orbit-agent-runtime 0.8.0 → 0.11.0

package/CHANGELOG.md

@@ -4,6 +4,131 @@ All notable changes to Orbit Agent Runtime are documented here. This project
 follows a pre-alpha versioning scheme: `v0.x.minor` marks a release wave,
 `patch` marks fixes. Until `v1.0` the public API is not yet stability-promised.
 
+## [0.11.0] — 2026-09-02 · Signed compliance reports (W35, P2)
+
+The compliance report becomes a *signed document*: a third party holding only
+the public key can verify that the report was produced by the operator and has
+not been altered — no shared secret, no access to the original system. This is
+the step that turns an internal tool output into something an external auditor
+can accept.
+
+### Added
+- **`core-hub/audit/report_signing.ts`** — ED25519 report signing (node:crypto
+  native, zero dependencies):
+  - `deriveReportKeyPair(seed)` — a 32-byte hex seed deterministically derives
+    the key pair (RFC 8410 PKCS8 wrap); operators back up a seed, verifiers get
+    a PEM public key.
+  - `signComplianceReport(report, seed)` — signs the stable key-sorted JSON
+    body (everything except `sig`); ed25519 signing is deterministic, so the
+    same report + seed always yields the same signature.
+  - `verifyComplianceReport(report, publicKeyPem)` — checks signer
+    fingerprint, body digest and the signature itself.
+- **Console** — `GET /api/compliance/export?format=json` signs the report when
+  `ORBIT_REPORT_SIGNING_KEY` is set; md/pdf exports carry a signature line;
+  `GET /api/compliance/public-key` hands out the verifier key + fingerprint;
+  the audit page report card shows live signing status.
+- **CLI** — `orbit verify-report <report.json> --public-key <pem-file|seed>`:
+  independent verification, non-zero exit on any tampering.
+- **Tests** — `report_signing.test.ts`: seed determinism, round-trip, digest
+  tamper detection, wrong-key rejection, unsigned rejection, signature
+  mutation.
+
+### Changed
+- PEM exports are trimmed so a key survives file round-trips byte-identically
+  (a trailing newline made fingerprints drift across write/read).
+
+### Verification
+- Kernel suite: **430/430** (423 → +7 report_signing). Console 107/107.
+- CLI smoke: PEM verification `✓ signature valid`, a doctored report exits 1.
+
+## [Unreleased] — Doc site (W34, M6b closeout)
+
+The open-source launch's last code gap closes: the architecture documents
+become a browsable static site, generated with the project's own zero
+dependencies.
+
+- **`tools/render-md.mjs`** — zero-dependency Markdown subset renderer
+  (ATX headings, fenced code, pipe tables, blockquotes, lists, hr,
+  paragraphs; inline bold / code / links). Pure functions, no I/O.
+- **`tools/build-site.mjs`** — renders `README.md` + `docs/*.md` +
+  `docs/blog/*` into a Bio-Lineage-themed static site under `site/` (9
+  pages). `npm run docsite`; `site/` is git-ignored generated output.
+- **CI** — new `Docsite tests + build` step (`npm run test:docsite`).
+- **Tests** — `tools/render-md.test.mjs`, 8 cases including a real-doc
+  golden check (architecture.md renders with no raw markdown leaking).
+- Product version untouched (kernel/console zero change); CHANGELOG gains
+  an `[Unreleased]` convention for tooling waves.
+
+## [0.10.0] — 2026-09-02 · Compliance report (W33, PRODUCT_PLAN P2)
+
+The audit story reaches its product conclusion: one exportable artifact that
+states the governance tier, proves the audit chain and summarises the
+governance interventions — the thing a third party can actually be shown.
+
+### Added
+- **Report model** (`web/public/lib.js`, DOM-free): `buildComplianceReport`
+  folds the governance profile, the audit-chain report and the recording
+  window into `{ meta, governance, audit, interventions, determinism,
+  summary }`. Audit status derives honestly: `EMPTY` (no entries), `UNSIGNED`
+  (no key — structure provable, integrity not), `PASS` (signed + consistent),
+  `FAIL` (broken at entry N with the reason). `countInterventions` tallies the
+  governance interventions from timeline steps (rate-limit / trip / pact /
+  budget / compression).
+- **Bridge endpoints**:
+  - `GET /api/compliance` — live report JSON.
+  - `GET /api/compliance/export?format=md|json|pdf` — downloadable report
+    (PDF reuses the existing zero-dependency buildPdf; export is itself an
+    audited action in the console event stream).
+- **Console audit page** — a "合规报告" card under the audit-chain card:
+  tier + audit status + intervention chips, and md / json / pdf export.
+
+### Verification
+- Console suite: **107/107** (103 → +4 compliance pure-function cases).
+- Kernel unchanged and green: **423/423** (console/bridge wave).
+- Smoke: a keyed strict host produces a `PASS` report with the entry count;
+  an unsigned host reports `EMPTY`/`UNSIGNED` honestly.
+- view-refs gate caught `badgeEl` used-but-not-imported in the audit view;
+  added to its import.
+
+### Migration
+- New API only (`/api/compliance*`, lib functions). No kernel change.
+
+## [0.9.0] — 2026-09-02 · Replay timeline (W32, PRODUCT_PLAN P1.1)
+
+The first PRODUCT_PLAN P1 delivery: deterministic replay becomes a visual,
+step-through debugging experience instead of a raw JSONL inspection.
+
+### Added
+- **Timeline model** (`web/public/lib.js`, DOM-free pure functions shared by
+  bridge and views): `buildTimeline(records)` expands a recording window into
+  ordered steps; `callFacts(record)` extracts channel/function/input digest/
+  output summary/duration/token estimate plus governance facts (rate-limit,
+  trip, pact, budget, compression, route); `flaggedSteps` isolates the
+  governance-intervened steps; `summarizeValue` renders a bounded output.
+- **Bridge endpoints**:
+  - `GET /api/replay/timeline` — the host's live recording window as steps.
+  - `POST /api/replay/fork { at }` — branch: keep `0..at`, discard the rest,
+    continue live recording from `at` (the window's `orderIndex` continues).
+- **Console replay page** — timeline card over the real window: step list with
+  governance badges, step-through navigation (prev/next), per-step detail
+  (input digest / output / duration / tokens / decisions) and a fork action
+  that branches a new experiment from the selected step.
+- **Console tests**: 6 new cases for the timeline pure functions
+  (103 console total).
+
+### Verification
+- Kernel suite unchanged and green: **423/423** (this wave is console/bridge
+  only — the kernel API surface is untouched, `RecordJournal.restoreSnapshot`
+  already provides the fork primitive).
+- Console suite: **103/103** green. css-coverage gate caught an unused
+  `tl-step` class in the new view; removed.
+- E2E smoke: 4-step window builds a timeline; fork at #1 keeps 0..1 and the
+  next live call lands at orderIndex 2.
+
+### Migration
+- New API only: `replayTimeline` / `replayFork` bridge calls plus lib
+  functions. No kernel change; no breaking change.
+
 ## [0.8.0] — 2026-09-01 · Trust assumption & contractification (W31)
 
 The last two VISION §3.1 governance dimensions ship, closing the four-tier

package/README.md

@@ -37,6 +37,10 @@ Orbit Agent Runtime is a lightweight, dependency-free runtime host for plugin-ba
 - **Isolation domains (W19)** — the impact graph allocates the physical layer: a unit whose failure closure exceeds the threshold gets its own L2 child process (`iso:<unit>`), the rest share deterministic chunks (`shared:<n>`). The sync is a diff, not a rebuild, and domains are published as one capability channel, so a domain call is recorded and replayed byte-identically
 - **Cross-domain transactions (W20)** — every hop between domains is an atomic gateway transaction: `decision (assignment / isolation) + execution + result + audit`, settled in a ledger that reconciles by (source → target) pair. Orphans (a hop that crossed a boundary and never settled) and refusals are both detectable from the records alone; replay injects the frozen output without re-entering the domain
 - **Durable journals (W27)** — the audit journal and the recording window each mirror to a crash-safe write-ahead log, so a restart does not erase the audit trail or a recorded run. One JSON line per entry means the only artifact a crash can leave is a partial final line: recovery drops exactly that and rejects any invalid *interior* line as a genuine fault. Recovered entries keep their original ids and ordering, so they are byte-identical and a window split across processes replays as one uninterrupted run
+- **Signed compliance reports (W35)** — reports are ED25519-signed with a deterministically derived key pair (back up a seed, hand out the public key); `orbit verify-report` proves a report genuine and untampered with nothing but the public key — no shared secret, no access to the original system. That is the difference between an internal tool output and a document an external auditor can accept
+- **Signed compliance reports (W35)** — reports are ED25519-signed with a deterministically derived key pair (back up a seed, hand out the public key); `orbit verify-report` proves a report genuine and untampered with nothing but the public key — no shared secret, no access to the original system. That is the difference between an internal tool output and a document an external auditor can accept
+- **Compliance report (W33)** — governance tier + audit-chain proof + governance interventions fold into one exportable artifact (`GET /api/compliance/export`, md / json / pdf). The status is honest: an unsigned chain reports UNSIGNED, a broken one FAIL at the exact entry — only a signed, consistent chain says PASS (PRODUCT_PLAN P2)
+- **Replay timeline (W32)** — the console turns a recording window into a visual, step-through debugging timeline: per-call governance badges (rate-limit / trip / pact / budget / compression / route), input digest + output + cost detail per step, and a fork action that branches a new experiment from any recorded step (PRODUCT_PLAN P1.1)
 - **Trust assumption & contractification (W31)** — VISION §3.1's last two governance dimensions: `strict` caps foreign adapters at L1 (no out-of-process children) and demands a declared parameter contract (`schema`) on every plugin; `standard` validates a tool's arguments against a declared schema before the call executes; `sandbox` checks nothing. The four-tier model is now fully implemented — every dimension in the VISION table has a code path
 - **Audit hash chain (W30)** — an append-only audit log is only as trustworthy as its file permissions; a hash chain makes it tamper-evident. With `new OrbitRuntimeHost({ auditSigningKey })` every audit entry carries HMAC-SHA256 `prevHash`/`chainHash` linkage, `host.verifyAuditChain()` proves integrity, `orbit audit <trace.wal> --key …` verifies from the CLI, and the `strict` tier refuses to boot on a broken chain. Editing any entry breaks the chain at that point and everything after it
 - **Four-tier governance (W29)** — VISION's Sandbox / Standard / Strict tiers are switchable configuration, not a design goal: `new OrbitRuntimeHost({ governanceProfile: "strict" })` tunes rate limits, trip thresholds, compression, PAE admission and trace durability in one declaration. `standard` is the kernel's previous numbers verbatim; a non-default tier is hashed into the run fingerprint, so a trace recorded under one tier refuses to replay under another (config drift, not silent divergence)
@@ -120,7 +124,7 @@ host.registerPlugin({
   id: "p.worker",
   displayName: "p.worker",
   edition: "1.0.0",
-  requireHostMinEdition: "0.8.0",
+  requireHostMinEdition: "0.11.0",
   allowCapabilities: ["channel:read", "channel:write"],
   declareChannelDeps: [ChannelKind.LLM_ACCESS]
 });
@@ -387,7 +391,7 @@ app workspace, run with `npm run start:web`.
 | M4 | **Cost-aware routing** — channel cost/latency/quality profiles, per-cycle sandbox budgets | ✅ Done |
 | M5 | Product hardening: benchmarks, plugin examples, CI, npm publish | ✅ Done |
 | M6 | **Open-source launch** — `orbit` CLI (`record`/`replay`/`diff`) | ✅ Done (CLI + audit shipped) |
-| M6b | **Open-source launch** — docs site / landing page, first public npm release | Pending (npm publish is one command away; `prepublishOnly` gates it) |
+| M6b | **Open-source launch** — docs site / landing page, first public npm release | npm publish ✅ (orbit-agent-runtime 0.8.0+ live); docs site pending |
 
 > M5/M6 track the `P0` milestones in [docs/PRODUCT_PLAN.md](./docs/PRODUCT_PLAN.md)
 > (P0.1 real capabilities → P0.2 CLI release → P0.3 open-source launch).

package/README.zh-CN.md

@@ -34,6 +34,10 @@ Orbit Agent Runtime 是一套零第三方依赖的插件化智能体运行时宿
 - **隔离域（W19）** —— 影响域图驱动物理层分配：故障闭包超阈值的单元获得独立 L2 子进程（`iso:<unit>`），其余确定性分块共置（`shared:<n>`）。同步是 diff 而非重建，域整体发布为单一能力通道，域调用被记录并可逐字节重放
 - **跨域事务（W20）** —— 域间每一次跳转都是一笔原子网关事务：决策（归属/隔离级）+ 执行 + 结果 + 审计，按（源域→目标域）对账结算；孤儿（跨界未结算）与拒绝（执行前被拒）都能从记录单独检出；重放注入冻结输出而不重入域
 - **日志持久化（W27）** —— 审计日志与录制窗口各挂一份崩溃安全的预写日志（WAL），进程重启不再擦除审计轨迹与已录制运行。一行一条 JSON，故崩溃唯一残留形态是「末行被截断」：恢复只丢弃那一行，而任何**内部**非法行按真实故障拒绝。恢复保留原始 id 与顺序，因此条目逐字节一致——被进程边界切开的录制窗口仍重放为一条连续运行
+- **报告签章（W35）** —— 报告经 ED25519 签名（seed 确定性派生密钥对：备份 seed、分发公钥）；`orbit verify-report` 仅凭公钥即可证明报告真实且未被篡改——无需共享秘密、无需原系统。这是"内部工具输出"与"外部审计可接受的文件"之间的分水岭
+- **报告签章（W35）** —— 报告经 ED25519 签名（seed 确定性派生密钥对：备份 seed、分发公钥）；`orbit verify-report` 仅凭公钥即可证明报告真实且未被篡改——无需共享秘密、无需原系统。这是"内部工具输出"与"外部审计可接受的文件"之间的分水岭
+- **合规报告（W33）** —— 治理档位 + 审计链证明 + 治理干预收敛为一份可导出产物（`GET /api/compliance/export`，md/json/pdf）。状态诚实推导：未签名链报 UNSIGNED、断裂链报 FAIL 并定位条目——只有签名且一致的链才报 PASS（PRODUCT_PLAN P2）
+- **重放时间线（W32）** —— 控制台把录制窗口变成可视化 step-through 调试时间线：每步的治理徽标（限流/熔断/越权/预算/压缩/路由）、输入 digest + 输出 + 成本详情，以及从任一步分叉出新实验的按钮（PRODUCT_PLAN P1.1）
 - **信任推定与契约化（W31）** —— VISION §3.1 最后两维落地：`strict` 把外来适配器封顶 L1（不跑子进程）并要求每个插件声明参数契约（`schema`）；`standard` 在调用前按声明校验参数；`sandbox` 零校验。四档模式全部维度都有代码实现
 - **审计哈希链（W30）** —— append-only 审计日志的可信度只有文件权限那么高；哈希链让它可证明未被篡改。`new OrbitRuntimeHost({ auditSigningKey })` 后每条审计条目携带 HMAC-SHA256 的 `prevHash`/`chainHash` 链，`host.verifyAuditChain()` 证明完整性，`orbit audit <trace.wal> --key …` 从 CLI 验证，`strict` 档在链被篡改时拒绝启动。改动任何一条都会在该处及之后全部断裂
 - **四档治理模式（W29）** —— VISION 的 Sandbox / Standard / Strict 档位从"设计目标"变为可切换配置：`new OrbitRuntimeHost({ governanceProfile: "strict" })` 一次声明限流、熔断、压缩、PAE 准入与轨迹持久化。`standard` 与旧版数字逐字一致；非默认档哈希进运行指纹，跨档重放报配置漂移而非静默分叉
@@ -301,7 +305,7 @@ orbit-agent-runtime/
 | M4 | **成本感知路由** —— 通道成本/延迟/质量档案，沙箱按轮预算调度 | ✅ 已完成 |
 | M5 | 产品化攻坚：基准测试、插件示例、CI、npm 发布 | ✅ 已完成 |
 | M6 | **开源发布** —— `orbit` CLI（`record`/`replay`/`diff`） | ✅ 已完成（CLI + audit 命令已交付） |
-| M6b | **开源发布** —— 文档站 / 落地页、首个公开 npm 版本 | 待办（npm publish 一步之遥；`prepublishOnly` 已配好门禁） |
+| M6b | **开源发布** —— 文档站 / 落地页、首个公开 npm 版本 | npm 发布 ✅（orbit-agent-runtime 0.8.0+ 已上线）；文档站待建 |
 
 > M5/M6 对应 [docs/PRODUCT_PLAN.md](./docs/PRODUCT_PLAN.md) 的 P0 里程碑
 > （P0.1 真能力落地 → P0.2 CLI 发布 → P0.3 开源发布）。