progmune-runtime 2.1.6 → 3.2.0

package/dist/ledger/chain-builder.js

@@ -0,0 +1,185 @@
+"use strict";
+/**
+ * Phase 9: Provenance Chain Builder
+ *
+ * Constructs an end-to-end provenance chain for a session.
+ * Reads session data from the corpus and builds a timeline of
+ * every generation, validation, repair, and deployment event.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildProvenanceChain = buildProvenanceChain;
+const crypto = __importStar(require("crypto"));
+function shortHash(data) {
+    return crypto.createHash("sha256").update(data).digest("hex").slice(0, 16);
+}
+/** Compute event hash = SHA256(index + step + artifact + prevHash + timestamp + result) */
+function hashEvent(index, step, artifact, prevHash, timestamp, result) {
+    return shortHash(`${index}|${step}|${artifact}|${prevHash}|${timestamp}|${result}`);
+}
+/** Compute chain root hash = SHA256(all event hashes concatenated) */
+function computeChainHash(events) {
+    return shortHash(events.map((e) => e.hash).join(""));
+}
+function buildProvenanceChain(sessionId) {
+    // Load session
+    const { getAllSessions } = require("../failure-corpus");
+    const sessions = getAllSessions();
+    const session = sessions.find((s) => s.sessionId === sessionId || s.sessionId?.startsWith(sessionId));
+    if (!session) {
+        throw new Error(`Session not found: ${sessionId}`);
+    }
+    const events = [];
+    let allTransitions = [];
+    let repairCount = 0;
+    let prevHash = ""; // Genesis block — first event has empty prevHash
+    for (const attempt of session.attempts || []) {
+        const trans = attempt.transitions || [];
+        const ts = new Date(attempt.timestamp || Date.now()).toISOString();
+        // Generation events — one per transition
+        for (const t of trans) {
+            const fn = t.function || "unknown";
+            const result = t.valid !== false ? "passed" : "failed";
+            const eventHash = hashEvent(events.length, "generation", fn, prevHash, ts, result);
+            events.push({
+                index: events.length,
+                step: "generation",
+                timestamp: ts,
+                actor: attempt.plannerSeed?.includes("fallback") ? "planner" : "llm",
+                artifact: fn,
+                hash: eventHash,
+                prevHash,
+                result: result,
+                detail: t.valid !== false ? undefined : "SSG protocol violation",
+            });
+            prevHash = eventHash;
+        }
+        // Validation event — per attempt
+        if (trans.length > 0) {
+            const hasViolations = (attempt.violations || []).length > 0;
+            const result = hasViolations ? "failed" : "passed";
+            const eventHash = hashEvent(events.length, "validation", `${trans.length} transitions`, prevHash, ts, result);
+            events.push({
+                index: events.length,
+                step: "validation",
+                timestamp: ts,
+                actor: attempt.plannerSeed?.includes("fallback") ? "planner" : "validator",
+                artifact: `${trans.length} transitions`,
+                hash: eventHash,
+                prevHash,
+                result: result,
+                detail: hasViolations
+                    ? `${attempt.violations.length} violation(s): ${attempt.violations.map((v) => v.description).join("; ")}`
+                    : "All constraints satisfied",
+            });
+            prevHash = eventHash;
+        }
+        // Repair events
+        if (attempt.outcome === "constraint_violation" && attempt.violations?.length > 0) {
+            for (const v of attempt.violations || []) {
+                const eventHash = hashEvent(events.length, "repair", v.violatedConstraint || "unknown", prevHash, ts, "repaired");
+                events.push({
+                    index: events.length,
+                    step: "repair",
+                    timestamp: ts,
+                    actor: "planner",
+                    artifact: v.violatedConstraint || "unknown",
+                    hash: eventHash,
+                    prevHash,
+                    result: "repaired",
+                    detail: `SVL-${v.svl || "?"}: ${v.description || ""}`,
+                });
+                prevHash = eventHash;
+                repairCount++;
+            }
+        }
+        allTransitions = allTransitions.concat(trans);
+    }
+    // Deploy event (fingerprint registration)
+    let storedHash = "";
+    try {
+        const { getFingerprint } = require("../ledger-registry");
+        const fp = getFingerprint(session.sessionId);
+        if (fp) {
+            storedHash = fp.ledgerHash || "";
+            const ts = new Date(fp.timestamp || Date.now()).toISOString();
+            const eventHash = hashEvent(events.length, "deploy", `fingerprint: ${fp.ledgerHash?.slice(0, 12)}`, prevHash, ts, "approved");
+            events.push({
+                index: events.length,
+                step: "deploy",
+                timestamp: ts,
+                actor: "system",
+                artifact: `fingerprint: ${fp.ledgerHash?.slice(0, 12)}`,
+                hash: eventHash,
+                prevHash,
+                result: "approved",
+                detail: `${fp.transitionCount} transitions registered`,
+            });
+            prevHash = eventHash;
+        }
+    }
+    catch { /* no fingerprint */ }
+    // Compute chain hash — root hash covering all events
+    const chainHash = computeChainHash(events);
+    // Compute integrity: check both fingerprint match and chain self-consistency
+    const finalHash = shortHash(JSON.stringify(allTransitions));
+    const fingerprintMatch = !storedHash || storedHash === finalHash;
+    // Self-check: recompute chain and verify it matches
+    let chainSelfCheck = true;
+    let checkPrev = "";
+    for (const e of events) {
+        const recomputed = hashEvent(e.index, e.step, e.artifact, checkPrev, e.timestamp, e.result);
+        if (recomputed !== e.hash) {
+            chainSelfCheck = false;
+            break;
+        }
+        checkPrev = e.hash;
+    }
+    const integrity = fingerprintMatch && chainSelfCheck ? "intact" : "broken";
+    const validTrans = allTransitions.filter((t) => t.valid !== false).length;
+    return {
+        sessionId: session.sessionId,
+        intent: session.intent || "",
+        events,
+        chainHash,
+        integrity,
+        finalLedgerHash: finalHash,
+        storedFingerprintHash: storedHash,
+        totalTransitions: allTransitions.length,
+        validTransitions: validTrans,
+        invalidTransitions: allTransitions.length - validTrans,
+        repairCount,
+    };
+}

package/dist/ledger/cli.js

@@ -0,0 +1,222 @@
+"use strict";
+/**
+ * Phase 9-10: Provenance & Accountability CLI
+ *
+ * Usage:
+ *   npx ts-node src/ledger/cli.ts replay <sessionId>
+ *   npx ts-node src/ledger/cli.ts accountability <sessionId>
+ *   npx ts-node src/ledger/cli.ts accountability <sessionId> --author alice@example.com
+ *   npx ts-node src/ledger/cli.ts --json replay <sessionId>
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const chain_builder_1 = require("./chain-builder");
+const accountability_1 = require("./accountability");
+const C = {
+    reset: "\x1b[0m", bold: "\x1b[1m", dim: "\x1b[2m",
+    green: "\x1b[32m", red: "\x1b[31m", cyan: "\x1b[36m",
+    yellow: "\x1b[33m", magenta: "\x1b[35m", blue: "\x1b[34m",
+};
+const args = process.argv.slice(2);
+// ── Help ──
+if (args.includes("--help") || args.includes("-h") || args.length === 0) {
+    console.log(`
+Progmune Provenance & Accountability CLI
+
+Usage:
+  npx ts-node src/ledger/cli.ts replay <sessionId>
+  npx ts-node src/ledger/cli.ts accountability <sessionId> [options]
+
+Options (accountability):
+  --author <email>     Human who initiated generation
+  --reviewer <email>   Human who reviewed (repeatable)
+  --approver <email>   Human who approved deployment
+  --deployer <id>      CI/CD system that deployed
+  --json               Output as JSON
+
+Examples:
+  npx ts-node src/ledger/cli.ts replay sess_abc123
+  npx ts-node src/ledger/cli.ts accountability sess_abc123
+  npx ts-node src/ledger/cli.ts accountability sess_abc123 \\
+    --author alice@example.com --reviewer bob@example.com --deployer github-actions
+  `);
+    process.exit(0);
+}
+// ── Parse ──
+const useJson = args.includes("--json");
+const cmd = args[0]; // "replay" | "accountability"
+const sessionId = args[1]?.startsWith("--") ? undefined : args[1];
+// Parse actor options
+function parseHumanOpt(flag) {
+    const idx = args.indexOf(flag);
+    if (idx < 0 || !args[idx + 1] || args[idx + 1].startsWith("--"))
+        return undefined;
+    const email = args[idx + 1];
+    return { id: email, name: email.split("@")[0], role: flag.slice(2) };
+}
+const author = parseHumanOpt("--author");
+const reviewer = parseHumanOpt("--reviewer");
+const approver = parseHumanOpt("--approver");
+const deployerOpt = (() => {
+    const idx = args.indexOf("--deployer");
+    if (idx < 0 || !args[idx + 1])
+        return undefined;
+    const id = args[idx + 1];
+    return { id, name: id };
+})();
+// ── Dispatch ──
+if (cmd === "replay") {
+    if (!sessionId) {
+        console.error("❌ sessionId required");
+        process.exit(1);
+    }
+    try {
+        const chain = (0, chain_builder_1.buildProvenanceChain)(sessionId);
+        console.log(useJson ? JSON.stringify(chain, null, 2) : formatProvenanceChain(chain));
+    }
+    catch (e) {
+        console.error(`❌ ${e.message}`);
+        process.exit(1);
+    }
+}
+else if (cmd === "accountability") {
+    if (!sessionId) {
+        console.error("❌ sessionId required");
+        process.exit(1);
+    }
+    try {
+        const chain = (0, accountability_1.buildAccountabilityChain)(sessionId, {
+            author,
+            reviewers: reviewer ? [reviewer] : undefined,
+            approver,
+            deployer: deployerOpt,
+        });
+        if (useJson) {
+            console.log(JSON.stringify(chain, null, 2));
+        }
+        else {
+            console.log(formatAccountabilityChain(chain));
+        }
+    }
+    catch (e) {
+        console.error(`❌ ${e.message}`);
+        process.exit(1);
+    }
+}
+else {
+    console.error(`❌ Unknown command: ${cmd}. Use "replay" or "accountability".`);
+    process.exit(1);
+}
+// ═══════════════════════════════════════════════════════════════
+//  Provenance Chain Formatter
+// ═══════════════════════════════════════════════════════════════
+function stepLabel(step) {
+    const labels = {
+        generation: `${C.cyan}gen${C.reset}    `,
+        validation: `${C.yellow}val${C.reset}    `,
+        repair: `${C.red}repair${C.reset}  `,
+        approval: `${C.green}approve${C.reset} `,
+        deploy: `${C.bold}deploy${C.reset}  `,
+    };
+    return labels[step] || step.padEnd(8);
+}
+function resultIcon(r) {
+    if (r === "passed" || r === "approved")
+        return `${C.green}✓${C.reset}`;
+    if (r === "failed")
+        return `${C.red}✗${C.reset}`;
+    return `${C.yellow}↻${C.reset}`;
+}
+function formatProvenanceChain(chain) {
+    const lines = [];
+    lines.push("");
+    lines.push(`${C.bold}${C.cyan}Provenance Chain${C.reset}`);
+    lines.push(`  Session:     ${chain.sessionId}`);
+    lines.push(`  Intent:      ${chain.intent}`);
+    lines.push(`  Integrity:   ${chain.integrity === "intact" ? `${C.green}INTACT${C.reset}` : `${C.red}BROKEN${C.reset}`}`);
+    lines.push(`  Chain hash:  ${C.bold}${chain.chainHash}${C.reset}  ${C.dim}(root — tampering breaks this)${C.reset}`);
+    lines.push(`  Ledger:      ${chain.finalLedgerHash} (stored: ${chain.storedFingerprintHash || "none"})`);
+    lines.push(`  Stats:       ${chain.totalTransitions} transitions (${chain.validTransitions} valid, ${chain.invalidTransitions} invalid), ${chain.repairCount} repairs`);
+    lines.push("");
+    lines.push(`  ${C.dim}idx step      result  artifact                     eventHash       prevHash${C.reset}`);
+    lines.push(`  ${C.dim}─── ────────  ──────  ──────────────────────────── ──────────────── ────────────────${C.reset}`);
+    for (let i = 0; i < chain.events.length; i++) {
+        const e = chain.events[i];
+        const prev = e.prevHash ? e.prevHash.slice(0, 14) : "· (genesis)";
+        lines.push(`  ${String(i).padStart(2, "0")}  ${stepLabel(e.step)} ${resultIcon(e.result)} ${e.artifact.padEnd(28).slice(0, 28)} ${e.hash} ${C.dim}←${prev}${C.reset}`);
+        if (e.detail)
+            lines.push(`       ${C.dim}${e.detail.slice(0, 80)}${C.reset}`);
+    }
+    lines.push("");
+    lines.push(`  ${C.dim}Chain: ${chain.events.map(e => e.hash).join(" → ")}${C.reset}`);
+    lines.push(`  ${C.dim}Root:  ${chain.chainHash}${C.reset}`);
+    lines.push("");
+    return lines.join("\n");
+}
+// ═══════════════════════════════════════════════════════════════
+//  Accountability Chain Formatter
+// ═══════════════════════════════════════════════════════════════
+function actorTypeIcon(t) {
+    const icons = {
+        human: `${C.blue}👤${C.reset}`,
+        llm: `${C.magenta}🤖${C.reset}`,
+        validator: `${C.cyan}⚙${C.reset}`,
+        reviewer: `${C.green}✅${C.reset}`,
+        deployer: `${C.bold}🚀${C.reset}`,
+    };
+    return icons[t] || "  ";
+}
+function formatAccountabilityChain(chain) {
+    const lines = [];
+    const integrityIcon = chain.integrity === "intact"
+        ? `${C.green}INTACT${C.reset}`
+        : `${C.red}BROKEN${C.reset}`;
+    const custodyIcon = chain.custodyGap
+        ? `${C.yellow}⚠ GAPS DETECTED${C.reset}`
+        : `${C.green}VERIFIED${C.reset}`;
+    lines.push("");
+    lines.push(`${C.bold}${C.cyan}╔══════════════════════════════════════════════════════════════╗${C.reset}`);
+    lines.push(`${C.bold}${C.cyan}║${C.reset}  ${C.bold}Accountability Ledger — AI Code Supply Chain${C.reset}                    ${C.bold}${C.cyan}║${C.reset}`);
+    lines.push(`${C.bold}${C.cyan}╚══════════════════════════════════════════════════════════════╝${C.reset}`);
+    lines.push("");
+    lines.push(`  Session:       ${chain.sessionId}`);
+    lines.push(`  Intent:        ${chain.intent}`);
+    lines.push(`  Chain hash:    ${C.bold}${chain.chainHash}${C.reset}`);
+    lines.push(`  Integrity:     ${integrityIcon}`);
+    lines.push(`  Custody:       ${custodyIcon}`);
+    const signed = chain.events.filter(e => e.signature).length;
+    const sigIcon = signed > 0 ? `${C.green}${signed} signed${C.reset}` : `${C.dim}unsigned${C.reset}`;
+    lines.push(`  Signatures:    ${sigIcon}  /  ${chain.totalEvents} events`);
+    lines.push(`  Actors:        ${C.blue}${chain.humanEvents} human${C.reset}  ${C.magenta}${chain.aiEvents} AI${C.reset}  ${C.cyan}${chain.automatedEvents} automated${C.reset}`);
+    lines.push("");
+    // Chain visualization
+    lines.push(`  ${C.dim}── AI Code Supply Chain ──${C.reset}`);
+    lines.push("");
+    for (let i = 0; i < chain.events.length; i++) {
+        const e = chain.events[i];
+        const icon = actorTypeIcon(e.actorType);
+        const actorColor = e.actorType === "human" || e.actorType === "reviewer" ? C.blue
+            : e.actorType === "llm" ? C.magenta : C.cyan;
+        lines.push(`  ${String(i).padStart(2, "0")} ${icon} ${actorColor}${e.actorLabel.padEnd(38).slice(0, 38)}${C.reset} ${resultIcon(e.result)} ${e.action.slice(0, 30)}`);
+        lines.push(`     ${C.dim}hash: ${e.hash} ← ${e.prevHash ? e.prevHash.slice(0, 14) : "genesis"}${C.reset}`);
+        // Connector between events
+        if (i < chain.events.length - 1) {
+            const nextType = chain.events[i + 1].actorType;
+            const connector = e.actorType !== nextType
+                ? `${C.yellow}  │   responsibility handoff${C.reset}`
+                : `${C.dim}  │${C.reset}`;
+            lines.push(connector);
+        }
+    }
+    lines.push("");
+    // Custody gap warning
+    if (chain.custodyGap) {
+        lines.push(`  ${C.yellow}⚠️  Custody gaps detected — some actors could not be verified.${C.reset}`);
+        lines.push(`  ${C.dim}→ Use --author, --reviewer, --approver flags to identify human actors.${C.reset}`);
+        lines.push("");
+    }
+    // Root hash
+    lines.push(`  ${C.dim}Root: ${chain.chainHash}${C.reset}`);
+    lines.push(`  ${C.dim}${chain.totalEvents} events · ${chain.humanEvents} human · ${chain.aiEvents} AI · ${chain.automatedEvents} automated${C.reset}`);
+    lines.push("");
+    return lines.join("\n");
+}

package/dist/ledger/index.js

@@ -0,0 +1,13 @@
+"use strict";
+/**
+ * Phase 9-10: Ledger Module
+ *
+ * Public API for provenance tracking and accountability.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyAccountabilityChain = exports.buildAccountabilityChain = exports.buildProvenanceChain = void 0;
+var chain_builder_1 = require("./chain-builder");
+Object.defineProperty(exports, "buildProvenanceChain", { enumerable: true, get: function () { return chain_builder_1.buildProvenanceChain; } });
+var accountability_1 = require("./accountability");
+Object.defineProperty(exports, "buildAccountabilityChain", { enumerable: true, get: function () { return accountability_1.buildAccountabilityChain; } });
+Object.defineProperty(exports, "verifyAccountabilityChain", { enumerable: true, get: function () { return accountability_1.verifyAccountabilityChain; } });

package/dist/ledger/signatures.js

@@ -0,0 +1,193 @@
+"use strict";
+/**
+ * Phase 12: Ed25519 Signatures for Accountability Events
+ *
+ * Cryptographic proof that a specific actor performed a specific action.
+ * Uses Node.js built-in crypto (Ed25519 since Node 12+).
+ *
+ * Each actor has a key pair. Events are signed by the actor's private key.
+ * Verification proves: "actor X signed event Y at time Z".
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateKeyPair = generateKeyPair;
+exports.loadPublicKey = loadPublicKey;
+exports.hasKey = hasKey;
+exports.ensureKey = ensureKey;
+exports.signEvent = signEvent;
+exports.verifySignature = verifySignature;
+exports.buildSignPayload = buildSignPayload;
+exports.trySign = trySign;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+// ═══════════════════════════════════════════════════════════════
+// Key Management
+// ═══════════════════════════════════════════════════════════════
+const KEYS_DIR = ".progmune_keys";
+function keysDir() {
+    const projectDir = process.env.PROGMUNE_PROJECT_DIR || process.cwd();
+    return path.resolve(projectDir, KEYS_DIR);
+}
+function keyPath(actorId) {
+    return path.join(keysDir(), `${sanitizeFilename(actorId)}.json`);
+}
+function sanitizeFilename(id) {
+    return id.replace(/[^a-zA-Z0-9_@.-]/g, "_").slice(0, 64);
+}
+/** Generate a new Ed25519 key pair for an actor */
+function generateKeyPair(actorId, actorType) {
+    const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519", {
+        publicKeyEncoding: { type: "spki", format: "der" },
+        privateKeyEncoding: { type: "pkcs8", format: "der" },
+    });
+    const kp = {
+        publicKey: publicKey.toString("hex"),
+        privateKey: privateKey.toString("hex"),
+        actorId,
+        actorType,
+        createdAt: new Date().toISOString(),
+    };
+    // Auto-save to .progmune_keys/
+    const dir = keysDir();
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+    // Only save public info + type; private key stored separately
+    fs.writeFileSync(keyPath(actorId) + ".pub", JSON.stringify({ actorId, actorType, publicKey: kp.publicKey, createdAt: kp.createdAt }, null, 2), "utf-8");
+    return kp;
+}
+/** Load public key for an actor */
+function loadPublicKey(actorId) {
+    const pubPath = keyPath(actorId) + ".pub";
+    try {
+        const data = JSON.parse(fs.readFileSync(pubPath, "utf-8"));
+        return data.publicKey || null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Check if a key exists for an actor */
+function hasKey(actorId) {
+    return loadPublicKey(actorId) !== null;
+}
+/** Load or generate a key for an actor */
+function ensureKey(actorId, actorType) {
+    const existingPub = loadPublicKey(actorId);
+    if (existingPub) {
+        return {
+            publicKey: existingPub,
+            privateKey: "", // Private key not stored in .pub file
+            actorId,
+            actorType,
+            createdAt: "",
+        };
+    }
+    return generateKeyPair(actorId, actorType);
+}
+// ═══════════════════════════════════════════════════════════════
+// Signing & Verification
+// ═══════════════════════════════════════════════════════════════
+/**
+ * Sign a payload with a private key.
+ * Returns the hex-encoded Ed25519 signature + public key for verification.
+ */
+function signEvent(payload, privateKey) {
+    const privKeyObj = crypto.createPrivateKey({
+        key: Buffer.from(privateKey, "hex"),
+        format: "der",
+        type: "pkcs8",
+    });
+    const pubKeyObj = crypto.createPublicKey(privKeyObj);
+    const pubKeyDer = pubKeyObj.export({ type: "spki", format: "der" });
+    const signature = crypto.sign(null, Buffer.from(payload, "utf-8"), privKeyObj);
+    return {
+        signature: signature.toString("hex"),
+        publicKey: pubKeyDer.toString("hex"),
+        actorId: "",
+        algorithm: "ed25519",
+    };
+}
+/**
+ * Verify an Ed25519 signature against a payload and public key.
+ */
+function verifySignature(payload, signature, publicKey) {
+    try {
+        const pubKeyObj = crypto.createPublicKey({
+            key: Buffer.from(publicKey, "hex"),
+            format: "der",
+            type: "spki",
+        });
+        const sigBuffer = Buffer.from(signature, "hex");
+        const valid = crypto.verify(null, Buffer.from(payload, "utf-8"), pubKeyObj, sigBuffer);
+        return {
+            valid,
+            actorId: "",
+            publicKey,
+            detail: valid ? undefined : "Signature verification failed — data may have been tampered.",
+        };
+    }
+    catch (e) {
+        return {
+            valid: false,
+            actorId: "",
+            publicKey,
+            detail: `Verification error: ${e.message}`,
+        };
+    }
+}
+/**
+ * Build the payload string that gets signed for an accountability event.
+ * Deterministic: reconstructable from the event data alone.
+ */
+function buildSignPayload(index, actorId, step, artifact, timestamp, result, prevHash) {
+    return `${index}|${actorId}|${step}|${artifact}|${timestamp}|${result}|${prevHash}`;
+}
+/**
+ * Sign an event payload using a stored key.
+ * Returns the signature string, or undefined if no key available.
+ */
+function trySign(actorId, payload) {
+    // In CI, keys are injected via environment variable
+    const envKey = process.env[`PROGMUNE_KEY_${sanitizeFilename(actorId).toUpperCase()}`];
+    if (envKey) {
+        const result = signEvent(payload, envKey);
+        result.actorId = actorId;
+        return result;
+    }
+    // In local dev, try loading from .progmune_keys/
+    // (private keys are not stored by default — user provides them)
+    return undefined;
+}

package/dist/ledger/types.js

@@ -0,0 +1,9 @@
+"use strict";
+/**
+ * Phase 9: Ledger Provenance Types
+ * Phase 10: Accountability Ledger Types
+ *
+ * End-to-end provenance + accountability tracking for AI-generated code.
+ * Every step identifies WHO acted, not just WHAT happened.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });