mneme-ai 3.6.0 → 3.7.0

package/dist/commands/agentcert.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `mneme agentcert` (v3.7.0) — the Agent Run Certificate.
+ *   agentcert build [--run <id>] [--task "…"] [--agent "…"] --out cert.json   → a signed, self-contained certificate
+ *   agentcert verify <cert.json>                                              → verify OFFLINE (no Mneme, no vendor)
+ * The build embeds the run's evidence (MCP-gateway audit chain + human approvals) and NOTARY-signs
+ * the whole thing, so an insurer / auditor / customer verifies the entire governed run from ONE file.
+ */
+import type { Command } from "commander";
+export declare function registerAgentcertCommands(program: Command): void;
+//# sourceMappingURL=agentcert.d.ts.map

package/dist/commands/agentcert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentcert.d.ts","sourceRoot":"","sources":["../../src/commands/agentcert.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAoBzC,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA8ChE"}

package/dist/commands/agentcert.js

@@ -0,0 +1,100 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { agentcert, notary } from "@mneme-ai/core";
+function out(s) { process.stdout.write(s + "\n"); }
+function loadFrames(cwd, run) {
+    const p = join(cwd, ".mneme", "mcpgate", "audit.jsonl");
+    if (!existsSync(p))
+        return [];
+    const all = readFileSync(p, "utf8").trim().split("\n").filter(Boolean).map((l) => { try {
+        return JSON.parse(l);
+    }
+    catch {
+        return null;
+    } }).filter(Boolean);
+    return run ? all.filter((f) => f.run === run) : all;
+}
+function loadApprovals(cwd) {
+    try {
+        const st = JSON.parse(readFileSync(join(cwd, ".mneme", "pager", "state.json"), "utf8"));
+        return (st.receipts ?? []).filter((r) => r.decidedBy === "human").map((r) => ({ id: String(r.req?.id ?? ""), decision: (r.decision === "deny" ? "deny" : "allow"), by: "human", on: String(r.channel ?? "pager"), at: Number(r.at) || 0 }));
+    }
+    catch {
+        return [];
+    }
+}
+export function registerAgentcertCommands(program) {
+    const k = program.command("agentcert").description("🎖 AGENT RUN CERTIFICATE — one portable, offline-verifiable certificate per governed agent run (the audit chain + human approvals, NOTARY-signed). The piece a giant adopts + an insurer underwrites: no vendor can issue it for itself.");
+    k.command("build").description("Build + sign a certificate for a run (or the whole audit ledger).")
+        .option("--run <id>", "only this run's audit frames (default: all)").option("--task <t>", "the run's task").option("--agent <a>", "agent/vendor name").option("--model <m>", "model id")
+        .option("--out <file>", "write the signed certificate").option("--json", "print the signed certificate JSON")
+        .action((o) => {
+        const cwd = process.cwd();
+        const auditFrames = loadFrames(cwd, o.run);
+        if (!auditFrames.length) {
+            out(`✗ no audit frames${o.run ? ` for run ${o.run}` : ""} — run some gated tool-calls first (mneme mcpgate / gephyra serve / matrix).`);
+            process.exitCode = 2;
+            return;
+        }
+        const approvals = loadApprovals(cwd);
+        const ev = {
+            runId: o.run || auditFrames[0].run || "all", agent: o.agent || auditFrames[0].agent || "agent", model: o.model, task: o.task,
+            startedAt: auditFrames[0].ts, endedAt: auditFrames[auditFrames.length - 1].ts, auditFrames, approvals,
+        };
+        const cert = agentcert.buildCertificate(ev);
+        // self-contained, portable: embed the evidence + sign the whole thing for offline verify
+        const payload = { cert, evidence: ev };
+        let signed = payload;
+        try {
+            signed = notary.issueReceipt(cwd, { kind: "reasoning-trace", subject: `agent-run-cert:${cert.runId}`, payload, includePayload: true, issuedAt: Date.now() });
+        }
+        catch { /* */ }
+        if (o.out)
+            writeFileSync(o.out, JSON.stringify(signed, null, 2), "utf8");
+        if (o.json) {
+            out(JSON.stringify(signed, null, 2));
+            return;
+        }
+        const s = cert.summary;
+        const ico = s.insurability === "insurable" ? "🟢" : s.insurability === "review" ? "🟡" : "🔴";
+        out(`🎖 AGENT RUN CERTIFICATE — ${cert.agent}${cert.task ? ` · "${cert.task}"` : ""} · ${ico} ${s.insurability.toUpperCase()}`);
+        out(`   ${s.calls} gated call(s): ${s.allowed} allowed · ${s.blocked} blocked · ${s.needsApproval} escalated · ${s.humanApprovals + s.humanDenials} human decision(s)`);
+        out(`   policy-compliant: ${s.policyCompliant ? "yes" : "NO"} · audit chain: ${s.auditChainOk ? "intact" : "BROKEN"} · max risk ${s.riskMax}`);
+        out(`   evidence sha256 ${cert.evidenceHash.slice(0, 16)}…${o.out ? ` · 🎖 signed → ${o.out}` : ""} (verify offline: mneme agentcert verify)`);
+    });
+    k.command("verify <file>").description("Verify a certificate OFFLINE — the signature, the embedded audit chain, and that the summary RE-DERIVES from the evidence (the cert cannot lie about its run).")
+        .action((file) => {
+        if (!existsSync(file)) {
+            out("certificate not found");
+            process.exitCode = 2;
+            return;
+        }
+        let signed;
+        try {
+            signed = JSON.parse(readFileSync(file, "utf8"));
+        }
+        catch {
+            out("✗ invalid certificate JSON");
+            process.exitCode = 2;
+            return;
+        }
+        const sig = notary.verifyReceipt(signed);
+        out(sig.valid ? "✓ signature VALID (Ed25519, offline — proves who issued it)" : `✗ signature INVALID: ${sig.reason}`);
+        const cert = signed.payload?.cert, evidence = signed.payload?.evidence;
+        if (!cert || !evidence) {
+            out("✗ certificate has no embedded cert/evidence");
+            process.exitCode = 2;
+            return;
+        }
+        const v = agentcert.verifyCertificate(cert, evidence);
+        out(v.valid ? "✓ run VERIFIED — " + v.reasons[0] : "✗ run NOT verified:");
+        if (!v.valid)
+            for (const r of v.reasons)
+                out("   • " + r);
+        const s = cert.summary;
+        out(`   → ${cert.agent}${cert.task ? ` · "${cert.task}"` : ""}: ${s.calls} gated calls · ${s.blocked} blocked · insurability ${s.insurability}`);
+        if (!sig.valid || !v.valid)
+            process.exitCode = 2;
+    });
+}
+//# sourceMappingURL=agentcert.js.map

package/dist/commands/agentcert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentcert.js","sourceRoot":"","sources":["../../src/commands/agentcert.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAEnD,SAAS,GAAG,CAAC,CAAS,IAAU,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AAEjE,SAAS,UAAU,CAAC,GAAW,EAAE,GAAY;IAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAyC,CAAC;IACpM,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACtD,CAAC;AACD,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAA0H,CAAC;QACjN,OAAO,CAAC,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAqB,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAClQ,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,0OAA0O,CAAC,CAAC;IAE/R,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,mEAAmE,CAAC;SAChG,MAAM,CAAC,YAAY,EAAE,6CAA6C,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC;SACvL,MAAM,CAAC,cAAc,EAAE,8BAA8B,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,mCAAmC,CAAC;SAC5G,MAAM,CAAC,CAAC,CAAgG,EAAE,EAAE;QAC3G,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,8EAA8E,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACnM,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,EAAE,GAA0B;YAChC,KAAK,EAAE,CAAC,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;YAC5H,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,SAAS;SACtG,CAAC;QACF,MAAM,IAAI,GAAG,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5C,yFAAyF;QACzF,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,GAAY,OAAO,CAAC;QAC9B,IAAI,CAAC;YAAC,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;QACrL,IAAI,CAAC,CAAC,GAAG;YAAE,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACvB,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9F,GAAG,CAAC,8BAA8B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAChI,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,mBAAmB,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,aAAa,gBAAgB,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,YAAY,oBAAoB,CAAC,CAAC;QACxK,GAAG,CAAC,wBAAwB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/I,GAAG,CAAC,sBAAsB,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,2CAA2C,CAAC,CAAC;IACjJ,CAAC,CAAC,CAAC;IAEL,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,WAAW,CAAC,gKAAgK,CAAC;SACrM,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;QACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACtF,IAAI,MAAgG,CAAC;QACrG,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACnI,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,6DAA6D,CAAC,CAAC,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACtH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC;QACvE,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7G,MAAM,CAAC,GAAG,SAAS,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtD,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;QAC1E,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO;gBAAE,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QACvB,GAAG,CAAC,QAAQ,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAC,OAAO,2BAA2B,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;QACjJ,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA8LA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA8lNvD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA+LA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA+lNvD"}

package/dist/index.js

@@ -108,6 +108,7 @@ import { registerKeryxCommands } from "./commands/keryx.js";
 import { registerCompileCommands } from "./commands/compile.js";
 import { registerSkillscanCommands } from "./commands/skillscan.js";
 import { registerMcpgateCommands } from "./commands/mcpgate.js";
+import { registerAgentcertCommands } from "./commands/agentcert.js";
 import { registerAdamasCommands } from "./commands/adamas.js";
 import { registerPrismCommands } from "./commands/prism.js";
 import { registerGoldilocksCommands } from "./commands/goldilocks.js";
@@ -4783,6 +4784,7 @@ export async function run(argv) {
     registerCompileCommands(program);
     registerSkillscanCommands(program);
     registerMcpgateCommands(program);
+    registerAgentcertCommands(program);
     registerAdamasCommands(program);
     registerPrismCommands(program);
     registerGoldilocksCommands(program);