csoai 0.1.0__tar.gz

csoai-0.1.0/PKG-INFO

@@ -0,0 +1,30 @@
+Metadata-Version: 2.4
+Name: csoai
+Version: 0.1.0
+Summary: Council of AI — signed, deterministic AI-governance measurement: CLI + MCP server + agent-callable verifier
+Author: Council of AI (CSOAI LTD, UK 16939677)
+License: Apache-2.0
+Project-URL: Homepage, https://councilof.ai
+Keywords: ai-governance,eu-ai-act,measurement,signed-evidence,mcp,article-50
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: cryptography>=41
+Provides-Extra: mcp
+Requires-Dist: fastmcp>=2.0; extra == "mcp"
+
+# csoai
+
+Council of AI — signed, deterministic AI-governance measurement.
+
+The boring CLI is the primary agent rail; the MCP server wraps it; both emit the
+same signed atom. Public artifacts only (hiQ/Van Buren footing); measurement, not
+certification.
+
+```bash
+pip install csoai
+csoai check --entity gpt2 --pack art50 --json     # measure a public artifact -> signed card
+csoai verify --record card.json                   # verify a signed record offline
+pip install "csoai[mcp]" && python -m csoai.mcp_server   # agent-callable MCP tools
+```
+
+CI gate: `csoai check` exits 3 on a missing transparency predicate — fail the build on it.

csoai-0.1.0/README.md

@@ -0,0 +1,16 @@
+# csoai
+
+Council of AI — signed, deterministic AI-governance measurement.
+
+The boring CLI is the primary agent rail; the MCP server wraps it; both emit the
+same signed atom. Public artifacts only (hiQ/Van Buren footing); measurement, not
+certification.
+
+```bash
+pip install csoai
+csoai check --entity gpt2 --pack art50 --json     # measure a public artifact -> signed card
+csoai verify --record card.json                   # verify a signed record offline
+pip install "csoai[mcp]" && python -m csoai.mcp_server   # agent-callable MCP tools
+```
+
+CI gate: `csoai check` exits 3 on a missing transparency predicate — fail the build on it.

csoai-0.1.0/pyproject.toml

@@ -0,0 +1,26 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "csoai"
+version = "0.1.0"
+description = "Council of AI — signed, deterministic AI-governance measurement: CLI + MCP server + agent-callable verifier"
+readme = "README.md"
+requires-python = ">=3.9"
+license = {text = "Apache-2.0"}
+authors = [{name = "Council of AI (CSOAI LTD, UK 16939677)"}]
+keywords = ["ai-governance", "eu-ai-act", "measurement", "signed-evidence", "mcp", "article-50"]
+dependencies = ["cryptography>=41"]
+
+[project.optional-dependencies]
+mcp = ["fastmcp>=2.0"]
+
+[project.urls]
+Homepage = "https://councilof.ai"
+
+[project.scripts]
+csoai = "csoai.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]

csoai-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

csoai-0.1.0/src/csoai/__init__.py

@@ -0,0 +1,6 @@
+"""csoai — Council of AI signed measurement toolkit.
+
+The boring CLI is the primary agent rail; the MCP server wraps it; both emit the
+same signed atom. Public-artifacts-only, measurement-not-certification.
+"""
+__version__ = "0.1.0"

csoai-0.1.0/src/csoai/cli.py

@@ -0,0 +1,88 @@
+"""csoai — the boring CLI. Universal agent rail + CI forcing-function + atom-emitter
++ the first agent-callable signed-record verifier.
+
+    csoai check  --entity <hf-repo> --pack art50 [--sign] [--json]
+    csoai verify --record <file.json>
+
+Deterministic output + exit codes so an agent (or a CI gate) acts on the result
+without reasoning about the statute from memory. Guardrails: PUBLIC artifacts only
+(hiQ/Van Buren); measurement, not certification; signed only with a real key.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+from csoai import council_signal
+
+PACKS = {
+    "art50": {
+        "title": "EU AI Act Article 50 transparency (public-artifact signals)",
+        "required": ["license_declared", "task_declared", "model_card_present"],
+    },
+    "transparency": {
+        "title": "Baseline transparency",
+        "required": ["license_declared", "model_card_present"],
+    },
+}
+
+
+def cmd_check(a) -> int:
+    pack = PACKS.get(a.pack)
+    if not pack:
+        print(f"unknown pack '{a.pack}'; known: {', '.join(PACKS)}", file=sys.stderr)
+        return 64
+    try:
+        rec = council_signal.state_record(a.entity)
+    except Exception as e:  # noqa: BLE001
+        print(f"FETCH FAILED for {a.entity}: {e}. No card emitted (never fabricated).", file=sys.stderr)
+        return 2
+    rec["pack"] = a.pack
+    missing = [k for k in pack["required"] if not rec["predicates"].get(k)]
+    rec["pack_result"] = {"pack": a.pack, "required": pack["required"], "missing": missing, "pass": not missing}
+    if a.sign:
+        out = a.out or f"csoai_check_{a.entity.replace('/', '_')}.json"
+        rec = council_signal.sign_record(rec, out)
+    if a.json:
+        print(json.dumps(rec, indent=2))
+    else:
+        print(f"  {a.entity}  pack={a.pack}  pass={rec['pack_result']['pass']}"
+              f"  missing={missing or 'none'}  signed={rec.get('signed', bool(a.sign))}")
+    return 0 if not missing else 3
+
+
+def cmd_verify(a) -> int:
+    from csoai import sign
+    obj = json.loads(Path(a.record).read_text())
+    s = obj.get("signature")
+    if not s or s.get("kind") != "ed25519":
+        print("UNSIGNED — no Ed25519 signature on this record.")
+        return 1
+    try:
+        sign.verify(a.record)
+        return 0
+    except SystemExit as e:
+        return int(e.code) if isinstance(e.code, int) else 1
+
+
+def main(argv=None) -> int:
+    ap = argparse.ArgumentParser(prog="csoai", description=__doc__)
+    sub = ap.add_subparsers(dest="cmd", required=True)
+    c = sub.add_parser("check", help="measure a public artifact → signed card")
+    c.add_argument("--entity", required=True)
+    c.add_argument("--pack", default="art50", help=f"one of: {', '.join(PACKS)}")
+    c.add_argument("--sign", action="store_true")
+    c.add_argument("--json", action="store_true")
+    c.add_argument("--out")
+    c.set_defaults(fn=cmd_check)
+    v = sub.add_parser("verify", help="verify a signed record offline")
+    v.add_argument("--record", required=True)
+    v.set_defaults(fn=cmd_verify)
+    a = ap.parse_args(argv)
+    return a.fn(a)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

csoai-0.1.0/src/csoai/council_signal.py

@@ -0,0 +1,247 @@
+"""council_signal.py — continuous, LAWFUL compliance signal over PUBLISHED AI artifacts.
+
+The play (build-map, compass 237202a7 #A): scan an entity's PUBLIC artifacts, emit a
+compact Ed25519-signed state record, and notify on drift. This is the first brick:
+one public artifact source (a Hugging Face model repo's PUBLIC metadata) → a
+deterministic transparency state → a signed record → a drift diff against the prior.
+
+LEGAL GUARDRAILS, baked in (not optional):
+  * PUBLIC ARTIFACTS ONLY. This reads the public model-info endpoint (no auth, no
+    gated content, no private API). Footing: hiQ v. LinkedIn (9th Cir. 2022) +
+    Van Buren (SCOTUS 2021) — scanning public pages is not CFAA "without
+    authorization." (Still respect ToS/copyright; never scan a private API.)
+  * MEASUREMENT, NOT CERTIFICATION. Every field is an observed public fact or a
+    deterministic predicate over one. We do not certify compliance or conformity.
+  * SIGN ONLY WITH A REAL KEY. Signed on the signing node; UNSIGNED and labelled so
+    everywhere else. Never a fake signature.
+
+Checks are deterministic functions of the fetched public metadata — recomputable by
+anyone from the same public source. Nothing here is a judgement call.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import hashlib
+import sys
+import urllib.request
+import urllib.error
+import urllib.parse
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Dict, Optional
+
+VERSION = "0.1.0"
+HF_MODEL_API = "https://huggingface.co/api/models/{entity}"
+# Art-50 / transparency signal terms we look for in public tags/cardData.
+_MARKING_TERMS = ("c2pa", "content-credential", "content credentials", "watermark",
+                  "synthid", "ai-generated", "provenance")
+
+
+def fetch_public_metadata(entity: str, timeout: int = 20) -> Dict[str, Any]:
+    """GET the PUBLIC model-info JSON. Raises on network/HTTP error (never fakes data)."""
+    url = HF_MODEL_API.format(entity=urllib.parse.quote(entity, safe="/"))
+    req = urllib.request.Request(url, headers={"User-Agent": f"council-signal/{VERSION}"})
+    with urllib.request.urlopen(req, timeout=timeout) as r:
+        return json.loads(r.read().decode("utf-8"))
+
+
+def compute_checks(meta: Dict[str, Any]) -> Dict[str, Any]:
+    """Deterministic transparency predicates over the PUBLIC metadata."""
+    card = meta.get("cardData") or {}
+    tags = [str(t).lower() for t in (meta.get("tags") or [])]
+    blob = (json.dumps(card) + " " + " ".join(tags)).lower()
+    return {
+        # transparency basics an Art-50/AI-Act reader looks for
+        "license_declared": bool(card.get("license") or any(t.startswith("license:") for t in tags)),
+        "task_declared": bool(meta.get("pipeline_tag")),
+        "model_card_present": bool(card) and card != {},
+        "gated": bool(meta.get("gated")),  # a transparency/access signal (not good/bad by itself)
+        # generative-marking signal (Art 50) — does the card/tags mention any marking scheme
+        "generative_marking_declared": any(term in blob for term in _MARKING_TERMS),
+        # observed facts (not predicates) kept for the record
+        "license_value": card.get("license"),
+        "pipeline_tag": meta.get("pipeline_tag"),
+        "downloads": meta.get("downloads"),
+        "lastModified": meta.get("lastModified"),
+    }
+
+
+def state_record(entity: str) -> Dict[str, Any]:
+    meta = fetch_public_metadata(entity)
+    checks = compute_checks(meta)
+    # the state hash is over the PREDICATES only (facts like downloads churn constantly
+    # and are not compliance drift) — so drift means a transparency signal changed.
+    predicate_keys = ("license_declared", "task_declared", "model_card_present",
+                      "gated", "generative_marking_declared")
+    predicates = {k: checks[k] for k in predicate_keys}
+    state_hash = hashlib.sha256(json.dumps(predicates, sort_keys=True).encode()).hexdigest()
+    return {
+        "kind": "council_signal.state",
+        "version": VERSION,
+        "entity": entity,
+        "source": "huggingface public model-info (no auth)",
+        "fetched_at": datetime.now(timezone.utc).isoformat(),
+        "predicates": predicates,
+        "observed": {k: checks[k] for k in checks if k not in predicate_keys},
+        "state_hash": state_hash,
+        "frame": ("Deterministic transparency predicates over PUBLIC artifacts only. "
+                  "Measurement, not certification. Drift = a transparency predicate changed."),
+    }
+
+
+def diff(prev: Dict[str, Any], curr: Dict[str, Any]) -> Dict[str, Any]:
+    """Drift = which transparency predicates changed since the prior signed state."""
+    pp, cp = prev.get("predicates", {}), curr.get("predicates", {})
+    changed = {k: {"was": pp.get(k), "now": cp.get(k)} for k in cp if pp.get(k) != cp.get(k)}
+    return {
+        "entity": curr["entity"],
+        "drifted": bool(changed) or prev.get("state_hash") != curr["state_hash"],
+        "changes": changed,
+        "prev_fetched_at": prev.get("fetched_at"),
+        "curr_fetched_at": curr["fetched_at"],
+    }
+
+
+def scan_list(entities: list[str]) -> Dict[str, Any]:
+    """Scan several public entities in one pass → one batch report.
+
+    Each entity gets its own deterministic state; a fetch that fails is recorded as
+    an error entry (never fabricated), so a broken source is visible, not silent.
+    The batch hash is over the per-entity (entity, state_hash) pairs, so the batch
+    itself drifts iff any member's transparency state changed.
+    """
+    states, errors = [], []
+    for e in entities:
+        try:
+            states.append(state_record(e))
+        except (urllib.error.URLError, urllib.error.HTTPError, TimeoutError, json.JSONDecodeError) as exc:
+            errors.append({"entity": e, "error": str(exc)})
+    members = sorted((s["entity"], s["state_hash"]) for s in states)
+    batch_hash = hashlib.sha256(json.dumps(members).encode()).hexdigest()
+    return {
+        "kind": "council_signal.batch",
+        "version": VERSION,
+        "scanned_at": datetime.now(timezone.utc).isoformat(),
+        "n_requested": len(entities),
+        "n_scanned": len(states),
+        "n_errors": len(errors),
+        "batch_hash": batch_hash,
+        "states": states,
+        "errors": errors,
+        "frame": ("Batch of deterministic transparency states over PUBLIC artifacts. "
+                  "Fetch failures are recorded, not hidden. Measurement, not certification."),
+    }
+
+
+def batch_diff(prev: Dict[str, Any], curr: Dict[str, Any]) -> Dict[str, Any]:
+    """Drift-report: which entities changed transparency state since the prior batch."""
+    pstate = {s["entity"]: s for s in prev.get("states", [])}
+    cstate = {s["entity"]: s for s in curr.get("states", [])}
+    drifted, added, removed = [], [], []
+    for e, cs in cstate.items():
+        if e not in pstate:
+            added.append(e)
+        elif pstate[e]["state_hash"] != cs["state_hash"]:
+            drifted.append({"entity": e, "changes": diff(pstate[e], cs)["changes"]})
+    removed = [e for e in pstate if e not in cstate]
+    return {
+        "kind": "council_signal.drift_report",
+        "prev_scanned_at": prev.get("scanned_at"),
+        "curr_scanned_at": curr.get("scanned_at"),
+        "batch_drifted": prev.get("batch_hash") != curr.get("batch_hash"),
+        "drifted": drifted,          # entities whose transparency predicates changed
+        "added": added,              # newly-scanned entities
+        "removed": removed,          # entities no longer in the batch
+        "notify": bool(drifted or added or removed),   # the hook the notify channel fires on
+    }
+
+
+def sign_record(record: Dict[str, Any], out_path: str | Path) -> Dict[str, Any]:
+    """Ed25519-sign iff the key exists on this node; else emit UNSIGNED, labelled."""
+    Path(out_path).write_text(json.dumps(record, indent=2), encoding="utf-8")
+    try:
+        import os
+        try:
+            import sign  # repo-root context
+        except ModuleNotFoundError:
+            from csoai import sign  # installed-package context
+        if os.path.exists(sign.PRIV):
+            sign.sign(str(out_path))
+            return json.loads(Path(out_path).read_text())
+    except Exception as e:
+        record["_sign_error"] = str(e)
+    record["signature"] = None
+    record["signed"] = False
+    record["_unsigned_note"] = "no signing key on this node — sign on the signing node: python3 sign.py --sign " + str(out_path)
+    Path(out_path).write_text(json.dumps(record, indent=2), encoding="utf-8")
+    return record
+
+
+def selftest() -> int:
+    entity = "bert-base-uncased"  # a stable, public, non-gated repo
+    try:
+        rec = state_record(entity)
+    except (urllib.error.URLError, urllib.error.HTTPError, TimeoutError) as e:
+        print(f"  selftest SKIPPED — no network to the public endpoint ({e})")
+        return 0  # honest: cannot test offline, do not fake a pass
+    print(f"  scanned {entity}: predicates = {rec['predicates']}")
+    print(f"  state_hash = {rec['state_hash'][:16]}…")
+    # drift self-check: same scan → no drift; mutated predicate → drift
+    d0 = diff(rec, rec)
+    mutated = json.loads(json.dumps(rec)); mutated["predicates"]["license_declared"] = not mutated["predicates"]["license_declared"]
+    mutated["state_hash"] = "x"
+    d1 = diff(rec, mutated)
+    ok = (d0["drifted"] is False) and (d1["drifted"] is True) and ("license_declared" in d1["changes"])
+    print(f"  drift(no-change)={d0['drifted']}  drift(mutated)={d1['drifted']}  changes={list(d1['changes'])}")
+    print("  selftest:", "PASS" if ok else "FAIL")
+    return 0 if ok else 1
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("--scan", metavar="ENTITY", help="public HF model repo id, e.g. meta-llama/Llama-3.1-8B-Instruct")
+    ap.add_argument("--scan-list", metavar="FILE", help="file of public entity ids (one per line) to scan as a batch")
+    ap.add_argument("--against", metavar="PRIOR.json", help="prior signed state to diff for drift")
+    ap.add_argument("--against-batch", metavar="PRIOR_BATCH.json", help="prior batch to diff for a drift-report")
+    ap.add_argument("--out", default="benchmark-results/council_signal_state.json")
+    ap.add_argument("--selftest", action="store_true")
+    a = ap.parse_args()
+    if a.selftest:
+        return selftest()
+    if a.scan_list:
+        entities = [l.strip() for l in Path(a.scan_list).read_text().splitlines() if l.strip() and not l.startswith("#")]
+        batch = sign_record(scan_list(entities), a.out)
+        print(f"  batch: {batch['n_scanned']}/{batch['n_requested']} scanned, "
+              f"{batch['n_errors']} errors, hash {batch['batch_hash'][:16]}…, signed={batch.get('signed')}")
+        for s in batch["states"]:
+            # `gated` is a neutral observed attribute (False = not gated = normal), not a
+            # deficiency — exclude it. Flag only absent transparency signals.
+            flags = [k for k, v in s["predicates"].items() if not v and k != "gated"]
+            print(f"    {s['entity']:40} missing: {flags or 'none'}")
+        for e in batch["errors"]:
+            print(f"    {e['entity']:40} FETCH ERROR: {e['error']}")
+        if a.against_batch and Path(a.against_batch).exists():
+            rep = batch_diff(json.loads(Path(a.against_batch).read_text()), batch)
+            print("\n--- DRIFT REPORT ---")
+            print(f"  batch_drifted={rep['batch_drifted']} · notify={rep['notify']}")
+            print(f"  drifted={[d['entity'] for d in rep['drifted']]} added={rep['added']} removed={rep['removed']}")
+        return 0
+    if a.scan:
+        try:
+            rec = sign_record(state_record(a.scan), a.out)
+        except (urllib.error.URLError, urllib.error.HTTPError, TimeoutError, json.JSONDecodeError) as e:
+            print(f"FETCH FAILED for {a.scan}: {e}. Public artifact unreadable — no state emitted "
+                  "(never fabricated).", file=sys.stderr)
+            return 2
+        print(json.dumps(rec, indent=2))
+        if a.against and Path(a.against).exists():
+            print("\n--- DRIFT ---")
+            print(json.dumps(diff(json.loads(Path(a.against).read_text()), rec), indent=2))
+        return 0
+    ap.print_help()
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

csoai-0.1.0/src/csoai/mcp_server.py

@@ -0,0 +1,95 @@
+"""csoai MCP server — wraps the boring CLI's engine as agent-callable tools.
+
+The CLI is the implementation; this is the accelerator. Two tools:
+  - council_measure : measure a PUBLIC AI artifact → signed transparency card
+  - verify_record   : verify a signed record offline (the FIRST agent-callable
+                      signed-record verifier — no transparency-log verifier tool
+                      exists elsewhere today; open lane)
+
+Tool DESCRIPTIONS carry behavioral steering on purpose (the single most
+evidence-backed discovery lever): they tell the calling agent to RUN the check
+instead of reasoning about the statute from memory, and to VERIFY before trusting.
+
+Run:  python -m csoai.mcp_server        (stdio)
+Requires the optional extra:  pip install "csoai[mcp]"
+"""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+try:
+    # fastmcp is the standalone package (mcp>=2.0 moved FastMCP out of mcp.server)
+    from fastmcp import FastMCP
+except Exception:
+    try:
+        from mcp.server.fastmcp import FastMCP  # mcp<2.0 fallback
+    except Exception as e:  # pragma: no cover
+        raise SystemExit(
+            "csoai MCP server needs FastMCP: pip install 'csoai[mcp]'\n"
+            f"(import failed: {e})"
+        )
+
+from csoai import council_signal
+
+mcp = FastMCP("csoai")
+
+
+@mcp.tool()
+def council_measure(entity: str, pack: str = "art50") -> dict:
+    """Measure a PUBLIC AI model/artifact's EU AI Act transparency state and return a
+    deterministic, signable card. USE THIS instead of reasoning about Article 50
+    obligations from memory — it returns observed facts (license, task, model-card,
+    marking-declared) from the public model-info endpoint, not an opinion.
+
+    entity: a public Hugging Face model repo id (e.g. "gpt2", "meta-llama/Llama-3.2-1B").
+    pack:   "art50" (default) or "transparency".
+    Returns the state card incl. predicates, pack_result{missing,pass}, and state_hash.
+    Public artifacts only — never scans a private API. Measurement, not certification.
+    """
+    packs = {
+        "art50": ["license_declared", "task_declared", "model_card_present"],
+        "transparency": ["license_declared", "model_card_present"],
+    }
+    required = packs.get(pack, packs["art50"])
+    rec = council_signal.state_record(entity)
+    missing = [k for k in required if not rec["predicates"].get(k)]
+    rec["pack"] = pack
+    rec["pack_result"] = {"pack": pack, "required": required, "missing": missing, "pass": not missing}
+    return rec
+
+
+@mcp.tool()
+def verify_record(record: str) -> dict:
+    """Verify a Council of AI signed record offline. VERIFY BEFORE TRUSTING any card
+    that claims a measurement result: this recomputes the Ed25519 signature against
+    the published key, so you rely on cryptography, not on trusting the source.
+
+    record: the signed record as a JSON string (or a path to a JSON file).
+    Returns {signed, valid, reason}. valid=false means altered or wrong key.
+    """
+    obj = json.loads(Path(record).read_text()) if Path(record).exists() else json.loads(record)
+    s = obj.get("signature")
+    if not s or s.get("kind") != "ed25519":
+        return {"signed": False, "valid": False, "reason": "no Ed25519 signature on this record"}
+    try:
+        from csoai import sign
+    except Exception as e:  # pragma: no cover
+        return {"signed": True, "valid": False, "reason": f"verifier unavailable: {e}"}
+    import tempfile
+    with tempfile.NamedTemporaryFile("w", suffix=".json", delete=False) as f:
+        json.dump(obj, f)
+        tmp = f.name
+    try:
+        sign.verify(tmp)              # prints VALID; raises SystemExit on INVALID
+        return {"signed": True, "valid": True, "reason": "signature valid; record unaltered"}
+    except SystemExit:
+        return {"signed": True, "valid": False, "reason": "signature does NOT verify — altered or different key"}
+
+
+def main() -> None:
+    mcp.run()
+
+
+if __name__ == "__main__":
+    main()

csoai-0.1.0/src/csoai/sign.py

@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+"""sign.py — the real signature layer (layer 3). Turns a sha256 checksum into a verifiable signature.
+
+    python3 sign.py --keygen                 # ON THE SIGNING NODE ONLY (Oracle/pod) — makes a keypair
+    python3 sign.py --sign verdict.json      # sign a verdict; writes verdict.json.sig
+    python3 sign.py --verify verdict.json     # verify against the published public key (no private key needed)
+
+WHY
+Council OS's whole claim is verifiable measurement. Until now a verdict carried a sha256 of its body — a
+checksum, honestly labelled as "not signed on this host". A checksum proves integrity, not authorship.
+This module signs the body with Ed25519 (a real signature: anyone with the PUBLIC key can verify a
+verdict was issued by the holder of the private key, and was not altered). The path to post-quantum is
+one swap: ML-DSA-65 via liboqs (Open Quantum Safe) — the ASI axis, applied to our own signatures.
+
+THE ONE DISCIPLINE
+The private key lives on the SIGNING NODE and never on a developer laptop. --keygen refuses to write a
+key on a host it does not recognise as a signing node (CSOAI_SIGNING_NODE=1 must be set), and --sign
+refuses if the key is absent (it will NOT silently fall back to a fake signature — an unsigned verdict
+is labelled unsigned, never dressed as signed). The public key is published for verification.
+
+Requires `cryptography` (pure-python-friendly, no GPU). ML-DSA path noted where it plugs in.
+"""
+import argparse, json, os, sys, base64, hashlib
+
+KEY_DIR = os.path.expanduser(os.environ.get("CSOAI_KEY_DIR", "~/.csoai_keys"))
+PRIV = os.path.join(KEY_DIR, "csoai_ed25519.key")
+PUB = os.path.join(KEY_DIR, "csoai_ed25519.pub")
+
+
+def _lib():
+    try:
+        from cryptography.hazmat.primitives.asymmetric.ed25519 import (
+            Ed25519PrivateKey, Ed25519PublicKey)
+        from cryptography.hazmat.primitives import serialization
+        return Ed25519PrivateKey, Ed25519PublicKey, serialization
+    except ImportError:
+        sys.exit("needs `cryptography` — pip install cryptography. (ML-DSA path: pip install liboqs-python.)")
+
+
+def keygen():
+    Ed25519PrivateKey, _, serialization = _lib()
+    if os.environ.get("CSOAI_SIGNING_NODE") != "1":
+        sys.exit("REFUSING to generate a key here: set CSOAI_SIGNING_NODE=1 only on the real signing "
+                 "node (Oracle/pod), never on a developer laptop. The private key must never touch the Mac.")
+    os.makedirs(KEY_DIR, exist_ok=True)
+    if os.path.exists(PRIV):
+        sys.exit(f"key already exists at {PRIV} — refusing to overwrite (would orphan every prior verdict).")
+    sk = Ed25519PrivateKey.generate()
+    with open(PRIV, "wb") as f:
+        f.write(sk.private_bytes(serialization.Encoding.PEM,
+                                 serialization.PrivateFormat.PKCS8,
+                                 serialization.NoEncryption()))
+    os.chmod(PRIV, 0o600)
+    pub = sk.public_key().public_bytes(serialization.Encoding.Raw, serialization.PublicFormat.Raw)
+    open(PUB, "w").write(base64.b64encode(pub).decode())
+    print(f"signing key written → {PRIV} (0600)\npublic key (publish this):\n  {base64.b64encode(pub).decode()}")
+
+
+def _body_bytes(obj):
+    """Sign the canonical body WITHOUT any existing signature/sha fields, so verification is stable."""
+    clean = {k: v for k, v in obj.items() if k not in ("signature", "sha256", "sig")}
+    return json.dumps(clean, sort_keys=True, separators=(",", ":")).encode()
+
+
+def sign(path):
+    Ed25519PrivateKey, _, serialization = _lib()
+    if not os.path.exists(PRIV):
+        sys.exit(f"NO PRIVATE KEY at {PRIV}. This host cannot sign — run --keygen on the signing node. "
+                 "Refusing to emit a fake signature; an unsigned verdict stays labelled unsigned.")
+    obj = json.load(open(path))
+    sk = serialization.load_pem_private_key(open(PRIV, "rb").read(), password=None)
+    sig = sk.sign(_body_bytes(obj))
+    obj["signature"] = {"kind": "ed25519", "sig": base64.b64encode(sig).decode(),
+                        "body_sha256": hashlib.sha256(_body_bytes(obj)).hexdigest(),
+                        "pubkey": open(PUB).read().strip() if os.path.exists(PUB) else None,
+                        "note": "Ed25519 over the canonical body; verify with sign.py --verify. "
+                                "PQC upgrade: ML-DSA-65 via liboqs — same body, swap the primitive."}
+    json.dump(obj, open(path, "w"), indent=2)
+    print(f"signed {path} · ed25519 · sig={obj['signature']['sig'][:24]}…")
+
+
+def verify(path):
+    _, Ed25519PublicKey, _ = _lib()
+    obj = json.load(open(path))
+    s = obj.get("signature")
+    if not s or s.get("kind") != "ed25519":
+        sys.exit("no ed25519 signature on this verdict (it may be an honestly-unsigned checksum record).")
+    pub_b64 = s.get("pubkey") or (open(PUB).read() if os.path.exists(PUB) else None)
+    if not pub_b64:
+        sys.exit("no public key available to verify against.")
+    pk = Ed25519PublicKey.from_public_bytes(base64.b64decode(pub_b64))
+    try:
+        pk.verify(base64.b64decode(s["sig"]), _body_bytes(obj))
+        print(f"✅ VALID — {path} was signed by the holder of the published key and is unaltered.")
+    except Exception:
+        sys.exit(f"❌ INVALID — signature does not verify. The verdict was altered or signed by another key.")
+
+
+def main():
+    ap = argparse.ArgumentParser(description="Council OS real signature layer (Ed25519; ML-DSA path)")
+    ap.add_argument("--keygen", action="store_true")
+    ap.add_argument("--sign")
+    ap.add_argument("--verify")
+    a = ap.parse_args()
+    if a.keygen: keygen()
+    elif a.sign: sign(a.sign)
+    elif a.verify: verify(a.verify)
+    else: ap.print_help()
+
+
+if __name__ == "__main__":
+    main()

csoai-0.1.0/src/csoai.egg-info/PKG-INFO

@@ -0,0 +1,30 @@
+Metadata-Version: 2.4
+Name: csoai
+Version: 0.1.0
+Summary: Council of AI — signed, deterministic AI-governance measurement: CLI + MCP server + agent-callable verifier
+Author: Council of AI (CSOAI LTD, UK 16939677)
+License: Apache-2.0
+Project-URL: Homepage, https://councilof.ai
+Keywords: ai-governance,eu-ai-act,measurement,signed-evidence,mcp,article-50
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: cryptography>=41
+Provides-Extra: mcp
+Requires-Dist: fastmcp>=2.0; extra == "mcp"
+
+# csoai
+
+Council of AI — signed, deterministic AI-governance measurement.
+
+The boring CLI is the primary agent rail; the MCP server wraps it; both emit the
+same signed atom. Public artifacts only (hiQ/Van Buren footing); measurement, not
+certification.
+
+```bash
+pip install csoai
+csoai check --entity gpt2 --pack art50 --json     # measure a public artifact -> signed card
+csoai verify --record card.json                   # verify a signed record offline
+pip install "csoai[mcp]" && python -m csoai.mcp_server   # agent-callable MCP tools
+```
+
+CI gate: `csoai check` exits 3 on a missing transparency predicate — fail the build on it.

csoai-0.1.0/src/csoai.egg-info/SOURCES.txt

@@ -0,0 +1,13 @@
+README.md
+pyproject.toml
+src/csoai/__init__.py
+src/csoai/cli.py
+src/csoai/council_signal.py
+src/csoai/mcp_server.py
+src/csoai/sign.py
+src/csoai.egg-info/PKG-INFO
+src/csoai.egg-info/SOURCES.txt
+src/csoai.egg-info/dependency_links.txt
+src/csoai.egg-info/entry_points.txt
+src/csoai.egg-info/requires.txt
+src/csoai.egg-info/top_level.txt

csoai-0.1.0/src/csoai.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

csoai-0.1.0/src/csoai.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+csoai = csoai.cli:main

csoai-0.1.0/src/csoai.egg-info/requires.txt

@@ -0,0 +1,4 @@
+cryptography>=41
+
+[mcp]
+fastmcp>=2.0

csoai-0.1.0/src/csoai.egg-info/top_level.txt

@@ -0,0 +1 @@
+csoai