attestral 0.1.0__tar.gz

attestral-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,16 @@
+name: ci
+on: [push, pull_request]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: pip install -e ".[dev,terraform]"
+      - run: ruff check attestral tests
+      - run: pytest -q

attestral-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,28 @@
+name: publish
+on:
+  release:
+    types: [published]
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/attestral/
+    permissions:
+      id-token: write        # REQUIRED for PyPI Trusted Publishing (OIDC)
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Build sdist + wheel
+        run: |
+          python -m pip install --upgrade build
+          python -m build
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

attestral-0.1.0/.gitignore

@@ -0,0 +1,12 @@
+__pycache__/
+*.pyc
+*.egg-info/
+dist/
+build/
+.venv/
+.ruff_cache/
+.pytest_cache/
+.DS_Store
+.vercel
+report.json
+.claude/

attestral-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,21 @@
+# Contributing to Attestral
+
+Thanks for considering a contribution.
+
+## Ground rules
+- Open an issue before large changes; small fixes can go straight to PR.
+- Every PR needs tests. `pytest -q` and `ruff check attestral tests` must pass.
+- New detection rules go in YAML with structured matchers (see docs) - no
+ executable logic in rule files, ever. Unknown matchers fail closed by design.
+- Contributions are accepted under the project CLA (one click on your first PR).
+
+## Scope
+This repo is the complete open-source core: model, ingesters, rules, evidence
+chain, compiler, drift detection, telemetry, Action. Hosted/team features are
+developed elsewhere and are out of scope here.
+
+## Development
+```bash
+pip install -e ".[dev,terraform]"
+pytest -q
+```

attestral-0.1.0/LICENSE

@@ -0,0 +1,15 @@
+Apache License 2.0
+
+Copyright 2026 Attestral
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

attestral-0.1.0/PKG-INFO

@@ -0,0 +1,121 @@
+Metadata-Version: 2.4
+Name: attestral
+Version: 0.1.0
+Summary: Continuous, audit-ready security design review for cloud and agentic systems
+Author: Attestral
+License: Apache-2.0
+License-File: LICENSE
+Keywords: design-review,mcp,security,terraform,threat-modeling
+Requires-Python: >=3.10
+Requires-Dist: click>=8.1
+Requires-Dist: pyyaml>=6.0
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Provides-Extra: llm
+Requires-Dist: anthropic>=0.40; extra == 'llm'
+Provides-Extra: terraform
+Requires-Dist: python-hcl2>=4.3; extra == 'terraform'
+Description-Content-Type: text/markdown
+
+# Attestral
+
+**Continuous, audit-ready security design review for cloud and agentic systems.**
+
+Attestral ingests your infrastructure-as-code and agent/MCP configurations, builds a unified system model, runs a deterministic rule pack (plus optional LLM threat elicitation), and produces a design review with a **tamper-evident evidence chain** you can hand to reviewers, auditors, and customers.
+
+```
+pip install attestral
+attestral scan ./my-project
+```
+
+## Why
+
+- Legacy threat modeling platforms are questionnaire-driven, consultant-heavy, and priced for the Fortune 500. In practice most teams do this work in a spreadsheet.
+- The fastest-growing attack surface (AI agents, MCP servers, tool permissions) is the one legacy tools understand least.
+- Review output is only worth what you can prove. Every Attestral run emits a SHA-256 hash chain over its findings, and altering any past entry invalidates the chain head.
+
+## What it does today (v0.1)
+
+| Layer | Status |
+|---|---|
+| Terraform ingestion (design-level) | ✅ dependency-free scanner |
+| MCP server config ingestion | ✅ `mcp.json` / `claude_desktop_config.json` |
+| Deterministic rule pack | ✅ 10 rules: cloud misconfig + agentic tool risk |
+| Framework mapping | ✅ NIST 800-53, ASVS, SOC 2, OWASP Agentic refs per finding |
+| Evidence chain + verification | ✅ `attestral verify report.json` |
+| Fail-closed CI gate | ✅ `--fail-on high` |
+| LLM threat elicitation | ✅ optional, `--llm` + `ANTHROPIC_API_KEY`, findings tagged separately |
+| Design→policy compiler (`attestral compile`) | ✅ mcp-guard default-deny policy, bound to the review chain head |
+| Design-runtime drift detection (`attestral drift`) | ✅ JSONL telemetry diffed against the attested design |
+| PR design-diff (GitHub App) | 🔜 roadmap |
+| IriusRisk/ThreatModeler import | 🔜 roadmap |
+
+## Usage
+
+```bash
+# Scan a project (Terraform + MCP configs discovered automatically)
+attestral scan ./my-project
+
+# Markdown + JSON evidence report
+attestral scan ./my-project -o review --format both
+
+# CI gate: fail the pipeline on high/critical design findings
+attestral scan . --fail-on high
+
+# Add LLM design-review reasoning on top of the deterministic layer
+export ANTHROPIC_API_KEY=...
+attestral scan ./my-project --llm
+
+# Prove a report hasn't been altered
+attestral verify review.json
+
+# Close the loop: compile the attested design into a runtime policy...
+attestral compile ./my-project -o policy.yaml
+# ...and diff runtime telemetry (mcp-guard JSONL) against it
+attestral drift policy.yaml events.jsonl --fail-on-drift
+```
+
+Try it on the included demo:
+
+```bash
+attestral scan examples/demo-project
+```
+
+## Architecture
+
+1. **Ingest** → unified `SystemModel` (components, edges, trust boundaries) from Terraform and MCP configs.
+2. **Deterministic layer** → typed matchers in YAML rules (`attestral/rules/core_rules.yaml`). No `eval`, unknown matchers fail closed.
+3. **LLM layer (optional)** → design-level threat elicitation over the model JSON; findings tagged `origin: llm`, never silently mixed with deterministic results.
+4. **Evidence layer** → hash-chained findings, markdown/JSON export, offline verification.
+
+## Writing custom rules
+
+```yaml
+rules:
+ - id: ORG-001
+ title: Internal service exposed without auth attribute
+ severity: high
+ target: aws_lb
+ match: { attr_missing: auth }
+ description: ...
+ recommendation: ...
+ frameworks: ["NIST AC-3"]
+```
+
+```bash
+attestral scan . # core pack
+python -c "from attestral.rules import RuleEngine; RuleEngine(['org_rules.yaml'])"
+```
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest -q
+ruff check attestral tests
+```
+
+## License
+
+Apache 2.0

attestral-0.1.0/README.md

@@ -0,0 +1,101 @@
+# Attestral
+
+**Continuous, audit-ready security design review for cloud and agentic systems.**
+
+Attestral ingests your infrastructure-as-code and agent/MCP configurations, builds a unified system model, runs a deterministic rule pack (plus optional LLM threat elicitation), and produces a design review with a **tamper-evident evidence chain** you can hand to reviewers, auditors, and customers.
+
+```
+pip install attestral
+attestral scan ./my-project
+```
+
+## Why
+
+- Legacy threat modeling platforms are questionnaire-driven, consultant-heavy, and priced for the Fortune 500. In practice most teams do this work in a spreadsheet.
+- The fastest-growing attack surface (AI agents, MCP servers, tool permissions) is the one legacy tools understand least.
+- Review output is only worth what you can prove. Every Attestral run emits a SHA-256 hash chain over its findings, and altering any past entry invalidates the chain head.
+
+## What it does today (v0.1)
+
+| Layer | Status |
+|---|---|
+| Terraform ingestion (design-level) | ✅ dependency-free scanner |
+| MCP server config ingestion | ✅ `mcp.json` / `claude_desktop_config.json` |
+| Deterministic rule pack | ✅ 10 rules: cloud misconfig + agentic tool risk |
+| Framework mapping | ✅ NIST 800-53, ASVS, SOC 2, OWASP Agentic refs per finding |
+| Evidence chain + verification | ✅ `attestral verify report.json` |
+| Fail-closed CI gate | ✅ `--fail-on high` |
+| LLM threat elicitation | ✅ optional, `--llm` + `ANTHROPIC_API_KEY`, findings tagged separately |
+| Design→policy compiler (`attestral compile`) | ✅ mcp-guard default-deny policy, bound to the review chain head |
+| Design-runtime drift detection (`attestral drift`) | ✅ JSONL telemetry diffed against the attested design |
+| PR design-diff (GitHub App) | 🔜 roadmap |
+| IriusRisk/ThreatModeler import | 🔜 roadmap |
+
+## Usage
+
+```bash
+# Scan a project (Terraform + MCP configs discovered automatically)
+attestral scan ./my-project
+
+# Markdown + JSON evidence report
+attestral scan ./my-project -o review --format both
+
+# CI gate: fail the pipeline on high/critical design findings
+attestral scan . --fail-on high
+
+# Add LLM design-review reasoning on top of the deterministic layer
+export ANTHROPIC_API_KEY=...
+attestral scan ./my-project --llm
+
+# Prove a report hasn't been altered
+attestral verify review.json
+
+# Close the loop: compile the attested design into a runtime policy...
+attestral compile ./my-project -o policy.yaml
+# ...and diff runtime telemetry (mcp-guard JSONL) against it
+attestral drift policy.yaml events.jsonl --fail-on-drift
+```
+
+Try it on the included demo:
+
+```bash
+attestral scan examples/demo-project
+```
+
+## Architecture
+
+1. **Ingest** → unified `SystemModel` (components, edges, trust boundaries) from Terraform and MCP configs.
+2. **Deterministic layer** → typed matchers in YAML rules (`attestral/rules/core_rules.yaml`). No `eval`, unknown matchers fail closed.
+3. **LLM layer (optional)** → design-level threat elicitation over the model JSON; findings tagged `origin: llm`, never silently mixed with deterministic results.
+4. **Evidence layer** → hash-chained findings, markdown/JSON export, offline verification.
+
+## Writing custom rules
+
+```yaml
+rules:
+ - id: ORG-001
+ title: Internal service exposed without auth attribute
+ severity: high
+ target: aws_lb
+ match: { attr_missing: auth }
+ description: ...
+ recommendation: ...
+ frameworks: ["NIST AC-3"]
+```
+
+```bash
+attestral scan . # core pack
+python -c "from attestral.rules import RuleEngine; RuleEngine(['org_rules.yaml'])"
+```
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest -q
+ruff check attestral tests
+```
+
+## License
+
+Apache 2.0

attestral-0.1.0/SECURITY.md

@@ -0,0 +1,15 @@
+# Security Policy
+
+## Reporting a vulnerability
+Email security@attestral.dev. You'll get an acknowledgment within 48 hours
+and a fix-or-mitigation plan within 7 days for confirmed issues. Please do
+not open public issues for vulnerabilities.
+
+## Scope
+The `attestral` package and this repository's GitHub Action. Include a
+reproduction; the demo project in `examples/` is a good base.
+
+## Design commitments
+- Fail-closed: unknown rule matchers never match; compilation defaults to deny.
+- No `eval`/`exec` anywhere in the rule path.
+- The evidence chain is deterministic and verifiable offline.

attestral-0.1.0/action.yml

@@ -0,0 +1,26 @@
+name: 'Attestral Drift Check'
+description: 'Prove your deployment still matches its attested security design review'
+author: 'Attestral'
+branding:
+  icon: 'shield'
+  color: 'red'
+inputs:
+  policy:
+    description: 'Path to the compiled mcp-guard policy (from `attestral compile`)'
+    required: true
+  events:
+    description: 'Path to runtime telemetry JSONL (mcp-guard format)'
+    required: true
+  version:
+    description: 'attestral version to install'
+    required: false
+    default: 'attestral'
+runs:
+  using: 'composite'
+  steps:
+    - name: Install attestral
+      shell: bash
+      run: pip install --quiet "${{ inputs.version }}"
+    - name: Check design-runtime drift (fail-closed)
+      shell: bash
+      run: attestral drift "${{ inputs.policy }}" "${{ inputs.events }}" --fail-on-drift

attestral-0.1.0/attestral/__init__.py

@@ -0,0 +1,6 @@
+"""Attestral: continuous, audit-ready security design review."""
+__version__ = "0.1.0"
+
+from attestral.model import Component, Edge, Finding, SystemModel, TrustBoundary
+
+__all__ = ["SystemModel", "Component", "Edge", "TrustBoundary", "Finding"]

attestral-0.1.0/attestral/cli.py

@@ -0,0 +1,109 @@
+"""Attestral CLI: scan a project, emit an audit-ready design review."""
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+import click
+
+from attestral import __version__
+from attestral.evidence import audit_chain, render_markdown, verify_chain
+from attestral.ingest import build_model
+from attestral.rules import RuleEngine
+
+
+@click.group()
+@click.version_option(__version__)
+def main() -> None:
+    """Attestral - continuous, audit-ready security design review."""
+
+
+@main.command()
+@click.argument("path", type=click.Path(exists=True))
+@click.option("-o", "--output", default="attestral-report", help="Output file stem.")
+@click.option("--format", "fmt", type=click.Choice(["md", "json", "both"]), default="both")
+@click.option("--llm", is_flag=True, help="Add LLM threat elicitation (needs ANTHROPIC_API_KEY).")
+@click.option("--fail-on", type=click.Choice(["critical", "high", "medium", "low"]), default=None,
+              help="Exit non-zero if findings at/above this severity exist (CI gate).")
+def scan(path: str, output: str, fmt: str, llm: bool, fail_on: str | None) -> None:
+    """Scan PATH (Terraform, MCP configs) and generate a design review."""
+    model = build_model(path)
+    findings = RuleEngine().evaluate(model)
+    if llm:
+        from attestral.llm import elicit
+        findings += elicit(model)
+
+    if fmt in ("md", "both"):
+        Path(f"{output}.md").write_text(render_markdown(model, findings, path))
+        click.echo(f"wrote {output}.md")
+    if fmt in ("json", "both"):
+        Path(f"{output}.json").write_text(
+            json.dumps({"target": path, "chain": audit_chain(findings)}, indent=2)
+        )
+        click.echo(f"wrote {output}.json")
+
+    for f in findings:
+        click.echo(f"  [{f.severity.value.upper():8}] {f.rule_id}  {f.title}  ({f.component_id})")
+    click.echo(f"{len(model.components)} components · {len(findings)} findings")
+
+    if fail_on:
+        from attestral.model import Severity
+        threshold = Severity(fail_on).rank
+        if any(f.severity.rank >= threshold for f in findings):
+            click.echo(f"FAIL-CLOSED: findings at or above '{fail_on}'", err=True)
+            sys.exit(1)
+
+
+@main.command()
+@click.argument("report", type=click.Path(exists=True))
+def verify(report: str) -> None:
+    """Verify the tamper-evident audit chain in a JSON report."""
+    data = json.loads(Path(report).read_text())
+    ok = verify_chain(data.get("chain", []))
+    click.echo("chain VALID ✅" if ok else "chain INVALID - report has been altered ❌")
+    sys.exit(0 if ok else 1)
+
+
+@main.command()
+@click.argument("path", type=click.Path(exists=True))
+@click.option("-o", "--output", default="mcp-guard-policy.yaml", help="Policy output file.")
+def compile(path: str, output: str) -> None:
+    """Compile PATH's attested design into an mcp-guard runtime policy."""
+    from attestral.compile import compile_policy, render_policy_yaml
+    model = build_model(path)
+    findings = RuleEngine().evaluate(model)
+    chain = audit_chain(findings)
+    head = chain[-1]["hash"] if chain else ""
+    policy = compile_policy(model, findings, chain_head=head)
+    Path(output).write_text(render_policy_yaml(policy))
+    allowed = sum(1 for s in policy["servers"].values() if s["allow"])
+    denied = len(policy["servers"]) - allowed
+    click.echo(f"wrote {output}  ·  default deny  ·  {allowed} allowed, {denied} denied")
+    for name, s in policy["servers"].items():
+        mark = "ALLOW" if s["allow"] else "DENY "
+        why = "" if s["allow"] else f"  ({s.get('reason','')})"
+        click.echo(f"  [{mark}] {name}{why}")
+
+
+@main.command()
+@click.argument("policy_file", type=click.Path(exists=True))
+@click.argument("events_file", type=click.Path(exists=True))
+@click.option("--fail-on-drift", is_flag=True, help="Exit non-zero on any drift (CI/cron gate).")
+def drift(policy_file: str, events_file: str, fail_on_drift: bool) -> None:
+    """Diff runtime EVENTS_FILE (JSONL) against a compiled POLICY_FILE."""
+    import yaml as _yaml
+    from attestral.drift import detect_drift, load_events
+    policy = _yaml.safe_load(Path(policy_file).read_text())
+    events = load_events(events_file)
+    findings = detect_drift(policy, events)
+    for f in findings:
+        click.echo(f"  [{f.severity.value.upper():8}] {f.rule_id}  {f.title}  ({f.component_id})")
+    click.echo(f"{len(events)} events · {len(findings)} drift findings")
+    if findings and fail_on_drift:
+        click.echo("DRIFT: deployment no longer matches the attested design", err=True)
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()

attestral-0.1.0/attestral/compile.py

@@ -0,0 +1,100 @@
+"""Compile an attested design into a runtime policy.
+
+This is the loop-closer: the reviewed system model (plus its findings)
+becomes an mcp-guard-compatible policy document. The threat model is not a
+PDF - it is the runtime configuration.
+
+Compilation rules (fail-closed):
+- default: deny - servers absent from the attested model are never allowed
+- critical findings against a server deny it outright (with the rule id as reason)
+- filesystem scopes are narrowed to the attested roots; broad roots (ATL-102)
+  compile to `allow: false` until re-scoped in the design
+- non-TLS transports (ATL-101) compile to a tls_only constraint violation → deny
+- env-secret findings (ATL-104) compile to a `forbid_env_secrets` constraint
+"""
+from __future__ import annotations
+
+import datetime as _dt
+import hashlib
+
+import yaml
+
+from attestral.model import Finding, SystemModel
+
+POLICY_VERSION = 1
+_BROAD_ROOTS = {"/", "~", "/home", "/Users"}
+
+
+def _model_hash(model: SystemModel) -> str:
+    return hashlib.sha256(model.to_json().encode()).hexdigest()
+
+
+def compile_policy(
+    model: SystemModel,
+    findings: list[Finding],
+    chain_head: str = "",
+) -> dict:
+    """Return an mcp-guard v0 policy dict derived from the attested design."""
+    by_component: dict[str, list[Finding]] = {}
+    for f in findings:
+        by_component.setdefault(f.component_id, []).append(f)
+
+    servers: dict[str, dict] = {}
+    for c in model.by_type("mcp_server"):
+        entry: dict = {"allow": True, "constraints": {}, "attested_source": c.source}
+        server_findings = by_component.get(c.id, [])
+        deny_reasons = [
+            f.rule_id for f in server_findings if f.severity.value == "critical"
+        ]
+
+        # Transport: attested design must be TLS; http:// compiles to deny.
+        url = str(c.attr("url", ""))
+        if url:
+            entry["constraints"]["transport"] = "tls_only"
+            if url.startswith("http://"):
+                deny_reasons.append("ATL-101")
+
+        # Filesystem scope: allow only attested, non-broad roots.
+        args = [str(a) for a in (c.attr("args") or [])]
+        roots = [a for a in args if a.startswith(("/", "~"))]
+        if roots:
+            narrow = [r for r in roots if r not in _BROAD_ROOTS]
+            if narrow:
+                entry["constraints"]["root_paths"] = sorted(narrow)
+            else:
+                deny_reasons.append("ATL-102")
+
+        # Secrets in env: enforce at the proxy.
+        if c.attr("_env_has_secrets"):
+            entry["constraints"]["forbid_env_secrets"] = True
+
+        if deny_reasons:
+            entry["allow"] = False
+            entry["reason"] = (
+                "denied by attested design review: " + ", ".join(sorted(set(deny_reasons)))
+            )
+            entry.pop("constraints", None)
+
+        servers[c.name] = entry
+
+    return {
+        "version": POLICY_VERSION,
+        "metadata": {
+            "generated_by": "attestral",
+            "generated_at": _dt.datetime.now(_dt.timezone.utc).isoformat(timespec="seconds"),
+            "model_hash": _model_hash(model),
+            "review_chain_head": chain_head,
+        },
+        "default": "deny",
+        "servers": servers,
+    }
+
+
+def render_policy_yaml(policy: dict) -> str:
+    header = (
+        "# mcp-guard policy - COMPILED FROM AN ATTESTED DESIGN REVIEW.\n"
+        "# Do not hand-edit: change the design, re-review, re-compile.\n"
+        f"# model_hash: {policy['metadata']['model_hash'][:16]}…  "
+        f"chain_head: {(policy['metadata']['review_chain_head'] or '-')[:16]}\n"
+    )
+    return header + yaml.safe_dump(policy, sort_keys=False)

attestral-0.1.0/attestral/drift.py

@@ -0,0 +1,84 @@
+"""Design-runtime drift detection.
+
+Reads a JSONL stream of tool-call events (mcp-guard telemetry format:
+one object per line with at least `server`, `tool`, and optionally
+`args`, `url`, `ts`) and diffs each event against the compiled policy
+derived from the attested design.
+
+Fail-closed philosophy carries through: an event that references a server
+absent from the attested model is CRITICAL drift - the deployed system has
+grown beyond what was reviewed.
+"""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from attestral.model import Finding, Severity
+
+DRIFT_RULES = {
+    "DRF-001": ("Unattested server observed at runtime", Severity.CRITICAL),
+    "DRF-002": ("Denied server invoked at runtime", Severity.CRITICAL),
+    "DRF-003": ("Filesystem access outside attested roots", Severity.HIGH),
+    "DRF-004": ("Non-TLS transport observed for TLS-constrained server", Severity.HIGH),
+}
+
+
+def _mk(rule: str, server: str, detail: str, event_no: int) -> Finding:
+    title, sev = DRIFT_RULES[rule]
+    return Finding(
+        rule_id=rule,
+        title=title,
+        severity=sev,
+        component_id=f"mcp_server.{server}",
+        description=f"Event #{event_no}: {detail}",
+        recommendation=(
+            "Either revert the runtime change, or update the design, re-run the "
+            "review, and re-compile the policy so deployment and review match."
+        ),
+        source="runtime-telemetry",
+        origin="deterministic",
+    )
+
+
+def _path_in_roots(path: str, roots: list[str]) -> bool:
+    return any(path == r or path.startswith(r.rstrip("/") + "/") for r in roots)
+
+
+def detect_drift(policy: dict, events: list[dict]) -> list[Finding]:
+    servers: dict[str, dict] = policy.get("servers", {})
+    findings: list[Finding] = []
+    for i, ev in enumerate(events, 1):
+        name = str(ev.get("server", ""))
+        entry = servers.get(name)
+
+        if entry is None:
+            findings.append(_mk("DRF-001", name, f"server '{name}' is not in the attested design", i))
+            continue
+        if not entry.get("allow", False):
+            findings.append(_mk("DRF-002", name, entry.get("reason", "denied by policy"), i))
+            continue
+
+        constraints = entry.get("constraints", {})
+        roots = constraints.get("root_paths")
+        if roots:
+            for arg in [str(a) for a in ev.get("args", []) if str(a).startswith(("/", "~"))]:
+                if not _path_in_roots(arg, roots):
+                    findings.append(_mk("DRF-003", name, f"path '{arg}' outside attested roots {roots}", i))
+        if constraints.get("transport") == "tls_only" and str(ev.get("url", "")).startswith("http://"):
+            findings.append(_mk("DRF-004", name, f"plaintext url '{ev.get('url')}'", i))
+    findings.sort(key=lambda f: f.severity.rank, reverse=True)
+    return findings
+
+
+def load_events(path: str | Path) -> list[dict]:
+    events = []
+    for line in Path(path).read_text().splitlines():
+        line = line.strip()
+        if not line:
+            continue
+        try:
+            events.append(json.loads(line))
+        except json.JSONDecodeError:
+            continue
+    return events