mneme-ai 3.5.1 → 3.7.0

package/dist/commands/agentcert.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `mneme agentcert` (v3.7.0) — the Agent Run Certificate.
+ *   agentcert build [--run <id>] [--task "…"] [--agent "…"] --out cert.json   → a signed, self-contained certificate
+ *   agentcert verify <cert.json>                                              → verify OFFLINE (no Mneme, no vendor)
+ * The build embeds the run's evidence (MCP-gateway audit chain + human approvals) and NOTARY-signs
+ * the whole thing, so an insurer / auditor / customer verifies the entire governed run from ONE file.
+ */
+import type { Command } from "commander";
+export declare function registerAgentcertCommands(program: Command): void;
+//# sourceMappingURL=agentcert.d.ts.map

package/dist/commands/agentcert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentcert.d.ts","sourceRoot":"","sources":["../../src/commands/agentcert.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAoBzC,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA8ChE"}

package/dist/commands/agentcert.js

@@ -0,0 +1,100 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { agentcert, notary } from "@mneme-ai/core";
+function out(s) { process.stdout.write(s + "\n"); }
+function loadFrames(cwd, run) {
+    const p = join(cwd, ".mneme", "mcpgate", "audit.jsonl");
+    if (!existsSync(p))
+        return [];
+    const all = readFileSync(p, "utf8").trim().split("\n").filter(Boolean).map((l) => { try {
+        return JSON.parse(l);
+    }
+    catch {
+        return null;
+    } }).filter(Boolean);
+    return run ? all.filter((f) => f.run === run) : all;
+}
+function loadApprovals(cwd) {
+    try {
+        const st = JSON.parse(readFileSync(join(cwd, ".mneme", "pager", "state.json"), "utf8"));
+        return (st.receipts ?? []).filter((r) => r.decidedBy === "human").map((r) => ({ id: String(r.req?.id ?? ""), decision: (r.decision === "deny" ? "deny" : "allow"), by: "human", on: String(r.channel ?? "pager"), at: Number(r.at) || 0 }));
+    }
+    catch {
+        return [];
+    }
+}
+export function registerAgentcertCommands(program) {
+    const k = program.command("agentcert").description("🎖 AGENT RUN CERTIFICATE — one portable, offline-verifiable certificate per governed agent run (the audit chain + human approvals, NOTARY-signed). The piece a giant adopts + an insurer underwrites: no vendor can issue it for itself.");
+    k.command("build").description("Build + sign a certificate for a run (or the whole audit ledger).")
+        .option("--run <id>", "only this run's audit frames (default: all)").option("--task <t>", "the run's task").option("--agent <a>", "agent/vendor name").option("--model <m>", "model id")
+        .option("--out <file>", "write the signed certificate").option("--json", "print the signed certificate JSON")
+        .action((o) => {
+        const cwd = process.cwd();
+        const auditFrames = loadFrames(cwd, o.run);
+        if (!auditFrames.length) {
+            out(`✗ no audit frames${o.run ? ` for run ${o.run}` : ""} — run some gated tool-calls first (mneme mcpgate / gephyra serve / matrix).`);
+            process.exitCode = 2;
+            return;
+        }
+        const approvals = loadApprovals(cwd);
+        const ev = {
+            runId: o.run || auditFrames[0].run || "all", agent: o.agent || auditFrames[0].agent || "agent", model: o.model, task: o.task,
+            startedAt: auditFrames[0].ts, endedAt: auditFrames[auditFrames.length - 1].ts, auditFrames, approvals,
+        };
+        const cert = agentcert.buildCertificate(ev);
+        // self-contained, portable: embed the evidence + sign the whole thing for offline verify
+        const payload = { cert, evidence: ev };
+        let signed = payload;
+        try {
+            signed = notary.issueReceipt(cwd, { kind: "reasoning-trace", subject: `agent-run-cert:${cert.runId}`, payload, includePayload: true, issuedAt: Date.now() });
+        }
+        catch { /* */ }
+        if (o.out)
+            writeFileSync(o.out, JSON.stringify(signed, null, 2), "utf8");
+        if (o.json) {
+            out(JSON.stringify(signed, null, 2));
+            return;
+        }
+        const s = cert.summary;
+        const ico = s.insurability === "insurable" ? "🟢" : s.insurability === "review" ? "🟡" : "🔴";
+        out(`🎖 AGENT RUN CERTIFICATE — ${cert.agent}${cert.task ? ` · "${cert.task}"` : ""} · ${ico} ${s.insurability.toUpperCase()}`);
+        out(`   ${s.calls} gated call(s): ${s.allowed} allowed · ${s.blocked} blocked · ${s.needsApproval} escalated · ${s.humanApprovals + s.humanDenials} human decision(s)`);
+        out(`   policy-compliant: ${s.policyCompliant ? "yes" : "NO"} · audit chain: ${s.auditChainOk ? "intact" : "BROKEN"} · max risk ${s.riskMax}`);
+        out(`   evidence sha256 ${cert.evidenceHash.slice(0, 16)}…${o.out ? ` · 🎖 signed → ${o.out}` : ""} (verify offline: mneme agentcert verify)`);
+    });
+    k.command("verify <file>").description("Verify a certificate OFFLINE — the signature, the embedded audit chain, and that the summary RE-DERIVES from the evidence (the cert cannot lie about its run).")
+        .action((file) => {
+        if (!existsSync(file)) {
+            out("certificate not found");
+            process.exitCode = 2;
+            return;
+        }
+        let signed;
+        try {
+            signed = JSON.parse(readFileSync(file, "utf8"));
+        }
+        catch {
+            out("✗ invalid certificate JSON");
+            process.exitCode = 2;
+            return;
+        }
+        const sig = notary.verifyReceipt(signed);
+        out(sig.valid ? "✓ signature VALID (Ed25519, offline — proves who issued it)" : `✗ signature INVALID: ${sig.reason}`);
+        const cert = signed.payload?.cert, evidence = signed.payload?.evidence;
+        if (!cert || !evidence) {
+            out("✗ certificate has no embedded cert/evidence");
+            process.exitCode = 2;
+            return;
+        }
+        const v = agentcert.verifyCertificate(cert, evidence);
+        out(v.valid ? "✓ run VERIFIED — " + v.reasons[0] : "✗ run NOT verified:");
+        if (!v.valid)
+            for (const r of v.reasons)
+                out("   • " + r);
+        const s = cert.summary;
+        out(`   → ${cert.agent}${cert.task ? ` · "${cert.task}"` : ""}: ${s.calls} gated calls · ${s.blocked} blocked · insurability ${s.insurability}`);
+        if (!sig.valid || !v.valid)
+            process.exitCode = 2;
+    });
+}
+//# sourceMappingURL=agentcert.js.map

package/dist/commands/agentcert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentcert.js","sourceRoot":"","sources":["../../src/commands/agentcert.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAEnD,SAAS,GAAG,CAAC,CAAS,IAAU,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AAEjE,SAAS,UAAU,CAAC,GAAW,EAAE,GAAY;IAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAyC,CAAC;IACpM,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACtD,CAAC;AACD,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAA0H,CAAC;QACjN,OAAO,CAAC,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAqB,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAClQ,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,0OAA0O,CAAC,CAAC;IAE/R,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,mEAAmE,CAAC;SAChG,MAAM,CAAC,YAAY,EAAE,6CAA6C,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC;SACvL,MAAM,CAAC,cAAc,EAAE,8BAA8B,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,mCAAmC,CAAC;SAC5G,MAAM,CAAC,CAAC,CAAgG,EAAE,EAAE;QAC3G,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,8EAA8E,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACnM,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,EAAE,GAA0B;YAChC,KAAK,EAAE,CAAC,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;YAC5H,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,SAAS;SACtG,CAAC;QACF,MAAM,IAAI,GAAG,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,yFAAyF;QACzF,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,GAAY,OAAO,CAAC;QAC9B,IAAI,CAAC;YAAC,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;QACrL,IAAI,CAAC,CAAC,GAAG;YAAE,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACvB,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9F,GAAG,CAAC,8BAA8B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAChI,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,mBAAmB,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,aAAa,gBAAgB,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,YAAY,oBAAoB,CAAC,CAAC;QACxK,GAAG,CAAC,wBAAwB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/I,GAAG,CAAC,sBAAsB,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,2CAA2C,CAAC,CAAC;IACjJ,CAAC,CAAC,CAAC;IAEL,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,WAAW,CAAC,gKAAgK,CAAC;SACrM,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;QACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACtF,IAAI,MAAgG,CAAC;QACrG,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACnI,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,6DAA6D,CAAC,CAAC,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACtH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC;QACvE,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7G,MAAM,CAAC,GAAG,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtD,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;QAC1E,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO;gBAAE,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACvB,GAAG,CAAC,QAAQ,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAC,OAAO,2BAA2B,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;QACjJ,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/mcpgate.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `mneme mcpgate` (v3.6.0) — the local-first MCP gateway surface.
+ *   mcpgate decide --tool <t> [--args '<json>'] [--agent a]   → ALLOW / NEEDS-APPROVAL / BLOCK
+ *   mcpgate audit [--verify]                                   → the signed, offline-verifiable call ledger
+ * Every call through `gephyra serve` (HTTP MCP-proxy) and the matrix gRPC rail is gated + audited
+ * automatically; this CLI is for manual decisions + verifying the audit chain.
+ */
+import type { Command } from "commander";
+export declare function registerMcpgateCommands(program: Command): void;
+//# sourceMappingURL=mcpgate.d.ts.map

package/dist/commands/mcpgate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpgate.d.ts","sourceRoot":"","sources":["../../src/commands/mcpgate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOzC,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmC9D"}

package/dist/commands/mcpgate.js

@@ -0,0 +1,77 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { mcpgate, notary } from "@mneme-ai/core";
+function out(s) { process.stdout.write(s + "\n"); }
+export function registerMcpgateCommands(program) {
+    const k = program.command("mcpgate").description("🛂 MCP GATEWAY — gate every agent tool-call (policy + behavioral risk + skill provenance → allow / needs-approval / block) and keep a SIGNED, offline-verifiable audit ledger. Local-first; the runtime perimeter a cloud gateway can't be.");
+    k.command("decide").description("Gate one tool-call.")
+        .requiredOption("--tool <t>", "tool name").option("--args <json>", "args JSON", "{}").option("--agent <a>", "agent id", "agent").option("--json", "emit JSON")
+        .action((o) => {
+        let args = {};
+        try {
+            args = JSON.parse(o.args ?? "{}");
+        }
+        catch { /* */ }
+        const cwd = process.cwd();
+        let policy = {};
+        try {
+            const pp = join(cwd, ".mneme", "mcpgate", "policy.json");
+            if (existsSync(pp))
+                policy = JSON.parse(readFileSync(pp, "utf8"));
+        }
+        catch { /* */ }
+        const v = mcpgate.gateCall({ tool: o.tool, agent: o.agent, args }, policy);
+        if (o.json) {
+            out(JSON.stringify(v, null, 2));
+            if (v.decision === "block")
+                process.exitCode = 2;
+            return;
+        }
+        const icon = v.decision === "block" ? "🔴" : v.decision === "needs-approval" ? "🟡" : "🟢";
+        out(`🛂 ${icon} ${v.decision.toUpperCase()} · ${o.tool} · risk ${v.risk} · args ${v.argsHash.slice(0, 12)}…`);
+        for (const r of v.reasons)
+            out(`   • ${r}`);
+        if (v.decision === "needs-approval")
+            out("   → route to the human: mneme pager request");
+        if (v.decision === "block")
+            process.exitCode = 2;
+    });
+    k.command("audit").description("Show + verify the call audit ledger (.mneme/mcpgate/audit.jsonl).")
+        .option("--verify", "verify the hash-chain + the NOTARY-signed head OFFLINE").option("--tail <n>", "show the last N frames", "10")
+        .action((o) => {
+        const dir = join(process.cwd(), ".mneme", "mcpgate");
+        const ledger = join(dir, "audit.jsonl");
+        if (!existsSync(ledger)) {
+            out("no audit ledger yet (no gated calls)");
+            return;
+        }
+        const frames = readFileSync(ledger, "utf8").trim().split("\n").filter(Boolean).map((l) => { try {
+            return JSON.parse(l);
+        }
+        catch {
+            return null;
+        } }).filter(Boolean);
+        const tail = Math.max(1, parseInt(o.tail ?? "10", 10));
+        out(`🛂 MCP gateway audit — ${frames.length} call(s)`);
+        for (const f of frames.slice(-tail))
+            out(`   #${f.seq} ${f.decision === "block" ? "🔴" : f.decision === "needs-approval" ? "🟡" : "🟢"} ${f.tool} · ${f.agent} · risk ${f.risk} · args ${f.argsHash.slice(0, 10)}…`);
+        if (o.verify) {
+            const chain = mcpgate.verifyAuditChain(frames);
+            out(chain.ok ? `   ✓ chain VERIFIED — ${chain.frames} frames intact (offline, tamper-evident)` : `   ✗ chain BROKEN at #${chain.brokenAt}: ${chain.reason}`);
+            const headPath = join(dir, "audit.head.json");
+            if (existsSync(headPath)) {
+                try {
+                    const rec = JSON.parse(readFileSync(headPath, "utf8"));
+                    const v = notary.verifyReceipt(rec);
+                    const head = rec.payload?.frameId;
+                    const last = frames[frames.length - 1]?.frameId;
+                    out(v.valid ? `   ✓ signed head VALID (Ed25519, offline)${head === last ? " · points at the current tip" : " · ⚠ tip moved"}` : `   ✗ signed head INVALID: ${v.reason}`);
+                }
+                catch { /* */ }
+            }
+            if (!chain.ok)
+                process.exitCode = 2;
+        }
+    });
+}
+//# sourceMappingURL=mcpgate.js.map

package/dist/commands/mcpgate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpgate.js","sourceRoot":"","sources":["../../src/commands/mcpgate.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAEjD,SAAS,GAAG,CAAC,CAAS,IAAU,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AAEjE,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,6OAA6O,CAAC,CAAC;IAEhS,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,qBAAqB,CAAC;SACnD,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC;SAC7J,MAAM,CAAC,CAAC,CAAkE,EAAE,EAAE;QAC7E,IAAI,IAAI,GAAY,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;QAClF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,MAAM,GAAG,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YAAC,IAAI,UAAU,CAAC,EAAE,CAAC;gBAAE,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;QACrK,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;gBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC1G,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3F,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAC9G,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO;YAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC,QAAQ,KAAK,gBAAgB;YAAE,GAAG,CAAC,8CAA8C,CAAC,CAAC;QACzF,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEL,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,mEAAmE,CAAC;SAChG,MAAM,CAAC,UAAU,EAAE,wDAAwD,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,wBAAwB,EAAE,IAAI,CAAC;SACjI,MAAM,CAAC,CAAC,CAAsC,EAAE,EAAE;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAAC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAC9F,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACjF,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAyB,CAAC;QAC5L,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACvD,GAAG,CAAC,0BAA0B,MAAM,CAAC,MAAM,UAAU,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACrN,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC/C,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,yBAAyB,KAAK,CAAC,MAAM,0CAA0C,CAAC,CAAC,CAAC,yBAAyB,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7J,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAC9C,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC;oBAAC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;oBAAC,MAAM,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;oBAAC,MAAM,IAAI,GAAI,GAAG,CAAC,OAAgC,EAAE,OAAO,CAAC;oBAAC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC;oBAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,4CAA4C,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YAC1a,IAAI,CAAC,KAAK,CAAC,EAAE;gBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA6LA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA6lNvD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA+LA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA+lNvD"}

package/dist/index.js

@@ -107,6 +107,8 @@ import { registerPagerCommands } from "./commands/pager.js";
 import { registerKeryxCommands } from "./commands/keryx.js";
 import { registerCompileCommands } from "./commands/compile.js";
 import { registerSkillscanCommands } from "./commands/skillscan.js";
+import { registerMcpgateCommands } from "./commands/mcpgate.js";
+import { registerAgentcertCommands } from "./commands/agentcert.js";
 import { registerAdamasCommands } from "./commands/adamas.js";
 import { registerPrismCommands } from "./commands/prism.js";
 import { registerGoldilocksCommands } from "./commands/goldilocks.js";
@@ -4781,6 +4783,8 @@ export async function run(argv) {
     registerKeryxCommands(program);
     registerCompileCommands(program);
     registerSkillscanCommands(program);
+    registerMcpgateCommands(program);
+    registerAgentcertCommands(program);
     registerAdamasCommands(program);
     registerPrismCommands(program);
     registerGoldilocksCommands(program);