dcl-core 0.3.0__tar.gz

dcl_core-0.3.0/LICENSE

@@ -0,0 +1,17 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+   Copyright 2026 Fronesis Labs

dcl_core-0.3.0/PKG-INFO

@@ -0,0 +1,113 @@
+Metadata-Version: 2.4
+Name: dcl-core
+Version: 0.3.0
+Summary: Tamper-evident record chain, offline chain verification, and multi-party consensus primitives for AI agent audit systems (DCL / Leibniz Layer protocol).
+Author: Fronesis Labs
+License: Apache-2.0
+Project-URL: Homepage, https://mcp.fronesislabs.com
+Project-URL: Repository, https://github.com/Fronesis-Labs/dcl-core
+Project-URL: Protocol, https://github.com/Fronesis-Labs/dcl-sdk/blob/main/PROTOCOL.md
+Keywords: mcp,model-context-protocol,audit,hash-chain,ai-agents,x402
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == "dev"
+Dynamic: license-file
+
+# DCL Core
+
+Tamper-evident record chain + multi-party consensus primitives for AI agent
+audit systems. Part of the Deterministic Commitment Layer / Leibniz Layer™
+ecosystem by Fronesis Labs.
+
+This is a clean-history consolidation: the single-agent chain logic
+previously duplicated inside `dcl-webhook`, and the multi-agent consensus
+logic from `dcl-v2`, unified into one module with two known issues fixed.
+
+## What changed vs the previous implementations
+
+### 1. `ChainState.verify()` now detects content tampering
+
+The chain logic previously embedded in `dcl-webhook/dcl_core.py` only
+checked that `prev_hash` pointers linked correctly between rows. It never
+recomputed a row's hash from its own stored fields. That meant a party with
+direct database access could edit `verdict`, `confidence`, or `reason` on
+an existing row — without touching `tx_hash`/`prev_hash` — and `verify()`
+would still report the chain as clean. This defeated the core tamper-evident
+claim.
+
+`verify()` here recomputes each row's hash from all of its stored fields
+and compares it against the stored `tx_hash`. Editing any field now breaks
+verification. See `tests/test_fixes.py::test_detects_content_tamper_not_just_link_break`.
+
+### 2. Super-Hash consensus no longer uses XOR
+
+`dcl-v2`'s original formula was `H*_t = hash(h_t1 ⊕ h_t2 ⊕ ... ⊕ h_tM)`.
+XOR is commutative and reversible: a party submitting last (or able to
+observe the running combination) can solve for a contribution that forces
+the final Super-Hash to any target value, without breaking any hash
+function — cheap arithmetic forgery, not a cryptographic break.
+
+`compute_super_hash()` instead sorts contributions by party ID and hashes
+their length-prefixed concatenation. Order no longer matters (no
+last-mover advantage) and the XOR-forgery trick no longer works. See
+`tests/test_fixes.py::test_super_hash_xor_forgery_no_longer_trivial`.
+
+## Structure
+
+```
+dcl_core/
+├── chain.py       ChainState — append-only chain, content-hash verify()
+└── consensus.py   ConsensusRound, compute_super_hash — multi-party consensus
+tests/
+└── test_fixes.py  Regression tests for both fixes above
+```
+
+## Quick start
+
+```bash
+pip install -e .
+python -m pytest tests/ -v
+```
+
+```python
+from dcl_core import ChainState
+
+chain = ChainState("audit.db")
+tx_hash, idx = chain.append(
+    verdict="COMMIT", input_hash="0xabc...", policy_hash="0xdef...",
+    agent_id="agent-1", reason="policy checks passed", confidence=0.95,
+    task_type="generation",
+)
+
+clean, bad_index, reason = chain.verify()
+```
+
+```python
+from dcl_core import ConsensusRound, verify_super_hash
+
+round_ = ConsensusRound(expected_parties={"org-a", "org-b", "org-c"})
+round_.submit("org-a", h_a)
+round_.submit("org-b", h_b)
+round_.submit("org-c", h_c)
+super_hash, contributions = round_.seal()
+assert verify_super_hash(contributions, super_hash)
+```
+
+## Scope
+
+This repo publishes the **protocol layer only** — record format, hash-chain
+verification, and consensus combination. Scoring/policy engines (behavioral
+fingerprinting, epistemic validation thresholds, reputation weighting) stay
+in separate, closed modules that build on top of this.
+
+## License
+
+Apache License 2.0 — see [LICENSE](LICENSE).

dcl_core-0.3.0/README.md

@@ -0,0 +1,90 @@
+# DCL Core
+
+Tamper-evident record chain + multi-party consensus primitives for AI agent
+audit systems. Part of the Deterministic Commitment Layer / Leibniz Layer™
+ecosystem by Fronesis Labs.
+
+This is a clean-history consolidation: the single-agent chain logic
+previously duplicated inside `dcl-webhook`, and the multi-agent consensus
+logic from `dcl-v2`, unified into one module with two known issues fixed.
+
+## What changed vs the previous implementations
+
+### 1. `ChainState.verify()` now detects content tampering
+
+The chain logic previously embedded in `dcl-webhook/dcl_core.py` only
+checked that `prev_hash` pointers linked correctly between rows. It never
+recomputed a row's hash from its own stored fields. That meant a party with
+direct database access could edit `verdict`, `confidence`, or `reason` on
+an existing row — without touching `tx_hash`/`prev_hash` — and `verify()`
+would still report the chain as clean. This defeated the core tamper-evident
+claim.
+
+`verify()` here recomputes each row's hash from all of its stored fields
+and compares it against the stored `tx_hash`. Editing any field now breaks
+verification. See `tests/test_fixes.py::test_detects_content_tamper_not_just_link_break`.
+
+### 2. Super-Hash consensus no longer uses XOR
+
+`dcl-v2`'s original formula was `H*_t = hash(h_t1 ⊕ h_t2 ⊕ ... ⊕ h_tM)`.
+XOR is commutative and reversible: a party submitting last (or able to
+observe the running combination) can solve for a contribution that forces
+the final Super-Hash to any target value, without breaking any hash
+function — cheap arithmetic forgery, not a cryptographic break.
+
+`compute_super_hash()` instead sorts contributions by party ID and hashes
+their length-prefixed concatenation. Order no longer matters (no
+last-mover advantage) and the XOR-forgery trick no longer works. See
+`tests/test_fixes.py::test_super_hash_xor_forgery_no_longer_trivial`.
+
+## Structure
+
+```
+dcl_core/
+├── chain.py       ChainState — append-only chain, content-hash verify()
+└── consensus.py   ConsensusRound, compute_super_hash — multi-party consensus
+tests/
+└── test_fixes.py  Regression tests for both fixes above
+```
+
+## Quick start
+
+```bash
+pip install -e .
+python -m pytest tests/ -v
+```
+
+```python
+from dcl_core import ChainState
+
+chain = ChainState("audit.db")
+tx_hash, idx = chain.append(
+    verdict="COMMIT", input_hash="0xabc...", policy_hash="0xdef...",
+    agent_id="agent-1", reason="policy checks passed", confidence=0.95,
+    task_type="generation",
+)
+
+clean, bad_index, reason = chain.verify()
+```
+
+```python
+from dcl_core import ConsensusRound, verify_super_hash
+
+round_ = ConsensusRound(expected_parties={"org-a", "org-b", "org-c"})
+round_.submit("org-a", h_a)
+round_.submit("org-b", h_b)
+round_.submit("org-c", h_c)
+super_hash, contributions = round_.seal()
+assert verify_super_hash(contributions, super_hash)
+```
+
+## Scope
+
+This repo publishes the **protocol layer only** — record format, hash-chain
+verification, and consensus combination. Scoring/policy engines (behavioral
+fingerprinting, epistemic validation thresholds, reputation weighting) stay
+in separate, closed modules that build on top of this.
+
+## License
+
+Apache License 2.0 — see [LICENSE](LICENSE).

dcl_core-0.3.0/dcl_core/__init__.py

@@ -0,0 +1,22 @@
+from .chain import ChainState, TamperDetectedError, sha256hex
+from .consensus import ConsensusRound, compute_super_hash, verify_super_hash
+from .verify import GENESIS, VerifyResult, canonical_content, recompute_tx_hash, verify_chain
+from .seal import Seal, format_seal
+
+__all__ = [
+    "ChainState",
+    "TamperDetectedError",
+    "sha256hex",
+    "ConsensusRound",
+    "compute_super_hash",
+    "verify_super_hash",
+    "GENESIS",
+    "VerifyResult",
+    "canonical_content",
+    "recompute_tx_hash",
+    "verify_chain",
+    "Seal",
+    "format_seal",
+]
+
+__version__ = "0.3.0"

dcl_core-0.3.0/dcl_core/chain.py

@@ -0,0 +1,242 @@
+"""
+dcl_core.chain — append-only tamper-evident record chain.
+
+Fix vs the version previously embedded in dcl-webhook's dcl_core.py:
+  - verify() now RECOMPUTES tx_hash from each row's stored content and
+    compares it to the stored tx_hash. The old version only checked that
+    prev_hash pointers were linked correctly, which meant an attacker with
+    direct DB access could edit a row's `verdict`/`confidence`/`reason`
+    without touching tx_hash/prev_hash, and verify() would still report the
+    chain as clean. That defeated the core "tamper-evident" claim.
+  - The timestamp used inside the hashed content is now the SAME value
+    stored in the `timestamp` column (previously two separate time.time()
+    calls were made, one for hashing and one for storage, making the hash
+    permanently unreproducible from stored fields).
+
+Patch (this file): added export() — a plain metadata dump of the full
+chain, oldest first. This is read-only access to already-stored fields
+(the same shape get_by_tx() returns), not scoring/policy logic, so it
+belongs in the open protocol layer. webhook_server.py's GET /chain/export
+was calling _chain.export() against a ChainState that never defined it —
+this closes that gap.
+"""
+
+import hashlib
+import json
+import sqlite3
+import threading
+import time
+from typing import Optional, Tuple
+
+
+def sha256hex(s: str) -> str:
+    return hashlib.sha256(s.encode()).hexdigest()
+
+
+class TamperDetectedError(Exception):
+    """Raised when a stored record's hash does not match its recomputed hash."""
+
+    def __init__(self, index: int, reason: str):
+        self.index = index
+        self.reason = reason
+        super().__init__(f"Tamper detected at index {index}: {reason}")
+
+
+class ChainState:
+    """SQLite-backed tamper-evident chain. Stores METADATA ONLY — never raw content."""
+
+    GENESIS = "0" * 64
+    HASH_LEN = 64  # full sha256 hex length; do not truncate (previous version cut to 32)
+
+    def __init__(self, db_path: str = "dcl_chain.db"):
+        self._lock = threading.RLock()  # same-process thread safety
+        self._conn = sqlite3.connect(db_path, timeout=30.0, check_same_thread=False)
+        self._conn.execute("PRAGMA journal_mode=WAL")
+        self._conn.execute(
+            """
+            CREATE TABLE IF NOT EXISTS chain (
+                idx INTEGER PRIMARY KEY,
+                tx_hash TEXT UNIQUE NOT NULL,
+                prev_hash TEXT NOT NULL,
+                verdict TEXT NOT NULL,
+                input_hash TEXT NOT NULL,
+                policy_hash TEXT NOT NULL,
+                agent_id TEXT NOT NULL,
+                reason TEXT NOT NULL,
+                confidence REAL NOT NULL,
+                task_type TEXT NOT NULL,
+                timestamp REAL NOT NULL,
+                drift_context TEXT NOT NULL
+            )
+            """
+        )
+        self._conn.execute("CREATE INDEX IF NOT EXISTS idx_tx_hash ON chain(tx_hash)")
+        self._conn.commit()
+
+    @staticmethod
+    def _content_for_hash(
+        idx: int,
+        verdict: str,
+        input_hash: str,
+        policy_hash: str,
+        prev_hash: str,
+        agent_id: str,
+        reason: str,
+        confidence: float,
+        task_type: str,
+        timestamp: float,
+        drift_context_json: str,
+    ) -> str:
+        """Canonical, order-fixed serialization of everything that must be tamper-evident.
+
+        Every field that can be independently edited in the DB is included here.
+        The old version only hashed idx/verdict/input_hash/policy_hash/prev_hash/time —
+        agent_id, reason, confidence, task_type, and drift_context were NOT part of the
+        hash, so editing any of those fields directly in SQLite was invisible to verify().
+        """
+        return "|".join(
+            [
+                str(idx),
+                verdict,
+                input_hash,
+                policy_hash,
+                prev_hash,
+                agent_id,
+                reason,
+                f"{confidence:.6f}",
+                task_type,
+                f"{timestamp:.6f}",
+                drift_context_json,
+            ]
+        )
+
+    def append(
+        self,
+        verdict: str,
+        input_hash: str,
+        policy_hash: str,
+        agent_id: str,
+        reason: str,
+        confidence: float,
+        task_type: str,
+        drift_context: Optional[dict] = None,
+    ) -> Tuple[str, int]:
+        # BEGIN IMMEDIATE grabs the SQLite write-lock before the SELECT, not
+        # after — this is what actually closes the race, not just the
+        # in-process RLock below. mcp_server.py and webhook_server.py are
+        # separate PM2 processes sharing this same db file; without this,
+        # two near-simultaneous appends (one MCP tool call, one REST call)
+        # can both read the same MAX(idx)/prev_hash and then collide on the
+        # INSERT (idx is a PRIMARY KEY), crashing the second caller's request
+        # instead of just making it wait its turn.
+        with self._lock:
+            self._conn.execute("BEGIN IMMEDIATE")
+            try:
+                last = self._conn.execute(
+                    "SELECT tx_hash FROM chain ORDER BY idx DESC LIMIT 1"
+                ).fetchone()
+                prev_hash = last[0] if last else self.GENESIS
+                new_idx = self._conn.execute(
+                    "SELECT COALESCE(MAX(idx), -1) + 1 FROM chain"
+                ).fetchone()[0]
+
+                timestamp = time.time()
+                drift_context = drift_context or {}
+                drift_context_json = json.dumps(drift_context, sort_keys=True)
+
+                content = self._content_for_hash(
+                    new_idx, verdict, input_hash, policy_hash, prev_hash,
+                    agent_id, reason, confidence, task_type, timestamp, drift_context_json,
+                )
+                tx_hash = "0x" + sha256hex(content)  # full 64 hex chars, not truncated
+
+                self._conn.execute(
+                    """
+                    INSERT INTO chain (idx, tx_hash, prev_hash, verdict, input_hash, policy_hash,
+                                        agent_id, reason, confidence, task_type, timestamp, drift_context)
+                    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                    """,
+                    (new_idx, tx_hash, prev_hash, verdict, input_hash, policy_hash,
+                     agent_id, reason, confidence, task_type, timestamp, drift_context_json),
+                )
+                self._conn.commit()
+                return tx_hash, new_idx
+            except Exception:
+                self._conn.rollback()
+                raise
+
+    def get_by_tx(self, tx_hash: str) -> Optional[dict]:
+        row = self._conn.execute(
+            """
+            SELECT idx, tx_hash, prev_hash, verdict, input_hash, policy_hash,
+                   agent_id, reason, confidence, task_type, timestamp, drift_context
+            FROM chain WHERE tx_hash = ?
+            """,
+            (tx_hash,),
+        ).fetchone()
+        if not row:
+            return None
+        return self._row_to_dict(row)
+
+    def export(self) -> list:
+        """Full chain dump, oldest first. Metadata only — never raw content.
+
+        Same field shape as get_by_tx(), for every row in the chain. Read-only
+        access to already-stored data; not scoring/policy logic, so it stays
+        in the open protocol layer alongside append()/get_by_tx()/verify().
+        """
+        rows = self._conn.execute(
+            """
+            SELECT idx, tx_hash, prev_hash, verdict, input_hash, policy_hash,
+                   agent_id, reason, confidence, task_type, timestamp, drift_context
+            FROM chain ORDER BY idx
+            """
+        ).fetchall()
+        return [self._row_to_dict(row) for row in rows]
+
+    @staticmethod
+    def _row_to_dict(row) -> dict:
+        return {
+            "index": row[0], "tx_hash": row[1], "prev_hash": row[2], "verdict": row[3],
+            "input_hash": row[4], "policy_hash": row[5], "agent_id": row[6], "reason": row[7],
+            "confidence": row[8], "task_type": row[9], "timestamp": row[10],
+            "drift_context": json.loads(row[11]),
+        }
+
+    def verify(self) -> Tuple[bool, Optional[int], Optional[str]]:
+        """Full integrity check: link continuity AND content-hash recomputation.
+
+        Returns (is_clean, first_bad_index_or_None, reason_or_None).
+        """
+        rows = self._conn.execute(
+            """
+            SELECT idx, tx_hash, prev_hash, verdict, input_hash, policy_hash,
+                   agent_id, reason, confidence, task_type, timestamp, drift_context
+            FROM chain ORDER BY idx
+            """
+        ).fetchall()
+
+        expected_prev = self.GENESIS
+        for row in rows:
+            (idx, tx_hash, prev_hash, verdict, input_hash, policy_hash,
+             agent_id, reason, confidence, task_type, timestamp, drift_context_json) = row
+
+            # 1. Chain linkage
+            if prev_hash != expected_prev:
+                return False, idx, "prev_hash does not match preceding tx_hash (link broken)"
+
+            # 2. Content integrity — recompute and compare
+            recomputed_content = self._content_for_hash(
+                idx, verdict, input_hash, policy_hash, prev_hash,
+                agent_id, reason, confidence, task_type, timestamp, drift_context_json,
+            )
+            recomputed_hash = "0x" + sha256hex(recomputed_content)
+            if recomputed_hash != tx_hash:
+                return False, idx, "stored tx_hash does not match recomputed hash of row content (row was edited)"
+
+            expected_prev = tx_hash
+
+        return True, None, None
+
+    def __len__(self):
+        return self._conn.execute("SELECT COUNT(*) FROM chain").fetchone()[0]

dcl_core-0.3.0/dcl_core/consensus.py

@@ -0,0 +1,82 @@
+"""
+dcl_core.consensus — cross-organizational Super-Hash consensus (from dcl-v2).
+
+Fix vs the original formula H*_t = hash(h_t1 XOR h_t2 XOR ... XOR h_tM):
+
+XOR is commutative and reversible. Any party that contributes last (or that
+can observe the running combination before submitting) can solve for a
+value h_tM such that the final H*_t equals whatever they want — without
+breaking any individual party's hash function. That means a dishonest party
+could forge apparent consensus cheaply, via arithmetic on XOR, not via a
+cryptographic break.
+
+Fix: combine contributions by hashing their SORTED, length-prefixed
+concatenation instead of XOR-ing them. Sorting makes the result independent
+of submission order (so no party gains an advantage by going last), and
+concatenation removes the XOR-invertibility problem. This is a Merkle-style
+combine, not full tree construction — sufficient for a fixed, known set of M
+parties; swap in a real Merkle tree if M grows large or is dynamic.
+"""
+
+import hashlib
+from typing import Dict, Tuple
+
+
+def sha256hex(s: str) -> str:
+    return hashlib.sha256(s.encode()).hexdigest()
+
+
+def compute_super_hash(party_hashes: Dict[str, str]) -> str:
+    """Combine per-party hashes into a single cross-organizational commitment.
+
+    party_hashes: mapping of party_id -> that party's local hash (h_ti) for
+    timestep t. Order of insertion does not matter — contributions are
+    sorted by party_id before combining, so no party can bias the result by
+    controlling submission order.
+    """
+    if not party_hashes:
+        raise ValueError("compute_super_hash requires at least one party contribution")
+
+    # Sort by party_id for order-independence, then length-prefix each hash
+    # to prevent ambiguous concatenation (e.g. "ab"+"c" vs "a"+"bc").
+    parts = []
+    for party_id in sorted(party_hashes.keys()):
+        h = party_hashes[party_id]
+        parts.append(f"{len(party_id)}:{party_id}:{len(h)}:{h}")
+
+    combined = "|".join(parts)
+    return "0x" + sha256hex(combined)
+
+
+def verify_super_hash(party_hashes: Dict[str, str], claimed_super_hash: str) -> bool:
+    """Recompute the Super-Hash from party contributions and compare."""
+    return compute_super_hash(party_hashes) == claimed_super_hash
+
+
+class ConsensusRound:
+    """Collects per-party hash contributions for one timestep and seals them
+    only once all expected parties have submitted (commit-reveal shape:
+    collect first, combine once, never recombine on partial data)."""
+
+    def __init__(self, expected_parties: set):
+        self.expected_parties = set(expected_parties)
+        self._contributions: Dict[str, str] = {}
+        self._sealed_super_hash: str | None = None
+
+    def submit(self, party_id: str, h_t: str) -> None:
+        if self._sealed_super_hash is not None:
+            raise RuntimeError("round already sealed; cannot accept further contributions")
+        if party_id not in self.expected_parties:
+            raise ValueError(f"unexpected party_id: {party_id}")
+        self._contributions[party_id] = h_t
+
+    @property
+    def is_complete(self) -> bool:
+        return set(self._contributions.keys()) == self.expected_parties
+
+    def seal(self) -> Tuple[str, Dict[str, str]]:
+        if not self.is_complete:
+            missing = self.expected_parties - set(self._contributions.keys())
+            raise RuntimeError(f"cannot seal: missing contributions from {missing}")
+        self._sealed_super_hash = compute_super_hash(self._contributions)
+        return self._sealed_super_hash, dict(self._contributions)

dcl_core-0.3.0/dcl_core/seal.py

@@ -0,0 +1,65 @@
+"""
+dcl_core.seal — human-readable verification seal formatting.
+
+Pure presentation over already-public fields (tx_hash, input_hash,
+timestamp). No scoring/policy logic, no network call — mirrors
+`formatSeal()` in @fronesis-labs/dcl-sdk (TypeScript) exactly, including
+the white-label options, so other DCL-protocol implementers aren't stuck
+with Fronesis Labs' branding.
+"""
+
+from datetime import datetime, timezone
+from typing import TypedDict
+
+
+class Seal(TypedDict):
+    seal_text: str
+    verify_url: str
+
+
+DEFAULT_BRAND = "Leibniz Layer | Fronesis Labs"
+DEFAULT_VERIFY_BASE_URL = "https://x402.fronesislabs.com/verify"
+DEFAULT_NETWORK = "Base Mainnet"
+
+
+def _strip_hex_prefix(s: str) -> str:
+    return s[2:] if s.startswith("0x") else s
+
+
+def _format_sealed_timestamp(unix_seconds: float) -> str:
+    return datetime.fromtimestamp(unix_seconds, tz=timezone.utc).strftime(
+        "%Y-%m-%d %H:%M UTC"
+    )
+
+
+def format_seal(
+    tx_hash: str,
+    input_hash: str,
+    timestamp: float,
+    brand: str = DEFAULT_BRAND,
+    verify_base_url: str = DEFAULT_VERIFY_BASE_URL,
+    network: str = DEFAULT_NETWORK,
+) -> Seal:
+    """Formats a human-readable "Verified by..." seal.
+
+    Does not fetch or verify anything itself — call verify_chain() /
+    recompute_tx_hash() first if you want an integrity guarantee behind
+    the seal you're displaying. Set network="" to omit the network suffix.
+    """
+    hash_display = _strip_hex_prefix(tx_hash)
+    intent_display = _strip_hex_prefix(input_hash)
+    sealed = _format_sealed_timestamp(timestamp)
+    verify_url = f"{verify_base_url}/{hash_display}"
+    network_suffix = f" — {network}" if network else ""
+
+    seal_text = "\n".join(
+        [
+            f"🔒 Verified by {brand}",
+            f"Hash: {hash_display}",
+            f"Intent: {intent_display}",
+            f"Sealed: {sealed}{network_suffix}",
+            f"Verify: {verify_url}",
+        ]
+    )
+
+    return {"seal_text": seal_text, "verify_url": verify_url}

dcl_core-0.3.0/dcl_core/verify.py

@@ -0,0 +1,90 @@
+"""
+dcl_core.verify — standalone, offline chain verification.
+
+This is the Python counterpart to `verifyChain()` / `recomputeTxHash()` /
+`canonicalContent()` in `@fronesis-labs/dcl-sdk` (TypeScript). It operates
+on plain dicts (the same shape `ChainState.export()` / `get_by_tx()`
+return) — no SQLite, no network. Anyone holding a chain export (their own,
+or fetched from someone else's server) can independently confirm it wasn't
+tampered with, without trusting the server that handed it to them.
+
+Implements PROTOCOL.md §1 (canonical content string), §2 (chain linking),
+§3 (verification algorithm). `canonical_content()` here and
+`ChainState._content_for_hash()` in chain.py must stay byte-identical —
+that invariant is what `tests/test_verify_matches_chain_state.py` checks.
+"""
+
+import hashlib
+import json
+from dataclasses import dataclass
+from typing import Optional
+
+GENESIS = "0" * 64
+
+
+def sha256hex(s: str) -> str:
+    return hashlib.sha256(s.encode()).hexdigest()
+
+
+def canonical_content(record: dict) -> str:
+    """§1 — the exact pipe-delimited string that gets SHA-256 hashed.
+
+    `record` must have: index, verdict, input_hash, policy_hash, prev_hash,
+    agent_id, reason, confidence, task_type, timestamp, drift_context.
+    """
+    drift_context = record.get("drift_context") or {}
+    drift_context_json = json.dumps(drift_context, sort_keys=True)
+    return "|".join(
+        [
+            str(record["index"]),
+            record["verdict"],
+            record["input_hash"],
+            record["policy_hash"],
+            record["prev_hash"],
+            record["agent_id"],
+            record["reason"],
+            f"{record['confidence']:.6f}",
+            record["task_type"],
+            f"{record['timestamp']:.6f}",
+            drift_context_json,
+        ]
+    )
+
+
+def recompute_tx_hash(record: dict) -> str:
+    """§1.2 — recomputes tx_hash for a single record from its stored fields."""
+    return "0x" + sha256hex(canonical_content(record))
+
+
+@dataclass
+class VerifyResult:
+    clean: bool
+    bad_index: Optional[int] = None
+    reason: Optional[str] = None
+
+
+def verify_chain(records: list) -> VerifyResult:
+    """§3 — full verification: chain-link continuity AND per-record
+    content-hash recomputation. Catches direct-DB edits that a server's
+    own /audit response can't be trusted to admit to.
+    """
+    sorted_records = sorted(records, key=lambda r: r["index"])
+    expected_prev = GENESIS
+
+    for r in sorted_records:
+        if r["prev_hash"] != expected_prev:
+            return VerifyResult(
+                clean=False,
+                bad_index=r["index"],
+                reason="prev_hash does not match preceding tx_hash (link broken)",
+            )
+        recomputed = recompute_tx_hash(r)
+        if recomputed != r["tx_hash"]:
+            return VerifyResult(
+                clean=False,
+                bad_index=r["index"],
+                reason="stored tx_hash does not match recomputed hash of row content (row was edited)",
+            )
+        expected_prev = r["tx_hash"]
+
+    return VerifyResult(clean=True)

dcl_core-0.3.0/dcl_core.egg-info/PKG-INFO

@@ -0,0 +1,113 @@
+Metadata-Version: 2.4
+Name: dcl-core
+Version: 0.3.0
+Summary: Tamper-evident record chain, offline chain verification, and multi-party consensus primitives for AI agent audit systems (DCL / Leibniz Layer protocol).
+Author: Fronesis Labs
+License: Apache-2.0
+Project-URL: Homepage, https://mcp.fronesislabs.com
+Project-URL: Repository, https://github.com/Fronesis-Labs/dcl-core
+Project-URL: Protocol, https://github.com/Fronesis-Labs/dcl-sdk/blob/main/PROTOCOL.md
+Keywords: mcp,model-context-protocol,audit,hash-chain,ai-agents,x402
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == "dev"
+Dynamic: license-file
+
+# DCL Core
+
+Tamper-evident record chain + multi-party consensus primitives for AI agent
+audit systems. Part of the Deterministic Commitment Layer / Leibniz Layer™
+ecosystem by Fronesis Labs.
+
+This is a clean-history consolidation: the single-agent chain logic
+previously duplicated inside `dcl-webhook`, and the multi-agent consensus
+logic from `dcl-v2`, unified into one module with two known issues fixed.
+
+## What changed vs the previous implementations
+
+### 1. `ChainState.verify()` now detects content tampering
+
+The chain logic previously embedded in `dcl-webhook/dcl_core.py` only
+checked that `prev_hash` pointers linked correctly between rows. It never
+recomputed a row's hash from its own stored fields. That meant a party with
+direct database access could edit `verdict`, `confidence`, or `reason` on
+an existing row — without touching `tx_hash`/`prev_hash` — and `verify()`
+would still report the chain as clean. This defeated the core tamper-evident
+claim.
+
+`verify()` here recomputes each row's hash from all of its stored fields
+and compares it against the stored `tx_hash`. Editing any field now breaks
+verification. See `tests/test_fixes.py::test_detects_content_tamper_not_just_link_break`.
+
+### 2. Super-Hash consensus no longer uses XOR
+
+`dcl-v2`'s original formula was `H*_t = hash(h_t1 ⊕ h_t2 ⊕ ... ⊕ h_tM)`.
+XOR is commutative and reversible: a party submitting last (or able to
+observe the running combination) can solve for a contribution that forces
+the final Super-Hash to any target value, without breaking any hash
+function — cheap arithmetic forgery, not a cryptographic break.
+
+`compute_super_hash()` instead sorts contributions by party ID and hashes
+their length-prefixed concatenation. Order no longer matters (no
+last-mover advantage) and the XOR-forgery trick no longer works. See
+`tests/test_fixes.py::test_super_hash_xor_forgery_no_longer_trivial`.
+
+## Structure
+
+```
+dcl_core/
+├── chain.py       ChainState — append-only chain, content-hash verify()
+└── consensus.py   ConsensusRound, compute_super_hash — multi-party consensus
+tests/
+└── test_fixes.py  Regression tests for both fixes above
+```
+
+## Quick start
+
+```bash
+pip install -e .
+python -m pytest tests/ -v
+```
+
+```python
+from dcl_core import ChainState
+
+chain = ChainState("audit.db")
+tx_hash, idx = chain.append(
+    verdict="COMMIT", input_hash="0xabc...", policy_hash="0xdef...",
+    agent_id="agent-1", reason="policy checks passed", confidence=0.95,
+    task_type="generation",
+)
+
+clean, bad_index, reason = chain.verify()
+```
+
+```python
+from dcl_core import ConsensusRound, verify_super_hash
+
+round_ = ConsensusRound(expected_parties={"org-a", "org-b", "org-c"})
+round_.submit("org-a", h_a)
+round_.submit("org-b", h_b)
+round_.submit("org-c", h_c)
+super_hash, contributions = round_.seal()
+assert verify_super_hash(contributions, super_hash)
+```
+
+## Scope
+
+This repo publishes the **protocol layer only** — record format, hash-chain
+verification, and consensus combination. Scoring/policy engines (behavioral
+fingerprinting, epistemic validation thresholds, reputation weighting) stay
+in separate, closed modules that build on top of this.
+
+## License
+
+Apache License 2.0 — see [LICENSE](LICENSE).

dcl_core-0.3.0/dcl_core.egg-info/SOURCES.txt

@@ -0,0 +1,15 @@
+LICENSE
+README.md
+pyproject.toml
+dcl_core/__init__.py
+dcl_core/chain.py
+dcl_core/consensus.py
+dcl_core/seal.py
+dcl_core/verify.py
+dcl_core.egg-info/PKG-INFO
+dcl_core.egg-info/SOURCES.txt
+dcl_core.egg-info/dependency_links.txt
+dcl_core.egg-info/requires.txt
+dcl_core.egg-info/top_level.txt
+tests/test_fixes.py
+tests/test_verify_matches_chain_state.py

dcl_core-0.3.0/dcl_core.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

dcl_core-0.3.0/dcl_core.egg-info/requires.txt

@@ -0,0 +1,3 @@
+
+[dev]
+pytest>=7.0

dcl_core-0.3.0/dcl_core.egg-info/top_level.txt

@@ -0,0 +1 @@
+dcl_core

dcl_core-0.3.0/pyproject.toml

@@ -0,0 +1,33 @@
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "dcl-core"
+version = "0.3.0"
+description = "Tamper-evident record chain, offline chain verification, and multi-party consensus primitives for AI agent audit systems (DCL / Leibniz Layer protocol)."
+readme = "README.md"
+license = { text = "Apache-2.0" }
+requires-python = ">=3.9"
+dependencies = []
+authors = [{ name = "Fronesis Labs" }]
+keywords = ["mcp", "model-context-protocol", "audit", "hash-chain", "ai-agents", "x402"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: Apache Software License",
+    "Programming Language :: Python :: 3",
+    "Topic :: Security :: Cryptography",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+]
+
+[project.urls]
+Homepage = "https://mcp.fronesislabs.com"
+Repository = "https://github.com/Fronesis-Labs/dcl-core"
+Protocol = "https://github.com/Fronesis-Labs/dcl-sdk/blob/main/PROTOCOL.md"
+
+[project.optional-dependencies]
+dev = ["pytest>=7.0"]
+
+[tool.setuptools.packages.find]
+include = ["dcl_core*"]

dcl_core-0.3.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

dcl_core-0.3.0/tests/test_fixes.py

@@ -0,0 +1,125 @@
+"""
+Regression tests for the two fixes:
+  1. ChainState.verify() must detect content tampering, not just broken links.
+  2. Super-Hash consensus must resist the XOR-forgeability attack.
+
+Plus a coverage test for export(), added when dcl-webhook's GET /chain/export
+turned out to be calling a method that never existed on ChainState.
+"""
+
+import os
+import tempfile
+
+import pytest
+
+from dcl_core.chain import ChainState
+from dcl_core.consensus import compute_super_hash, verify_super_hash, ConsensusRound
+
+
+def make_chain():
+    fd, path = tempfile.mkstemp(suffix=".db")
+    os.close(fd)
+    os.remove(path)  # let sqlite create it fresh
+    return ChainState(path), path
+
+
+def test_clean_chain_verifies():
+    chain, path = make_chain()
+    chain.append("COMMIT", "ih1", "ph1", "agent-1", "ok", 0.95, "test")
+    chain.append("COMMIT", "ih2", "ph1", "agent-1", "ok", 0.90, "test")
+    clean, bad_idx, reason = chain.verify()
+    assert clean is True
+    assert bad_idx is None
+
+
+def test_detects_content_tamper_not_just_link_break():
+    """This is the core regression: editing a field WITHOUT touching
+    tx_hash/prev_hash used to pass the old verify(). It must now fail."""
+    chain, path = make_chain()
+    chain.append("NO_COMMIT", "ih1", "ph1", "agent-1", "policy violation", 0.10, "test")
+
+    # Simulate an attacker with direct DB access flipping the verdict,
+    # leaving tx_hash and prev_hash untouched.
+    conn = chain._conn
+    conn.execute("UPDATE chain SET verdict = 'COMMIT', confidence = 0.99 WHERE idx = 0")
+    conn.commit()
+
+    clean, bad_idx, reason = chain.verify()
+    assert clean is False
+    assert bad_idx == 0
+    assert "recomputed hash" in reason
+
+
+def test_detects_broken_link():
+    chain, path = make_chain()
+    chain.append("COMMIT", "ih1", "ph1", "agent-1", "ok", 0.95, "test")
+    chain.append("COMMIT", "ih2", "ph1", "agent-1", "ok", 0.90, "test")
+
+    conn = chain._conn
+    conn.execute("UPDATE chain SET prev_hash = 'deadbeef' WHERE idx = 1")
+    conn.commit()
+
+    clean, bad_idx, reason = chain.verify()
+    assert clean is False
+    assert bad_idx == 1
+
+
+def test_export_returns_full_chain_in_order():
+    chain, path = make_chain()
+    chain.append("COMMIT", "ih1", "ph1", "agent-1", "ok", 0.95, "test")
+    chain.append("NO_COMMIT", "ih2", "ph1", "agent-2", "policy violation", 0.10, "test")
+
+    dump = chain.export()
+    assert len(dump) == 2
+    assert [row["index"] for row in dump] == [0, 1]
+    assert dump[0]["agent_id"] == "agent-1"
+    assert dump[1]["verdict"] == "NO_COMMIT"
+
+
+def test_export_matches_get_by_tx_shape():
+    chain, path = make_chain()
+    tx_hash, _ = chain.append("COMMIT", "ih1", "ph1", "agent-1", "ok", 0.95, "test")
+
+    exported_row = chain.export()[0]
+    fetched_row = chain.get_by_tx(tx_hash)
+    assert exported_row == fetched_row
+
+
+def test_super_hash_order_independent():
+    contributions = {"org-a": "h_a", "org-b": "h_b", "org-c": "h_c"}
+    h1 = compute_super_hash(contributions)
+    h2 = compute_super_hash({"org-c": "h_c", "org-a": "h_a", "org-b": "h_b"})
+    assert h1 == h2
+
+
+def test_super_hash_xor_forgery_no_longer_trivial():
+    """Under the old XOR scheme, a party submitting last could pick h_tM
+    such that h_t1 ^ h_t2 ^ ... ^ h_tM equals any target value, by solving
+    h_tM = target ^ (h_t1 ^ ... ^ h_t(M-1)). Demonstrate that trick no
+    longer forges the new (concatenation-based) Super-Hash."""
+    h_a = "aa" * 32
+    h_b = "bb" * 32
+    target = "11" * 32  # attacker's desired forged super-hash (hex string)
+
+    # The old XOR-forgery move: compute h_c that would XOR the others to `target`.
+    def xor_hex(x: str, y: str) -> str:
+        return format(int(x, 16) ^ int(y, 16), f"0{len(x)}x")
+
+    forged_h_c = xor_hex(xor_hex(h_a, h_b), target)
+
+    # Under the fixed scheme this forged value does not produce `target`.
+    forged_super_hash = compute_super_hash({"org-a": h_a, "org-b": h_b, "org-c": forged_h_c})
+    assert forged_super_hash != "0x" + target
+
+
+def test_consensus_round_requires_all_parties_before_sealing():
+    round_ = ConsensusRound(expected_parties={"org-a", "org-b"})
+    round_.submit("org-a", "h_a")
+    assert round_.is_complete is False
+    with pytest.raises(RuntimeError):
+        round_.seal()
+
+    round_.submit("org-b", "h_b")
+    assert round_.is_complete is True
+    super_hash, contributions = round_.seal()
+    assert verify_super_hash(contributions, super_hash)

dcl_core-0.3.0/tests/test_verify_matches_chain_state.py

@@ -0,0 +1,98 @@
+"""
+Confirms dcl_core.verify.verify_chain() (standalone, offline, dict-based)
+agrees with ChainState.verify() (SQLite-backed, production) on the exact
+same data. If these two ever disagree, cross-language SDK verification
+(TS, and anyone else implementing PROTOCOL.md) silently breaks — this is
+the guard against that.
+"""
+
+import tempfile
+import os
+
+from dcl_core.chain import ChainState
+from dcl_core.verify import verify_chain, recompute_tx_hash, GENESIS
+from dcl_core.seal import format_seal
+
+
+def _make_chain(n=5):
+    fd, path = tempfile.mkstemp(suffix=".db")
+    os.close(fd)
+    cs = ChainState(db_path=path)
+    for i in range(n):
+        cs.append(
+            verdict="COMMIT" if i % 2 == 0 else "NO_COMMIT",
+            input_hash=f"0x{'a' * 63}{i}",
+            policy_hash=f"0x{'b' * 63}{i}",
+            agent_id=f"agent-{i}",
+            reason=f"reason {i}",
+            confidence=0.9 + i * 0.001,
+            task_type="test",
+            drift_context={"environment": "test", "step": i},
+        )
+    return cs, path
+
+
+def test_standalone_verify_matches_chain_state_on_clean_chain():
+    cs, path = _make_chain(5)
+    try:
+        clean, bad_index, reason = cs.verify()
+        assert clean is True
+
+        records = cs.export()
+        result = verify_chain(records)
+        assert result.clean is True
+        assert result.bad_index is None
+    finally:
+        os.remove(path)
+
+
+def test_recompute_tx_hash_matches_stored_hash_for_every_record():
+    cs, path = _make_chain(3)
+    try:
+        for record in cs.export():
+            assert recompute_tx_hash(record) == record["tx_hash"]
+    finally:
+        os.remove(path)
+
+
+def test_standalone_verify_catches_tampered_row():
+    cs, path = _make_chain(4)
+    try:
+        records = cs.export()
+        records[2]["confidence"] = 0.111111  # tamper without touching tx_hash
+
+        result = verify_chain(records)
+        assert result.clean is False
+        assert result.bad_index == 2
+        assert "content hash" in result.reason or "recomputed" in result.reason
+    finally:
+        os.remove(path)
+
+
+def test_genesis_prev_hash_constant_matches_chain_state():
+    assert GENESIS == ChainState.GENESIS
+
+
+def test_format_seal_basic_shape():
+    seal = format_seal(
+        tx_hash="0x" + "a" * 64,
+        input_hash="0x" + "b" * 64,
+        timestamp=1754400000.123456,
+    )
+    assert seal["seal_text"].startswith("🔒 Verified by Leibniz Layer | Fronesis Labs")
+    assert seal["verify_url"] == "https://x402.fronesislabs.com/verify/" + "a" * 64
+    assert "2025-08-05" in seal["seal_text"] or "2025" in seal["seal_text"]
+
+
+def test_format_seal_white_label_omits_network():
+    seal = format_seal(
+        tx_hash="0x" + "c" * 64,
+        input_hash="0x" + "d" * 64,
+        timestamp=1754400000.0,
+        brand="My Audit Layer",
+        verify_base_url="https://example.com/verify",
+        network="",
+    )
+    assert "My Audit Layer" in seal["seal_text"]
+    assert "—" not in seal["seal_text"]
+    assert seal["verify_url"] == "https://example.com/verify/" + "c" * 64