aac-cli 0.2.11__tar.gz → 0.2.12__tar.gz

{aac_cli-0.2.11/aac_cli.egg-info → aac_cli-0.2.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aac-cli
-Version: 0.2.11
+Version: 0.2.12
 Summary: The aac platform CLI — headless operator interface to the AAC control plane (tenant registration, chain audit).
 Author: Agent Authority Cloud Project
 License-Expression: Apache-2.0
@@ -28,9 +28,9 @@ Dynamic: license-file
 # aac-cli — the `aac` command
 
 `aac` is the command-line tool for tenants of Agent Authority Cloud (AAC).
-AAC lets an organisation's AI agents and services prove, on every request,
-which tenant they belong to and what they were authorised to do. A
-**tenant** is one organisation registered with AAC. Each of its workloads
+AAC lets an organization's AI agents and services prove, on every request,
+which tenant they belong to and what they were authorized to do. A
+**tenant** is one organization registered with AAC. Each of its workloads
 runs beside an AAC sidecar that signs outgoing requests and verifies
 incoming ones against public trust material the tenant publishes.
 
@@ -69,7 +69,8 @@ pip install aac-cli
 aac --version
 ```
 
-Python 3.11 to 3.14 is supported. Release checks test all four versions.
+Supported platforms are macOS, Linux and Linux Docker containers. Python 3.11
+to 3.14 is supported. Release checks test all four versions.
 
 > **Mind the name.** `pip install aac` installs an unrelated project that
 > happens to share the acronym. The AAC package is **`aac-cli`**; the
@@ -756,7 +757,7 @@ stored value.
 
 `tenant_id` is managed for you. Profile commands display it but never ask
 for it; only `aac tenant register`, `aac init` and `aac sso login` write it.
-It is your organisation's identifier in the federation, allocated by AAC at
+It is your organization's identifier in the federation, allocated by AAC at
 registration in the form `tnt-<uuid>`, and it never changes.
 A binding makes that tenant the profile's stored default; it does not grant
 membership or configure an identity provider. Successful sign-in to an existing
@@ -953,12 +954,12 @@ code.
 Enterprise tenants are registered through an onboarding ceremony: AAC
 operations opens a registration window and hands the tenant operator a
 bootstrap token, which the commands below read from `--bootstrap-token` or
-the `AAC_BOOTSTRAP_TOKEN` environment variable. The token authorises only
+the `AAC_BOOTSTRAP_TOKEN` environment variable. The token authorizes only
 the onboarding steps shown with it; every other administration command runs
 under a signed-in session.
 
 For enterprise sign-in, AAC supports Microsoft Entra ID (also known as
-Azure Active Directory or Azure AD). If your organisation needs another
+Azure Active Directory or Azure AD). If your organization needs another
 identity provider, contact support@cascadeauth.com.
 
 ### Register the tenant

{aac_cli-0.2.11 → aac_cli-0.2.12}/README.md

@@ -1,9 +1,9 @@
 # aac-cli — the `aac` command
 
 `aac` is the command-line tool for tenants of Agent Authority Cloud (AAC).
-AAC lets an organisation's AI agents and services prove, on every request,
-which tenant they belong to and what they were authorised to do. A
-**tenant** is one organisation registered with AAC. Each of its workloads
+AAC lets an organization's AI agents and services prove, on every request,
+which tenant they belong to and what they were authorized to do. A
+**tenant** is one organization registered with AAC. Each of its workloads
 runs beside an AAC sidecar that signs outgoing requests and verifies
 incoming ones against public trust material the tenant publishes.
 
@@ -42,7 +42,8 @@ pip install aac-cli
 aac --version
 ```
 
-Python 3.11 to 3.14 is supported. Release checks test all four versions.
+Supported platforms are macOS, Linux and Linux Docker containers. Python 3.11
+to 3.14 is supported. Release checks test all four versions.
 
 > **Mind the name.** `pip install aac` installs an unrelated project that
 > happens to share the acronym. The AAC package is **`aac-cli`**; the
@@ -729,7 +730,7 @@ stored value.
 
 `tenant_id` is managed for you. Profile commands display it but never ask
 for it; only `aac tenant register`, `aac init` and `aac sso login` write it.
-It is your organisation's identifier in the federation, allocated by AAC at
+It is your organization's identifier in the federation, allocated by AAC at
 registration in the form `tnt-<uuid>`, and it never changes.
 A binding makes that tenant the profile's stored default; it does not grant
 membership or configure an identity provider. Successful sign-in to an existing
@@ -926,12 +927,12 @@ code.
 Enterprise tenants are registered through an onboarding ceremony: AAC
 operations opens a registration window and hands the tenant operator a
 bootstrap token, which the commands below read from `--bootstrap-token` or
-the `AAC_BOOTSTRAP_TOKEN` environment variable. The token authorises only
+the `AAC_BOOTSTRAP_TOKEN` environment variable. The token authorizes only
 the onboarding steps shown with it; every other administration command runs
 under a signed-in session.
 
 For enterprise sign-in, AAC supports Microsoft Entra ID (also known as
-Azure Active Directory or Azure AD). If your organisation needs another
+Azure Active Directory or Azure AD). If your organization needs another
 identity provider, contact support@cascadeauth.com.
 
 ### Register the tenant

{aac_cli-0.2.11 → aac_cli-0.2.12}/aac_cli/__init__.py

@@ -10,4 +10,4 @@ entrypoint (`aac_cli.cli:entrypoint`).
 # test in bin/tests/test_cli_version_parity.py. A literal keeps the
 # shipped code free of import-time metadata lookups (and their
 # not-installed failure mode).
-__version__ = "0.2.11"
+__version__ = "0.2.12"

{aac_cli-0.2.11 → aac_cli-0.2.12}/aac_cli/_aeg/cli.py

@@ -204,15 +204,18 @@ def _render(args, events, query: Query, sources: list[SourceInput]) -> int:
     if args.output.resolve() in {path.resolve() for path in protected}:
         raise InputError("--output must not overwrite an evidence input")
     visual = build_visual_aeg(graph)
-    visual.provenance = summarize_sources(sources, selected, central_status=central_status)
+    visual.provenance = summarize_sources(
+        sources, selected, central_status=central_status, evidence_complete=graph.evidence_complete
+    )
     with tempfile.TemporaryDirectory(prefix="aac-aeg-") as directory:
         rendered = write_html_aeg(visual, root, out_dir=Path(directory))
         args.output.parent.mkdir(parents=True, exist_ok=True)
         args.output.write_text(rendered.read_text(encoding="utf-8"), encoding="utf-8")
     for diagnostic in diagnostics:
         print(diagnostic, file=sys.stderr)
+    coverage = "" if graph.evidence_complete else "; partial evidence"
     print(
-        f"AEG written to {args.output} ({len(graph.tokens)} observed/referenced tokens; partial evidence)",
+        f"AEG written to {args.output} ({len(graph.tokens)} observed/referenced tokens{coverage})",
         file=sys.stderr,
     )
     return 4 if query_failed else 0

{aac_cli-0.2.11 → aac_cli-0.2.12}/aac_cli/_aeg/data/renderer-source.json

@@ -1,20 +1,20 @@
 {
-  "content_sha256": "6e8bcd00bd94c415e04af65deb527be4d1581a6a5396d74c95708d6dda97fca4",
+  "content_sha256": "f45099fcfa1d1ceca5f31244dfa526ea096094ced6cfc7faf27cc1babe482163",
   "files": {
     "__init__.py": "80d80a1ba35353d271cddf02532801c60b57f5ec06fb268ae823747742ce8979",
-    "cli.py": "98aa2b0c528fefb5f1f90a16584a6fbda1f075ebfcf61605f52948cdb940a1af",
+    "cli.py": "a180a171b4d1f819fd96d0821394eee19b45fafddddbd50c74778af6ac3d5fb0",
     "data/action-taken-v1.json": "d863343afe7f314646a73cf063480a7e650f93857d2ed5ec3a7b1f9838671fdf",
     "data/predicates-v1.json": "35e83a29feada10e8cfbef7009245146a9717d4f4fd58d74124e0ec91ae922c8",
-    "from_sidecar.py": "6ac023f6925a13e94e0fee762656a02ca98981f2add194b052e9014ca48e2219",
-    "inputs.py": "ebf1ca77957d29d59683348f6916bac3c21e2037f087f26ff7c7242d75edc77c",
-    "model.py": "b631dcd7af587dcc89c18e1058bc81fb1043f04250a0d6ea585f9c595fd75cfc",
+    "from_sidecar.py": "8671c3e0efe9bfe9ecf9be057b70e245ca8d0d645b6bad8819f6fb1b882e255e",
+    "inputs.py": "047a6b7dd788e04c49e10f090de9336ed3870e754b547c469371369d27b55b8b",
+    "model.py": "715d0e92c3aafd9e0a194a74b4df7354bd24d1bf815767d590cf245da3d60018",
     "narrative.py": "8ac4b12add84cc8be907cff5f25e58731ab1144888aec8d376e286de461a6179",
-    "provenance.py": "d310e13bfd45cb16edcc72e7b2bc28c916e3ff45208e2b44240e589f0ec0558d",
+    "provenance.py": "3f611a8c129a2856e2cf76561bde29dc1884719083dfdddea72810e026946b90",
     "schemas.py": "c47e0138fb8bfeaf1db1725a00d4a37ff4a136a9e8f5907356b1006f301a9ded",
     "temporal.py": "b69081e9280d578dc1261a276da3178e979a02efaf1137f720b4520ed543a36d",
     "theme.py": "ded47be13f5c591da95a1bb91ee1b665c1570c929d842bdaa1a41325d0b40caa",
     "timeline_source.py": "dc875458d69c6135b3ffe0db9c35e511da603b5d52409f780f3e1b74dc464520",
-    "visualizer.py": "5eb7b863652c51a4a5751bcd8ae735b688e6e3e61089f0c158473ebb52ae6655"
+    "visualizer.py": "3213a1cbfe901f320c687b5eafcc09bed46bd2270c6cd427a7f74472c80a3bfe"
   },
   "legal": {
     "LICENSE": "0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594",

{aac_cli-0.2.11 → aac_cli-0.2.12}/aac_cli/_aeg/from_sidecar.py

@@ -463,6 +463,9 @@ def _translate_mint(
         "tenant_id": sidecar_event.get("tenant_id"),
         "presenter_spiffe_id": sidecar_event.get("actor_spiffe_id"),
         "originator_human_id_hash": None,
+        # The sidecar records the sign-in issuer, never the person's identity;
+        # the originator node shows it when no identity hash is available.
+        "originator_issuer": sidecar_event.get("originator_issuer"),
         # T0 has no parent and no parent_token_ids_list (not a composite).
     }
     t0_event = UnifiedEvent(
@@ -624,6 +627,7 @@ def _translate_composite_mint(
         "parent_root_token_ids": sidecar_event.get("parent_root_token_ids") or [],
         "parent_tenant_ids": sidecar_event.get("parent_tenant_ids") or [],
         "originator_human_id_hash": sidecar_event.get("originator_human_id_hash"),
+        "originator_issuer": sidecar_event.get("originator_issuer"),
         "task_ref": sidecar_event.get("task_ref"),
     }
     t_comp_0_event = UnifiedEvent(

{aac_cli-0.2.11 → aac_cli-0.2.12}/aac_cli/_aeg/inputs.py

@@ -100,6 +100,7 @@ def _sidecar_types(row: dict, label: str) -> None:
         "agent_decision_action",
         "destination",
         "terminal_attestation_verification",
+        "originator_issuer",
     ):
         if row.get(key) is not None and not isinstance(row[key], str):
             raise InputError(f"{label}: {key} must be a string or null")
@@ -232,6 +233,7 @@ def read_trace(body, source: str) -> tuple[str, list[UnifiedEvent]]:
             "terminal_attestation_verification",
             "destination",
             "agent_decision_action",
+            "originator_issuer",
         ):
             if raw.get(key) is not None and not isinstance(raw[key], str):
                 raise InputError(f"{label}: {key} must be a string or null")

{aac_cli-0.2.11 → aac_cli-0.2.12}/aac_cli/_aeg/model.py

@@ -215,6 +215,11 @@ class TerminalNode:
     action_payload: dict = field(default_factory=dict)
     action_taken_by_spiffe_id: str | None = None
     action_taken_timestamp: str | None = None
+    # True only when an action record's actor is the workload the audience
+    # names (exact match, or a match of the audience pattern). Any other
+    # token-correlated action stays an observation and never proves that the
+    # addressed recipient acted.
+    recipient_acted: bool = False
     # Canonical associations observed for this leaf and exact receiver workload.
     # A trust-domain match, another token, or a wildcard is not such evidence.
     observed_tenant_ids: tuple[str, ...] = ()
@@ -274,6 +279,21 @@ class TokenRelationGraph:
     # become unknown. Receiving/reporting observations cannot supply this map.
     creator_tenant_claims: dict[str, tuple[str, ...]] = field(default_factory=dict)
 
+    @property
+    def evidence_complete(self) -> bool:
+        """True when the supplied records leave no structural gap.
+
+        Every referenced token was observed (no placeholder stands in for a
+        token only named by another), and each recipient's own records show
+        its action. A complete set is still a set of supplied observations,
+        not independently verified business truth.
+        """
+        if not self.tokens or not self.terminals:
+            return False
+        if any(token.placeholder for token in self.tokens.values()):
+            return False
+        return all(terminal.recipient_acted for terminal in self.terminals)
+
 
 # ---------------------------------------------------------------------------
 # Extraction — events → TokenRelationGraph
@@ -729,14 +749,49 @@ def _extract_originators(
         if e.source.startswith(TENANT_SOURCE_PREFIX) and e.event_type == "human_authenticated"
     }
 
-    out: list[OriginatorNode] = []
+    # Every observation of the same root (local sidecar record, central
+    # metadata, a second file) describes ONE originator. Merge them per root so
+    # the canvas label and the details are built from the same facts: a SIEM
+    # match on any observed hash wins, otherwise the first issuer any
+    # observation carries.
+    by_root: dict[str, list[UnifiedEvent]] = {}
     for mint in mint_root_events:
-        h_hash = mint.raw_event.get("originator_human_id_hash") or ""
-        root_tid = mint.root_token_id
-        token = tokens.get(mint.token_id)
-        tenant_id = token.tenant_id if token else (mint.raw_event.get("tenant_id") or "")
+        by_root.setdefault(mint.root_token_id, []).append(mint)
+
+    out: list[OriginatorNode] = []
+    for root_tid, observations in by_root.items():
+        h_hash = next(
+            (
+                str(o.raw_event.get("originator_human_id_hash"))
+                for o in observations
+                if o.raw_event.get("originator_human_id_hash")
+            ),
+            "",
+        )
+        issuer = next(
+            (
+                o.raw_event.get("originator_issuer")
+                for o in observations
+                if isinstance(o.raw_event.get("originator_issuer"), str)
+                and o.raw_event.get("originator_issuer")
+            ),
+            None,
+        )
+        token = next((tokens[o.token_id] for o in observations if o.token_id in tokens), None)
+        tenant_id = (
+            token.tenant_id
+            if token
+            else next(
+                (
+                    str(o.raw_event.get("tenant_id"))
+                    for o in observations
+                    if o.raw_event.get("tenant_id")
+                ),
+                "",
+            )
+        )
         # Optional enrichment from tenant SIEM.
-        siem = siem_human_events.get(h_hash)
+        siem = siem_human_events.get(h_hash) if h_hash else None
         if siem:
             raw = siem.raw_event
             out.append(
@@ -757,6 +812,9 @@ def _extract_originators(
                     human_id_hash=h_hash,
                     root_token_id=root_tid,
                     tenant_id=tenant_id,
+                    # The sidecar's mint record names the sign-in issuer even
+                    # when no identity hash reaches these records.
+                    human_iss=issuer,
                 )
             )
     return out
@@ -812,6 +870,35 @@ def _extract_auth_summary(
 # ---------------------------------------------------------------------------
 
 
+# The AAC audience grammar (AAC Design, "SPIFFE-ID pattern matching for
+# audience"), as the verifier implements it: a concrete SPIFFE ID, or a trailing
+# `/*` that stands for exactly one non-empty path segment. Trust domains match
+# exactly; a SPIFFE ID itself never contains a wildcard.
+_AUDIENCE_PATTERN = re.compile(r"^spiffe://[A-Za-z0-9.\-_]+(?:/[^/*]+)*(?:/\*)?$")
+_CONCRETE_SPIFFE_ID = re.compile(r"^spiffe://[A-Za-z0-9.\-_]+(?:/[^/*]+)+$")
+
+
+def _actor_matches_audience(actor: object, audience: str) -> bool:
+    """Whether an action's actor is the workload the audience constraint names.
+
+    Only a concrete SPIFFE ID can be the addressed recipient, and only under
+    the audience grammar above. Anything else (an opaque identity, a pattern
+    used as an actor, an unsupported audience shape) is kept as an observation
+    without claiming a match. A shared token or tenant never counts.
+    """
+    if not isinstance(actor, str) or not _CONCRETE_SPIFFE_ID.fullmatch(actor):
+        return False
+    if any(character.isspace() for character in actor) or not _AUDIENCE_PATTERN.fullmatch(audience):
+        return False
+    if audience.endswith("/*"):
+        prefix = audience[:-2]
+        if not actor.startswith(prefix + "/"):
+            return False
+        tail = actor[len(prefix) + 1 :]
+        return bool(tail) and "/" not in tail
+    return actor == audience
+
+
 def _extract_terminals(
     events: list[UnifiedEvent],
     tokens: dict[str, TokenNode],
@@ -882,6 +969,9 @@ def _extract_terminals(
             action_by_token.get(tid, []),
             key=lambda e: (e.timestamp_iso, json.dumps(e.raw_event, sort_keys=True)),
         )
+        recipient_acted = any(
+            _actor_matches_audience(e.raw_event.get("actor_spiffe_id"), audience) for e in actions
+        )
         if actions:
             action = actions[0]
             raw: dict = (
@@ -911,6 +1001,7 @@ def _extract_terminals(
                     # alias is needed.
                     action_taken_by_spiffe_id=raw.get("actor_spiffe_id"),
                     action_taken_timestamp=action.timestamp_iso,
+                    recipient_acted=recipient_acted,
                 )
             )
         else:

{aac_cli-0.2.11 → aac_cli-0.2.12}/aac_cli/_aeg/provenance.py

@@ -50,10 +50,16 @@ class SourceSummary:
 class Provenance:
     sources: tuple[SourceSummary, ...]
     central_status: str
+    # Structural completeness of the supplied records (TokenRelationGraph.evidence_complete).
+    evidence_complete: bool = False
 
 
 def summarize_sources(
-    sources: list[SourceInput], selected: list[UnifiedEvent], *, central_status: str
+    sources: list[SourceInput],
+    selected: list[UnifiedEvent],
+    *,
+    central_status: str,
+    evidence_complete: bool = False,
 ) -> Provenance:
     # Selection retains the original event objects. Track membership by identity,
     # not by a filename, timestamp or caller-controlled event field that could
@@ -81,7 +87,7 @@ def summarize_sources(
                 times[-1] if times else None,
             )
         )
-    return Provenance(tuple(summaries), central_status)
+    return Provenance(tuple(summaries), central_status, evidence_complete)
 
 
 def source_panel(provenance: Provenance | None, diagnostics: list[str]) -> str:
@@ -143,11 +149,21 @@ def source_panel(provenance: Provenance | None, diagnostics: list[str]) -> str:
             "observations for hosted data, not unique business actions. Timestamp spans describe "
             "available records, not execution start/end or continuous coverage.</p>"
         )
+    if provenance and provenance.evidence_complete:
+        coverage = (
+            "<li>Every referenced token was observed and each recipient's own records show its "
+            "action. Records are supplied, correlated observations, not independently verified "
+            "business truth.</li>"
+        )
+    else:
+        coverage = (
+            "<li>Partial evidence: only supplied, correlated observations are shown. Missing "
+            "records do not establish success or failure.</li>"
+        )
     parts.append(
-        "<h2>Limitations for these inputs</h2><ul><li>Partial evidence: only supplied, "
-        "correlated observations are shown. Missing records do not establish success or failure.</li>"
-        "<li>An intended recipient is named by an audience constraint; that constraint alone "
-        "does not prove delivery or completion. Mint/transport success does not prove a business result.</li>"
+        "<h2>Limitations for these inputs</h2><ul>" + coverage + "<li>A recipient is named by an "
+        'audience constraint ("addressed to"); that constraint alone does not prove delivery or '
+        "completion. Mint/transport success does not prove a business result.</li>"
     )
     if "Control-plane trace data" in used:
         parts.append(

{aac_cli-0.2.11 → aac_cli-0.2.12}/aac_cli/_aeg/visualizer.py

@@ -35,6 +35,7 @@ from datetime import (  # c-S6 fix: was per-call import inside _format_unix_time
 from html import escape
 from importlib.resources import files
 from pathlib import Path
+from urllib.parse import urlparse
 
 from .model import (
     ChainFailure,
@@ -331,20 +332,48 @@ def _build_originator_node(orig: OriginatorNode, theme: VisualTheme) -> GraphNod
         label = f"Human originator\n\n{label_name}"
         brief = f"Human originator ({label_name})"
         detail_title = f"Human originator: {label_name}"
+    elif orig.human_iss:
+        # The sidecar records where the person signed in; the identity itself
+        # travels only as a sealed hash in the root token.
+        host = _issuer_host(orig.human_iss)
+        label = f"Originator\n\nsigned in at {host}"
+        brief = f"Originator signed in at {host} (identity hash not in these records)"
+        detail_title = f"Originator: signed in at {host}"
     else:
         label = "Originator\n\n(identity not recorded)"
         brief = "Originator identity not available in these records"
         detail_title = "Originator (identity not recorded)"
-    sections: list[dict] = [
+    sections: list[dict] = []
+    sign_in_shown = not has_human_id and bool(orig.human_iss)
+    if sign_in_shown:
+        sections.append(
+            {
+                "title": "Sign-in (from the sidecar's mint record)",
+                "rows": [
+                    ["issuer", orig.human_iss],
+                    [
+                        "identity",
+                        "AAC seals a hash of the person's sign-in (issuer, subject and sign-in "
+                        "time) into the root token and never stores the name.",
+                    ],
+                ],
+            }
+        )
+    sections.append(
         {
             "title": "Human identity (from log data)",
             "rows": [
                 ["human_id_hash", orig.human_id_hash or "(not recorded)"],
-                ["OIDC issuer", orig.human_iss or "(not logged at originating tenant SIEM)"],
+                [
+                    "OIDC issuer",
+                    "(not logged at originating tenant SIEM)"
+                    if sign_in_shown or not orig.human_iss
+                    else orig.human_iss,
+                ],
                 ["OIDC subject", orig.human_sub or "(not logged at originating tenant SIEM)"],
             ],
         },
-    ]
+    )
     if orig.role:
         sections.append({"title": "Role", "rows": [["role", orig.role]]})
     if orig.authorization_summary:
@@ -377,6 +406,11 @@ def _build_originator_node(orig: OriginatorNode, theme: VisualTheme) -> GraphNod
     )
 
 
+def _issuer_host(issuer: str) -> str:
+    """The host of a sign-in issuer URL, or the issuer itself when it has none."""
+    return urlparse(issuer).hostname or issuer
+
+
 def _build_token_node(token: TokenNode, theme: VisualTheme) -> GraphNode:
     participant = theme.creator_identity(token)
     color = color_for(participant, theme)
@@ -593,13 +627,19 @@ def _build_terminal_node(
     participant = theme.recipient_identity(terminal)
     color = color_for(participant, theme)
     tenant_label_text = color["label"]
+    # The audience constraint names who the authority was addressed to; only an
+    # action by that addressed workload is evidence that it acted.
+    acted = terminal.recipient_acted
     label_lines = [
+        "Addressed to",
+        "",
         str(color.get("node_label") or tenant_label_text),
         terminal.workload_label,
-        "Intended recipient",
     ]
     if "*" in terminal.audience_pattern:
         label_lines.append("Audience pattern")
+    if acted:
+        label_lines.append("received and acted")
     # Generic action summary line — works for any wedge, not just financial.
     # If leaf token's action is known, display it; otherwise omit.
     if leaf_token:
@@ -656,8 +696,11 @@ def _build_terminal_node(
     return GraphNode(
         node_id=f"terminal:{terminal.leaf_token_id}",
         label=label,
-        brief=f"Intended recipient (audience constraint): {tenant_label_text}",
-        detail_title=f"Intended recipient: {tenant_label_text} {terminal.workload_label}",
+        brief=(
+            f"Addressed to: {tenant_label_text} {terminal.workload_label} (audience constraint)"
+            + (", received and acted" if acted else "")
+        ),
+        detail_title=f"Addressed to: {tenant_label_text} {terminal.workload_label}",
         detail_sections=sections,
         fill_color=color["fill"],
         border_color=color["border"],
@@ -886,7 +929,7 @@ def _build_terminal_edge(
     edge_counter: int,
 ) -> GraphEdge:
     # An audience is a constraint, not evidence that a hand-off happened.
-    op_label = "intended for"
+    op_label = "addressed to"
     rows = [
         ["audience-bound to", terminal.audience_pattern],
         [
@@ -1212,7 +1255,7 @@ def _wrap_with_demo_chrome(
       <p class="aac-root"><strong>Chain root token ID:</strong> <code>{escape(root_token_id)}</code></p>
       <div class="aac-legend" tabindex="0" aria-label="Participant legend">{"".join(legend_pieces)}</div>
       <div class="aac-roles" aria-label="Node role legend">
-        <span>⬭ Originator</span><span>▭ Token</span><span>⬡ Intended recipient (audience constraint)</span>
+        <span>⬭ Originator</span><span>▭ Token</span><span>⬡ Addressed to (audience constraint)</span>
         <span>◇ Composite root</span>
       </div>
     </header>

{aac_cli-0.2.11 → aac_cli-0.2.12/aac_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aac-cli
-Version: 0.2.11
+Version: 0.2.12
 Summary: The aac platform CLI — headless operator interface to the AAC control plane (tenant registration, chain audit).
 Author: Agent Authority Cloud Project
 License-Expression: Apache-2.0
@@ -28,9 +28,9 @@ Dynamic: license-file
 # aac-cli — the `aac` command
 
 `aac` is the command-line tool for tenants of Agent Authority Cloud (AAC).
-AAC lets an organisation's AI agents and services prove, on every request,
-which tenant they belong to and what they were authorised to do. A
-**tenant** is one organisation registered with AAC. Each of its workloads
+AAC lets an organization's AI agents and services prove, on every request,
+which tenant they belong to and what they were authorized to do. A
+**tenant** is one organization registered with AAC. Each of its workloads
 runs beside an AAC sidecar that signs outgoing requests and verifies
 incoming ones against public trust material the tenant publishes.
 
@@ -69,7 +69,8 @@ pip install aac-cli
 aac --version
 ```
 
-Python 3.11 to 3.14 is supported. Release checks test all four versions.
+Supported platforms are macOS, Linux and Linux Docker containers. Python 3.11
+to 3.14 is supported. Release checks test all four versions.
 
 > **Mind the name.** `pip install aac` installs an unrelated project that
 > happens to share the acronym. The AAC package is **`aac-cli`**; the
@@ -756,7 +757,7 @@ stored value.
 
 `tenant_id` is managed for you. Profile commands display it but never ask
 for it; only `aac tenant register`, `aac init` and `aac sso login` write it.
-It is your organisation's identifier in the federation, allocated by AAC at
+It is your organization's identifier in the federation, allocated by AAC at
 registration in the form `tnt-<uuid>`, and it never changes.
 A binding makes that tenant the profile's stored default; it does not grant
 membership or configure an identity provider. Successful sign-in to an existing
@@ -953,12 +954,12 @@ code.
 Enterprise tenants are registered through an onboarding ceremony: AAC
 operations opens a registration window and hands the tenant operator a
 bootstrap token, which the commands below read from `--bootstrap-token` or
-the `AAC_BOOTSTRAP_TOKEN` environment variable. The token authorises only
+the `AAC_BOOTSTRAP_TOKEN` environment variable. The token authorizes only
 the onboarding steps shown with it; every other administration command runs
 under a signed-in session.
 
 For enterprise sign-in, AAC supports Microsoft Entra ID (also known as
-Azure Active Directory or Azure AD). If your organisation needs another
+Azure Active Directory or Azure AD). If your organization needs another
 identity provider, contact support@cascadeauth.com.
 
 ### Register the tenant

{aac_cli-0.2.11 → aac_cli-0.2.12}/pyproject.toml

@@ -32,7 +32,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "aac-cli"
-version = "0.2.11"
+version = "0.2.12"
 description = "The aac platform CLI — headless operator interface to the AAC control plane (tenant registration, chain audit)."
 readme = "README.md"
 requires-python = ">=3.11"