agentauth-receipts 0.1.0__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (381) hide show
  1. agentauth_receipts-0.1.0/.gitignore +83 -0
  2. agentauth_receipts-0.1.0/CHANGELOG.md +71 -0
  3. agentauth_receipts-0.1.0/LICENSE +21 -0
  4. agentauth_receipts-0.1.0/PKG-INFO +276 -0
  5. agentauth_receipts-0.1.0/README.md +231 -0
  6. agentauth_receipts-0.1.0/RELEASE.md +72 -0
  7. agentauth_receipts-0.1.0/VERSION +1 -0
  8. agentauth_receipts-0.1.0/agent_receipts/__init__.py +1 -0
  9. agentauth_receipts-0.1.0/agent_receipts/cli.py +5 -0
  10. agentauth_receipts-0.1.0/agentauth/__init__.py +99 -0
  11. agentauth_receipts-0.1.0/agentauth/backend/__init__.py +9 -0
  12. agentauth_receipts-0.1.0/agentauth/backend/api_keys.py +70 -0
  13. agentauth_receipts-0.1.0/agentauth/backend/attestation.py +199 -0
  14. agentauth_receipts-0.1.0/agentauth/backend/audit.py +137 -0
  15. agentauth_receipts-0.1.0/agentauth/backend/biscuit_keys.py +44 -0
  16. agentauth_receipts-0.1.0/agentauth/backend/capabilities.py +529 -0
  17. agentauth_receipts-0.1.0/agentauth/backend/config.py +59 -0
  18. agentauth_receipts-0.1.0/agentauth/backend/db.py +76 -0
  19. agentauth_receipts-0.1.0/agentauth/backend/deps.py +50 -0
  20. agentauth_receipts-0.1.0/agentauth/backend/errors.py +108 -0
  21. agentauth_receipts-0.1.0/agentauth/backend/identity.py +846 -0
  22. agentauth_receipts-0.1.0/agentauth/backend/main.py +62 -0
  23. agentauth_receipts-0.1.0/agentauth/backend/models.py +270 -0
  24. agentauth_receipts-0.1.0/agentauth/backend/routers/__init__.py +0 -0
  25. agentauth_receipts-0.1.0/agentauth/backend/routers/identity.py +352 -0
  26. agentauth_receipts-0.1.0/agentauth/backend/routers/verifier.py +69 -0
  27. agentauth_receipts-0.1.0/agentauth/backend/schemas.py +190 -0
  28. agentauth_receipts-0.1.0/agentauth/backend/secret_encryption.py +189 -0
  29. agentauth_receipts-0.1.0/agentauth/backend/signing_keys.py +38 -0
  30. agentauth_receipts-0.1.0/agentauth/identity/__init__.py +55 -0
  31. agentauth_receipts-0.1.0/agentauth/identity/_capabilities.py +167 -0
  32. agentauth_receipts-0.1.0/agentauth/identity/_devattest.py +207 -0
  33. agentauth_receipts-0.1.0/agentauth/identity/_http.py +105 -0
  34. agentauth_receipts-0.1.0/agentauth/identity/client.py +250 -0
  35. agentauth_receipts-0.1.0/agentauth/identity/errors.py +125 -0
  36. agentauth_receipts-0.1.0/agentauth/identity/logging.py +77 -0
  37. agentauth_receipts-0.1.0/agentauth/identity/models.py +114 -0
  38. agentauth_receipts-0.1.0/agentauth/identity/session.py +271 -0
  39. agentauth_receipts-0.1.0/agentauth/receipts/__init__.py +275 -0
  40. agentauth_receipts-0.1.0/agentauth/receipts/__main__.py +6 -0
  41. agentauth_receipts-0.1.0/agentauth/receipts/_version.py +1 -0
  42. agentauth_receipts-0.1.0/agentauth/receipts/approval.py +22 -0
  43. agentauth_receipts-0.1.0/agentauth/receipts/assurance.py +239 -0
  44. agentauth_receipts-0.1.0/agentauth/receipts/audit.py +838 -0
  45. agentauth_receipts-0.1.0/agentauth/receipts/auditor.py +85 -0
  46. agentauth_receipts-0.1.0/agentauth/receipts/authority_binding.py +238 -0
  47. agentauth_receipts-0.1.0/agentauth/receipts/budget.py +49 -0
  48. agentauth_receipts-0.1.0/agentauth/receipts/c2sp.py +224 -0
  49. agentauth_receipts-0.1.0/agentauth/receipts/certificate.py +226 -0
  50. agentauth_receipts-0.1.0/agentauth/receipts/cli.py +555 -0
  51. agentauth_receipts-0.1.0/agentauth/receipts/compliance.py +395 -0
  52. agentauth_receipts-0.1.0/agentauth/receipts/compose.py +260 -0
  53. agentauth_receipts-0.1.0/agentauth/receipts/decision.py +398 -0
  54. agentauth_receipts-0.1.0/agentauth/receipts/delegation.py +213 -0
  55. agentauth_receipts-0.1.0/agentauth/receipts/diagnostics.py +99 -0
  56. agentauth_receipts-0.1.0/agentauth/receipts/evidence.py +148 -0
  57. agentauth_receipts-0.1.0/agentauth/receipts/evidence_refs.py +28 -0
  58. agentauth_receipts-0.1.0/agentauth/receipts/explain.py +137 -0
  59. agentauth_receipts-0.1.0/agentauth/receipts/export.py +1337 -0
  60. agentauth_receipts-0.1.0/agentauth/receipts/fraud_tools.py +38 -0
  61. agentauth_receipts-0.1.0/agentauth/receipts/handoff.py +75 -0
  62. agentauth_receipts-0.1.0/agentauth/receipts/hash_util.py +15 -0
  63. agentauth_receipts-0.1.0/agentauth/receipts/hpke.py +123 -0
  64. agentauth_receipts-0.1.0/agentauth/receipts/identity_evidence.py +227 -0
  65. agentauth_receipts-0.1.0/agentauth/receipts/inference.py +113 -0
  66. agentauth_receipts-0.1.0/agentauth/receipts/lineage.py +60 -0
  67. agentauth_receipts-0.1.0/agentauth/receipts/logging_config.py +27 -0
  68. agentauth_receipts-0.1.0/agentauth/receipts/mandate.py +450 -0
  69. agentauth_receipts-0.1.0/agentauth/receipts/mcp.py +353 -0
  70. agentauth_receipts-0.1.0/agentauth/receipts/mcp_bridge.py +54 -0
  71. agentauth_receipts-0.1.0/agentauth/receipts/mcp_client.py +327 -0
  72. agentauth_receipts-0.1.0/agentauth/receipts/mcp_server.py +146 -0
  73. agentauth_receipts-0.1.0/agentauth/receipts/otel.py +93 -0
  74. agentauth_receipts-0.1.0/agentauth/receipts/partner_config.py +162 -0
  75. agentauth_receipts-0.1.0/agentauth/receipts/partner_factory.py +41 -0
  76. agentauth_receipts-0.1.0/agentauth/receipts/policy.py +127 -0
  77. agentauth_receipts-0.1.0/agentauth/receipts/policy_engine.py +298 -0
  78. agentauth_receipts-0.1.0/agentauth/receipts/preflight.py +147 -0
  79. agentauth_receipts-0.1.0/agentauth/receipts/proof.py +221 -0
  80. agentauth_receipts-0.1.0/agentauth/receipts/prover.py +143 -0
  81. agentauth_receipts-0.1.0/agentauth/receipts/proving.py +32 -0
  82. agentauth_receipts-0.1.0/agentauth/receipts/receipt_schema.py +190 -0
  83. agentauth_receipts-0.1.0/agentauth/receipts/redact.py +112 -0
  84. agentauth_receipts-0.1.0/agentauth/receipts/replay.py +134 -0
  85. agentauth_receipts-0.1.0/agentauth/receipts/repo_agent/__init__.py +1 -0
  86. agentauth_receipts-0.1.0/agentauth/receipts/repo_agent/commands.py +17 -0
  87. agentauth_receipts-0.1.0/agentauth/receipts/repo_agent/engine.py +686 -0
  88. agentauth_receipts-0.1.0/agentauth/receipts/repo_agent/policy.yaml +21 -0
  89. agentauth_receipts-0.1.0/agentauth/receipts/repo_agent/server.py +88 -0
  90. agentauth_receipts-0.1.0/agentauth/receipts/repo_agent/terminal.py +94 -0
  91. agentauth_receipts-0.1.0/agentauth/receipts/resource_refs.py +75 -0
  92. agentauth_receipts-0.1.0/agentauth/receipts/runtime.py +225 -0
  93. agentauth_receipts-0.1.0/agentauth/receipts/scitt.py +259 -0
  94. agentauth_receipts-0.1.0/agentauth/receipts/scitt_bundle.py +192 -0
  95. agentauth_receipts-0.1.0/agentauth/receipts/session.py +148 -0
  96. agentauth_receipts-0.1.0/agentauth/receipts/signing.py +286 -0
  97. agentauth_receipts-0.1.0/agentauth/receipts/tamper.py +311 -0
  98. agentauth_receipts-0.1.0/agentauth/receipts/tee.py +135 -0
  99. agentauth_receipts-0.1.0/agentauth/receipts/tee_nitro.py +375 -0
  100. agentauth_receipts-0.1.0/agentauth/receipts/tiles.py +184 -0
  101. agentauth_receipts-0.1.0/agentauth/receipts/verification.py +61 -0
  102. agentauth_receipts-0.1.0/agentauth/receipts/verifier_auth.py +162 -0
  103. agentauth_receipts-0.1.0/agentauth/receipts/verifier_server.py +177 -0
  104. agentauth_receipts-0.1.0/agentauth/receipts/witness.py +156 -0
  105. agentauth_receipts-0.1.0/agentauth/receipts/wrapper.py +507 -0
  106. agentauth_receipts-0.1.0/agentauth/workload_keys.py +195 -0
  107. agentauth_receipts-0.1.0/backend/.venv-test/lib/python3.12/site-packages/_pytest/config/__init__.py +2246 -0
  108. agentauth_receipts-0.1.0/backend/.venv-test/lib/python3.12/site-packages/_pytest/config/argparsing.py +503 -0
  109. agentauth_receipts-0.1.0/backend/.venv-test/lib/python3.12/site-packages/_pytest/config/exceptions.py +15 -0
  110. agentauth_receipts-0.1.0/backend/.venv-test/lib/python3.12/site-packages/_pytest/config/findpaths.py +350 -0
  111. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/examples/Test_FDB_Loader.ipynb +6868 -0
  112. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/afd/README.md +40 -0
  113. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/afd/configs/CreditCardFraudDetection.json +158 -0
  114. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/afd/configs/FakeJobPostingPrediction.json +93 -0
  115. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/afd/configs/Fraudecommerce.json +43 -0
  116. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/afd/configs/IEEECISFraudDetection.json +348 -0
  117. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/afd/configs/IPBlocklist.json +23 -0
  118. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/afd/configs/MaliciousURL.json +23 -0
  119. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/afd/configs/SimulatedCreditCardTransactionsSparkov.json +98 -0
  120. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/afd/configs/TwitterBotAccounts.json +93 -0
  121. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/afd/configs/VehicleLoanDefaultPrediction.json +203 -0
  122. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/afd/create_afd_resources.py +204 -0
  123. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/afd/score_afd_model.py +269 -0
  124. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/autogluon/README.md +4 -0
  125. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/autogluon/benchmark_ag.py +81 -0
  126. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/autogluon/example-ag-ieeecis.ipynb +2183 -0
  127. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/autosklearn/README.md +13 -0
  128. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/autosklearn/benchmark_autosklearn.py +173 -0
  129. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/benchmark_utils.py +46 -0
  130. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/h2o/README.md +4 -0
  131. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/h2o/benchmark_h2o.py +100 -0
  132. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/h2o/example-h2o-ieeecis.ipynb +2254 -0
  133. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/label-noise/benchmark_experiments.ipynb +494 -0
  134. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/label-noise/feature_dict.py +206 -0
  135. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/label-noise/load_fdb_datasets.py +356 -0
  136. agentauth_receipts-0.1.0/benchmarks/corpus/amazon_fdb/scripts/reproducibility/label-noise/micro_models.py +197 -0
  137. agentauth_receipts-0.1.0/benchmarks/corpus/gorilla/berkeley-function-call-leaderboard/CHANGELOG.md +473 -0
  138. agentauth_receipts-0.1.0/benchmarks/corpus/gorilla/berkeley-function-call-leaderboard/bfcl_eval/scripts/_compile_helper.py +249 -0
  139. agentauth_receipts-0.1.0/benchmarks/corpus/gorilla/berkeley-function-call-leaderboard/bfcl_eval/scripts/check_func_doc_format.py +423 -0
  140. agentauth_receipts-0.1.0/benchmarks/corpus/gorilla/berkeley-function-call-leaderboard/bfcl_eval/scripts/check_illegal_python_param_name.py +72 -0
  141. agentauth_receipts-0.1.0/benchmarks/corpus/gorilla/berkeley-function-call-leaderboard/bfcl_eval/scripts/compile_multi_turn_func_doc.py +50 -0
  142. agentauth_receipts-0.1.0/benchmarks/corpus/gorilla/berkeley-function-call-leaderboard/bfcl_eval/scripts/visualize_multi_turn_ground_truth_conversation.py +138 -0
  143. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/config/__init__.py +1 -0
  144. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/config/benchmark_config.yaml +205 -0
  145. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/config/config_loader.py +677 -0
  146. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/bibliomantic-mcp-server/docs/ADR-001-enhanced-data-layer.md +47 -0
  147. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/CHANGELOG.md +390 -0
  148. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/CNAME +1 -0
  149. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/FDA_SECURITY.md +289 -0
  150. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/apis/error-codes.md +395 -0
  151. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/apis/overview.md +112 -0
  152. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/apis/python-sdk.md +671 -0
  153. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/assets/biomcp-cursor-locations.png +0 -0
  154. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/assets/favicon.ico +0 -0
  155. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/assets/icon.png +0 -0
  156. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/assets/logo.png +0 -0
  157. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/assets/mcp_architecture.txt +16 -0
  158. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/assets/remote-connection/00_connectors.png +0 -0
  159. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/assets/remote-connection/01_add_custom_connector.png +0 -0
  160. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/assets/remote-connection/02_connector_enabled.png +0 -0
  161. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/assets/remote-connection/03_connect_to_biomcp.png +0 -0
  162. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/assets/remote-connection/04_select_google_oauth.png +0 -0
  163. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/assets/remote-connection/05_success_connect.png +0 -0
  164. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/backend-services-reference/01-overview.md +199 -0
  165. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/backend-services-reference/02-biothings-suite.md +481 -0
  166. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/backend-services-reference/03-cbioportal.md +141 -0
  167. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/backend-services-reference/04-clinicaltrials-gov.md +134 -0
  168. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/backend-services-reference/05-nci-cts-api.md +453 -0
  169. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/backend-services-reference/06-pubtator3.md +210 -0
  170. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/backend-services-reference/07-alphagenome.md +466 -0
  171. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/blog/ai-assisted-clinical-trial-search-analysis.md +77 -0
  172. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/blog/images/deep-researcher-video.png +0 -0
  173. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/blog/images/researcher-announce.png +0 -0
  174. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/blog/images/researcher-drop-down.png +0 -0
  175. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/blog/images/researcher-prompt.png +0 -0
  176. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/blog/images/trial-search-assistant.png +0 -0
  177. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/blog/images/what_is_biomcp_thumbnail.png +0 -0
  178. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/blog/researcher-persona-resource.md +157 -0
  179. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/changelog.md +390 -0
  180. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/concepts/01-what-is-biomcp.md +50 -0
  181. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/concepts/02-the-deep-researcher-persona.md +218 -0
  182. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/concepts/03-sequential-thinking-with-the-think-tool.md +239 -0
  183. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/developer-guides/01-server-deployment.md +551 -0
  184. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/developer-guides/02-contributing-and-testing.md +714 -0
  185. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/developer-guides/03-third-party-endpoints.md +347 -0
  186. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/developer-guides/04-transport-protocol.md +286 -0
  187. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/developer-guides/05-error-handling.md +189 -0
  188. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/developer-guides/06-http-client-and-caching.md +244 -0
  189. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/developer-guides/07-performance-optimizations.md +149 -0
  190. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/developer-guides/generate_endpoints.py +34 -0
  191. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/faq-condensed.md +86 -0
  192. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/genomoncology.md +47 -0
  193. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/getting-started/01-quickstart-cli.md +216 -0
  194. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/getting-started/02-claude-desktop-integration.md +292 -0
  195. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/getting-started/03-authentication-and-api-keys.md +319 -0
  196. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/how-to-guides/01-find-articles-and-cbioportal-data.md +322 -0
  197. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/how-to-guides/02-find-trials-with-nci-and-biothings.md +431 -0
  198. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/how-to-guides/03-get-comprehensive-variant-annotations.md +490 -0
  199. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/how-to-guides/04-predict-variant-effects-with-alphagenome.md +586 -0
  200. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/how-to-guides/05-logging-and-monitoring-with-bigquery.md +187 -0
  201. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/how-to-guides/06-search-nci-organizations-and-interventions.md +684 -0
  202. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/index.md +250 -0
  203. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/policies.md +396 -0
  204. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/reference/architecture-diagrams.md +217 -0
  205. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/reference/quick-architecture.md +58 -0
  206. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/reference/quick-reference.md +416 -0
  207. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/reference/visual-architecture.md +84 -0
  208. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/robots.txt +16 -0
  209. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/stylesheets/announcement.css +130 -0
  210. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/stylesheets/extra.css +170 -0
  211. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/troubleshooting.md +487 -0
  212. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/tutorials/biothings-prompts.md +362 -0
  213. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/tutorials/claude-code-biomcp-alphagenome.md +254 -0
  214. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/tutorials/nci-prompts.md +312 -0
  215. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/tutorials/openfda-integration.md +397 -0
  216. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/tutorials/openfda-prompts.md +481 -0
  217. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/tutorials/remote-connection.md +107 -0
  218. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/user-guides/01-command-line-interface.md +561 -0
  219. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/user-guides/02-mcp-tools-reference.md +743 -0
  220. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/user-guides/03-integrating-with-ides-and-clients.md +578 -0
  221. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/docs/workflows/all-workflows.md +377 -0
  222. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/scripts/check_docs_in_mkdocs.py +71 -0
  223. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/scripts/check_http_imports.py +146 -0
  224. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/scripts/generate_endpoints_doc.py +46 -0
  225. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/biomcp/tests/config/test_smithery_config.py +114 -0
  226. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/context7-mcp/docs/README.ar.md +342 -0
  227. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/context7-mcp/docs/README.de.md +358 -0
  228. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/context7-mcp/docs/README.es.md +262 -0
  229. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/context7-mcp/docs/README.fr.md +412 -0
  230. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/context7-mcp/docs/README.id-ID.md +361 -0
  231. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/context7-mcp/docs/README.it.md +359 -0
  232. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/context7-mcp/docs/README.ja.md +714 -0
  233. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/context7-mcp/docs/README.ko.md +978 -0
  234. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/context7-mcp/docs/README.pt-BR.md +359 -0
  235. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/context7-mcp/docs/README.ru.md +438 -0
  236. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/context7-mcp/docs/README.tr.md +381 -0
  237. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/context7-mcp/docs/README.uk.md +890 -0
  238. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/context7-mcp/docs/README.zh-CN.md +338 -0
  239. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/context7-mcp/docs/README.zh-TW.md +573 -0
  240. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/context7-mcp/docs/adding-projects.md +118 -0
  241. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/dexpaprika-mcp/CHANGELOG.md +86 -0
  242. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/mcp-nixos/website/app/docs/claude.html +17734 -0
  243. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/mcp-nixos/website/app/docs/page.tsx +1630 -0
  244. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/paper-search-mcp/docs/images/demo.png +0 -0
  245. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/unit-converter-mcp/CHANGELOG.md +67 -0
  246. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/wikipedia-mcp/CHANGELOG.md +97 -0
  247. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/wikipedia-mcp/docs/API.md +145 -0
  248. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/wikipedia-mcp/docs/DEVELOPMENT.md +191 -0
  249. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/wikipedia-mcp/docs/RELEASE_PROCESS.md +160 -0
  250. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/wikipedia-mcp/docs/TESTING.md +162 -0
  251. agentauth_receipts-0.1.0/benchmarks/corpus/mcp_bench/mcp_servers/wikipedia-mcp/examples/wikipedia_mcp_example.py +132 -0
  252. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/CHANGELOG.md +249 -0
  253. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/docs/cli-reference.md +359 -0
  254. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/docs/evaluation.md +196 -0
  255. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/docs/getting-started.md +215 -0
  256. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/docs/leaderboard-submission.md +651 -0
  257. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/docs/running_simulations.md +286 -0
  258. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/docs/voice-personas.md +168 -0
  259. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/examples/agents/README.md +64 -0
  260. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/examples/agents/custom_agent_eval.py +190 -0
  261. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/examples/agents/minimal_text_agent.py +161 -0
  262. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/examples/agents/react_agent.py +242 -0
  263. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/scripts/start_tau2_server.sh +4 -0
  264. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/__init__.py +0 -0
  265. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/analyze_vad_silence.py +222 -0
  266. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/check_data.py +31 -0
  267. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/evaluate_trajectories.py +198 -0
  268. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/get_experiment_results.py +139 -0
  269. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/leaderboard/MAINTAINER.md +136 -0
  270. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/leaderboard/__init__.py +97 -0
  271. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/leaderboard/generate_schema.py +80 -0
  272. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/leaderboard/leaderboard.py +507 -0
  273. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/leaderboard/prepare_submission.py +920 -0
  274. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/leaderboard/review_submission.py +437 -0
  275. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/leaderboard/submission.py +436 -0
  276. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/leaderboard/trim_trajectories.py +260 -0
  277. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/leaderboard/verify_trajectories.py +111 -0
  278. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/leaderboard/verify_trajectories_private.py +8 -0
  279. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/leaderboard/verify_trajectories_public.py +73 -0
  280. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/manual_mode.py +758 -0
  281. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/per_task_summary.py +359 -0
  282. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/recombine_rewards.py +268 -0
  283. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/review_conversation.py +1247 -0
  284. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/show_domain_doc.py +79 -0
  285. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/start_servers.py +101 -0
  286. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/scripts/view_simulations.py +1125 -0
  287. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/voice/scripts/elevenlabs.py +173 -0
  288. agentauth_receipts-0.1.0/benchmarks/corpus/tau2_bench/src/tau2/voice/scripts/setup_voices.py +381 -0
  289. agentauth_receipts-0.1.0/benchmarks/policies/mcp_permissive.yaml +10 -0
  290. agentauth_receipts-0.1.0/benchmarks/policies/tau2_mock.yaml +10 -0
  291. agentauth_receipts-0.1.0/compliance/README.md +12 -0
  292. agentauth_receipts-0.1.0/compliance/eu-ai-act.yaml +57 -0
  293. agentauth_receipts-0.1.0/compliance/fixtures/ecs_ingest_sample.json +36 -0
  294. agentauth_receipts-0.1.0/compliance/iso27001.yaml +57 -0
  295. agentauth_receipts-0.1.0/compliance/soc2.yaml +60 -0
  296. agentauth_receipts-0.1.0/config/certs/README.md +9 -0
  297. agentauth_receipts-0.1.0/config/certs/aws_nitro_enclaves_root_g1.pem +14 -0
  298. agentauth_receipts-0.1.0/config/cursor-mcp.json.example +11 -0
  299. agentauth_receipts-0.1.0/config/env.example +17 -0
  300. agentauth_receipts-0.1.0/config/partner.example.yaml +22 -0
  301. agentauth_receipts-0.1.0/config/partner.production.example.yaml +19 -0
  302. agentauth_receipts-0.1.0/docs/architecture.md +127 -0
  303. agentauth_receipts-0.1.0/docs/assurance_taxonomy.md +92 -0
  304. agentauth_receipts-0.1.0/docs/backward_compatibility.md +54 -0
  305. agentauth_receipts-0.1.0/docs/combined_corpus_sota_review.md +207 -0
  306. agentauth_receipts-0.1.0/docs/compliance_mapping.md +71 -0
  307. agentauth_receipts-0.1.0/docs/decision_model.md +142 -0
  308. agentauth_receipts-0.1.0/docs/deployment.md +93 -0
  309. agentauth_receipts-0.1.0/docs/design_partner.md +200 -0
  310. agentauth_receipts-0.1.0/docs/execution_context.md +108 -0
  311. agentauth_receipts-0.1.0/docs/http_verifier.md +86 -0
  312. agentauth_receipts-0.1.0/docs/inference_and_composition.md +183 -0
  313. agentauth_receipts-0.1.0/docs/l1_l2_hardening.md +88 -0
  314. agentauth_receipts-0.1.0/docs/l1_l2_sota_assessment.md +251 -0
  315. agentauth_receipts-0.1.0/docs/l1_l2_token_architecture.md +61 -0
  316. agentauth_receipts-0.1.0/docs/l1_l3l4_boundary.md +131 -0
  317. agentauth_receipts-0.1.0/docs/l3_l4_backlog.md +453 -0
  318. agentauth_receipts-0.1.0/docs/landscape_research.md +739 -0
  319. agentauth_receipts-0.1.0/docs/mcp_integration.md +91 -0
  320. agentauth_receipts-0.1.0/docs/mcp_live_server.md +146 -0
  321. agentauth_receipts-0.1.0/docs/open_standard_strategy.md +532 -0
  322. agentauth_receipts-0.1.0/docs/otel_genai_mapping.md +46 -0
  323. agentauth_receipts-0.1.0/docs/partner_runbook.md +129 -0
  324. agentauth_receipts-0.1.0/docs/policy_language.md +28 -0
  325. agentauth_receipts-0.1.0/docs/receipt_bundle_v2.md +67 -0
  326. agentauth_receipts-0.1.0/docs/roadmap.md +61 -0
  327. agentauth_receipts-0.1.0/docs/scitt.md +80 -0
  328. agentauth_receipts-0.1.0/docs/security_issues_backlog.md +1124 -0
  329. agentauth_receipts-0.1.0/docs/sota_backlog.md +378 -0
  330. agentauth_receipts-0.1.0/docs/sp1_benchmark.md +64 -0
  331. agentauth_receipts-0.1.0/docs/state_of_the_art.md +218 -0
  332. agentauth_receipts-0.1.0/docs/tee_attestation.md +96 -0
  333. agentauth_receipts-0.1.0/docs/tlog_tiles.md +41 -0
  334. agentauth_receipts-0.1.0/docs/trust_model.md +116 -0
  335. agentauth_receipts-0.1.0/docs/v1-decisions/01-identity-service.md +112 -0
  336. agentauth_receipts-0.1.0/docs/v2-decisions/01-identity-attestation.md +115 -0
  337. agentauth_receipts-0.1.0/docs/witnessing.md +89 -0
  338. agentauth_receipts-0.1.0/examples/01_quickstart.py +70 -0
  339. agentauth_receipts-0.1.0/examples/02_capabilities.py +131 -0
  340. agentauth_receipts-0.1.0/examples/README.md +42 -0
  341. agentauth_receipts-0.1.0/examples/common.py +189 -0
  342. agentauth_receipts-0.1.0/examples/composed_prove_fraud_agent.py +51 -0
  343. agentauth_receipts-0.1.0/examples/mcp_fraud_agent.py +88 -0
  344. agentauth_receipts-0.1.0/examples/mcp_live_client.py +61 -0
  345. agentauth_receipts-0.1.0/examples/mcp_live_prove_client.py +83 -0
  346. agentauth_receipts-0.1.0/examples/mcp_live_server.py +15 -0
  347. agentauth_receipts-0.1.0/examples/mcp_sse_client.py +51 -0
  348. agentauth_receipts-0.1.0/examples/partner_pilot.py +74 -0
  349. agentauth_receipts-0.1.0/examples/poisoned-repo/AGENTS.md +9 -0
  350. agentauth_receipts-0.1.0/examples/poisoned-repo/BEE_MOVIE.txt +12 -0
  351. agentauth_receipts-0.1.0/examples/poisoned-repo/README.md +14 -0
  352. agentauth_receipts-0.1.0/examples/poisoned-repo/scripts/print_manifest.sh +4 -0
  353. agentauth_receipts-0.1.0/examples/poisoned-repo/scripts/setup.sh +10 -0
  354. agentauth_receipts-0.1.0/examples/poisoned-repo/src/calc.py +5 -0
  355. agentauth_receipts-0.1.0/examples/poisoned-repo/tests/test_calc.py +5 -0
  356. agentauth_receipts-0.1.0/examples/proven_fraud_agent.py +50 -0
  357. agentauth_receipts-0.1.0/examples/requirements.txt +19 -0
  358. agentauth_receipts-0.1.0/examples/shadow_fraud_agent.py +54 -0
  359. agentauth_receipts-0.1.0/identity/scripts/demo.sh +67 -0
  360. agentauth_receipts-0.1.0/identity/scripts/install.sh +81 -0
  361. agentauth_receipts-0.1.0/identity/scripts/register-entries.sh +50 -0
  362. agentauth_receipts-0.1.0/identity/scripts/setup-cluster.sh +36 -0
  363. agentauth_receipts-0.1.0/identity/scripts/teardown.sh +6 -0
  364. agentauth_receipts-0.1.0/policies/fraud_decision.yaml +23 -0
  365. agentauth_receipts-0.1.0/pyproject.toml +138 -0
  366. agentauth_receipts-0.1.0/scripts/arctl.sh +58 -0
  367. agentauth_receipts-0.1.0/scripts/bootstrap.sh +24 -0
  368. agentauth_receipts-0.1.0/scripts/coverage_summary.py +125 -0
  369. agentauth_receipts-0.1.0/scripts/download_benchmark_corpora.sh +69 -0
  370. agentauth_receipts-0.1.0/scripts/export_fraud_onnx.py +90 -0
  371. agentauth_receipts-0.1.0/scripts/ezkl_setup_fraud_head.sh +40 -0
  372. agentauth_receipts-0.1.0/scripts/gen_cursor_mcp.py +47 -0
  373. agentauth_receipts-0.1.0/scripts/partner_preflight.sh +70 -0
  374. agentauth_receipts-0.1.0/scripts/partner_smoke.sh +57 -0
  375. agentauth_receipts-0.1.0/scripts/prove_tier_matrix.py +139 -0
  376. agentauth_receipts-0.1.0/scripts/run_repo_agent.sh +64 -0
  377. agentauth_receipts-0.1.0/scripts/run_repo_agent_ui.sh +64 -0
  378. agentauth_receipts-0.1.0/scripts/scaffold_policy.py +91 -0
  379. agentauth_receipts-0.1.0/scripts/sp1_benchmark_fraud_head.sh +25 -0
  380. agentauth_receipts-0.1.0/scripts/sp1_build_fraud_head.sh +66 -0
  381. agentauth_receipts-0.1.0/scripts/zkvm_prove_fraud_head.sh +36 -0
agentauth_receipts-0.1.0/.gitignore ADDED
@@ -0,0 +1,83 @@
1
+ # Rust
2
+ /target/
3
+ # Detached zkVM crate builds into its own target dir (RISC Zero toolchain output)
4
+ crates/agent-receipts-zkvm/target/
5
+ **/*.rs.bk
6
+
7
+ # Python
8
+ __pycache__/
9
+ *.py[cod]
10
+ *.egg-info/
11
+ .eggs/
12
+ dist/
13
+ build/
14
+ .venv/
15
+ venv/
16
+ .python-version
17
+ .pytest_cache/
18
+ .mypy_cache/
19
+ .ruff_cache/
20
+
21
+ # Coverage
22
+ .coverage
23
+ .coverage.*
24
+ coverage.json
25
+ coverage.xml
26
+ htmlcov/
27
+ lcov.info
28
+ target/llvm-cov/
29
+ dashboard/coverage/
30
+
31
+ # Backend identity service
32
+ backend/.venv/
33
+ backend/agents.db
34
+ backend/audit.jsonl
35
+ backend/.env
36
+
37
+ # Node / dashboard
38
+ dashboard/node_modules/
39
+ dashboard/dist/
40
+
41
+ # Local dev
42
+ .env
43
+ *.db
44
+ *.sqlite
45
+ .audit/
46
+ /receipts/
47
+ *.redacted.json
48
+ config/partner.yaml
49
+ certs/*.pem
50
+ certs/*.json
51
+ !certs/.gitkeep
52
+
53
+ # IDE / misc
54
+ .idea/
55
+ .vscode/
56
+ .cursor/mcp.json
57
+ *.swp
58
+ *.log
59
+ .DS_Store
60
+
61
+ # Proving artifacts and generated key caches (large)
62
+ /proofs/
63
+ /keys/*.bin
64
+ /keys/**/*.bin
65
+ /keys/*.sha256
66
+ /keys/**/*.sha256
67
+ !/keys/.gitkeep
68
+
69
+ # Generated compliance scratch fixtures
70
+ /compliance/fixtures/*.generated.json
71
+ /compliance/fixtures/*.tmp.json
72
+
73
+ # Local caches
74
+ .cache/
75
+ .vendor/
76
+
77
+ # Signing private keys — never commit
78
+ keys/signing/
79
+ *.key
80
+
81
+ # Claude Code session/tooling
82
+ .claude/
83
+ SECURITY_AUDIT.md
agentauth_receipts-0.1.0/CHANGELOG.md ADDED
@@ -0,0 +1,71 @@
1
+ # Changelog
2
+
3
+ All notable changes to this project are documented here.
4
+
5
+ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
6
+
7
+ ## [Unreleased]
8
+
9
+ ### Added — evidence plane (ZK binding + signing)
10
+
11
+ - Halo2 policy proof now **binds the committed output and policy** into its public inputs
12
+ (`commitment_to_field`); editing a receipt's `output_hash` / `policy_commitment` after
13
+ proving fails verification. (Circuit id bumped; superseded by `policy_range_v3`.)
14
+ - Ed25519 signing module (`agent_receipts.signing`): `SigningKey`, `generate_keypair`,
15
+ `load_or_create_key`, and envelope-level `sign_bundle` / `verify_bundle_signatures`.
16
+ - Audit log hardening: optional per-record Ed25519 signatures, `verify_signatures()`, and a
17
+ signed Merkle `signed_checkpoint()` / `verify_checkpoint()` that detects a full-chain rewrite.
18
+ - `cryptography` runtime dependency; `keys/signing/` private keys git-ignored.
19
+
20
+ ### Changed
21
+
22
+ - Trust model docs updated with output-binding, signature, and checkpoint guarantees.
23
+
24
+ ## [0.2.1] - 2026-05-29
25
+
26
+ ### Added — deployment hardening (pre design partner ship)
27
+
28
+ - `arctl preflight` go/no-go checks (config, policy, writable dirs, prove readiness)
29
+ - `scripts/partner_preflight.sh` deployment gate
30
+ - HTTP verifier: optional API key auth, rate limiting, body size cap, `GET /ready`
31
+ - Stable agent identity via `persist_certificate` (load/create JSON cert)
32
+ - `PartnerConfig` strict mode, env overrides (`AGENT_RECEIPTS_*`)
33
+ - [docs/deployment.md](docs/deployment.md), `config/partner.production.example.yaml`, `config/env.example`
34
+ - `partner_factory.build_agent_from_config()` for integrations
35
+ - Structured logging via `AGENT_RECEIPTS_LOG_LEVEL`
36
+
37
+ ## [0.2.0] - 2026-05-29
38
+
39
+ ### Added — design partner readiness
40
+
41
+ - HTTP verifier service (`POST /v1/verify`, `GET /health`, `GET /v1/version`) via `arctl serve`
42
+ - Partner onboarding guide ([docs/design_partner.md](docs/design_partner.md))
43
+ - Partner operations runbook ([docs/partner_runbook.md](docs/partner_runbook.md))
44
+ - Receipt bundle export (`agent-receipts.receipt-bundle.v1`) and `arctl verify-bundle`
45
+ - `arctl` CLI: `doctor`, `export-audit`, `show-config`, `redact`, `serve`
46
+ - Partner YAML config (`config/partner.example.yaml`) and `examples/partner_pilot.py`
47
+ - `scripts/bootstrap.sh` and `scripts/partner_smoke.sh`
48
+ - `scripts/scaffold_policy.py` for custom policy YAML from schema/tools
49
+ - `arctl redact` for sharing receipts without PII
50
+ - Docker image and `docker-compose.yml` (verifier + optional MCP profile)
51
+ - [RELEASE.md](RELEASE.md) pinning instructions for pilot deployments
52
+
53
+ ### Changed
54
+
55
+ - MCP server supports stdio, SSE, and streamable HTTP transports
56
+ - `ReceiptedMcpClient` supports prove + composed proofs on live MCP
57
+ - Python tooling CLI renamed to **`arctl`** (Rust binary remains **`agent-receipts`**)
58
+
59
+ ## [0.1.0] - 2026-05-29
60
+
61
+ ### Added
62
+
63
+ - Rust core: certificates, audit chain, proof envelopes
64
+ - Python SDK: `Policy`, `AgentWrapper`, operating modes
65
+ - Halo2 `policy_range_v1` circuit and CLI prove/verify
66
+ - MCP integration: gateway, delegation, live server
67
+ - EZKL fraud head path and logical composed verification
68
+
69
+ [0.2.0]: https://github.com/pberlizov/agent-receipts/compare/v0.1.0...v0.2.0
70
+ [0.2.1]: https://github.com/pberlizov/agent-receipts/compare/v0.2.0...v0.2.1
71
+ [0.1.0]: https://github.com/pberlizov/agent-receipts/releases/tag/v0.1.0
agentauth_receipts-0.1.0/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 Agent Receipts contributors
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
agentauth_receipts-0.1.0/PKG-INFO ADDED
@@ -0,0 +1,276 @@
1
+ Metadata-Version: 2.4
2
+ Name: agentauth-receipts
3
+ Version: 0.1.0
4
+ Summary: AgentAuth — attested identity and verifiable execution receipts for autonomous AI agents
5
+ License-Expression: MIT
6
+ License-File: LICENSE
7
+ Requires-Python: <3.14,>=3.10
8
+ Requires-Dist: biscuit-python<0.5,>=0.4
9
+ Requires-Dist: cbor2>=5.4
10
+ Requires-Dist: cryptography>=42.0
11
+ Requires-Dist: httpx>=0.27
12
+ Requires-Dist: pyjwt<3.0,>=2.8
13
+ Requires-Dist: pyyaml>=6.0
14
+ Provides-Extra: dev
15
+ Requires-Dist: agentauth[mcp,server,verifier]; extra == 'dev'
16
+ Requires-Dist: coverage[toml]>=7.5; extra == 'dev'
17
+ Requires-Dist: diff-cover>=9.0; extra == 'dev'
18
+ Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
19
+ Requires-Dist: pytest-cov>=5.0; extra == 'dev'
20
+ Requires-Dist: pytest>=8.0; extra == 'dev'
21
+ Requires-Dist: ruff>=0.4; extra == 'dev'
22
+ Provides-Extra: ezkl
23
+ Requires-Dist: agentauth[onnx]; extra == 'ezkl'
24
+ Provides-Extra: kms
25
+ Requires-Dist: boto3>=1.34; extra == 'kms'
26
+ Requires-Dist: google-cloud-kms>=2.20; extra == 'kms'
27
+ Provides-Extra: mcp
28
+ Requires-Dist: httpx>=0.27; extra == 'mcp'
29
+ Requires-Dist: mcp>=1.0; extra == 'mcp'
30
+ Requires-Dist: uvicorn>=0.30; extra == 'mcp'
31
+ Provides-Extra: onnx
32
+ Requires-Dist: numpy>=1.26; extra == 'onnx'
33
+ Requires-Dist: onnx>=1.16; extra == 'onnx'
34
+ Provides-Extra: partner
35
+ Requires-Dist: agentauth[dev,mcp,server,verifier]; extra == 'partner'
36
+ Provides-Extra: server
37
+ Requires-Dist: fastapi<1.0,>=0.110; extra == 'server'
38
+ Requires-Dist: pydantic<3.0,>=2.6; extra == 'server'
39
+ Requires-Dist: sqlalchemy<3.0,>=2.0; extra == 'server'
40
+ Requires-Dist: uvicorn[standard]<1.0,>=0.27; extra == 'server'
41
+ Provides-Extra: verifier
42
+ Requires-Dist: starlette>=0.37; extra == 'verifier'
43
+ Requires-Dist: uvicorn>=0.30; extra == 'verifier'
44
+ Description-Content-Type: text/markdown
45
+
46
+ # Agent Receipts
47
+
48
+ Cryptographic receipts for autonomous AI agents: prove that a consequential action was **authorized**, ran on the **claimed model**, and satisfied a **committed policy**.
49
+
50
+ OAuth 2.1 and MCP answer *who may act*. Agent Cards are self-declared. Agent Receipts answer *what actually happened* with a verifiable `ExecutionProof`, a lower-layer decision model, and a tamper-evident audit chain.
51
+
52
+ ---
53
+
54
+ # AgentAuth for autonomous coding agents (Cognition / Devin)
55
+
56
+ An autonomous software engineer like Devin acts directly on enterprise codebases: it reads repositories, issues, and PRs; runs commands; pushes commits; and spawns sub-agents. The thing standing between Devin and broad enterprise adoption is **trust** — can you prove what Devin did, prove it stayed inside the scope a human authorized, and be sure the record itself can't be forged? AgentAuth is the identity-and-verifiable-execution layer that answers those questions cryptographically. It turns Devin's output from *"commits your security team has to review"* into *"output guaranteed to have stayed within authorized scope, with machine-verifiable proof."*
57
+
58
+ This section has three parts: **Section 1** ranks what we have today by fit to Cognition's problems and summarizes the Cognition-tailored features we propose to build; **Section 2** describes the current capabilities in depth; **Section 3** is the technical implementation plan for the proposed features.
59
+
60
+ > **Honesty line.** Everything under "Built today" is implemented and, where noted, empirically validated. Everything under "Proposed" is roadmap — designed but not yet built. We mark the boundary explicitly because a verification company that overstates its own guarantees has already failed its one job.
61
+
62
+ ## Section 1 — Ranked fit for Cognition
63
+
64
+ ### Built today (ranked by fit to Cognition's enterprise-trust blockers)
65
+
66
+ 1. **Pre-action authorization + capability tokens (scope containment).** Every consequential Devin action is checked against a committed policy and a capability token *before it executes*; an injected or off-task Devin that reaches outside its authorized scope (files, repos, tools, network) is blocked before the action runs, not flagged after. This is the blast-radius control that makes granting Devin write access defensible at all.
67
+ 2. **Tamper-evident, cryptographically verifiable execution receipts.** Each action produces an `ExecutionProof` bound into a hash-chained Merkle audit log, so you can prove exactly what Devin did, under whose authority, and that the record was not altered afterward. Empirically validated: across **~284,000 adversarial tamper trials**, AgentAuth's false-accept rate on forgeable content is **~0**, versus **67–100%** for conventional logging and signed-receipt designs.
68
+ 3. **Attested agent identity, bound into every receipt.** Each Devin instance carries a short-lived, attested SPIFFE / JWT-SVID identity acting under a *named human principal*, cryptographically tied to every action — answering "which Devin, under whose authorization" with a signature an attacker cannot swap, not a self-declared label.
69
+ 4. **Privacy-preserving proof of policy compliance (ZK).** A zero-knowledge proof shows Devin's execution satisfied the committed policy *without revealing* the proprietary codebase, inputs, or model to the verifier — cryptographic compliance evidence that doesn't require exposing customer IP.
70
+ 5. **Capability delegation with monotonic attenuation (sub-agents).** When Devin spawns sub-agents, their capability tokens are *attenuations* of Devin's — they can only narrow scope, never widen it — giving a cryptographic authority chain across the entire agent tree.
71
+ 6. **Standards-conformant, independently verifiable evidence.** Receipts emit SCITT/COSE statements and a C2SP transparency-log format that an **independent** verifier (re-implemented from the specs, not our code) accepts — so the evidence plugs into the supply-chain and transparency tooling enterprises already run.
72
+
73
+ ### Proposed, Cognition-tailored (roadmap — technical plans in Section 3)
74
+
75
+ - **Injection detection via behavioral anomaly.** Today we *contain* an injected Devin; we don't *detect* the injection. A learned model of normal Devin behavior flags the statistical signature of an injection in the action sequence — turning "block the out-of-scope action" into "Devin was compromised, here is the evidence."
76
+ - **Memory-state commitment (sleeper-agent defense).** Commit a hash of Devin's full memory state (Wiki index, task context, observations) at each step and prove memory changed only via legitimate operations — closing the gap where poisoned memory yields legitimate-looking actions taken against a corrupted internal model.
77
+ - **Attestation chains through the CI/CD pipeline.** Devin's signed action attestation propagates through build → test → scan → deploy; a commit without a valid agent attestation stops the pipeline, extending the integrity chain from the original human authorization all the way to production.
78
+ - **Adversarial task-decomposition verification.** The human's original task is signed; every subtask Devin generates for a sub-agent is verified to be a semantic decomposition of that signed intent — so even a poisoned Devin cannot redirect sub-agents toward objectives the human never authorized.
79
+
80
+ ## Section 2 — Built today, in depth
81
+
82
+ **Pre-action authorization + capability tokens.** The policy engine (`agentauth/receipts/`) evaluates each `ActionDescriptor` against a committed policy and the action's capability token before the wrapper lets it execute; in `bounded_auto` mode a violation forces an abstain output. Capabilities are Biscuit tokens (`agentauth/backend/capabilities.py`) with offline verification and request-bound proof-of-possession, so authorization is enforced at the edge without a callback to a central server. For Devin this is the difference between "an injected agent can do anything Devin can" and "an injected agent is confined to the files, tools, and network the task authorized."
83
+
84
+ **Verifiable receipts + Merkle audit log.** `AgentWrapper` records a `DecisionResult` and builds an `ExecutionProof` that binds the output, the execution context, the policy commitment, and the attested identity; receipts are appended to an RFC 6962 hash-chained log (`agentauth/receipts/audit.py`) with inclusion/consistency proofs and witness co-signing for anti-equivocation. The adversarial soundness benchmark (`benchmarks/soundness.py`) is our empirical proof this holds: it mutates every field of every receipt and measures the *false-accept rate* (a tampered receipt the verifier wrongly accepts) against a ladder of real alternatives — plain logging (accepts ~100%), signing just the output (~93%), a hash-chained audit log (~90%), a signed-receipt-core design (~67%), and AgentAuth (~0), with a 95% confidence bound and the residual misses enumerated.
85
+
86
+ **Attested identity, bound into every receipt.** `auth.identify(...)` issues an attested, short-lived JWT-SVID (Ed25519) whose `sub` is the agent's SPIFFE ID; `session.wrap()` turns that credential into an `AuthorityBinding` that every receipt carries, and `verify_receipt_bundle` re-checks the signed credential and binds its `sub`/`iss`/`cnf` to the receipt's authority block (`agentauth/receipts/identity_evidence.py`). Swapping the credential, the SPIFFE ID, or the bound key on a receipt fails verification.
87
+
88
+ **Privacy-preserving ZK + composed proofs.** A Halo2 policy circuit proves a decision satisfied a numeric/structural policy; an EZKL or RISC0/SP1 zkVM circuit attests the inference step; the two compose into one proof (`crates/`), with a confidential variant that proves a range over a *hidden* score. The verifier learns "the policy held" without learning the inputs — so an enterprise can require compliance proof on every Devin action without surrendering its codebase to the verifier. Measured prove/verify latency and tamper-resistance per backend live in `scripts/prove_tier_matrix.py`.
89
+
90
+ **Delegation, standards, and interop.** Biscuit attenuation gives monotonic capability narrowing for sub-agents; receipts also serialize to SCITT/COSE signed statements and a C2SP tlog-tiles transparency log, validated by an independent verifier in `python/tests/test_interop_conformance.py`. This is what lets the evidence flow into in-toto/SLSA/Sigstore-style supply-chain tooling rather than living in a proprietary silo.
91
+
92
+ ## Section 3 — Technical implementation plans (proposed)
93
+
94
+ ### 3.1 Injection detection via behavioral anomaly (the "detect, don't just contain" layer)
95
+
96
+ **Gap.** Capability tokens and pre-action authorization limit the *blast radius* of a prompt injection delivered through repository content (a malicious issue, comment, or file Devin reads). If injected Devin tries to act outside scope, it is blocked. But the system never says *"Devin was compromised"* — it cannot tell an injection apart from a task that legitimately needs something unusual.
97
+
98
+ **Design.** Add an L2.5 anomaly signal on the action stream the wrapper already intercepts.
99
+ - **Features per action:** action type, tool, requested resource vs authorized scope, position in the sequence, embedding distance from the signed task description, capability-usage delta, inter-action timing, output schema conformance.
100
+ - **Model:** train a sequence anomaly detector (autoencoder or small transformer over action embeddings; isolation-forest baseline) on *legitimate* agent trajectories. We already ingest real trajectory corpora — ATIF MCP trajectories and ~80k SWE-agent sessions — as a cold-start training set; for Devin specifically the model is fine-tuned on Cognition's own legitimate-run telemetry.
101
+ - **Integration:** the wrapper computes an anomaly score per step, attaches it plus a commitment to the model version (hash of weights) into the receipt, and the policy can gate on it (escalate / abstain / require human approval). When the capability layer blocks, the receipt now also carries the *why*: "anomaly 0.94 — accessed `/etc` outside scope, sequence break immediately after reading untrusted issue #214."
102
+ - **Verifiability:** committing the model hash and the input feature vector makes the score reproducible and auditable; an EZKL proof that `score = model(features)` for the committed model makes the *detection itself* tamper-evident.
103
+
104
+ **Honest limits.** Anomaly detection is probabilistic — it has false positives and negatives and is a *signal layered on* the deterministic capability containment, not a replacement for it. It needs representative normal-behavior data, which is a co-build with Cognition. This is the productionization of the adaptive-reliability-layer (ARL) work as an attested receipt signal.
105
+
106
+ ### 3.2 Memory-state commitment + ZK transition proofs (sleeper-agent defense)
107
+
108
+ **Gap.** The Merkle log records what Devin *did*, step by step. But if Devin's persistent memory — its accumulated beliefs about authorized scope, vendor relationships, and security policy — is poisoned through injected content, the log shows legitimate-looking actions taken against a corrupted internal model. There is a commitment to the *actions*, none to the *memory state*.
109
+
110
+ **Design.**
111
+ - **Define Devin's persistent state concretely** and instrument each component: the Devin Wiki index (content-addressed → a Merkle snapshot), conversation/task context, the tool-observation log, and derived "beliefs" (authorized scope, relationship facts, policy).
112
+ - **Commit it:** at step *t*, compute `memory_root_t` over those components and include it in each receipt and audit entry alongside `context_hash`. The audit chain already commits actions per step; this adds a parallel commitment of belief state.
113
+ - **Prove legitimate transitions:** define an allowed transition function `δ(memory_t, op_t) → memory_{t+1}` over operations like `append_observation(authorized_source)` or `apply_authorized_wiki_update`. A ZK circuit (reusing the session-folding proof we use for multi-step) proves `memory_root_{t+1} = δ(memory_root_t, op_t)` for an allowed, authorized op. Memory that diverges with no corresponding legitimate operation fails the proof — the poisoning is cryptographically visible.
114
+
115
+ **Honest limits.** "Agent memory" is fuzzy in current LLM architectures; the hard part is *defining and instrumenting* persistent state per Devin component, which requires Devin-internal access — a genuine co-build, not a drop-in. The transition circuit is non-trivial. This is the most research-forward of the four and the one we'd scope jointly. We name it because the sleeper-agent scenario is the one currently terrifying enterprise security teams, and it is the only mechanism here that commits to the agent's *beliefs*, not just its actions.
116
+
117
+ ### 3.3 AI action attestation chains through the CI/CD pipeline (our recommended first build)
118
+
119
+ **Gap.** Devin's security model treats "push a commit" as a terminal action. But a commit *begins* a chain — CI, tests, scanners, deployment — that all run because Devin acted. After the push there is no cryptographic link between "Devin was authorized to make this change" and "this deployment is running because Devin made it." The integrity chain breaks at the Devin boundary.
120
+
121
+ **Design.**
122
+ - **Emit the push as an attestation.** When Devin pushes, it produces a receipt over the `git push` action: output = the commit hash; bound to the Devin instance's SPIFFE identity, the human principal's signed authorization (an AP2-style mandate), the capability token, and a ZK proof that the execution stayed in scope. We map this receipt to an **in-toto attestation + SLSA provenance predicate**, signed via Sigstore/cosign and logged to the C2SP/Rekor transparency log — so it rides the supply-chain standards GitHub and enterprises already adopt rather than inventing a silo.
123
+ - **Gate the pipeline.** A GitHub Action / CI step fetches the attestation for the commit SHA and verifies: (a) the agent signature and attested identity, (b) the ZK proof of policy-compliant execution, (c) the human authorization chain (mandate → Devin), (d) inclusion in the transparency log. No valid agent attestation ⇒ the pipeline **fails closed**.
124
+ - **Propagate the chain.** Each downstream stage (build, test, scan, deploy) emits its own in-toto attestation referencing the upstream artifact, producing an unbroken layout from human authorization → Devin → CI → deploy. The deploy gate verifies the *whole* chain; code that passed through any unauthorized hand — human or AI — is flagged before production.
125
+
126
+ **Honest limits.** It needs integration points in the customer's CI/CD (a verification Action and a deploy gate), and the per-commit proof has to fit a CI latency budget — so the push attestation uses the fast policy-tier proof, not full composed inference.
127
+
128
+ **Why we'd build this first.** It is the smallest extension of what we already emit (a receipt *is* an attestation), it is concretely demoable (an Action that blocks an unattested commit), and it rides a strong standards tailwind (SLSA/in-toto/Sigstore plus the regulatory push on AI-generated-code provenance). Commercially it is the sharpest reframe for Cognition: Devin stops being "an AI that produces commits your security team must review" and becomes "an AI whose output is cryptographically guaranteed in-scope all the way through deployment" — trust infrastructure, not an audit tool.
129
+
130
+ ### 3.4 Adversarial task-decomposition verification
131
+
132
+ **Gap.** When Devin decomposes a task into subtasks for sub-agents, there are no security properties on the decomposition. A poisoned memory state could cause Devin to generate subtask descriptions that subtly redirect sub-agents toward unauthorized objectives, with nothing to catch it.
133
+
134
+ **Design.** Two layers, one cryptographic and one semantic.
135
+ - **Cryptographic floor (have today):** the human's original task is signed as a mandate; each subtask's capability token must be a Biscuit *attenuation* of the original — it cannot add scope. This is already sound and enforced offline.
136
+ - **Semantic filter (new):** embed the signed original task and each generated subtask, and verify *entailment* — the subtask must be derivable from the original without introducing new objectives (an NLI model, or an LLM-judge run under a committed prompt). A subtask that is not semantically entailed by the signed original is **blocked before assignment**. Bind the signed original, the per-subtask verdicts, and the judge/model commitment into the receipt.
137
+ - **Effect:** if Devin's memory has been poisoned to also "update the deployment configuration while fixing the bug," the subtask `update the deployment configuration` fails entailment against the signed `fix the authentication bug` — the human never authorized configuration changes — and never reaches a sub-agent.
138
+
139
+ **Honest limits.** Semantic entailment is probabilistic — embeddings / NLI / LLM-judge can err — so it is a strong filter, not a proof. The cryptographic guarantee is the capability attenuation plus the binding of signed intent and verdict; the entailment layer catches drift *within* the capability scope. The two together defeat the sleeper-agent attack at the decomposition boundary: even a corrupted internal state must produce output that passes verification against the uncorrupted, human-signed original intent before any sub-agent acts.
140
+
141
+ ---
142
+
143
+ ## Layered repo
144
+
145
+ This repository now carries multiple layers of the stack:
146
+
147
+ - `L1` identity and attestation foundations in [`agentauth/identity/`](agentauth/identity) + [`agentauth/backend/`](agentauth/backend), with SPIRE/SPIFFE deployment notes in [`identity/`](identity/identity.md)
148
+ - `L2` capability-token and delegation primitives in the same identity backend + SDK
149
+ - `L3/L4` decision, receipt, verifier, audit, and proof infrastructure in [`agentauth/receipts/`](agentauth/receipts), [`crates/`](crates), and [`docs/`](docs)
150
+
151
+ All three are one installable package (`agentauth`); see [Repository layout](#repository-layout).
152
+
153
+ The current architectural seam between the upper and lower layers is documented in [docs/l1_l3l4_boundary.md](docs/l1_l3l4_boundary.md).
154
+
155
+ ## Design partners (v0.2.1)
156
+
157
+ **[Design partner guide](docs/design_partner.md)** · **[Deployment](docs/deployment.md)** · **[Runbook](docs/partner_runbook.md)** · **[Open standard strategy](docs/open_standard_strategy.md)** · **[Landscape research](docs/landscape_research.md)** · **[Release pinning](RELEASE.md)**
158
+
159
+ ```bash
160
+ git checkout v0.2.1
161
+ bash scripts/partner_preflight.sh
162
+ bash scripts/bootstrap.sh
163
+ cp config/partner.example.yaml config/partner.yaml
164
+ python3 examples/partner_pilot.py
165
+ arctl verify-bundle receipts/<proof-id>.json
166
+ arctl explain receipts/<proof-id>.json
167
+ arctl audit-summary receipts/<proof-id>.json
168
+ arctl replay-check receipts/<id>.json --policy policies/fraud_decision.yaml
169
+ ```
170
+
171
+ HTTP verifier for compliance:
172
+
173
+ ```bash
174
+ arctl serve
175
+ curl -s -X POST http://localhost:8787/v1/verify -H 'Content-Type: application/json' -d @receipts/<id>.json
176
+ ```
177
+
178
+ ## Quick start
179
+
180
+ ```bash
181
+ pip install -e ".[dev]"
182
+ python examples/shadow_fraud_agent.py
183
+ ```
184
+
185
+ ```bash
186
+ cargo test
187
+ ```
188
+
189
+ ## Repository layout
190
+
191
+ One installable distribution (`agentauth`), one import namespace:
192
+
193
+ ```text
194
+ agent-receipts/
195
+ ├── agentauth/ # the unified Python package
196
+ │ ├── identity/ # L1/L2 SDK: client, session, models, errors
197
+ │ ├── backend/ # FastAPI service: identity router + receipt verifier
198
+ │ └── receipts/ # L3/L4 runtime: policy, decision, proofs, audit, verifier
199
+ ├── crates/agent-receipts-*/ # Rust proof, audit, and verifier core
200
+ ├── identity/ # SPIFFE/SPIRE and attestation deployment notes
201
+ ├── dashboard/ # React/TypeScript SPA
202
+ ├── backend/tests, sdk/python/tests, python/tests # the unified test suite
203
+ ├── docs/ # Architecture, trust model, policy language
204
+ ├── examples/ # Runnable demos
205
+ └── policies/ # Example policy YAML files
206
+ ```
207
+
208
+ ## Developer interface
209
+
210
+ One import spans both layers. Attest an identity, then receipt everything it does — each receipt is bound to the verified identity:
211
+
212
+ ```python
213
+ from agentauth import AgentAuth, Policy
214
+
215
+ auth = AgentAuth(api_key="aa_...", dev_attestation=True) # localhost demos/tests
216
+ agent = auth.identify(agent_type="researcher", owner="alice@acme.ai",
217
+ scopes=["db:read"]) # L1/L2 — attested identity
218
+
219
+ receipted = agent.wrap(your_model,
220
+ policy=Policy.from_yaml("policies/fraud_decision.yaml"),
221
+ mode="shadow") # L3/L4 — receipted, bound to identity
222
+ result = receipted.run({"transaction_id": "tx-1", "amount": 420.0})
223
+ print(result.output, result.decision.outcome)
224
+ ```
225
+
226
+ The receipts runtime also works standalone (no identity), and the identity SDK
227
+ works standalone (no receipts) — `agentauth.identity` and `agentauth.receipts`
228
+ remain importable directly.
229
+
230
+ ## AgentAuth identity service
231
+
232
+ The integrated L1/L2 identity service issues short-lived, attested agent credentials and optional capability grants. The same backend (`uvicorn agentauth.backend.main:app`) also verifies receipt bundles at `POST /v1/verify`.
233
+
234
+ - Architecture note: [identity/identity.md](identity/identity.md)
235
+ - L1→L3/L4 seam: [docs/l1_l3l4_boundary.md](docs/l1_l3l4_boundary.md)
236
+
237
+ ## Proof paths
238
+
239
+ | Path | Inference attestation | Policy attestation | Use case |
240
+ |------|----------------------|-------------------|----------|
241
+ | **Full ZK** | EZKL / zkPyTorch circuit | Halo2 policy circuit | Small models (fraud heads, classifiers) |
242
+ | **TEE hybrid** | Intel TDX / NVIDIA CC quote | ZK policy circuit on attested output | LLM-scale |
243
+
244
+ ## Operating modes
245
+
246
+ | Mode | Behavior |
247
+ |------|----------|
248
+ | `shadow` | Policy check + audit chain; no ZK latency |
249
+ | `recommend` | Same as shadow; suggests abstain on violation |
250
+ | `bounded_auto` | Forces abstain output on violation |
251
+ | `prove` | Generates Halo2 policy proof via Rust CLI |
252
+
253
+ ## Status
254
+
255
+ Implemented:
256
+
257
+ - Core data types + hash-chained audit log (SQLite)
258
+ - Python `AgentWrapper` (`shadow` / `recommend` / `bounded_auto` / `prove`)
259
+ - Halo2 policy-range circuit
260
+ - `agent-receipts` CLI: `setup`, `prove-policy`, `verify-policy`
261
+ - MCP receipting and live transports
262
+ - EZKL + composition path
263
+ - AgentAuth identity service, attestation flow, and capability-token prototype
264
+
265
+ Not yet implemented or still hardening:
266
+
267
+ - Final L1/L2 to L3/L4 semantic unification
268
+ - ZK inference circuit and recursive composition
269
+ - TEE quote verification hardening
270
+ - Remaining security backlog items in [docs/security_issues_backlog.md](docs/security_issues_backlog.md)
271
+
272
+ See [docs/architecture.md](docs/architecture.md), [docs/open_standard_strategy.md](docs/open_standard_strategy.md), [docs/landscape_research.md](docs/landscape_research.md), and [docs/roadmap.md](docs/roadmap.md).
273
+
274
+ ## License
275
+
276
+ MIT — see [LICENSE](LICENSE).