trooth 0.1.0 → 0.2.0

package/README.md

@@ -1,39 +1,87 @@
 # trooth
 
-Compliance, automated — from your terminal. Scan a Terraform plan against SOC 2, ISO 27001,
-GDPR, HIPAA, NIST AI RMF, and the EU AI Act, and get a signed Compliance Delta back.
+The trust network your terminal can check. Read any company's **witnessed** trust
+standing from the [Trooth Network](https://trooth.co). Identity, security, privacy,
+AI practices, and more, each witnessed, signed, and dated. It also scans your own Terraform
+plans against SOC 2, ISO 27001, GDPR, HIPAA, NIST AI RMF, and the EU AI Act.
 
-**Advisory and report-only. Trooth never applies changes to your infrastructure.**
+**`check` reads only public, already-published records. No key, no account.**
+**`scan` is advisory and report-only. Trooth never applies changes to your infrastructure.**
 
 ## Install / run
 
 ```bash
 # No install needed:
-npx trooth scan ./plan.tfplan
+npx trooth check stripe.com
 
-# or generate JSON yourself first:
-terraform show -json plan.tfplan > plan.json
-npx trooth scan plan.json
+# or install it:
+npm i -g trooth
+trooth check trooth.co
 ```
 
 ## Commands
 
 | Command | What it does |
 | --- | --- |
+| `trooth check <domain>` | Reads a company's witnessed standing from the live Trooth Network (`GET https://api.trooth.co/directory/api/vendors`) and prints the score, the per-discipline breakdown, live probes, attestations, and the badge / scan IDs you can verify. Returns an honest "not listed yet" when a company has no published standing. |
 | `trooth scan <plan>` | Posts your `terraform show -json` plan to Trooth Pre-Flight (`POST https://api.trooth.co/v1/preflight`) and prints the verdict, score, and findings. Accepts a JSON file or a binary `.tfplan` (it runs `terraform show -json` for you). |
+| `trooth eu ...` | Pushes EU AI Act evidence (datasets, evals, drift) into Trooth from CI/CD. Needs a session token or company id. |
 | `trooth lint [path]` | Local, read-only IaC drift check. Never transmits your code. |
 | `trooth --help` / `--version` | Help / version. |
 
+## Examples
+
+```bash
+trooth check trooth.co
+```
+
+```
+Trooth Network // witnessed · public · read-only //
+Trooth, LLC   trooth.co
+Standing: 91/100   Listed   witnessed 2026-08-30
+
+By discipline
+  Legal          ██████████  20/20
+  Security       ████████░░  16/20
+  AI governance  ██████████  19/20
+  Business       █████████░  18/20
+  IP             █████████░  18/20
+
+Live probes 64/65     Attestations 27/35
+Badge bronze_rw_...   Scan rw_...
+
+A witnessed, point-in-time reading of public evidence. Not a certification.
+```
+
+```bash
+# For scripting: raw JSON, exit code 1 when a company is not listed:
+trooth check acme.com --json
+```
+
 ## Flags
 
-- `--strict` — exit non-zero if there are findings (default: exit 0, advisory).
-- `--json` — print the raw signed Compliance Delta.
+- `--json`: print the raw JSON record instead of the formatted view.
+- `--strict`: scan only, exit non-zero if there are findings (default: exit 0, advisory).
 
 ## Notes
 
-- Only your **declared plan** is sent to the Pre-Flight API; nothing is written back, and
-  Trooth never touches live infrastructure.
+- `check` reads only the **public** witness directory. There is no key and no account, and
+  it never sends anything about you. It is a read.
+- A "not listed" result is not a judgement. It means no witnessed standing has been
+  published for that domain yet. A company gets witnessed by listing at
+  <https://trooth.co/get-started>.
+- `scan` sends only your **declared plan** to the Pre-Flight API; nothing is written back,
+  and Trooth never touches live infrastructure.
 - Set `TROOTH_API` to point at a different base URL (defaults to `https://api.trooth.co`).
 - Requires Node 18+ (uses built-in `fetch`).
 
+## Use it from an AI assistant
+
+The same public network powers Trooth's read-only MCP server, so ChatGPT, Claude, Cursor,
+or any MCP client can ask about a company in plain words:
+
+```
+https://api.trooth.co/public/mcp
+```
+
 Trooth automates. Trooth never signs for you.

package/bin/trooth.mjs

@@ -1,26 +1,29 @@
 #!/usr/bin/env node
-// Trooth CLI — `trooth`
+// Trooth CLI. Command name: `trooth`
 // Copyright (c) 2026 Trooth, LLC. All rights reserved.
 //
 // Commands:
+//   trooth check <domain>  Read a company's witnessed trust standing from the
+//                          public Trooth Network (read-only, no key, no account).
 //   trooth scan <plan>     Send a Terraform plan to Trooth Pre-Flight (advisory, report-only).
 //                          <plan> may be a `terraform show -json` JSON file, OR a binary
 //                          .tfplan (the CLI will run `terraform show -json` for you).
+//   trooth eu   ...        Push EU AI Act evidence into Trooth from CI/CD (needs a token).
 //   trooth lint [path]     Local, read-only IaC drift check (never transmits your code).
 //   trooth --help          Show help.   trooth --version  Show version.
 //
-// Pre-Flight is ADVISORY and REPORT-ONLY. Trooth never applies changes to your
-// infrastructure. The scan posts only your declared plan to the Pre-Flight API and
-// returns a signed Compliance Delta. Trooth automates. Trooth never signs for you.
+// `check` reads only PUBLIC, already-published witness records. `scan` is ADVISORY and
+// REPORT-ONLY: Trooth never applies changes to your infrastructure, and the scan posts
+// only your declared plan. Trooth automates. Trooth never signs for you.
 
 import { readFileSync, existsSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { createRequire } from 'node:module';
 
 const API = process.env.TROOTH_API || 'https://api.trooth.co';
-const J='\x1b[32m', D='\x1b[2m', B='\x1b[1m', R='\x1b[31m', A='\x1b[33m', X='\x1b[0m';
+const J='\x1b[32m', D='\x1b[2m', B='\x1b[1m', R='\x1b[31m', A='\x1b[33m', C='\x1b[36m', X='\x1b[0m';
 const require = createRequire(import.meta.url);
-let VERSION = '0.1.0';
+let VERSION = '0.2.0';
 try { VERSION = require('../package.json').version; } catch {}
 
 const argv = process.argv.slice(2);
@@ -28,40 +31,182 @@ const cmd = argv[0];
 
 function help() {
   console.log(`
-${J}${B}trooth${X} ${D}v${VERSION} — compliance, automated (advisory, report-only)${X}
+${J}${B}trooth${X} ${D}v${VERSION} · the trust network your terminal can check${X}
 
 ${B}Usage${X}
-  trooth scan <plan>        Scan a Terraform plan via Trooth Pre-Flight
+  trooth check <domain>     Read a company's witnessed standing on the Trooth Network
+  trooth scan <plan>        Scan a Terraform plan via Trooth Pre-Flight (advisory)
   trooth lint [path]        Local read-only IaC drift check
   trooth --help | --version
 
 ${B}Examples${X}
+  trooth check stripe.com                ${D}# read a company's witnessed record${X}
+  trooth check trooth.co --json          ${D}# raw JSON, for scripting${X}
   terraform show -json plan.tfplan > plan.json && trooth scan plan.json
-  trooth scan ./plan.tfplan          ${D}# runs \`terraform show -json\` for you${X}
 
 ${B}Flags${X}
-  --strict                  Exit non-zero if findings exist (default: exit 0, advisory)
-  --json                    Print raw JSON response
+  --json                    Print raw JSON instead of the formatted view
+  --strict                  (scan) exit non-zero if findings exist (default: advisory, exit 0)
 
-${D}Pre-Flight is advisory and report-only — Trooth never applies changes.
-Trooth automates. Trooth never signs for you.${X}
+${D}check reads only public, already-published witness records. No key, no account.
+scan is advisory and report-only. Trooth automates. Trooth never signs for you.${X}
 `);
 }
 
+/* --------------------------------------------------------------- check ---- */
+
+/** Normalize a domain the way the Trooth Network does: strip scheme, path,
+ *  leading www, case, and trailing slash. */
+function normalizeDomain(input) {
+  if (!input) return '';
+  let s = String(input).trim().toLowerCase();
+  s = s.replace(/^[a-z]+:\/\//, '');   // scheme
+  s = s.replace(/\/.*$/, '');          // path/query/hash
+  s = s.replace(/^www\./, '');         // leading www
+  s = s.replace(/\.$/, '');            // trailing dot
+  return s;
+}
+
+const CATEGORY_LABELS = {
+  legal: 'Legal',
+  security: 'Security',
+  ai: 'AI governance',
+  business: 'Business',
+  ip: 'IP',
+};
+
+/** Pull a 0..100 score out of the feed's score field (object or number). */
+function scorePct(score) {
+  if (score == null) return null;
+  if (typeof score === 'number') return Math.round(score);
+  if (typeof score === 'object') {
+    if (typeof score.rate === 'number') return Math.round(score.rate * 100);
+    if (typeof score.passed === 'number' && typeof score.total === 'number' && score.total > 0)
+      return Math.round((score.passed / score.total) * 100);
+  }
+  return null;
+}
+
+function bar(passed, total) {
+  if (!total) return '';
+  const filled = Math.round((passed / total) * 10);
+  return '█'.repeat(filled) + '░'.repeat(10 - filled);
+}
+
+function fmtDate(iso) {
+  if (!iso) return '';
+  const d = new Date(iso);
+  if (isNaN(d)) return String(iso);
+  return d.toISOString().slice(0, 10);
+}
+
+async function check() {
+  const domainArg = argv.find((a, i) => i > 0 && !a.startsWith('--'));
+  const asJson = argv.includes('--json');
+  const domain = normalizeDomain(domainArg);
+  if (!domain) {
+    console.error(`${R}error${X} missing <domain>. Try: trooth check stripe.com`);
+    process.exit(2);
+  }
+
+  let res;
+  try {
+    res = await fetch(`${API}/directory/api/vendors`, {
+      headers: { accept: 'application/json', 'user-agent': `trooth-cli/${VERSION}` },
+    });
+  } catch (e) {
+    console.error(`${R}error${X} could not reach the Trooth Network at ${API}: ${e.message}`);
+    process.exit(1);
+  }
+  if (!res.ok) {
+    console.error(`${R}error${X} the Trooth Network returned HTTP ${res.status}.`);
+    process.exit(1);
+  }
+  let data;
+  try { data = await res.json(); } catch { data = {}; }
+  const vendors = Array.isArray(data && data.vendors) ? data.vendors : [];
+  const vendor = vendors.find((v) => v && normalizeDomain(v.domain) === domain) || null;
+
+  if (asJson) {
+    console.log(JSON.stringify(vendor || { domain, listed: false }, null, 2));
+    process.exit(vendor ? 0 : 1);
+  }
+
+  if (!vendor) {
+    console.log(`\n${B}${domain}${X} ${D}//${X} ${A}not listed on the Trooth Network yet${X}`);
+    console.log(`\n${D}No witnessed standing has been published for this domain. That is not a`);
+    console.log(`judgement. It simply has not been witnessed. A company gets witnessed by`);
+    console.log(`listing at ${X}${C}https://trooth.co/get-started${X}${D}: the scan reads its public surface and`);
+    console.log(`publishes a signed, dated standing that anyone can check.${X}\n`);
+    process.exit(1);
+  }
+
+  const pct = scorePct(vendor.score);
+  const name = vendor.company_name || domain;
+  const tier = vendor.tier ? vendor.tier[0].toUpperCase() + vendor.tier.slice(1) : 'Listed';
+  const when = fmtDate(vendor.passed_at);
+
+  console.log(`\n${J}${B}Trooth Network${X} ${D}// witnessed · public · read-only //${X}`);
+  console.log(`${B}${name}${X}   ${C}${domain}${X}`);
+  const scoreStr = pct == null ? `${D}not yet scored${X}` : `${B}${pct}/100${X}`;
+  console.log(`Standing: ${scoreStr}   ${J}${tier}${X}${when ? `   ${D}witnessed ${when}${X}` : ''}`);
+
+  // Categories (object keyed by discipline).
+  const cats = vendor.categories;
+  if (cats && typeof cats === 'object' && !Array.isArray(cats)) {
+    console.log(`\n${B}By discipline${X}`);
+    for (const key of ['legal', 'security', 'ai', 'business', 'ip']) {
+      const c = cats[key];
+      if (!c || typeof c.total !== 'number') continue;
+      const label = (CATEGORY_LABELS[key] || key).padEnd(14);
+      const r = c.total > 0 ? c.passed / c.total : 0;
+      const col = r >= 0.9 ? J : r >= 0.5 ? A : R;
+      console.log(`  ${label} ${col}${bar(c.passed, c.total)}${X}  ${String(c.passed).padStart(2)}/${c.total}`);
+    }
+  }
+
+  const line = [];
+  if (vendor.probes && typeof vendor.probes.total === 'number')
+    line.push(`${B}Live probes${X} ${vendor.probes.passed}/${vendor.probes.total}`);
+  if (vendor.attested && typeof vendor.attested.total === 'number')
+    line.push(`${B}Attestations${X} ${vendor.attested.passed}/${vendor.attested.total}`);
+  if (line.length) console.log(`\n${line.join('     ')}`);
+
+  const ids = [];
+  if (vendor.badge_id) ids.push(`${D}Badge ${vendor.badge_id}${X}`);
+  if (vendor.scan_id) ids.push(`${D}Scan ${vendor.scan_id}${X}`);
+  if (ids.length) console.log(ids.join('   '));
+
+  const events = Array.isArray(vendor.events) ? vendor.events : [];
+  if (events.length) {
+    console.log(`\n${B}Recent witness events${X}`);
+    for (const e of events.slice(0, 3)) {
+      if (!e || !e.type) continue;
+      console.log(`  ${J}•${X} ${D}${fmtDate(e.at)}${X}  ${e.type.replace(/_/g, ' ')}${e.detail ? `${D}  ${e.detail}${X}` : ''}`);
+    }
+  }
+
+  console.log(`\n${D}A witnessed, point-in-time reading of public evidence. Not a certification.`);
+  console.log(`Full record and directory: ${X}${C}https://trooth.co/network${X}${D}   ·   Signing keys: ${API}/public/keys${X}\n`);
+  process.exit(0);
+}
+
+/* ---------------------------------------------------------------- scan ---- */
+
 function loadPlan(file) {
   if (!file) { console.error(`${R}error${X} missing <plan> argument. Try: trooth scan ./plan.json`); process.exit(2); }
   if (!existsSync(file)) { console.error(`${R}error${X} file not found: ${file}`); process.exit(2); }
   // Try to read as JSON (a `terraform show -json` document).
   let raw = '';
   try { raw = readFileSync(file, 'utf8'); } catch (e) { console.error(`${R}error${X} cannot read ${file}: ${e.message}`); process.exit(2); }
-  try { return JSON.parse(raw); } catch { /* not JSON — likely a binary .tfplan */ }
+  try { return JSON.parse(raw); } catch { /* not JSON, likely a binary .tfplan */ }
   // Fall back: ask Terraform to render the plan as JSON.
   try {
     const out = execFileSync('terraform', ['show', '-json', file], { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
     return JSON.parse(out);
   } catch (e) {
     console.error(`${R}error${X} ${file} is not JSON, and \`terraform show -json\` failed.`);
-    console.error(`${D}  Generate JSON first:  terraform show -json ${file} > plan.json  →  trooth scan plan.json${X}`);
+    console.error(`${D}  Generate JSON first:  terraform show -json ${file} > plan.json  then  trooth scan plan.json${X}`);
     process.exit(2);
   }
 }
@@ -92,7 +237,7 @@ async function scan() {
 
   if (asJson) { console.log(JSON.stringify(delta, null, 2)); process.exit(strict && (delta.summary?.fail > 0) ? 1 : 0); }
 
-  const score = delta.score ?? '–';
+  const score = delta.score ?? '-';
   const verdict = (delta.verdict || 'reviewed').toUpperCase();
   const s = delta.summary || {};
   console.log(`\n${J}${B}Trooth Pre-Flight${X} ${D}// advisory · report-only //${X}`);
@@ -116,6 +261,32 @@ async function scan() {
   process.exit(strict && (s.fail > 0) ? 1 : 0); // advisory by default: exit 0
 }
 
+/* ------------------------------------------------------------------ eu ---- */
+// `trooth eu` pushes EU AI Act evidence into Trooth from CI/CD (automated observability).
+//   trooth eu --token <t> --datasets ds.json --evals ev.json --drift dr.json
+// Each file is a JSON array. Auth: TROOTH_TOKEN env or --token (bearer or x-trooth-company).
+async function eu() {
+  const flag = (name) => { const i = argv.indexOf(name); return i >= 0 ? argv[i + 1] : null; };
+  const token = flag('--token') || process.env.TROOTH_TOKEN || '';
+  const company = flag('--company') || process.env.TROOTH_COMPANY || '';
+  if (!token && !company) { console.error(`${R}error${X} provide --token <session> or --company <id> (or TROOTH_TOKEN / TROOTH_COMPANY env).`); process.exit(2); }
+  const load = (f) => { if (!f) return undefined; try { return JSON.parse(readFileSync(f, 'utf8')); } catch (e) { console.error(`${R}error${X} cannot read ${f}: ${e.message}`); process.exit(2); } };
+  const body = { datasets: load(flag('--datasets')), evals: load(flag('--evals')), drift: load(flag('--drift')) };
+  if (!body.datasets && !body.evals && !body.drift) { console.error(`${R}error${X} provide at least one of --datasets/--evals/--drift <file.json>`); process.exit(2); }
+  const headers = { 'content-type': 'application/json', 'user-agent': `trooth-cli/${VERSION}` };
+  if (token) headers['authorization'] = `Bearer ${token}`;
+  if (company) headers['x-trooth-company'] = company;
+  let res;
+  try { res = await fetch(`${API}/v1/eu/ingest`, { method: 'POST', headers, body: JSON.stringify(body) }); }
+  catch (e) { console.error(`${R}error${X} could not reach Trooth at ${API}: ${e.message}`); process.exit(1); }
+  if (!res.ok) { console.error(`${R}error${X} HTTP ${res.status}. ${(await res.text().catch(()=> '')).slice(0,300)}`); process.exit(1); }
+  const out = await res.json();
+  console.log(`\n${J}${B}Trooth EU AI Act${X} ${D}// evidence ingested //${X}`);
+  console.log(`datasets ${B}${out.ingested?.datasets ?? 0}${X} · evals ${B}${out.ingested?.evals ?? 0}${X} · drift ${B}${out.ingested?.drift ?? 0}${X}`);
+  console.log(`\n${D}${out.disclaimer || 'Advisory. Trooth automates, computes, and documents; it never signs.'}${X}\n`);
+  process.exit(0);
+}
+
 async function lint() {
   // Local, read-only .tf drift check. Reuses the published @trooth/os linter if present,
   // otherwise runs a built-in minimal ruleset. Never transmits your code.
@@ -128,7 +299,9 @@ async function lint() {
 (async () => {
   if (cmd === '--version' || cmd === '-v') { console.log(VERSION); return; }
   if (!cmd || cmd === '--help' || cmd === '-h' || cmd === 'help') { help(); return; }
+  if (cmd === 'check') return check();
   if (cmd === 'scan') return scan();
+  if (cmd === 'eu') return eu();
   if (cmd === 'lint') return lint();
   console.error(`${R}error${X} unknown command: ${cmd}\n`); help(); process.exit(2);
 })();

package/package.json

@@ -1,11 +1,9 @@
 {
   "name": "trooth",
-  "version": "0.1.0",
-  "description": "Trooth CLI — scan your Terraform plan against SOC 2 / ISO 27001 / GDPR / HIPAA / NIST AI RMF / EU AI Act. Advisory and report-only. Trooth never applies changes.",
+  "version": "0.2.0",
+  "description": "Trooth CLI. Check any company's witnessed trust standing from your terminal (read-only, no key), and scan a Terraform plan against SOC 2 / ISO 27001 / GDPR / HIPAA / NIST AI RMF / EU AI Act. Advisory and report-only. Trooth never applies changes.",
   "type": "module",
-  "bin": {
-    "trooth": "./bin/trooth.mjs"
-  },
+  "bin": "bin/trooth.mjs",
   "files": [
     "bin/",
     "README.md"
@@ -14,6 +12,7 @@
     "node": ">=18"
   },
   "scripts": {
+    "check": "node ./bin/trooth.mjs check",
     "scan": "node ./bin/trooth.mjs scan"
   },
   "license": "MIT",
@@ -24,6 +23,13 @@
     "url": "https://github.com/trooth/trooth-cli.git"
   },
   "keywords": [
+    "trust",
+    "vendor-trust",
+    "trust-network",
+    "company-check",
+    "due-diligence",
+    "mcp",
+    "ai-agents",
     "compliance",
     "soc2",
     "iso27001",