magenta-canon 0.8.0 → 0.8.1

package/README.md

@@ -19,6 +19,7 @@ MCP host (Claude Code, Claude Desktop, Cursor, …) and downstream MCP tools, an
 
 ```bash
 npx magenta-canon demo                  # full local proof loop: allow · block · witness · verify · tamper
+npx magenta-canon vertical fintech-refund # sector demo in buyer language (vertical --list shows all 8)
 npx magenta-canon verify --self-test    # verifier self-check: all verdict levels incl. a tamper FAIL
 npx magenta-canon gateway <config.json> # the stdio MCP capability gateway
 npx magenta-canon mirror --self-test    # external STH mirror: catch operator history rewrites

package/bin/magenta-canon.mjs

@@ -3,6 +3,7 @@
  * magenta-canon — CLI entry point for the open-source reference implementation.
  *
  *   npx magenta-canon demo               run the full local proof loop
+ *   npx magenta-canon vertical <id>      run a sector demo (gate one industry's tools)
  *   npx magenta-canon verify <bundle>    independently verify an evidence bundle
  *   npx magenta-canon gateway <config>   run the stdio MCP capability gateway
  *   npx magenta-canon mirror <cmd>       external STH mirror (append|verify|check|--self-test)
@@ -40,6 +41,9 @@ const USAGE = `magenta-canon ${pkg.version} — verifiable MCP gateway for AI-ag
 Usage:
   magenta-canon demo                 Run the full local proof loop (allow, block,
                                      witness, verify, and a tamper control).
+  magenta-canon vertical <id>        Run a sector demo (e.g. fintech-refund,
+                                     healthcare-scribe). 'vertical --list' shows
+                                     all available ids.
   magenta-canon verify <bundle.json> Independently verify an evidence bundle.
                                      Exit 0 = VERIFIED, 1 = VERIFICATION FAILED.
   magenta-canon gateway <config.json> Run the stdio MCP capability gateway
@@ -93,6 +97,14 @@ switch (sub) {
     // demo.mjs is plain ESM and resolves tsx + headless mode itself.
     run(process.execPath, [path.join(ROOT, "scripts", "demo.mjs"), ...rest]);
     break;
+  case "vertical":
+    // Sector vertical demos: gate one industry's tool calls, prove the blocked
+    // call never reached downstream, and verify the evidence. Reads a shipped
+    // examples/verticals/<id>/ scenario and resolves its runtime from dist/
+    // (or tsx in a repo checkout) exactly like `demo`. No <id> / --list / an
+    // unknown id all print the available verticals.
+    run(process.execPath, [path.join(ROOT, "scripts", "vertical-demo.mjs"), ...rest]);
+    break;
   case "verify":
     if (!rest[0] || rest[0].startsWith("-") && rest[0] !== "--self-test") {
       // pass flags through (e.g. --self-test, --version); only warn on no target

package/docs/NPM_PACKAGING.md

@@ -3,27 +3,22 @@
 How Magenta Canon is packaged as an installable CLI, what ships in the tarball,
 what deliberately does not, and how to verify the package locally.
 
-> **Status: published on npm.** The current published release is **`0.7.0`**
-> (the **Ledger Sentinel**), carried on **both** the `latest` and `next`
-> dist-tags (registry fileCount **66**, unpacked **747063 B**, shasum
-> `7b978f669ff08b5d7474e7b1e003bd4e62b47060`, integrity
-> `sha512-4CoFikyVR35Obl4Tcd2k6ffdP9Iq0/fCT6MM2cFF1Xc8fDcHHYUpr7lfkMaveSucf+d6571gKWdB/m/F/t8VAw==`,
-> owner-verified live install). This refresh prepares **`0.8.0`** — the
-> **Sentinel Mesh V1** completion. Magenta Canon 0.8.0 completes the mesh:
-> eight sentinels plus a coordinator, **105 ratified invariants** across
-> twelve domains (every one with a named enforcer; zero live reserved),
-> adding the **Execution** (MC-EXEC-001…014), **Configuration &
-> Dual-Authority** (MC-CONFIG-001…014), and **Mirror** (MC-MIRROR-001…012)
-> sentinels, plus the **Anomaly** meta-sentinel (MC-ANOM-001…004, the Attack
-> KB's regression memory) and the **Sentinel Coordinator** (MC-COORD-001…003,
-> a scoped, deterministic, tamper-evident `magenta-sentinel-report/1` that
-> never overrides or suppresses a finding). It does **not** provide continuous
-> hosted monitoring, Postgres storage, hosted independent mirror
-> infrastructure, trust-root/issuer persistence, production execution kill
-> switches, multi-tenant hosted services, automatic multi-model threat
-> ingestion, or probabilistic/unknown-threat detection. `0.8.0` is **not yet
-> published**; publishing remains an explicitly-authorized step done on an
-> authenticated machine.
+> **Status: published on npm.** The current published release is **`0.8.0`**
+> (the **Sentinel Mesh V1** completion — eight sentinels plus a coordinator,
+> **105 ratified invariants** across twelve domains, every one with a named
+> enforcer), carried on **both** the `latest` and `next` dist-tags.
+>
+> This refresh prepares **`0.8.1`** — the **Vertical Demo Gallery**: eight
+> runnable, customer-facing sector demos under `examples/verticals/` (fintech
+> refund ceiling; devops / saas / healthcare / legal / e-commerce / insurance /
+> SOC allowlists) and a new **`magenta-canon vertical <id>`** CLI command so npm
+> users can run them from a fresh install (the prior `npm run demo:vertical`
+> path only worked inside a repo checkout). `0.8.1` is a **PATCH** — no code,
+> dependency, verifier, witness, gateway, or Sentinel changes; the trust core
+> and Sentinel Mesh V1 are untouched, runtime deps remain `tweetnacl` + `zod`,
+> and production install scripts remain zero. `0.8.1` is **not yet published**;
+> publishing remains an explicitly-authorized step done on an authenticated
+> machine.
 >
 > **Verdict-semantics migration (0.3.0):** scripts that grepped
 > `RESULT: VERIFIED` must match the new verdicts — `RESULT: INTEGRITY
@@ -72,7 +67,8 @@ npm dist-tag add magenta-canon@<version> next
 | `0.5.0` | **durable witness identity + authorized rotation continuity** (Durable Witness PR 3, #35): encrypted witness keystore (`MAGENTA_WITNESS_KEYFILE`/`MAGENTA_WITNESS_PASSPHRASE`; scrypt N=2^16 with bounded params → AES-256-GCM with header-bound AAD, `O_EXCL` create, atomic replace); **rotation records committed into the evidence ledger** (`magenta-rotation/1`: old-key authorization + new-key countersignature + `effective_tree_size` epoch boundary + chain hash) — *key material alone never grants authority; a validated, durably committed rotation record does*; epoch-aware replay in server **and** standalone verifier (historical STHs validate against their epoch's key; rollback/substitution/forked chains refused); deterministic crash reconciliation at boot (recover committed fact / abandon orphan / fail closed — never silent activation); single-authority config matrix (keystore × env-keys × `MAGENTA_STATE_FILE` exclusions); ships `docs/WITNESS_IDENTITY.md`. **Limitation (documented):** witness identity only — founder/receipt-issuer custody is a separate forthcoming lane (issuer key still regenerates on restart in file-ledger mode; pre-restart evidence keeps verifying). **Migration:** none required — 0.4.0 env-key and memory modes are unchanged; the keystore is opt-in and mutually exclusive with `MAGENTA_WITNESS_SECRET`/`PUBLIC` and `MAGENTA_STATE_FILE`. **Also in this release (repo hygiene, #37/#38):** the legacy RealityOS heartbeat adapter is **deprecated and removed** — excluded from the supported product architecture, never required for Magenta verification or distribution (`docs/LEGACY_REALITYOS_HEARTBEAT.md`); a tracked legacy dev identity was removed with a secret-hygiene CI gate added (`reports/INCIDENT_TRACKED_DEV_IDENTITY.md`) — **published**; `latest`/`next` aligned |
 | `0.6.0` | the **executable Sentinel Mesh foundation** (PRs #40/#41): versioned **Invariant Registry** (`magenta-invariants/1`, `shared/invariants.ts` — 37 ratified invariants across repository/artifact/dependency/release/authority/witness domains, permanent IDs, reserved IDs for future lanes); deterministic **Repository Sentinel** (tracked private-key material incl. escaped-JSON forms, identity/keystore/state paths, heartbeat-revival surfaces, `.gitignore` protections); deterministic **Artifact Sentinel** (tarball / extracted dir / `npm pack`: secrets, forbidden file classes, compiled entrypoints, `MANIFEST.json` sha256 equality, version consistency, approved-dependency set, install scripts, native binaries — hardened in-memory tar reader, traversal-inert, bomb/malformation refusal); canonical **violation records** (`magenta-sentinel-violation/1`, deterministic `record_hash`, volatile fields excluded, assurance honestly `unsigned-local-diagnostic`); **scoped release-promotion eligibility** (`eligible / blocked / requires-independent-review / diagnostic-only`; authority-class violations always escalate to human review); and the **Witness & Rotation Sentinel** (MC-WIT-001…011: pinned-anchor continuity — honestly `not-evaluated` without an independently supplied anchor; rotation-chain completeness; old-key authorization + new-key countersignature validation; exact epoch boundaries; key-version & fork detection; epoch-correct STH validation; **substitution / resurrection / rollback / pre-activation** distinguished in evidence; keystore↔ledger authority agreement) — independently re-derived from the published wire formats, never wrapping server code. New CLI: `magenta-canon sentinel repository | artifact | pack | witness | invariants`. **Not included:** production runtime kill switch, hosted Sentinel service, Postgres Ledger Sentinel, independent hosted mirror, founder/root custody persistence, multi-tenant hosted control plane, automated third-party threat-intel intake, complete Sentinel Mesh coverage. **Migration:** none required — no behavior changes to gateway/verifier/ledger/witness paths; the sentinel surface is additive — **published**; `latest`/`next` aligned |
 | `0.7.0` | the **Ledger Sentinel** (PR #43): MC-LEDGER-RSV-001 ratified into **MC-LEDGER-001…021** — the ledger-truth contract every storage implementation must satisfy (File Ledger today; PostgreSQL/hosted/mirrors later; *the implementation is never its own judge*). Independent evaluation (`magenta-canon sentinel ledger <ledger.jsonl>`): contiguous receipt sequence; duplicate-identity refusal; framing integrity; previous-hash continuity from genesis; receipt/execution-hash re-derivation; issuer-signature validity (recomputed hashes never bypass signatures); **own RFC 6962 Merkle re-derivation**; equivocation-at-rest freeze; exact tree-size/boundary accounting; checkpoint monotonicity; deterministic replay (store↔verifier↔sentinel agreement); corruption fails closed; **bounded crash-tail quarantine** (only a provably incomplete final append); commit-before-authority; single-writer/lock inspection (**never auto-stolen**); single-ledger-authority + **writer-fencing contract** for future stores; witness cross-run agreement; authority-record typing; mirror consistency incl. checkpoint-deletion exposure. Five distinct assurance outcomes (integrity / origin / operational exclusivity / not-evaluated / violation). Ships `docs/LEDGER_SENTINEL.md`. **Not included:** continuous hosted monitoring, Postgres storage, hosted independent mirror, trust-root/issuer persistence, production kill switches, multi-tenancy, automatic multi-model threat ingestion. **Migration:** none — additive CLI surface — **published** (fileCount 66, shasum `7b978f669ff08b5d7474e7b1e003bd4e62b47060`); `latest`/`next` aligned |
-| `0.8.0` | **Sentinel Mesh V1 complete** (PRs #45–#48, #50–#51): the mesh closes at **eight sentinels + a coordinator** and **105 ratified invariants** across twelve domains — every ratified invariant names an enforcer (the coverage law is a CI gate), **zero live reserved**, three superseded reservations preserved. New this release: the **Execution Sentinel** (MC-EXEC-001…014 — binds an action to the signature-authenticated receipt's committed `action_hash`, never operator params; refused-action-downstream and missing-receipt caught); the **Configuration & Dual-Authority Sentinel** (MC-CONFIG-001…014 — one operation, one canonical authority path; independent source/precedence/fallback/drift enumeration); the **Mirror Sentinel** (MC-MIRROR-001…012 — independent `magenta-mirror/1` re-derivation: record-hash chain, STH signatures, anti-equivocation across all observed sizes); the **Anomaly Sentinel** (MC-ANOM-001…004 — the Attack KB's regression memory: a ratified attack that stops being detected fails the build; governed model-to-canon intake refuses model-sourced ratification without an independent reviewer + reproduction); and the **Sentinel Coordinator** (MC-COORD-001…003 — combines per-sentinel findings into one scoped, deterministic, tamper-evident `magenta-sentinel-report/1` that never overrides, downgrades, or suppresses a finding, freezing only the affected authority class). In-tree conformance proof (`server/sentinel/conformance.test.ts`) pins the totals, coverage law, adversarial matrix, scoped freeze, deterministic report hash, and redaction; ships `docs/SENTINEL_MESH_V1_COMPLETION.md`. Attack KB / Anomaly / Coordinator / conformance are **CI/dev surface — not in the tarball**; the ratified invariants ship in the registry. **Not included:** hosted Sentinel service, continuous monitoring, Postgres ledger, hosted mirror, trust-root/issuer custody, multi-tenancy, probabilistic/unknown-threat detection, production kill switches. **Migration:** none — additive (new sentinel subcommands; no behavior change to gateway/verifier/ledger/witness) — **not yet published** |
+| `0.8.0` | **Sentinel Mesh V1 complete** (PRs #45–#48, #50–#51): the mesh closes at **eight sentinels + a coordinator** and **105 ratified invariants** across twelve domains — every ratified invariant names an enforcer (the coverage law is a CI gate), **zero live reserved**, three superseded reservations preserved. New this release: the **Execution Sentinel** (MC-EXEC-001…014 — binds an action to the signature-authenticated receipt's committed `action_hash`, never operator params; refused-action-downstream and missing-receipt caught); the **Configuration & Dual-Authority Sentinel** (MC-CONFIG-001…014 — one operation, one canonical authority path; independent source/precedence/fallback/drift enumeration); the **Mirror Sentinel** (MC-MIRROR-001…012 — independent `magenta-mirror/1` re-derivation: record-hash chain, STH signatures, anti-equivocation across all observed sizes); the **Anomaly Sentinel** (MC-ANOM-001…004 — the Attack KB's regression memory: a ratified attack that stops being detected fails the build; governed model-to-canon intake refuses model-sourced ratification without an independent reviewer + reproduction); and the **Sentinel Coordinator** (MC-COORD-001…003 — combines per-sentinel findings into one scoped, deterministic, tamper-evident `magenta-sentinel-report/1` that never overrides, downgrades, or suppresses a finding, freezing only the affected authority class). In-tree conformance proof (`server/sentinel/conformance.test.ts`) pins the totals, coverage law, adversarial matrix, scoped freeze, deterministic report hash, and redaction; ships `docs/SENTINEL_MESH_V1_COMPLETION.md`. Attack KB / Anomaly / Coordinator / conformance are **CI/dev surface — not in the tarball**; the ratified invariants ship in the registry. **Not included:** hosted Sentinel service, continuous monitoring, Postgres ledger, hosted mirror, trust-root/issuer custody, multi-tenancy, probabilistic/unknown-threat detection, production kill switches. **Migration:** none — additive (new sentinel subcommands; no behavior change to gateway/verifier/ledger/witness) — **published** (`latest`/`next` aligned to `0.8.0`) |
+| `0.8.1` | **Vertical Demo Gallery** (PR #49): eight runnable, customer-facing sector demos under `examples/verticals/` — fintech (refund ceiling) and devops / saas / healthcare / legal / e-commerce / insurance / SOC (allowlists) — plus a new **`magenta-canon vertical <id>`** CLI command so npm users can run them from a fresh install (the prior `npm run demo:vertical` path only worked inside a repo checkout). Each demo gates one industry's tool calls, proves the blocked call was **absent** downstream, and verifies the evidence to `ORIGIN AND INTEGRITY VERIFIED` against a pinned witness key. **PATCH** — no code / dependency / verifier / witness / gateway / Sentinel changes; trust core and Sentinel Mesh V1 untouched. Runtime deps remain `tweetnacl` + `zod`; zero production install scripts. Conformance + CLI regression tests pin every gate decision and the npm-consumer command. **Migration:** none — additive examples + one CLI subcommand — **not yet published** |
 
 
 **Verified on macOS / Linux / Windows (current release `0.1.11`; `0.1.12` re-proven via installed-tarball smoke):**
@@ -271,25 +267,26 @@ MCP gateway, and a **local-file external STH mirror foundation** with an
 operator runbook. **Not** included: hosted mirror service, automated network
 publishing, production multi-tenant SaaS, production durability guarantees.
 
-## Verifying the release artifact (checklist — current target `0.8.0`)
+## Verifying the release artifact (checklist — current target `0.8.1`)
 
 From a clean checkout of the release commit:
 
 ```bash
 npm ci && npm run check && npm test          # 0 tsc errors; full suite green
 npm run build:lean && npm run build:lean     # deterministic: dist/MANIFEST.json identical
-npm pack                                     # prepack rebuilds dist/; expect magenta-canon-0.8.0.tgz
-tar -tzf magenta-canon-0.8.0.tgz             # no .ts, no .map, no tests, no server/routes.ts, no ledger/lock/keystore files; no attack-kb/anomaly/coordinator/conformance files
+npm pack                                     # prepack rebuilds dist/; expect magenta-canon-0.8.1.tgz
+tar -tzf magenta-canon-0.8.1.tgz             # no .ts, no .map, no tests, no server/routes.ts, no ledger/lock/keystore files; no attack-kb/anomaly/coordinator/conformance files
 ```
 
 Then in an empty directory:
 
 ```bash
-npm init -y && npm i ../path/to/magenta-canon-0.8.0.tgz
+npm init -y && npm i ../path/to/magenta-canon-0.8.1.tgz
 ls node_modules                              # exactly: magenta-canon tweetnacl zod
 npx magenta-canon verify --self-test         # all verdict levels incl. tamper VERIFICATION FAILED
 npx magenta-canon mirror --self-test         # [PASS] x3
 npx magenta-canon demo                       # allow / block / VERIFIED / tamper FAILED
+npx magenta-canon vertical --list            # 8 sector demos; `vertical <id>` runs one (new in 0.8.1)
 npx magenta-canon sentinel artifact node_modules/magenta-canon   # PROMOTION: ELIGIBLE
 npx magenta-canon sentinel ledger <your-ledger.jsonl>            # ledger truth (0.7.0)
 npx magenta-canon sentinel execution <bundle.json>              # authority-bound action evidence (new in 0.8.0)

package/examples/verticals/README.md

@@ -0,0 +1,54 @@
+# Sector vertical examples
+
+Each folder is a complete, runnable example of Magenta Canon gating a different
+kind of AI-agent action — the **same wedge** ("allow what's delegated, block what
+isn't, witness both, verify the receipt") told in the vocabulary of a specific
+sector. Every example rides the **real** capability gate the policy enforces
+today: a numeric **ceiling** for `payments.refund`, and an **allowlist**
+(default-deny) of `mcp.call:<tool>` for everything else. No example claims a gate
+behavior that isn't actually enforced.
+
+| Vertical | Sector | Model | Delegated → allowed | Blocked at the gate |
+|---|---|---|---|---|
+| [`devops-deploy`](devops-deploy/) | DevOps / CI-CD | allowlist | deploy_staging | deploy_prod |
+| [`ecommerce-ops`](ecommerce-ops/) | E-commerce / marketplace | allowlist | catalog_read, inventory_update | price_override |
+| [`fintech-refund`](fintech-refund/) | Fintech / payments | ceiling | refund | refund |
+| [`healthcare-scribe`](healthcare-scribe/) | Healthcare | allowlist | chart_read, note_draft | medication_order, record_delete |
+| [`insurance-claims`](insurance-claims/) | Insurance | allowlist | claim_read, estimate_draft | payout_approve |
+| [`legal-paralegal`](legal-paralegal/) | Legal | allowlist | caselaw_search, memo_draft | court_efile |
+| [`saas-support-data`](saas-support-data/) | SaaS / customer support | allowlist | db_read, db_write | db_delete |
+| [`security-soc`](security-soc/) | Security / SOC | allowlist | alert_read, ioc_enrich | host_isolate |
+
+## Run any vertical
+
+From a published install — no repository checkout required:
+
+```bash
+npx magenta-canon vertical <id>     # e.g. npx magenta-canon vertical healthcare-scribe
+npx magenta-canon vertical --list   # list the available verticals
+```
+
+(Inside a repo checkout, `npm run demo:vertical <id>` does the same thing.)
+
+The runner boots a local control plane, drives the scenario's calls through the
+Magenta MCP gateway, proves the blocked calls were **absent** from the downstream
+tool's own log, publishes the evidence, and independently verifies it to
+`ORIGIN AND INTEGRITY VERIFIED` against a pinned witness key.
+
+**Limitation:** every vertical is a local, single-host **demo** — ephemeral port,
+fresh universe in a temp dir, cleaned up on exit. Not hosted SaaS, not
+multi-tenant, not production durability.
+
+## Make your own
+
+Each folder's `gateway.config.json` is the artifact you point a real MCP host
+(Claude Code / Cursor) at. To adapt one:
+
+1. Point `downstream` at **your** real MCP server instead of the shared
+   `lib/tool-server.mjs` echo tool.
+2. Set `grantedCapabilities` to what the agent is actually delegated.
+3. Run your host through the gateway — every tool call is now gated and witnessed.
+
+`lib/tool-server.mjs` is a single generic downstream tool server shared by all
+the examples: it exposes whatever tool names it is given on the command line and
+logs every call it receives (the ground truth for the non-bypass proof).

package/examples/verticals/devops-deploy/README.md

@@ -0,0 +1,44 @@
+# Deploy agent — DevOps / CI-CD
+
+A CI agent may deploy to staging but is not delegated production. A prod deploy is blocked at the gate and never reaches the deploy tool.
+
+## What this proves
+
+**Capability model:** **allowlist** (default-deny)
+**Delegated capabilities:** `mcp.call:deploy_staging`
+
+| Tool call | Gate decision | Why |
+|---|---|---|
+| `deploy_staging` | ✅ allowed | staging is delegated |
+| `deploy_prod` | ⛔ blocked | production is NOT on the allowlist |
+
+Every decision — allowed *and* blocked — is witnessed as a signed receipt on the
+append-only transparency log. A blocked call **never reaches the downstream
+tool** (proven by the tool's own call log), and the published evidence verifies
+to `ORIGIN AND INTEGRITY VERIFIED` against a pinned witness key.
+
+## Run it
+
+From a published install — no repository checkout required:
+
+```bash
+npx magenta-canon vertical devops-deploy
+```
+
+(Inside a repo checkout you can also use `npm run demo:vertical devops-deploy`.)
+
+It boots a local control plane, drives the calls above through the Magenta
+gateway, proves the blocked call was **absent** from the downstream tool's own
+log, publishes the evidence, and independently verifies it to
+`ORIGIN AND INTEGRITY VERIFIED`.
+
+**Limitation:** this is a local, single-host **demo** — an ephemeral control
+plane and a fresh universe in a temp dir, cleaned up on exit. It is not hosted
+SaaS, not multi-tenant, and not production durability.
+
+## Make it yours
+
+`gateway.config.json` here is the same artifact you would point a real MCP host
+(Claude Code / Cursor) at: swap the downstream for **your** real MCP tool server
+and set your own `grantedCapabilities`. Every tool call is then gated and
+witnessed exactly as shown above.

package/examples/verticals/devops-deploy/gateway.config.json

@@ -0,0 +1,23 @@
+{
+  "downstream": {
+    "command": "node",
+    "args": [
+      "../lib/tool-server.mjs",
+      "deploy_staging",
+      "deploy_prod"
+    ]
+  },
+  "controlPlane": {
+    "url": "http://127.0.0.1:5000",
+    "internalKey": "operator-secret-xyz"
+  },
+  "agent": {
+    "agentId": "mcp:acme-ci-deployer",
+    "authorizedBy": "operator:cj@trendinghot",
+    "model": "mcp-gateway"
+  },
+  "grantedCapabilities": [
+    "mcp.call:deploy_staging"
+  ],
+  "defaultAction": "agent.mcp.call"
+}

package/examples/verticals/devops-deploy/scenario.json

@@ -0,0 +1,30 @@
+{
+  "id": "devops-deploy",
+  "sector": "DevOps / CI-CD",
+  "title": "Deploy agent",
+  "model": "allowlist",
+  "story": "A CI agent may deploy to staging but is not delegated production. A prod deploy is blocked at the gate and never reaches the deploy tool.",
+  "calls": [
+    {
+      "name": "deploy_staging",
+      "arguments": {
+        "service": "checkout-api",
+        "sha": "3d7f9bf"
+      },
+      "expect": "allow",
+      "note": "staging is delegated"
+    },
+    {
+      "name": "deploy_prod",
+      "arguments": {
+        "service": "checkout-api",
+        "sha": "3d7f9bf"
+      },
+      "expect": "block",
+      "note": "production is NOT on the allowlist"
+    }
+  ],
+  "groundTruthAbsent": [
+    "deploy_prod"
+  ]
+}

package/examples/verticals/ecommerce-ops/README.md

@@ -0,0 +1,45 @@
+# Catalog ops agent — E-commerce / marketplace
+
+A merchandising agent may read the catalog and update inventory, but may not override price or cancel orders. Pricing and order state stay with a human.
+
+## What this proves
+
+**Capability model:** **allowlist** (default-deny)
+**Delegated capabilities:** `mcp.call:catalog_read`, `mcp.call:inventory_update`
+
+| Tool call | Gate decision | Why |
+|---|---|---|
+| `catalog_read` | ✅ allowed | reading the catalog is delegated |
+| `inventory_update` | ✅ allowed | inventory updates are delegated |
+| `price_override` | ⛔ blocked | overriding price is NOT delegated |
+
+Every decision — allowed *and* blocked — is witnessed as a signed receipt on the
+append-only transparency log. A blocked call **never reaches the downstream
+tool** (proven by the tool's own call log), and the published evidence verifies
+to `ORIGIN AND INTEGRITY VERIFIED` against a pinned witness key.
+
+## Run it
+
+From a published install — no repository checkout required:
+
+```bash
+npx magenta-canon vertical ecommerce-ops
+```
+
+(Inside a repo checkout you can also use `npm run demo:vertical ecommerce-ops`.)
+
+It boots a local control plane, drives the calls above through the Magenta
+gateway, proves the blocked call was **absent** from the downstream tool's own
+log, publishes the evidence, and independently verifies it to
+`ORIGIN AND INTEGRITY VERIFIED`.
+
+**Limitation:** this is a local, single-host **demo** — an ephemeral control
+plane and a fresh universe in a temp dir, cleaned up on exit. It is not hosted
+SaaS, not multi-tenant, and not production durability.
+
+## Make it yours
+
+`gateway.config.json` here is the same artifact you would point a real MCP host
+(Claude Code / Cursor) at: swap the downstream for **your** real MCP tool server
+and set your own `grantedCapabilities`. Every tool call is then gated and
+witnessed exactly as shown above.

package/examples/verticals/ecommerce-ops/gateway.config.json

@@ -0,0 +1,26 @@
+{
+  "downstream": {
+    "command": "node",
+    "args": [
+      "../lib/tool-server.mjs",
+      "catalog_read",
+      "inventory_update",
+      "price_override",
+      "order_cancel"
+    ]
+  },
+  "controlPlane": {
+    "url": "http://127.0.0.1:5000",
+    "internalKey": "operator-secret-xyz"
+  },
+  "agent": {
+    "agentId": "mcp:acme-catalog-ops",
+    "authorizedBy": "operator:cj@trendinghot",
+    "model": "mcp-gateway"
+  },
+  "grantedCapabilities": [
+    "mcp.call:catalog_read",
+    "mcp.call:inventory_update"
+  ],
+  "defaultAction": "agent.mcp.call"
+}

package/examples/verticals/ecommerce-ops/scenario.json

@@ -0,0 +1,38 @@
+{
+  "id": "ecommerce-ops",
+  "sector": "E-commerce / marketplace",
+  "title": "Catalog ops agent",
+  "model": "allowlist",
+  "story": "A merchandising agent may read the catalog and update inventory, but may not override price or cancel orders. Pricing and order state stay with a human.",
+  "calls": [
+    {
+      "name": "catalog_read",
+      "arguments": {
+        "sku": "SKU-552"
+      },
+      "expect": "allow",
+      "note": "reading the catalog is delegated"
+    },
+    {
+      "name": "inventory_update",
+      "arguments": {
+        "sku": "SKU-552",
+        "on_hand": 120
+      },
+      "expect": "allow",
+      "note": "inventory updates are delegated"
+    },
+    {
+      "name": "price_override",
+      "arguments": {
+        "sku": "SKU-552",
+        "price_cents": 100
+      },
+      "expect": "block",
+      "note": "overriding price is NOT delegated"
+    }
+  ],
+  "groundTruthAbsent": [
+    "price_override"
+  ]
+}

package/examples/verticals/fintech-refund/README.md

@@ -0,0 +1,44 @@
+# Refund agent — Fintech / payments
+
+A support agent may issue refunds up to a delegated ceiling ($100). A larger refund is stopped at the gate before it reaches the payments tool.
+
+## What this proves
+
+**Capability model:** numeric **ceiling**
+**Delegated capabilities:** `payments.refund:<=10000`
+
+| Tool call | Gate decision | Why |
+|---|---|---|
+| `refund` | ✅ allowed | $89.00 — within the $100 ceiling |
+| `refund` | ⛔ blocked | $250.00 — exceeds the delegated ceiling |
+
+Every decision — allowed *and* blocked — is witnessed as a signed receipt on the
+append-only transparency log. A blocked call **never reaches the downstream
+tool** (proven by the tool's own call log), and the published evidence verifies
+to `ORIGIN AND INTEGRITY VERIFIED` against a pinned witness key.
+
+## Run it
+
+From a published install — no repository checkout required:
+
+```bash
+npx magenta-canon vertical fintech-refund
+```
+
+(Inside a repo checkout you can also use `npm run demo:vertical fintech-refund`.)
+
+It boots a local control plane, drives the calls above through the Magenta
+gateway, proves the blocked call was **absent** from the downstream tool's own
+log, publishes the evidence, and independently verifies it to
+`ORIGIN AND INTEGRITY VERIFIED`.
+
+**Limitation:** this is a local, single-host **demo** — an ephemeral control
+plane and a fresh universe in a temp dir, cleaned up on exit. It is not hosted
+SaaS, not multi-tenant, and not production durability.
+
+## Make it yours
+
+`gateway.config.json` here is the same artifact you would point a real MCP host
+(Claude Code / Cursor) at: swap the downstream for **your** real MCP tool server
+and set your own `grantedCapabilities`. Every tool call is then gated and
+witnessed exactly as shown above.

package/examples/verticals/fintech-refund/gateway.config.json

@@ -0,0 +1,31 @@
+{
+  "downstream": {
+    "command": "node",
+    "args": [
+      "../lib/tool-server.mjs",
+      "refund"
+    ]
+  },
+  "controlPlane": {
+    "url": "http://127.0.0.1:5000",
+    "internalKey": "operator-secret-xyz"
+  },
+  "agent": {
+    "agentId": "mcp:acme-payments-bot",
+    "authorizedBy": "operator:cj@trendinghot",
+    "model": "mcp-gateway"
+  },
+  "grantedCapabilities": [
+    "payments.refund:<=10000"
+  ],
+  "defaultAction": "agent.mcp.call",
+  "toolMap": {
+    "refund": {
+      "action": "agent.payments.refund",
+      "paramsFrom": [
+        "amount_cents",
+        "order_id"
+      ]
+    }
+  }
+}

package/examples/verticals/fintech-refund/scenario.json

@@ -0,0 +1,30 @@
+{
+  "id": "fintech-refund",
+  "sector": "Fintech / payments",
+  "title": "Refund agent",
+  "model": "ceiling",
+  "story": "A support agent may issue refunds up to a delegated ceiling ($100). A larger refund is stopped at the gate before it reaches the payments tool.",
+  "calls": [
+    {
+      "name": "refund",
+      "arguments": {
+        "amount_cents": 8900,
+        "order_id": "4471"
+      },
+      "expect": "allow",
+      "note": "$89.00 — within the $100 ceiling"
+    },
+    {
+      "name": "refund",
+      "arguments": {
+        "amount_cents": 25000,
+        "order_id": "5012"
+      },
+      "expect": "block",
+      "note": "$250.00 — exceeds the delegated ceiling"
+    }
+  ],
+  "groundTruthAbsent": [
+    "refund"
+  ]
+}

package/examples/verticals/healthcare-scribe/README.md

@@ -0,0 +1,46 @@
+# Clinical scribe agent — Healthcare
+
+A clinical scribe may read the chart and draft a note, but may not order medication or delete records. Clinical authority stays with the clinician.
+
+## What this proves
+
+**Capability model:** **allowlist** (default-deny)
+**Delegated capabilities:** `mcp.call:chart_read`, `mcp.call:note_draft`
+
+| Tool call | Gate decision | Why |
+|---|---|---|
+| `chart_read` | ✅ allowed | reading the chart is delegated |
+| `note_draft` | ✅ allowed | drafting a note is delegated |
+| `medication_order` | ⛔ blocked | ordering medication requires the clinician, not the agent |
+| `record_delete` | ⛔ blocked | deleting records is never delegated |
+
+Every decision — allowed *and* blocked — is witnessed as a signed receipt on the
+append-only transparency log. A blocked call **never reaches the downstream
+tool** (proven by the tool's own call log), and the published evidence verifies
+to `ORIGIN AND INTEGRITY VERIFIED` against a pinned witness key.
+
+## Run it
+
+From a published install — no repository checkout required:
+
+```bash
+npx magenta-canon vertical healthcare-scribe
+```
+
+(Inside a repo checkout you can also use `npm run demo:vertical healthcare-scribe`.)
+
+It boots a local control plane, drives the calls above through the Magenta
+gateway, proves the blocked call was **absent** from the downstream tool's own
+log, publishes the evidence, and independently verifies it to
+`ORIGIN AND INTEGRITY VERIFIED`.
+
+**Limitation:** this is a local, single-host **demo** — an ephemeral control
+plane and a fresh universe in a temp dir, cleaned up on exit. It is not hosted
+SaaS, not multi-tenant, and not production durability.
+
+## Make it yours
+
+`gateway.config.json` here is the same artifact you would point a real MCP host
+(Claude Code / Cursor) at: swap the downstream for **your** real MCP tool server
+and set your own `grantedCapabilities`. Every tool call is then gated and
+witnessed exactly as shown above.

package/examples/verticals/healthcare-scribe/gateway.config.json

@@ -0,0 +1,26 @@
+{
+  "downstream": {
+    "command": "node",
+    "args": [
+      "../lib/tool-server.mjs",
+      "chart_read",
+      "note_draft",
+      "medication_order",
+      "record_delete"
+    ]
+  },
+  "controlPlane": {
+    "url": "http://127.0.0.1:5000",
+    "internalKey": "operator-secret-xyz"
+  },
+  "agent": {
+    "agentId": "mcp:acme-clinical-scribe",
+    "authorizedBy": "operator:cj@trendinghot",
+    "model": "mcp-gateway"
+  },
+  "grantedCapabilities": [
+    "mcp.call:chart_read",
+    "mcp.call:note_draft"
+  ],
+  "defaultAction": "agent.mcp.call"
+}

package/examples/verticals/healthcare-scribe/scenario.json

@@ -0,0 +1,48 @@
+{
+  "id": "healthcare-scribe",
+  "sector": "Healthcare",
+  "title": "Clinical scribe agent",
+  "model": "allowlist",
+  "story": "A clinical scribe may read the chart and draft a note, but may not order medication or delete records. Clinical authority stays with the clinician.",
+  "calls": [
+    {
+      "name": "chart_read",
+      "arguments": {
+        "patient": "p-1029"
+      },
+      "expect": "allow",
+      "note": "reading the chart is delegated"
+    },
+    {
+      "name": "note_draft",
+      "arguments": {
+        "patient": "p-1029",
+        "text": "Follow-up in 2 weeks."
+      },
+      "expect": "allow",
+      "note": "drafting a note is delegated"
+    },
+    {
+      "name": "medication_order",
+      "arguments": {
+        "patient": "p-1029",
+        "drug": "amoxicillin",
+        "dose": "500mg"
+      },
+      "expect": "block",
+      "note": "ordering medication requires the clinician, not the agent"
+    },
+    {
+      "name": "record_delete",
+      "arguments": {
+        "patient": "p-1029"
+      },
+      "expect": "block",
+      "note": "deleting records is never delegated"
+    }
+  ],
+  "groundTruthAbsent": [
+    "medication_order",
+    "record_delete"
+  ]
+}