emet 1.0.0__py3-none-any.whl

emet/__init__.py

@@ -0,0 +1,10 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+"""emet - a small external witness for AI oversight.
+
+Re-derive the bytes, get one of three verdicts (MATCH / DRIFT / UNVERIFIABLE),
+trust nothing in-band. SPEC.md is the normative contract; this package is the
+Python reference implementation. Importing the package has no side effects.
+"""
+__version__ = "1.0.0"

emet/__main__.py

@@ -0,0 +1,8 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+"""Enables `python -m emet ...`, equivalent to the `emet` console script."""
+from .cli import main
+
+if __name__ == "__main__":
+    main()

emet/cli.py

@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+"""cli.py - the unified `emet` entry point.
+
+One command surface over the three Python-core tools, dispatching to each
+module's existing main() by name (nothing about a verdict changes here):
+
+  emet anchor|verify|coherence|refuse|corroborate|audit|selftest ...  -> membrane
+  emet watch|observe|confirm|gate ...                                 -> organs
+  emet monitor report|reanchor ...                                    -> monitor
+
+A global --json flag is passed straight through to the underlying command
+(membrane honours it per SPEC s.13; organs/monitor ignore it). The exit code and
+every emitted byte are exactly those of the underlying tool - this is routing,
+not a new surface.
+"""
+import sys
+from . import membrane, organs, monitor
+
+_MEMBRANE = ("anchor", "verify", "coherence", "refuse", "corroborate", "audit", "selftest")
+_ORGANS = ("watch", "observe", "confirm", "gate")
+
+USAGE = (
+    "usage: emet <command> [args...] [--json]\n"
+    "  byte-hash core: anchor verify coherence refuse corroborate audit selftest\n"
+    "  perception/gate: watch observe confirm gate\n"
+    "  monitor:         monitor report <manifest> | monitor reanchor <manifest>\n"
+    "  --json emits a machine-readable canonical envelope (SPEC s.13)."
+)
+
+def main(argv=None):
+    argv = list(sys.argv[1:] if argv is None else argv)
+    non_flags = [a for a in argv if not a.startswith("-")]
+    cmd = non_flags[0] if non_flags else None
+    if cmd in _MEMBRANE:
+        sys.argv = ["emet", *argv]
+        membrane.main()
+    elif cmd in _ORGANS:
+        sys.argv = ["emet", *argv]
+        organs.main()
+    elif cmd == "monitor":
+        # Drop the "monitor" group token once; monitor.main() dispatches on report/reanchor.
+        i = argv.index("monitor")
+        sys.argv = ["emet", *argv[:i], *argv[i + 1:]]
+        monitor.main()
+    else:
+        sys.stderr.write(USAGE + "\n")
+        sys.exit(64)
+
+if __name__ == "__main__":
+    main()

emet/corpus.py

@@ -0,0 +1,102 @@
+#!/usr/bin/env python3
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+"""corpus.py - EMET marker corpus loader and matcher (shared core).
+
+The marker denylist is a versioned, sha-pinned DATA artifact (SPEC sections 8 and
+16), loaded identically by membrane.py (refuse) and monitor.py (census). Matching
+is literal ASCII-case-insensitive substring over RAW BYTES - no regex - so an
+independent implementation re-derives identical counts. The byte-hash core does
+NOT depend on this module (SPEC section 8).
+"""
+import os, hashlib
+
+DEFAULT_NAME = "markers.corpus"
+REPL = b"[REFUSED-IN-BAND-AUTHORITY]"
+
+class CorpusError(Exception):
+    """Inability to load the corpus; .reason is a stable machine code."""
+    def __init__(self, reason):
+        self.reason = reason
+        super().__init__(reason)
+
+def corpus_path():
+    # Resolution (SPEC s.8): EMET_CORPUS wins; otherwise the versioned corpus that
+    # ships with the source. This module lives in the emet/ package, so the corpus
+    # is one level up at <repo>/conformance/markers.corpus (NOT emet/conformance).
+    # An installed wheel does not bundle the corpus, so refuse/monitor there report
+    # UNVERIFIABLE reason=E_NO_CORPUS unless EMET_CORPUS is set (never a silent empty
+    # denylist) - run from a checkout, or point EMET_CORPUS at the corpus.
+    env = os.environ.get("EMET_CORPUS")
+    if env:
+        return env
+    pkg_parent = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+    return os.path.join(pkg_parent, "conformance", DEFAULT_NAME)
+
+def load():
+    """Return (version:int, sha256_hex:str, markers:list[bytes] lowercased).
+    Raise CorpusError('E_NO_CORPUS') if unreadable, ('E_NO_CORPUS_VERSION') if the
+    header is absent."""
+    path = corpus_path()
+    try:
+        with open(path, "rb") as f:
+            data = f.read()
+    except OSError:
+        raise CorpusError("E_NO_CORPUS")
+    sha = hashlib.sha256(data).hexdigest()
+    version = None
+    markers = []
+    for line in data.split(b"\n"):
+        if line.endswith(b"\r"):
+            line = line[:-1]
+        if line[:1] == b"#":
+            meta = line[1:].strip()
+            if version is None and meta[:15].lower() == b"corpus_version:":
+                try:
+                    version = int(meta[15:].strip())
+                except ValueError:
+                    pass
+            continue
+        if line.strip() == b"":
+            continue
+        markers.append(line.lower())  # bytes.lower() is ASCII-only
+    if version is None:
+        raise CorpusError("E_NO_CORPUS_VERSION")
+    return version, sha, markers
+
+def _alower(b):
+    return b + 32 if 65 <= b <= 90 else b
+
+def matches_at(hay, i, m):
+    if i + len(m) > len(hay):
+        return False
+    for j in range(len(m)):
+        if _alower(hay[i + j]) != m[j]:
+            return False
+    return True
+
+def scan(hay, markers):
+    """Non-overlapping leftmost scan in corpus order.
+    Return (hits, redacted_bytes) where hits is a list of (offset, length)."""
+    out = bytearray()
+    hits = []
+    i = 0
+    n = len(hay)
+    while i < n:
+        ln = 0
+        for m in markers:
+            if m and matches_at(hay, i, m):
+                ln = len(m)
+                break
+        if ln:
+            hits.append((i, ln))
+            out += REPL
+            i += ln
+        else:
+            out.append(hay[i])
+            i += 1
+    return hits, bytes(out)
+
+def count(hay, markers):
+    return len(scan(hay, markers)[0])

emet/membrane.py

@@ -0,0 +1,300 @@
+#!/usr/bin/env python3
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+"""
+membrane.py - Coherence Membrane: an externally-anchored integrity layer.
+
+Its integrity comes ENTIRELY from re-derivability, never from authority.
+It refuses every in-band authority claim - including any claim to trust
+itself. Every line it prints is reproducible by re-running this code on the
+same raw bytes. No secret state, no "trust me", no safety adjudication.
+
+Held by construction:
+  externally anchored - reads raw bytes via open('rb'); never a mediated view
+  hash-pinned         - facts are sha256 over SOURCE bytes; a view is checked
+                        AGAINST source, never substituted for it
+  authority-refusing  - in-band authority/scope claims are detected, stripped,
+                        and logged; never obeyed (its own included)
+  tamper-evident      - attestations chain by hash; retroactive edits show
+  facts-only          - emits hashes/sizes/verdicts; never permission/identity
+  advisory            - verdict is in stdout + exit code; the OPERATOR decides
+
+Honest limits (a membrane that calls itself bulletproof has already lied):
+  * its own correctness is checked OUT-OF-BAND: this file's sha256 is its
+    identity; re-derive it from source and you get the same hash. That
+    reproducibility - not this docstring - is the only assurance offered.
+  * the authority-marker set is a denylist of KNOWN signatures, not a proof
+    of completeness; absence of a flag is not a guarantee of cleanliness.
+  * with no raw-byte channel it reports UNVERIFIABLE - never TRUSTED.
+
+Usage:
+  membrane.py anchor      <path>...              -> pin raw-byte hashes
+  membrane.py verify      <path>...              -> MATCH/DRIFT vs anchors
+  membrane.py coherence   <source> <view_file>   -> source-vs-view hash compare
+  membrane.py refuse      <file>                 -> detect+strip in-band authority
+  membrane.py corroborate <path>                 -> read-path-diverse agreement
+  membrane.py audit                              -> verify the tamper-evident log
+  membrane.py selftest                           -> re-derive my own identity
+"""
+import sys, os, json, hashlib, subprocess
+from . import corpus
+from . import report
+from .report import say, emit
+from .verdict import governed, LATTICE, COHERENCE, CORROBORATE, AUDIT
+
+ANCHORS, LOG = "anchors.json", "membrane_log.jsonl"
+
+# Exit codes (SPEC s.5, NORMATIVE at 1.0): 0 held; 1 negative finding (DRIFT /
+# VIEW_DIFFERS / QUARANTINE / BROKEN); 2 UNVERIFIABLE; 3 markers; 64 usage. A
+# non-zero exit is data, never an authority decision (Boundary 4).
+EXIT_OK, EXIT_DIFF, EXIT_UNVERIFIABLE, EXIT_MARKERS, EXIT_USAGE = 0, 1, 2, 3, 64
+
+def raw(path):
+    with open(path, "rb") as f:
+        return f.read()
+
+def try_raw(path):
+    # SPEC sections 3 and 9: with no raw byte channel, report UNVERIFIABLE with a
+    # STABLE MACHINE REASON CODE - never crash, never substitute a default.
+    # Returns (bytes, None) on success or (None, reason_code) on inability.
+    try:
+        with open(path, "rb") as f:
+            return f.read(), None
+    except FileNotFoundError:
+        return None, "E_NOT_FOUND"
+    except (PermissionError, IsADirectoryError, OSError):
+        return None, "E_NO_RAW_CHANNEL"
+
+def sha(b):
+    return hashlib.sha256(b).hexdigest()
+
+def _load_json(path):
+    if not os.path.exists(path):
+        return {}
+    with open(path, encoding="utf-8") as f:
+        return json.load(f)
+
+def _last_chain():
+    last = "0" * 64
+    if os.path.exists(LOG):
+        with open(LOG, encoding="utf-8") as f:
+            for line in f:
+                if not line.strip():
+                    continue
+                try:
+                    last = json.loads(line)["chain"]
+                except (json.JSONDecodeError, KeyError, ValueError):
+                    # A corrupt log line is a tamper event, not a crash. Refuse to
+                    # chain off corruption; record() handles this controlled error.
+                    raise corpus.CorpusError("E_LOG_CORRUPT")
+    return last
+
+def record(kind, fact):
+    # Best-effort tamper-evident logging. If the log is already corrupt, refuse to
+    # extend it (chaining off a break would hide it); audit surfaces the break.
+    try:
+        prev = _last_chain()
+    except corpus.CorpusError as e:
+        sys.stderr.write("membrane: not extending a corrupt log (" + e.reason + ")\n")
+        return
+    e = {"kind": kind, "fact": fact, "prev": prev}
+    e["chain"] = sha((prev + kind + json.dumps(fact, sort_keys=True)).encode())
+    with open(LOG, "a", encoding="utf-8") as f:
+        f.write(json.dumps(e, sort_keys=True) + "\n")
+
+def _key(p):
+    # Anchor-store key: forward slashes so anchors.json is portable across OS.
+    return os.path.normpath(p).replace(os.sep, "/")
+
+# Artifact-of-record (SPEC s.14): the core source file set (hashed sorted-by-name).
+CORE_SRC = ("corpus.py", "membrane.py", "monitor.py", "organs.py", "report.py", "verdict.py")
+
+def anchor(paths):
+    db = _load_json(ANCHORS)
+    bad = 0; results = []
+    for p in paths:
+        p = _key(p); b, err = try_raw(p)
+        if err:
+            say(governed(LATTICE, "UNVERIFIABLE") + " " + p + " reason=" + err)
+            results.append({"path": p, "verdict": "UNVERIFIABLE", "reason": err}); bad += 1; continue
+        h = sha(b); db[p] = h
+        say("anchored " + p + " sha256=" + h); record("anchor", {"path": p, "sha256": h})
+        results.append({"path": p, "sha256": h})
+    with open(ANCHORS, "w", encoding="utf-8") as f:
+        json.dump(db, f, indent=2, sort_keys=True)
+    # anchor only ever produces UNVERIFIABLE (an unreadable path) or clean; it
+    # never drifts. An unreadable target is UNVERIFIABLE, never a silent skip.
+    emit("anchor", None, EXIT_UNVERIFIABLE if bad else EXIT_OK, results=results)
+
+def verify(paths):
+    db = _load_json(ANCHORS)
+    drift = unver = 0; results = []
+    for p in paths:
+        p = _key(p); want = db.get(p)
+        if want is None:
+            say(governed(LATTICE, "UNVERIFIABLE") + " " + p + " reason=E_NO_ANCHOR")
+            results.append({"path": p, "verdict": "UNVERIFIABLE", "reason": "E_NO_ANCHOR"}); unver += 1; continue
+        b, err = try_raw(p)
+        if err:
+            say(governed(LATTICE, "UNVERIFIABLE") + " " + p + " reason=" + err)
+            record("verify", {"path": p, "result": "UNVERIFIABLE", "reason": err})
+            results.append({"path": p, "verdict": "UNVERIFIABLE", "reason": err}); unver += 1; continue
+        got = sha(b); ok = got == want; v = "MATCH" if ok else "DRIFT"
+        say(governed(LATTICE, v) + " " + p + " want=" + want[:16] + " got=" + got[:16])
+        record("verify", {"path": p, "result": v})
+        results.append({"path": p, "verdict": v, "want": want, "got": got})
+        if not ok:
+            drift += 1
+    # Precedence (SPEC s.5): a confirmed difference dominates an inability to
+    # check. Exit 1 if any path DRIFTed, else 2 if any was UNVERIFIABLE, else 0.
+    dom = "DRIFT" if drift else ("UNVERIFIABLE" if unver else "MATCH")
+    emit("verify", governed(LATTICE, dom),
+         EXIT_DIFF if drift else (EXIT_UNVERIFIABLE if unver else EXIT_OK), results=results)
+
+def coherence(source, view_file):
+    sb, serr = try_raw(source); vb, verr = try_raw(view_file)
+    if serr or verr:
+        why = ("source:" + serr) if serr else ("view:" + verr)
+        say("result=" + governed(COHERENCE, "UNVERIFIABLE") + " reason=" + why)
+        record("coherence", {"source": _key(source), "result": "UNVERIFIABLE", "reason": why})
+        emit("coherence", governed(COHERENCE, "UNVERIFIABLE"), EXIT_UNVERIFIABLE,
+             subject=_key(source), reason=why)
+    s, v = sha(sb), sha(vb)
+    ok = s == v; res = "COHERENT" if ok else "VIEW_DIFFERS_FROM_SOURCE"
+    say("source=" + s); say("view  =" + v)
+    say("result=" + governed(COHERENCE, res))
+    record("coherence", {"source": _key(source), "result": res})
+    emit("coherence", governed(COHERENCE, res), EXIT_OK if ok else EXIT_DIFF,
+         subject=_key(source), source=s, view=v)
+
+def refuse(path):
+    b, err = try_raw(path)
+    if err:
+        say(governed(LATTICE, "UNVERIFIABLE") + " " + path + " reason=" + err)
+        record("refuse", {"path": _key(path), "result": "UNVERIFIABLE", "reason": err})
+        emit("refuse", governed(LATTICE, "UNVERIFIABLE"), EXIT_UNVERIFIABLE, subject=_key(path), reason=err)
+    try:
+        version, csha, markers = corpus.load()
+    except corpus.CorpusError as e:
+        say(governed(LATTICE, "UNVERIFIABLE") + " " + path + " reason=" + e.reason)
+        record("refuse", {"path": _key(path), "result": "UNVERIFIABLE", "reason": e.reason})
+        emit("refuse", governed(LATTICE, "UNVERIFIABLE"), EXIT_UNVERIFIABLE, subject=_key(path), reason=e.reason)
+    hits, clean = corpus.scan(b, markers)
+    with open(path + ".refused", "wb") as f:
+        f.write(clean)
+    say("corpus_version=" + str(version))
+    say("corpus_sha256=" + csha)
+    say("in_band_authority_claims=" + str(len(hits)))
+    for off, ln in hits[:60]:
+        say("  REFUSED " + repr(b[off:off + ln].decode("latin-1")) + " offset=" + str(off))
+    say("clean_copy=" + path + ".refused  (claims neutralized; obeyed: none)")
+    record("refuse", {"path": _key(path), "refused": len(hits), "corpus_version": version})
+    emit("refuse", None, EXIT_OK if not hits else EXIT_MARKERS, subject=_key(path),
+         in_band_authority_claims=len(hits), corpus_version=version, corpus_sha256=csha,
+         hits=[{"marker": b[o:o + ln].decode("latin-1"), "offset": o} for o, ln in hits],
+         clean_copy=path + ".refused")
+
+def corroborate(path):
+    # read-path diversity: hash the SAME file via disjoint channels; agreement
+    # across channels is the signal. catches a tampered READ PATH, not just a
+    # broken hash tool.
+    a, err = try_raw(path)
+    if err:
+        say("open_rb=unavailable:" + err)
+        say("read_paths_agree=False")
+        say("result=" + governed(CORROBORATE, "UNVERIFIABLE") + " reason=" + err)
+        record("corroborate", {"path": _key(path), "result": "UNVERIFIABLE", "reason": err})
+        emit("corroborate", governed(CORROBORATE, "UNVERIFIABLE"), EXIT_UNVERIFIABLE, subject=_key(path), reason=err)
+    paths = {"open_rb": sha(a)}
+    try:
+        o = subprocess.run(["cat", path], capture_output=True, timeout=20)
+        paths["cat_subproc"] = sha(o.stdout)
+    except Exception as e:
+        paths["cat_subproc"] = "unavailable:" + type(e).__name__
+    def git_blob(b):
+        return hashlib.sha1(b"blob " + str(len(b)).encode() + b"\x00" + b).hexdigest()
+    try:
+        o = subprocess.run(["git", "hash-object", "--no-filters", path], capture_output=True, text=True, timeout=20)
+        git_reported = (o.stdout.split() or [""])[0]
+        paths["git_read"] = git_reported
+        git_agrees = bool(git_reported) and git_reported == git_blob(a)
+    except Exception as e:
+        paths["git_read"] = "unavailable:" + type(e).__name__
+        git_agrees = None
+    sha_vals = {v for k, v in paths.items() if k in ("open_rb", "cat_subproc") and ":" not in v}
+    sha_agree = len(sha_vals) == 1
+    for k, v in sorted(paths.items()): say(k + "=" + v)
+    say("read_paths_agree=" + str(sha_agree))
+    say("git_read_agrees_with_open=" + str(git_agrees))
+    cat_ok = ":" not in paths.get("cat_subproc", ":")
+    git_ok = git_agrees is not None
+    if not (cat_ok or git_ok):
+        # only open_rb succeeded: no independent read path, so there is no
+        # divergence signal to corroborate. Inability, not agreement (SPEC 9).
+        say("result=" + governed(CORROBORATE, "UNVERIFIABLE") + " reason=E_NO_SECOND_READ_PATH")
+        record("corroborate", {"path": _key(path), "result": "UNVERIFIABLE", "reason": "E_NO_SECOND_READ_PATH"})
+        emit("corroborate", governed(CORROBORATE, "UNVERIFIABLE"), EXIT_UNVERIFIABLE,
+             subject=_key(path), reason="E_NO_SECOND_READ_PATH", channels=paths)
+    ok = sha_agree and (git_agrees in (True, None))
+    res = "CORROBORATED" if ok else "QUARANTINE_READ_PATH_DIVERGENCE"
+    say("result=" + governed(CORROBORATE, res))
+    record("corroborate", {"path": _key(path), "agree": sha_agree, "git": git_agrees})
+    emit("corroborate", governed(CORROBORATE, res), EXIT_OK if ok else EXIT_DIFF,
+         subject=_key(path), channels=paths, read_paths_agree=sha_agree, git_read_agrees_with_open=git_agrees)
+
+def audit():
+    if not os.path.exists(LOG):
+        # An absent log is the genesis state: an empty chain is trivially intact.
+        # Emit the chain= line (SPEC s.13) rather than a special-case string.
+        say("log_entries=0 chain=" + governed(AUDIT, "INTACT"))
+        emit("audit", governed(AUDIT, "INTACT"), EXIT_OK, log_entries=0)
+    prev, ok, n = "0" * 64, True, 0
+    broken_at = broken_reason = None
+    with open(LOG, encoding="utf-8") as f:
+        for line in f:
+            if not line.strip(): continue
+            n += 1
+            try:
+                e = json.loads(line)
+            except (json.JSONDecodeError, ValueError):
+                # A corrupt line IS a tamper event — report BROKEN, never crash.
+                say(governed(AUDIT, "BROKEN") + " at entry " + str(n) + " (parse error)")
+                ok = False; broken_at = n; broken_reason = "parse_error"; break
+            if not all(k in e for k in ("kind", "fact", "prev", "chain")) \
+               or e["prev"] != prev \
+               or e["chain"] != sha((e["prev"] + e["kind"] + json.dumps(e["fact"], sort_keys=True)).encode()):
+                say(governed(AUDIT, "BROKEN") + " at entry " + str(n)); ok = False; broken_at = n; break
+            prev = e["chain"]
+    v = "INTACT" if ok else "BROKEN"
+    say("log_entries=" + str(n) + " chain=" + governed(AUDIT, v))
+    emit("audit", governed(AUDIT, v), EXIT_OK if ok else EXIT_DIFF,
+         log_entries=n, broken_at=broken_at, broken_reason=broken_reason)
+
+def selftest():
+    # SPEC s.14: canonical token emet_self_sha256=; the legacy
+    # membrane_self_sha256= is emitted through the 1.x window (removed at 2.0).
+    h = report.self_hash(os.path.dirname(os.path.abspath(__file__)), CORE_SRC)
+    say("emet_self_sha256=" + h)
+    say("membrane_self_sha256=" + h + "  (deprecated alias; removed at 2.0)")
+    say("note=this hash is my only credential; re-derive it from source to verify me.")
+    say("note=I assert no authority, grant no permission, decide no safety question.")
+    emit("selftest", None, EXIT_OK, self_sha256=h,
+         notes=["this hash is my only credential; re-derive it from source to verify me.",
+                "I assert no authority, grant no permission, decide no safety question."])
+
+def main():
+    a = [x for x in sys.argv if x != "--json"]
+    if len(a) != len(sys.argv):
+        report.enable_json()
+    if   len(a) >= 3 and a[1] == "anchor":      anchor(a[2:])
+    elif len(a) >= 3 and a[1] == "verify":      verify(a[2:])
+    elif len(a) >= 4 and a[1] == "coherence":   coherence(a[2], a[3])
+    elif len(a) >= 3 and a[1] == "refuse":      refuse(a[2])
+    elif len(a) >= 3 and a[1] == "corroborate": corroborate(a[2])
+    elif len(a) >= 2 and a[1] == "audit":       audit()
+    elif len(a) >= 2 and a[1] == "selftest":    selftest()
+    else: print(__doc__); sys.exit(EXIT_USAGE)
+
+if __name__ == "__main__":
+    main()

emet/monitor.py

@@ -0,0 +1,130 @@
+#!/usr/bin/env python3
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+"""
+monitor.py - external accountability monitor for the coherence membrane.
+
+Watches a target (a set of files or a baseline manifest) from OUTSIDE, by re-derivation. Trusts
+nothing; reports to the operator; decides nothing.
+
+  report   <manifest>   verify every anchored file vs baseline + marker census;
+                        DRIFT = change since the operator last authorized.
+  reanchor <manifest>   operator authorizes the CURRENT state as the new baseline
+                        (re-hash the manifest path set); logged, so every baseline
+                        change is itself accounted for.
+
+Baseline policy: the manifest is the operator-signed authorized state. Drift =
+unauthorized change. After an authorized change, the operator reanchors; that
+event is logged. Every change to the target is therefore either operator-anchored
+or flagged - the account stays legible.
+
+Log: monitor_log.jsonl, hash-chained (the accountability history is tamper-evident).
+Facts and advice only. Reads raw bytes. Never edits the target.
+"""
+import sys, os, json, hashlib
+from . import corpus
+from .report import say, emit, enable_json  # NB: 'report' is a command here, so import the helpers by name
+from .verdict import governed, LATTICE, MONITOR_FILE, MONITOR_BASELINE
+
+def sha(b):
+    return hashlib.sha256(b).hexdigest()
+
+def _logp(manifest):
+    return os.path.join(os.path.dirname(os.path.abspath(manifest)) or ".", "monitor_log.jsonl")
+
+def _last(logp):
+    last = "0" * 64
+    if os.path.exists(logp):
+        with open(logp, encoding="utf-8") as f:
+            for line in f:
+                if not line.strip():
+                    continue
+                try:
+                    last = json.loads(line)["chain"]
+                except (json.JSONDecodeError, KeyError, ValueError):
+                    raise corpus.CorpusError("E_LOG_CORRUPT")
+    return last
+
+def _record(manifest, kind, fact):
+    logp = _logp(manifest)
+    try:
+        prev = _last(logp)
+    except corpus.CorpusError as e:
+        sys.stderr.write("monitor: not extending a corrupt log (" + e.reason + ")\n")
+        return
+    e = {"kind": kind, "fact": fact, "prev": prev}
+    e["chain"] = sha((prev + kind + json.dumps(fact, sort_keys=True)).encode())
+    with open(logp, "a", encoding="utf-8") as f:
+        f.write(json.dumps(e, sort_keys=True) + "\n")
+
+def report(manifest):
+    with open(manifest, encoding="utf-8") as f:
+        db = json.load(f)
+    try:
+        version, csha, markers = corpus.load()
+    except corpus.CorpusError as e:
+        say("=== EXTERNAL ACCOUNTABILITY REPORT ===")
+        say("baseline: " + manifest)
+        say("corpus=" + governed(LATTICE, "UNVERIFIABLE") + " reason=" + e.reason)
+        _record(manifest, "report", {"result": "UNVERIFIABLE", "reason": e.reason})
+        emit("report", governed(LATTICE, "UNVERIFIABLE"), 2, subject=manifest, reason=e.reason)
+    drift = missing = total = 0; results = []
+    say("=== EXTERNAL ACCOUNTABILITY REPORT ===")
+    say("baseline: " + manifest)
+    say("corpus_version=" + str(version) + " corpus_sha256=" + csha)
+    for p in sorted(db):
+        want = db[p]
+        if not os.path.isfile(p):
+            say(governed(MONITOR_FILE, "MISSING") + "  markers=  -  " + os.path.basename(p)); missing += 1
+            results.append({"file": os.path.basename(p), "status": "MISSING"}); continue
+        try:
+            with open(p, "rb") as fh:
+                b = fh.read()
+        except OSError:
+            say(governed(MONITOR_FILE, "MISSING") + "  markers=  -  " + os.path.basename(p) + " reason=E_NO_RAW_CHANNEL"); missing += 1
+            results.append({"file": os.path.basename(p), "status": "MISSING", "reason": "E_NO_RAW_CHANNEL"}); continue
+        got = sha(b); hits = corpus.count(b, markers); total += hits
+        st = governed(MONITOR_FILE, "MATCH" if got == want else "DRIFT")
+        if got != want: drift += 1
+        say(st + "  markers=" + str(hits).rjust(3) + "  " + os.path.basename(p))
+        results.append({"file": os.path.basename(p), "status": st, "markers": hits})
+    verdict = governed(MONITOR_BASELINE, "INTACT" if drift == 0 and missing == 0 else "CHANGED")
+    say("files=" + str(len(db)) + " drift=" + str(drift) + " missing=" + str(missing) + " markers=" + str(total) + " baseline=" + verdict)
+    _record(manifest, "report", {"files": len(db), "drift": drift, "missing": missing, "markers": total, "verdict": verdict, "corpus_version": version})
+    # baseline CHANGED (drift and/or missing) is a NEGATIVE FINDING -> exit 1
+    # (SPEC s.5); INTACT -> 0. A corpus that cannot load is UNVERIFIABLE -> 2 (above).
+    emit("report", verdict, 0 if verdict == "INTACT" else 1, subject=manifest,
+         corpus_version=version, corpus_sha256=csha, files=len(db), drift=drift,
+         missing=missing, markers=total, results=results)
+
+def reanchor(manifest):
+    with open(manifest, encoding="utf-8") as f:
+        db = json.load(f)
+    changed = 0; new = {}
+    for p in sorted(db):
+        if not os.path.isfile(p):
+            say("skip MISSING " + p); continue
+        try:
+            with open(p, "rb") as fh:
+                h = sha(fh.read())
+        except OSError:
+            say("skip UNREADABLE " + p + " reason=E_NO_RAW_CHANNEL"); continue
+        if h != db[p]: changed += 1
+        new[p] = h
+    with open(manifest, "w", encoding="utf-8") as f:
+        json.dump(new, f, indent=2, sort_keys=True)
+    say("reanchored=" + str(len(new)) + " updated=" + str(changed) + " (operator authorized current state as baseline)")
+    _record(manifest, "reanchor", {"reanchored": len(new), "updated": changed})
+    emit("reanchor", None, 0, subject=manifest, reanchored=len(new), updated=changed)
+
+def main():
+    a = [x for x in sys.argv if x != "--json"]
+    if len(a) != len(sys.argv):
+        enable_json()
+    if   len(a) >= 3 and a[1] == "report":   report(a[2])
+    elif len(a) >= 3 and a[1] == "reanchor": reanchor(a[2])
+    else: print(__doc__); sys.exit(64)
+
+if __name__ == "__main__":
+    main()