mcp-warden-cli 2.0.0__tar.gz → 2.2.0__tar.gz

{mcp_warden_cli-2.0.0 → mcp_warden_cli-2.2.0}/.github/workflows/deps-locked.yml

@@ -96,6 +96,49 @@ jobs:
           fi
           echo "requirements-dev.lock is in sync with pyproject.toml."
 
+      # --------------------------------------------------------------------
+      # 2b. Action lockfile-in-sync check (DSE-1538).
+      #    action/requirements.lock is what the published composite action
+      #    installs into CUSTOMER CI (action.yml, --require-hashes). Same
+      #    preferred-baseline regeneration and body diff as step 2, with the
+      #    runtime-only command printed in the lock's own header (no dev extra).
+      # --------------------------------------------------------------------
+      - name: Verify action lockfile is in sync with pyproject.toml
+        run: |
+          cp action/requirements.lock /tmp/action-requirements.regenerated.lock
+          uv pip compile --universal --generate-hashes --python-version 3.11 \
+            pyproject.toml -o /tmp/action-requirements.regenerated.lock
+          if ! diff -u \
+               <(grep -v '^#' action/requirements.lock) \
+               <(grep -v '^#' /tmp/action-requirements.regenerated.lock); then
+            echo "::error::action/requirements.lock is out of sync with pyproject.toml."
+            echo "Regenerate it (see CONTRIBUTING.md) and commit the result:"
+            echo "  uv pip compile --universal --generate-hashes --python-version 3.11 pyproject.toml -o action/requirements.lock"
+            exit 1
+          fi
+          echo "action/requirements.lock is in sync with pyproject.toml."
+
+      # The action lock drifted behind the dev lock once and shipped advisories
+      # the dev lock had already fixed (DSE-1538). Every package both locks pin
+      # must be pinned to the same version, so customers run what CI tested.
+      - name: Verify action lock pins equal dev lock pins
+        shell: python
+        run: |
+          import re, sys
+          def pins(path):
+              out = {}
+              for name, ver in re.findall(r"^([A-Za-z0-9_.-]+)==(\S+)", open(path).read(), re.M):
+                  out.setdefault(re.sub(r"[-_.]+", "-", name).lower(), set()).add(ver)
+              return out
+          dev, action = pins("requirements-dev.lock"), pins("action/requirements.lock")
+          bad = {n: (sorted(dev[n]), sorted(action[n])) for n in action if n in dev and dev[n] != action[n]}
+          if bad:
+              print("::error::action/requirements.lock pins differ from requirements-dev.lock")
+              for n, (d, a) in sorted(bad.items()):
+                  print(f"  {n}: dev={d} action={a}")
+              sys.exit(1)
+          print(f"All {sum(n in dev for n in action)} shared pins in action/requirements.lock equal requirements-dev.lock.")
+
       # --------------------------------------------------------------------
       # 3. The locked closure actually works — import the package + key deps.
       # --------------------------------------------------------------------
@@ -118,3 +161,30 @@ jobs:
 
       - name: CVE audit the locked closure (fail on any advisory)
         run: /tmp/locked/bin/python -m pip_audit --skip-editable
+
+      # --------------------------------------------------------------------
+      # 5. Action lock: hash-verified install + CVE gate (DSE-1538).
+      #    Step 2b's diff keeps existing pins as the baseline, so on its own it
+      #    cannot see a tampered hash or a downgrade that still satisfies
+      #    pyproject.toml. Installing with --require-hashes rejects the former;
+      #    pip-audit over the exact pins rejects a downgrade to a version with a
+      #    known advisory. Same evidence the dev lock gets from steps 1 and 4.
+      # --------------------------------------------------------------------
+      - name: Install action closure with --require-hashes
+        run: |
+          python -m venv /tmp/action-locked
+          /tmp/action-locked/bin/python -m pip install --upgrade pip
+          /tmp/action-locked/bin/python -m pip install --require-hashes -r action/requirements.lock
+
+      # pip-audit evaluates environment markers against THIS runner and silently
+      # skips pins that do not match, so a win32- or PyPy-only pin would never be
+      # audited on ubuntu (proven, CSO review of DSE-1538). The action runs on
+      # Windows and macOS too: audit a copy with every marker stripped.
+      - name: CVE audit the action lock, all platforms (fail on any advisory)
+        run: |
+          sed -E 's/ ; [^\\]*\\$/ \\/' action/requirements.lock > /tmp/action-requirements.unmarked.txt
+          if grep -qE '^[A-Za-z0-9_.-]+==[^ ]+ ;' /tmp/action-requirements.unmarked.txt; then
+            echo "::error::a marker survived stripping; refusing a partial audit"
+            exit 1
+          fi
+          /tmp/locked/bin/python -m pip_audit --disable-pip --require-hashes -r /tmp/action-requirements.unmarked.txt

{mcp_warden_cli-2.0.0 → mcp_warden_cli-2.2.0}/.github/workflows/integrity-gate.yml

@@ -66,6 +66,30 @@ jobs:
       - name: Run property-fuzz suite (deterministic, seed=0)
         run: pytest tests/fuzz -p no:randomly --hypothesis-seed=0
 
+  # --------------------------------------------------------------------------
+  # Handler binding has an intentionally narrow, independently tested interpreter contract.
+  # Other MCP-Warden commands retain the package's broader Python support.
+  # --------------------------------------------------------------------------
+  test-handler-compatibility:
+    name: Handler contract (CPython ${{ matrix.python }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.11", "3.12", "3.13"]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Set up supported CPython
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python }}
+          cache: pip
+      - name: Install measured handler dependencies
+        run: pip install -e ".[dev]"
+      - name: Verify handler binding and enforcement
+        run: pytest -q tests/test_handler_boundary.py tests/test_policy_enforcement.py tests/test_policy_enforcement_v2.py tests/test_adapter_conformance.py
+
   # --------------------------------------------------------------------------
   # Job 1a: mcp 1.x compatibility leg (#105)
   #

{mcp_warden_cli-2.0.0 → mcp_warden_cli-2.2.0}/.github/workflows/release.yml

@@ -1,17 +1,10 @@
 # =============================================================================
 # Release & publish workflow (v1.0 — W1.1 / W1.2 / W2.3)
 #
-# !!! INERT UNTIL CONFIGURED — SAFE TO MERGE !!!
-#
-# This workflow does NOTHING until BOTH of the following are true:
-#   (a) a GitHub *Release* is published (a pushed git tag ALONE does not trigger
-#       it — the trigger is `release: published`, the explicit human gesture), AND
-#   (b) the `mcp-warden-cli` PyPI project + its Trusted Publisher (OIDC) are configured
-#       by the owner (see RELEASING.md "One-time PyPI setup").
-#
-# Until (a) AND (b) hold, merging this file changes nothing at runtime: no tag is
-# cut here, no version is bumped here, nothing is published here. Cutting v1.0.0 is
-# then a single tag + GitHub Release away (the full runbook is in RELEASING.md).
+# A published GitHub Release builds and signs artifacts. Production uploads
+# additionally require the existing PyPI Trusted Publisher and enabled repo gate.
+# A pushed tag alone does not trigger publication. Manual choices are TestPyPI,
+# build-only, or a production authentication-only check that uploads nothing.
 #
 # What it does WHEN a Release is published:
 #   build         — builds sdist + wheel, uploads them as workflow artifacts.
@@ -41,18 +34,23 @@ on:
   release:
     types: [published]
 
-  # Manual escape hatch for a dry run to TestPyPI (no Release required, no signing,
-  # no production PyPI). Nice-to-have; kept deliberately simple.
+  # Manual TestPyPI/build-only paths and an authentication-only production check.
   workflow_dispatch:
     inputs:
       publish-target:
-        description: "Where to publish on a manual run"
+        description: "TestPyPI upload, build-only, or production OIDC verification (no upload)"
         required: true
         default: "testpypi"
         type: choice
         options:
           - testpypi
           - none
+          - verify-pypi
+      publisher-checked:
+        description: "verify-pypi only: inspected existing project publisher and no matching pending publisher in owner account"
+        type: boolean
+        required: true
+        default: false
 
 # Least-privilege at the top level; each job widens scope locally only as needed.
 permissions:
@@ -65,6 +63,7 @@ jobs:
   # --------------------------------------------------------------------------
   build:
     name: Build sdist + wheel
+    if: github.event_name != 'workflow_dispatch' || github.event.inputs.publish-target != 'verify-pypi'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -138,7 +137,7 @@ jobs:
   #
   # On a `release: published` run -> production PyPI.
   # On a manual `workflow_dispatch` with publish-target=testpypi -> TestPyPI only.
-  # publish-target=none short-circuits (build + artifacts only).
+  # publish-target=none builds only; verify-pypi skips the build and upload jobs.
   # --------------------------------------------------------------------------
   pypi-publish:
     name: Publish to PyPI (OIDC Trusted Publishing)
@@ -159,7 +158,7 @@ jobs:
     if: >-
       vars.PYPI_TRUSTED_PUBLISHER == 'true' &&
       (github.event_name == 'release' ||
-       (github.event_name == 'workflow_dispatch' && github.event.inputs.publish-target != 'none'))
+       (github.event_name == 'workflow_dispatch' && github.event.inputs.publish-target == 'testpypi'))
 
     steps:
       - name: Download dist artifacts
@@ -190,6 +189,32 @@ jobs:
           # Re-running a dry run no-ops on an already-uploaded TestPyPI version.
           skip-existing: true
 
+  # Authentication-only production check: no build, upload, signing or stored token.
+  # Uses this SAME workflow identity and no deployment environment, like publication.
+  pypi-verify:
+    name: Verify PyPI OIDC (no upload)
+    if: github.event_name == 'workflow_dispatch' && github.event.inputs.publish-target == 'verify-pypi'
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    env:
+      WARDEN_PYPI_PUBLISHER_CONFIRMED: ${{ github.event.inputs.publisher-checked }}
+    steps:
+      - name: Require reviewed main
+        if: github.ref != 'refs/heads/main'
+        run: |
+          echo '::error::Production verification requires reviewed main.'
+          exit 1
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Set up Python 3.11
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
+      - name: Verify production OIDC exchange without uploading
+        run: python scripts/verify_pypi_oidc.py
+
   # --------------------------------------------------------------------------
   # Job 3: sign the release artifacts with Sigstore keyless ("heal thyself", W2.3).
   #

{mcp_warden_cli-2.0.0 → mcp_warden_cli-2.2.0}/CHANGELOG.md

@@ -30,6 +30,110 @@ Streamable HTTP; the v0.3 `guard` proxy adds deterministic runtime *result* insp
 
 ## [Unreleased]
 
+## [2.2.0] — 2026-10-24
+
+### Community corpus layout (DSE-2143)
+
+- `check --against-community` reads entries from `locks/schema-<N>/<ecosystem>/...`,
+  where `<N>` is the implemented lock schema (4). The schema-3 corpus written by 1.x
+  stays at `locks/<ecosystem>/...` and is no longer read: 2.0.0 and 2.1.0 refused every
+  entry there with `WRD-CONSENSUS-SCHEMA-MISMATCH`; it now reads as NOVEL until a
+  schema-4 entry exists. See `docs/COMMUNITY_CORPUS.md` §4.
+
+## [2.1.0] — 2026-10-23
+
+### Pagination (DSE-1539)
+
+- `pin` and `check` take `--max-pages N` (default 256, `MAX_LIST_PAGES`): a list call
+  whose `nextCursor` chain runs past the cap fails capture with exit 2.
+- Capture now refuses a surface that repeats a tool name, prompt name or resource URI
+  (typically across pages). Each is the entry's identity in the name-keyed drift diff,
+  so a repeat let one entry shadow the other. **Behaviour change:** a server that lists
+  a duplicate now fails `pin`/`check` with exit 2 instead of pinning.
+- SPEC §8.2 states capture completeness and identity uniqueness normatively.
+- `pin`/`check` escape capture errors before printing, so a server-supplied name with
+  console markup (`x[/red]`) cannot crash the CLI into exit 1 or restyle the output.
+
+### Auth audit
+
+- `WRD-AUTH-TOKEN-IN-CONFIG` now catches tokens joined by `-` or `_` inside a path or
+  secret-manager URI (DSE-1540, CSO NF-2). `~/.aws/<uuid-shaped key>` and
+  `pass://a.b/tok_<hex>` were read as file names and reported nothing. A `-`/`_`-joined
+  piece of a segment (including the stem of a dotted name, so `<uuid>.json`) is now a
+  literal when a part is a token-shaped run with a digit, or when its non-word,
+  non-numeric parts switch between letters and digits 3+ times over 20+ characters
+  (16+ if mixed case). The same rule covers URI fragments and `${VAR:?msg}` messages.
+  `gcp-sa-key-prod-2024`, `id_ed25519_github-work`, GCP key files
+  (`<project>-123456-<hex>.json`) and `application_default_credentials` stay names.
+- Reference, locator and placeholder heuristics move from `auth_audit.py` into
+  `auth_refs.py`; the rule above is the only behaviour change.
+
+### Capture integrity
+
+- `pin`/`check` capture is capability-aware and fails closed (DSE-1538). A declared
+  `tools`/`resources`/`prompts` section whose list call errors now exits 2 instead of
+  being pinned as empty; an undeclared section is empty only on JSON-RPC `-32601`.
+- CI regenerates and diffs `action/requirements.lock`, the lock the published action
+  installs, alongside `requirements-dev.lock`, then installs it with `--require-hashes`
+  and runs `pip-audit` over its exact pins with platform markers stripped, so
+  Windows-, macOS- and PyPy-only pins are audited too. The diff alone keeps existing pins
+  as its baseline, so it cannot see a tampered hash or an in-range downgrade. A further
+  step fails when any action-lock pin differs from the dev-lock pin CI tests.
+- Security: the action lock had fallen behind the dev lock and shipped advisories in
+  `mcp` 2.1.1, `starlette` 1.2.1, `cryptography` 48.0.0 and `anyio` 4.13.0. Both locks
+  move to `mcp` 2.2.0, and every action-lock pin now equals the audited dev-lock pin.
+- THREAT_MODEL §5.3.4 documents capture completeness and OS-trust-store TLS for `--url`.
+
+### Signing
+
+- `mcp-warden lock sign <lock> [--coordinate C] [--identity-token T]` signs an existing
+  unsigned lock (DSE-1530), for attesters that capture inside a network-less sandbox and
+  sign afterwards. Same contract as `pin --sign`: v2 statement with `--coordinate`, v1
+  without, exit 1 on signing failure with no partial sidecar. It refuses (exit 2) a lock
+  that fails the integrity gate or carries a stale approval, an invalid coordinate, an
+  existing sidecar (a dangling symlink included), and a lock that already carries a
+  signature pointer, so it never overwrites or stacks a signature. The sidecar is placed
+  with `os.link` before the lock is rewritten, so a run that loses a race to another
+  signer exits 2 and leaves the winner's files untouched (a filesystem without hard
+  links fails closed with exit 1). A symlinked lock is resolved
+  so the sidecar sits beside the file that is verified.
+- `pin --sign` and `lock sign` stage the bundle in a uniquely named `O_EXCL` temp file,
+  so a planted `.sigstore.tmp` symlink is never followed.
+
+### Decision receipt foundation
+
+- Add protocol-neutral V2 enforcement with independently authorized signed decision
+  receipts before allowed effects, strengthening rules and exact finite noncritical
+  overrides. Every negative path attempts evidence; failed allow evidence creates a
+  separately bound deny and never invokes the handler.
+- Add independent primary/fallback logs, protected-state and recovery-latch ports,
+  recovery with administrator approval, verified receipt chains, pure historical replay,
+  separate current eligibility and safe human/agent projections.
+- Add mandatory receipt failure/restart corpus and property fuzzing. Reference
+  providers remain unsupported for real platform rollback resistance; live `guard`
+  integration and whole-kernel conformance remain separate gates.
+- Harden frozen handlers against nested serialized code. Handler identity supports
+  CPython 3.11–3.13 only, with a dedicated CI matrix; other interpreters fail closed
+  at this SDK boundary. Existing artifact-signature domains and V1 defaults remain.
+
+### Artifact trust foundation
+
+- Add opt-in Ed25519 verification for existing policy, runtime, adapter and
+  executable-bundle activation APIs, with an independently pinned public-key
+  configuration and explicit artifact-kind signer roles.
+- Add `trust roots-digest`, `trust prepare` and `trust verify` for enrollment
+  inspection, unsigned canonical review/signing artifacts, and offline signature
+  checks. Human signing stays external; signature validity alone does not permit
+  effects. Durable receipts and live guard integration remain separate work.
+
+### Release engineering
+
+- Add a manual `verify-pypi` production OIDC exchange check in the existing release
+  workflow, without building, signing, uploading or storing credentials. Identity
+  mismatches, redirects, failed exchanges and malformed responses fail closed.
+- Correct release documentation: existing-project publisher setup, non-reserving
+  pending publishers, 2.0.0's manual recovery, and unchanged-artifact failed-job reruns.
+
 ## [2.0.0] — 2026-10-02
 
 ### Breaking compatibility
@@ -467,7 +571,9 @@ v1-strong foundation. Highlights of the 0.3.0 → 1.0.0 arc:
   declared surface, RFC 8785 (JCS) + SHA-256 canonicalization, SARIF output, and a live
   integrity-gate workflow with committed `clean.warden.lock`.
 
-[Unreleased]: https://github.com/DataScience-EngineeringExperts/mcp-warden/compare/v1.1.0...HEAD
+[Unreleased]: https://github.com/DataScience-EngineeringExperts/mcp-warden/compare/v2.2.0...HEAD
+[2.2.0]: https://github.com/DataScience-EngineeringExperts/mcp-warden/compare/v2.1.0...v2.2.0
+[2.1.0]: https://github.com/DataScience-EngineeringExperts/mcp-warden/compare/v2.0.0...v2.1.0
 [1.1.0]: https://github.com/DataScience-EngineeringExperts/mcp-warden/compare/v1.0.1...v1.1.0
 [1.0.1]: https://github.com/DataScience-EngineeringExperts/mcp-warden/compare/v1.0.0...v1.0.1
 [1.0.0]: https://github.com/DataScience-EngineeringExperts/mcp-warden/releases/tag/v1.0.0

{mcp_warden_cli-2.0.0 → mcp_warden_cli-2.2.0}/DOCUMENTATION_INDEX.md

@@ -1,6 +1,6 @@
 # Documentation Index — mcp-warden
 
-Last Updated: 2026-10-02
+Last Updated: 2026-10-22
 
 Master index of every document in this repository. The `docs/` files are the
 **security contract and source of truth** for all algorithms; the three core docs
@@ -12,7 +12,7 @@ describe and visualize the implementation that satisfies that contract.
 
 | # | Doc | Purpose |
 |---|-----|---------|
-| 1 | [`README.md`](README.md) | Project overview, install, the pin/check CI demo (full walkthrough archived to [`docs/PIN_CHECK_DEMO.md`](docs/PIN_CHECK_DEMO.md) to hold the 500-line core-doc limit), CLI reference (incl. v0.3 `lock rotate` + redacted offline `diff` viewer), GitHub Action usage section (Issue #18), **pre-commit hook section (Issue #22)** |
+| 1 | [`README.md`](README.md) | Project overview, install, the pin/check CI demo (full walkthrough archived to [`docs/PIN_CHECK_DEMO.md`](docs/PIN_CHECK_DEMO.md) to hold the 500-line core-doc limit), CLI reference (incl. v0.3 `lock rotate`, DSE-1530 `lock sign`, DSE-1539 `--max-pages` + redacted offline `diff` viewer), GitHub Action usage section (Issue #18), **pre-commit hook section (Issue #22)** |
 | 2 | [`SYSTEM_CONTEXT_DIAGRAM.md`](SYSTEM_CONTEXT_DIAGRAM.md) | System context + pin/check sequence (mermaid); trust boundary; `conclave` as dev-time reviewer only; composite GitHub Action + **pre-commit hook** as consumer delivery vehicles |
 | 3 | [`DOCUMENTATION_INDEX.md`](DOCUMENTATION_INDEX.md) | This file |
 
@@ -47,6 +47,7 @@ is the MCP auth posture sound. Both reuse the `check` exit-code contract (0 clea
 | [`src/mcp_warden/deploy_gate.py`](src/mcp_warden/deploy_gate.py) | `WRD-GATE-*` engine: eval thresholds, guardrail presence, budget, approval receipt |
 | [`src/mcp_warden/cli_deploy_gate.py`](src/mcp_warden/cli_deploy_gate.py) | `deploy-gate` command body (register idiom) |
 | [`src/mcp_warden/auth_audit.py`](src/mcp_warden/auth_audit.py) | `WRD-AUTH-*` static config audit; reuses `checks_secret.scan_field` for vendor patterns (vendor hits are never downgraded); template fill-me-ins are `WRD-AUTH-PLACEHOLDER-SECRET` (low), matched on whole tokens |
+| [`src/mcp_warden/auth_refs.py`](src/mcp_warden/auth_refs.py) | Reference / locator / placeholder heuristics behind `WRD-AUTH-*`: `${VAR}` forms, secret-manager URIs and credential paths, token-shaped segments (incl. `-`/`_`-joined tokens, DSE-1540), placeholder bounds |
 | [`src/mcp_warden/cli_auth.py`](src/mcp_warden/cli_auth.py) | `auth audit` sub-app command body |
 | [`tests/test_deploy_gate.py`](tests/test_deploy_gate.py) | Engine per-control pass/fail + CLI exit codes + fail-closed on malformed evidence |
 | [`tests/test_auth_audit.py`](tests/test_auth_audit.py) | Every rule, the deliberate non-flags (loopback, `${VAR}` refs, stdio), redaction, CLI/JSON/SARIF |
@@ -155,13 +156,15 @@ scope-honesty box and makes no compliance/regulatory claim.
 
 | Doc | Defines |
 |-----|---------|
+| [`docs/ARTIFACT_TRUST.md`](docs/ARTIFACT_TRUST.md) | Opt-in Ed25519 implementation of DSE-716's external artifact verifier: explicit key/kind roles, independently pinned canonical roots, exact version/kind/key-bound signing frame, unsigned review preparation and offline signature verification. No private signing capability, durable receipts, live guard wiring or whole-kernel claim |
 | [`docs/PIN_CHECK_DEMO.md`](docs/PIN_CHECK_DEMO.md) | Full end-to-end pin/check walkthrough, archived out of `README.md` on 2026-08-24 to hold the 500-line core-doc limit |
 | [`docs/SPEC.md`](docs/SPEC.md) | **MCP Lock Format v1** — the vendor-neutral, self-contained format specification any tool can implement: on-disk `warden.lock` schema, RFC 8785 (JCS) canonicalization, SHA-256 `sha256:<hex>` hashing, `overall_digest` construction, the normative drift class + severity table, the optional per-tool inspection block, and a Conformance section (§12.1: passing `vectors/` **is** conformance) + worked example. `WARDEN_LOCK_SCHEMA.md` is the mcp-warden implementation of this format |
 | [`docs/THREAT_MODEL.md`](docs/THREAT_MODEL.md) | **(v0.1)** Positioning, trust model (TOFU + `--approve`), assets/actors, the four threat classes (MCP-DRIFT / MCP-CAPSURF / MCP-SECRET / MCP-SUPPLY), explicit out-of-scope limits, deliberate cuts |
 | [`docs/THREAT_MODEL_V2.md`](docs/THREAT_MODEL_V2.md) | **(v0.2)** Addendum extending the v0.1 model: T-RESULT vectors, the defends (BLOCK) / monitors (fuzzy) / still-does-NOT-defend (T-BEHAVE) table, runtime trust-model notes, retained + added cuts, shadow-default positioning |
-| [`docs/AGENT_TRUST_KERNEL.md`](docs/AGENT_TRUST_KERNEL.md) | **(DSE-714, design contract)** Normative invariants for the future deterministic Agent Trust Kernel: trust boundaries, complete mediation, default deny, non-overridable critical classes, evidence-before-effect, offline operation, residual risks, and bindings for DSE-715 through DSE-717. MCP-Warden v1.1 is explicitly not yet ATK-conformant |
+| [`docs/AGENT_TRUST_KERNEL.md`](docs/AGENT_TRUST_KERNEL.md) | **(DSE-714, design contract)** Normative invariants for the future deterministic Agent Trust Kernel: trust boundaries, complete mediation, default deny, non-overridable critical classes, evidence-before-effect, offline operation, residual risks, and bindings for DSE-715 through DSE-717. MCP-Warden 2.1.0 is explicitly not yet ATK-conformant |
 | [`docs/CONTENT_ENVELOPE.md`](docs/CONTENT_ENVELOPE.md) | **(DSE-715, implemented foundation)** Strict immutable V1 content envelope, domain-separated exact-byte digests, canonical metadata boundary, bounded one-hop lineage, monotonic taint, stable code-only errors, and secret-safe public projection. Evidence only; no authority or whole-ATK conformance claim |
-| [`docs/POLICY_ENFORCEMENT.md`](docs/POLICY_ENFORCEMENT.md) | **(DSE-716, implemented foundation)** Versioned signed policy/runtime/adapter/executable-bundle activation, exact adapter/bundle-bound leases, mechanically derived frozen handler identity, deterministic default-deny PDP, evidence-gated structural PEP, stable reason/recovery matrix, caps, and non-optional fixed-corpus adapter harness. DSE-717 durable evidence is in progress but remains required for any whole-ATK claim |
+| [`docs/POLICY_ENFORCEMENT.md`](docs/POLICY_ENFORCEMENT.md) | **(DSE-716, implemented foundation)** Versioned signed policy/runtime/adapter/executable-bundle activation, exact adapter/bundle-bound leases, mechanically derived frozen handler identity, deterministic default-deny PDP, evidence-gated structural PEP, stable reason/recovery matrix, caps, and non-optional fixed-corpus adapter harness. Separate DSE-717 V2 evidence foundation; real protected-platform and live-guard gates remain pending |
+| [`docs/DECISION_RECEIPTS.md`](docs/DECISION_RECEIPTS.md) | **(DSE-717, development foundation)** Independently authorized signed receipts, strict strengthening rules and finite noncritical overrides; separate primary/fallback logs, protected-state/latch ports, authenticated recovery, pure historical replay, current eligibility, safe projections and nonoptional reference conformance. Reference providers cannot establish platform rollback resistance; first published in 2.1.0 |
 | [`docs/WARDEN_LOCK_SCHEMA.md`](docs/WARDEN_LOCK_SCHEMA.md) | **mcp-warden implementation of [`docs/SPEC.md`](docs/SPEC.md) (MCP Lock Format v1).** `warden.lock` format, RFC 8785 canonicalization + SHA-256 hashing, field/entry/overall digests, the normative drift definition + severities; **§5.1/§6.2 structural schema diff** (normalized per-tool `schema_skeleton`, `schema_version` 4 — annotations/output added at v4, skeleton added at v2, in-document `$ref` resolution at v3 (#29), granular `WRD-DRIFT-SCHEMA-*` taxonomy + severities, v1 fallback); **§8.1/§8.2 (v0.3, #19)** structured out-of-digest provenance (`pinner` / `attestations` / `rotation_count`, `PROVENANCE_VERSION`, B4 `bound_digest` format) + `lock rotate` digest-invariant semantics + the #16 signing implication; **§11 (v0.2)** optional per-tool inspection policy (`expected_output_charset` / `may_return_urls` / `secret_echo_applies`, fail-safe defaults, digest impact) |
 | [`docs/WARDEN_LOCK_EXAMPLE.md`](docs/WARDEN_LOCK_EXAMPLE.md) | Illustrative full `warden.lock` + a post-`lock rotate` `pin` block (archived from WARDEN_LOCK_SCHEMA §9 to keep that core doc under the line cap) |
 | [`docs/CHECKS.md`](docs/CHECKS.md) | The deterministic `WRD-*` static-check catalog (capability/secret/supply/robustness), the shared tokenizer, severity→SARIF mapping, redaction rule, CUT list. **Reused by v0.2** `WRD-RES-SECRET-ECHO` (the `WRD-SEC-*` patterns + redaction) |
@@ -169,7 +172,7 @@ scope-honesty box and makes no compliance/regulatory claim.
 | [`docs/RESULT_INSPECTION.md`](docs/RESULT_INSPECTION.md) | **(v0.2)** The `WRD-RES-*` result-inspection catalog: deterministic/fuzzy tier partition, per-rule exact match definitions (ANSI allowlist, secret-echo via `WRD-SEC-*`, exfil seed denylist, injection seed phrase list), severities, SARIF mapping, redaction, fail-safe per-tool precision. Run identically by `guard` and `inspect` |
 | [`docs/GUARD_PROXY.md`](docs/GUARD_PROXY.md) | **(v0.2 base, updated to v0.3 defaults)** The `guard` transparent stdio proxy + `inspect` offline analyzer contract: frame-handling discipline, single-loop framing (Content-Length + newline), incremental scan, subprocess lifecycle, runtime arg-policy + `tools/list_changed` gate, the **v0.3 default-block posture** + `--no-block-*` opt-outs + `--audit-only`, reserved codes `-32001`/`-32002`, and the exact on-the-wire "block" behavior |
 | [`docs/GUARD_PROXY_V3.md`](docs/GUARD_PROXY_V3.md) | **(v0.3)** The proxy-hardening contract: `notifications/cancelled`/`progress` untouched passthrough (§1), subprocess-lifecycle edge cases — server-crash `-32002` synthesis, client-disconnect process-group teardown, truncated/oversized-frame fail-open (§2), Windows experimental degradation (§3), the full v0.3 block-flag scheme + precedence (§4), and **(#21) `--strict` fail-CLOSED mode — terminate on an inspection-layer error, `-32003` non-retriable, exit `3` (§5)** |
-| [`docs/SIGNING.md`](docs/SIGNING.md) | **(v0.3, #16)** Sigstore keyless signing + verification of `warden.lock`: the optional `[sigstore]` extra, the deterministic `mcp-warden-lock-digest/v1` statement that binds ONLY `overall_digest` (survives `lock rotate`), `pin --sign` / `check --verify` usage, the **fixed-sidecar** verify contract (pointer field never trusted), the full fail-closed matrix, the TUF-cache/offline caveat, and the two accepted trade-offs (rotate-replay + committed-fixture coverage gap + refresh steps) |
+| [`docs/SIGNING.md`](docs/SIGNING.md) | **(v0.3, #16)** Sigstore keyless signing + verification of `warden.lock`: the optional `[sigstore]` extra, the deterministic `mcp-warden-lock-digest/v1` statement that binds ONLY `overall_digest` (survives `lock rotate`), `pin --sign` / **`lock sign` (DSE-1530, exclusive placement, no overwrite/stacking)** / `check --verify` usage, the **fixed-sidecar** verify contract (pointer field never trusted), the full fail-closed matrix, the TUF-cache/offline caveat, and the two accepted trade-offs (rotate-replay + committed-fixture coverage gap + refresh steps) |
 
 ## Non-normative design and implementation plans
 
@@ -177,6 +180,12 @@ scope-honesty box and makes no compliance/regulatory claim.
 
 | Plan | Purpose |
 |---|---|
+| [`docs/plans/2026-10-04-dse717-reconciliation.md`](docs/plans/2026-10-04-dse717-reconciliation.md) | Recovered-branch provenance, integration ownership, failure-path validation and exact-head security/external-review gates |
+| [`docs/plans/2026-07-19-decision-receipts-design.md`](docs/plans/2026-07-19-decision-receipts-design.md) | Original DSE-717 receipt, deterministic rule, evidence, recovery and replay design |
+| [`docs/plans/2026-07-19-decision-receipts-implementation.md`](docs/plans/2026-07-19-decision-receipts-implementation.md) | Original strict-TDD execution plan and independently reviewed release gates |
+| [`docs/archive/2026-10-04-readme-community-consensus.md`](docs/archive/2026-10-04-readme-community-consensus.md) | Preserved advanced README community-consensus walkthrough: pinned attesters/corpus revision, verdict exit codes and required-consensus withholding protection |
+| [`docs/plans/2026-10-04-dse717-council-fixes.md`](docs/plans/2026-10-04-dse717-council-fixes.md) | Council remediation: quarantine preservation, complete V2 floor presence, independently pinned historical signer/root rotation, regression evidence and bounded projection/conformance documentation |
+| [`docs/plans/2026-10-03-checkpoint-artifact-trust.md`](docs/plans/2026-10-03-checkpoint-artifact-trust.md) | First human-checkpoint development wave: opt-in signature verification and unsigned review tooling, with unpublished DSE-717 work preserved and live DSE-1076 integration still dependent on it |
 | [`docs/plans/2026-07-18-agent-trust-kernel-design.md`](docs/plans/2026-07-18-agent-trust-kernel-design.md) | **Non-normative execution record.** Records the DSE-714 design decision and verification plan; binding requirements live in `docs/AGENT_TRUST_KERNEL.md` |
 | [`docs/plans/2026-07-18-content-envelope-design.md`](docs/plans/2026-07-18-content-envelope-design.md) | **Non-normative DSE-715 execution record.** Records the reviewed strict-TDD plan; verified behavior is documented in `docs/CONTENT_ENVELOPE.md` |
 | [`docs/plans/2026-07-19-pdp-pep-design.md`](docs/plans/2026-07-19-pdp-pep-design.md) | **Non-normative DSE-716 execution record.** Records the activated-snapshot, structural-PEP, TDD, and review plan; verified behavior is documented in `docs/POLICY_ENFORCEMENT.md` |
@@ -201,23 +210,35 @@ scope-honesty box and makes no compliance/regulatory claim.
 
 | Doc | Purpose |
 |-----|---------|
-| [`RELEASING.md`](RELEASING.md) | Operator runbook: one-time PyPI Trusted-Publisher (OIDC) setup, cut-a-release checklist, post-release verification, rollback/yank. PyPI dist name is `mcp-warden-cli`; CLI/repo stay `mcp-warden`. |
-| [`CHANGELOG.md`](CHANGELOG.md) | Keep-a-Changelog history through CLI 2.0.0 / schema level 4 with explicit in/out-of-scope. |
-| [`.github/workflows/release.yml`](.github/workflows/release.yml) | Publish-on-Release workflow: build Python distributions + tested TypeScript 0.2.0 tarball → publish Python to PyPI via OIDC Trusted Publishing (no stored token, **gated on repo var `PYPI_TRUSTED_PUBLISHER=true`** + `skip-existing`, #64) → Sigstore-keyless sign Python, TypeScript, and checksums and attach bundles to the Release. Live: `mcp-warden-cli` Trusted Publisher configured + the gate variable set. |
+| [`RELEASING.md`](RELEASING.md) | Operator runbook: existing-project PyPI publisher settings, authentication-only verification, release delivery, post-release checks, failed-job recovery and rollback/yank. PyPI dist name is `mcp-warden-cli`; CLI/repo stay `mcp-warden`. |
+| [`CHANGELOG.md`](CHANGELOG.md) | Keep-a-Changelog history through CLI 2.1.0 (schema level 4) with explicit in/out-of-scope. |
+| [`.github/workflows/release.yml`](.github/workflows/release.yml) | Publish-on-Release: build Python + tested TypeScript tarball; upload only Python through OIDC (repo gate + `skip-existing`); Sigstore-sign artifacts/checksums. Manual `verify-pypi` exchanges credentials without build/upload/signing. The gate variable alone does not prove publisher alignment. |
+| [`scripts/verify_pypi_oidc.py`](scripts/verify_pypi_oidc.py) | Standard-library OIDC probe: reviewed-main binding, owner inspection acknowledgment, bounded HTTPS, no redirects/token logs/storage/uploads. PyPI minting can mutate pending records; exchange does not prove project upload permission. |
+| [`docs/plans/2026-10-02-pypi-automation-repair.md`](docs/plans/2026-10-02-pypi-automation-repair.md) | Bounded automation repair and session wrap plan, including the authenticated PyPI browser boundary. |
 | [`requirements-dev.lock`](requirements-dev.lock) · [`.github/workflows/deps-locked.yml`](.github/workflows/deps-locked.yml) | **(#59)** Hash-pinned dev/CI dependency lock + the "Hash-locked dev/CI install" check (verifies `--require-hashes` install + that the lock stays in sync with `pyproject.toml` without floating to latest, #65). Dependency-update policy lives in [`SECURITY.md`](SECURITY.md). |
 
 ---
 
 ## Source layout
 
+`src/mcp_warden/artifact_payload.py`, `artifact_trust.py`, and `cli_trust.py` implement
+the strict existing-artifact decoder, opt-in public-key verifier, and unsigned
+review/signature CLI. Tests are `tests/test_artifact_trust.py`,
+`test_cli_trust.py`, and `test_artifact_trust_integration.py`.
+
 | Module | Responsibility | Spec anchor |
 |--------|----------------|-------------|
+| `receipt_models.py` · `decision_receipts.py` · `signer_authorization.py` · `receipt_kernel.py` | **(DSE-717)** Closed canonical receipts and independently activated, role-bound governance signatures; no product private-key loader | DECISION_RECEIPTS.md authority/events |
+| `rule_models.py` · `rule_engine.py` · `decision_governor.py` · `governed_decision.py` | **(DSE-717)** Strengthening-only rules, exact finite noncritical overrides and canonical effective decisions | DECISION_RECEIPTS.md rules |
+| `evidence_state.py` · `evidence_latch.py` · `evidence_reference.py` · `receipt_log.py` · `evidence_models.py` · `evidence_coordinator.py` · `evidence_recovery.py` | **(DSE-717)** Independent primary/fallback evidence, compare-and-advance protected-state ports and latch-clear-last recovery; reference protection unsupported | DECISION_RECEIPTS.md evidence/recovery |
+| `policy_enforcement_v2.py` · `enforcement_result_v2.py` · `receipt_conformance.py` · `receipt_conformance_models.py` | **(DSE-717)** Evidence on every path, failed-allow deny conversion, pre-sink revalidation and mandatory eleven-scenario/five-fixed-case reference corpus | DECISION_RECEIPTS.md evidence/conformance |
+| `receipt_verification.py` · `receipt_replay.py` · `receipt_projection.py` | **(DSE-717)** Canonical signature/chain verification with retained root-activated historical authority/verifier pins, strict separate live-floor checks, effect-free historical replay, current eligibility and primary-only human explanations | DECISION_RECEIPTS.md verification/replay |
 | `src/mcp_warden/hashing.py` | `canon()` (RFC 8785) + `hash()` + field hashes | WARDEN_LOCK_SCHEMA §3 |
 | `src/mcp_warden/content_models.py` · `content_envelope.py` | **(DSE-715)** Strict immutable evidence models; typed domain-separated byte hashing call surface; canonical constructors/parser; bounded derivation and one-hop lineage; explicit secret-safe projection | CONTENT_ENVELOPE.md / AGENT_TRUST_KERNEL ATK-01/02/05/06/09/12 |
 | `src/mcp_warden/decision_models.py` · `policy_decision.py` | **(DSE-716)** Strict V1 decision models; signed policy/runtime activation; exact lease/request binding; deterministic default-deny PDP; canonical digest-only decisions and stable recovery codes | POLICY_ENFORCEMENT.md / AGENT_TRUST_KERNEL ATK-03/05/06/07/08/09 |
 | `src/mcp_warden/policy_enforcement.py` · `handler_identity.py` · `executable_bundle.py` · `adapter_conformance.py` | **(DSE-716)** Signed adapter and executable-bundle closure; exact manifest-bound leases; closure-free mechanically code/dependency-derived frozen handlers; canonical effect binding; evidence-gated PEP; PEP-owned execution trace and multiple output-channel scans; mandatory versioned malformed-input corpus | POLICY_ENFORCEMENT.md / AGENT_TRUST_KERNEL ATK-03/04/06/08 |
 | `src/mcp_warden/tokenizer.py` | Shared tokenizer + capability derivation (single source of truth) | CHECKS §3 / WARDEN_LOCK_SCHEMA §5.4 |
-| `src/mcp_warden/capture.py` | Declared-surface capture over stdio (argv array, no shell) or Streamable HTTP (`--url`); shared list normalization, timeouts, and errors | THREAT_MODEL §3.3 / WARDEN_LOCK_SCHEMA §4.1 |
+| `src/mcp_warden/capture.py` | Declared-surface capture over stdio (argv array, no shell) or Streamable HTTP (`--url`) through one `_capture_session`; capability-aware, fail-closed list calls (DSE-1538); `--max-pages` cursor cap (default `MAX_LIST_PAGES` 256) and duplicate tool-name / resource-URI / prompt-name rejection (DSE-1539); timeouts and errors | THREAT_MODEL §3.3 / WARDEN_LOCK_SCHEMA §4.1 |
 | `src/mcp_warden/models.py` | Pydantic models for captured surface + lock (incl. `Pinner`/`Attestation` provenance) | WARDEN_LOCK_SCHEMA §2–§8 |
 | `src/mcp_warden/lockfile.py` | Lock builder + reader/writer + overall digest | WARDEN_LOCK_SCHEMA §5–§6, §9 |
 | `src/mcp_warden/check_core.py` | **(#22)** Shared check verdict core (`run_check` / `run_check_full`): read_lock→capture→checks→build_lock(in-memory)→compute_drift. Single source of truth for `cli.py:check` AND the pre-commit wrapper | WARDEN_LOCK_SCHEMA §6.2 |
@@ -248,13 +269,16 @@ scope-honesty box and makes no compliance/regulatory claim.
 | `src/mcp_warden/wire_block.py` | **(v0.2/v0.3)** on-wire block synthesis: `-32001` error-response + redacted-content (`_meta.warden.modified`); **v0.3** `-32002` `transport_error`; **(#21)** `-32003` `strict_abort_error` (non-retriable) | GUARD_PROXY §7 · V3 §2.6, §5 |
 | `src/mcp_warden/inspector.py` | **(v0.2)** offline JSONL analyzer over recorded sessions (same catalog) | GUARD_PROXY §3 |
 | `src/mcp_warden/emit_res.py` | **(v0.2)** SARIF 2.1.0 + JSONL emitters for `ResultFinding` (action/direction/tier) | GUARD_PROXY §10 |
-| `src/mcp_warden/cli.py` · `cli_guard.py` · `cli_lock.py` · `cli_diff.py` | `typer` CLI (`pin`/`check`/`policy`/`guard`/`inspect`/`lock rotate`/`diff`), exit codes; **`check` delegates its verdict to `check_core.run_check_full` (#22)**; `guard`/`inspect` bodies in `cli_guard`, `lock rotate` + integrity gate in `cli_lock`, **(v0.3) `diff` redacted offline lock viewer (`SAFE_PROVENANCE_FIELDS` allowlist, never reads `server.command`/`args`)** in `cli_diff` | all |
+| `src/mcp_warden/cli.py` · `cli_guard.py` · `cli_lock.py` · `cli_diff.py` | `typer` CLI (`pin`/`check`/`policy`/`guard`/`inspect`/`lock rotate`/`lock sign`/`diff`), exit codes; **`check` delegates its verdict to `check_core.run_check_full` (#22)**; `guard`/`inspect` bodies in `cli_guard`, `lock rotate` + `lock sign` (DSE-1530) + shared integrity / stale-approval gate in `cli_lock`, **(v0.3) `diff` redacted offline lock viewer (`SAFE_PROVENANCE_FIELDS` allowlist, never reads `server.command`/`args`)** in `cli_diff` | all |
 | `src/mcp_warden/precommit.py` | **(#22)** `mcp-warden-precommit` pre-commit entry point — wraps `check_core.run_check`; check-only (never imports `pin`/lock-writer, never opens the lock for write) | README pre-commit section |
 
 ## Tests
 
 | File | Covers |
 |------|--------|
+| `tests/test_dse717_council_fixes.py` | **(DSE-717)** Critical/rule quarantine preservation after rejected overrides, closed governor errors, every mandatory V2 floor omission, conditional override/legacy compatibility, retired live signer rejection and root/key rotation followed by append/reopen/chain verification |
+| `tests/test_receipt_conformance.py` · `test_dse717_review_regressions.py` · `test_policy_enforcement_v2.py` · `test_handler_boundary.py` | **(DSE-717)** Mandatory failure/restart corpus, actual evidence/projection scans, negative sink absence, distinct failed-allow conversion, closed hostile inputs and supported interpreter/serialized-code boundaries |
+| `tests/test_decision_receipts.py` · `test_receipt_hardening.py` · `test_rule_engine.py` · `test_evidence_coordinator.py` · `test_evidence_recovery.py` · `test_receipt_verification.py` · `test_receipt_replay.py` · `test_receipt_projection.py` | **(DSE-717)** Canonical signing/authority isolation, strict rules/finite overrides, independent log/state/latch failures, authenticated recovery, chain verification, effect-free replay and closed projections |
 | `tests/test_hashing.py` | JCS+SHA-256 reproducibility, canonical-form pins, null handling |
 | `tests/test_content_envelope.py` | **(DSE-715)** Strict/frozen models, typed digest domains, nine ingress kinds, canonical/cap boundary, deterministic lineage, parser rejection matrix, atomic digest verification, and planted-secret output/error/log scans |
 | `tests/test_policy_decision.py` · `test_policy_enforcement.py` · `test_adapter_conformance.py` | **(DSE-716)** Exact policy/runtime/adapter/bundle activation, deterministic decisions, every subject/effect/lease/manifest binding, trusted-time/rollback/revocation matrix, critical floor, hostile nested construction, callable drift resistance, evidence/sink ordering, fixed-corpus enforcement, cap boundaries, and deterministic reports |
@@ -277,7 +301,7 @@ scope-honesty box and makes no compliance/regulatory claim.
 | `tests/test_guard_v3.py` | **(v0.3)** opt-out demotes to shadow (`--no-block-*`/`--allow-exfil-domain`/`--no-block-deterministic`), `tools/list_changed` gate block+shadow, policy deny block+shadow, audit-only override, cancel/progress passthrough, **server-crash → `-32002` for every pending id**, client-disconnect child reap (no orphan), truncated + oversized frame fail-open |
 | `tests/test_guard_strict.py` | **(#21)** `--strict` fail-CLOSED: 4 terminate sites (request-policy / result-inspect / list-gate / nested-hash re-raise) → exit `3` + one `strict_abort` stderr line + `-32003` client frame + child reaped; negatives (truncated/over-cap/unparseable/clean) do NOT abort; default `--no-strict` byte-identical fail-open regression; secret-leak redaction; CLI threading; double-emission single line; `StrictInspectionAbort` is `BaseException`-not-`Exception` + anyio `ExceptionGroup` unwrap |
 | `tests/test_inspect_parity.py` | **(v0.2)** guard↔inspect finding parity on the same recorded frames + inspect exit codes |
-| `tests/fuzz/` (`test_fuzz_framing.py` · `test_fuzz_ansi.py` · `test_fuzz_domain.py` · `test_fuzz_redact.py` · `test_fuzz_content_envelope.py` · `test_fuzz_policy_decision.py`) | **(#17 / DSE-715 / DSE-716)** `hypothesis` property-fuzzing of the live runtime attack surface, content envelopes, identity substitution, arbitrary effect bytes, explicit trusted-time boundaries, deterministic decisions, and planted-secret absence. `ci`/`fuzz` profiles in `tests/fuzz/conftest.py`; deep soak via `make fuzz` |
+| `tests/fuzz/` (`test_fuzz_framing.py` · `test_fuzz_ansi.py` · `test_fuzz_domain.py` · `test_fuzz_redact.py` · `test_fuzz_content_envelope.py` · `test_fuzz_policy_decision.py` · `test_fuzz_receipts.py`) | **(#17 / DSE-715 / DSE-716)** `hypothesis` property-fuzzing of the live runtime attack surface, content envelopes, identity substitution, arbitrary effect bytes, explicit trusted-time boundaries, deterministic decisions, and planted-secret absence. `ci`/`fuzz` profiles in `tests/fuzz/conftest.py`; deep soak via `make fuzz` |
 | `tests/fixtures/clean_server.py` · `mutated_server.py` | Real MCP SDK stdio fixtures |
 | `tests/fixtures/poison_server.py` | **(v0.2)** result-poisoning fixture server (ANSI/secret-echo/exfil/inject/clean tools) |
 | `tests/fixtures/crash_server.py` · `listchange_server.py` · `clean_listchange.warden.lock` | **(v0.3)** raw-stdio lifecycle fixtures: crash-mid-call (`-32002`) and `tools/list_changed` rug-pull + its pinned clean lock |