mindforge-cc 10.7.0 → 11.2.0

package/bin/governance/audit-verifier.js

@@ -0,0 +1,60 @@
+'use strict';
+/**
+ * MindForge — Audit chain verifier (UC-04). Fail-closed: any break => valid:false.
+ *
+ * Walks the JSONL audit log line-by-line and re-derives each entry's hash from its
+ * content plus the prior entry's hash. The chain is valid only if EVERY link holds:
+ *   1. entry.previous_hash matches the running previousHash (null for the first entry)
+ *   2. entry._hash equals sha256({...entry-without-_hash, previous_hash})
+ *
+ * CRITICAL INVARIANT: hashEntry() here MUST produce byte-identical material to the
+ * writer (bin/autonomous/audit-writer.js). The writer hashes {...e, previous_hash}
+ * where `e` has no `_hash`. The stored entry is {...e, previous_hash, _hash}; stripping
+ * `_hash` via destructuring yields {...e, previous_hash} with the SAME key insertion
+ * order, so {...rest, previous_hash} reproduces the writer's material exactly.
+ */
+const fs = require('fs');
+const { hashAuditEntry } = require('./audit-hash');
+
+/**
+ * Re-derives an entry's chained hash. Excludes `_hash` from the material by
+ * stripping it, then delegating to the canonical {@link hashAuditEntry} so the
+ * writer and verifier share ONE hasher (no material drift possible).
+ * @param {object} entry — stored entry (may include `_hash`, which is stripped)
+ * @param {string|null} previousHash — prior entry's `_hash` (null for the first link)
+ * @returns {string} hex-encoded SHA-256 digest
+ */
+function hashEntry(entry, previousHash) {
+  const { _hash, ...rest } = entry; // exclude _hash from material
+  return hashAuditEntry(rest, previousHash);
+}
+
+/**
+ * Verifies the integrity of a hash-chained audit log. Fail-closed.
+ * @param {string} auditPath — path to the AUDIT.jsonl file
+ * @returns {{ valid: boolean, count: number, brokenAt?: number, reason?: string }}
+ */
+function verifyAuditChain(auditPath) {
+  let lines;
+  try { lines = fs.readFileSync(auditPath, 'utf8').split('\n').filter(Boolean); }
+  catch (e) { return { valid: false, count: 0, brokenAt: 0, reason: `unreadable: ${e.message}` }; }
+
+  let previousHash = null;
+  for (let i = 0; i < lines.length; i++) {
+    let entry;
+    try { entry = JSON.parse(lines[i]); }
+    catch { return { valid: false, count: lines.length, brokenAt: i, reason: 'unparseable line' }; }
+
+    if (entry.previous_hash !== previousHash) {
+      return { valid: false, count: lines.length, brokenAt: i, reason: 'previous_hash mismatch' };
+    }
+    const expected = hashEntry(entry, previousHash);
+    if (entry._hash !== expected) {
+      return { valid: false, count: lines.length, brokenAt: i, reason: 'hash mismatch (entry mutated)' };
+    }
+    previousHash = entry._hash;
+  }
+  return { valid: true, count: lines.length };
+}
+
+module.exports = { verifyAuditChain };

package/bin/governance/impact-analyzer.js

@@ -137,6 +137,34 @@ class ImpactAnalyzer {
   static resetSession(sessionId) {
     this.sessionState.delete(sessionId);
   }
+
+  /**
+   * Returns the current entropy count for a session without incrementing.
+   * Useful for diagnostics and monitoring.
+   */
+  static getSessionEntropy(sessionId) {
+    return this.sessionState.get(sessionId) || 0;
+  }
+
+  /**
+   * Clears all session state entries. Use during process cleanup or testing.
+   */
+  static clearAllSessions() {
+    this.sessionState.clear();
+  }
+
+  /**
+   * Clears sessions that have exceeded a given entropy threshold.
+   * Prevents unbounded memory growth from abandoned sessions.
+   * @param {number} maxEntropy - Sessions above this count are purged.
+   */
+  static clearStaleSessions(maxEntropy = 50) {
+    for (const [sessionId, count] of this.sessionState.entries()) {
+      if (count > maxEntropy) {
+        this.sessionState.delete(sessionId);
+      }
+    }
+  }
 }
 
 module.exports = ImpactAnalyzer;

package/bin/governance/policy-engine.js

@@ -95,14 +95,21 @@ class PolicyEngine {
           // [ENTERPRISE] Tier 3 Reasoning/PQ Proof Bypass
           if (intent.tier >= 3 && (intent.reasoning_proof || intent.pq_proof)) {
              const quantumCrypto = require('./quantum-crypto');
-             const isProofValid = intent.pq_proof ? 
-                quantumCrypto.verifyZKProof(intent.pq_proof, intent.id) : true;
+             let isProofValid = true;
+
+             if (intent.pq_proof) {
+               const zkResult = quantumCrypto.verifyZKProof(intent.pq_proof, intent.id);
+               isProofValid = zkResult.verified === true;
+               if (!isProofValid) {
+                 console.log(`[APO-ZK] [${requestId}] ZK proof denied: ${zkResult.reason}${zkResult.simulated ? ' (simulated)' : ''}`);
+               }
+             }
 
              if (isProofValid) {
                 console.log(`[APO-BYPASS] [${requestId}] Tier 3 'Sovereign Proof' verified (${intent.pq_proof ? 'ZK-PQ' : 'Standard'}). Overriding Blast Radius limit.`);
                 // Continue to permit check
              } else {
-                verdict = { verdict: 'DENY', reason: 'Invalid or Malformed ZK-Proof detected.', requestId };
+                verdict = { verdict: 'DENY', reason: 'ZK proof verification failed. Configure a verifier module or provide a valid proof.', requestId };
                 this.logAudit(intent, impactScore, verdict);
                 return verdict;
              }

package/bin/governance/quantum-crypto.js

@@ -1,26 +1,68 @@
 /**
  * MindForge v7 — Post-Quantum Agentic Security (PQAS)
  * Simulated Lattice-Based Cryptography (Dilithium-5 / Kyber-1024)
+ *
+ * @typedef {Object} ZKVerifierProvider
+ * @property {(proof: string, intentId: string) => {verified: boolean, reason?: string}} verify
  */
 'use strict';
 
 const crypto = require('node:crypto');
 const configManager = require('./config-manager');
 
+/**
+ * Honest-disclosure guard message. The signatures produced by this module are
+ * SIMULATED Dilithium-5 (base64(SHA3 + random) — NOT real ML-DSA/FIPS-204
+ * lattice crypto). They must NEVER sit on the live trust path silently. The
+ * simulated implementation is preserved for demonstration only and is gated
+ * behind an explicit, opt-in flag.
+ */
+const PQC_DEMO_DISABLED_MSG =
+  'PQC demo disabled — set experimental.pqc_demo=true to use simulated lattice crypto (NOT for production trust)';
+
 class QuantumCrypto {
   constructor() {
     this.providerId = configManager.get('security.provider', 'simulated-lattice');
-    this.pqasEnabled = configManager.get('security.pqas_enabled', true);
+    // UC-24: simulated PQC is OFF the live trust path by default. Real PQC has
+    // not shipped. The simulated path is gated SOLELY behind the explicit
+    // experimental.pqc_demo opt-in (read fresh via isPqcDemoEnabled), so there
+    // is exactly one switch controlling the simulated minter. The legacy
+    // security.pqas_enabled flag is retained for provider metadata only and
+    // MUST NOT independently gate minting (see getProvider).
+    this.pqasEnabled = configManager.get('security.pqas_enabled', false);
+  }
+
+  /**
+   * Returns true only when the operator has explicitly opted into the SIMULATED
+   * post-quantum demo. Read fresh from config so a runtime toggle is honored.
+   * @returns {boolean}
+   */
+  isPqcDemoEnabled() {
+    return configManager.get('experimental.pqc_demo', false) === true;
+  }
+
+  /**
+   * Hard gate: throws unless the operator has explicitly enabled the simulated
+   * PQC demo. Prevents simulated (false-assurance) signatures from silently
+   * landing on the live trust path.
+   */
+  _assertPqcDemoEnabled() {
+    if (!this.isPqcDemoEnabled()) {
+      throw new Error(PQC_DEMO_DISABLED_MSG);
+    }
   }
 
   /**
    * Returns the current active crypto provider.
    */
   getProvider() {
-    // In v7, this would resolve to a real provider like 'oqs-provider.js'
+    // In v7, this would resolve to a real provider like 'oqs-provider.js'.
+    // Read pqas_enabled FRESH from config (not the constructor cache) for
+    // symmetry with the demo gate. This is metadata only — it does NOT gate
+    // minting; experimental.pqc_demo is the single source of truth for that.
     return {
       id: this.providerId,
-      pqas_enabled: this.pqasEnabled,
+      pqas_enabled: configManager.get('security.pqas_enabled', false),
       algorithm: 'Dilithium-5'
     };
   }
@@ -29,7 +71,10 @@ class QuantumCrypto {
    * Generates a key pair using the configured PQ provider.
    */
   async generateLatticeKeyPair() {
-    if (!this.pqasEnabled) throw new Error('PQAS is disabled in configuration.');
+    // UC-24: simulated keys are demo-only. The SINGLE gate is the fresh-read
+    // experimental.pqc_demo flag — enabling it is sufficient to mint, and
+    // disabling it fails closed. security.pqas_enabled does NOT gate this.
+    this._assertPqcDemoEnabled();
 
     // Simulate high-entropy lattice seeds
     const seed = crypto.randomBytes(64).toString('hex');
@@ -47,21 +92,27 @@ class QuantumCrypto {
 
   /**
    * Signs data using simulated Dilithium-5.
+   * @returns {{ signature: string, simulated: true, algorithm: string }}
    */
   async signPQ(data, privateKey) {
-    if (!this.pqasEnabled) throw new Error('PQAS is disabled.');
+    // UC-24: never produce a simulated (false-assurance) signature on the live
+    // trust path. The SINGLE gate is the fresh-read experimental.pqc_demo flag
+    // (same flag _selectProvider routes on) — security.pqas_enabled does NOT
+    // independently block signing.
+    this._assertPqcDemoEnabled();
     if (!privateKey.startsWith('mfq7_dilithium5_priv_')) {
       throw new Error('Invalid Post-Quantum private key format.');
     }
 
-    // Simulate the lattice-based signature overhead
     const hash = crypto.createHash('sha3-512').update(data).digest('hex');
     const salt = crypto.randomBytes(16).toString('hex');
-    
-    // Dilithium signatures are significantly larger than Ed25519
-    const simulatedSignature = `pqas_sig_d5_${Buffer.from(hash + salt).toString('base64')}_${crypto.randomBytes(128).toString('base64')}`;
-    
-    return simulatedSignature;
+    const signature = `pqas_sig_d5_${Buffer.from(hash + salt).toString('base64')}_${crypto.randomBytes(128).toString('base64')}`;
+
+    return {
+      signature,
+      simulated: true,
+      algorithm: 'Dilithium-5'
+    };
   }
 
   /**
@@ -69,10 +120,11 @@ class QuantumCrypto {
    */
   verifyPQ(data, signature, publicKey) {
     if (!publicKey.startsWith('mfq7_dilithium5_pub_')) return false;
-    if (!signature.startsWith('pqas_sig_d5_')) return false;
+    const sig = typeof signature === 'object' && signature.signature ? signature.signature : signature;
+    if (!sig.startsWith('pqas_sig_d5_')) return false;
 
     try {
-      const parts = signature.split('_');
+      const parts = sig.split('_');
       const blob = Buffer.from(parts[3], 'base64').toString('utf8');
       const hashInSig = blob.slice(0, 128); 
       
@@ -86,33 +138,48 @@ class QuantumCrypto {
   }
 
   /**
-   * Generates a simulated ZK-Proof of policy adherence.
-   * This mimics a SNARK where the agent proves it ran the PolicyEngine rules.
+   * Generates a SIMULATED ZK-Proof of policy adherence.
+   * This mimics a SNARK where the agent proves it ran the PolicyEngine rules,
+   * but it is NOT a real zero-knowledge proof. The returned token is explicitly
+   * stamped with a `sim` marker (zkp_v1_sim_...) so downstream code and audit
+   * logs can never mistake it for a real SNARK. It remains inert by default —
+   * verifyZKProof DENYs unless an external verifier module is configured.
+   * @returns {string} A simulated ZK-proof token prefixed `zkp_v1_sim_`.
    */
   generateZKProof(intent, result) {
     const proofPayload = JSON.stringify({
       intent: intent.id,
       verdict: result.verdict,
       timestamp: Date.now(),
-      entropy: crypto.randomBytes(16).toString('hex')
+      entropy: crypto.randomBytes(16).toString('hex'),
+      simulated: true
     });
 
     const hash = crypto.createHash('sha256').update(proofPayload).digest('hex');
-    return `zkp_v1_${hash}_${crypto.randomBytes(32).toString('base64')}`;
+    // `sim` marker is embedded AFTER the `zkp_v1_` prefix so the existing
+    // format check (startsWith 'zkp_v1_') and any external verifier still work.
+    return `zkp_v1_sim_${hash}_${crypto.randomBytes(32).toString('base64')}`;
   }
 
   verifyZKProof(proof, intentId) {
-    if (!proof.startsWith('zkp_v1_')) return false;
-    // SECURITY: Real ZK verification is not yet implemented.
-    // Governance gate MUST block by default — fail-closed.
-    console.warn(
-      `[SECURITY][quantum-crypto] verifyZKProof is a STUB — real ZK verification not yet implemented. ` +
-      `Blocking proof for intent="${intentId}". All governance checks will fail until a real verifier is integrated.`
-    );
-    throw new Error(
-      'ZK proof verification is not implemented. Governance gate denies by default. ' +
-      'Integrate a real ZK verifier (e.g., snarkjs/circom) before enabling this path.'
-    );
+    if (!proof || !proof.startsWith('zkp_v1_')) {
+      return { verified: false, reason: 'invalid_proof_format' };
+    }
+
+    try {
+      const verifierModule = configManager.get('security.zk_verifier_module');
+      if (verifierModule) {
+        const verifier = require(verifierModule);
+        return verifier.verify(proof, intentId);
+      }
+    } catch (e) { /* no external verifier configured */ }
+
+    return {
+      verified: false,
+      reason: 'no_verifier_configured',
+      simulated: true,
+      message: 'ZK proof verification requires an external verifier module (e.g., snarkjs/circom). Configure via security.zk_verifier_module in config.json.'
+    };
   }
 }
 

package/bin/governance/rbac-manager.js

@@ -18,6 +18,7 @@ class RBACManager {
       'did:mindforge:researcher': ['knowledge-detective'],
       'did:mindforge:tool': ['system-operator']
     };
+    this.temporaryElevations = new Map(); // key: `${did}:${role}`, value: { timer, expiresAt }
   }
 
   /**
@@ -84,10 +85,72 @@ class RBACManager {
     fs.writeFileSync(this.rolesPath, JSON.stringify(current, null, 2));
   }
 
+  /**
+   * Temporarily elevates an agent to a role for a limited duration.
+   * The elevation auto-expires after ttlMs milliseconds.
+   * @param {string} did - Agent DID
+   * @param {string} role - Role to temporarily grant
+   * @param {number} ttlMs - Time-to-live in milliseconds (default: 1 hour)
+   */
+  elevateRole(did, role, ttlMs = 3600000) {
+    const key = `${did}:${role}`;
+
+    // Clear existing elevation if any
+    if (this.temporaryElevations.has(key)) {
+      clearTimeout(this.temporaryElevations.get(key).timer);
+    }
+
+    const timer = setTimeout(() => {
+      this.temporaryElevations.delete(key);
+    }, ttlMs);
+
+    // Prevent timer from keeping process alive
+    if (timer.unref) timer.unref();
+
+    this.temporaryElevations.set(key, {
+      timer,
+      expiresAt: Date.now() + ttlMs
+    });
+
+    return { did, role, expiresAt: Date.now() + ttlMs };
+  }
+
+  /**
+   * Checks if an agent currently has a temporary role elevation.
+   * @param {string} did - Agent DID
+   * @param {string} role - Role to check
+   */
+  hasTemporaryElevation(did, role) {
+    const key = `${did}:${role}`;
+    const elevation = this.temporaryElevations.get(key);
+    if (!elevation) return false;
+    if (Date.now() > elevation.expiresAt) {
+      clearTimeout(elevation.timer);
+      this.temporaryElevations.delete(key);
+      return false;
+    }
+    return true;
+  }
+
+  /**
+   * Revokes a temporary elevation before its TTL expires.
+   * @param {string} did - Agent DID
+   * @param {string} role - Role to revoke
+   */
+  revokeElevation(did, role) {
+    const key = `${did}:${role}`;
+    const elevation = this.temporaryElevations.get(key);
+    if (elevation) {
+      clearTimeout(elevation.timer);
+      this.temporaryElevations.delete(key);
+    }
+  }
+
   /**
    * Checks if an agent has a specific permission based on their roles.
-   * @param {string} did 
-   * @param {string} permission 
+   * Also checks temporary elevations.
+   * @param {string} did
+   * @param {string} permission
    */
   hasPermission(did, permission) {
     const roles = this.getRoles(did);
@@ -99,9 +162,18 @@ class RBACManager {
       'guest-agent':     ['read_src']
     };
 
+    // Check static roles first
     for (const role of roles) {
       if (PERMISSION_MAP[role]?.includes(permission)) return true;
     }
+
+    // Check temporary elevations
+    for (const [role, permissions] of Object.entries(PERMISSION_MAP)) {
+      if (permissions.includes(permission) && this.hasTemporaryElevation(did, role)) {
+        return true;
+      }
+    }
+
     return false;
   }
 }

package/bin/governance/ztai-manager.js

@@ -5,6 +5,7 @@
 
 const crypto = require('node:crypto');
 const { promisify } = require('node:util');
+const configManager = require('./config-manager');
 
 const generateKeyPair = promisify(crypto.generateKeyPair);
 
@@ -122,9 +123,10 @@ class QuantumSafeKeyProvider extends KeyProvider {
   async sign(did, data) {
     const record = this.keyStore.get(did);
     if (!record) throw new Error(`PQ record not found for ${did}`);
-    
+
     console.log(`[PQAS-DILITHIUM] Delegating signature to lattice enclave [DID: ${did}]`);
-    return await this.quantumCrypto.signPQ(data, record.privateKey);
+    const result = await this.quantumCrypto.signPQ(data, record.privateKey);
+    return result;
   }
 
   async rotate(did) {
@@ -146,26 +148,63 @@ class ZTAIManager {
     };
   }
 
+  /**
+   * Selects a key provider for a given trust tier.
+   *
+   * UC-24: All tiers route to REAL crypto by default — Tier 1-2 use the
+   * in-memory Ed25519 provider, Tier 3+ use the (simulated-HSM) enclave
+   * provider which also signs with REAL Ed25519. The SIMULATED post-quantum
+   * lattice provider ('quantum') is NEVER selected on the live trust path
+   * unless the operator has explicitly opted into the demo via
+   * experimental.pqc_demo. This keeps false-assurance signatures off the
+   * default trust path while preserving the demo for explicit exploration.
+   *
+   * @param {number} tier - Trust tier (1-4)
+   * @returns {'local'|'enclave'|'quantum'}
+   */
+  _selectProvider(tier) {
+    const pqcDemo = configManager.get('experimental.pqc_demo', false) === true;
+
+    // Tier 4+ MAY use the simulated lattice provider, but only when the
+    // operator has explicitly enabled the PQC demo. Otherwise it falls back to
+    // the real-Ed25519 enclave provider so the trust path stays verifiable.
+    if (tier >= 4) {
+      return pqcDemo ? 'quantum' : 'enclave';
+    }
+
+    // Tier 3 agents use the SecureEnclaveProvider (real Ed25519).
+    return tier >= 3 ? 'enclave' : 'local';
+  }
+
   /**
    * Registers a new agent and assigns a provider based on Trust Tier.
+   * @param {string} persona - Agent persona identifier
+   * @param {number} tier - Trust tier (1-4)
+   * @param {string|null} sessionId - Optional session scope for isolation
    */
-  async registerAgent(persona, tier = 1) {
+  async registerAgent(persona, tier = 1, sessionId = null) {
     const uuid = crypto.randomUUID();
     const did = `did:mindforge:${uuid}`;
-    
-    // Tier 3 agents use the SecureEnclaveProvider
-    const providerType = tier >= 3 ? 'enclave' : 'local';
+
+    const providerType = this._selectProvider(tier);
     const provider = this.providers[providerType];
-    
+
     const publicKeyPEM = await provider.generate(did);
 
-    this.agentRegistry.set(did, {
+    const agentData = {
       publicKey: publicKeyPEM,
       persona,
       tier,
       providerType,
       createdAt: new Date().toISOString()
-    });
+    };
+
+    // Store sessionId if provided for session-scoped isolation
+    if (sessionId) {
+      agentData.sessionId = sessionId;
+    }
+
+    this.agentRegistry.set(did, agentData);
 
     return did;
   }
@@ -219,6 +258,37 @@ class ZTAIManager {
     return this.agentRegistry.get(did);
   }
 
+  /**
+   * Returns all agents registered under a specific session.
+   * @param {string} sessionId - Session identifier to filter by
+   */
+  getSessionAgents(sessionId) {
+    const results = [];
+    for (const [did, agent] of this.agentRegistry.entries()) {
+      if (agent.sessionId === sessionId) {
+        results.push({ did, ...agent });
+      }
+    }
+    return results;
+  }
+
+  /**
+   * Revokes all agents belonging to a session. Used for session cleanup.
+   * @param {string} sessionId - Session identifier
+   */
+  revokeSessionAgents(sessionId) {
+    const dids = [];
+    for (const [did, agent] of this.agentRegistry.entries()) {
+      if (agent.sessionId === sessionId) {
+        dids.push(did);
+      }
+    }
+    for (const did of dids) {
+      this.revokeAgent(did);
+    }
+    return dids;
+  }
+
   /**
    * Specialized signing for FinOps budget decisions (Pillar V).
    */

package/bin/hindsight-injector.js

@@ -21,17 +21,16 @@ class HindsightInjector {
       // 1. Rollback .planning directory
       TemporalHub.rollbackTo(auditId);
 
-      // 2. Append the "Hindsight" event to AUDIT.jsonl
+      // 2. Append the "Hindsight" event to AUDIT.jsonl via the unified, hash-chained,
+      //    durable append (UC-04b) so this entry links into the single verifiable chain.
+      const { appendAuditEntrySync } = require('./autonomous/audit-writer');
       const auditPath = path.join(process.cwd(), '.planning', 'AUDIT.jsonl');
-      const hindsightEvent = {
-        id:          require('crypto').randomBytes(8).toString('hex'),
-        timestamp:   new Date().toISOString(),
+      const hindsightEvent = appendAuditEntrySync(auditPath, {
         event:       'hindsight_injected',
         target_id:   auditId,
         description: fixDescription,
         agent:       'temporal-hub'
-      };
-      fs.appendFileSync(auditPath, JSON.stringify(hindsightEvent) + '\n');
+      });
 
       // 3. Mark the state as "ready_for_regeneration"
       const statePath = path.join(process.cwd(), '.planning', 'auto-state.json');
@@ -43,9 +42,9 @@ class HindsightInjector {
       }
 
       // 4. Capture the new state immediately
-      TemporalHub.captureState(hindsightEvent.id, { 
-        event: 'hindsight_injected', 
-        target_id: auditId 
+      await TemporalHub.captureState(hindsightEvent.id, {
+        event: 'hindsight_injected',
+        target_id: auditId
       });
 
       return { success: true, event: hindsightEvent };