protect-mcp 0.10.0 → 0.11.1

package/CHANGELOG.md

@@ -1,7 +1,50 @@
 # Changelog
 
+## 0.10.1: HTTP gateway mode enforces Cedar and emits chained receipts
+
+Three fixes found by running the cloud-gateway path end to end before
+documenting it:
+
+- Fail-open fixed: in `--http` mode, loaded Cedar policies were never
+  attached to the gateway (the stdio path attached them after the HTTP
+  branch returned), so a remote gate started with `--enforce` and a Cedar
+  policy silently allowed everything. Cedar policies are now attached
+  before the child starts, and a forbidden tool call over HTTP is denied.
+- Silent-unsigned fixed: a Cedar-mode gateway never read `signing` from
+  protect-mcp.json (only the JSON-policy branch did), so it emitted no
+  receipts while looking fully configured. Cedar mode now picks up signing
+  and credentials from protect-mcp.json when present and says so on stderr.
+- Gateway receipts now chain: the wrapped-server path (stdio and HTTP)
+  threads previousReceiptHash per draft s5.7 and resumes the chain across
+  restarts from the log tail, matching the hook server. Verified end to
+  end: a cloud-style client over Streamable HTTP, one allow and one deny,
+  chained draft-02 receipts, replayed offline with the published
+  @veritasacta/verify with zero chain breaks.
+
+
 ## 0.10.0: receipts migrate to the draft-02 Acta envelope
 
+Also in this release, the policy digest becomes a recomputable commitment
+(prompted by public review of opaque policy identifiers):
+
+- One normative construction for every engine, `acta-policy-digest-v1`:
+  per-file SHA-256s into a sorted `{construction, engine, files}` manifest,
+  JCS, SHA-256, emitted as `"sha256:<64 hex>"`. Replaces two divergent
+  code-defined preimages that concatenated sources (ambiguous file
+  boundaries) and truncated to 16 hex characters with no prefix. Receipts
+  now carry the full-strength digest; pre-0.10 digests should be treated
+  as opaque labels.
+- `protect-mcp policy digest` prints the digest, the per-file hashes, and
+  the recompute rule (`--expect` for CI, `--json` for tooling).
+- `protect-mcp policy publish` writes the `acta.policy-bundle.v1` bundle
+  (policy bytes plus preimage spec, addressed by the digest) ready to host
+  at `.well-known/acta-policies/<hex>.json`; a verifier confirms which
+  policy governed a receipt from the bundle bytes alone, with no
+  communication with the issuer.
+- The construction is specified normatively in
+  draft-farley-acta-signed-receipts-03 (section 5.8), alongside
+  `require_approval` as a decision value.
+
 Receipts are now emitted in the envelope the IETF draft actually specifies
 (draft-farley-acta-signed-receipts-02): a two-field
 `{ payload, signature: { alg: "EdDSA", kid, sig } }` envelope, with the

package/dist/{chunk-SPDIFFGP.mjs → chunk-BXZUS6HS.mjs}

@@ -1,11 +1,11 @@
 import {
   meetsMinTier
-} from "./chunk-622KQ4KW.mjs";
+} from "./chunk-NQOKPBSQ.mjs";
 import {
   checkRateLimit,
   getToolPolicy,
   parseRateLimit
-} from "./chunk-VWGRAUWI.mjs";
+} from "./chunk-WMIWQ6TS.mjs";
 
 // src/simulate.ts
 import { readFileSync } from "fs";

package/dist/{chunk-VWGRAUWI.mjs → chunk-CIWIK6BT.mjs}

@@ -1,242 +1,6 @@
-import {
-  computeSbIssuerKid,
-  createReceiptEnvelope
-} from "./chunk-3AVIMUNP.mjs";
-
-// src/policy.ts
-import { createHash } from "crypto";
-import { readFileSync } from "fs";
-function loadPolicy(path) {
-  const raw = readFileSync(path, "utf-8");
-  const parsed = JSON.parse(raw);
-  if (!parsed.tools || typeof parsed.tools !== "object") {
-    throw new Error(`Invalid policy file: missing "tools" object in ${path}`);
-  }
-  const policy = {
-    tools: parsed.tools,
-    default_tier: parsed.default_tier || "unknown",
-    policy_engine: parsed.policy_engine || "built-in",
-    ...parsed.external ? { external: parsed.external } : {}
-  };
-  const digest = computePolicyDigest(policy);
-  return {
-    policy,
-    digest,
-    credentials: parsed.credentials,
-    signing: parsed.signing
-  };
-}
-function computePolicyDigest(policy) {
-  const canonical = JSON.stringify(sortKeysDeep(policy));
-  return createHash("sha256").update(canonical).digest("hex").slice(0, 16);
-}
-function sortKeysDeep(obj) {
-  if (obj === null || typeof obj !== "object") return obj;
-  if (Array.isArray(obj)) return obj.map(sortKeysDeep);
-  const sorted = {};
-  for (const key of Object.keys(obj).sort()) {
-    sorted[key] = sortKeysDeep(obj[key]);
-  }
-  return sorted;
-}
-function getToolPolicy(toolName, policy) {
-  if (!policy) {
-    return { require: "any" };
-  }
-  if (policy.tools[toolName]) {
-    return policy.tools[toolName];
-  }
-  if (policy.tools["*"]) {
-    return policy.tools["*"];
-  }
-  return { require: "any" };
-}
-function parseRateLimit(spec) {
-  const match = spec.match(/^(\d+)\/(second|minute|hour|day)$/);
-  if (!match) {
-    throw new Error(`Invalid rate limit format: "${spec}". Expected "N/unit" (e.g. "5/hour")`);
-  }
-  const count = parseInt(match[1], 10);
-  const unit = match[2];
-  const windowMs = {
-    second: 1e3,
-    minute: 6e4,
-    hour: 36e5,
-    day: 864e5
-  };
-  return { count, windowMs: windowMs[unit] };
-}
-function checkRateLimit(key, limit, store) {
-  const now = Date.now();
-  const windowStart = now - limit.windowMs;
-  const timestamps = (store.get(key) || []).filter((t) => t > windowStart);
-  if (timestamps.length >= limit.count) {
-    store.set(key, timestamps);
-    return { allowed: false, remaining: 0 };
-  }
-  timestamps.push(now);
-  store.set(key, timestamps);
-  return { allowed: true, remaining: limit.count - timestamps.length };
-}
-
-// src/signing.ts
-import { readFileSync as readFileSync2, existsSync } from "fs";
-var signerState = null;
-var signingConfigured = false;
-var signingInitError = null;
-async function initSigning(config) {
-  const warnings = [];
-  signerState = null;
-  signingConfigured = Boolean(config && config.enabled !== false);
-  signingInitError = null;
-  if (!config || config.enabled === false) {
-    return warnings;
-  }
-  if (!config.key_path) {
-    signingInitError = "signing enabled but key_path is not configured";
-    warnings.push(`signing: ${signingInitError}`);
-    return warnings;
-  }
-  if (!existsSync(config.key_path)) {
-    signingInitError = `key file not found at ${config.key_path}`;
-    warnings.push(`signing: ${signingInitError} \u2014 run "protect-mcp init" to generate`);
-    return warnings;
-  }
-  let keyData;
-  try {
-    keyData = JSON.parse(readFileSync2(config.key_path, "utf-8"));
-    if (!keyData.privateKey || !keyData.publicKey) {
-      signingInitError = "key file missing privateKey or publicKey fields";
-      warnings.push(`signing: ${signingInitError}`);
-      return warnings;
-    }
-  } catch (err) {
-    signingInitError = `failed to load key file: ${err instanceof Error ? err.message : err}`;
-    warnings.push(`signing: ${signingInitError}`);
-    return warnings;
-  }
-  try {
-    signerState = {
-      privateKey: keyData.privateKey,
-      publicKey: keyData.publicKey,
-      // kid is opaque per draft-02; existing key files keep their explicit kid,
-      // and keys without one get the s2.1.1 RECOMMENDED sb:issuer format.
-      kid: keyData.kid || computeSbIssuerKid(keyData.publicKey),
-      issuer: config.issuer || keyData.issuer || "protect-mcp"
-    };
-  } catch (err) {
-    signingInitError = `failed to initialize signer: ${err instanceof Error ? err.message : err}`;
-    warnings.push(`signing: ${signingInitError} \u2014 enforce mode will fail closed`);
-  }
-  return warnings;
-}
-function signDecision(entry, prevReceiptHash) {
-  const artifactType = entry.decision === "deny" ? "gateway_restraint" : "decision_receipt";
-  if (signingConfigured && signingInitError) {
-    return {
-      ok: false,
-      signed: null,
-      artifact_type: artifactType,
-      warning: `signing initialization failed: ${signingInitError}`,
-      error: signingInitError
-    };
-  }
-  if (signingConfigured && !signerState) {
-    const error = "signing was configured but no signer is ready";
-    return {
-      ok: false,
-      signed: null,
-      artifact_type: artifactType,
-      warning: error,
-      error
-    };
-  }
-  if (!signerState) {
-    return { ok: false, signed: null, artifact_type: "none" };
-  }
-  try {
-    const payload = {
-      // draft-02 s3.1 access-decision fields
-      type: "protectmcp:decision",
-      tool_name: entry.tool,
-      decision: entry.decision,
-      reason: entry.reason_code,
-      policy_digest: entry.policy_digest,
-      // Extension fields (signed alongside the s3.1 core)
-      scope: entry.request_id,
-      // request scope
-      mode: entry.mode,
-      request_id: entry.request_id,
-      // Spec version: ties every receipt to the IETF standard
-      spec: "draft-farley-acta-signed-receipts-02",
-      // Issuer certification: distinguishes VOPRF-backed receipts from self-signed ones
-      // - scopeblind:verified  = issued via ScopeBlind VOPRF backend (paid tier)
-      // - self-signed          = signed with local Ed25519 key (free tier, protect-mcp default)
-      // - uncertified          = unsigned receipt (shadow mode, no signing configured)
-      issuer_certification: signerState ? "self-signed" : "uncertified",
-      // The signer's PUBLIC key, inside the signed payload, so a receipt is
-      // self-contained: any verifier (including the record viewer, in-browser)
-      // can check the signature without a side channel. Binding the key inside
-      // the signature means it cannot be swapped without breaking the signature;
-      // authenticity (that the key is YOUR gate's) still comes from pinning it.
-      public_key: signerState.publicKey
-    };
-    if (signerState.issuer && signerState.issuer !== signerState.kid) {
-      payload.issuer_name = signerState.issuer;
-    }
-    if (prevReceiptHash) payload.previousReceiptHash = prevReceiptHash;
-    if (entry.tier) payload.tier = entry.tier;
-    if (entry.credential_ref) payload.credential_ref = entry.credential_ref;
-    if (entry.rate_limit_remaining !== void 0) {
-      payload.rate_limit_remaining = entry.rate_limit_remaining;
-    }
-    if (entry.policy_engine) payload.policy_engine = entry.policy_engine;
-    if (entry.hook_event) payload.hook_event = entry.hook_event;
-    if (entry.sandbox_state) payload.sandbox_state = entry.sandbox_state;
-    if (entry.timing) payload.timing = entry.timing;
-    if (entry.swarm) payload.swarm = entry.swarm;
-    if (entry.payload_digest) payload.payload_digest = entry.payload_digest;
-    if (entry.enrichment) payload.enrichment = entry.enrichment;
-    if (entry.action_readback) payload.action_readback = entry.action_readback;
-    if (entry.deny_iteration) payload.deny_iteration = entry.deny_iteration;
-    const result = createReceiptEnvelope(
-      payload,
-      signerState.privateKey,
-      signerState.kid,
-      Number.isFinite(entry.timestamp) ? new Date(entry.timestamp).toISOString() : void 0
-    );
-    return {
-      ok: true,
-      signed: JSON.stringify(result.envelope),
-      artifact_type: artifactType,
-      receipt_hash: result.hash
-    };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "unknown error";
-    return {
-      ok: false,
-      signed: null,
-      artifact_type: artifactType,
-      warning: `signing failed: ${message}`,
-      error: message
-    };
-  }
-}
-function getSignerInfo() {
-  if (!signerState) return null;
-  return {
-    publicKey: signerState.publicKey,
-    kid: signerState.kid,
-    issuer: signerState.issuer
-  };
-}
-function isSigningEnabled() {
-  return signingConfigured && signingInitError === null && signerState !== null;
-}
-
 // src/http-server.ts
 import { createServer } from "http";
-import { readFileSync as readFileSync3, existsSync as existsSync2 } from "fs";
+import { readFileSync, existsSync } from "fs";
 import { join } from "path";
 var LOG_FILE = ".protect-mcp-log.jsonl";
 var MAX_RECEIPTS = 100;
@@ -331,12 +95,12 @@ function handleHealth(res, startTime, config) {
 }
 function handleStatus(res, logDir) {
   const logPath = join(logDir, LOG_FILE);
-  if (!existsSync2(logPath)) {
+  if (!existsSync(logPath)) {
     res.writeHead(200);
     res.end(JSON.stringify({ entries: 0, message: "no log file yet" }));
     return;
   }
-  const raw = readFileSync3(logPath, "utf-8");
+  const raw = readFileSync(logPath, "utf-8");
   const lines = raw.trim().split("\n").filter(Boolean);
   const entries = [];
   for (const line of lines) {
@@ -460,7 +224,7 @@ function handleListApprovals(res, approvalStore) {
 }
 
 // src/action-readback.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash } from "crypto";
 var SECRET_KEY_RE = /(api[_-]?key|authorization|bearer|credential|password|secret|session|token|private[_-]?key)/i;
 var DESTINATION_KEYS = [
   "path",
@@ -540,7 +304,7 @@ function buildActionReadback(tool, input) {
     action,
     destination,
     payload_preview: payloadPreview,
-    payload_hash: createHash2("sha256").update(canonical).digest("hex"),
+    payload_hash: createHash("sha256").update(canonical).digest("hex"),
     payload_bytes: Buffer.byteLength(canonical, "utf-8"),
     disclosed_fields: [...new Set(disclosedFields)].slice(0, 80),
     redacted_fields: [...new Set(redactedFields)].slice(0, 80),
@@ -549,14 +313,6 @@ function buildActionReadback(tool, input) {
 }
 
 export {
-  loadPolicy,
-  getToolPolicy,
-  parseRateLimit,
-  checkRateLimit,
-  initSigning,
-  signDecision,
-  getSignerInfo,
-  isSigningEnabled,
   ReceiptBuffer,
   startStatusServer,
   buildActionReadback

package/dist/{chunk-MWXDXYWH.mjs → chunk-FGCNKEEW.mjs}

@@ -1,7 +1,80 @@
-// src/cedar-evaluator.ts
+import {
+  canonicalize
+} from "./chunk-XOP3PEBM.mjs";
+
+// src/policy-digest.ts
 import { createHash } from "crypto";
 import { readFileSync, readdirSync, existsSync } from "fs";
 import { join, extname } from "path";
+var POLICY_DIGEST_CONSTRUCTION = "acta-policy-digest-v1";
+var POLICY_BUNDLE_SCHEMA = "acta.policy-bundle.v1";
+var sha256hex = (data) => createHash("sha256").update(data).digest("hex");
+function digestPolicyFiles(engine, files) {
+  if (files.length === 0) throw new Error("policy digest requires at least one file");
+  const names = /* @__PURE__ */ new Set();
+  for (const f of files) {
+    if (!f.name) throw new Error("policy file entries require a name");
+    if (names.has(f.name)) throw new Error(`duplicate policy file name: ${f.name}`);
+    names.add(f.name);
+  }
+  const entries = files.map((f) => ({ name: f.name, sha256: sha256hex(Buffer.from(f.content, "utf-8")) })).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  const manifest = { construction: POLICY_DIGEST_CONSTRUCTION, engine, files: entries };
+  return {
+    policy_digest: `sha256:${sha256hex(Buffer.from(canonicalize(manifest), "utf-8"))}`,
+    construction: POLICY_DIGEST_CONSTRUCTION,
+    engine,
+    files: entries
+  };
+}
+function digestCedarDir(dirPath) {
+  if (!existsSync(dirPath)) throw new Error(`Cedar policy directory not found: ${dirPath}`);
+  const names = readdirSync(dirPath).filter((f) => extname(f) === ".cedar").sort();
+  if (names.length === 0) throw new Error(`No .cedar files found in: ${dirPath}`);
+  const files = names.map((name) => ({ name, content: readFileSync(join(dirPath, name), "utf-8") }));
+  return { ...digestPolicyFiles("cedar", files), dir: dirPath };
+}
+function digestCedarSource(source) {
+  return digestPolicyFiles("cedar", [{ name: "policy.cedar", content: source }]);
+}
+function digestBuiltinPolicy(policy) {
+  return digestPolicyFiles("builtin", [{ name: "policy.json", content: canonicalize(policy) }]);
+}
+function shortPolicyLabel(result) {
+  return `${result.engine}:${result.policy_digest.replace(/^sha256:/, "").slice(0, 16)}`;
+}
+function buildPolicyBundle(engine, files, generatedAt) {
+  const d = digestPolicyFiles(engine, files);
+  const byName = new Map(files.map((f) => [f.name, f.content]));
+  return {
+    schema: POLICY_BUNDLE_SCHEMA,
+    construction: POLICY_DIGEST_CONSTRUCTION,
+    engine,
+    policy_digest: d.policy_digest,
+    files: d.files.map((e) => ({ ...e, content: byName.get(e.name) })),
+    generated_at: generatedAt || (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function verifyPolicyBundle(bundle) {
+  try {
+    const b = bundle;
+    if (!b || b.schema !== POLICY_BUNDLE_SCHEMA) return { valid: false, error: "unknown_schema" };
+    if (b.construction !== POLICY_DIGEST_CONSTRUCTION) return { valid: false, error: "unknown_construction" };
+    if (!Array.isArray(b.files) || b.files.length === 0) return { valid: false, error: "missing_files" };
+    for (const f of b.files) {
+      if (sha256hex(Buffer.from(f.content, "utf-8")) !== f.sha256) {
+        return { valid: false, error: `file_hash_mismatch:${f.name}` };
+      }
+    }
+    const recomputed = digestPolicyFiles(b.engine, b.files.map((f) => ({ name: f.name, content: f.content }))).policy_digest;
+    return recomputed === b.policy_digest ? { valid: true, recomputed } : { valid: false, recomputed, error: "digest_mismatch" };
+  } catch (err) {
+    return { valid: false, error: `verify_error:${err instanceof Error ? err.message : "unknown"}` };
+  }
+}
+
+// src/cedar-evaluator.ts
+import { readFileSync as readFileSync2, readdirSync as readdirSync2, existsSync as existsSync2 } from "fs";
+import { join as join2, extname as extname2 } from "path";
 var cedarWasm = null;
 var loadAttempted = false;
 async function ensureCedarWasm() {
@@ -20,20 +93,19 @@ async function ensureCedarWasm() {
   }
 }
 function loadCedarPolicies(dirPath) {
-  if (!existsSync(dirPath)) {
+  if (!existsSync2(dirPath)) {
     throw new Error(`Cedar policy directory not found: ${dirPath}`);
   }
-  const entries = readdirSync(dirPath).filter((f) => extname(f) === ".cedar").sort();
+  const entries = readdirSync2(dirPath).filter((f) => extname2(f) === ".cedar").sort();
   if (entries.length === 0) {
     throw new Error(`No .cedar files found in: ${dirPath}`);
   }
-  const sources = [];
+  const files = [];
   for (const file of entries) {
-    const content = readFileSync(join(dirPath, file), "utf-8");
-    sources.push(content);
+    files.push({ name: file, content: readFileSync2(join2(dirPath, file), "utf-8") });
   }
-  const concatenated = sources.join("\n\n");
-  const digest = createHash("sha256").update(concatenated).digest("hex").slice(0, 16);
+  const concatenated = files.map((f) => f.content).join("\n\n");
+  const digest = digestPolicyFiles("cedar", files).policy_digest;
   return {
     source: concatenated,
     digest,
@@ -174,7 +246,7 @@ async function isCedarAvailable() {
   return ensureCedarWasm();
 }
 function policySetFromSource(source, name = "inline") {
-  const digest = createHash("sha256").update(source).digest("hex").slice(0, 16);
+  const digest = digestCedarSource(source).policy_digest;
   return { source, digest, fileCount: 1, files: [name] };
 }
 async function runEvaluatorSelfTest() {
@@ -202,6 +274,11 @@ async function runEvaluatorSelfTest() {
 }
 
 export {
+  digestCedarDir,
+  digestBuiltinPolicy,
+  shortPolicyLabel,
+  buildPolicyBundle,
+  verifyPolicyBundle,
   loadCedarPolicies,
   evaluateCedar,
   isCedarAvailable,

package/dist/{chunk-622KQ4KW.mjs → chunk-NQOKPBSQ.mjs}

@@ -1,16 +1,21 @@
 import {
   ReceiptBuffer,
   buildActionReadback,
+  startStatusServer
+} from "./chunk-CIWIK6BT.mjs";
+import {
   checkRateLimit,
   getToolPolicy,
   isSigningEnabled,
   parseRateLimit,
-  signDecision,
-  startStatusServer
-} from "./chunk-VWGRAUWI.mjs";
+  signDecision
+} from "./chunk-WMIWQ6TS.mjs";
 import {
   evaluateCedar
-} from "./chunk-MWXDXYWH.mjs";
+} from "./chunk-FGCNKEEW.mjs";
+import {
+  receiptHash
+} from "./chunk-XOP3PEBM.mjs";
 
 // src/evidence-store.ts
 import { readFileSync, writeFileSync, existsSync } from "fs";
@@ -589,7 +594,7 @@ function parseNotificationConfigFromEnv() {
 import { spawn } from "child_process";
 import { randomUUID, randomBytes } from "crypto";
 import { createInterface } from "readline";
-import { appendFileSync } from "fs";
+import { appendFileSync, readFileSync as readFileSync2 } from "fs";
 import { join as join2 } from "path";
 var LOG_FILE = ".protect-mcp-log.jsonl";
 var RECEIPTS_FILE = ".protect-mcp-receipts.jsonl";
@@ -600,6 +605,8 @@ var ProtectGateway = class {
   clientReader = null;
   logFilePath;
   receiptFilePath;
+  /** s5.7 hash of the last line appended to the receipt file (chain link) */
+  lastReceiptHash = null;
   evidenceStore;
   receiptBuffer;
   /** Approval grants keyed by request_id (scoped to the specific action that was requested) */
@@ -619,6 +626,11 @@ var ProtectGateway = class {
     this.config = config;
     this.logFilePath = join2(process.cwd(), LOG_FILE);
     this.receiptFilePath = join2(process.cwd(), RECEIPTS_FILE);
+    try {
+      const existing = readFileSync2(this.receiptFilePath, "utf-8").split("\n").filter((l) => l.trim());
+      if (existing.length > 0) this.lastReceiptHash = receiptHash(JSON.parse(existing[existing.length - 1]));
+    } catch {
+    }
     this.evidenceStore = new EvidenceStore();
     this.receiptBuffer = new ReceiptBuffer();
     this.notificationConfig = parseNotificationConfigFromEnv();
@@ -965,12 +977,13 @@ var ProtectGateway = class {
     } catch {
     }
     if (isSigningEnabled()) {
-      const signed = signDecision(log);
+      const signed = signDecision(log, this.lastReceiptHash || void 0);
       if (signed.signed) {
         process.stderr.write(`[PROTECT_MCP_RECEIPT] ${signed.signed}
 `);
         try {
           appendFileSync(this.receiptFilePath, signed.signed + "\n");
+          if (signed.receipt_hash) this.lastReceiptHash = signed.receipt_hash;
         } catch {
         }
         this.receiptBuffer.add(log.request_id, signed.signed);

package/dist/{chunk-HULPW5WR.mjs → chunk-SOJBLPPX.mjs}

@@ -1,6 +1,6 @@
 import {
   receiptIdentity
-} from "./chunk-3AVIMUNP.mjs";
+} from "./chunk-XOP3PEBM.mjs";
 
 // src/report.ts
 import { readFileSync, existsSync } from "fs";

package/dist/{chunk-ZLZPSUCY.mjs → chunk-UBTX3A3D.mjs}

@@ -3,7 +3,9 @@ import {
 } from "./chunk-KRKZ2YX7.mjs";
 import {
   ReceiptBuffer,
-  buildActionReadback,
+  buildActionReadback
+} from "./chunk-CIWIK6BT.mjs";
+import {
   checkRateLimit,
   getSignerInfo,
   getToolPolicy,
@@ -12,15 +14,16 @@ import {
   loadPolicy,
   parseRateLimit,
   signDecision
-} from "./chunk-VWGRAUWI.mjs";
+} from "./chunk-WMIWQ6TS.mjs";
 import {
   evaluateCedar,
   isCedarAvailable,
-  loadCedarPolicies
-} from "./chunk-MWXDXYWH.mjs";
+  loadCedarPolicies,
+  runEvaluatorSelfTest
+} from "./chunk-FGCNKEEW.mjs";
 import {
   receiptHash
-} from "./chunk-3AVIMUNP.mjs";
+} from "./chunk-XOP3PEBM.mjs";
 
 // src/hook-server.ts
 import { createServer } from "http";
@@ -824,6 +827,41 @@ async function startHookServer(options = {}) {
       }
     }
   }
+  if (enforce) {
+    const selfTest = await runEvaluatorSelfTest();
+    for (const c of selfTest.cases) {
+      if (!c.pass) {
+        process.stderr.write(
+          `[PROTECT_MCP] SELF-TEST FAIL: ${c.name} (expected ${c.expected}, got ${c.actual})
+`
+        );
+      }
+    }
+    if (!selfTest.passed) {
+      throw new Error(
+        "enforce mode refused to start: the restraint self-test failed. A gate that cannot prove it denies must not arm."
+      );
+    }
+    const receiptProbe = signDecision({
+      v: 2,
+      tool: "__protect_mcp_startup_selftest__",
+      decision: "deny",
+      reason_code: "startup_selftest",
+      policy_digest: policyDigest,
+      request_id: `selftest-${Date.now()}`,
+      mode: "enforce",
+      timestamp: Date.now()
+    });
+    if (receiptProbe.error) {
+      throw new Error(
+        `enforce mode refused to start: signing is configured but a denial receipt could not be produced (${receiptProbe.error}). An enforcing gate that cannot evidence a denial must not arm.`
+      );
+    }
+    process.stderr.write(
+      `[PROTECT_MCP] Restraint self-test passed (${selfTest.cases.length} vectors${selfTest.wasmAvailable ? "" : "; Cedar WASM absent, fail-closed invariant verified"})${receiptProbe.ok ? "; denial receipt signing verified" : ""}. Arming enforce mode.
+`
+    );
+  }
   const state = {
     cedarPolicies,
     cedarDir: cedarDir || null,