gargoyle-receipts 0.9.0.dev0__tar.gz → 0.10.0.dev0__tar.gz

{gargoyle_receipts-0.9.0.dev0/gargoyle_receipts.egg-info → gargoyle_receipts-0.10.0.dev0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gargoyle-receipts
-Version: 0.9.0.dev0
+Version: 0.10.0.dev0
 Summary: Signed, single-use, argument-bound receipts and human-approval holds for agent tool calls.
 Author: Justin LaPorte
 License-Expression: Apache-2.0
@@ -59,7 +59,7 @@ your MCP server and lets through only what both agreed to.
 
 [![PyPI](https://img.shields.io/pypi/v/gargoyle-receipts)](https://pypi.org/project/gargoyle-receipts/)
 
-Status: pre-release (`0.9.0.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
+Status: pre-release (`0.10.0.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
 still change before the first release; it is specified in [SPEC.md](SPEC.md).
 
 ## What a receipt gives you
@@ -235,7 +235,10 @@ undone the same way: the middleware keeps what a held write replaced and
 offers `gargoyle_revert`, which composes the restoring write and sends it
 through the gate, held, shown as a diff, bound to the current state, and
 refused if anything changed since. The audit marks a revert from the
-state hashes alone.
+state hashes alone. Every entry also names the MCP client that asked, from
+its initialize handshake, so a fleet with Claude on some desks and ChatGPT
+on others still has one trail that says who, through what, did what. The
+receipt itself stays model-agnostic.
 
 The MCP middleware also keeps an evidence log: one hash-chained line per
 decision, refusals and declined holds included, so the trail answers "what

{gargoyle_receipts-0.9.0.dev0 → gargoyle_receipts-0.10.0.dev0}/README.md

@@ -21,7 +21,7 @@ your MCP server and lets through only what both agreed to.
 
 [![PyPI](https://img.shields.io/pypi/v/gargoyle-receipts)](https://pypi.org/project/gargoyle-receipts/)
 
-Status: pre-release (`0.9.0.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
+Status: pre-release (`0.10.0.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
 still change before the first release; it is specified in [SPEC.md](SPEC.md).
 
 ## What a receipt gives you
@@ -197,7 +197,10 @@ undone the same way: the middleware keeps what a held write replaced and
 offers `gargoyle_revert`, which composes the restoring write and sends it
 through the gate, held, shown as a diff, bound to the current state, and
 refused if anything changed since. The audit marks a revert from the
-state hashes alone.
+state hashes alone. Every entry also names the MCP client that asked, from
+its initialize handshake, so a fleet with Claude on some desks and ChatGPT
+on others still has one trail that says who, through what, did what. The
+receipt itself stays model-agnostic.
 
 The MCP middleware also keeps an evidence log: one hash-chained line per
 decision, refusals and declined holds included, so the trail answers "what

{gargoyle_receipts-0.9.0.dev0 → gargoyle_receipts-0.10.0.dev0}/gargoyle/cli.py

@@ -316,6 +316,8 @@ def cmd_audit(args) -> int:
                 why += " state %s -> %s" % (pre or "?", post or "?") if post else " state %s" % pre
             if r.get("reverts"):
                 why += " reverts #%d" % r["reverts"]
+            if r.get("client"):
+                why += " via " + r["client"]
             print("%4s %-5s %-8s %-24s %-28s %s%s" % (r["seq"] if r["seq"] is not None else "?",
                                                       "ok" if r["accepted"] else "FAIL", r["kind"] or "?",
                                                       (r["tool"] or "?")[:24], (r["principal"] or "?")[:28], r["reason"], why))

{gargoyle_receipts-0.9.0.dev0 → gargoyle_receipts-0.10.0.dev0}/gargoyle/evidence.py

@@ -48,8 +48,9 @@ from gargoyle.envelope import args_sha256, canonical_json, canonical_json_legacy
 from gargoyle.execution import verify_chain
 from gargoyle.verifier import verify_provenance
 
-EVIDENCE_VERSION = "gargoyle-evidence/2"          # entry hashes over RFC 8785 canonical JSON
-EVIDENCE_VERSIONS = {"gargoyle-evidence/1": canonical_json_legacy, EVIDENCE_VERSION: canonical_json}
+EVIDENCE_VERSION = "gargoyle-evidence/3"          # version 3 adds `client`; hashes over RFC 8785 canonical JSON
+EVIDENCE_VERSIONS = {"gargoyle-evidence/1": canonical_json_legacy, "gargoyle-evidence/2": canonical_json,
+                     EVIDENCE_VERSION: canonical_json}
 GENESIS = "0" * 64
 
 HONORED = "honored"
@@ -65,6 +66,11 @@ REF_EVIDENCE_UNCHAINED = "REF_EVIDENCE_UNCHAINED"       # a pre-chain {receipt,
 
 _FIELDS = ("evidence_version", "seq", "prev_sha256", "at", "kind", "tool", "args_sha256",
            "principal", "reason", "receipt", "grant", "execution", "entry_sha256")
+# Version 3 names the MCP client that made the call ("Claude Desktop 1.2", "ChatGPT"),
+# from the initialize handshake; null when the client did not say. The
+# receipt stays model-agnostic: this is evidence about the session, not a
+# bound field of the decision.
+_FIELDS_V3 = _FIELDS + ("client",)
 
 
 def entry_sha256(entry: Dict[str, Any]) -> str:
@@ -78,9 +84,11 @@ def entry_sha256(entry: Dict[str, Any]) -> str:
 
 def build_entry(*, seq: int, prev_sha256: str, kind: str, tool: str, args: Any, principal: str,
                 reason: str, receipt: Any = None, grant: Any = None, execution: Any = None,
-                at: Optional[datetime] = None) -> Dict[str, Any]:
+                at: Optional[datetime] = None, client: Optional[str] = None) -> Dict[str, Any]:
     if kind not in (HONORED, REFUSED):
         raise ValueError("kind must be honored or refused")
+    if client is not None and not isinstance(client, str):
+        raise ValueError("client must be a string or None")
     entry = {
         "evidence_version": EVIDENCE_VERSION,
         "seq": seq,
@@ -94,6 +102,7 @@ def build_entry(*, seq: int, prev_sha256: str, kind: str, tool: str, args: Any,
         "receipt": receipt,
         "grant": grant,
         "execution": execution,
+        "client": client,
     }
     entry["entry_sha256"] = entry_sha256(entry)
     return entry
@@ -121,13 +130,15 @@ class EvidenceLog:
                     self._seq, self._tail = int(last["seq"]), str(last["entry_sha256"])
 
     def append(self, kind: str, tool: str, args: Any, principal: str, reason: str, *,
-               receipt: Any = None, grant: Any = None, execution: Any = None) -> Dict[str, Any]:
+               receipt: Any = None, grant: Any = None, execution: Any = None,
+               client: Optional[str] = None) -> Dict[str, Any]:
         """Write one entry and return it. Raises OSError if the file cannot
         be written; the caller decides whether that stops the call."""
         if self._seq is None:
             self._load_tail()
         entry = build_entry(seq=self._seq + 1, prev_sha256=self._tail, kind=kind, tool=tool, args=args,
-                            principal=principal, reason=reason, receipt=receipt, grant=grant, execution=execution)
+                            principal=principal, reason=reason, receipt=receipt, grant=grant, execution=execution,
+                            client=client)
         with open(self.path, "a", encoding="utf-8") as f:
             f.write(json.dumps(entry, sort_keys=True) + "\n")
         self._seq, self._tail = entry["seq"], entry["entry_sha256"]
@@ -135,8 +146,10 @@ class EvidenceLog:
 
 
 def _well_formed(entry: Any) -> bool:
-    return (isinstance(entry, dict) and set(entry) == set(_FIELDS)
+    expected = _FIELDS_V3 if isinstance(entry, dict) and entry.get("evidence_version") == EVIDENCE_VERSION else _FIELDS
+    return (isinstance(entry, dict) and set(entry) == set(expected)
             and entry["evidence_version"] in EVIDENCE_VERSIONS
+            and (entry.get("client") is None or isinstance(entry.get("client"), str))
             and isinstance(entry["seq"], int) and entry["seq"] >= 1
             and isinstance(entry["prev_sha256"], str) and len(entry["prev_sha256"]) == 64
             and isinstance(entry["at"], str) and entry["kind"] in (HONORED, REFUSED)
@@ -179,7 +192,7 @@ def verify_log(
             rc = rc if isinstance(rc, dict) else {}
             report.append({"seq": None, "kind": None, "tool": rc.get("tool"), "principal": rc.get("principal"),
                            "accepted": False, "reason": REF_EVIDENCE_UNCHAINED if legacy else REF_EVIDENCE_MALFORMED,
-                           "verdict": None, "released_by": [], "state": None})
+                           "verdict": None, "released_by": [], "state": None, "client": None})
             all_ok = False
             continue
         e = raw
@@ -212,7 +225,7 @@ def verify_log(
                  if ex.get("pre_state_sha256") or ex.get("post_state_sha256") else None)
         report.append({"seq": e["seq"], "kind": e["kind"], "tool": e["tool"], "principal": e["principal"],
                        "accepted": ok, "reason": reason, "verdict": e["reason"], "released_by": released_by,
-                       "state": state})
+                       "state": state, "client": e.get("client")})
         all_ok = all_ok and ok
         # The chain continues from what the file says, so one bad entry is
         # reported once rather than cascading into every later one.

{gargoyle_receipts-0.9.0.dev0 → gargoyle_receipts-0.10.0.dev0}/gargoyle/mcp_server.py

@@ -267,6 +267,15 @@ def _without_gargoyle_meta(params: Dict[str, Any]) -> Dict[str, Any]:
     return forwarded
 
 
+def client_label(params: Any) -> Optional[str]:
+    """"name version" from an initialize request's clientInfo, or None."""
+    info = params.get("clientInfo") if isinstance(params, dict) else None
+    if not isinstance(info, dict) or not isinstance(info.get("name"), str) or not info["name"]:
+        return None
+    version = info.get("version")
+    return info["name"] + (" " + version if isinstance(version, str) and version else "")
+
+
 def call_for(tool: str, args: Any, principal: str, state_sha256: Optional[str] = None) -> Dict[str, Any]:
     """The call a receipt must bind to execute `tool` with `args` through a
     server serving `principal`: the same three fields the issuer bound, plus
@@ -319,6 +328,7 @@ class ServerState:
             )
         self.executed: List[Dict[str, Any]] = []
         self.initialized = False
+        self.client: Optional[str] = None     # "name version" from the MCP initialize handshake
 
 
 def gate_tool_call(state: ServerState, params: Dict[str, Any]) -> (bool, str):
@@ -422,7 +432,8 @@ def _record(state: ServerState, kind: str, gate: Dict[str, Any], params: Dict[st
     principal = (state.config or {}).get("principal") or ""
     try:
         state.evidence.append(kind, str(params.get("name")), params.get("arguments", {}), principal,
-                              gate["reason"], receipt=gate["envelope"], grant=gate["grant"], execution=execution)
+                              gate["reason"], receipt=gate["envelope"], grant=gate["grant"], execution=execution,
+                              client=state.client)
     except (OSError, ValueError) as exc:
         sys.stderr.write("gargoyle: evidence log unwritable: %s\n" % exc)
 
@@ -464,6 +475,8 @@ def handle_message(state: ServerState, msg: Dict[str, Any]) -> Optional[Dict[str
     params = msg.get("params") or {}
 
     if state.upstream is not None and method in ("initialize", "tools/list"):
+        if method == "initialize":
+            state.client = client_label(params)
         reply = _relay(state, msg)
         if method == "tools/list" and state.snapshots is not None and isinstance(reply, dict) \
                 and isinstance(reply.get("result"), dict) and isinstance(reply["result"].get("tools"), list):
@@ -472,6 +485,7 @@ def handle_message(state: ServerState, msg: Dict[str, Any]) -> Optional[Dict[str
         return reply
 
     if method == "initialize":
+        state.client = client_label(params)
         # The handshake completes when the client sends notifications/initialized;
         # tools are served only after that.
         return _success(

{gargoyle_receipts-0.9.0.dev0 → gargoyle_receipts-0.10.0.dev0}/gargoyle/remote.py

@@ -194,6 +194,8 @@ def build_remote_app(
     def handle_one(st: ServerState, msg: Dict[str, Any]) -> Optional[Dict[str, Any]]:
         method = msg.get("method")
         if method == "initialize":
+            from gargoyle.mcp_server import client_label
+            st.client = client_label(msg.get("params"))
             return {"jsonrpc": "2.0", "id": msg.get("id"), "result": st.upstream_init}   # type: ignore[attr-defined]
         if method == "notifications/initialized":
             st.initialized = True

{gargoyle_receipts-0.9.0.dev0 → gargoyle_receipts-0.10.0.dev0/gargoyle_receipts.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gargoyle-receipts
-Version: 0.9.0.dev0
+Version: 0.10.0.dev0
 Summary: Signed, single-use, argument-bound receipts and human-approval holds for agent tool calls.
 Author: Justin LaPorte
 License-Expression: Apache-2.0
@@ -59,7 +59,7 @@ your MCP server and lets through only what both agreed to.
 
 [![PyPI](https://img.shields.io/pypi/v/gargoyle-receipts)](https://pypi.org/project/gargoyle-receipts/)
 
-Status: pre-release (`0.9.0.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
+Status: pre-release (`0.10.0.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
 still change before the first release; it is specified in [SPEC.md](SPEC.md).
 
 ## What a receipt gives you
@@ -235,7 +235,10 @@ undone the same way: the middleware keeps what a held write replaced and
 offers `gargoyle_revert`, which composes the restoring write and sends it
 through the gate, held, shown as a diff, bound to the current state, and
 refused if anything changed since. The audit marks a revert from the
-state hashes alone.
+state hashes alone. Every entry also names the MCP client that asked, from
+its initialize handshake, so a fleet with Claude on some desks and ChatGPT
+on others still has one trail that says who, through what, did what. The
+receipt itself stays model-agnostic.
 
 The MCP middleware also keeps an evidence log: one hash-chained line per
 decision, refusals and declined holds included, so the trail answers "what

{gargoyle_receipts-0.9.0.dev0 → gargoyle_receipts-0.10.0.dev0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gargoyle-receipts"
-version = "0.9.0.dev0"
+version = "0.10.0.dev0"
 description = "Signed, single-use, argument-bound receipts and human-approval holds for agent tool calls."
 readme = "README.md"
 requires-python = ">=3.12"

{gargoyle_receipts-0.9.0.dev0 → gargoyle_receipts-0.10.0.dev0}/tests/test_evidence.py

@@ -186,3 +186,22 @@ def test_an_honored_held_call_reports_who_released_it(tmp_path):
     with contextlib.redirect_stdout(buf):
         assert main(["audit", "--log", str(log.path), "--out", str(out)]) == 0
     assert "CHAIN_VERIFIED released by sysops@contoso.com" in buf.getvalue()
+
+
+def test_entries_name_the_client_and_older_versions_still_verify(tmp_path):
+    from gargoyle.evidence import EVIDENCE_VERSION, _well_formed
+    log = EvidenceLog(str(tmp_path / "e.jsonl"))
+    e = log.append(REFUSED, "delete_file", {}, PRINCIPAL, "DESTRUCTIVE_TOOL", client="Claude Desktop 1.4")
+    assert e["evidence_version"] == EVIDENCE_VERSION and e["client"] == "Claude Desktop 1.4"
+    anon = log.append(REFUSED, "delete_file", {}, PRINCIPAL, "DESTRUCTIVE_TOOL")
+    assert anon["client"] is None
+    v = verify_log(read_log(str(log.path)), **TRUST)
+    assert v["accepted"] and [r["client"] for r in v["entries"]] == ["Claude Desktop 1.4", None]
+    # A version-2 entry (no client member) is still well-formed; a version-3 entry without it is not.
+    v2 = {k: val for k, val in anon.items() if k != "client"}; v2["evidence_version"] = "gargoyle-evidence/2"
+    v2["entry_sha256"] = entry_sha256(v2)
+    assert _well_formed(v2)
+    v3_missing = {k: val for k, val in anon.items() if k != "client"}
+    assert not _well_formed(v3_missing)
+    with pytest.raises(ValueError):
+        build_entry(seq=1, prev_sha256=GENESIS, kind=REFUSED, tool="t", args={}, principal=PRINCIPAL, reason="x", client=7)

{gargoyle_receipts-0.9.0.dev0 → gargoyle_receipts-0.10.0.dev0}/tests/test_mcp_self_issue.py

@@ -206,7 +206,8 @@ def test_every_decision_lands_in_the_evidence_log(tmp_path):
     state = middleware(client, sleep=human_declines, approval_timeout=60, attest=True)
     from gargoyle.evidence import EvidenceLog
     state.evidence = EvidenceLog(str(tmp_path / "e.jsonl"))
-    handle_message(state, {"jsonrpc": "2.0", "id": 1, "method": "initialize", "params": {}})
+    handle_message(state, {"jsonrpc": "2.0", "id": 1, "method": "initialize",
+                           "params": {"protocolVersion": "2025-06-18", "capabilities": {}, "clientInfo": {"name": "ChatGPT", "version": "2.1"}}})
     handle_message(state, {"jsonrpc": "2.0", "method": "notifications/initialized"})
     ok = handle_message(state, {"jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": call("read_file", {"path": "a"})})
     no = handle_message(state, {"jsonrpc": "2.0", "id": 3, "method": "tools/call", "params": call("delete_file", {"path": "a"})})
@@ -218,6 +219,7 @@ def test_every_decision_lands_in_the_evidence_log(tmp_path):
 
     entries = read_log(str(tmp_path / "e.jsonl"))
     assert [e["kind"] for e in entries] == [HONORED, REFUSED, REFUSED]
+    assert {e["client"] for e in entries} == {"ChatGPT 2.1"}               # which assistant asked, every entry
     assert [e["seq"] for e in entries] == [1, 2, 3] and entries[2]["prev_sha256"] == entries[1]["entry_sha256"]
     assert entries[1]["receipt"] is None                               # policy said no: nothing was issued
     assert entries[2]["receipt"]["requires_approval"] is True          # the human said no: the hold is on record

{gargoyle_receipts-0.9.0.dev0 → gargoyle_receipts-0.10.0.dev0}/tests/test_remote.py

@@ -101,6 +101,7 @@ def test_remote_gate_over_stdio_upstream(tmp_path):
         assert r["result"]["_meta"]["gargoyle/receipt"]["request_context"]["principal"] == "bob@contoso.com"
         lines = [json.loads(l) for l in (tmp_path / "audit.jsonl").read_text(encoding="utf-8").splitlines()]
         assert [e["principal"] for e in lines] == ["alice@contoso.com"] * 3 + ["bob@contoso.com"] and [e["seq"] for e in lines] == [1, 2, 3, 4]
+        assert [e["client"] for e in lines] == ["t 0"] * 3 + [None]          # alice's client named itself; bob's did not
         # No session: told to initialize; DELETE ends one.
         assert rpc(c, alice, {"jsonrpc": "2.0", "id": 9, "method": "tools/list", "params": {}}, "stale").status_code == 404
         assert c.delete("/mcp/" + alice, headers={SESSION_HEADER: sid}).status_code == 200