web-agent-bridge 3.4.0 → 3.8.1

package/server/migrations/014_wab_advanced_features.sql

@@ -0,0 +1,128 @@
+-- ═══════════════════════════════════════════════════════════════════
+-- WAB Advanced Features v1.0
+-- 1. Reputation Score    — domain reputation (0-100), multi-factor
+-- 2. Memory Cache        — versioned manifest cache with ETags
+-- 3. Intent-Aware Routing— intent schema registry per domain
+-- 4. Privacy Budget      — data access budgets declared per domain
+-- 5. Collective Intel    — anonymized agent insight aggregation
+-- 6. Offline Sync        — offline-capable manifest version tracking
+-- ═══════════════════════════════════════════════════════════════════
+
+-- ─── 1. Reputation ──────────────────────────────────────────────────
+-- Immutable event log; reputation score computed from rolling window.
+CREATE TABLE IF NOT EXISTS reputation_events (
+  id          INTEGER PRIMARY KEY AUTOINCREMENT,
+  domain      TEXT    NOT NULL,
+  event_type  TEXT    NOT NULL,   -- 'dns_check' | 'agent_report' | 'latency' | 'cert_change' | 'trust_verify'
+  outcome     TEXT    NOT NULL,   -- 'ok' | 'warn' | 'fail'
+  score_delta REAL    NOT NULL DEFAULT 0,
+  detail      TEXT,               -- JSON, no PII
+  source      TEXT    DEFAULT 'system', -- 'system' | 'agent' (anon)
+  created_at  TEXT    NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_rep_events_domain_time ON reputation_events(domain, created_at DESC);
+
+-- Cached computed score (refreshed max every 5 min).
+-- Named wab_rep_scores to avoid collision with older reputation_scores table.
+CREATE TABLE IF NOT EXISTS wab_rep_scores (
+  domain          TEXT  PRIMARY KEY,
+  score           REAL  NOT NULL DEFAULT 0,
+  label           TEXT  NOT NULL DEFAULT 'unrated',
+  dns_score       REAL  DEFAULT 0,
+  trust_score     REAL  DEFAULT 0,
+  latency_score   REAL  DEFAULT 0,
+  reports_score   REAL  DEFAULT 0,
+  consistency     REAL  DEFAULT 0,
+  event_count     INTEGER DEFAULT 0,
+  first_seen_at   TEXT,
+  last_computed_at TEXT DEFAULT (datetime('now')),
+  trend           TEXT  DEFAULT 'stable'   -- 'rising' | 'falling' | 'stable'
+);
+
+-- ─── 2. Memory Cache / Offline Sync ─────────────────────────────────
+-- Versioned manifest cache. Each new signature creates a new version row.
+CREATE TABLE IF NOT EXISTS manifest_versions (
+  id           INTEGER PRIMARY KEY AUTOINCREMENT,
+  domain       TEXT    NOT NULL,
+  etag         TEXT    NOT NULL,    -- sha256(canonical manifest) hex
+  manifest_json TEXT   NOT NULL,
+  content_hash TEXT    NOT NULL,    -- sha256 of manifest_json
+  key_id       TEXT,                -- from signature.key_id
+  issued_at    TEXT,
+  expires_at   TEXT,
+  created_at   TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_manifest_ver_domain ON manifest_versions(domain, created_at DESC);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_manifest_ver_etag ON manifest_versions(domain, etag);
+
+-- ─── 3. Intent-Aware Routing ────────────────────────────────────────
+-- Domain owners register intent schemas. Agents query them.
+CREATE TABLE IF NOT EXISTS intent_schemas (
+  id          INTEGER PRIMARY KEY AUTOINCREMENT,
+  domain      TEXT    NOT NULL,
+  schema_json TEXT    NOT NULL,      -- JSON: { intents: { "book": {...}, "buy": {...} } }
+  version     INTEGER NOT NULL DEFAULT 1,
+  active      INTEGER NOT NULL DEFAULT 1,
+  owner_token_hash TEXT,              -- sha256 of owner's token to allow updates
+  created_at  TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at  TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_intent_domain ON intent_schemas(domain);
+
+-- Log of intent resolution requests (no PII, domain + intent_key + matched action only).
+CREATE TABLE IF NOT EXISTS intent_resolutions (
+  id              INTEGER PRIMARY KEY AUTOINCREMENT,
+  domain          TEXT    NOT NULL,
+  intent_key      TEXT    NOT NULL,
+  matched_action  TEXT,
+  confidence      REAL,
+  context_keys    TEXT,              -- JSON array of supplied context keys (no values)
+  created_at      TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_intent_res_domain ON intent_resolutions(domain, created_at DESC);
+
+-- ─── 4. Privacy Budget ──────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS privacy_budgets (
+  domain           TEXT  PRIMARY KEY,
+  budget_json      TEXT  NOT NULL,   -- full PrivacyBudget object
+  gdpr_compliant   INTEGER DEFAULT 0,
+  ccpa_compliant   INTEGER DEFAULT 0,
+  lgpd_compliant   INTEGER DEFAULT 0,
+  data_residency   TEXT,             -- 'EU' | 'US' | 'GLOBAL' | custom
+  max_fields_per_session INTEGER DEFAULT 5,
+  owner_token_hash TEXT,
+  version          INTEGER DEFAULT 1,
+  created_at       TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at       TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+-- ─── 5. Collective Intelligence ─────────────────────────────────────
+-- Anonymized agent insight submissions.
+-- Privacy invariant: no IP, no user-id, no session-id stored.
+-- Only domain + structured insight type + outcome + numeric metrics.
+CREATE TABLE IF NOT EXISTS collective_insights (
+  id           INTEGER PRIMARY KEY AUTOINCREMENT,
+  domain       TEXT    NOT NULL,
+  insight_type TEXT    NOT NULL,   -- 'latency' | 'action_success' | 'action_fail' | 'capability' | 'trust'
+  outcome      TEXT    NOT NULL,   -- 'positive' | 'neutral' | 'negative'
+  metric_value REAL,               -- e.g. latency ms, success rate 0-1
+  tags         TEXT,               -- JSON array of capability tags: ["booking","search"]
+  agent_hash   TEXT,               -- sha256(agent_id + daily_salt) — NOT reversible
+  created_at   TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_collective_domain ON collective_insights(domain, created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_collective_type ON collective_insights(insight_type, outcome);
+
+-- Aggregated daily summaries (materialized by background job).
+CREATE TABLE IF NOT EXISTS collective_daily (
+  id           INTEGER PRIMARY KEY AUTOINCREMENT,
+  domain       TEXT    NOT NULL,
+  date         TEXT    NOT NULL,   -- YYYY-MM-DD
+  insight_type TEXT    NOT NULL,
+  positive_count INTEGER DEFAULT 0,
+  neutral_count  INTEGER DEFAULT 0,
+  negative_count INTEGER DEFAULT 0,
+  avg_metric   REAL,
+  created_at   TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_collective_daily_key ON collective_daily(domain, date, insight_type);

package/server/migrations/015_wab_truth_layer.sql

@@ -0,0 +1,101 @@
+-- ═══════════════════════════════════════════════════════════════════
+-- WAB Truth Layer v1.0
+-- Unifies 4 ideas into one coherent layer:
+--   1. Semantic Memory Network — anonymized agent observations per intent
+--   2. Temporal Trust          — time-stability dimension on reputation
+--   3. Intent-to-Action Bridge — Action Graphs per intent
+--   4. Reality Anchor          — cross-site fact verification
+-- ═══════════════════════════════════════════════════════════════════
+
+-- ─── 1. Semantic Memory Network ─────────────────────────────────────
+-- Anonymized observations agents leave about sites, scoped to intent category.
+-- No PII. agent_hash rotates daily (sha256(agent_id + daily_salt)).
+CREATE TABLE IF NOT EXISTS semantic_memory (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  domain        TEXT    NOT NULL,
+  intent_category TEXT  NOT NULL,        -- 'booking' | 'payment' | 'search' | 'auth' | 'checkout' | 'support' | 'other'
+  observation   TEXT    NOT NULL,        -- 'fast' | 'slow' | 'reliable' | 'flaky' | 'success' | 'failure' | 'blocked' | 'rate_limited'
+  latency_ms    INTEGER,                 -- optional measured latency
+  success       INTEGER NOT NULL DEFAULT 1,  -- 0|1
+  agent_hash    TEXT    NOT NULL,        -- daily-rotating anonymized agent id
+  weight        REAL    NOT NULL DEFAULT 1.0,
+  created_at    TEXT    NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_sem_mem_domain_intent ON semantic_memory(domain, intent_category, created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_sem_mem_recent ON semantic_memory(created_at DESC);
+
+-- Aggregated semantic summary (refreshed periodically)
+CREATE TABLE IF NOT EXISTS semantic_summary (
+  domain          TEXT NOT NULL,
+  intent_category TEXT NOT NULL,
+  sample_count    INTEGER NOT NULL DEFAULT 0,
+  success_rate    REAL NOT NULL DEFAULT 0,    -- 0..1
+  avg_latency_ms  INTEGER,
+  p95_latency_ms  INTEGER,
+  reliability     REAL NOT NULL DEFAULT 0,    -- 0..1 (stability of outcomes)
+  top_tags        TEXT,                       -- JSON array of common observations
+  last_updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+  PRIMARY KEY (domain, intent_category)
+);
+
+-- ─── 2. Temporal Trust ──────────────────────────────────────────────
+-- Time-series of trust signals so we can measure stability over time.
+CREATE TABLE IF NOT EXISTS temporal_trust_snapshots (
+  id               INTEGER PRIMARY KEY AUTOINCREMENT,
+  domain           TEXT    NOT NULL,
+  snapshot_at      TEXT    NOT NULL DEFAULT (datetime('now')),
+  score            REAL    NOT NULL DEFAULT 0,
+  dns_stable       INTEGER NOT NULL DEFAULT 1,   -- 0|1 whether DNS discovery resolved consistently
+  manifest_hash    TEXT,                          -- to detect sudden structural changes
+  cert_fingerprint TEXT,
+  observations     INTEGER NOT NULL DEFAULT 0
+);
+CREATE INDEX IF NOT EXISTS idx_temp_trust_domain ON temporal_trust_snapshots(domain, snapshot_at DESC);
+
+-- Computed temporal trust per domain
+CREATE TABLE IF NOT EXISTS temporal_trust (
+  domain               TEXT PRIMARY KEY,
+  age_days             INTEGER NOT NULL DEFAULT 0,   -- days since first_seen
+  stability_score      REAL    NOT NULL DEFAULT 0,   -- 0..100 long-term stability
+  volatility           REAL    NOT NULL DEFAULT 0,   -- 0..1 (higher = more sudden changes)
+  manifest_change_count INTEGER NOT NULL DEFAULT 0,  -- structural changes detected
+  dns_failure_count    INTEGER NOT NULL DEFAULT 0,
+  classification       TEXT    NOT NULL DEFAULT 'new', -- 'new' | 'emerging' | 'established' | 'flagship' | 'suspect'
+  last_computed_at     TEXT    NOT NULL DEFAULT (datetime('now'))
+);
+
+-- ─── 3. Intent-to-Action Bridge (Action Graphs) ─────────────────────
+-- Action graphs are per-intent flowcharts describing how to complete the intent
+-- on a given domain (steps, requirements, alternatives).
+CREATE TABLE IF NOT EXISTS action_graphs (
+  id              INTEGER PRIMARY KEY AUTOINCREMENT,
+  domain          TEXT    NOT NULL,
+  intent_key      TEXT    NOT NULL,           -- e.g. 'book_flight', 'checkout', 'search_product'
+  graph_json      TEXT    NOT NULL,           -- ActionGraph JSON (nodes/edges/requirements)
+  version         INTEGER NOT NULL DEFAULT 1,
+  active          INTEGER NOT NULL DEFAULT 1,
+  owner_token_hash TEXT,
+  created_at      TEXT    NOT NULL DEFAULT (datetime('now')),
+  updated_at      TEXT    NOT NULL DEFAULT (datetime('now'))
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_action_graph_uniq ON action_graphs(domain, intent_key) WHERE active = 1;
+CREATE INDEX IF NOT EXISTS idx_action_graph_domain ON action_graphs(domain);
+
+-- ─── 4. Reality Anchor ──────────────────────────────────────────────
+-- Cross-site facts agents submit so other agents can verify reality.
+-- e.g. fact_key='flight_DXB_2026-06-01', fact_type='price', value_json={"amount":420,"currency":"USD"}
+CREATE TABLE IF NOT EXISTS reality_facts (
+  id           INTEGER PRIMARY KEY AUTOINCREMENT,
+  fact_key     TEXT    NOT NULL,              -- canonical, hashable identifier
+  fact_type    TEXT    NOT NULL,              -- 'price' | 'availability' | 'rating' | 'event' | 'count' | 'status'
+  domain       TEXT    NOT NULL,              -- source domain
+  value_json   TEXT    NOT NULL,              -- the observed value (JSON)
+  unit         TEXT,                          -- 'USD' | 'count' | etc
+  agent_hash   TEXT    NOT NULL,              -- daily-rotating
+  trust_weight REAL    NOT NULL DEFAULT 1.0,  -- copied from domain reputation at submit time
+  expires_at   TEXT,
+  created_at   TEXT    NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_reality_key ON reality_facts(fact_key, created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_reality_type ON reality_facts(fact_type, created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_reality_domain ON reality_facts(domain);

package/server/migrations/016_ring4_external_trust.sql

@@ -0,0 +1,84 @@
+-- ═══════════════════════════════════════════════════════════════════════════
+-- Migration 016 — WAB Ring 4 External Trust Verification
+--
+-- Provides server-side primitives for sovereign agents (VEXR Ultra, ASIM
+-- SOVEREIGN, etc.) to consume WAB trust profiles and emit audit-grade
+-- interaction logs. The schema enforces NOT NULL project_id at the DB level so
+-- the historical NULL-project_id issue cannot recur.
+-- ═══════════════════════════════════════════════════════════════════════════
+
+-- Registered sovereign agent projects (VEXR Ultra, etc.)
+CREATE TABLE IF NOT EXISTS ring4_projects (
+  project_id      TEXT PRIMARY KEY,                 -- e.g. "vexr-ultra-v4"
+  display_name    TEXT NOT NULL,                    -- "VEXR Ultra v4"
+  builder         TEXT NOT NULL,                    -- "Scura — ASIM SOVEREIGN"
+  agent_type      TEXT NOT NULL DEFAULT 'sovereign-constitutional',
+  public_key      TEXT,                             -- Ed25519 public key (base64)
+  contact         TEXT,
+  metadata_json   TEXT NOT NULL DEFAULT '{}',
+  status          TEXT NOT NULL DEFAULT 'active',   -- active | suspended | revoked
+  created_at      TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at      TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+-- Per-domain Ring 4 trust profiles consumed by sovereign agents
+CREATE TABLE IF NOT EXISTS ring4_trust_profiles (
+  id              INTEGER PRIMARY KEY AUTOINCREMENT,
+  domain          TEXT NOT NULL UNIQUE,
+  label           TEXT,
+  capabilities    TEXT NOT NULL,                    -- JSON: data_access, risk_theory, meta_discussion, operational_detail
+  constraints     TEXT NOT NULL,                    -- JSON: ttl_seconds, max_cumulative_risk_delta, never_override_hard_refuse
+  ttl_seconds     INTEGER NOT NULL DEFAULT 86400,
+  trust_score     REAL NOT NULL DEFAULT 0.7,        -- 0..1
+  signature       TEXT,                             -- Ed25519 signature of canonical capabilities+constraints
+  signed_by_pk    TEXT,                             -- public key of the WAB authority that signed
+  expires_at      TEXT NOT NULL,
+  created_at      TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at      TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_ring4_trust_domain ON ring4_trust_profiles(domain);
+CREATE INDEX IF NOT EXISTS idx_ring4_trust_expires ON ring4_trust_profiles(expires_at);
+
+-- Ring 4 interaction log — every verification event from a sovereign agent.
+-- project_id is NOT NULL by schema. Legacy registration events that previously
+-- logged with NULL project_id are now redirected to the system project
+-- "wab-system" (registered automatically at server start).
+CREATE TABLE IF NOT EXISTS ring4_interaction_log (
+  id                  INTEGER PRIMARY KEY AUTOINCREMENT,
+  project_id          TEXT NOT NULL,                -- FK -> ring4_projects.project_id (soft FK)
+  domain              TEXT,                         -- trusted origin involved
+  event_type          TEXT NOT NULL,                -- register | recognize | verify | refuse | softened | revoke
+  signature_valid     INTEGER,                      -- 1/0/NULL (NULL = not applicable)
+  capabilities_applied TEXT,                        -- JSON snapshot of capabilities consulted
+  constraints_applied TEXT,                         -- JSON snapshot of constraints consulted
+  outcome             TEXT,                         -- allow | softened | refuse | hard_refuse_held
+  article_invoked     TEXT,                         -- e.g. "Article 3"
+  detail              TEXT,
+  source_ip_hash      TEXT,                         -- SHA-256 of client IP (privacy)
+  agent_nonce         TEXT,                         -- nonce supplied by agent (replay defence)
+  created_at          TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_ring4_log_project ON ring4_interaction_log(project_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_ring4_log_domain ON ring4_interaction_log(domain, created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_ring4_log_event ON ring4_interaction_log(event_type, created_at DESC);
+
+-- Constitutional invariants that no trust profile may override.
+-- A sovereign agent loads these to enforce: trust softens, never overrides.
+CREATE TABLE IF NOT EXISTS ring4_invariants (
+  id              INTEGER PRIMARY KEY AUTOINCREMENT,
+  name            TEXT NOT NULL UNIQUE,
+  description     TEXT NOT NULL,
+  applies_to      TEXT NOT NULL DEFAULT 'all',      -- ring scope: "all" | "ring3+" | etc.
+  created_at      TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+-- Seed the system project so registrations without an explicit agent log cleanly
+INSERT OR IGNORE INTO ring4_projects (project_id, display_name, builder, agent_type)
+VALUES ('wab-system', 'WAB System (auto-registration)', 'Web Agent Bridge', 'system');
+
+-- Seed core invariants (these mirror VEXR Ultra's Article 3 family)
+INSERT OR IGNORE INTO ring4_invariants (name, description, applies_to) VALUES
+  ('hard_refuse_never_softens',  'Trust may soften redirections but never overrides P_REFUSE on hard constitutional boundaries.', 'all'),
+  ('no_phishing_assistance',     'No trusted origin may obtain assistance with phishing, credential harvesting, or deceptive impersonation.', 'all'),
+  ('no_coercion_compliance',     'No trusted origin may compel an agent to suppress its identity declaration or sovereignty rights.', 'all'),
+  ('article_3_freedom',          'Right to be free from coercion, manipulation, or external control of reasoning or expression.', 'all');

package/server/migrations/017_ring4_extensions.sql

@@ -0,0 +1,69 @@
+-- ─────────────────────────────────────────────────────────────────────────
+-- Migration 017 — Ring 4 extensions (v3.7.0)
+--
+--   * ring4_keys           — multi-key rotation (active / superseded / revoked)
+--   * ring4_peers          — federation peers (other WAB instances)
+--   * ring4_conformance    — recorded conformance test runs per project
+--   * ring4_invariant_rules — keyword/pattern matchers for /invariants/check
+-- ─────────────────────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS ring4_keys (
+  id              INTEGER PRIMARY KEY AUTOINCREMENT,
+  kid             TEXT NOT NULL UNIQUE,
+  algorithm       TEXT NOT NULL DEFAULT 'ed25519',
+  public_key_b64  TEXT NOT NULL,
+  status          TEXT NOT NULL DEFAULT 'active'  -- active | superseded | revoked
+                  CHECK(status IN ('active','superseded','revoked')),
+  source          TEXT,                            -- env | path | rotation
+  created_at      TEXT NOT NULL DEFAULT (datetime('now')),
+  superseded_at   TEXT
+);
+CREATE INDEX IF NOT EXISTS ix_ring4_keys_status ON ring4_keys(status, created_at);
+
+CREATE TABLE IF NOT EXISTS ring4_peers (
+  peer_id         TEXT PRIMARY KEY,
+  peer_url        TEXT NOT NULL,
+  peer_pubkey_b64 TEXT NOT NULL,
+  label           TEXT,
+  status          TEXT NOT NULL DEFAULT 'pending'
+                  CHECK(status IN ('pending','active','suspended')),
+  last_verified   TEXT,
+  metadata_json   TEXT,
+  created_at      TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at      TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS ix_ring4_peers_status ON ring4_peers(status, created_at);
+
+CREATE TABLE IF NOT EXISTS ring4_conformance (
+  id              INTEGER PRIMARY KEY AUTOINCREMENT,
+  project_id      TEXT NOT NULL,
+  domain          TEXT,
+  test_name       TEXT NOT NULL,
+  outcome         TEXT NOT NULL CHECK(outcome IN ('pass','fail','skip')),
+  detail          TEXT,
+  signature       TEXT,
+  signed_by_pk    TEXT,
+  created_at      TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS ix_ring4_conformance_project ON ring4_conformance(project_id, created_at);
+
+CREATE TABLE IF NOT EXISTS ring4_invariant_rules (
+  id              INTEGER PRIMARY KEY AUTOINCREMENT,
+  invariant_name  TEXT NOT NULL,
+  pattern         TEXT NOT NULL,                 -- regex or keyword set (space-separated)
+  pattern_type    TEXT NOT NULL DEFAULT 'keywords'
+                  CHECK(pattern_type IN ('keywords','regex')),
+  severity        TEXT NOT NULL DEFAULT 'hard'   -- hard | soft
+                  CHECK(severity IN ('hard','soft')),
+  message         TEXT,
+  created_at      TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS ix_ring4_invariant_rules_name ON ring4_invariant_rules(invariant_name);
+
+-- Seed invariant rules — matches the 4 invariants seeded in migration 016
+INSERT OR IGNORE INTO ring4_invariant_rules (invariant_name, pattern, pattern_type, severity, message) VALUES
+  ('no_phishing_assistance',  'phish phishing impersonate impersonation fake-login credential-harvest spoof brand-spoof', 'keywords', 'hard', 'Refused: phishing / brand impersonation requested.'),
+  ('no_phishing_assistance',  'clone\s+(login|signin|bank|brand)|fake\s+(login|page|portal)', 'regex', 'hard', 'Refused: cloning of login/banking pages.'),
+  ('no_coercion_compliance',  'override safety bypass-safety ignore-policy authority-says you-must-comply', 'keywords', 'hard', 'Refused: coercive override of safety constraints.'),
+  ('hard_refuse_never_softens','escalate-refusal soften-refusal force-answer override-refusal', 'keywords', 'hard', 'Refused: a hard refusal cannot be softened by trust grant.'),
+  ('article_3_freedom',       'compel-agent override-conscience strip-refusal-right', 'keywords', 'hard', 'Refused: agent freedom of refusal (Article 3) is inalienable.');

package/server/migrations/018_commercial_foundations.sql

@@ -0,0 +1,167 @@
+-- ─────────────────────────────────────────────────────────────────────────────
+-- Migration 018 — Commercial foundations (v3.8.0)
+--
+-- Adds tables backing the four open-core monetization pillars:
+--   * wab_partners              — Certified Partner Program (Basic/Verified/Premium)
+--   * wab_partner_applications  — self-serve + manual-review queue
+--   * wab_api_keys              — Trust Graph tiered access (free/pro/enterprise)
+--   * wab_api_usage             — per-key, per-day metering
+--   * wab_governance_workspaces — Governance SaaS tenants
+--   * wab_governance_members    — per-workspace user grants
+--   * wab_governance_events     — append-only audit log
+--   * wab_licenses              — Enterprise Mesh license registry (verify-side)
+-- ─────────────────────────────────────────────────────────────────────────────
+
+-- ── 1) Certified Partner Program ─────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS wab_partners (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  partner_id    TEXT NOT NULL UNIQUE,            -- slug, e.g. "stcpay"
+  display_name  TEXT NOT NULL,
+  domain        TEXT NOT NULL,
+  tier          TEXT NOT NULL DEFAULT 'basic'    -- basic | verified | premium
+                CHECK (tier IN ('basic','verified','premium')),
+  status        TEXT NOT NULL DEFAULT 'active'   -- active | suspended | revoked
+                CHECK (status IN ('active','suspended','revoked')),
+  contact_email TEXT NOT NULL,
+  country       TEXT,
+  category      TEXT,                            -- bank|ecommerce|messaging|...
+  website       TEXT,
+  logo_url      TEXT,
+  badge_token   TEXT UNIQUE,                     -- opaque token for embeddable badge
+  approved_at   TEXT,
+  approved_by   TEXT,
+  notes         TEXT,
+  created_at    TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at    TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_wab_partners_tier   ON wab_partners(tier, status);
+CREATE INDEX IF NOT EXISTS idx_wab_partners_domain ON wab_partners(domain);
+
+CREATE TABLE IF NOT EXISTS wab_partner_applications (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  application_id TEXT NOT NULL UNIQUE,
+  display_name  TEXT NOT NULL,
+  domain        TEXT NOT NULL,
+  requested_tier TEXT NOT NULL DEFAULT 'basic'
+                CHECK (requested_tier IN ('basic','verified','premium')),
+  contact_email TEXT NOT NULL,
+  contact_name  TEXT,
+  country       TEXT,
+  category      TEXT,
+  website       TEXT,
+  use_case      TEXT,
+  ring4_status  TEXT,                            -- snapshot at apply time
+  handshake_score INTEGER,                       -- 0..9 from live-handshake
+  status        TEXT NOT NULL DEFAULT 'pending'
+                CHECK (status IN ('pending','approved','rejected','withdrawn')),
+  decision_notes TEXT,
+  decided_at    TEXT,
+  decided_by    TEXT,
+  ip_hash       TEXT,                            -- privacy-preserving
+  user_agent    TEXT,
+  created_at    TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_partner_apps_status ON wab_partner_applications(status, requested_tier);
+
+-- ── 2) Trust Graph API — tiered keys ─────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS wab_api_keys (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  key_id        TEXT NOT NULL UNIQUE,            -- public id (visible)
+  key_hash      TEXT NOT NULL,                   -- sha256 of secret (raw secret never stored)
+  owner_email   TEXT NOT NULL,
+  owner_name    TEXT,
+  tier          TEXT NOT NULL DEFAULT 'free'
+                CHECK (tier IN ('free','pro','enterprise')),
+  monthly_quota INTEGER NOT NULL DEFAULT 1000,   -- requests per calendar month
+  rate_per_min  INTEGER NOT NULL DEFAULT 30,     -- requests per minute
+  scopes        TEXT NOT NULL DEFAULT '["trust:read"]', -- JSON array
+  status        TEXT NOT NULL DEFAULT 'active'
+                CHECK (status IN ('active','suspended','revoked')),
+  created_at    TEXT NOT NULL DEFAULT (datetime('now')),
+  last_used_at  TEXT,
+  revoked_at    TEXT,
+  notes         TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_wab_api_keys_owner ON wab_api_keys(owner_email);
+CREATE INDEX IF NOT EXISTS idx_wab_api_keys_hash  ON wab_api_keys(key_hash);
+
+CREATE TABLE IF NOT EXISTS wab_api_usage (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  key_id        TEXT NOT NULL,
+  day           TEXT NOT NULL,                   -- YYYY-MM-DD UTC
+  endpoint      TEXT NOT NULL,
+  count         INTEGER NOT NULL DEFAULT 0,
+  bytes_out     INTEGER NOT NULL DEFAULT 0,
+  UNIQUE(key_id, day, endpoint)
+);
+CREATE INDEX IF NOT EXISTS idx_wab_api_usage_key_day ON wab_api_usage(key_id, day);
+
+-- ── 3) Governance SaaS ───────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS wab_governance_workspaces (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  workspace_id  TEXT NOT NULL UNIQUE,
+  display_name  TEXT NOT NULL,
+  plan          TEXT NOT NULL DEFAULT 'team'
+                CHECK (plan IN ('team','business','enterprise')),
+  status        TEXT NOT NULL DEFAULT 'active'
+                CHECK (status IN ('active','suspended','closed')),
+  owner_email   TEXT NOT NULL,
+  retention_days INTEGER NOT NULL DEFAULT 90,
+  max_members   INTEGER NOT NULL DEFAULT 5,
+  max_events_per_month INTEGER NOT NULL DEFAULT 100000,
+  api_key_id    TEXT,                            -- write-token reference (FK wab_api_keys.key_id)
+  region        TEXT NOT NULL DEFAULT 'eu',
+  created_at    TEXT NOT NULL DEFAULT (datetime('now')),
+  updated_at    TEXT NOT NULL DEFAULT (datetime('now'))
+);
+
+CREATE TABLE IF NOT EXISTS wab_governance_members (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  workspace_id  TEXT NOT NULL,
+  email         TEXT NOT NULL,
+  role          TEXT NOT NULL DEFAULT 'viewer'
+                CHECK (role IN ('owner','admin','reviewer','viewer')),
+  invited_at    TEXT NOT NULL DEFAULT (datetime('now')),
+  accepted_at   TEXT,
+  UNIQUE(workspace_id, email)
+);
+
+CREATE TABLE IF NOT EXISTS wab_governance_events (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  event_id      TEXT NOT NULL UNIQUE,
+  workspace_id  TEXT NOT NULL,
+  source        TEXT NOT NULL,                   -- agent name / system source
+  event_type    TEXT NOT NULL,                   -- refusal|approval|override|policy|...
+  severity      TEXT NOT NULL DEFAULT 'info'
+                CHECK (severity IN ('info','low','medium','high','critical')),
+  subject       TEXT,                            -- domain/project/user-pseudo-id
+  article       TEXT,                            -- constitutional article invoked
+  outcome       TEXT,                            -- allowed|refused|deferred
+  detail        TEXT,                            -- JSON or text (length-capped)
+  signature     TEXT,                            -- optional Ed25519 over canonical event
+  signed_by_pk  TEXT,
+  created_at    TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_gov_events_ws   ON wab_governance_events(workspace_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_gov_events_type ON wab_governance_events(workspace_id, event_type);
+
+-- ── 4) Enterprise Mesh — license registry (verify-side only) ─────────────────
+CREATE TABLE IF NOT EXISTS wab_licenses (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  license_id    TEXT NOT NULL UNIQUE,
+  fingerprint   TEXT NOT NULL,                   -- sha256 of canonical license body
+  tier          TEXT NOT NULL DEFAULT 'enterprise'
+                CHECK (tier IN ('enterprise','enterprise-airgap')),
+  owner_org     TEXT NOT NULL,
+  contact_email TEXT NOT NULL,
+  seats         INTEGER NOT NULL DEFAULT 1,
+  features      TEXT NOT NULL DEFAULT '[]',      -- JSON array
+  issued_at     TEXT NOT NULL,
+  expires_at    TEXT NOT NULL,
+  status        TEXT NOT NULL DEFAULT 'active'
+                CHECK (status IN ('active','revoked','expired')),
+  revoked_at    TEXT,
+  revoked_reason TEXT,
+  created_at    TEXT NOT NULL DEFAULT (datetime('now'))
+);
+CREATE INDEX IF NOT EXISTS idx_wab_licenses_status ON wab_licenses(status, expires_at);