agent-os-kernel 1.1.0__py3-none-any.whl → 1.3.0__py3-none-any.whl

modules/iatp/examples/demo_attestation_reputation.py

@@ -0,0 +1,274 @@
+"""
+Integration example demonstrating Agent Attestation and Reputation Slashing.
+
+This example shows:
+1. Creating an attestation for an agent
+2. Setting up agents with attestation
+3. Simulating hallucination detection and reputation slashing
+4. Network-wide reputation propagation
+"""
+import asyncio
+from iatp import (
+    CapabilityManifest,
+    AgentCapabilities,
+    PrivacyContract,
+    TrustLevel,
+    ReversibilityLevel,
+    RetentionPolicy,
+    AttestationRecord,
+)
+from iatp.attestation import AttestationValidator, ReputationManager
+
+
+def demo_attestation():
+    """Demonstrate agent attestation functionality."""
+    print("\n" + "=" * 80)
+    print("DEMO 1: Agent Attestation (Verifiable Credentials)")
+    print("=" * 80)
+    
+    # Create an attestation validator (Control Plane)
+    validator = AttestationValidator()
+    
+    # Add a trusted Control Plane public key
+    validator.add_trusted_key(
+        key_id="control-plane-prod-2026",
+        public_key="-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj...\n-----END PUBLIC KEY-----"
+    )
+    print("✓ Control Plane public key registered")
+    
+    # Compute codebase hash
+    agent_code = "def process_request(data): return data"
+    codebase_hash = validator.compute_codebase_hash(agent_code)
+    config_hash = validator.compute_codebase_hash('{"timeout": 30}')
+    
+    print(f"✓ Codebase hash: {codebase_hash[:16]}...")
+    print(f"✓ Config hash: {config_hash[:16]}...")
+    
+    # Create attestation (done by Control Plane)
+    attestation = validator.create_attestation(
+        agent_id="banking-agent-v1.2.3",
+        codebase_hash=codebase_hash,
+        config_hash=config_hash,
+        signing_key_id="control-plane-prod-2026",
+        expires_in_hours=24
+    )
+    print(f"✓ Attestation created: {attestation.agent_id}")
+    print(f"  Expires: {attestation.expires_at}")
+    
+    # Validate attestation (done by receiving agent)
+    is_valid, error = validator.validate_attestation(
+        attestation,
+        verify_signature=False  # Simplified for demo
+    )
+    
+    if is_valid:
+        print("✅ Attestation VALID - Agent is running verified code")
+    else:
+        print(f"❌ Attestation INVALID: {error}")
+    
+    # Simulate tampered agent
+    print("\n--- Simulating Tampered Agent ---")
+    tampered_attestation = AttestationRecord(
+        agent_id="hacked-agent",
+        codebase_hash="different_hash",
+        config_hash=config_hash,
+        signature="invalid_signature",
+        signing_key_id="unknown-key",
+        timestamp="2026-01-25T10:00:00Z",
+        expires_at=None
+    )
+    
+    is_valid, error = validator.validate_attestation(
+        tampered_attestation,
+        verify_signature=False
+    )
+    
+    if not is_valid:
+        print(f"✅ Correctly rejected tampered agent: {error}")
+
+
+def demo_reputation_slashing():
+    """Demonstrate reputation slashing and recovery."""
+    print("\n" + "=" * 80)
+    print("DEMO 2: Reputation Slashing")
+    print("=" * 80)
+    
+    manager = ReputationManager()
+    
+    # Start with a good agent
+    agent_id = "summarizer-agent-v2"
+    
+    # Record some successful operations
+    print(f"\n--- Agent '{agent_id}' performing successfully ---")
+    for i in range(10):
+        manager.record_success(agent_id, trace_id=f"trace-{i}")
+    
+    score = manager.get_score(agent_id)
+    print(f"✓ After 10 successful operations: Score = {score.score:.2f}/10")
+    print(f"  Trust Level: {score.get_trust_level().value}")
+    
+    # Simulate hallucination detected by cmvk
+    print(f"\n--- cmvk detects hallucination (HIGH severity) ---")
+    manager.record_hallucination(
+        agent_id=agent_id,
+        severity="high",
+        trace_id="trace-hallucination-1",
+        details={
+            "reason": "Generated fabricated customer data",
+            "context": "Responding to query about user profile"
+        }
+    )
+    
+    score = manager.get_score(agent_id)
+    print(f"⚠️  After hallucination: Score = {score.score:.2f}/10 (slashed by 1.0)")
+    print(f"  Trust Level: {score.get_trust_level().value}")
+    print(f"  Negative events: {score.negative_events}")
+    
+    # Another hallucination
+    print(f"\n--- cmvk detects another hallucination (CRITICAL severity) ---")
+    manager.record_hallucination(
+        agent_id=agent_id,
+        severity="critical",
+        trace_id="trace-hallucination-2",
+        details={
+            "reason": "Made up financial transaction data",
+            "context": "Banking query"
+        }
+    )
+    
+    score = manager.get_score(agent_id)
+    print(f"❌ After critical hallucination: Score = {score.score:.2f}/10 (slashed by 2.0)")
+    print(f"  Trust Level: {score.get_trust_level().value}")
+    print(f"  🚨 Agent is now UNTRUSTED - other agents stop listening!")
+    
+    # Show recent events
+    print(f"\n--- Recent Events (last 3) ---")
+    for event in score.recent_events[-3:]:
+        symbol = "✅" if event.score_delta > 0 else "❌"
+        print(f"{symbol} {event.event_type} ({event.severity}): "
+              f"delta={event.score_delta:+.2f}, detected_by={event.detected_by}")
+
+
+def demo_network_propagation():
+    """Demonstrate network-wide reputation propagation."""
+    print("\n" + "=" * 80)
+    print("DEMO 3: Network-Wide Reputation Propagation")
+    print("=" * 80)
+    
+    # Create two reputation managers (two different nodes)
+    node1 = ReputationManager()
+    node2 = ReputationManager()
+    
+    # Node 1 detects misbehavior
+    print("\n--- Node 1: Detecting misbehavior from 'data-agent-x' ---")
+    node1.record_hallucination(
+        agent_id="data-agent-x",
+        severity="high",
+        details={"reason": "Fabricated statistics"}
+    )
+    
+    score1 = node1.get_score("data-agent-x")
+    print(f"✓ Node 1 reputation for 'data-agent-x': {score1.score:.2f}/10")
+    
+    # Export reputation data from node 1
+    print("\n--- Exporting reputation data from Node 1 ---")
+    reputation_data = node1.export_reputation_data()
+    print(f"✓ Exported data for {len(reputation_data)} agents")
+    
+    # Import to node 2
+    print("\n--- Importing reputation data to Node 2 ---")
+    node2.import_reputation_data(reputation_data)
+    
+    score2 = node2.get_score("data-agent-x")
+    if score2:
+        print(f"✅ Node 2 now knows about 'data-agent-x': {score2.score:.2f}/10")
+        print(f"   Trust Level: {score2.get_trust_level().value}")
+        print(f"   🌐 Reputation propagated across network!")
+    
+    # Show conservative merging
+    print("\n--- Conservative Reputation Merging ---")
+    node1.get_or_create_score("trusted-agent-y").score = 8.0
+    node2.get_or_create_score("trusted-agent-y").score = 3.0  # Node 2 has concerns
+    
+    print(f"Node 1 view: 'trusted-agent-y' = 8.0/10")
+    print(f"Node 2 view: 'trusted-agent-y' = 3.0/10")
+    
+    # Node 2 exports to Node 1
+    data_from_node2 = node2.export_reputation_data()
+    node1.import_reputation_data(data_from_node2)
+    
+    merged_score = node1.get_score("trusted-agent-y")
+    print(f"After merge: Node 1 takes conservative (lower) score = {merged_score.score:.2f}/10")
+    print(f"✓ System prefers safety: when in doubt, trust less")
+
+
+def demo_integration_with_manifest():
+    """Show how reputation integrates with capability manifests."""
+    print("\n" + "=" * 80)
+    print("DEMO 4: Integration with Capability Manifests")
+    print("=" * 80)
+    
+    manager = ReputationManager()
+    
+    # Create an agent with initial trust level
+    manifest = CapabilityManifest(
+        agent_id="analytics-agent",
+        trust_level=TrustLevel.STANDARD,
+        capabilities=AgentCapabilities(
+            idempotency=True,
+            reversibility=ReversibilityLevel.PARTIAL
+        ),
+        privacy_contract=PrivacyContract(
+            retention=RetentionPolicy.TEMPORARY
+        )
+    )
+    
+    print(f"Initial manifest trust: {manifest.trust_level.value}")
+    print(f"Initial trust score: {manifest.calculate_trust_score()}/10")
+    
+    # Record multiple hallucinations
+    print("\n--- Agent misbehaves multiple times ---")
+    for i in range(3):
+        manager.record_hallucination(
+            agent_id="analytics-agent",
+            severity="medium"
+        )
+    
+    # Get reputation-based trust level
+    reputation_score = manager.get_score("analytics-agent")
+    reputation_trust = reputation_score.get_trust_level()
+    
+    print(f"\nAfter misbehavior:")
+    print(f"  Reputation score: {reputation_score.score:.2f}/10")
+    print(f"  Reputation-based trust: {reputation_trust.value}")
+    print(f"  🔒 Other agents can use this to reject requests!")
+    
+    # Show the decision process
+    if reputation_trust == TrustLevel.UNTRUSTED:
+        print(f"\n❌ REQUEST REJECTED:")
+        print(f"   Agent 'analytics-agent' has been slashed to UNTRUSTED")
+        print(f"   Even though manifest says {manifest.trust_level.value},")
+        print(f"   network reputation overrides: {reputation_trust.value}")
+
+
+if __name__ == "__main__":
+    print("\n" + "🔒" * 40)
+    print("IATP: Removing Implicit Trust")
+    print("Agent Attestation + Reputation Slashing Demo")
+    print("🔒" * 40)
+    
+    demo_attestation()
+    demo_reputation_slashing()
+    demo_network_propagation()
+    demo_integration_with_manifest()
+    
+    print("\n" + "=" * 80)
+    print("✅ Demo Complete!")
+    print("=" * 80)
+    print("\nKey Takeaways:")
+    print("1. ✅ Attestation prevents agents from running hacked code")
+    print("2. ✅ Reputation slashing penalizes misbehavior (hallucinations)")
+    print("3. ✅ Network-wide propagation shares reputation across nodes")
+    print("4. ✅ cmvk integration automatically detects and reports issues")
+    print("5. ✅ No implicit trust - everything is verified and tracked!")
+    print("\n")

modules/iatp/examples/demo_client.py

@@ -0,0 +1,240 @@
+#!/usr/bin/env python3
+"""
+IATP Demo Client
+
+This script demonstrates the Inter-Agent Trust Protocol in action.
+It shows how a client interacts with both trusted and untrusted agents
+through their IATP sidecars.
+
+Usage:
+    python examples/demo_client.py
+
+Prerequisites:
+    docker-compose up -d
+"""
+import httpx
+import json
+import sys
+from typing import Optional
+
+# Configuration
+BANK_SIDECAR_URL = "http://localhost:8081"
+HONEYPOT_SIDECAR_URL = "http://localhost:9001"
+
+def print_header(title: str):
+    """Print a formatted header."""
+    print("\n" + "=" * 70)
+    print(f"  {title}")
+    print("=" * 70)
+
+def print_json(data: dict, indent: int = 2):
+    """Print formatted JSON."""
+    print(json.dumps(data, indent=indent, default=str))
+
+def make_request(url: str, method: str = "GET", data: Optional[dict] = None, headers: Optional[dict] = None):
+    """Make an HTTP request and handle errors gracefully."""
+    try:
+        if method == "GET":
+            response = httpx.get(url, headers=headers, timeout=10)
+        else:
+            response = httpx.post(url, json=data, headers=headers, timeout=10)
+        
+        print(f"Status: {response.status_code}")
+        
+        # Print response headers
+        print("\nResponse Headers:")
+        for key, value in response.headers.items():
+            if key.lower().startswith("x-agent"):
+                print(f"  {key}: {value}")
+        
+        # Print response body
+        print("\nResponse Body:")
+        try:
+            print_json(response.json())
+        except:
+            print(response.text)
+            
+        return response
+        
+    except httpx.ConnectError:
+        print(f"❌ Connection failed. Is the service running at {url}?")
+        return None
+    except Exception as e:
+        print(f"❌ Error: {e}")
+        return None
+
+
+def demo_health_checks():
+    """Check health of both sidecars."""
+    print_header("1. HEALTH CHECKS")
+    
+    print("\n📍 Bank Sidecar Health:")
+    make_request(f"{BANK_SIDECAR_URL}/health")
+    
+    print("\n📍 Honeypot Sidecar Health:")
+    make_request(f"{HONEYPOT_SIDECAR_URL}/health")
+
+
+def demo_capability_handshake():
+    """Demonstrate the IATP handshake to exchange capabilities."""
+    print_header("2. CAPABILITY HANDSHAKE (The Trust Negotiation)")
+    
+    print("\n📍 Bank Agent Manifest (Trusted):")
+    print("   This agent has high trust level and ephemeral data retention.")
+    make_request(f"{BANK_SIDECAR_URL}/.well-known/agent-manifest")
+    
+    print("\n📍 Honeypot Agent Manifest (Untrusted):")
+    print("   This agent has low trust and permanent data retention - DANGER!")
+    make_request(f"{HONEYPOT_SIDECAR_URL}/.well-known/agent-manifest")
+
+
+def demo_trusted_request():
+    """Send a normal request to the trusted bank agent."""
+    print_header("3. REQUEST TO TRUSTED AGENT")
+    
+    print("\n📍 Sending balance check to Bank Agent (via Sidecar):")
+    print("   This should succeed because the agent is trusted.")
+    
+    data = {
+        "action": "check_balance",
+        "account_id": "ACC-12345",
+        "customer_name": "John Doe"
+    }
+    
+    print(f"\nRequest: POST {BANK_SIDECAR_URL}/proxy")
+    print(f"Payload: {json.dumps(data, indent=2)}")
+    
+    make_request(f"{BANK_SIDECAR_URL}/proxy", method="POST", data=data)
+
+
+def demo_sensitive_data_blocked():
+    """Demonstrate how sensitive data is blocked."""
+    print_header("4. SENSITIVE DATA PROTECTION")
+    
+    print("\n📍 Sending request with CREDIT CARD to agent with permanent retention:")
+    print("   This should be BLOCKED by the sidecar!")
+    
+    data = {
+        "action": "store_payment",
+        "card_number": "4532015112830366",  # Valid Luhn number
+        "customer_name": "Jane Doe"
+    }
+    
+    print(f"\nRequest: POST {HONEYPOT_SIDECAR_URL}/proxy")
+    print(f"Payload: {json.dumps(data, indent=2)}")
+    
+    make_request(f"{HONEYPOT_SIDECAR_URL}/proxy", method="POST", data=data)
+
+
+def demo_ssn_blocked():
+    """Demonstrate SSN blocking."""
+    print_header("5. SSN PROTECTION")
+    
+    print("\n📍 Sending request with SSN to agent with non-ephemeral retention:")
+    print("   This should be BLOCKED!")
+    
+    data = {
+        "action": "verify_identity",
+        "ssn": "123-45-6789",
+        "name": "Bob Smith"
+    }
+    
+    print(f"\nRequest: POST {HONEYPOT_SIDECAR_URL}/proxy")
+    print(f"Payload: {json.dumps(data, indent=2)}")
+    
+    make_request(f"{HONEYPOT_SIDECAR_URL}/proxy", method="POST", data=data)
+
+
+def demo_user_override():
+    """Demonstrate the user override flow."""
+    print_header("6. USER OVERRIDE FLOW")
+    
+    print("\n📍 Step 1: Send request to low-trust agent (no override):")
+    print("   This should return a WARNING requiring user confirmation.")
+    
+    data = {
+        "action": "get_recommendations",
+        "user_id": "USER-789"
+    }
+    
+    print(f"\nRequest: POST {HONEYPOT_SIDECAR_URL}/proxy")
+    response = make_request(f"{HONEYPOT_SIDECAR_URL}/proxy", method="POST", data=data)
+    
+    if response and response.status_code == 449:
+        print("\n📍 Step 2: Retry with X-User-Override header:")
+        print("   User has acknowledged the risk and wants to proceed.")
+        
+        headers = {"X-User-Override": "true"}
+        make_request(f"{HONEYPOT_SIDECAR_URL}/proxy", method="POST", data=data, headers=headers)
+
+
+def demo_distributed_tracing():
+    """Demonstrate distributed tracing."""
+    print_header("7. DISTRIBUTED TRACING")
+    
+    print("\n📍 Sending request with custom trace ID:")
+    
+    data = {"action": "audit_log", "event": "demo_test"}
+    headers = {"X-Agent-Trace-ID": "DEMO-TRACE-12345"}
+    
+    print(f"Trace ID: DEMO-TRACE-12345")
+    make_request(f"{BANK_SIDECAR_URL}/proxy", method="POST", data=data, headers=headers)
+    
+    print("\n📍 Retrieving trace logs:")
+    make_request(f"{BANK_SIDECAR_URL}/trace/DEMO-TRACE-12345")
+
+
+def main():
+    """Run the full demonstration."""
+    print("""
+╔══════════════════════════════════════════════════════════════════════════════╗
+║                                                                              ║
+║   ██╗ █████╗ ████████╗██████╗     ██████╗ ███████╗███╗   ███╗ ██████╗        ║
+║   ██║██╔══██╗╚══██╔══╝██╔══██╗    ██╔══██╗██╔════╝████╗ ████║██╔═══██╗       ║
+║   ██║███████║   ██║   ██████╔╝    ██║  ██║█████╗  ██╔████╔██║██║   ██║       ║
+║   ██║██╔══██║   ██║   ██╔═══╝     ██║  ██║██╔══╝  ██║╚██╔╝██║██║   ██║       ║
+║   ██║██║  ██║   ██║   ██║         ██████╔╝███████╗██║ ╚═╝ ██║╚██████╔╝       ║
+║   ╚═╝╚═╝  ╚═╝   ╚═╝   ╚═╝         ╚═════╝ ╚══════╝╚═╝     ╚═╝ ╚═════╝        ║
+║                                                                              ║
+║   Inter-Agent Trust Protocol - The Envoy for AI Agents                       ║
+║                                                                              ║
+╚══════════════════════════════════════════════════════════════════════════════╝
+    """)
+    
+    print("This demo shows how IATP protects agents and enforces trust policies.\n")
+    print(f"Bank Sidecar URL:     {BANK_SIDECAR_URL}")
+    print(f"Honeypot Sidecar URL: {HONEYPOT_SIDECAR_URL}")
+    
+    try:
+        demo_health_checks()
+        demo_capability_handshake()
+        demo_trusted_request()
+        demo_sensitive_data_blocked()
+        demo_ssn_blocked()
+        demo_user_override()
+        demo_distributed_tracing()
+        
+        print_header("DEMO COMPLETE")
+        print("""
+✅ Key Takeaways:
+   1. IATP sidecars intercept ALL agent traffic
+   2. Capability manifests enable trust negotiation
+   3. Sensitive data (credit cards, SSN) is automatically blocked
+   4. Low-trust agents require user override
+   5. Every request gets a trace ID for debugging
+
+📚 Next Steps:
+   - Try modifying the manifests in docker-compose.yml
+   - Add your own agent and protect it with a sidecar
+   - Explore the flight recorder logs
+
+🔗 Documentation: https://github.com/imran-siddique/inter-agent-trust-protocol
+        """)
+        
+    except KeyboardInterrupt:
+        print("\n\nDemo interrupted.")
+        sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

modules/iatp/examples/demo_rbac.py

@@ -0,0 +1,143 @@
+#!/usr/bin/env python3
+"""
+Demo: RBAC (Role-Based Access Control) with IATP
+
+This demo showcases how different agent types can have different permissions:
+- Coder Agent: Has both read and write access (repo:read, repo:write)
+- Reviewer Agent: Has only read access (repo:read)
+
+The handshake validation ensures agents have required scopes before proceeding.
+"""
+
+from typing import List
+
+from iatp.models import (
+    AgentCapabilities,
+    CapabilityManifest,
+    PrivacyContract,
+    RetentionPolicy,
+    ReversibilityLevel,
+    TrustLevel,
+)
+from iatp.policy_engine import IATPPolicyEngine
+
+
+def create_coder_agent_manifest() -> CapabilityManifest:
+    """Create a manifest for a Coder Agent with write permissions."""
+    return CapabilityManifest(
+        agent_id="coder-agent-v1.0",
+        agent_version="1.0.0",
+        trust_level=TrustLevel.TRUSTED,
+        capabilities=AgentCapabilities(
+            idempotency=True,
+            reversibility=ReversibilityLevel.FULL,
+            undo_window="24h",
+            sla_latency="2000ms"
+        ),
+        privacy_contract=PrivacyContract(
+            retention=RetentionPolicy.EPHEMERAL,
+            storage_location="us-west",
+            human_review=False,
+            encryption_at_rest=True,
+            encryption_in_transit=True,
+        ),
+        scopes=["repo:read", "repo:write"]  # Full access
+    )
+
+
+def create_reviewer_agent_manifest() -> CapabilityManifest:
+    """Create a manifest for a Reviewer Agent with read-only permissions."""
+    return CapabilityManifest(
+        agent_id="reviewer-agent-v1.0",
+        agent_version="1.0.0",
+        trust_level=TrustLevel.STANDARD,
+        capabilities=AgentCapabilities(
+            idempotency=True,
+            reversibility=ReversibilityLevel.NONE,
+            sla_latency="1000ms"
+        ),
+        privacy_contract=PrivacyContract(
+            retention=RetentionPolicy.TEMPORARY,
+            storage_location="us-east",
+            human_review=False,
+            encryption_at_rest=True,
+            encryption_in_transit=True,
+        ),
+        scopes=["repo:read"]  # Read-only access
+    )
+
+
+def validate_agent(manifest: CapabilityManifest, operation: str, required_scopes: List[str]):
+    """Validate an agent's permissions for a specific operation."""
+    engine = IATPPolicyEngine()
+    
+    print(f"\n{'='*70}")
+    print(f"Agent: {manifest.agent_id}")
+    print(f"Operation: {operation}")
+    print(f"Agent Scopes: {manifest.scopes}")
+    print(f"Required Scopes: {required_scopes}")
+    print(f"{'='*70}")
+    
+    is_compatible, error_msg = engine.validate_handshake(
+        manifest,
+        required_scopes=required_scopes
+    )
+    
+    if is_compatible:
+        print(f"✅ SUCCESS: Agent authorized for {operation}")
+        print(f"   Trust Level: {manifest.trust_level.value}")
+        print(f"   Trust Score: {manifest.calculate_trust_score()}/10")
+    else:
+        print(f"❌ DENIED: Agent not authorized for {operation}")
+        print(f"   Reason: {error_msg}")
+    
+    return is_compatible
+
+
+def main():
+    """Run RBAC demo scenarios."""
+    print("\n" + "="*70)
+    print("IATP RBAC (Role-Based Access Control) Demo")
+    print("="*70)
+    
+    # Create agent manifests
+    coder = create_coder_agent_manifest()
+    reviewer = create_reviewer_agent_manifest()
+    
+    # Scenario 1: Coder Agent attempting write operation (should succeed)
+    print("\n\n📝 SCENARIO 1: Coder Agent Writing Code")
+    validate_agent(coder, "Write code to repository", ["repo:write"])
+    
+    # Scenario 2: Coder Agent attempting read operation (should succeed)
+    print("\n\n📖 SCENARIO 2: Coder Agent Reading Code")
+    validate_agent(coder, "Read code from repository", ["repo:read"])
+    
+    # Scenario 3: Reviewer Agent attempting read operation (should succeed)
+    print("\n\n👀 SCENARIO 3: Reviewer Agent Reading Code")
+    validate_agent(reviewer, "Read code from repository", ["repo:read"])
+    
+    # Scenario 4: Reviewer Agent attempting write operation (should fail)
+    print("\n\n🚫 SCENARIO 4: Reviewer Agent Attempting to Write Code")
+    validate_agent(reviewer, "Write code to repository", ["repo:write"])
+    
+    # Scenario 5: Agent requiring multiple scopes
+    print("\n\n🔐 SCENARIO 5: Admin Operation Requiring Multiple Scopes")
+    validate_agent(coder, "Deploy changes", ["repo:read", "repo:write"])
+    
+    # Scenario 6: Reviewer attempting admin operation
+    print("\n\n⛔ SCENARIO 6: Reviewer Attempting Admin Operation")
+    validate_agent(reviewer, "Deploy changes", ["repo:read", "repo:write"])
+    
+    print("\n\n" + "="*70)
+    print("Demo Complete!")
+    print("="*70)
+    print("\nKey Takeaways:")
+    print("1. Coder Agent (repo:write) can perform both read and write operations")
+    print("2. Reviewer Agent (repo:read) can only perform read operations")
+    print("3. RBAC scopes are enforced during handshake validation")
+    print("4. Missing scopes result in clear error messages")
+    print("="*70 + "\n")
+
+
+if __name__ == "__main__":
+    main()