protect-mcp 0.9.2 → 0.9.3

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.9.3: the skeptic's tools sharpen
+
+Two verification upgrades: the anchor check moves into the verifier, and the
+record viewer proves signatures instead of just labelling them.
+
+- `verify-claim` now verifies the anchor automatically: it finds the
+  `<claim>.anchor.json` sidecar, checks offline that the anchored envelope binds
+  this exact claim (digest, record root, and the same issuer key), and confirms
+  against the public log that the digest sits at the recorded entry. A failed
+  binding makes the attestation INVALID; an unreachable log does not (the local
+  checks stand alone). `--check-anchor` makes a missing anchor fatal,
+  `--anchor-file <p>` overrides the path, `--offline` skips the network hop.
+- The `record` viewer now verifies Ed25519 signatures in the browser, locally:
+  each row shows `✓ verified`, `✗ invalid signature`, or `signed · unpinned
+  key`, and the stat strip counts how many verified. The CLI injects your
+  gateway's PUBLIC key so rows verify against your own key (the private key
+  never reaches the page).
+- Receipts now embed the signer's public key inside the signed payload
+  (`payload.public_key`), so a receipt is self-contained: any verifier can check
+  it without a side channel, and the key cannot be swapped without breaking the
+  signature. Older receipts still verify against a pinned or pasted key.
+
 ## 0.9.2: anchor a claim to the public log
 
 Closes the one honest gap in a bare claim: that the disclosed set is complete.

package/README.md

@@ -148,6 +148,43 @@ disclosure, not full zero-knowledge, but it makes the privacy claim concrete:
 auditors can verify selected facts without receiving the full tool payload or
 sensitive desk context.
 
+### Prove a claim over the record (position-blind attestations)
+
+You can prove a CLAIM over your record without revealing it. Mint a signed,
+position-blind attestation over the whole record that discloses only per-decision
+categories (a receipt digest, the verdict, capability tags), never your tool
+inputs, outputs, or data:
+
+```bash
+# "No action reached the network across the record":
+npx protect-mcp claim --no net.egress
+
+# other predicates:
+#   --only fs.read,fs.write     all actions were confined to these capabilities
+#   --no-verdict blocked        no action was blocked
+#   --count blocked             how many were blocked
+```
+
+Anyone verifies it offline, seeing only the categories, never the content:
+
+```bash
+npx protect-mcp verify-claim claim-<id>.json
+```
+
+The verifier recomputes a Merkle root over the disclosed set and recomputes the
+predicate independently, so the issuer cannot lie about the claim given the
+disclosure. Add `--anchor` to record the claim's digest in the public,
+append-only ScopeBlind transparency log, so a counterparty who does not trust you
+can confirm the disclosed set is complete and was not quietly re-cut (only the
+hash is sent; the record stays local):
+
+```bash
+npx protect-mcp claim --no net.egress --anchor
+```
+
+This is an accountable, position-blind attestation, not full zero-knowledge: it
+reveals the shape, not the content.
+
 ## Claude Code hook quickstart
 
 ```bash
@@ -335,6 +372,9 @@ To report a vulnerability, see [SECURITY.md](./SECURITY.md).
 | `dashboard` | Start a local-only dashboard on `127.0.0.1` showing tool inventory, risk, policy coverage, exact-action approvals, receipt chains, and audit export. |
 | `recommend` | Draft a reviewable JSON policy from observed local calls. Dry-run by default; use `--write` to create `protect-mcp.recommended.json`. |
 | `registry` | Create an org identity, anchor receipt digests, and write a static verifier page. Hosted mode uploads digests only. |
+| `record` | Open a local, searchable viewer over your receipts (`--live` streams as the agent runs): Ed25519 signatures verified in your browser against your gateway key, capability tags, a provenance tree, and one-click signed export. All local, nothing uploaded. |
+| `claim` | Mint a signed, position-blind attestation of a predicate over the record (`--no <cap>`, `--only <c1,c2>`, `--no-verdict <verdict>`, `--count <verdict>`), disclosing only decision categories. Add `--anchor` to record the claim digest in the public transparency log. |
+| `verify-claim` | Verify a claim pack offline: signature, recomputed Merkle root, independently recomputed predicate, and the anchor sidecar when present (binds the anchored envelope to this exact claim, then confirms the public log holds it). `--check-anchor` requires the anchor; `--offline` skips the log hop. |
 | `killer-demo` | Generate a complete shadow-mode to policy to approval to signed-receipt demo pack. |
 | `verify-disclosure` | Verify a `scopeblind.selective_disclosure.v0` package and explain disclosed versus hidden fields. |
 | `policy-packs` | List, inspect, and install starter Cedar policy packs. |

package/dist/{chunk-CXW2EIRM.mjs → chunk-7MHK5RF4.mjs}

@@ -1,11 +1,11 @@
 import {
   meetsMinTier
-} from "./chunk-GHR65WVD.mjs";
+} from "./chunk-PB3TC7E3.mjs";
 import {
   checkRateLimit,
   getToolPolicy,
   parseRateLimit
-} from "./chunk-IDUH2O4Q.mjs";
+} from "./chunk-XLJUZ4WO.mjs";
 
 // src/simulate.ts
 import { readFileSync } from "fs";

package/dist/{chunk-744JMCY4.mjs → chunk-DX7QOA3E.mjs}

@@ -1,6 +1,6 @@
 import {
   buildEnrichment
-} from "./chunk-KMNXHGGT.mjs";
+} from "./chunk-HPKHMVZX.mjs";
 import {
   ReceiptBuffer,
   buildActionReadback,
@@ -15,7 +15,7 @@ import {
   loadPolicy,
   parseRateLimit,
   signDecision
-} from "./chunk-IDUH2O4Q.mjs";
+} from "./chunk-XLJUZ4WO.mjs";
 
 // src/hook-server.ts
 import { createServer } from "http";

package/dist/{chunk-KMNXHGGT.mjs → chunk-HPKHMVZX.mjs}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-D733KAPG.mjs";
 
 // src/receipt-enrichment.ts
-var ENRICHMENT_VERSION = 1;
+var ENRICHMENT_VERSION = 2;
 function canonicalJson(value) {
   const seen = /* @__PURE__ */ new WeakSet();
   const enc = (v) => {

package/dist/{chunk-GHR65WVD.mjs → chunk-PB3TC7E3.mjs}

@@ -8,7 +8,7 @@ import {
   parseRateLimit,
   signDecision,
   startStatusServer
-} from "./chunk-IDUH2O4Q.mjs";
+} from "./chunk-XLJUZ4WO.mjs";
 
 // src/evidence-store.ts
 import { readFileSync, writeFileSync, existsSync } from "fs";

package/dist/{chunk-IDUH2O4Q.mjs → chunk-XLJUZ4WO.mjs}

@@ -177,7 +177,13 @@ function signDecision(entry) {
       // - scopeblind:verified  = issued via ScopeBlind VOPRF backend (paid tier)
       // - self-signed          = signed with local Ed25519 key (free tier, protect-mcp default)
       // - uncertified          = unsigned receipt (shadow mode, no signing configured)
-      issuer_certification: signerState ? "self-signed" : "uncertified"
+      issuer_certification: signerState ? "self-signed" : "uncertified",
+      // The signer's PUBLIC key, inside the signed payload, so a receipt is
+      // self-contained: any verifier (including the record viewer, in-browser)
+      // can check the signature without a side channel. Binding the key inside
+      // the signature means it cannot be swapped without breaking the signature;
+      // authenticity (that the key is YOUR gate's) still comes from pinning it.
+      public_key: signerState.publicKey
     };
     if (entry.tier) payload.tier = entry.tier;
     if (entry.credential_ref) payload.credential_ref = entry.credential_ref;

package/dist/{claim-TUDH2WPB.mjs → claim-3EBRPP5U.mjs}

@@ -1,6 +1,6 @@
 import {
   canonicalJson
-} from "./chunk-KMNXHGGT.mjs";
+} from "./chunk-HPKHMVZX.mjs";
 import {
   sha256
 } from "./chunk-AYNQIEN7.mjs";
@@ -156,6 +156,79 @@ function buildAnchorEnvelope(pack, key, issuedAt) {
   const signature = bytesToHex(ed25519.sign(hash, hexToBytes(key.privateKey)));
   return { ...signed, signature, digest };
 }
+function verifyAnchorEnvelope(pack, envelope) {
+  const reasons = [];
+  if (!envelope || envelope.type !== "evidence_pack" || envelope.anchors !== "protect-mcp-claim") {
+    return { ok: false, reasons: ["sidecar does not contain a protect-mcp claim anchor envelope"] };
+  }
+  const expected = claimDigest(pack);
+  if (envelope.claim_digest !== expected) {
+    reasons.push("anchored envelope binds a DIFFERENT claim (claim_digest mismatch)");
+  }
+  if (envelope.record_root !== pack.record.root) {
+    reasons.push("anchored envelope commits to a different record root");
+  }
+  if (pack.issuer && envelope.verification_key !== pack.issuer.publicKey) {
+    reasons.push("anchor was signed by a different key than the claim issuer");
+  }
+  try {
+    const { signature, digest, ...signed } = envelope;
+    const hash = sha256(new TextEncoder().encode(JSON.stringify(anchorDeepSort(signed))));
+    if (bytesToHex(hash) !== String(digest).toLowerCase()) {
+      reasons.push("envelope digest does not match its contents");
+    } else if (!ed25519.verify(hexToBytes(String(signature)), hash, hexToBytes(envelope.verification_key))) {
+      reasons.push("envelope signature does not verify");
+    }
+  } catch {
+    reasons.push("envelope signature does not verify");
+  }
+  return { ok: reasons.length === 0, reasons };
+}
+async function checkClaimAnchor(pack, sidecar, opts) {
+  const reasons = [];
+  const envelope = sidecar && sidecar.envelope;
+  if (!envelope) {
+    return { local_ok: false, log_ok: null, reasons: ["sidecar has no anchor envelope"] };
+  }
+  const local = verifyAnchorEnvelope(pack, envelope);
+  reasons.push(...local.reasons);
+  const base = (sidecar.log || DEFAULT_LOG).replace(/\/+$/, "");
+  const out = {
+    local_ok: local.ok,
+    log_ok: null,
+    seq: sidecar.seq,
+    anchored_at: sidecar.anchored_at,
+    entry_url: sidecar.entry_url || (typeof sidecar.seq === "number" ? `${base}/fn/log/${sidecar.seq}` : void 0),
+    reasons
+  };
+  if (opts?.offline) return out;
+  const doFetch = opts?.fetchImpl || globalThis.fetch;
+  if (!doFetch) return out;
+  try {
+    const resp = await doFetch(`${base}/fn/log/digest/sha256:${envelope.digest}`, { headers: { accept: "application/json" } });
+    const data = await resp.json().catch(() => null);
+    if (!resp.ok || !data) {
+      out.log_ok = null;
+      return out;
+    }
+    if (data.anchored !== true) {
+      out.log_ok = false;
+      out.reasons.push("the public log does not contain this anchor digest");
+      return out;
+    }
+    if (typeof sidecar.seq === "number" && typeof data.seq === "number" && data.seq !== sidecar.seq) {
+      out.log_ok = false;
+      out.reasons.push(`log holds the digest at entry #${data.seq}, sidecar says #${sidecar.seq}`);
+      return out;
+    }
+    out.log_ok = true;
+    if (typeof data.seq === "number") out.seq = data.seq;
+    return out;
+  } catch {
+    out.log_ok = null;
+    return out;
+  }
+}
 async function anchorClaim(pack, key, opts) {
   const envelope = buildAnchorEnvelope(pack, key, opts.issuedAt);
   const base = (opts.log || DEFAULT_LOG).replace(/\/+$/, "");
@@ -192,10 +265,12 @@ export {
   anchorClaim,
   buildAnchorEnvelope,
   buildClaim,
+  checkClaimAnchor,
   claimDigest,
   evaluate,
   leafHash,
   merkleRoot,
   receiptToLeaf,
+  verifyAnchorEnvelope,
   verifyClaim
 };

package/dist/cli.js

@@ -456,7 +456,13 @@ function signDecision(entry) {
       // - scopeblind:verified  = issued via ScopeBlind VOPRF backend (paid tier)
       // - self-signed          = signed with local Ed25519 key (free tier, protect-mcp default)
       // - uncertified          = unsigned receipt (shadow mode, no signing configured)
-      issuer_certification: signerState ? "self-signed" : "uncertified"
+      issuer_certification: signerState ? "self-signed" : "uncertified",
+      // The signer's PUBLIC key, inside the signed payload, so a receipt is
+      // self-contained: any verifier (including the record viewer, in-browser)
+      // can check the signature without a side channel. Binding the key inside
+      // the signature means it cannot be swapped without breaking the signature;
+      // authenticity (that the key is YOUR gate's) still comes from pinning it.
+      public_key: signerState.publicKey
     };
     if (entry.tier) payload.tier = entry.tier;
     if (entry.credential_ref) payload.credential_ref = entry.credential_ref;
@@ -5156,7 +5162,7 @@ var init_receipt_enrichment = __esm({
     "use strict";
     init_sha256();
     init_utils();
-    ENRICHMENT_VERSION = 1;
+    ENRICHMENT_VERSION = 2;
     RULES = [
       { cap: "exec.shell", tool: /bash|shell|exec|terminal|run_command|command/ },
       { cap: "fs.read", tool: /(^|[_.])(read|cat|glob|grep|search|ls|view|list_files|open)/ },
@@ -5182,11 +5188,13 @@ __export(claim_exports, {
   anchorClaim: () => anchorClaim,
   buildAnchorEnvelope: () => buildAnchorEnvelope,
   buildClaim: () => buildClaim,
+  checkClaimAnchor: () => checkClaimAnchor,
   claimDigest: () => claimDigest,
   evaluate: () => evaluate,
   leafHash: () => leafHash,
   merkleRoot: () => merkleRoot,
   receiptToLeaf: () => receiptToLeaf,
+  verifyAnchorEnvelope: () => verifyAnchorEnvelope,
   verifyClaim: () => verifyClaim
 });
 function sha256Hex3(input) {
@@ -5327,6 +5335,79 @@ function buildAnchorEnvelope(pack, key, issuedAt) {
   const signature = bytesToHex(ed25519.sign(hash, hexToBytes(key.privateKey)));
   return { ...signed, signature, digest };
 }
+function verifyAnchorEnvelope(pack, envelope) {
+  const reasons = [];
+  if (!envelope || envelope.type !== "evidence_pack" || envelope.anchors !== "protect-mcp-claim") {
+    return { ok: false, reasons: ["sidecar does not contain a protect-mcp claim anchor envelope"] };
+  }
+  const expected = claimDigest(pack);
+  if (envelope.claim_digest !== expected) {
+    reasons.push("anchored envelope binds a DIFFERENT claim (claim_digest mismatch)");
+  }
+  if (envelope.record_root !== pack.record.root) {
+    reasons.push("anchored envelope commits to a different record root");
+  }
+  if (pack.issuer && envelope.verification_key !== pack.issuer.publicKey) {
+    reasons.push("anchor was signed by a different key than the claim issuer");
+  }
+  try {
+    const { signature, digest, ...signed } = envelope;
+    const hash = sha2562(new TextEncoder().encode(JSON.stringify(anchorDeepSort(signed))));
+    if (bytesToHex(hash) !== String(digest).toLowerCase()) {
+      reasons.push("envelope digest does not match its contents");
+    } else if (!ed25519.verify(hexToBytes(String(signature)), hash, hexToBytes(envelope.verification_key))) {
+      reasons.push("envelope signature does not verify");
+    }
+  } catch {
+    reasons.push("envelope signature does not verify");
+  }
+  return { ok: reasons.length === 0, reasons };
+}
+async function checkClaimAnchor(pack, sidecar, opts) {
+  const reasons = [];
+  const envelope = sidecar && sidecar.envelope;
+  if (!envelope) {
+    return { local_ok: false, log_ok: null, reasons: ["sidecar has no anchor envelope"] };
+  }
+  const local = verifyAnchorEnvelope(pack, envelope);
+  reasons.push(...local.reasons);
+  const base = (sidecar.log || DEFAULT_LOG).replace(/\/+$/, "");
+  const out = {
+    local_ok: local.ok,
+    log_ok: null,
+    seq: sidecar.seq,
+    anchored_at: sidecar.anchored_at,
+    entry_url: sidecar.entry_url || (typeof sidecar.seq === "number" ? `${base}/fn/log/${sidecar.seq}` : void 0),
+    reasons
+  };
+  if (opts?.offline) return out;
+  const doFetch = opts?.fetchImpl || globalThis.fetch;
+  if (!doFetch) return out;
+  try {
+    const resp = await doFetch(`${base}/fn/log/digest/sha256:${envelope.digest}`, { headers: { accept: "application/json" } });
+    const data = await resp.json().catch(() => null);
+    if (!resp.ok || !data) {
+      out.log_ok = null;
+      return out;
+    }
+    if (data.anchored !== true) {
+      out.log_ok = false;
+      out.reasons.push("the public log does not contain this anchor digest");
+      return out;
+    }
+    if (typeof sidecar.seq === "number" && typeof data.seq === "number" && data.seq !== sidecar.seq) {
+      out.log_ok = false;
+      out.reasons.push(`log holds the digest at entry #${data.seq}, sidecar says #${sidecar.seq}`);
+      return out;
+    }
+    out.log_ok = true;
+    if (typeof data.seq === "number") out.seq = data.seq;
+    return out;
+  } catch {
+    out.log_ok = null;
+    return out;
+  }
+}
 async function anchorClaim(pack, key, opts) {
   const envelope = buildAnchorEnvelope(pack, key, opts.issuedAt);
   const base = (opts.log || DEFAULT_LOG).replace(/\/+$/, "");
@@ -10563,6 +10644,16 @@ Start the gate with ${bold("npx protect-mcp serve")}, use your agent, then run t
       return null;
     }
   }).filter((x) => x !== null).map(mapRecordEntry);
+  let pinnedKey = "";
+  let pinnedKid = "";
+  try {
+    const kd = JSON.parse(readFileSync11(join8(dir, "keys", "gateway.json"), "utf-8"));
+    if (kd && typeof kd.publicKey === "string" && /^[0-9a-f]{64}$/i.test(kd.publicKey)) {
+      pinnedKey = kd.publicKey;
+      pinnedKid = typeof kd.kid === "string" ? kd.kid : "";
+    }
+  } catch {
+  }
   const openTarget = (target) => {
     if (argv.includes("--no-open")) return;
     const platform = process.platform;
@@ -10590,7 +10681,7 @@ Start the gate with ${bold("npx protect-mcp serve")}, use your agent, then run t
         res.end(JSON.stringify({ recs: recs2, signed: f === recPath }));
         return;
       }
-      const meta2 = { file: chosen, signed: pick() === recPath, count: 0, live: true };
+      const meta2 = { file: chosen, signed: pick() === recPath, count: 0, live: true, pinned_key: pinnedKey, pinned_kid: pinnedKid };
       const page = RECORD_HTML.replace("__DATA__", () => "[]").replace("__META__", () => JSON.stringify(meta2));
       res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
       res.end(page);
@@ -10615,7 +10706,7 @@ ${bold("\u{1F6E1}\uFE0F  Your record")} ${dim("\xB7")} live at ${url}
     return;
   }
   const recs = readRecs(chosen);
-  const meta = { file: chosen, signed: chosen === recPath, count: recs.length, live: false };
+  const meta = { file: chosen, signed: chosen === recPath, count: recs.length, live: false, pinned_key: pinnedKey, pinned_kid: pinnedKid };
   const html = RECORD_HTML.replace("__DATA__", () => JSON.stringify(recs)).replace("__META__", () => JSON.stringify(meta));
   const out = join8(osMod.tmpdir(), "protect-mcp-record-" + Date.now() + ".html");
   writeFileSync4(out, html);
@@ -10681,6 +10772,9 @@ input{width:100%;padding:10px 13px;border:1px solid var(--line);border-radius:9p
 .badge{font-size:10.5px;font-weight:600;padding:1px 7px;border-radius:100px}
 .badge.sgn{background:var(--gb);color:var(--g)}
 .badge.log{background:var(--paper);color:var(--faint);border:1px solid var(--line)}
+.badge.vbad{background:#fbecec;color:#b3382f;border:1px solid #edc6c2}
+.badge.vfor{background:#fbf3df;color:#8a6d1a;border:1px solid #e8d8ae}
+.stat .badk{color:#b3382f;font-weight:680}.stat .warnk{color:#8a6d1a}.stat .dim2{color:var(--faint);font-weight:400}
 .dg{font-size:10.5px;color:var(--faint);font-family:ui-monospace,Menlo,monospace}
 .when{margin-left:auto;font-size:12px;color:var(--faint);font-family:ui-monospace,Menlo,monospace}
 .det{margin-top:8px;padding-top:8px;border-top:1px solid var(--line);font-size:12px;color:var(--soft);font-family:ui-monospace,Menlo,monospace;white-space:pre-wrap;word-break:break-all;display:none}
@@ -10727,6 +10821,30 @@ input{width:100%;padding:10px 13px;border:1px solid var(--line);border-radius:9p
 </div>
 <script>
 var RECORDS=__DATA__;var META=__META__;var Q="",ACT={},VIEW="list",OPEN={};var NL=String.fromCharCode(10);
+// In-browser signature verification. Mirrors @veritasacta/artifacts exactly:
+// preimage = JCS-style canonical JSON (sorted keys) of the receipt minus its
+// signature, verified with WebCrypto Ed25519. Pinned key (your keys/gateway.json
+// public half, injected by the CLI) = authenticity; key embedded in the receipt
+// payload (0.9.3+) = self-consistency. Everything runs locally.
+var VSTATE={},VDONE=false,VBUSY=false,VUNSUP=false;
+function vkey(r){return "row:"+(r.id||"")+"|"+(r.ts||"")}
+function hexb(h){h=String(h||"");var a=new Uint8Array(h.length>>1);for(var i=0;i<a.length;i++)a[i]=parseInt(h.substr(i*2,2),16);return a}
+function canon(v){return JSON.stringify(v,function(k,x){if(x&&typeof x==="object"&&!Array.isArray(x)){var s={},ks=Object.keys(x).sort();for(var i=0;i<ks.length;i++)s[ks[i]]=x[ks[i]];return s}return x})}
+async function edv(sig,msg,pub){var key=await crypto.subtle.importKey("raw",hexb(pub),{name:"Ed25519"},false,["verify"]);return crypto.subtle.verify({name:"Ed25519"},key,hexb(sig),msg)}
+async function verifyRow(r){var raw=r.raw;if(!raw||typeof raw.signature!=="string")return"unsigned";
+var rest={},k;for(k in raw)if(k!=="signature")rest[k]=raw[k];
+var msg=new TextEncoder().encode(canon(rest));
+var pin=String(META.pinned_key||"").toLowerCase();
+var emb=String((raw.payload&&raw.payload.public_key)||raw.public_key||"").toLowerCase();
+if(!/^[0-9a-f]{64}$/.test(emb))emb="";
+if(pin){if(await edv(raw.signature,msg,pin))return"ok";if(emb&&emb!==pin&&await edv(raw.signature,msg,emb))return"foreign";return"bad"}
+if(emb)return(await edv(raw.signature,msg,emb))?"ok":"bad";
+return"nokey"}
+function vsum(){var s={ok:0,bad:0,foreign:0,nokey:0};RECORDS.forEach(function(r){if(!r.signed)return;var v=VSTATE[vkey(r)];if(v&&s[v]!==undefined)s[v]++});return s}
+async function kickVerify(){if(VBUSY||VUNSUP||!(window.crypto&&crypto.subtle))return;VBUSY=true;
+try{var rows=RECORDS.slice(0,1500);for(var i=0;i<rows.length;i++){var r=rows[i],kk=vkey(r);if(VSTATE[kk])continue;
+try{VSTATE[kk]=await verifyRow(r)}catch(e){if(e&&e.name==="NotSupportedError"){VUNSUP=true;break}VSTATE[kk]="bad"}}}
+finally{VDONE=true;VBUSY=false;render()}}
 function esc(s){return String(s).replace(/[&<>"]/g,function(c){return{"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;"}[c]})}
 function vlabel(v){return v==="allowed"?"Allowed":v==="held"?"Held":"Blocked"}
 function when(ts){if(!ts)return"";var d=new Date(ts);return d.toLocaleDateString(undefined,{month:"short",day:"numeric"})+" "+d.toLocaleTimeString(undefined,{hour:"2-digit",minute:"2-digit"})}
@@ -10740,8 +10858,9 @@ function exportJsonl(){var rows=filtered();if(!rows.length)return;var lines=rows
 function exportMd(){var rows=filtered();if(!rows.length)return;var c=counts(rows);var head=["# Agent decision record","",rows.length+" decisions from "+META.file,c.allowed+" allowed, "+c.held+" held, "+c.blocked+" blocked, "+c.signed+" signed.","","Generated locally by protect-mcp. These are signed receipts; verify offline with npx @veritasacta/verify (our code removed).","","| When | Decision | Tool | Reason | Hook | Signed |","|---|---|---|---|---|---|"];var body=rows.slice(0,3000).map(function(r){return "| "+(r.ts||"")+" | "+vlabel(r.verdict)+" | "+String(r.tool||"").replace(/\\|/g,"/")+" | "+String(r.reason||"").replace(/\\|/g,"/")+" | "+(r.hook||"")+" | "+(r.signed?"yes":"no")+" |"});dl("protect-mcp-record-"+stamp()+".md",head.concat(body).join(NL)+NL,"text/markdown")}
 function copyAttest(){var a=document.getElementById("attest");var cmd=a?a.getAttribute("data-cmd"):"";try{navigator.clipboard&&cmd&&navigator.clipboard.writeText(cmd)}catch(e){}var b=document.getElementById("cpa");if(b){var t=b.textContent;b.textContent="Copied";setTimeout(function(){b.textContent=t},1200)}}
 function copyVerify(){var cmd="npx @veritasacta/verify";try{navigator.clipboard&&navigator.clipboard.writeText(cmd)}catch(e){}var b=document.getElementById("cpv");if(b){var t=b.textContent;b.textContent="Copied";setTimeout(function(){b.textContent=t},1200)}}
-function renderStats(){var c=counts(RECORDS);var p=[];p.push('<span class="stat"><b>'+RECORDS.length+'</b> decisions</span>');p.push('<span class="stat"><span class="dot g"></span>'+c.allowed+' allowed</span>');if(c.held)p.push('<span class="stat"><span class="dot a"></span>'+c.held+' held</span>');p.push('<span class="stat"><span class="dot r"></span>'+c.blocked+' blocked</span>');p.push('<span class="stat sig">'+c.signed+' signed, verifiable offline</span>');document.getElementById("stats").innerHTML=p.join("")}
-function renderList(rows){var html="";rows.slice(0,800).forEach(function(r){var sig=r.signed?'<span class="badge sgn">signed</span>':'<span class="badge log">log</span>';var dg=r.digest?'<span class="dg">'+esc(String(r.digest).slice(0,10))+'</span>':'';var ct=(r.caps||[]).map(function(c){return '<span class="cap">'+esc(c)+'</span>'}).join('');var rk="row:"+(r.id||"")+"|"+(r.ts||"");html+='<div class="row '+r.verdict+(OPEN[rk]?" open":"")+'" data-k="'+esc(rk)+'"><div class="top"><span class="pill '+r.verdict+'">'+vlabel(r.verdict)+"</span><b>"+esc(r.tool)+'</b><span class="tag">'+esc(r.reason)+"</span>"+ct+(r.hook?'<span class="tag">'+esc(r.hook)+"</span>":"")+sig+dg+'<span class="when">'+esc(when(r.ts))+'</span></div><div class="det">'+esc(JSON.stringify(r.raw||r,null,2))+"</div></div>"});document.getElementById("list").innerHTML=html||'<p style="color:#8a837a">No records match.</p>';}
+function renderStats(){var c=counts(RECORDS);var p=[];p.push('<span class="stat"><b>'+RECORDS.length+'</b> decisions</span>');p.push('<span class="stat"><span class="dot g"></span>'+c.allowed+' allowed</span>');if(c.held)p.push('<span class="stat"><span class="dot a"></span>'+c.held+' held</span>');p.push('<span class="stat"><span class="dot r"></span>'+c.blocked+' blocked</span>');var st;if(!c.signed){st='0 signed, verifiable offline'}else if(VUNSUP||!(window.crypto&&crypto.subtle)){st=c.signed+' signed, verifiable offline <span class="dim2">(in-browser check unavailable here; run npx protect-mcp receipts)</span>'}else if(!VDONE){st=c.signed+' signed \xB7 verifying in your browser\u2026'}else{var s=vsum();st=s.ok+' of '+c.signed+' signatures verified in your browser';if(s.foreign)st+=' <span class="warnk">\xB7 '+s.foreign+' signed by an unpinned key</span>';if(s.bad)st+=' <span class="badk">\xB7 '+s.bad+' INVALID</span>';if(s.nokey)st+=' <span class="dim2">\xB7 '+s.nokey+' need a key to check</span>'}
+p.push('<span class="stat sig">'+st+'</span>');document.getElementById("stats").innerHTML=p.join("")}
+function renderList(rows){var html="";rows.slice(0,800).forEach(function(r){var vs=VSTATE[vkey(r)];var sig=!r.signed?'<span class="badge log">log</span>':vs==="ok"?'<span class="badge sgn">\u2713 verified</span>':vs==="bad"?'<span class="badge vbad">\u2717 invalid signature</span>':vs==="foreign"?'<span class="badge vfor">signed \xB7 unpinned key</span>':'<span class="badge sgn">signed</span>';var dg=r.digest?'<span class="dg">'+esc(String(r.digest).slice(0,10))+'</span>':'';var ct=(r.caps||[]).map(function(c){return '<span class="cap">'+esc(c)+'</span>'}).join('');var rk="row:"+(r.id||"")+"|"+(r.ts||"");html+='<div class="row '+r.verdict+(OPEN[rk]?" open":"")+'" data-k="'+esc(rk)+'"><div class="top"><span class="pill '+r.verdict+'">'+vlabel(r.verdict)+"</span><b>"+esc(r.tool)+'</b><span class="tag">'+esc(r.reason)+"</span>"+ct+(r.hook?'<span class="tag">'+esc(r.hook)+"</span>":"")+sig+dg+'<span class="when">'+esc(when(r.ts))+'</span></div><div class="det">'+esc(JSON.stringify(r.raw||r,null,2))+"</div></div>"});document.getElementById("list").innerHTML=html||'<p style="color:#8a837a">No records match.</p>';}
 function isLifecycle(r){var h=r.hook||"";return h==="SessionStart"||h==="SessionEnd"||h==="Stop"||h==="SubagentStart"||h==="SubagentStop"||h==="TaskCreated"||h==="TaskCompleted"||h==="ConfigChange"||h==="Notification"||h==="PreCompact";}
 function buildTree(rows){var ags={},order=[];rows.forEach(function(r){var a=r.agent||"main agent";if(!ags[a]){ags[a]={name:a,byId:{},items:[],caps:{},blocked:0,actions:0};order.push(a);}var g=ags[a];(r.caps||[]).forEach(function(c){g.caps[c]=(g.caps[c]||0)+1;});if(isLifecycle(r)){g.items.push({t:"e",ts:r.ts,r:r});return;}var id=r.id||("_"+r.ts);var n=g.byId[id];if(!n){n={t:"a",id:id,tool:r.tool,verdict:r.verdict,caps:(r.caps||[]).slice(),ts:r.ts,dur:0,signed:!!r.signed,raw:r.raw};g.byId[id]=n;g.items.push(n);g.actions++;}if(r.hook==="PostToolUse"){if(r.dur)n.dur=r.dur;if(!n.raw)n.raw=r.raw;}else{n.verdict=r.verdict;if((r.caps||[]).length)n.caps=r.caps.slice();n.raw=r.raw;n.ts=r.ts;}if(r.signed)n.signed=true;});order.forEach(function(a){var g=ags[a];g.blocked=g.items.filter(function(it){return it.t==="a"&&it.verdict==="blocked";}).length;g.items.sort(function(x,y){return (x.ts<y.ts)?-1:1;});});return order.map(function(a){return ags[a];});}
 function renderTree(ags){if(!ags.length){document.getElementById("list").innerHTML='<p style="color:#8a837a">No records match.</p>';return;}var html="",N=0;ags.forEach(function(g,gi){var capstr=Object.keys(g.caps).sort(function(a,b){return g.caps[b]-g.caps[a];}).slice(0,5).map(function(c){return '<span class="cap">'+esc(c)+'</span>';}).join('');var ak="ag:"+g.name;var op=(OPEN.hasOwnProperty(ak)?OPEN[ak]:(ags.length===1||gi===0))?" open":"";html+='<div class="agent'+op+'" data-k="'+esc(ak)+'"><div class="ahead"><span class="atwist">\u25B8</span><b>'+esc(g.name)+'</b><span class="acount">'+g.actions+' action'+(g.actions===1?'':'s')+'</span>'+(g.blocked?'<span class="badge blk">'+g.blocked+' blocked</span>':'')+capstr+'</div><div class="akids">';g.items.forEach(function(it){if(N++>1500)return;if(it.t==="e"){var r=it.r;html+='<div class="ev"><span class="evdot"></span>'+esc(r.hook||r.tool)+' <span class="evre">'+esc(r.reason)+'</span><span class="when">'+esc(when(r.ts))+'</span></div>';}else{var ct=(it.caps||[]).map(function(c){return '<span class="cap">'+esc(c)+'</span>';}).join('');var dur=it.dur?'<span class="dg">'+it.dur+'ms</span>':'';var ik="act:"+it.id;html+='<div class="act '+it.verdict+(OPEN[ik]?" open":"")+'" data-k="'+esc(ik)+'"><span class="pill '+it.verdict+'">'+vlabel(it.verdict)+'</span><b>'+esc(it.tool)+'</b>'+ct+(it.signed?'<span class="badge sgn">signed</span>':'')+dur+'<span class="when">'+esc(when(it.ts))+'</span><div class="det">'+esc(JSON.stringify(it.raw||{},null,2))+'</div></div>';}});html+='</div></div>';});if(N>1500)html+='<p style="color:#8a837a;font-size:12px;margin-top:10px">Showing the first 1500 items. Search or pick a facet to narrow.</p>';document.getElementById("list").innerHTML=html;}
@@ -10759,8 +10878,8 @@ if(VIEW==="tree"){renderTree(buildTree(rows));}else{renderList(rows);}}
 document.getElementById("q").addEventListener("input",function(e){Q=e.target.value.toLowerCase().trim();render()});
 document.getElementById("chips").addEventListener("click",function(e){var c=e.target.closest(".chip");if(!c)return;var k=c.getAttribute("data-k"),v=c.getAttribute("data-v");ACT[k]=ACT[k]===v?undefined:v;render()});
 document.getElementById("list").addEventListener("click",function(e){var ah=e.target.closest(".ahead");if(ah){var ag=ah.parentNode;ag.classList.toggle("open");var ak=ag.getAttribute("data-k");if(ak)OPEN[ak]=ag.classList.contains("open");return;}var el=e.target.closest(".act")||e.target.closest(".row");if(el){el.classList.toggle("open");var k=el.getAttribute("data-k");if(k)OPEN[k]=el.classList.contains("open");}});
-render();
-if(META.live){var poll=function(){fetch('/data',{cache:'no-store'}).then(function(r){return r.json()}).then(function(d){var nr=d.recs||[];var changed=nr.length!==RECORDS.length;RECORDS=nr;META.count=RECORDS.length;if(typeof d.signed==='boolean')META.signed=d.signed;if(changed)render()}).catch(function(){})};poll();setInterval(poll,2000);}
+render();kickVerify();
+if(META.live){var poll=function(){fetch('/data',{cache:'no-store'}).then(function(r){return r.json()}).then(function(d){var nr=d.recs||[];var changed=nr.length!==RECORDS.length;RECORDS=nr;META.count=RECORDS.length;if(typeof d.signed==='boolean')META.signed=d.signed;if(changed){render();kickVerify()}}).catch(function(){})};poll();setInterval(poll,2000);}
 </script></body></html>`;
 async function handleClaim(argv) {
   const { readFileSync: readFileSync11, existsSync: existsSync9, writeFileSync: writeFileSync4 } = await import("fs");
@@ -10946,17 +11065,64 @@ ${bold("protect-mcp verify-claim")}
 `);
   process.stdout.write(`  Predicate:  ${ok(v.predicate_ok)} ${v.predicate_ok ? "recomputed independently and matches" : "MISMATCH"}
 `);
+  const ai = argv.indexOf("--anchor-file");
+  const sidecarPath = ai !== -1 && argv[ai + 1] ? argv[ai + 1] : file.replace(/\.json$/, "") + ".anchor.json";
+  const requireAnchor = argv.includes("--check-anchor");
+  let anchorOk = true;
+  if (existsSync9(sidecarPath)) {
+    const { checkClaimAnchor: checkClaimAnchor2 } = await Promise.resolve().then(() => (init_claim(), claim_exports));
+    let sidecar = null;
+    try {
+      sidecar = JSON.parse(readFileSync11(sidecarPath, "utf-8"));
+    } catch {
+    }
+    if (!sidecar) {
+      anchorOk = false;
+      process.stdout.write(`  Anchor:     ${red("\u2717")} ${sidecarPath} is not valid JSON
+`);
+    } else {
+      const a = await checkClaimAnchor2(pack, sidecar, { offline: argv.includes("--offline") });
+      anchorOk = a.local_ok && a.log_ok !== false;
+      if (a.local_ok) {
+        process.stdout.write(`  Anchor:     ${green("\u2713")} anchored envelope binds this exact claim and its record root
+`);
+        process.stdout.write(`              ${green("\u2713")} envelope signed by the claim issuer's key
+`);
+      } else {
+        for (const r of a.reasons.slice(0, 3)) process.stdout.write(`  Anchor:     ${red("\u2717")} ${r}
+`);
+      }
+      if (a.log_ok === true) {
+        process.stdout.write(`              ${green("\u2713")} public log confirms it${typeof a.seq === "number" ? ": entry " + bold("#" + a.seq) : ""}${a.anchored_at ? dim(" \xB7 anchored " + a.anchored_at) : ""}
+`);
+      } else if (a.log_ok === false) {
+        process.stdout.write(`              ${red("\u2717")} ${a.reasons[a.reasons.length - 1]}
+`);
+      } else if (a.local_ok) {
+        process.stdout.write(`              ${yellow("~")} log not checked ${dim(argv.includes("--offline") ? "(--offline)" : "(unreachable; local binding checks stand)")}
+`);
+      }
+    }
+  } else if (requireAnchor) {
+    anchorOk = false;
+    process.stdout.write(`  Anchor:     ${red("\u2717")} no anchor sidecar at ${sidecarPath} ${dim("(mint with: protect-mcp claim ... --anchor)")}
+`);
+  } else {
+    process.stdout.write(`  Anchor:     ${dim("none found (" + sidecarPath + "). Anchoring proves the claim was fixed at a time: claim ... --anchor")}
+`);
+  }
+  const finalValid = v.valid && anchorOk;
   process.stdout.write(`
-  ${v.valid ? green("VALID") : red("INVALID")} attestation.
+  ${finalValid ? green("VALID") : red("INVALID")} attestation${v.valid && !anchorOk ? red(" (anchor check failed)") : ""}.
 `);
   process.stdout.write(`  ${dim("Proves the pack came from the issuer key and the claim is true over the disclosed decision")}
 `);
   process.stdout.write(`  ${dim("categories (verdict + capabilities), which reveal no tool inputs, outputs, or data. Completeness")}
 `);
-  process.stdout.write(`  ${dim("of the disclosed set is attested by the issuer; pin the key or anchor to the log for more.")}
+  process.stdout.write(`  ${dim("of the disclosed set is attested by the issuer; the anchor fixes it in a public append-only log.")}
 
 `);
-  process.exit(v.valid ? 0 : 1);
+  process.exit(finalValid ? 0 : 1);
 }
 async function handleBundle(argv) {
   const { readFileSync: readFileSync11, writeFileSync: writeFileSync4, existsSync: existsSync9 } = await import("fs");

package/dist/cli.mjs

@@ -11,11 +11,11 @@ import {
   readInstalledConnectorPilots,
   simulate,
   writeConnectorPilots
-} from "./chunk-CXW2EIRM.mjs";
+} from "./chunk-7MHK5RF4.mjs";
 import {
   ProtectGateway,
   validateCredentials
-} from "./chunk-GHR65WVD.mjs";
+} from "./chunk-PB3TC7E3.mjs";
 import {
   buildActionReadback,
   evaluateCedar,
@@ -26,7 +26,7 @@ import {
   policySetFromSource,
   runEvaluatorSelfTest,
   signDecision
-} from "./chunk-IDUH2O4Q.mjs";
+} from "./chunk-XLJUZ4WO.mjs";
 import "./chunk-PQJP2ZCI.mjs";
 
 // src/cli.ts
@@ -2033,6 +2033,16 @@ Start the gate with ${bold("npx protect-mcp serve")}, use your agent, then run t
       return null;
     }
   }).filter((x) => x !== null).map(mapRecordEntry);
+  let pinnedKey = "";
+  let pinnedKid = "";
+  try {
+    const kd = JSON.parse(readFileSync(join(dir, "keys", "gateway.json"), "utf-8"));
+    if (kd && typeof kd.publicKey === "string" && /^[0-9a-f]{64}$/i.test(kd.publicKey)) {
+      pinnedKey = kd.publicKey;
+      pinnedKid = typeof kd.kid === "string" ? kd.kid : "";
+    }
+  } catch {
+  }
   const openTarget = (target) => {
     if (argv.includes("--no-open")) return;
     const platform = process.platform;
@@ -2060,7 +2070,7 @@ Start the gate with ${bold("npx protect-mcp serve")}, use your agent, then run t
         res.end(JSON.stringify({ recs: recs2, signed: f === recPath }));
         return;
       }
-      const meta2 = { file: chosen, signed: pick() === recPath, count: 0, live: true };
+      const meta2 = { file: chosen, signed: pick() === recPath, count: 0, live: true, pinned_key: pinnedKey, pinned_kid: pinnedKid };
       const page = RECORD_HTML.replace("__DATA__", () => "[]").replace("__META__", () => JSON.stringify(meta2));
       res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
       res.end(page);
@@ -2085,7 +2095,7 @@ ${bold("\u{1F6E1}\uFE0F  Your record")} ${dim("\xB7")} live at ${url}
     return;
   }
   const recs = readRecs(chosen);
-  const meta = { file: chosen, signed: chosen === recPath, count: recs.length, live: false };
+  const meta = { file: chosen, signed: chosen === recPath, count: recs.length, live: false, pinned_key: pinnedKey, pinned_kid: pinnedKid };
   const html = RECORD_HTML.replace("__DATA__", () => JSON.stringify(recs)).replace("__META__", () => JSON.stringify(meta));
   const out = join(osMod.tmpdir(), "protect-mcp-record-" + Date.now() + ".html");
   writeFileSync(out, html);
@@ -2151,6 +2161,9 @@ input{width:100%;padding:10px 13px;border:1px solid var(--line);border-radius:9p
 .badge{font-size:10.5px;font-weight:600;padding:1px 7px;border-radius:100px}
 .badge.sgn{background:var(--gb);color:var(--g)}
 .badge.log{background:var(--paper);color:var(--faint);border:1px solid var(--line)}
+.badge.vbad{background:#fbecec;color:#b3382f;border:1px solid #edc6c2}
+.badge.vfor{background:#fbf3df;color:#8a6d1a;border:1px solid #e8d8ae}
+.stat .badk{color:#b3382f;font-weight:680}.stat .warnk{color:#8a6d1a}.stat .dim2{color:var(--faint);font-weight:400}
 .dg{font-size:10.5px;color:var(--faint);font-family:ui-monospace,Menlo,monospace}
 .when{margin-left:auto;font-size:12px;color:var(--faint);font-family:ui-monospace,Menlo,monospace}
 .det{margin-top:8px;padding-top:8px;border-top:1px solid var(--line);font-size:12px;color:var(--soft);font-family:ui-monospace,Menlo,monospace;white-space:pre-wrap;word-break:break-all;display:none}
@@ -2197,6 +2210,30 @@ input{width:100%;padding:10px 13px;border:1px solid var(--line);border-radius:9p
 </div>
 <script>
 var RECORDS=__DATA__;var META=__META__;var Q="",ACT={},VIEW="list",OPEN={};var NL=String.fromCharCode(10);
+// In-browser signature verification. Mirrors @veritasacta/artifacts exactly:
+// preimage = JCS-style canonical JSON (sorted keys) of the receipt minus its
+// signature, verified with WebCrypto Ed25519. Pinned key (your keys/gateway.json
+// public half, injected by the CLI) = authenticity; key embedded in the receipt
+// payload (0.9.3+) = self-consistency. Everything runs locally.
+var VSTATE={},VDONE=false,VBUSY=false,VUNSUP=false;
+function vkey(r){return "row:"+(r.id||"")+"|"+(r.ts||"")}
+function hexb(h){h=String(h||"");var a=new Uint8Array(h.length>>1);for(var i=0;i<a.length;i++)a[i]=parseInt(h.substr(i*2,2),16);return a}
+function canon(v){return JSON.stringify(v,function(k,x){if(x&&typeof x==="object"&&!Array.isArray(x)){var s={},ks=Object.keys(x).sort();for(var i=0;i<ks.length;i++)s[ks[i]]=x[ks[i]];return s}return x})}
+async function edv(sig,msg,pub){var key=await crypto.subtle.importKey("raw",hexb(pub),{name:"Ed25519"},false,["verify"]);return crypto.subtle.verify({name:"Ed25519"},key,hexb(sig),msg)}
+async function verifyRow(r){var raw=r.raw;if(!raw||typeof raw.signature!=="string")return"unsigned";
+var rest={},k;for(k in raw)if(k!=="signature")rest[k]=raw[k];
+var msg=new TextEncoder().encode(canon(rest));
+var pin=String(META.pinned_key||"").toLowerCase();
+var emb=String((raw.payload&&raw.payload.public_key)||raw.public_key||"").toLowerCase();
+if(!/^[0-9a-f]{64}$/.test(emb))emb="";
+if(pin){if(await edv(raw.signature,msg,pin))return"ok";if(emb&&emb!==pin&&await edv(raw.signature,msg,emb))return"foreign";return"bad"}
+if(emb)return(await edv(raw.signature,msg,emb))?"ok":"bad";
+return"nokey"}
+function vsum(){var s={ok:0,bad:0,foreign:0,nokey:0};RECORDS.forEach(function(r){if(!r.signed)return;var v=VSTATE[vkey(r)];if(v&&s[v]!==undefined)s[v]++});return s}
+async function kickVerify(){if(VBUSY||VUNSUP||!(window.crypto&&crypto.subtle))return;VBUSY=true;
+try{var rows=RECORDS.slice(0,1500);for(var i=0;i<rows.length;i++){var r=rows[i],kk=vkey(r);if(VSTATE[kk])continue;
+try{VSTATE[kk]=await verifyRow(r)}catch(e){if(e&&e.name==="NotSupportedError"){VUNSUP=true;break}VSTATE[kk]="bad"}}}
+finally{VDONE=true;VBUSY=false;render()}}
 function esc(s){return String(s).replace(/[&<>"]/g,function(c){return{"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;"}[c]})}
 function vlabel(v){return v==="allowed"?"Allowed":v==="held"?"Held":"Blocked"}
 function when(ts){if(!ts)return"";var d=new Date(ts);return d.toLocaleDateString(undefined,{month:"short",day:"numeric"})+" "+d.toLocaleTimeString(undefined,{hour:"2-digit",minute:"2-digit"})}
@@ -2210,8 +2247,9 @@ function exportJsonl(){var rows=filtered();if(!rows.length)return;var lines=rows
 function exportMd(){var rows=filtered();if(!rows.length)return;var c=counts(rows);var head=["# Agent decision record","",rows.length+" decisions from "+META.file,c.allowed+" allowed, "+c.held+" held, "+c.blocked+" blocked, "+c.signed+" signed.","","Generated locally by protect-mcp. These are signed receipts; verify offline with npx @veritasacta/verify (our code removed).","","| When | Decision | Tool | Reason | Hook | Signed |","|---|---|---|---|---|---|"];var body=rows.slice(0,3000).map(function(r){return "| "+(r.ts||"")+" | "+vlabel(r.verdict)+" | "+String(r.tool||"").replace(/\\|/g,"/")+" | "+String(r.reason||"").replace(/\\|/g,"/")+" | "+(r.hook||"")+" | "+(r.signed?"yes":"no")+" |"});dl("protect-mcp-record-"+stamp()+".md",head.concat(body).join(NL)+NL,"text/markdown")}
 function copyAttest(){var a=document.getElementById("attest");var cmd=a?a.getAttribute("data-cmd"):"";try{navigator.clipboard&&cmd&&navigator.clipboard.writeText(cmd)}catch(e){}var b=document.getElementById("cpa");if(b){var t=b.textContent;b.textContent="Copied";setTimeout(function(){b.textContent=t},1200)}}
 function copyVerify(){var cmd="npx @veritasacta/verify";try{navigator.clipboard&&navigator.clipboard.writeText(cmd)}catch(e){}var b=document.getElementById("cpv");if(b){var t=b.textContent;b.textContent="Copied";setTimeout(function(){b.textContent=t},1200)}}
-function renderStats(){var c=counts(RECORDS);var p=[];p.push('<span class="stat"><b>'+RECORDS.length+'</b> decisions</span>');p.push('<span class="stat"><span class="dot g"></span>'+c.allowed+' allowed</span>');if(c.held)p.push('<span class="stat"><span class="dot a"></span>'+c.held+' held</span>');p.push('<span class="stat"><span class="dot r"></span>'+c.blocked+' blocked</span>');p.push('<span class="stat sig">'+c.signed+' signed, verifiable offline</span>');document.getElementById("stats").innerHTML=p.join("")}
-function renderList(rows){var html="";rows.slice(0,800).forEach(function(r){var sig=r.signed?'<span class="badge sgn">signed</span>':'<span class="badge log">log</span>';var dg=r.digest?'<span class="dg">'+esc(String(r.digest).slice(0,10))+'</span>':'';var ct=(r.caps||[]).map(function(c){return '<span class="cap">'+esc(c)+'</span>'}).join('');var rk="row:"+(r.id||"")+"|"+(r.ts||"");html+='<div class="row '+r.verdict+(OPEN[rk]?" open":"")+'" data-k="'+esc(rk)+'"><div class="top"><span class="pill '+r.verdict+'">'+vlabel(r.verdict)+"</span><b>"+esc(r.tool)+'</b><span class="tag">'+esc(r.reason)+"</span>"+ct+(r.hook?'<span class="tag">'+esc(r.hook)+"</span>":"")+sig+dg+'<span class="when">'+esc(when(r.ts))+'</span></div><div class="det">'+esc(JSON.stringify(r.raw||r,null,2))+"</div></div>"});document.getElementById("list").innerHTML=html||'<p style="color:#8a837a">No records match.</p>';}
+function renderStats(){var c=counts(RECORDS);var p=[];p.push('<span class="stat"><b>'+RECORDS.length+'</b> decisions</span>');p.push('<span class="stat"><span class="dot g"></span>'+c.allowed+' allowed</span>');if(c.held)p.push('<span class="stat"><span class="dot a"></span>'+c.held+' held</span>');p.push('<span class="stat"><span class="dot r"></span>'+c.blocked+' blocked</span>');var st;if(!c.signed){st='0 signed, verifiable offline'}else if(VUNSUP||!(window.crypto&&crypto.subtle)){st=c.signed+' signed, verifiable offline <span class="dim2">(in-browser check unavailable here; run npx protect-mcp receipts)</span>'}else if(!VDONE){st=c.signed+' signed \xB7 verifying in your browser\u2026'}else{var s=vsum();st=s.ok+' of '+c.signed+' signatures verified in your browser';if(s.foreign)st+=' <span class="warnk">\xB7 '+s.foreign+' signed by an unpinned key</span>';if(s.bad)st+=' <span class="badk">\xB7 '+s.bad+' INVALID</span>';if(s.nokey)st+=' <span class="dim2">\xB7 '+s.nokey+' need a key to check</span>'}
+p.push('<span class="stat sig">'+st+'</span>');document.getElementById("stats").innerHTML=p.join("")}
+function renderList(rows){var html="";rows.slice(0,800).forEach(function(r){var vs=VSTATE[vkey(r)];var sig=!r.signed?'<span class="badge log">log</span>':vs==="ok"?'<span class="badge sgn">\u2713 verified</span>':vs==="bad"?'<span class="badge vbad">\u2717 invalid signature</span>':vs==="foreign"?'<span class="badge vfor">signed \xB7 unpinned key</span>':'<span class="badge sgn">signed</span>';var dg=r.digest?'<span class="dg">'+esc(String(r.digest).slice(0,10))+'</span>':'';var ct=(r.caps||[]).map(function(c){return '<span class="cap">'+esc(c)+'</span>'}).join('');var rk="row:"+(r.id||"")+"|"+(r.ts||"");html+='<div class="row '+r.verdict+(OPEN[rk]?" open":"")+'" data-k="'+esc(rk)+'"><div class="top"><span class="pill '+r.verdict+'">'+vlabel(r.verdict)+"</span><b>"+esc(r.tool)+'</b><span class="tag">'+esc(r.reason)+"</span>"+ct+(r.hook?'<span class="tag">'+esc(r.hook)+"</span>":"")+sig+dg+'<span class="when">'+esc(when(r.ts))+'</span></div><div class="det">'+esc(JSON.stringify(r.raw||r,null,2))+"</div></div>"});document.getElementById("list").innerHTML=html||'<p style="color:#8a837a">No records match.</p>';}
 function isLifecycle(r){var h=r.hook||"";return h==="SessionStart"||h==="SessionEnd"||h==="Stop"||h==="SubagentStart"||h==="SubagentStop"||h==="TaskCreated"||h==="TaskCompleted"||h==="ConfigChange"||h==="Notification"||h==="PreCompact";}
 function buildTree(rows){var ags={},order=[];rows.forEach(function(r){var a=r.agent||"main agent";if(!ags[a]){ags[a]={name:a,byId:{},items:[],caps:{},blocked:0,actions:0};order.push(a);}var g=ags[a];(r.caps||[]).forEach(function(c){g.caps[c]=(g.caps[c]||0)+1;});if(isLifecycle(r)){g.items.push({t:"e",ts:r.ts,r:r});return;}var id=r.id||("_"+r.ts);var n=g.byId[id];if(!n){n={t:"a",id:id,tool:r.tool,verdict:r.verdict,caps:(r.caps||[]).slice(),ts:r.ts,dur:0,signed:!!r.signed,raw:r.raw};g.byId[id]=n;g.items.push(n);g.actions++;}if(r.hook==="PostToolUse"){if(r.dur)n.dur=r.dur;if(!n.raw)n.raw=r.raw;}else{n.verdict=r.verdict;if((r.caps||[]).length)n.caps=r.caps.slice();n.raw=r.raw;n.ts=r.ts;}if(r.signed)n.signed=true;});order.forEach(function(a){var g=ags[a];g.blocked=g.items.filter(function(it){return it.t==="a"&&it.verdict==="blocked";}).length;g.items.sort(function(x,y){return (x.ts<y.ts)?-1:1;});});return order.map(function(a){return ags[a];});}
 function renderTree(ags){if(!ags.length){document.getElementById("list").innerHTML='<p style="color:#8a837a">No records match.</p>';return;}var html="",N=0;ags.forEach(function(g,gi){var capstr=Object.keys(g.caps).sort(function(a,b){return g.caps[b]-g.caps[a];}).slice(0,5).map(function(c){return '<span class="cap">'+esc(c)+'</span>';}).join('');var ak="ag:"+g.name;var op=(OPEN.hasOwnProperty(ak)?OPEN[ak]:(ags.length===1||gi===0))?" open":"";html+='<div class="agent'+op+'" data-k="'+esc(ak)+'"><div class="ahead"><span class="atwist">\u25B8</span><b>'+esc(g.name)+'</b><span class="acount">'+g.actions+' action'+(g.actions===1?'':'s')+'</span>'+(g.blocked?'<span class="badge blk">'+g.blocked+' blocked</span>':'')+capstr+'</div><div class="akids">';g.items.forEach(function(it){if(N++>1500)return;if(it.t==="e"){var r=it.r;html+='<div class="ev"><span class="evdot"></span>'+esc(r.hook||r.tool)+' <span class="evre">'+esc(r.reason)+'</span><span class="when">'+esc(when(r.ts))+'</span></div>';}else{var ct=(it.caps||[]).map(function(c){return '<span class="cap">'+esc(c)+'</span>';}).join('');var dur=it.dur?'<span class="dg">'+it.dur+'ms</span>':'';var ik="act:"+it.id;html+='<div class="act '+it.verdict+(OPEN[ik]?" open":"")+'" data-k="'+esc(ik)+'"><span class="pill '+it.verdict+'">'+vlabel(it.verdict)+'</span><b>'+esc(it.tool)+'</b>'+ct+(it.signed?'<span class="badge sgn">signed</span>':'')+dur+'<span class="when">'+esc(when(it.ts))+'</span><div class="det">'+esc(JSON.stringify(it.raw||{},null,2))+'</div></div>';}});html+='</div></div>';});if(N>1500)html+='<p style="color:#8a837a;font-size:12px;margin-top:10px">Showing the first 1500 items. Search or pick a facet to narrow.</p>';document.getElementById("list").innerHTML=html;}
@@ -2229,13 +2267,13 @@ if(VIEW==="tree"){renderTree(buildTree(rows));}else{renderList(rows);}}
 document.getElementById("q").addEventListener("input",function(e){Q=e.target.value.toLowerCase().trim();render()});
 document.getElementById("chips").addEventListener("click",function(e){var c=e.target.closest(".chip");if(!c)return;var k=c.getAttribute("data-k"),v=c.getAttribute("data-v");ACT[k]=ACT[k]===v?undefined:v;render()});
 document.getElementById("list").addEventListener("click",function(e){var ah=e.target.closest(".ahead");if(ah){var ag=ah.parentNode;ag.classList.toggle("open");var ak=ag.getAttribute("data-k");if(ak)OPEN[ak]=ag.classList.contains("open");return;}var el=e.target.closest(".act")||e.target.closest(".row");if(el){el.classList.toggle("open");var k=el.getAttribute("data-k");if(k)OPEN[k]=el.classList.contains("open");}});
-render();
-if(META.live){var poll=function(){fetch('/data',{cache:'no-store'}).then(function(r){return r.json()}).then(function(d){var nr=d.recs||[];var changed=nr.length!==RECORDS.length;RECORDS=nr;META.count=RECORDS.length;if(typeof d.signed==='boolean')META.signed=d.signed;if(changed)render()}).catch(function(){})};poll();setInterval(poll,2000);}
+render();kickVerify();
+if(META.live){var poll=function(){fetch('/data',{cache:'no-store'}).then(function(r){return r.json()}).then(function(d){var nr=d.recs||[];var changed=nr.length!==RECORDS.length;RECORDS=nr;META.count=RECORDS.length;if(typeof d.signed==='boolean')META.signed=d.signed;if(changed){render();kickVerify()}}).catch(function(){})};poll();setInterval(poll,2000);}
 </script></body></html>`;
 async function handleClaim(argv) {
   const { readFileSync, existsSync, writeFileSync } = await import("fs");
   const { join } = await import("path");
-  const { buildClaim } = await import("./claim-TUDH2WPB.mjs");
+  const { buildClaim } = await import("./claim-3EBRPP5U.mjs");
   let dir = process.cwd();
   const di = argv.indexOf("--dir");
   if (di !== -1 && argv[di + 1]) dir = argv[di + 1];
@@ -2336,7 +2374,7 @@ ${bold("\u{1F6E1}\uFE0F  Signed claim")}
   process.stdout.write(`  Hand it to anyone. They verify offline: ${bold("npx protect-mcp verify-claim " + out)}
 `);
   if (argv.indexOf("--anchor") !== -1) {
-    const { anchorClaim } = await import("./claim-TUDH2WPB.mjs");
+    const { anchorClaim } = await import("./claim-3EBRPP5U.mjs");
     const li = argv.indexOf("--log");
     const logBase = li !== -1 && argv[li + 1] ? argv[li + 1] : void 0;
     process.stdout.write(`
@@ -2369,7 +2407,7 @@ ${bold("\u{1F6E1}\uFE0F  Signed claim")}
 }
 async function handleVerifyClaim(argv) {
   const { readFileSync, existsSync } = await import("fs");
-  const { verifyClaim } = await import("./claim-TUDH2WPB.mjs");
+  const { verifyClaim } = await import("./claim-3EBRPP5U.mjs");
   const file = argv.find((a) => !a.startsWith("--"));
   if (!file || !existsSync(file)) {
     process.stderr.write(`
@@ -2416,17 +2454,64 @@ ${bold("protect-mcp verify-claim")}
 `);
   process.stdout.write(`  Predicate:  ${ok(v.predicate_ok)} ${v.predicate_ok ? "recomputed independently and matches" : "MISMATCH"}
 `);
+  const ai = argv.indexOf("--anchor-file");
+  const sidecarPath = ai !== -1 && argv[ai + 1] ? argv[ai + 1] : file.replace(/\.json$/, "") + ".anchor.json";
+  const requireAnchor = argv.includes("--check-anchor");
+  let anchorOk = true;
+  if (existsSync(sidecarPath)) {
+    const { checkClaimAnchor } = await import("./claim-3EBRPP5U.mjs");
+    let sidecar = null;
+    try {
+      sidecar = JSON.parse(readFileSync(sidecarPath, "utf-8"));
+    } catch {
+    }
+    if (!sidecar) {
+      anchorOk = false;
+      process.stdout.write(`  Anchor:     ${red("\u2717")} ${sidecarPath} is not valid JSON
+`);
+    } else {
+      const a = await checkClaimAnchor(pack, sidecar, { offline: argv.includes("--offline") });
+      anchorOk = a.local_ok && a.log_ok !== false;
+      if (a.local_ok) {
+        process.stdout.write(`  Anchor:     ${green("\u2713")} anchored envelope binds this exact claim and its record root
+`);
+        process.stdout.write(`              ${green("\u2713")} envelope signed by the claim issuer's key
+`);
+      } else {
+        for (const r of a.reasons.slice(0, 3)) process.stdout.write(`  Anchor:     ${red("\u2717")} ${r}
+`);
+      }
+      if (a.log_ok === true) {
+        process.stdout.write(`              ${green("\u2713")} public log confirms it${typeof a.seq === "number" ? ": entry " + bold("#" + a.seq) : ""}${a.anchored_at ? dim(" \xB7 anchored " + a.anchored_at) : ""}
+`);
+      } else if (a.log_ok === false) {
+        process.stdout.write(`              ${red("\u2717")} ${a.reasons[a.reasons.length - 1]}
+`);
+      } else if (a.local_ok) {
+        process.stdout.write(`              ${yellow("~")} log not checked ${dim(argv.includes("--offline") ? "(--offline)" : "(unreachable; local binding checks stand)")}
+`);
+      }
+    }
+  } else if (requireAnchor) {
+    anchorOk = false;
+    process.stdout.write(`  Anchor:     ${red("\u2717")} no anchor sidecar at ${sidecarPath} ${dim("(mint with: protect-mcp claim ... --anchor)")}
+`);
+  } else {
+    process.stdout.write(`  Anchor:     ${dim("none found (" + sidecarPath + "). Anchoring proves the claim was fixed at a time: claim ... --anchor")}
+`);
+  }
+  const finalValid = v.valid && anchorOk;
   process.stdout.write(`
-  ${v.valid ? green("VALID") : red("INVALID")} attestation.
+  ${finalValid ? green("VALID") : red("INVALID")} attestation${v.valid && !anchorOk ? red(" (anchor check failed)") : ""}.
 `);
   process.stdout.write(`  ${dim("Proves the pack came from the issuer key and the claim is true over the disclosed decision")}
 `);
   process.stdout.write(`  ${dim("categories (verdict + capabilities), which reveal no tool inputs, outputs, or data. Completeness")}
 `);
-  process.stdout.write(`  ${dim("of the disclosed set is attested by the issuer; pin the key or anchor to the log for more.")}
+  process.stdout.write(`  ${dim("of the disclosed set is attested by the issuer; the anchor fixes it in a public append-only log.")}
 
 `);
-  process.exit(v.valid ? 0 : 1);
+  process.exit(finalValid ? 0 : 1);
 }
 async function handleBundle(argv) {
   const { readFileSync, writeFileSync, existsSync } = await import("fs");
@@ -4121,7 +4206,7 @@ async function main() {
   if (useHttp) {
     const portIdx = args.indexOf("--port");
     const httpPort = portIdx >= 0 && args[portIdx + 1] ? parseInt(args[portIdx + 1]) : 3e3;
-    const { startHttpTransport } = await import("./http-transport-D7C64PIA.mjs");
+    const { startHttpTransport } = await import("./http-transport-HLSMVBI6.mjs");
     startHttpTransport({ port: httpPort, config, serverCommand: childCommand });
     return;
   }

package/dist/hook-server.js

@@ -307,7 +307,13 @@ function signDecision(entry) {
       // - scopeblind:verified  = issued via ScopeBlind VOPRF backend (paid tier)
       // - self-signed          = signed with local Ed25519 key (free tier, protect-mcp default)
       // - uncertified          = unsigned receipt (shadow mode, no signing configured)
-      issuer_certification: signerState ? "self-signed" : "uncertified"
+      issuer_certification: signerState ? "self-signed" : "uncertified",
+      // The signer's PUBLIC key, inside the signed payload, so a receipt is
+      // self-contained: any verifier (including the record viewer, in-browser)
+      // can check the signature without a side channel. Binding the key inside
+      // the signature means it cannot be swapped without breaking the signature;
+      // authenticity (that the key is YOUR gate's) still comes from pinning it.
+      public_key: signerState.publicKey
     };
     if (entry.tier) payload.tier = entry.tier;
     if (entry.credential_ref) payload.credential_ref = entry.credential_ref;
@@ -1039,7 +1045,7 @@ var sha256 = /* @__PURE__ */ createHasher(() => new SHA256());
 var sha2562 = sha256;
 
 // src/receipt-enrichment.ts
-var ENRICHMENT_VERSION = 1;
+var ENRICHMENT_VERSION = 2;
 function canonicalJson(value) {
   const seen = /* @__PURE__ */ new WeakSet();
   const enc = (v) => {

package/dist/hook-server.mjs

@@ -1,9 +1,9 @@
 import {
   startHookServer
-} from "./chunk-744JMCY4.mjs";
-import "./chunk-KMNXHGGT.mjs";
+} from "./chunk-DX7QOA3E.mjs";
+import "./chunk-HPKHMVZX.mjs";
 import "./chunk-AYNQIEN7.mjs";
-import "./chunk-IDUH2O4Q.mjs";
+import "./chunk-XLJUZ4WO.mjs";
 import "./chunk-JIDDQUSQ.mjs";
 import "./chunk-D733KAPG.mjs";
 import "./chunk-PQJP2ZCI.mjs";

package/dist/{http-transport-D7C64PIA.mjs → http-transport-HLSMVBI6.mjs}

@@ -1,7 +1,7 @@
 import {
   ProtectGateway
-} from "./chunk-GHR65WVD.mjs";
-import "./chunk-IDUH2O4Q.mjs";
+} from "./chunk-PB3TC7E3.mjs";
+import "./chunk-XLJUZ4WO.mjs";
 import "./chunk-PQJP2ZCI.mjs";
 
 // src/http-transport.ts

package/dist/index.d.mts

@@ -3,6 +3,16 @@ export { BUILTIN_PATTERNS, HookPattern, generateHookSettings, generateSampleCeda
 export { createSandboxServer } from './demo-server.mjs';
 import 'node:http';
 
+interface PaymentInfo {
+    /** Normalized human amount in `asset` units, when derivable; else null. */
+    amount: number | null;
+    /** Asset symbol (e.g. 'USDC') or contract address, when derivable; else null. */
+    asset: string | null;
+    /** SHA-256 (hex) of the lowercased recipient: position-blind, when present. */
+    recipient_digest: string | null;
+    /** x402 scheme ('exact' | 'upto' | ...) when present. */
+    scheme?: string;
+}
 interface ReceiptEnrichment {
     /** Rule/schema version, so derivations stay reproducible as rules evolve. */
     v: number;
@@ -15,6 +25,8 @@ interface ReceiptEnrichment {
         kind: 'path' | 'host' | 'command';
         digest: string;
     };
+    /** Minimum-disclosure facts about a value transfer (x402 / agent payment). */
+    payment?: PaymentInfo;
 }
 
 interface ProtectPolicy {

package/dist/index.d.ts

@@ -3,6 +3,16 @@ export { BUILTIN_PATTERNS, HookPattern, generateHookSettings, generateSampleCeda
 export { createSandboxServer } from './demo-server.js';
 import 'node:http';
 
+interface PaymentInfo {
+    /** Normalized human amount in `asset` units, when derivable; else null. */
+    amount: number | null;
+    /** Asset symbol (e.g. 'USDC') or contract address, when derivable; else null. */
+    asset: string | null;
+    /** SHA-256 (hex) of the lowercased recipient: position-blind, when present. */
+    recipient_digest: string | null;
+    /** x402 scheme ('exact' | 'upto' | ...) when present. */
+    scheme?: string;
+}
 interface ReceiptEnrichment {
     /** Rule/schema version, so derivations stay reproducible as rules evolve. */
     v: number;
@@ -15,6 +25,8 @@ interface ReceiptEnrichment {
         kind: 'path' | 'host' | 'command';
         digest: string;
     };
+    /** Minimum-disclosure facts about a value transfer (x402 / agent payment). */
+    payment?: PaymentInfo;
 }
 
 interface ProtectPolicy {

package/dist/index.js

@@ -35540,7 +35540,13 @@ function signDecision(entry) {
       // - scopeblind:verified  = issued via ScopeBlind VOPRF backend (paid tier)
       // - self-signed          = signed with local Ed25519 key (free tier, protect-mcp default)
       // - uncertified          = unsigned receipt (shadow mode, no signing configured)
-      issuer_certification: signerState ? "self-signed" : "uncertified"
+      issuer_certification: signerState ? "self-signed" : "uncertified",
+      // The signer's PUBLIC key, inside the signed payload, so a receipt is
+      // self-contained: any verifier (including the record viewer, in-browser)
+      // can check the signature without a side channel. Binding the key inside
+      // the signature means it cannot be swapped without breaking the signature;
+      // authenticity (that the key is YOUR gate's) still comes from pinning it.
+      public_key: signerState.publicKey
     };
     if (entry.tier) payload.tier = entry.tier;
     if (entry.credential_ref) payload.credential_ref = entry.credential_ref;
@@ -40362,7 +40368,7 @@ function forwardReceipt(signedReceipt) {
 }
 
 // src/receipt-enrichment.ts
-var ENRICHMENT_VERSION = 1;
+var ENRICHMENT_VERSION = 2;
 function canonicalJson(value) {
   const seen = /* @__PURE__ */ new WeakSet();
   const enc = (v) => {

package/dist/index.mjs

@@ -27,7 +27,7 @@ import {
   readInstalledConnectorPilots,
   simulate,
   writeConnectorPilots
-} from "./chunk-CXW2EIRM.mjs";
+} from "./chunk-7MHK5RF4.mjs";
 import {
   ProtectGateway,
   buildDecisionContext,
@@ -39,7 +39,7 @@ import {
   resolveCredential,
   sendApprovalNotification,
   validateCredentials
-} from "./chunk-GHR65WVD.mjs";
+} from "./chunk-PB3TC7E3.mjs";
 import {
   createSandboxServer
 } from "./chunk-SETXVE2K.mjs";
@@ -54,8 +54,8 @@ import {
   forwardReceipt,
   getScopeBlindBridge,
   startHookServer
-} from "./chunk-744JMCY4.mjs";
-import "./chunk-KMNXHGGT.mjs";
+} from "./chunk-DX7QOA3E.mjs";
+import "./chunk-HPKHMVZX.mjs";
 import {
   sha256 as sha2562
 } from "./chunk-AYNQIEN7.mjs";
@@ -73,7 +73,7 @@ import {
   policySetFromSource,
   runEvaluatorSelfTest,
   signDecision
-} from "./chunk-IDUH2O4Q.mjs";
+} from "./chunk-XLJUZ4WO.mjs";
 import {
   Field,
   _abool2,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "protect-mcp",
-  "version": "0.9.2",
+  "version": "0.9.3",
   "mcpName": "com.scopeblind/protect-mcp",
   "description": "Fail-closed Cedar policy gate + Ed25519 signed receipts for AI agent tool calls. Denies on any policy error, proves the gate is live with a startup self-test, and turns every decision into a local searchable record you own. The open gate behind Legate by ScopeBlind. scopeblind.com",
   "main": "dist/index.js",