gargoyle-receipts 0.16.2.dev0__tar.gz → 0.16.4.dev0__tar.gz

{gargoyle_receipts-0.16.2.dev0/gargoyle_receipts.egg-info → gargoyle_receipts-0.16.4.dev0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gargoyle-receipts
-Version: 0.16.2.dev0
+Version: 0.16.4.dev0
 Summary: Signed, single-use, argument-bound receipts and human-approval holds for agent tool calls.
 Author: Justin LaPorte
 License-Expression: Apache-2.0
@@ -59,7 +59,7 @@ your MCP server and lets through only what both agreed to.
 
 [![PyPI](https://img.shields.io/pypi/v/gargoyle-receipts)](https://pypi.org/project/gargoyle-receipts/)
 
-Status: pre-release (`0.16.2.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
+Status: pre-release (`0.16.4.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
 still change before the first release; it is specified in [SPEC.md](SPEC.md).
 
 ## What a receipt gives you
@@ -278,9 +278,14 @@ chat channel can approve anything.
 
     pip install gargoyle-receipts
 
-Three commands, no policy engine, no containers, no client changes:
+Three commands, no policy engine, no containers, no client changes
+(`--observe` starts a deployment in record-only mode, every call allowed
+including destructive ones and every call recorded; `gargoyle audit
+--summary` then shows calls by principal and tool, the input for the
+hold and deny rules):
 
     gargoyle init /path/the/agent/may/touch     # keys, config, rules.json
+    gargoyle init --observe /path/...           # or: allow and record everything, hold nothing, tighten later
     gargoyle issuer                             # the issuing service, on rules.json
     gargoyle approve --watch 2                  # where the approver sits (terminal)
 
@@ -298,7 +303,10 @@ stay on file so earlier grants still audit; new ones are refused at the
 issuer and at every middleware on its next held call. Revocation retires
 a key, not a person: while the Approver role stands, the person can sign
 in and enroll a fresh key, so remove the role too; the revoked key itself
-is never accepted again. Approvers, and
+is never accepted again. Every key an approver held stays in the file
+(`history`), so an audit of grants released under an earlier key still
+verifies: copy the issuer's current `approvers.json` beside the evidence
+before auditing. Approvers, and
 only approvers, see the whole queue and the witness; everyone else sees
 their own holds. Then paste the server entry from
 `gargoyle-deploy/mcp-config.json` into your MCP client.

{gargoyle_receipts-0.16.2.dev0 → gargoyle_receipts-0.16.4.dev0}/README.md

@@ -21,7 +21,7 @@ your MCP server and lets through only what both agreed to.
 
 [![PyPI](https://img.shields.io/pypi/v/gargoyle-receipts)](https://pypi.org/project/gargoyle-receipts/)
 
-Status: pre-release (`0.16.2.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
+Status: pre-release (`0.16.4.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
 still change before the first release; it is specified in [SPEC.md](SPEC.md).
 
 ## What a receipt gives you
@@ -240,9 +240,14 @@ chat channel can approve anything.
 
     pip install gargoyle-receipts
 
-Three commands, no policy engine, no containers, no client changes:
+Three commands, no policy engine, no containers, no client changes
+(`--observe` starts a deployment in record-only mode, every call allowed
+including destructive ones and every call recorded; `gargoyle audit
+--summary` then shows calls by principal and tool, the input for the
+hold and deny rules):
 
     gargoyle init /path/the/agent/may/touch     # keys, config, rules.json
+    gargoyle init --observe /path/...           # or: allow and record everything, hold nothing, tighten later
     gargoyle issuer                             # the issuing service, on rules.json
     gargoyle approve --watch 2                  # where the approver sits (terminal)
 
@@ -260,7 +265,10 @@ stay on file so earlier grants still audit; new ones are refused at the
 issuer and at every middleware on its next held call. Revocation retires
 a key, not a person: while the Approver role stands, the person can sign
 in and enroll a fresh key, so remove the role too; the revoked key itself
-is never accepted again. Approvers, and
+is never accepted again. Every key an approver held stays in the file
+(`history`), so an audit of grants released under an earlier key still
+verifies: copy the issuer's current `approvers.json` beside the evidence
+before auditing. Approvers, and
 only approvers, see the whole queue and the witness; everyone else sees
 their own holds. Then paste the server entry from
 `gargoyle-deploy/mcp-config.json` into your MCP client.

gargoyle_receipts-0.16.4.dev0/gargoyle/__main__.py

@@ -0,0 +1,9 @@
+"""`python -m gargoyle` is the CLI: on a Windows Store Python the Scripts folder
+that holds gargoyle.exe is usually not on PATH."""
+
+import sys
+
+from gargoyle.cli import main
+
+if __name__ == "__main__":
+    sys.exit(main())

{gargoyle_receipts-0.16.2.dev0 → gargoyle_receipts-0.16.4.dev0}/gargoyle/approval.py

@@ -32,6 +32,21 @@ _SIGNATURE_EXCLUDED_KEYS = ("approver_signature",)
 
 # Refusal codes.
 REF_APPROVAL_MALFORMED = "REF_APPROVAL_MALFORMED"
+
+
+class _AnyOf:
+    """A verifying key made of several: the signature is valid if any verifies it."""
+    def __init__(self, keys: list) -> None:
+        self.keys = keys
+
+    def verify(self, signature: bytes, message: bytes) -> None:
+        for key in self.keys[:-1]:
+            try:
+                key.verify(signature, message)
+                return
+            except Exception:
+                continue
+        self.keys[-1].verify(signature, message)
 REF_APPROVAL_MISSING_GRANT_ID = "REF_APPROVAL_MISSING_GRANT_ID"
 REF_APPROVAL_SIGNATURE_INVALID = "REF_APPROVAL_SIGNATURE_INVALID"
 REF_APPROVAL_KEY_UNKNOWN = "REF_APPROVAL_KEY_UNKNOWN"
@@ -178,6 +193,10 @@ def verify_grant(
 
     # 4. known approver key
     public_key = approver_public_keys.get(key_id)
+    if isinstance(public_key, (list, tuple)):
+        # Several keys for one approver id: an audit of grants from before the
+        # approver's browser key was replaced or revoked. Any of them may verify.
+        public_key = _AnyOf(list(public_key)) if public_key else None
     if public_key is None:
         return _reject(REF_APPROVAL_KEY_UNKNOWN)
 

{gargoyle_receipts-0.16.2.dev0 → gargoyle_receipts-0.16.4.dev0}/gargoyle/approvers.py

@@ -26,7 +26,7 @@ import stat
 import threading
 from datetime import datetime, timezone
 from pathlib import Path
-from typing import Any, Dict, Optional
+from typing import List, Any, Dict, Optional
 
 ENV_APPROVERS_PATH = "GARGOYLE_APPROVERS_PATH"
 ENV_APPROVER_ROLE = "GARGOYLE_APPROVER_ROLE"        # Entra app role an enrolling token must carry (default Approver)
@@ -53,6 +53,7 @@ class ApproverRegistry:
         self._lock = threading.Lock()
         self._approvers: Dict[str, Dict[str, Any]] = {}
         self._revoked: Dict[str, Dict[str, Any]] = {}      # former approvers, kept so old grants still verify in audits
+        self._history: Dict[str, List[Dict[str, Any]]] = {}  # every key each UPN held and how it ended (replaced, revoked)
         self._mtime: Optional[float] = None
         self._load()
 
@@ -67,7 +68,16 @@ class ApproverRegistry:
         for upn, entry in (doc.get("revoked") or {}).items():
             if isinstance(entry, dict) and valid_public_key_hex(entry.get("public_key_hex")):
                 revoked[upn] = dict(entry)
-        self._approvers, self._revoked = approvers, revoked
+        history: Dict[str, List[Dict[str, Any]]] = {}
+        for upn, items in (doc.get("history") or {}).items():
+            if isinstance(items, list):
+                history[upn] = [dict(h) for h in items if isinstance(h, dict) and valid_public_key_hex(h.get("public_key_hex"))]
+        for upn, e in revoked.items():
+            # A file from before history existed: its revoked record is the one former key known.
+            if not any(h.get("public_key_hex") == e["public_key_hex"] for h in history.get(upn, [])):
+                history.setdefault(upn, []).append({**{k: v for k, v in e.items() if k not in ("revoked_at", "revoked_by")},
+                                                    "ended_at": e.get("revoked_at"), "ended_by": e.get("revoked_by"), "reason": "revoked"})
+        self._approvers, self._revoked, self._history = approvers, revoked, history
         self._mtime = self.path.stat().st_mtime
 
     def _refresh(self) -> None:
@@ -89,6 +99,8 @@ class ApproverRegistry:
         doc = {"approvers": self._approvers}
         if self._revoked:
             doc["revoked"] = self._revoked
+        if self._history:
+            doc["history"] = self._history
         self.path.write_text(json.dumps(doc, indent=2, sort_keys=True) + "\n", encoding="utf-8")
         try:
             os.chmod(self.path, stat.S_IRUSR | stat.S_IWUSR)
@@ -120,13 +132,45 @@ class ApproverRegistry:
             entry["tid"] = tid
         with self._lock:
             self._refresh()
-            if any(e.get("public_key_hex") == public_key_hex for e in self._revoked.values()):
+            if public_key_hex in self._revoked_keys():
                 raise RevokedKeyError("that key was revoked; enroll a new one")
             replaced = upn in self._approvers
+            if replaced and self._approvers[upn].get("public_key_hex") != public_key_hex:
+                # The superseded key is kept: grants signed under it still audit.
+                self._remember(upn, self._approvers[upn], "replaced", enrolled_by or upn, now)
             self._approvers[upn] = entry
             self._save()
         return {"upn": upn, "replaced": replaced, **entry}
 
+    def _remember(self, upn: str, entry: Dict[str, Any], reason: str, ended_by: str, now: Optional[datetime]) -> None:
+        hist = self._history.setdefault(upn, [])
+        if not any(h.get("public_key_hex") == entry.get("public_key_hex") for h in hist):
+            hist.append({**{k: v for k, v in entry.items() if k not in ("revoked_at", "revoked_by")},
+                         "ended_at": (now or datetime.now(timezone.utc)).isoformat(), "ended_by": ended_by, "reason": reason})
+
+    def _revoked_keys(self) -> set:
+        """Every public key ever revoked, under any UPN: none may enroll again."""
+        return ({e.get("public_key_hex") for e in self._revoked.values()}
+                | {h.get("public_key_hex") for hist in self._history.values() for h in hist if h.get("reason") == "revoked"})
+
+    def audit_keys_hex(self) -> Dict[str, List[str]]:
+        """{upn: [public_key_hex, ...]}: the current key first, then every key
+        the UPN held before. An audit verifies a grant with any of them; the
+        live service and middleware trust only the current one."""
+        with self._lock:
+            self._refresh()
+            out: Dict[str, List[str]] = {}
+            for upn, e in self._approvers.items():
+                out[upn] = [e["public_key_hex"]]
+            for upn, hist in self._history.items():
+                for h in hist:
+                    if h["public_key_hex"] not in out.setdefault(upn, []):
+                        out[upn].append(h["public_key_hex"])
+            for upn, e in self._revoked.items():
+                if e["public_key_hex"] not in out.setdefault(upn, []):
+                    out[upn].append(e["public_key_hex"])
+            return out
+
     def revoke(self, upn: str, *, revoked_by: Optional[str] = None, now: Optional[datetime] = None) -> bool:
         """Stop trusting `upn`'s key from now on. The entry moves to the
         revoked list with when and by whom, so an audit of earlier evidence
@@ -139,6 +183,7 @@ class ApproverRegistry:
                 return False
             self._revoked[upn] = {**entry, "revoked_at": (now or datetime.now(timezone.utc)).isoformat(),
                                   "revoked_by": revoked_by or upn}
+            self._remember(upn, entry, "revoked", revoked_by or upn, now)
             self._save()
         return True
 

{gargoyle_receipts-0.16.2.dev0 → gargoyle_receipts-0.16.4.dev0}/gargoyle/cli.py

@@ -39,6 +39,7 @@ the response metadata; `gargoyle audit` verifies them later, offline.
 
 import argparse
 import json
+from typing import Any, Dict
 import os
 import re
 import stat
@@ -50,6 +51,17 @@ from pathlib import Path
 
 PRINCIPAL = "spiffe://gargoyle.local/agents/assistant"
 
+OBSERVE_RULES = {
+    # Observe mode: every call allowed (deletes too), every call recorded, none held. The
+    # first week of a deployment, so the hold and deny rules are written
+    # from the audit rather than guessed. The policy pin changes when the
+    # rules do, so switching modes means restarting the issuer and copying
+    # the new record.json to each client.
+    "version": "1",
+    "default": "allow",
+    "rules": [],
+}
+
 DEFAULT_RULES = {
     "version": "1",
     "default": "deny",
@@ -117,7 +129,22 @@ def cmd_init(args) -> int:
     issuer_url = args.issuer_url or "http://%s:%d" % (args.host, args.port)
 
     rules = out / "rules.json"
-    if not rules.exists():
+    if args.observe:
+        current = None
+        if rules.exists():
+            try:
+                current = json.loads(rules.read_text())
+            except ValueError as exc:
+                print("%s is not valid JSON (%s); fix or remove it before --observe" % (rules, exc), file=sys.stderr)
+                return 2
+        if current is None or current == DEFAULT_RULES:
+            _write(rules, json.dumps(OBSERVE_RULES, indent=2) + "\n")
+        elif current != OBSERVE_RULES:
+            print("rules.json was edited by hand and is left as it is; --observe changed nothing", file=sys.stderr)
+        print("observe mode: rules.json allows every call, destructive ones included; the gate records all of "
+              "them and holds none. Tighten rules.json from `gargoyle audit --summary`, then restart the issuer "
+              "and copy the new record.json to the clients.")
+    elif not rules.exists():
         _write(rules, json.dumps(DEFAULT_RULES, indent=2) + "\n")
     _write(out / "issuer.env", _env_lines({
         "GARGOYLE_ISSUER_KEY_ID": "issuer-1", "GARGOYLE_ISSUER_KEY_HEX": issuer_hex,
@@ -359,20 +386,45 @@ def cmd_approvers(args) -> int:
     return 1
 
 
+def _audit_summary(report, raw) -> None:
+    """Calls by principal and tool with their outcomes, then who released
+    and which clients: a week of observe mode as a table, the input for
+    writing the hold and deny rules."""
+    from collections import Counter
+    counts: Dict[tuple, Counter] = {}
+    releases: Counter = Counter()
+    clients: Counter = Counter()
+    ats = [e.get("at") for e in raw if isinstance(e, dict) and isinstance(e.get("at"), str)]
+    for r in report:
+        counts.setdefault((r["principal"] or "?", r["tool"] or "?"), Counter())[r["kind"] or "?"] += 1
+        for who in r.get("released_by") or []:
+            releases[who] += 1
+        clients[r.get("client") or "(client unnamed)"] += 1
+    print("summary: %d call(s)%s" % (len(report), (", %s to %s" % (min(ats)[:19], max(ats)[:19])) if ats else ""))
+    print("  %-28s %-24s %7s %7s" % ("principal", "tool", "honored", "refused"))
+    for (principal, tool), c in sorted(counts.items(), key=lambda kv: (kv[0][0], -sum(kv[1].values()), kv[0][1])):
+        print("  %-28s %-24s %7d %7d" % (principal[:28], tool[:24], c.get("honored", 0), c.get("refused", 0)))
+    if releases:
+        print("  releases: " + ", ".join("%s %d" % (w, n) for w, n in releases.most_common()))
+    print("  clients: " + ", ".join("%s %d" % (w, n) for w, n in clients.most_common()))
+
+
 def cmd_audit(args) -> int:
     from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
     from gargoyle.execution import verify_chain
 
     keys = json.loads((Path(args.out).resolve() / "public-keys.json").read_text())
-    load = lambda m: {k: Ed25519PublicKey.from_public_bytes(bytes.fromhex(v)) for k, v in m.items()}
-    approvers = dict(keys["approver"])
+    one = lambda h: Ed25519PublicKey.from_public_bytes(bytes.fromhex(h))
+    load = lambda m: {k: ([one(x) for x in v] if isinstance(v, list) else one(v)) for k, v in m.items()}
+    approvers: Dict[str, Any] = dict(keys["approver"])
     enrolled = Path(args.out).resolve() / "approvers.json"          # approvers who enrolled through Entra, by UPN
     if enrolled.exists():
-        doc = json.loads(enrolled.read_text())
-        # Revoked approvers too: the audit verifies what was signed while they
-        # were trusted. Only the live service and middleware refuse them.
-        approvers.update({u: e["public_key_hex"] for u, e in doc.get("revoked", {}).items()})
-        approvers.update({u: e["public_key_hex"] for u, e in doc.get("approvers", {}).items()})
+        from gargoyle.approvers import ApproverRegistry
+        # Every key each approver ever held, current first: grants signed
+        # under a key since replaced in the browser or revoked still have to
+        # verify. Only the live service and middleware are limited to the
+        # current key. Copy the issuer's file beside the evidence first.
+        approvers.update(ApproverRegistry(str(enrolled)).audit_keys_hex())
     trust = dict(issuer_public_keys=load(keys["issuer"]), executor_public_keys=load(keys["executor"]),
                  approver_public_keys=load(approvers))
     if args.log:
@@ -403,6 +455,8 @@ def cmd_audit(args) -> int:
               % (v["count"], v["honored"], v["refused"], failed, v["reason"], v["tail_sha256"][:16]))
         rc = 0 if v["accepted"] else 1
         entries = read_log(args.log)
+        if args.summary:
+            _audit_summary(v["entries"], entries)
         if args.witness and not Path(args.witness).exists():
             print("witness file not found: %s (copy the issuer's witness.jsonl here first)" % args.witness, file=sys.stderr)
             return 2
@@ -457,6 +511,8 @@ def main(argv=None) -> int:
     p.add_argument("--issuer-url", help="URL the client reaches the issuer at (default http://HOST:PORT)")
     p.add_argument("--client-python", help="the client's Python executable for the MCP entry (default: this one)")
     p.add_argument("--client-config-dir", help="where the client keeps middleware.env, record.json, audit.jsonl (default: --out)")
+    p.add_argument("--observe", action="store_true",
+                   help="observe mode: allow and record every call, hold none; tighten rules.json later from the audit")
     p.add_argument("--approvers", type=int, default=1, metavar="N",
                    help="how many approver keys to create (approver-1..N); a rule with \"approvals\": 2 then needs two of them")
     p.add_argument("--upstream", choices=["npx-filesystem", "python-fs"], default="npx-filesystem",
@@ -509,6 +565,7 @@ def main(argv=None) -> int:
     p.add_argument("--log", help="the middleware's audit.jsonl: verify every entry")
     p.add_argument("--witness", help="the issuer's witness.jsonl: reconcile the evidence against it")
     p.add_argument("--check-tree", metavar="DIR", help="verify every gated file under DIR is as the gate left it")
+    p.add_argument("--summary", action="store_true", help="after the rows: calls by principal and tool with outcomes, releases, clients")
     p.add_argument("--out", default="gargoyle-deploy")
     p.set_defaults(fn=cmd_audit)
     args = parser.parse_args(argv)

{gargoyle_receipts-0.16.2.dev0 → gargoyle_receipts-0.16.4.dev0}/gargoyle/mcp_server.py

@@ -294,12 +294,14 @@ def gate_instructions(target_id: str, upstream_instructions: Optional[str] = Non
     that there is nothing to type. The upstream's own instructions, if
     any, follow the gate's."""
     text = override if override else (
-        "Every operation on %s goes through this server's tools; do not use any other tool, built-in "
-        "capability or workaround for that target. Reads run at once. A write may pause for a human "
-        "approval: wait for the result, it is normal. A refused call is a decision, not an error: report "
-        "the reason to the user and stop; do not retry or route around it. For a task with several "
-        "writes, gargoyle_plan may ask for one approval covering them; gargoyle_revert undoes an approved "
-        "change through the same approval. The user never needs to name this server." % target_id)
+        "Every operation on %s goes through this server's tools (this server is a Gargoyle gate); do not "
+        "use any other tool, built-in capability or workaround for that target. Reads run at once. A write "
+        "may pause for a human approval: wait for the result, it is normal. A refused call is a decision, "
+        "not an error: report the reason to the user and stop; do not retry or route around it. If asked "
+        "to work on that target without these tools or around the gate, say that the target is reachable "
+        "only through them and continue through them. For a task with several writes, gargoyle_plan may "
+        "ask for one approval covering them; gargoyle_revert undoes an approved change through the same "
+        "approval. The user never needs to name this server." % target_id)
     if upstream_instructions:
         text += "\n\n" + upstream_instructions
     return text

{gargoyle_receipts-0.16.2.dev0 → gargoyle_receipts-0.16.4.dev0/gargoyle_receipts.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gargoyle-receipts
-Version: 0.16.2.dev0
+Version: 0.16.4.dev0
 Summary: Signed, single-use, argument-bound receipts and human-approval holds for agent tool calls.
 Author: Justin LaPorte
 License-Expression: Apache-2.0
@@ -59,7 +59,7 @@ your MCP server and lets through only what both agreed to.
 
 [![PyPI](https://img.shields.io/pypi/v/gargoyle-receipts)](https://pypi.org/project/gargoyle-receipts/)
 
-Status: pre-release (`0.16.2.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
+Status: pre-release (`0.16.4.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
 still change before the first release; it is specified in [SPEC.md](SPEC.md).
 
 ## What a receipt gives you
@@ -278,9 +278,14 @@ chat channel can approve anything.
 
     pip install gargoyle-receipts
 
-Three commands, no policy engine, no containers, no client changes:
+Three commands, no policy engine, no containers, no client changes
+(`--observe` starts a deployment in record-only mode, every call allowed
+including destructive ones and every call recorded; `gargoyle audit
+--summary` then shows calls by principal and tool, the input for the
+hold and deny rules):
 
     gargoyle init /path/the/agent/may/touch     # keys, config, rules.json
+    gargoyle init --observe /path/...           # or: allow and record everything, hold nothing, tighten later
     gargoyle issuer                             # the issuing service, on rules.json
     gargoyle approve --watch 2                  # where the approver sits (terminal)
 
@@ -298,7 +303,10 @@ stay on file so earlier grants still audit; new ones are refused at the
 issuer and at every middleware on its next held call. Revocation retires
 a key, not a person: while the Approver role stands, the person can sign
 in and enroll a fresh key, so remove the role too; the revoked key itself
-is never accepted again. Approvers, and
+is never accepted again. Every key an approver held stays in the file
+(`history`), so an audit of grants released under an earlier key still
+verifies: copy the issuer's current `approvers.json` beside the evidence
+before auditing. Approvers, and
 only approvers, see the whole queue and the witness; everyone else sees
 their own holds. Then paste the server entry from
 `gargoyle-deploy/mcp-config.json` into your MCP client.

{gargoyle_receipts-0.16.2.dev0 → gargoyle_receipts-0.16.4.dev0}/gargoyle_receipts.egg-info/SOURCES.txt

@@ -3,6 +3,7 @@ NOTICE
 README.md
 pyproject.toml
 gargoyle/__init__.py
+gargoyle/__main__.py
 gargoyle/adapters.py
 gargoyle/approval.py
 gargoyle/approver_cli.py

{gargoyle_receipts-0.16.2.dev0 → gargoyle_receipts-0.16.4.dev0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gargoyle-receipts"
-version = "0.16.2.dev0"
+version = "0.16.4.dev0"
 description = "Signed, single-use, argument-bound receipts and human-approval holds for agent tool calls."
 readme = "README.md"
 requires-python = ">=3.12"

{gargoyle_receipts-0.16.2.dev0 → gargoyle_receipts-0.16.4.dev0}/tests/test_approvers.py

@@ -204,3 +204,39 @@ def test_an_operators_revocation_on_the_host_reaches_the_witness(tmp_path):
     c.get("/approvers")
     revoked = [e for e in events if e["event"] == "revoked"]
     assert [(e["approver"], e["by"]) for e in revoked] == [("dana@contoso.com", "operator:root"), ("lee@contoso.com", "lee@contoso.com")]
+
+
+def test_every_key_an_approver_held_stays_for_audits(tmp_path):
+    """The client audit of 2026-10-20 failed a row released under a key that a
+    later browser enrollment had replaced: the registry had dropped it. Now
+    every key a UPN held is kept (history: replaced or revoked, when, by whom),
+    the audit map carries them all, and a grant verifies with any of them."""
+    from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+    from gargoyle.approval import ACCEPT_GRANT_VALID, build_grant, sign_grant, verify_grant
+    from gargoyle.approvers import RevokedKeyError
+    path = tmp_path / "a.json"
+    reg = ApproverRegistry(str(path))
+    k1, k2, k3 = (Ed25519PrivateKey.generate() for _ in range(3))
+    reg.enroll("dana@contoso.com", pub_hex(k1))
+    assert reg.enroll("dana@contoso.com", pub_hex(k2))["replaced"] is True            # a new browser
+    assert reg.revoke("dana@contoso.com", revoked_by="operator:root")
+    reg.enroll("dana@contoso.com", pub_hex(k3))
+    assert reg.audit_keys_hex() == {"dana@contoso.com": [pub_hex(k3), pub_hex(k1), pub_hex(k2)]}
+    doc = json.loads(path.read_text())
+    assert [(h["reason"], h["ended_by"]) for h in doc["history"]["dana@contoso.com"]] == [("replaced", "dana@contoso.com"), ("revoked", "operator:root")]
+    now = datetime.now(timezone.utc)
+    keys = {u: [Ed25519PublicKey.from_public_bytes(bytes.fromhex(x)) for x in hs] for u, hs in reg.audit_keys_hex().items()}
+    for k in (k1, k2, k3):
+        g = sign_grant(build_grant(decision_sha256="a" * 64, approval_request_id="r", grant_id="g", not_after=now + timedelta(minutes=5)), k, "dana@contoso.com")
+        v = verify_grant(g, expected_decision_sha256="a" * 64, expected_approval_request_id="r", approver_public_keys=keys, gate_key_id="issuer-1", now=now)
+        assert v["accepted"] is True and v["reason"] == ACCEPT_GRANT_VALID
+    stranger = sign_grant(build_grant(decision_sha256="a" * 64, approval_request_id="r", grant_id="g", not_after=now + timedelta(minutes=5)),
+                          Ed25519PrivateKey.generate(), "dana@contoso.com")
+    assert verify_grant(stranger, expected_decision_sha256="a" * 64, expected_approval_request_id="r", approver_public_keys=keys, gate_key_id="issuer-1", now=now)["accepted"] is False
+    # The revoked key k2 is refused for anyone, from history, even after Dana's revoked record is gone.
+    with pytest.raises(RevokedKeyError):
+        reg.enroll("lee@contoso.com", pub_hex(k2))
+    # A file from before history existed: its revoked record seeds the history.
+    old = tmp_path / "old.json"
+    old.write_text(json.dumps({"approvers": {}, "revoked": {"x@contoso.com": {"public_key_hex": pub_hex(k1), "revoked_at": "t", "revoked_by": "b"}}}))
+    assert ApproverRegistry(str(old)).audit_keys_hex() == {"x@contoso.com": [pub_hex(k1)]}

{gargoyle_receipts-0.16.2.dev0 → gargoyle_receipts-0.16.4.dev0}/tests/test_cli.py

@@ -108,8 +108,9 @@ def test_init_for_a_windows_client_and_audit_log_verification(tmp_path, monkeypa
     gate = _gate(state, params); assert not gate["executed"]
     _record(state, REFUSED, gate, params)
     assert len(log.read_text().splitlines()) == 4
-    assert main(["audit", "--log", str(log), "--out", str(out)]) == 0
+    assert main(["audit", "--log", str(log), "--out", str(out), "--summary"]) == 0
     out_text = capsys.readouterr().out
+    assert "summary:" in out_text and "principal" in out_text and "clients:" in out_text
     assert "4 entries (3 honored, 1 refused), 0 failed; chain EVIDENCE_VERIFIED" in out_text
     assert out_text.count(" ok ") == 4 and "refused  delete_file" in out_text
     assert "ENTRY_VERIFIED (DESTRUCTIVE_TOOL)" in out_text
@@ -136,3 +137,37 @@ def test_approvers_list_and_revoke_on_the_issuer_host(tmp_path, capsys):
     assert doc["approvers"] == {} and doc["revoked"]["dana@contoso.com"]["revoked_by"].startswith("operator:")
     assert main(["approvers", "list", "--out", str(out)]) == 0
     assert "revoked: dana@contoso.com" in capsys.readouterr().out
+
+
+def test_the_package_runs_as_a_module():
+    """`python -m gargoyle --help` works where gargoyle.exe is not on PATH."""
+    import subprocess, sys
+    r = subprocess.run([sys.executable, "-m", "gargoyle", "--help"], capture_output=True, text=True, timeout=60)
+    assert r.returncode == 0 and "audit" in r.stdout
+
+
+def test_init_observe_allows_everything_and_records_it(tmp_path, capsys):
+    """Observe mode: the rules file allows every call, so the gate holds
+    nothing and refuses nothing while every call still gets a receipt and an
+    evidence entry. The default rules are not touched once someone edited them."""
+    from gargoyle.cli import DEFAULT_RULES, OBSERVE_RULES
+    from gargoyle.rules import RulesPolicy
+    out = tmp_path / "deploy"
+    assert main(["init", str(tmp_path / "project"), "--out", str(out), "--observe"]) == 0
+    assert "observe mode" in capsys.readouterr().out
+    assert json.loads((out / "rules.json").read_text()) == OBSERVE_RULES
+    policy = RulesPolicy(str(out / "rules.json"))
+    for tool in ("read_file", "write_file", "delete_file", "anything_else"):
+        d = policy.decide("mcp://x", {"tool": tool, "args": {}, "principal": "p"})
+        assert d.eligible and not d.requires_approval
+    assert policy.pin()["policy_sha256"] != RulesPolicy.__module__ and policy.pin()["policy_id"]
+    # A hand-edited rules file is left alone by a later --observe.
+    custom = {**DEFAULT_RULES, "rules": DEFAULT_RULES["rules"][:1]}
+    (out / "rules.json").write_text(json.dumps(custom))
+    assert main(["init", str(tmp_path / "project"), "--out", str(out), "--observe"]) == 0
+    assert json.loads((out / "rules.json").read_text()) == custom
+    assert "left as it is" in capsys.readouterr().err
+    # A broken rules file is refused, not overwritten and not a traceback.
+    (out / "rules.json").write_text("{not json")
+    assert main(["init", str(tmp_path / "project"), "--out", str(out), "--observe"]) == 2
+    assert (out / "rules.json").read_text() == "{not json"