(e);
+                process.stderr.write(`[kcp-harness] export error: ${msg}\n`);
+                process.exit(1);
+            }
+            break;
+        }
+        case "dashboard": {
+            const config = existsSync(configPath) ? loadConfig(configPath) : null;
+            const auditPath = getFlag(args, "--audit") ?? config?.audit.path ?? ".kcp-harness/audit.jsonl";
+            const port = Number(getFlag(args, "--port") ?? "3847");
+            const host = getFlag(args, "--host") ?? "127.0.0.1";
+            if (!existsSync(auditPath)) {
+                process.stderr.write(`[kcp-harness] audit log not found: ${auditPath}\n`);
+                process.stderr.write(`[kcp-harness] the dashboard reads from the audit log — run the proxy first\n`);
+                process.exit(1);
+            }
+            const dashboard = new DashboardServer({ auditPath, port, host });
+            await dashboard.start();
+            process.stderr.write(`[kcp-harness] dashboard running at ${dashboard.getAddress()}\n`);
+            process.stderr.write(`[kcp-harness] watching ${auditPath} for live updates\n`);
+            // Keep running until SIGINT/SIGTERM
+            const shutdown = async () => {
+                process.stderr.write(`\n[kcp-harness] shutting down dashboard\n`);
+                await dashboard.stop();
+                process.exit(0);
+            };
+            process.on("SIGINT", shutdown);
+            process.on("SIGTERM", shutdown);
+            break;
+        }
         default:
             process.stderr.write(`[kcp-harness] unknown command: ${command}\n\n`);
             process.stdout.write(USAGE);

package/dist/config.d.ts

@@ -28,6 +28,10 @@ export interface GovernancePolicy {
     strict?: boolean;
     /** Environment for federation context selection (dev/test/staging/prod). */
     env?: string;
+    /** Require verified signatures on all manifests (default: false). */
+    signature_required?: boolean;
+    /** Trusted public keys for signature verification (paths, URLs, or inline). */
+    trusted_keys?: string[];
 }
 /** A downstream MCP server to proxy tool calls to. */
 export interface DownstreamConfig {

package/dist/config.js

@@ -60,6 +60,8 @@ function parsePolicy(raw) {
         max_units: p["max_units"] === undefined ? DEFAULT_POLICY.max_units : Number(p["max_units"]),
         strict: p["strict"] === true,
         env: p["env"] === undefined ? undefined : String(p["env"]),
+        signature_required: p["signature_required"] === true,
+        trusted_keys: Array.isArray(p["trusted_keys"]) ? p["trusted_keys"].map(String) : undefined,
     };
 }
 function parseBudget(raw) {

package/dist/dashboard/server.d.ts

@@ -0,0 +1,30 @@
+/** Dashboard server options. */
+export interface DashboardOptions {
+    /** Path to the audit JSONL log. */
+    auditPath: string;
+    /** HTTP port (default: 3847). */
+    port: number;
+    /** Bind host (default: 127.0.0.1 — localhost only). */
+    host: string;
+}
+/** Compliance dashboard HTTP server. */
+export declare class DashboardServer {
+    private server;
+    private tail;
+    private sseClients;
+    private readonly reader;
+    private readonly options;
+    constructor(options: DashboardOptions);
+    /** Start the dashboard server. */
+    start(): Promise<void>;
+    /** Stop the dashboard server. */
+    stop(): Promise<void>;
+    /** Get the server address. */
+    getAddress(): string;
+    private handleRequest;
+    private serveUI;
+    private serveSummary;
+    private serveSessions;
+    private serveEvents;
+    private serveSSE;
+}

package/dist/dashboard/server.js

@@ -0,0 +1,145 @@
+// Dashboard server — HTTP API + static UI over the audit log.
+//
+// Serves the compliance dashboard on localhost. No external dependencies
+// — uses Node's built-in http module. Binds to 127.0.0.1 by default
+// for security (no network exposure).
+import { createServer } from "node:http";
+import { AuditReader } from "../audit-reader.js";
+import { AuditTail } from "./tail.js";
+import { renderDashboard } from "./ui.js";
+/** Compliance dashboard HTTP server. */
+export class DashboardServer {
+    server = null;
+    tail = null;
+    sseClients = new Set();
+    reader;
+    options;
+    constructor(options) {
+        this.options = options;
+        this.reader = new AuditReader(options.auditPath);
+    }
+    /** Start the dashboard server. */
+    async start() {
+        this.server = createServer((req, res) => this.handleRequest(req, res));
+        // Start tailing for SSE
+        this.tail = new AuditTail(this.options.auditPath);
+        this.tail.on("line", (event) => {
+            const data = `data: ${JSON.stringify(event)}\n\n`;
+            for (const client of this.sseClients) {
+                try {
+                    client.write(data);
+                }
+                catch {
+                    this.sseClients.delete(client);
+                }
+            }
+        });
+        this.tail.start();
+        return new Promise((resolve) => {
+            this.server.listen(this.options.port, this.options.host, () => {
+                resolve();
+            });
+        });
+    }
+    /** Stop the dashboard server. */
+    async stop() {
+        this.tail?.stop();
+        for (const client of this.sseClients) {
+            try {
+                client.end();
+            }
+            catch { }
+        }
+        this.sseClients.clear();
+        return new Promise((resolve) => {
+            if (this.server) {
+                this.server.close(() => resolve());
+            }
+            else {
+                resolve();
+            }
+        });
+    }
+    /** Get the server address. */
+    getAddress() {
+        return `http://${this.options.host}:${this.options.port}`;
+    }
+    async handleRequest(req, res) {
+        const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+        const path = url.pathname;
+        // CORS headers for localhost
+        res.setHeader("Access-Control-Allow-Origin", "*");
+        res.setHeader("Access-Control-Allow-Methods", "GET");
+        try {
+            switch (path) {
+                case "/":
+                    return this.serveUI(res);
+                case "/api/summary":
+                    return await this.serveSummary(url, res);
+                case "/api/sessions":
+                    return await this.serveSessions(res);
+                case "/api/events":
+                    return await this.serveEvents(url, res);
+                case "/api/events/stream":
+                    return this.serveSSE(req, res);
+                default:
+                    res.writeHead(404, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "not found" }));
+            }
+        }
+        catch (e) {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: e instanceof Error ? e.message : String(e) }));
+        }
+    }
+    serveUI(res) {
+        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(renderDashboard());
+    }
+    async serveSummary(url, res) {
+        const filter = parseFilterParams(url);
+        const summary = await this.reader.summarize(filter);
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(summary));
+    }
+    async serveSessions(res) {
+        const index = await this.reader.sessionIndex();
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(index));
+    }
+    async serveEvents(url, res) {
+        const filter = parseFilterParams(url);
+        const events = await this.reader.readAll(filter);
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify(events));
+    }
+    serveSSE(req, res) {
+        res.writeHead(200, {
+            "Content-Type": "text/event-stream",
+            "Cache-Control": "no-cache",
+            "Connection": "keep-alive",
+        });
+        res.write("retry: 5000\n\n");
+        this.sseClients.add(res);
+        req.on("close", () => {
+            this.sseClients.delete(res);
+        });
+    }
+}
+/** Parse filter parameters from URL query string. */
+function parseFilterParams(url) {
+    const session = url.searchParams.get("session") ?? undefined;
+    const type = url.searchParams.get("type") ?? undefined;
+    const from = url.searchParams.get("from") ?? undefined;
+    const to = url.searchParams.get("to") ?? undefined;
+    const outcome = url.searchParams.get("outcome") ?? undefined;
+    if (!session && !type && !from && !to && !outcome)
+        return undefined;
+    return {
+        sessionId: session,
+        type: type,
+        from,
+        to,
+        outcome: outcome,
+    };
+}

package/dist/dashboard/tail.d.ts

@@ -0,0 +1,18 @@
+import type { AuditEvent } from "../audit.js";
+type TailHandler = (event: AuditEvent) => void;
+/** Tails an append-only JSONL audit log, emitting new events. */
+export declare class AuditTail {
+    private readonly path;
+    private handlers;
+    private offset;
+    private running;
+    constructor(path: string);
+    /** Register a handler for new events. */
+    on(_event: "line", handler: TailHandler): void;
+    /** Start tailing from the current end of file. */
+    start(): void;
+    /** Stop tailing. */
+    stop(): void;
+    private readNew;
+}
+export {};

package/dist/dashboard/tail.js

@@ -0,0 +1,77 @@
+// Audit log tail — watch for new events appended to the JSONL log.
+//
+// Uses fs.watch + readline to tail the audit log and emit parsed events.
+// Powers the SSE live-update endpoint in the dashboard.
+import { createReadStream, watchFile, unwatchFile, statSync } from "node:fs";
+import { createInterface } from "node:readline";
+/** Tails an append-only JSONL audit log, emitting new events. */
+export class AuditTail {
+    path;
+    handlers = [];
+    offset = 0;
+    running = false;
+    constructor(path) {
+        this.path = path;
+    }
+    /** Register a handler for new events. */
+    on(_event, handler) {
+        this.handlers.push(handler);
+    }
+    /** Start tailing from the current end of file. */
+    start() {
+        if (this.running)
+            return;
+        this.running = true;
+        try {
+            this.offset = statSync(this.path).size;
+        }
+        catch {
+            this.offset = 0;
+        }
+        watchFile(this.path, { interval: 1000 }, () => {
+            this.readNew();
+        });
+    }
+    /** Stop tailing. */
+    stop() {
+        this.running = false;
+        unwatchFile(this.path);
+    }
+    readNew() {
+        if (!this.running)
+            return;
+        let currentSize;
+        try {
+            currentSize = statSync(this.path).size;
+        }
+        catch {
+            return;
+        }
+        if (currentSize <= this.offset)
+            return;
+        const stream = createReadStream(this.path, {
+            encoding: "utf-8",
+            start: this.offset,
+        });
+        const rl = createInterface({ input: stream, crlfDelay: Infinity });
+        let newOffset = this.offset;
+        rl.on("line", (line) => {
+            newOffset += Buffer.byteLength(line, "utf-8") + 1; // +1 for newline
+            const trimmed = line.trim();
+            if (!trimmed)
+                return;
+            try {
+                const event = JSON.parse(trimmed);
+                for (const handler of this.handlers) {
+                    handler(event);
+                }
+            }
+            catch {
+                // Skip malformed lines
+            }
+        });
+        rl.on("close", () => {
+            this.offset = newOffset;
+        });
+    }
+}

package/dist/dashboard/ui.d.ts

@@ -0,0 +1 @@
+export declare function renderDashboard(): string;

package/dist/dashboard/ui.js

@@ -0,0 +1,193 @@
+// Dashboard UI — single-page HTML/CSS/JS served as a template string.
+//
+// No build step, no framework, no external dependencies. The dashboard
+// fetches data from the API endpoints and renders it in the browser.
+export function renderDashboard() {
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>KCP Harness — Compliance Dashboard</title>
+<style>
+  :root {
+    --bg: #0f1117; --surface: #1a1d27; --border: #2a2d3a;
+    --text: #e1e4ed; --muted: #8b8fa3; --accent: #e94560;
+    --green: #4ade80; --red: #f87171; --yellow: #fbbf24; --blue: #60a5fa;
+  }
+  * { margin: 0; padding: 0; box-sizing: border-box; }
+  body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: var(--bg); color: var(--text); }
+  .container { max-width: 1200px; margin: 0 auto; padding: 20px; }
+  header { display: flex; align-items: center; gap: 16px; margin-bottom: 24px; border-bottom: 1px solid var(--border); padding-bottom: 16px; }
+  header h1 { font-size: 20px; font-weight: 600; }
+  header .badge { font-size: 11px; background: var(--accent); color: white; padding: 2px 8px; border-radius: 10px; }
+  .stats { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); gap: 12px; margin-bottom: 24px; }
+  .stat { background: var(--surface); border: 1px solid var(--border); border-radius: 8px; padding: 16px; }
+  .stat .label { font-size: 12px; color: var(--muted); text-transform: uppercase; letter-spacing: 0.5px; }
+  .stat .value { font-size: 28px; font-weight: 700; margin-top: 4px; }
+  .stat .value.green { color: var(--green); }
+  .stat .value.red { color: var(--red); }
+  .stat .value.yellow { color: var(--yellow); }
+  .stat .value.blue { color: var(--blue); }
+  .panel { background: var(--surface); border: 1px solid var(--border); border-radius: 8px; margin-bottom: 16px; }
+  .panel-header { padding: 12px 16px; border-bottom: 1px solid var(--border); display: flex; justify-content: space-between; align-items: center; }
+  .panel-header h2 { font-size: 14px; font-weight: 600; }
+  .panel-body { padding: 0; max-height: 500px; overflow-y: auto; }
+  table { width: 100%; border-collapse: collapse; font-size: 13px; }
+  th { text-align: left; padding: 8px 16px; color: var(--muted); font-weight: 500; font-size: 11px; text-transform: uppercase; letter-spacing: 0.5px; position: sticky; top: 0; background: var(--surface); }
+  td { padding: 8px 16px; border-top: 1px solid var(--border); }
+  .outcome { display: inline-block; padding: 2px 8px; border-radius: 4px; font-size: 11px; font-weight: 600; }
+  .outcome-approved { background: rgba(74,222,128,0.15); color: var(--green); }
+  .outcome-blocked { background: rgba(248,113,113,0.15); color: var(--red); }
+  .outcome-pass-through { background: rgba(96,165,250,0.15); color: var(--blue); }
+  .outcome-error { background: rgba(251,191,36,0.15); color: var(--yellow); }
+  .type-badge { font-size: 11px; color: var(--muted); }
+  .live-dot { width: 8px; height: 8px; border-radius: 50%; background: var(--green); display: inline-block; animation: pulse 2s infinite; }
+  @keyframes pulse { 0%, 100% { opacity: 1; } 50% { opacity: 0.3; } }
+  .filters { display: flex; gap: 8px; align-items: center; }
+  .filters select, .filters input { background: var(--bg); border: 1px solid var(--border); color: var(--text); padding: 4px 8px; border-radius: 4px; font-size: 12px; }
+  .sessions-list { list-style: none; }
+  .sessions-list li { padding: 10px 16px; border-top: 1px solid var(--border); display: flex; justify-content: space-between; align-items: center; }
+  .sessions-list li:first-child { border-top: none; }
+  .session-id { font-family: monospace; font-size: 12px; color: var(--blue); cursor: pointer; }
+  .session-meta { font-size: 11px; color: var(--muted); }
+  footer { text-align: center; color: var(--muted); font-size: 11px; margin-top: 24px; padding: 16px; }
+</style>
+</head>
+<body>
+<div class="container">
+  <header>
+    <h1>KCP Harness</h1>
+    <span class="badge">Compliance Dashboard</span>
+    <span style="margin-left:auto;font-size:12px;color:var(--muted)"><span class="live-dot"></span> Live</span>
+  </header>
+
+  <div class="stats" id="stats">
+    <div class="stat"><div class="label">Sessions</div><div class="value blue" id="s-sessions">-</div></div>
+    <div class="stat"><div class="label">Events</div><div class="value" id="s-events">-</div></div>
+    <div class="stat"><div class="label">Governed</div><div class="value green" id="s-governed">-</div></div>
+    <div class="stat"><div class="label">Blocked</div><div class="value red" id="s-blocked">-</div></div>
+    <div class="stat"><div class="label">Budget Exceeded</div><div class="value yellow" id="s-budget">-</div></div>
+    <div class="stat"><div class="label">Drifts</div><div class="value yellow" id="s-drifts">-</div></div>
+    <div class="stat"><div class="label">Sig. Blocked</div><div class="value red" id="s-sig">-</div></div>
+  </div>
+
+  <div class="panel">
+    <div class="panel-header">
+      <h2>Sessions</h2>
+    </div>
+    <div class="panel-body">
+      <ul class="sessions-list" id="sessions-list"></ul>
+    </div>
+  </div>
+
+  <div class="panel">
+    <div class="panel-header">
+      <h2>Event Log</h2>
+      <div class="filters">
+        <select id="f-type"><option value="">All types</option>
+          <option value="tool_call">tool_call</option>
+          <option value="session_start">session_start</option>
+          <option value="session_end">session_end</option>
+          <option value="budget_spend">budget_spend</option>
+          <option value="budget_exceeded">budget_exceeded</option>
+          <option value="temporal_drift">temporal_drift</option>
+        </select>
+        <select id="f-outcome"><option value="">All outcomes</option>
+          <option value="approved">approved</option>
+          <option value="blocked">blocked</option>
+          <option value="pass-through">pass-through</option>
+          <option value="error">error</option>
+        </select>
+      </div>
+    </div>
+    <div class="panel-body">
+      <table>
+        <thead><tr><th>Time</th><th>Session</th><th>Type</th><th>Tool</th><th>Outcome</th><th>Reason</th></tr></thead>
+        <tbody id="events-body"></tbody>
+      </table>
+    </div>
+  </div>
+
+  <footer>kcp-harness compliance dashboard &middot; all data local &middot; no external connections</footer>
+</div>
+
+<script>
+const API = '';
+let allEvents = [];
+
+async function load() {
+  const [summary, sessions, events] = await Promise.all([
+    fetch(API + '/api/summary').then(r => r.json()),
+    fetch(API + '/api/sessions').then(r => r.json()),
+    fetch(API + '/api/events').then(r => r.json()),
+  ]);
+  updateStats(summary);
+  renderSessions(sessions.sessions || []);
+  allEvents = events;
+  renderEvents(events);
+}
+
+function updateStats(s) {
+  document.getElementById('s-sessions').textContent = s.sessions ?? 0;
+  document.getElementById('s-events').textContent = s.events ?? 0;
+  document.getElementById('s-governed').textContent = s.governed ?? 0;
+  document.getElementById('s-blocked').textContent = s.blocked ?? 0;
+  document.getElementById('s-budget').textContent = s.budgetExceeded ?? 0;
+  document.getElementById('s-drifts').textContent = s.drifts ?? 0;
+  document.getElementById('s-sig').textContent = s.signatureBlocked ?? 0;
+}
+
+function renderSessions(sessions) {
+  const ul = document.getElementById('sessions-list');
+  if (!sessions.length) { ul.innerHTML = '<li style="color:var(--muted)">No sessions yet</li>'; return; }
+  ul.innerHTML = sessions.map(s =>
+    '<li><div><span class="session-id" onclick="filterSession(\\'' + s.id + '\\')">' + s.id.slice(0,12) + '</span>' +
+    '<div class="session-meta">' + s.events + ' events, ' + s.governed + ' governed, ' + s.blocked + ' blocked</div></div>' +
+    '<div class="session-meta">' + new Date(s.startedAt).toLocaleString() + '</div></li>'
+  ).join('');
+}
+
+function renderEvents(events) {
+  const type = document.getElementById('f-type').value;
+  const outcome = document.getElementById('f-outcome').value;
+  let filtered = events;
+  if (type) filtered = filtered.filter(e => e.type === type);
+  if (outcome) filtered = filtered.filter(e => e.outcome === outcome);
+  const last200 = filtered.slice(-200);
+  const tbody = document.getElementById('events-body');
+  tbody.innerHTML = last200.map(e =>
+    '<tr><td style="font-size:11px;white-space:nowrap">' + new Date(e.timestamp).toLocaleTimeString() + '</td>' +
+    '<td style="font-family:monospace;font-size:11px">' + (e.sessionId||'').slice(0,8) + '</td>' +
+    '<td><span class="type-badge">' + e.type + '</span></td>' +
+    '<td>' + (e.toolCall?.name || '-') + '</td>' +
+    '<td><span class="outcome outcome-' + e.outcome + '">' + e.outcome + '</span></td>' +
+    '<td style="font-size:11px;max-width:300px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap">' + (e.governance?.reason || e.error || e.type) + '</td></tr>'
+  ).join('');
+}
+
+function filterSession(id) {
+  const filtered = allEvents.filter(e => e.sessionId === id);
+  renderEvents(filtered);
+}
+
+document.getElementById('f-type').onchange = () => renderEvents(allEvents);
+document.getElementById('f-outcome').onchange = () => renderEvents(allEvents);
+
+// SSE live updates
+const sse = new EventSource(API + '/api/events/stream');
+sse.onmessage = (msg) => {
+  try {
+    const event = JSON.parse(msg.data);
+    allEvents.push(event);
+    renderEvents(allEvents);
+    fetch(API + '/api/summary').then(r => r.json()).then(updateStats);
+  } catch {}
+};
+sse.onerror = () => {};
+
+load();
+</script>
+</body>
+</html>`;
+}

package/dist/export.d.ts

@@ -0,0 +1,28 @@
+import { type AuditSummary } from "./audit-reader.js";
+/** Export configuration. */
+export interface ExportOptions {
+    /** Path to the audit JSONL log. */
+    auditPath: string;
+    /** Output directory for evidence bundles. */
+    outputDir: string;
+    /** Which framework(s) to export. */
+    format: "soc2" | "iso27001" | "both";
+    /** Optional date range filter. */
+    dateRange?: {
+        from: string;
+        to: string;
+    };
+    /** Organization name for the report header. */
+    organization?: string;
+}
+/** Result of an export operation. */
+export interface ExportResult {
+    /** Output directory. */
+    outputDir: string;
+    /** Files created. */
+    files: string[];
+    /** Summary statistics. */
+    summary: AuditSummary;
+}
+/** Export compliance evidence from the audit log. */
+export declare function exportEvidence(options: ExportOptions): Promise<ExportResult>;

package/dist/export.js

@@ -0,0 +1,226 @@
+// Compliance evidence export — SOC 2 Type II and ISO 27001 Annex A.
+//
+// Reads the audit JSONL log and produces structured evidence bundles
+// suitable for compliance auditors. The mapping is deterministic: audit
+// events map to specific control IDs based on their type and outcome.
+//
+// Output: a directory of JSON evidence files + Markdown summary reports.
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { AuditReader } from "./audit-reader.js";
+/** Export compliance evidence from the audit log. */
+export async function exportEvidence(options) {
+    const reader = new AuditReader(options.auditPath);
+    const filter = options.dateRange
+        ? { from: options.dateRange.from, to: options.dateRange.to }
+        : undefined;
+    const events = await reader.readAll(filter);
+    const summary = await reader.summarize(filter);
+    const sessionIndex = await reader.sessionIndex();
+    const files = [];
+    // Create output directories
+    mkdirSync(options.outputDir, { recursive: true });
+    // Write manifest
+    const manifest = {
+        generator: "kcp-harness",
+        generatedAt: new Date().toISOString(),
+        organization: options.organization,
+        format: options.format,
+        dateRange: options.dateRange ?? summary.dateRange,
+        statistics: summary,
+    };
+    writeJSON(options.outputDir, "manifest.json", manifest);
+    files.push("manifest.json");
+    // Write raw data
+    mkdirSync(join(options.outputDir, "raw"), { recursive: true });
+    writeJSON(options.outputDir, "raw/sessions.json", sessionIndex);
+    writeJSON(options.outputDir, "raw/statistics.json", summary);
+    files.push("raw/sessions.json", "raw/statistics.json");
+    // Generate framework-specific evidence
+    if (options.format === "soc2" || options.format === "both") {
+        const soc2Files = exportSOC2(options.outputDir, events, summary, options.organization);
+        files.push(...soc2Files);
+    }
+    if (options.format === "iso27001" || options.format === "both") {
+        const isoFiles = exportISO27001(options.outputDir, events, summary, options.organization);
+        files.push(...isoFiles);
+    }
+    return { outputDir: options.outputDir, files, summary };
+}
+// -- SOC 2 Type II (Trust Services Criteria) ----------------------------------
+function exportSOC2(outputDir, events, summary, org) {
+    const dir = join(outputDir, "soc2");
+    mkdirSync(dir, { recursive: true });
+    const files = [];
+    // CC6.1 — Logical and physical access controls
+    const cc61 = buildControlEvidence("CC6.1", "Logical and Physical Access Controls", "The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events.", events, (e) => e.type === "tool_call" && e.classification?.governed === true, (e) => `${e.outcome}: ${e.governance?.reason ?? e.toolCall?.name ?? "unknown"}`);
+    writeJSON(dir, "CC6.1-logical-access.json", cc61);
+    files.push("soc2/CC6.1-logical-access.json");
+    // CC6.3 — Authorized access
+    const cc63 = buildControlEvidence("CC6.3", "Authorized Access", "The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes.", events, (e) => e.type === "tool_call" && e.governance?.mode === "plan-first", (e) => `pre-authorized via plan "${e.governance?.approvedPlan?.task ?? "unknown"}"`);
+    writeJSON(dir, "CC6.3-authorized-access.json", cc63);
+    files.push("soc2/CC6.3-authorized-access.json");
+    // CC6.6 — System boundaries
+    const cc66 = buildControlEvidence("CC6.6", "System Boundaries", "The entity implements logical access security measures to protect against threats from sources outside its system boundaries.", events, (e) => e.type === "tool_call", (e) => e.classification?.governed
+        ? `governed: ${e.classification.reason}`
+        : `pass-through: ${e.classification?.reason ?? "unclassified"}`);
+    writeJSON(dir, "CC6.6-system-boundaries.json", cc66);
+    files.push("soc2/CC6.6-system-boundaries.json");
+    // CC7.2 — Monitoring
+    const cc72 = buildControlEvidence("CC7.2", "Monitoring Activities", "The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives.", events, (_e) => true, (e) => `[${e.type}] ${e.outcome}: ${shortDetail(e)}`);
+    writeJSON(dir, "CC7.2-monitoring.json", cc72);
+    files.push("soc2/CC7.2-monitoring.json");
+    // CC8.1 — Change management
+    const cc81 = buildControlEvidence("CC8.1", "Change Management", "The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives.", events, (e) => e.type === "temporal_drift" || e.type === "plan_invalidated", (e) => e.drift
+        ? `drift detected in ${e.drift.manifest}: ${e.drift.summary}`
+        : `${e.type}: ${e.outcome}`);
+    writeJSON(dir, "CC8.1-change-management.json", cc81);
+    files.push("soc2/CC8.1-change-management.json");
+    // Summary report
+    const report = generateSOC2Report(summary, cc61, cc63, cc66, cc72, cc81, org);
+    writeFile(dir, "summary.md", report);
+    files.push("soc2/summary.md");
+    return files;
+}
+// -- ISO 27001 Annex A --------------------------------------------------------
+function exportISO27001(outputDir, events, summary, org) {
+    const dir = join(outputDir, "iso27001");
+    mkdirSync(dir, { recursive: true });
+    const files = [];
+    // A.8.3 — Information access restriction
+    const a83 = buildControlEvidence("A.8.3", "Information Access Restriction", "Access to information and other associated assets shall be restricted in accordance with the established topic-specific policy on access control.", events, (e) => e.type === "tool_call" && e.classification?.governed === true, (e) => `${e.outcome}: ${e.governance?.reason ?? e.toolCall?.name ?? "unknown"}`);
+    writeJSON(dir, "A.8.3-access-restriction.json", a83);
+    files.push("iso27001/A.8.3-access-restriction.json");
+    // A.8.4 — Access to source code
+    const a84 = buildControlEvidence("A.8.4", "Access to Source Code", "Read and write access to source code, development tools and software libraries shall be appropriately managed.", events, (e) => e.type === "tool_call" && e.classification?.governed === true
+        && (e.toolCall?.name === "Read" || e.toolCall?.name === "Glob" || e.toolCall?.name === "Grep"), (e) => `${e.toolCall?.name} ${e.classification?.target ?? ""}: ${e.outcome}`);
+    writeJSON(dir, "A.8.4-source-code-access.json", a84);
+    files.push("iso27001/A.8.4-source-code-access.json");
+    // A.8.15 — Logging
+    const a815 = buildControlEvidence("A.8.15", "Logging", "Logs that record activities, exceptions, faults and other relevant events shall be produced, stored, protected and analysed.", events, (e) => e.type === "session_start" || e.type === "session_end", (e) => `session ${e.sessionId}: ${e.type}`);
+    writeJSON(dir, "A.8.15-logging.json", a815);
+    files.push("iso27001/A.8.15-logging.json");
+    // A.8.16 — Monitoring activities
+    const a816 = buildControlEvidence("A.8.16", "Monitoring Activities", "Networks, systems and applications shall be monitored for anomalous behaviour and appropriate actions taken to evaluate potential information security incidents.", events, (e) => e.type === "temporal_drift" || e.type === "budget_exceeded" || e.outcome === "blocked", (e) => `[${e.type}] ${e.outcome}: ${shortDetail(e)}`);
+    writeJSON(dir, "A.8.16-monitoring.json", a816);
+    files.push("iso27001/A.8.16-monitoring.json");
+    // A.5.23 — Information security for use of cloud services
+    const a523 = buildControlEvidence("A.5.23", "Information Security for Use of Cloud Services", "Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organization's information security requirements.", events, (e) => e.type === "tool_call" && e.signature !== undefined, (e) => `signature ${e.signature?.status ?? "unknown"}: ${e.signature?.detail ?? e.toolCall?.name ?? ""}`);
+    writeJSON(dir, "A.5.23-cloud-services.json", a523);
+    files.push("iso27001/A.5.23-cloud-services.json");
+    // Summary report
+    const report = generateISO27001Report(summary, a83, a84, a815, a816, a523, org);
+    writeFile(dir, "summary.md", report);
+    files.push("iso27001/summary.md");
+    return files;
+}
+// -- Helpers ------------------------------------------------------------------
+function buildControlEvidence(controlId, controlName, description, events, predicate, detailFn) {
+    const matching = events.filter(predicate);
+    return {
+        controlId,
+        controlName,
+        description,
+        evidenceCount: matching.length,
+        events: matching.map((e) => ({
+            timestamp: e.timestamp,
+            sessionId: e.sessionId,
+            type: e.type,
+            outcome: e.outcome,
+            detail: detailFn(e),
+        })),
+    };
+}
+function shortDetail(e) {
+    if (e.drift)
+        return `drift in ${e.drift.manifest}`;
+    if (e.budget)
+        return `budget ${e.budget.totals?.USDC ?? 0}/${e.budget.ceiling?.amount ?? "∞"}`;
+    if (e.governance)
+        return e.governance.reason;
+    if (e.toolCall)
+        return `${e.toolCall.name}`;
+    return e.type;
+}
+function generateSOC2Report(summary, ...controls) {
+    const org = controls.pop();
+    const ctrls = controls;
+    const lines = [
+        `# SOC 2 Type II — Evidence Summary`,
+        org ? `\n**Organization**: ${org}` : "",
+        `\n**Generated**: ${new Date().toISOString()}`,
+        `**Period**: ${summary.dateRange.first || "N/A"} — ${summary.dateRange.last || "N/A"}`,
+        ``,
+        `## Overview`,
+        ``,
+        `| Metric | Value |`,
+        `|--------|-------|`,
+        `| Sessions | ${summary.sessions} |`,
+        `| Total events | ${summary.events} |`,
+        `| Governed access attempts | ${summary.governed} |`,
+        `| Blocked | ${summary.blocked} |`,
+        `| Budget exceeded | ${summary.budgetExceeded} |`,
+        `| Temporal drifts | ${summary.drifts} |`,
+        `| Signature-blocked | ${summary.signatureBlocked} |`,
+        ``,
+        `## Controls`,
+        ``,
+        `| Control | Name | Evidence Count |`,
+        `|---------|------|---------------|`,
+        ...ctrls.map((c) => `| ${c.controlId} | ${c.controlName} | ${c.evidenceCount} |`),
+        ``,
+        ...ctrls.map((c) => [
+            `### ${c.controlId} — ${c.controlName}`,
+            ``,
+            `> ${c.description}`,
+            ``,
+            `Evidence items: **${c.evidenceCount}**`,
+            ``,
+        ].join("\n")),
+    ];
+    return lines.filter(Boolean).join("\n") + "\n";
+}
+function generateISO27001Report(summary, ...controls) {
+    const org = controls.pop();
+    const ctrls = controls;
+    const lines = [
+        `# ISO 27001 Annex A — Evidence Summary`,
+        org ? `\n**Organization**: ${org}` : "",
+        `\n**Generated**: ${new Date().toISOString()}`,
+        `**Period**: ${summary.dateRange.first || "N/A"} — ${summary.dateRange.last || "N/A"}`,
+        ``,
+        `## Overview`,
+        ``,
+        `| Metric | Value |`,
+        `|--------|-------|`,
+        `| Sessions | ${summary.sessions} |`,
+        `| Total events | ${summary.events} |`,
+        `| Governed access attempts | ${summary.governed} |`,
+        `| Blocked | ${summary.blocked} |`,
+        `| Budget exceeded | ${summary.budgetExceeded} |`,
+        `| Temporal drifts | ${summary.drifts} |`,
+        `| Signature-blocked | ${summary.signatureBlocked} |`,
+        ``,
+        `## Controls`,
+        ``,
+        `| Control | Name | Evidence Count |`,
+        `|---------|------|---------------|`,
+        ...ctrls.map((c) => `| ${c.controlId} | ${c.controlName} | ${c.evidenceCount} |`),
+        ``,
+        ...ctrls.map((c) => [
+            `### ${c.controlId} — ${c.controlName}`,
+            ``,
+            `> ${c.description}`,
+            ``,
+            `Evidence items: **${c.evidenceCount}**`,
+            ``,
+        ].join("\n")),
+    ];
+    return lines.filter(Boolean).join("\n") + "\n";
+}
+function writeJSON(dir, filename, data) {
+    writeFileSync(join(dir, filename), JSON.stringify(data, null, 2) + "\n", "utf-8");
+}
+function writeFile(dir, filename, content) {
+    writeFileSync(join(dir, filename), content, "utf-8");
+}

package/dist/governor.d.ts

@@ -1,4 +1,4 @@
-import { type AgentPlan, type DecisionTrace } from "kcp-agent";
+import { type AgentPlan, type DecisionTrace, type SignatureResult } from "kcp-agent";
 import type { GovernancePolicy } from "./config.js";
 import type { Classification } from "./classifier.js";
 import type { SessionState, ApprovedPlan } from "./session.js";
@@ -19,6 +19,8 @@ export interface GovernanceDecision {
     approvedPlan?: ApprovedPlan;
     /** Budget spend result (for auto-plan mode with costs). */
     budgetSpend?: SpendResult;
+    /** Manifest signature verification result (when signature checking is active). */
+    signature?: SignatureResult;
 }
 /**
  * Govern a classified tool call — decide whether to approve or block.

package/dist/governor.js

@@ -100,6 +100,18 @@ async function autoGovern(target, domain, session, policy) {
             approved: false,
             mode: "blocked",
             reason: `manifest error: ${tree.error}`,
+            signature: tree.signature,
+        };
+    }
+    // Signature enforcement: if required, block on non-verified signatures
+    if (policy.signature_required && tree.signature?.status !== "verified") {
+        const status = tree.signature?.status ?? "unsigned";
+        const detail = tree.signature?.detail ?? "no signing block in manifest";
+        return {
+            approved: false,
+            mode: "blocked",
+            reason: `manifest signature ${status}: ${detail}`,
+            signature: tree.signature,
         };
     }
     // Extract the flat plan list
@@ -131,6 +143,7 @@ async function autoGovern(target, domain, session, policy) {
                     mode: "auto-plan",
                     plan: rootPlan,
                     budgetSpend,
+                    signature: tree.signature,
                     reason: `auto-plan blocked: budget ceiling exceeded — ${budgetSpend.reason}`,
                 };
             }
@@ -142,6 +155,7 @@ async function autoGovern(target, domain, session, policy) {
             mode: "auto-plan",
             plan: rootPlan,
             budgetSpend,
+            signature: tree.signature,
             reason: `auto-plan approved: unit "${matchingUnit.id}" (score ${matchingUnit.score}) covers ${target}`,
         };
     }
@@ -152,6 +166,7 @@ async function autoGovern(target, domain, session, policy) {
             approved: false,
             mode: "auto-plan",
             plan: rootPlan,
+            signature: tree.signature,
             reason: `auto-plan blocked: unit "${ineligibleUnit.id}" covers ${target} but is not load-eligible (${ineligibleUnit.reasons.filter(r => r.startsWith("unaffordable") || r.startsWith("needs")).join("; ") || "gate restriction"})`,
         };
     }
@@ -164,6 +179,7 @@ async function autoGovern(target, domain, session, policy) {
         approved: false,
         mode: "auto-plan",
         plan: rootPlan,
+        signature: tree.signature,
         reason: `auto-plan blocked: ${skipReason}`,
     };
 }
@@ -188,6 +204,8 @@ function buildFollowOptions(policy, session) {
         planOptions,
         maxDepth: 0, // auto-plan doesn't follow federation by default
         fetchGuard: {}, // default guards (no private hosts, https only)
+        requireSignature: policy.signature_required ?? false,
+        trustedKey: policy.trusted_keys?.[0], // FollowOptions takes a single key
     };
 }
 function normalizePath(p) {

package/dist/index.d.ts

@@ -10,3 +10,6 @@ export { BudgetLedger, type BudgetCeiling, type LedgerEntry, type LedgerSource,
 export { TemporalWatch, type WatchedPlan, type DriftResult, type WatchResult, } from "./temporal-watch.js";
 export { generate, generateAll, listAgents, harnessServerEntry, governedPathsBlock, manifestRef, } from "./integrations/generate.js";
 export { AGENTS, type AgentTarget, type IntegrationOutput, type IntegrationFile, type IntegrationOptions, type AgentInfo, } from "./integrations/types.js";
+export { AuditReader, type AuditFilter, type AuditSummary, type SessionEntry, type SessionIndex, } from "./audit-reader.js";
+export { exportEvidence, type ExportOptions, type ExportResult, } from "./export.js";
+export { DashboardServer, type DashboardOptions, } from "./dashboard/server.js";

package/dist/index.js

@@ -19,3 +19,6 @@ export { BudgetLedger, } from "./budget-ledger.js";
 export { TemporalWatch, } from "./temporal-watch.js";
 export { generate, generateAll, listAgents, harnessServerEntry, governedPathsBlock, manifestRef, } from "./integrations/generate.js";
 export { AGENTS, } from "./integrations/types.js";
+export { AuditReader, } from "./audit-reader.js";
+export { exportEvidence, } from "./export.js";
+export { DashboardServer, } from "./dashboard/server.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kcp-harness",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "KCP Compliance Harness — MCP proxy that enforces deterministic knowledge governance for any agent",
   "type": "module",
   "bin": {