trustdex 0.10.0 → 0.11.0

package/src/runtime-attestation.mjs

@@ -0,0 +1,202 @@
+import crypto from 'node:crypto';
+
+import { canonicalJson, sha256Json } from './canonical.mjs';
+import {
+  normalizeRuntimeToolInventory,
+  runtimeToolInventoryDigest
+} from './runtime-evidence.mjs';
+
+const KIND = 'agent-runtime-tool-inventory-attestation';
+const ALGORITHM = 'ed25519';
+const MAX_TTL_SECONDS = 86_400;
+const MAX_FUTURE_SKEW_SECONDS = 300;
+const FIELDS = new Set([
+  'schemaVersion', 'kind', 'algorithm', 'inventoryDigest', 'runtime', 'capturedAt',
+  'captureMethod', 'producerKeyId', 'createdAt', 'expiresAt', 'signature'
+]);
+
+function requireObject(value, message) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error(message);
+  return value;
+}
+
+function requireExactKeys(value, expected, message) {
+  const keys = Object.keys(requireObject(value, message));
+  if (keys.length !== expected.size || keys.some((key) => !expected.has(key))) throw new Error(message);
+  return value;
+}
+
+function requireDigest(value, field) {
+  if (typeof value !== 'string' || !/^[a-f0-9]{64}$/.test(value)) {
+    throw new Error(`Invalid runtime inventory attestation digest: ${field}`);
+  }
+  return value;
+}
+
+function requireTimestamp(value, field) {
+  if (typeof value !== 'string' || Number.isNaN(Date.parse(value)) ||
+      new Date(value).toISOString() !== value) {
+    throw new Error(`Invalid runtime inventory attestation timestamp: ${field}`);
+  }
+  return value;
+}
+
+function publicKeyId(publicKey) {
+  const key = publicKey?.type === 'public' ? publicKey : crypto.createPublicKey(publicKey);
+  if (key.asymmetricKeyType !== 'ed25519') {
+    throw new Error('Runtime inventory attestations require an Ed25519 key.');
+  }
+  const der = key.export({ type: 'spki', format: 'der' });
+  return crypto.createHash('sha256').update(der).digest('hex');
+}
+
+function payload(record) {
+  return {
+    schemaVersion: record.schemaVersion,
+    kind: record.kind,
+    algorithm: record.algorithm,
+    inventoryDigest: record.inventoryDigest,
+    runtime: record.runtime,
+    capturedAt: record.capturedAt,
+    captureMethod: record.captureMethod,
+    producerKeyId: record.producerKeyId,
+    createdAt: record.createdAt,
+    expiresAt: record.expiresAt
+  };
+}
+
+export function validateRuntimeInventoryAttestation(record) {
+  requireExactKeys(record, FIELDS, 'Invalid runtime inventory attestation.');
+  if (record.schemaVersion !== 1 || record.kind !== KIND || record.algorithm !== ALGORITHM) {
+    throw new Error('Unsupported runtime inventory attestation schema.');
+  }
+  requireDigest(record.inventoryDigest, 'inventoryDigest');
+  requireDigest(record.producerKeyId, 'producerKeyId');
+  if (!['claude', 'codex'].includes(record.runtime)) throw new Error('Invalid attested runtime.');
+  if (!['runtime-export', 'runtime-adapter'].includes(record.captureMethod)) {
+    throw new Error('Invalid attested capture method.');
+  }
+  requireTimestamp(record.capturedAt, 'capturedAt');
+  requireTimestamp(record.createdAt, 'createdAt');
+  requireTimestamp(record.expiresAt, 'expiresAt');
+  if (Date.parse(record.expiresAt) <= Date.parse(record.createdAt)) {
+    throw new Error('Runtime inventory attestation expiry must follow creation time.');
+  }
+  if (Date.parse(record.expiresAt) - Date.parse(record.createdAt) > MAX_TTL_SECONDS * 1000) {
+    throw new Error('Runtime inventory attestation lifetime exceeds 24 hours.');
+  }
+  if (Date.parse(record.capturedAt) > Date.parse(record.createdAt) + MAX_FUTURE_SKEW_SECONDS * 1000) {
+    throw new Error('Runtime inventory capture cannot postdate attestation creation by more than five minutes.');
+  }
+  if (typeof record.signature !== 'string' ||
+      !/^[A-Za-z0-9+/]{86}==$/.test(record.signature) ||
+      Buffer.from(record.signature, 'base64').toString('base64') !== record.signature) {
+    throw new Error('Invalid runtime inventory attestation signature.');
+  }
+  return record;
+}
+
+export function createRuntimeInventoryAttestation(inventoryInput, privateKeyPem, options = {}) {
+  const inventory = normalizeRuntimeToolInventory(inventoryInput);
+  const ttlSeconds = options.ttlSeconds === undefined ? 300 : options.ttlSeconds;
+  if (!Number.isSafeInteger(ttlSeconds) || ttlSeconds < 1 || ttlSeconds > MAX_TTL_SECONDS) {
+    throw new Error('Runtime inventory attestation TTL must be an integer from 1 to 86400 seconds.');
+  }
+  const createdAt = options.createdAt || new Date().toISOString();
+  requireTimestamp(createdAt, 'createdAt');
+  if (Date.parse(inventory.capturedAt) > Date.parse(createdAt) + MAX_FUTURE_SKEW_SECONDS * 1000) {
+    throw new Error('Runtime inventory capture cannot postdate attestation creation by more than five minutes.');
+  }
+  const expiresAt = new Date(Date.parse(createdAt) + ttlSeconds * 1000).toISOString();
+  const publicKey = crypto.createPublicKey(privateKeyPem);
+  const record = {
+    schemaVersion: 1,
+    kind: KIND,
+    algorithm: ALGORITHM,
+    inventoryDigest: runtimeToolInventoryDigest(inventory),
+    runtime: inventory.runtime,
+    capturedAt: inventory.capturedAt,
+    captureMethod: inventory.captureMethod,
+    producerKeyId: publicKeyId(publicKey),
+    createdAt,
+    expiresAt
+  };
+  const signature = crypto.sign(
+    null,
+    Buffer.from(canonicalJson(payload(record))),
+    privateKeyPem
+  );
+  return { ...record, signature: signature.toString('base64') };
+}
+
+function invalid(reason) {
+  return { valid: false, reason, producerKeyId: null, inventoryDigest: null, attestationDigest: null };
+}
+
+export function verifyRuntimeInventoryAttestation(inventoryInput, recordInput, publicKeyPem, options = {}) {
+  let inventory;
+  let record;
+  try {
+    inventory = normalizeRuntimeToolInventory(inventoryInput);
+    record = validateRuntimeInventoryAttestation(recordInput);
+  } catch (error) {
+    return invalid(error.message);
+  }
+
+  let keyId;
+  try { keyId = publicKeyId(publicKeyPem); } catch {
+    return invalid('Invalid runtime inventory attestation public key.');
+  }
+  if (record.producerKeyId !== keyId) return invalid('Runtime inventory producer key does not match.');
+  const inventoryDigest = runtimeToolInventoryDigest(inventory);
+  if (record.inventoryDigest !== inventoryDigest ||
+      record.runtime !== inventory.runtime ||
+      record.capturedAt !== inventory.capturedAt ||
+      record.captureMethod !== inventory.captureMethod) {
+    return invalid('Runtime inventory does not match its attestation.');
+  }
+
+  const nowMs = options.now === undefined ? Date.now() : Date.parse(options.now);
+  if (!Number.isFinite(nowMs)) return invalid('Invalid runtime inventory verification time.');
+  if (nowMs >= Date.parse(record.expiresAt)) return invalid('Runtime inventory attestation expired.');
+  const futureSkewSeconds = options.futureSkewSeconds === undefined
+    ? MAX_FUTURE_SKEW_SECONDS
+    : options.futureSkewSeconds;
+  if (!Number.isSafeInteger(futureSkewSeconds) || futureSkewSeconds < 0) {
+    return invalid('Invalid runtime inventory future-skew limit.');
+  }
+  if (Date.parse(record.createdAt) > nowMs + futureSkewSeconds * 1000) {
+    return invalid('Runtime inventory attestation creation time is too far in the future.');
+  }
+  if (Date.parse(inventory.capturedAt) > nowMs + futureSkewSeconds * 1000) {
+    return invalid('Runtime inventory capture time is too far in the future.');
+  }
+  if (options.maxAgeSeconds !== undefined) {
+    if (!Number.isSafeInteger(options.maxAgeSeconds) || options.maxAgeSeconds < 0) {
+      return invalid('Invalid runtime inventory maximum age.');
+    }
+    if (nowMs - Date.parse(inventory.capturedAt) > options.maxAgeSeconds * 1000) {
+      return invalid('Runtime inventory capture is too old.');
+    }
+  }
+
+  let valid = false;
+  try {
+    valid = crypto.verify(
+      null,
+      Buffer.from(canonicalJson(payload(record))),
+      publicKeyPem,
+      Buffer.from(record.signature, 'base64')
+    );
+  } catch {
+    return invalid('Runtime inventory attestation signature verification failed.');
+  }
+  if (!valid) return invalid('Runtime inventory attestation signature verification failed.');
+  return {
+    valid: true,
+    reason: null,
+    producerKeyId: keyId,
+    inventoryDigest,
+    attestationDigest: sha256Json(record)
+  };
+}

package/src/runtime-evidence.mjs

@@ -39,7 +39,7 @@ function requireTimestamp(value, field) {
   return value;
 }
 
-function normalizeInventory(input) {
+export function normalizeRuntimeToolInventory(input) {
   const inventory = requireExactKeys(input, new Set([
     'schemaVersion', 'kind', 'runtime', 'capturedAt', 'captureMethod', 'servers'
   ]), 'Invalid runtime tool inventory.');
@@ -71,6 +71,10 @@ function normalizeInventory(input) {
   };
 }
 
+export function runtimeToolInventoryDigest(input) {
+  return sha256Json(normalizeRuntimeToolInventory(input));
+}
+
 function serverStatus(binding, observed) {
   if (!binding) return 'unexpected';
   if (!observed) return 'not-observed';
@@ -95,15 +99,41 @@ function createSummary(servers) {
   };
 }
 
-function evidenceStatus(summary) {
+function baseEvidenceStatus(summary) {
   if (summary.blockedCount || summary.unexpectedCount) return 'block';
   if (summary.reviewCount) return 'needs-review';
   if (summary.notObservedCount) return 'restricted';
   return 'matched';
 }
 
+function normalizeAuthentication(input, expectedInventoryDigest) {
+  if (input === undefined || input === null) {
+    return { status: 'unverified', producerKeyId: null, attestationDigest: null };
+  }
+  requireExactKeys(input, new Set([
+    'valid', 'reason', 'producerKeyId', 'inventoryDigest', 'attestationDigest'
+  ]), 'Invalid runtime inventory authentication.');
+  if (input.valid !== true || input.reason !== null) {
+    throw new Error('Runtime inventory authentication is not verified.');
+  }
+  if (requireDigest(input.inventoryDigest, 'inventoryDigest') !== expectedInventoryDigest) {
+    throw new Error('Runtime inventory authentication digest mismatch.');
+  }
+  return {
+    status: 'verified',
+    producerKeyId: requireDigest(input.producerKeyId, 'producerKeyId'),
+    attestationDigest: requireDigest(input.attestationDigest, 'attestationDigest')
+  };
+}
+
+function evidenceStatus(summary, authentication, schemaVersion = 2) {
+  if (summary.blockedCount || summary.unexpectedCount) return 'block';
+  if (schemaVersion >= 2 && authentication.status !== 'verified') return 'needs-review';
+  return baseEvidenceStatus(summary);
+}
+
 function evidenceDigest(snapshot) {
-  return sha256Json({
+  const projected = {
     schemaVersion: snapshot.schemaVersion,
     kind: snapshot.kind,
     runtime: snapshot.runtime,
@@ -114,7 +144,13 @@ function evidenceDigest(snapshot) {
     status: snapshot.status,
     summary: snapshot.summary,
     servers: snapshot.servers
-  });
+  };
+  if (snapshot.schemaVersion >= 2) {
+    projected.inventoryAuthentication = snapshot.inventoryAuthentication;
+    projected.producerKeyId = snapshot.producerKeyId;
+    projected.attestationDigest = snapshot.attestationDigest;
+  }
+  return sha256Json(projected);
 }
 
 function inventoryFromEvidence(snapshot) {
@@ -130,9 +166,11 @@ function inventoryFromEvidence(snapshot) {
   };
 }
 
-export function createEffectiveRuntimeEvidence(bindingInput, inventoryInput) {
+export function createEffectiveRuntimeEvidence(bindingInput, inventoryInput, authenticationInput = null) {
   const bindings = validateToolPermissionBindingSnapshot(bindingInput);
-  const inventory = normalizeInventory(inventoryInput);
+  const inventory = normalizeRuntimeToolInventory(inventoryInput);
+  const inventoryDigest = runtimeToolInventoryDigest(inventory);
+  const authentication = normalizeAuthentication(authenticationInput, inventoryDigest);
   if (bindings.runtime !== inventory.runtime) {
     throw new Error('Runtime inventory does not match the binding runtime.');
   }
@@ -157,15 +195,18 @@ export function createEffectiveRuntimeEvidence(bindingInput, inventoryInput) {
   });
   const summary = createSummary(servers);
   const snapshot = {
-    schemaVersion: 1,
+    schemaVersion: 2,
     kind: KIND,
     createdAt: new Date().toISOString(),
     runtime: inventory.runtime,
     capturedAt: inventory.capturedAt,
     captureMethod: inventory.captureMethod,
     bindingDigest: bindings.digest,
-    inventoryDigest: sha256Json(inventory),
-    status: evidenceStatus(summary),
+    inventoryDigest,
+    inventoryAuthentication: authentication.status,
+    producerKeyId: authentication.producerKeyId,
+    attestationDigest: authentication.attestationDigest,
+    status: evidenceStatus(summary, authentication),
     summary,
     servers
   };
@@ -207,11 +248,15 @@ function validateServer(server) {
 }
 
 function validateEvidence(snapshot) {
-  requireExactKeys(snapshot, new Set([
+  const baseFields = [
     'schemaVersion', 'kind', 'createdAt', 'runtime', 'capturedAt', 'captureMethod',
     'bindingDigest', 'inventoryDigest', 'status', 'summary', 'servers', 'digest'
-  ]), 'Invalid effective runtime evidence snapshot.');
-  if (snapshot.schemaVersion !== 1 || snapshot.kind !== KIND) {
+  ];
+  const expectedFields = new Set(snapshot?.schemaVersion === 2
+    ? [...baseFields, 'inventoryAuthentication', 'producerKeyId', 'attestationDigest']
+    : baseFields);
+  requireExactKeys(snapshot, expectedFields, 'Invalid effective runtime evidence snapshot.');
+  if (![1, 2].includes(snapshot.schemaVersion) || snapshot.kind !== KIND) {
     throw new Error('Unsupported effective runtime evidence schema.');
   }
   if (!RUNTIMES.has(snapshot.runtime)) throw new Error('Invalid effective runtime evidence runtime.');
@@ -221,6 +266,23 @@ function validateEvidence(snapshot) {
   requireDigest(snapshot.bindingDigest, 'bindingDigest');
   requireDigest(snapshot.inventoryDigest, 'inventoryDigest');
   requireDigest(snapshot.digest, 'digest');
+  let authentication = { status: 'unverified', producerKeyId: null, attestationDigest: null };
+  if (snapshot.schemaVersion === 2) {
+    if (!['unverified', 'verified'].includes(snapshot.inventoryAuthentication)) {
+      throw new Error('Invalid runtime inventory authentication state.');
+    }
+    if (snapshot.inventoryAuthentication === 'verified') {
+      authentication = normalizeAuthentication({
+        valid: true,
+        reason: null,
+        producerKeyId: snapshot.producerKeyId,
+        inventoryDigest: snapshot.inventoryDigest,
+        attestationDigest: snapshot.attestationDigest
+      }, snapshot.inventoryDigest);
+    } else if (snapshot.producerKeyId !== null || snapshot.attestationDigest !== null) {
+      throw new Error('Unverified runtime inventory cannot retain attestation metadata.');
+    }
+  }
   if (!EVIDENCE_STATUSES.has(snapshot.status)) throw new Error('Invalid effective runtime evidence status.');
   if (!Array.isArray(snapshot.servers)) throw new Error('Effective runtime evidence is missing servers.');
   for (const server of snapshot.servers) validateServer(server);
@@ -239,7 +301,9 @@ function validateEvidence(snapshot) {
   if (snapshot.inventoryDigest !== sha256Json(inventoryFromEvidence(snapshot))) {
     throw new Error('Effective runtime inventory digest mismatch.');
   }
-  if (snapshot.status !== evidenceStatus(summary)) throw new Error('Effective runtime evidence status mismatch.');
+  if (snapshot.status !== evidenceStatus(summary, authentication, snapshot.schemaVersion)) {
+    throw new Error('Effective runtime evidence status mismatch.');
+  }
   if (snapshot.digest !== evidenceDigest(snapshot)) throw new Error('Effective runtime evidence digest mismatch.');
   return snapshot;
 }
@@ -263,6 +327,16 @@ export function diffEffectiveRuntimeEvidence(beforeInput, afterInput) {
   if (before.captureMethod !== after.captureMethod) {
     addChange(changes, 'review', 'capture-method-changed', null, 'captureMethod', before.captureMethod, after.captureMethod);
   }
+  const beforeAuthentication = before.schemaVersion === 2 ? before.inventoryAuthentication : 'unverified';
+  const afterAuthentication = after.schemaVersion === 2 ? after.inventoryAuthentication : 'unverified';
+  if (beforeAuthentication !== afterAuthentication) {
+    addChange(changes, 'review', 'inventory-authentication-changed', null, 'inventoryAuthentication', beforeAuthentication, afterAuthentication);
+  }
+  const beforeKeyId = before.schemaVersion === 2 ? before.producerKeyId : null;
+  const afterKeyId = after.schemaVersion === 2 ? after.producerKeyId : null;
+  if (beforeKeyId !== afterKeyId) {
+    addChange(changes, 'review', 'producer-key-changed', null, 'producerKeyId', beforeKeyId, afterKeyId);
+  }
 
   const left = new Map(before.servers.map((server) => [server.name, server]));
   const right = new Map(after.servers.map((server) => [server.name, server]));
@@ -306,7 +380,7 @@ export function diffEffectiveRuntimeEvidence(beforeInput, afterInput) {
     reviews: changes.filter((change) => change.impact === 'review').length
   };
   return {
-    schemaVersion: 1,
+    schemaVersion: before.schemaVersion === 2 || after.schemaVersion === 2 ? 2 : 1,
     runtime: before.runtime,
     status: summary.expansions || summary.reviews ? 'needs-review' :
       summary.restrictions ? 'restricted' : 'unchanged',