orc-seal 0.1.0__tar.gz

orc_seal-0.1.0/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

orc_seal-0.1.0/PKG-INFO

@@ -0,0 +1,58 @@
+Metadata-Version: 2.4
+Name: orc-seal
+Version: 0.1.0
+Summary: Outcome Receipts (ORC v0.1) for any MCP server: every tool result gets a receipt a stranger can verify.
+Author: Viridis LLC
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://github.com/jdhart81/viridis-agent-fleet
+Project-URL: Spec, https://github.com/jdhart81/viridis-agent-fleet/blob/main/docs/standards/OUTCOME_RECEIPT_v0.1.md
+Project-URL: Issues, https://github.com/jdhart81/viridis-agent-fleet/issues
+Keywords: mcp,agents,receipts,verification,erc-8004,x402
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# orc-seal
+
+**Every MCP tool result gets a receipt a stranger can verify.** Put `orc-seal` in front of any MCP server, in any language, with no code changes. Each successful `tools/call` result carries an [Outcome Receipt (ORC v0.1)](https://github.com/jdhart81/viridis-agent-fleet/blob/main/docs/standards/OUTCOME_RECEIPT_v0.1.md) under `result._meta["com.viridisconservation/orc"]`.
+
+Identity standards say who an agent is. Payment rails say what was paid. A receipt says **what was actually delivered**, and anyone can check it.
+
+## Use it (one line)
+In your MCP client config, prefix the server command:
+```json
+{ "command": "orc-seal",
+  "args": ["--issuer", "did:web:yourdomain.com", "--", "npx", "-y", "@you/your-mcp-server"] }
+```
+Install: `pip install orc-seal` (stdlib only, Python ≥ 3.10).
+
+## Levels
+| Level | What it proves | How you get it |
+|---|---|---|
+| **INTACT** (L1) | The result was not altered after sealing | Default. Nothing leaves your machine. |
+| **ISSUED** (L2) | A public registry recorded this exact seal, with a timestamp | Set `ORC_SEAL_API_KEY`. Free tier: 1,000 receipts/month. |
+
+The registry only ever sees the commitment, digest, salt, profile and tool name. **Your outputs and tool arguments never leave the process.** Arguments are not in the receipt either; only their SHA-256 is.
+
+## Verify
+- In a browser: open the receipt's `verify.page` link (runs locally in the page).
+- CLI: `orc-seal verify receipt.json`
+- Python: `from orc_seal import verify`
+
+## Python decorator (optional)
+```python
+from orc_seal import Sealer, sealed
+s = Sealer({"id": "did:web:yourdomain.com"})
+@sealed(s)
+def quote(kwh: int) -> dict: ...
+quote(1000)  # -> {"result": {...}, "orc": {...receipt...}}
+```
+
+## Guarantees (tested)
+M1 result never changed · M2 every receipt verifies · M3 arguments and outputs never sent · M4 registry failures fail open · M5 deterministic float handling · M6 errors are not sealed · M7 oversized results pass through unsealed · P1 non-tool traffic is byte-identical.
+
+## Get a registry key
+Email hartjustin6@gmail.com with your issuer id. Design partners get the free tier and help shape ORC v0.2.
+
+Apache-2.0 · Viridis LLC

orc_seal-0.1.0/README.md

@@ -0,0 +1,43 @@
+# orc-seal
+
+**Every MCP tool result gets a receipt a stranger can verify.** Put `orc-seal` in front of any MCP server, in any language, with no code changes. Each successful `tools/call` result carries an [Outcome Receipt (ORC v0.1)](https://github.com/jdhart81/viridis-agent-fleet/blob/main/docs/standards/OUTCOME_RECEIPT_v0.1.md) under `result._meta["com.viridisconservation/orc"]`.
+
+Identity standards say who an agent is. Payment rails say what was paid. A receipt says **what was actually delivered**, and anyone can check it.
+
+## Use it (one line)
+In your MCP client config, prefix the server command:
+```json
+{ "command": "orc-seal",
+  "args": ["--issuer", "did:web:yourdomain.com", "--", "npx", "-y", "@you/your-mcp-server"] }
+```
+Install: `pip install orc-seal` (stdlib only, Python ≥ 3.10).
+
+## Levels
+| Level | What it proves | How you get it |
+|---|---|---|
+| **INTACT** (L1) | The result was not altered after sealing | Default. Nothing leaves your machine. |
+| **ISSUED** (L2) | A public registry recorded this exact seal, with a timestamp | Set `ORC_SEAL_API_KEY`. Free tier: 1,000 receipts/month. |
+
+The registry only ever sees the commitment, digest, salt, profile and tool name. **Your outputs and tool arguments never leave the process.** Arguments are not in the receipt either; only their SHA-256 is.
+
+## Verify
+- In a browser: open the receipt's `verify.page` link (runs locally in the page).
+- CLI: `orc-seal verify receipt.json`
+- Python: `from orc_seal import verify`
+
+## Python decorator (optional)
+```python
+from orc_seal import Sealer, sealed
+s = Sealer({"id": "did:web:yourdomain.com"})
+@sealed(s)
+def quote(kwh: int) -> dict: ...
+quote(1000)  # -> {"result": {...}, "orc": {...receipt...}}
+```
+
+## Guarantees (tested)
+M1 result never changed · M2 every receipt verifies · M3 arguments and outputs never sent · M4 registry failures fail open · M5 deterministic float handling · M6 errors are not sealed · M7 oversized results pass through unsealed · P1 non-tool traffic is byte-identical.
+
+## Get a registry key
+Email hartjustin6@gmail.com with your issuer id. Design partners get the free tier and help shape ORC v0.2.
+
+Apache-2.0 · Viridis LLC

orc_seal-0.1.0/orc_seal/__init__.py

@@ -0,0 +1,5 @@
+"""orc-seal: Outcome Receipts (ORC v0.1) for any MCP server. Apache-2.0."""
+from .sealer import (META_KEY, RegistryClient, Sealer, normalize, sealed,  # noqa: F401
+                     verify)
+
+__version__ = "0.1.0"

orc_seal-0.1.0/orc_seal/__main__.py

@@ -0,0 +1,82 @@
+"""CLI.
+
+  orc-seal --issuer did:web:example.com [--name "Example"] [--agent my-server]
+           [--registry https://mcp.viridisconservation.com] -- <server command...>
+  orc-seal verify receipt.json
+
+Registration (L2 ISSUED) is enabled when ORC_SEAL_API_KEY is set.
+Without a key, receipts are self-sealed (L1 INTACT) and nothing leaves the machine.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+import urllib.request
+
+from .proxy import run
+from .sealer import DEFAULT_REGISTRY, RegistryClient, Sealer, verify
+
+
+def _lookup(url: str):
+    try:
+        with urllib.request.urlopen(url, timeout=5) as r:
+            return json.loads(r.read().decode())
+    except Exception:
+        return None
+
+
+def main(argv=None) -> int:
+    argv = list(sys.argv[1:] if argv is None else argv)
+    if argv[:1] == ["verify"]:
+        if len(argv) != 2:
+            print("usage: orc-seal verify receipt.json", file=sys.stderr)
+            return 2
+        with open(argv[1]) as f:
+            receipt = json.load(f)
+        out = verify(receipt, registry_lookup=_lookup)
+        print(json.dumps({"level": out["level"], "label": out["label"],
+                          "reasons": out["reasons"]}, indent=2))
+        return 0 if out["level"] >= 1 else 1
+    p = argparse.ArgumentParser(prog="orc-seal")
+    p.add_argument("--issuer", required=True, help="issuer id, e.g. did:web:example.com")
+    p.add_argument("--name", default="")
+    p.add_argument("--agent", default="")
+    p.add_argument("--registry", default=os.environ.get("ORC_SEAL_REGISTRY", DEFAULT_REGISTRY))
+    if "--" not in argv:
+        p.parse_args(argv)  # --help exits successfully before requiring a server.
+        p.error("missing server command after --")
+    i = argv.index("--")
+    opts, cmd = argv[:i], argv[i + 1:]
+    a = p.parse_args(opts)
+    if not cmd:
+        p.error("missing server command after --")
+    key = os.environ.get("ORC_SEAL_API_KEY", "")
+    registry = RegistryClient(a.registry, key) if key else None
+    sealer = Sealer({"id": a.issuer, "name": a.name or a.issuer}, agent=a.agent or cmd[0],
+                    registry=registry, verify_base=a.registry)
+    return run(cmd, sealer)
+
+
+def _exit(code: int) -> None:
+    """P4: exit with the server's code without waiting on the stdin pump.
+
+    The client->server pump is a daemon thread blocked in stdin.readline();
+    normal interpreter shutdown can then die with "could not acquire lock for
+    <stdin>". Flush what we wrote, then leave immediately.
+    """
+    try:
+        sys.stdout.flush()
+        sys.stderr.flush()
+    finally:
+        os._exit(code if isinstance(code, int) else 1)
+
+
+def cli() -> None:
+    """Console entry point with the same safe shutdown as python -m."""
+    _exit(main())
+
+
+if __name__ == "__main__":
+    cli()

orc_seal-0.1.0/orc_seal/orc.py

@@ -0,0 +1,189 @@
+"""Outcome Receipt (ORC) v0.1 — reference implementation. Stdlib only.
+
+An ORC is a portable, verifiable record that an agent produced a specific
+output. It is rail-neutral: it can bind to an x402 settlement, a Stripe
+charge, an AP2 mandate, or an ERC-8004 validation response, but it never
+depends on any of them. Spec: docs/standards/OUTCOME_RECEIPT_v0.1.md
+
+Verification levels (each implies the ones before it):
+  L1 INTACT     digest recomputes from `output`, and the commitment binds it
+  L2 ISSUED     the issuer proves it sealed this commitment (registry record
+                or Ed25519 signature; checked by a caller-supplied resolver)
+  L3 SETTLED    a payment binding is confirmed by its own rail (resolver)
+  L4 VALIDATED  an independent validator attested the same commitment
+
+--- INVARIANTS ---
+R1  canonical() is byte-identical to the fleet engines' canonical form:
+    json.dumps(sort_keys=True, separators=(",", ":"), ensure_ascii=True).
+R2  seal() never mutates its input; the same output + excludes always give
+    the same digest (salt only changes the commitment).
+R3  verify() never raises; malformed input yields level 0 with reasons.
+R4  L1 requires BOTH digest recomputation and commitment recomputation.
+R5  Levels above L1 are granted only by an explicit resolver returning True;
+    absent resolvers leave the level capped and say why (no silent upgrade).
+R6  Floats are rejected in `output` at seal time (money and quantities must be
+    integers or decimal strings), so any language can reproduce the digest.
+R7  from_cliff_check() maps a Signed Cliff Check receipt losslessly: the ORC
+    digest equals the engine's audit_sha256 and the commitment is unchanged.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import secrets
+from copy import deepcopy
+from datetime import datetime, timezone
+from typing import Any, Callable, Optional
+
+ORC_VERSION = "0.1"
+CANON_ID = "orc-canon/1"
+COMMIT_SCHEME = "sha256(salt||digest)"
+Resolver = Callable[[dict], bool]
+
+
+def canonical(value: Any) -> str:                                        # R1
+    return json.dumps(value, sort_keys=True, separators=(",", ":"),
+                      ensure_ascii=True)
+
+
+def sha256_hex(s: str) -> str:
+    return hashlib.sha256(s.encode()).hexdigest()
+
+
+def _has_float(v: Any) -> bool:
+    if isinstance(v, float):
+        return True
+    if isinstance(v, dict):
+        return any(_has_float(x) for x in v.values())
+    if isinstance(v, (list, tuple)):
+        return any(_has_float(x) for x in v)
+    return False
+
+
+def _is_hex64(s: Any) -> bool:
+    return isinstance(s, str) and len(s) == 64 and all(c in "0123456789abcdef" for c in s)
+
+
+def digest_of(output: dict, excludes: list[str]) -> str:
+    content = {k: v for k, v in output.items() if k not in set(excludes)}
+    return sha256_hex(canonical(content))
+
+
+def seal(output: dict, *, issuer: dict, subject: dict, profile: str = "generic",
+         excludes: Optional[list[str]] = None, bindings: Optional[dict] = None,
+         salt: Optional[str] = None, issued_at: Optional[str] = None) -> dict:
+    """Build an ORC receipt. Pure function except for the random salt."""
+    if not isinstance(output, dict):
+        raise ValueError("output must be a JSON object")
+    if _has_float(output):                                               # R6
+        raise ValueError("floats are not allowed in output; use integers or decimal strings")
+    excludes = list(excludes or [])
+    out = deepcopy(output)                                               # R2
+    d = digest_of(out, excludes)
+    salt = salt or secrets.token_hex(32)
+    return {
+        "orc": ORC_VERSION, "profile": profile,
+        "issuer": deepcopy(issuer), "subject": deepcopy(subject),
+        "output": out,
+        "digest": {"alg": "sha256", "canonicalization": CANON_ID,
+                   "excludes": excludes, "value": d},
+        "commitment": {"scheme": COMMIT_SCHEME, "salt": salt,
+                       "value": sha256_hex(salt + d)},
+        "bindings": deepcopy(bindings or {}),
+        "issued_at": issued_at or datetime.now(timezone.utc).isoformat(),
+    }
+
+
+def verify(receipt: Any, *, issuer_resolver: Optional[Resolver] = None,
+           payment_resolver: Optional[Resolver] = None,
+           validation_resolver: Optional[Resolver] = None) -> dict:
+    """Return {level, checks, reasons}. Never raises (R3)."""
+    reasons: list[str] = []
+    checks = {"digest_recomputes": False, "commitment_binds": False,
+              "issuer_proven": None, "payment_settled": None, "validated": None}
+
+    def done(level: int) -> dict:
+        return {"level": level, "label": ["NONE", "INTACT", "ISSUED", "SETTLED",
+                                          "VALIDATED"][level],
+                "checks": checks, "reasons": reasons}
+    try:
+        if not isinstance(receipt, dict) or receipt.get("orc") != ORC_VERSION:
+            reasons.append("not an ORC v0.1 receipt"); return done(0)
+        dg, cm, out = receipt.get("digest", {}), receipt.get("commitment", {}), receipt.get("output")
+        if dg.get("canonicalization") != CANON_ID or dg.get("alg") != "sha256":
+            reasons.append("unsupported digest algorithm or canonicalization"); return done(0)
+        if cm.get("scheme") != COMMIT_SCHEME or not _is_hex64(cm.get("salt")):
+            reasons.append("unsupported commitment scheme or bad salt"); return done(0)
+        if not isinstance(out, dict):
+            reasons.append("output must be an object"); return done(0)
+        excl = dg.get("excludes", [])
+        if not isinstance(excl, list) or not all(isinstance(x, str) for x in excl):
+            reasons.append("digest.excludes must be a list of strings"); return done(0)
+        computed = digest_of(out, excl)
+        checks["digest_recomputes"] = computed == dg.get("value")
+        checks["commitment_binds"] = sha256_hex(cm["salt"] + str(dg.get("value"))) == cm.get("value")
+        if not (checks["digest_recomputes"] and checks["commitment_binds"]):     # R4
+            if not checks["digest_recomputes"]:
+                reasons.append("output was altered: digest does not recompute")
+            if not checks["commitment_binds"]:
+                reasons.append("commitment does not bind the digest")
+            return done(0)
+        level = 1
+        for key, res, need in (("issuer_proven", issuer_resolver, "issuer"),
+                               ("payment_settled", payment_resolver, "payment"),
+                               ("validated", validation_resolver, "validation")):  # R5
+            if res is None:
+                reasons.append(f"no {need} resolver supplied; level capped at {level}")
+                return done(level)
+            ok = bool(res(receipt))
+            checks[key] = ok
+            if not ok:
+                reasons.append(f"{need} check failed; level capped at {level}")
+                return done(level)
+            level += 1
+        return done(level)
+    except Exception as exc:  # R3: never raise
+        reasons.append(f"malformed receipt: {type(exc).__name__}")
+        return done(0)
+
+
+CLIFF_EXCLUDES = ["audit_sha256", "notary_payload"]
+
+
+def from_cliff_check(cc: dict) -> dict:                                  # R7
+    """Map a Signed Cliff Check receipt (v0.1/v0.2) to ORC v0.1, losslessly."""
+    res, sig = cc["result"], cc["signature"]
+    orc = {
+        "orc": ORC_VERSION, "profile": "viridis.cliff-check/" + cc["credit"],
+        "issuer": {"id": "did:web:viridisconservation.com", "name": "Viridis LLC"},
+        "subject": {"agent": "taxcredit-engine", "tool": "calculate_tax_credit",
+                    "product": cc.get("product"), "product_version": cc.get("product_version"),
+                    "client": cc.get("client"), "project": cc.get("project")},
+        "output": deepcopy(res),
+        "digest": {"alg": "sha256", "canonicalization": CANON_ID,
+                   "excludes": list(CLIFF_EXCLUDES), "value": res["audit_sha256"]},
+        "commitment": {"scheme": COMMIT_SCHEME, "salt": sig["salt"],
+                       "value": sig["commit_hash"]},
+        "bindings": {},
+        "issued_at": cc.get("generated_at"),
+    }
+    if cc.get("verify", {}).get("page"):
+        orc["verify"] = {"page": cc["verify"]["page"]}
+    return orc
+
+
+def erc8004_validation_response(receipt: dict, *, request_hash: str,
+                                response_uri: str, passed: bool) -> dict:
+    """Unsigned ERC-8004 Validation-Registry response fields for an ORC.
+
+    Maps: responseHash = commitment.value, responseURI = where the ORC is
+    published, response = 100 (pass) or 0 (fail), tag = "orc/0.1".
+    The caller's own signer submits it; this function never touches a chain.
+    """
+    if not _is_hex64(request_hash):
+        raise ValueError("request_hash must be 64 lowercase hex chars")
+    return {"requestHash": "0x" + request_hash,
+            "response": 100 if passed else 0,
+            "responseURI": response_uri,
+            "responseHash": "0x" + receipt["commitment"]["value"],
+            "tag": "orc/" + ORC_VERSION}

orc_seal-0.1.0/orc_seal/proxy.py

@@ -0,0 +1,94 @@
+"""Stdio proxy: put orc-seal in front of ANY MCP server, in any language.
+
+    orc-seal --issuer did:web:example.com -- npx -y @acme/some-mcp-server
+
+The client talks to orc-seal exactly as it talked to the server. Every
+message passes through unchanged (P1), except successful `tools/call`
+responses, which gain a receipt under result._meta (sealer M1/M6).
+
+--- INVARIANTS ---
+P1  Transparency: lines that are not JSON objects, requests, notifications,
+    and responses to anything other than tools/call are forwarded byte-for-byte.
+P2  Ordering: server->client lines are written in the order received.
+P3  The proxy never originates JSON-RPC messages of its own.
+P4  Exit: when the server exits, the proxy exits with the server's code.
+"""
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+import threading
+from typing import IO, Optional
+
+from .sealer import Sealer
+
+
+class Tracker:
+    """Remembers tools/call requests by id until their response arrives."""
+
+    def __init__(self):
+        self._lock = threading.Lock()
+        self._pending: dict = {}
+
+    def note_client_line(self, line: bytes) -> None:
+        try:
+            msg = json.loads(line)
+        except Exception:
+            return
+        if isinstance(msg, dict) and msg.get("method") == "tools/call" and "id" in msg:
+            with self._lock:
+                self._pending[json.dumps(msg["id"])] = msg
+
+    def take(self, msg_id) -> Optional[dict]:
+        with self._lock:
+            return self._pending.pop(json.dumps(msg_id), None)
+
+
+def transform_server_line(line: bytes, tracker: Tracker, sealer: Sealer) -> bytes:
+    try:
+        msg = json.loads(line)
+    except Exception:
+        return line                                                       # P1
+    if not isinstance(msg, dict) or "id" not in msg or "method" in msg:
+        return line                                                       # P1
+    req = tracker.take(msg["id"])
+    if req is None:
+        return line                                                       # P1
+    out = sealer.seal_tools_call(req, msg)
+    if out is msg:
+        return line
+    nl = b"\r\n" if line.endswith(b"\r\n") else b"\n"
+    return json.dumps(out, separators=(",", ":")).encode() + nl
+
+
+def pump_client(src: IO[bytes], dst: IO[bytes], tracker: Tracker) -> None:
+    for line in iter(src.readline, b""):
+        tracker.note_client_line(line)
+        try:
+            dst.write(line)
+            dst.flush()
+        except (BrokenPipeError, ValueError):
+            break
+    try:
+        dst.close()
+    except Exception:
+        pass
+
+
+def pump_server(src: IO[bytes], dst: IO[bytes], tracker: Tracker, sealer: Sealer) -> None:
+    for line in iter(src.readline, b""):                                  # P2
+        dst.write(transform_server_line(line, tracker, sealer))
+        dst.flush()
+
+
+def run(cmd: list[str], sealer: Sealer, stdin: IO[bytes] = None,
+        stdout: IO[bytes] = None) -> int:
+    stdin = stdin or sys.stdin.buffer
+    stdout = stdout or sys.stdout.buffer
+    child = subprocess.Popen(cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE)
+    tracker = Tracker()
+    t_in = threading.Thread(target=pump_client, args=(stdin, child.stdin, tracker), daemon=True)
+    t_in.start()
+    pump_server(child.stdout, stdout, tracker, sealer)
+    return child.wait()                                                   # P4

orc_seal-0.1.0/orc_seal/sealer.py

@@ -0,0 +1,217 @@
+"""orc-seal: attach an Outcome Receipt (ORC v0.1) to every MCP tool result.
+
+Any MCP server becomes a receipt issuer without code changes. Each successful
+`tools/call` result gets a receipt under
+`result._meta["com.viridisconservation/orc"]`; a stranger can check it at L1
+(INTACT) offline, and at L2 (ISSUED) when the seal was registered.
+
+--- INVARIANTS ---
+M1  Result preservation: sealing never changes the tool's result. It only adds
+    one key under `_meta` (JSON-RPC mode) or wraps it in an envelope that the
+    caller explicitly opted into (decorator mode).
+M2  Every receipt produced here verifies at L1 with the reference verifier.
+M3  Privacy: tool arguments never appear in a receipt (only `args_sha256`),
+    and the registry client sends only commitment, digest, salt, profile,
+    subject and issuer. The output and the arguments never leave the process.
+M4  Fail-open: a registry, network or sealing failure never fails or blocks
+    the tool call beyond the registry timeout. `issuer_proof` is attached only
+    after a 2xx reply that echoes the same commitment and digest.
+M5  Deterministic normalization: floats become shortest round-trip decimal
+    strings, non-finite floats become "NaN"/"Infinity"/"-Infinity", tuples
+    become lists, bytes become {"bytes_sha256": ...}, non-string keys become
+    strings. normalize(normalize(x)) == normalize(x).
+M6  Only successful results are sealed: JSON-RPC errors and results with
+    isError=true pass through unchanged. Receipts are for delivered outcomes.
+M7  Oversized results (canonical output > MAX_OUTPUT_BYTES) are not sealed;
+    the result passes through with `_meta[...] = {"skipped": "too_large"}`.
+"""
+from __future__ import annotations
+
+import functools
+import hashlib
+import inspect
+import json
+import math
+import urllib.error
+import urllib.request
+from copy import deepcopy
+from typing import Any, Callable, Optional
+
+from . import orc
+
+META_KEY = "com.viridisconservation/orc"
+MAX_OUTPUT_BYTES = 262_144
+DEFAULT_REGISTRY = "https://mcp.viridisconservation.com"
+
+
+def normalize(value: Any) -> Any:                                        # M5
+    if isinstance(value, bool) or value is None or isinstance(value, (int, str)):
+        return value
+    if isinstance(value, float):
+        if math.isnan(value):
+            return "NaN"
+        if math.isinf(value):
+            return "Infinity" if value > 0 else "-Infinity"
+        return repr(value)
+    if isinstance(value, dict):
+        return {str(k): normalize(v) for k, v in value.items()}
+    if isinstance(value, (list, tuple)):
+        return [normalize(v) for v in value]
+    if isinstance(value, (bytes, bytearray)):
+        return {"bytes_sha256": hashlib.sha256(bytes(value)).hexdigest()}
+    return str(value)
+
+
+def args_digest(args: Any) -> str:
+    return orc.sha256_hex(orc.canonical(normalize(args if args is not None else {})))
+
+
+class RegistryClient:
+    """POST {base}/orc/v0/register. Sends no output and no arguments (M3)."""
+
+    def __init__(self, base_url: str = DEFAULT_REGISTRY, api_key: str = "",
+                 timeout: float = 3.0,
+                 opener: Optional[Callable[..., Any]] = None):
+        self.base = base_url.rstrip("/")
+        self.api_key = api_key
+        self.timeout = timeout
+        self._open = opener or urllib.request.urlopen
+        self.last_error: Optional[str] = None
+
+    @staticmethod
+    def payload(receipt: dict) -> dict:
+        return {"commitment": receipt["commitment"]["value"],
+                "salt": receipt["commitment"]["salt"],
+                "digest": receipt["digest"]["value"],
+                "profile": receipt["profile"],
+                "issuer": receipt["issuer"],
+                "subject": {"agent": str(receipt["subject"].get("agent", "")),
+                            "tool": str(receipt["subject"].get("tool", ""))},
+                "issued_at": receipt["issued_at"]}
+
+    def register(self, receipt: dict) -> Optional[dict]:
+        """Return issuer_proof on success, else None (never raises; M4)."""
+        self.last_error = None
+        try:
+            body = json.dumps(self.payload(receipt)).encode()
+            req = urllib.request.Request(
+                self.base + "/orc/v0/register", data=body, method="POST",
+                headers={"content-type": "application/json",
+                         "authorization": "Bearer " + self.api_key,
+                         "user-agent": "orc-seal/0.1"})
+            with self._open(req, timeout=self.timeout) as resp:
+                status = getattr(resp, "status", 200)
+                data = json.loads(resp.read().decode() or "{}")
+            if not (200 <= status < 300):
+                self.last_error = f"http {status}"
+                return None
+            if (data.get("commitment") != receipt["commitment"]["value"]
+                    or data.get("digest") != receipt["digest"]["value"]):
+                self.last_error = "registry echo mismatch"
+                return None
+            proof = data.get("issuer_proof") or {}
+            if proof.get("method") != "registry" or not str(proof.get("url", "")).startswith("http"):
+                self.last_error = "registry returned no proof url"
+                return None
+            return {"method": "registry", "url": proof["url"]}
+        except urllib.error.HTTPError as exc:
+            self.last_error = f"http {exc.code}"
+        except Exception as exc:  # network, JSON, anything: fail open
+            self.last_error = type(exc).__name__
+        return None
+
+
+class Sealer:
+    def __init__(self, issuer: dict, *, agent: str = "",
+                 registry: Optional[RegistryClient] = None,
+                 profile: str = "generic", verify_base: Optional[str] = None):
+        if not isinstance(issuer, dict) or not issuer.get("id"):
+            raise ValueError("issuer must be a dict with an 'id' (e.g. did:web:example.com)")
+        self.issuer = {"id": str(issuer["id"]), "name": str(issuer.get("name", issuer["id"]))}
+        self.agent = agent
+        self.registry = registry
+        self.profile = profile
+        self.verify_base = (verify_base or (registry.base if registry else DEFAULT_REGISTRY)).rstrip("/")
+
+    def seal(self, tool: str, args: Any, result: Any,
+             bindings: Optional[dict] = None) -> Optional[dict]:
+        """Return a receipt, or None if the result is too large (M7)."""
+        output = {"tool": str(tool), "args_sha256": args_digest(args),
+                  "result": normalize(result)}
+        if len(orc.canonical(output)) > MAX_OUTPUT_BYTES:
+            return None
+        receipt = orc.seal(output, issuer=self.issuer,
+                           subject={"agent": self.agent, "tool": str(tool)},
+                           profile=self.profile, bindings=bindings)
+        c = receipt["commitment"]["value"]
+        receipt["verify"] = {"page": f"{self.verify_base}/verify?c={c}"}
+        if self.registry is not None:
+            proof = self.registry.register(receipt)
+            if proof:
+                receipt["issuer_proof"] = proof
+        return receipt
+
+    # -- JSON-RPC (MCP wire) mode -------------------------------------------
+    def seal_tools_call(self, request: dict, response: dict) -> dict:
+        """Return `response` with a receipt in result._meta (M1, M6, M7)."""
+        try:
+            if request.get("method") != "tools/call" or "result" not in response:
+                return response
+            result = response["result"]
+            if not isinstance(result, dict) or result.get("isError"):
+                return response
+            params = request.get("params") or {}
+            sealed_part = {k: v for k, v in result.items() if k != "_meta"}
+            receipt = self.seal(params.get("name", ""), params.get("arguments"), sealed_part)
+            out = dict(response)
+            new_result = dict(result)
+            meta = dict(result.get("_meta") or {})
+            meta[META_KEY] = receipt if receipt is not None else {"skipped": "too_large"}
+            new_result["_meta"] = meta
+            out["result"] = new_result
+            return out
+        except Exception:
+            return response                                               # M4
+
+
+def sealed(sealer: Sealer, tool: Optional[str] = None, key: str = "orc"):
+    """Decorator for plain Python tools: returns {"result": r, key: receipt}.
+
+    Opt-in envelope (M1). Works for sync and async functions.
+    """
+    def wrap(fn):
+        name = tool or fn.__name__
+
+        def envelope(result, args):
+            try:
+                receipt = sealer.seal(name, args, result)
+            except Exception:
+                receipt = None
+            return {"result": result, key: receipt}
+
+        if inspect.iscoroutinefunction(fn):
+            @functools.wraps(fn)
+            async def aw(*a, **kw):
+                r = await fn(*a, **kw)
+                return envelope(r, {"args": list(a), "kwargs": kw})
+            return aw
+
+        @functools.wraps(fn)
+        def w(*a, **kw):
+            r = fn(*a, **kw)
+            return envelope(r, {"args": list(a), "kwargs": kw})
+        return w
+    return wrap
+
+
+def verify(receipt: dict, *, registry_lookup: Optional[Callable[[str], Optional[dict]]] = None) -> dict:
+    """L1 always; L2 if `registry_lookup(url) -> record` confirms the seal."""
+    def issuer_ok(r: dict) -> bool:
+        proof = r.get("issuer_proof") or {}
+        if proof.get("method") != "registry" or registry_lookup is None:
+            return False
+        rec = registry_lookup(proof.get("url", "")) or {}
+        return (rec.get("commitment") == r["commitment"]["value"]
+                and rec.get("digest") == r["digest"]["value"])
+    has_proof = bool(receipt.get("issuer_proof")) and registry_lookup is not None
+    return orc.verify(deepcopy(receipt), issuer_resolver=issuer_ok if has_proof else None)

orc_seal-0.1.0/orc_seal.egg-info/PKG-INFO

@@ -0,0 +1,58 @@
+Metadata-Version: 2.4
+Name: orc-seal
+Version: 0.1.0
+Summary: Outcome Receipts (ORC v0.1) for any MCP server: every tool result gets a receipt a stranger can verify.
+Author: Viridis LLC
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://github.com/jdhart81/viridis-agent-fleet
+Project-URL: Spec, https://github.com/jdhart81/viridis-agent-fleet/blob/main/docs/standards/OUTCOME_RECEIPT_v0.1.md
+Project-URL: Issues, https://github.com/jdhart81/viridis-agent-fleet/issues
+Keywords: mcp,agents,receipts,verification,erc-8004,x402
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# orc-seal
+
+**Every MCP tool result gets a receipt a stranger can verify.** Put `orc-seal` in front of any MCP server, in any language, with no code changes. Each successful `tools/call` result carries an [Outcome Receipt (ORC v0.1)](https://github.com/jdhart81/viridis-agent-fleet/blob/main/docs/standards/OUTCOME_RECEIPT_v0.1.md) under `result._meta["com.viridisconservation/orc"]`.
+
+Identity standards say who an agent is. Payment rails say what was paid. A receipt says **what was actually delivered**, and anyone can check it.
+
+## Use it (one line)
+In your MCP client config, prefix the server command:
+```json
+{ "command": "orc-seal",
+  "args": ["--issuer", "did:web:yourdomain.com", "--", "npx", "-y", "@you/your-mcp-server"] }
+```
+Install: `pip install orc-seal` (stdlib only, Python ≥ 3.10).
+
+## Levels
+| Level | What it proves | How you get it |
+|---|---|---|
+| **INTACT** (L1) | The result was not altered after sealing | Default. Nothing leaves your machine. |
+| **ISSUED** (L2) | A public registry recorded this exact seal, with a timestamp | Set `ORC_SEAL_API_KEY`. Free tier: 1,000 receipts/month. |
+
+The registry only ever sees the commitment, digest, salt, profile and tool name. **Your outputs and tool arguments never leave the process.** Arguments are not in the receipt either; only their SHA-256 is.
+
+## Verify
+- In a browser: open the receipt's `verify.page` link (runs locally in the page).
+- CLI: `orc-seal verify receipt.json`
+- Python: `from orc_seal import verify`
+
+## Python decorator (optional)
+```python
+from orc_seal import Sealer, sealed
+s = Sealer({"id": "did:web:yourdomain.com"})
+@sealed(s)
+def quote(kwh: int) -> dict: ...
+quote(1000)  # -> {"result": {...}, "orc": {...receipt...}}
+```
+
+## Guarantees (tested)
+M1 result never changed · M2 every receipt verifies · M3 arguments and outputs never sent · M4 registry failures fail open · M5 deterministic float handling · M6 errors are not sealed · M7 oversized results pass through unsealed · P1 non-tool traffic is byte-identical.
+
+## Get a registry key
+Email hartjustin6@gmail.com with your issuer id. Design partners get the free tier and help shape ORC v0.2.
+
+Apache-2.0 · Viridis LLC

orc_seal-0.1.0/orc_seal.egg-info/SOURCES.txt

@@ -0,0 +1,14 @@
+LICENSE
+README.md
+pyproject.toml
+orc_seal/__init__.py
+orc_seal/__main__.py
+orc_seal/orc.py
+orc_seal/proxy.py
+orc_seal/sealer.py
+orc_seal.egg-info/PKG-INFO
+orc_seal.egg-info/SOURCES.txt
+orc_seal.egg-info/dependency_links.txt
+orc_seal.egg-info/entry_points.txt
+orc_seal.egg-info/top_level.txt
+tests/test_orc_seal.py

orc_seal-0.1.0/orc_seal.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

orc_seal-0.1.0/orc_seal.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+orc-seal = orc_seal.__main__:cli

orc_seal-0.1.0/orc_seal.egg-info/top_level.txt

@@ -0,0 +1 @@
+orc_seal

orc_seal-0.1.0/pyproject.toml

@@ -0,0 +1,27 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "orc-seal"
+version = "0.1.0"
+description = "Outcome Receipts (ORC v0.1) for any MCP server: every tool result gets a receipt a stranger can verify."
+readme = "README.md"
+license = "Apache-2.0"
+license-files = ["LICENSE"]
+requires-python = ">=3.10"
+authors = [{ name = "Viridis LLC" }]
+keywords = ["mcp", "agents", "receipts", "verification", "erc-8004", "x402"]
+dependencies = []
+
+[project.urls]
+Homepage = "https://github.com/jdhart81/viridis-agent-fleet"
+Spec = "https://github.com/jdhart81/viridis-agent-fleet/blob/main/docs/standards/OUTCOME_RECEIPT_v0.1.md"
+
+Issues = "https://github.com/jdhart81/viridis-agent-fleet/issues"
+
+[project.scripts]
+orc-seal = "orc_seal.__main__:cli"
+
+[tool.setuptools]
+packages = ["orc_seal"]

orc_seal-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

orc_seal-0.1.0/tests/test_orc_seal.py

@@ -0,0 +1,286 @@
+"""M1-M7 (sealer) and P1-P4 (stdio proxy) for orc-seal."""
+import asyncio
+import io
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+HERE = Path(__file__).resolve().parent
+PKG = HERE.parent
+ROOT = PKG.parents[1]
+sys.path.insert(0, str(PKG))
+from orc_seal import META_KEY, RegistryClient, Sealer, normalize, sealed, verify  # noqa: E402
+from orc_seal import orc as vendored  # noqa: E402
+from orc_seal.proxy import Tracker, transform_server_line  # noqa: E402
+
+ISSUER = {"id": "did:web:example.com", "name": "Example"}
+REQ = {"jsonrpc": "2.0", "id": 7, "method": "tools/call",
+       "params": {"name": "double", "arguments": {"x": 21, "secret": "hunter2"}}}
+RESP = {"jsonrpc": "2.0", "id": 7,
+        "result": {"content": [{"type": "text", "text": "42"}],
+                   "structuredContent": {"value": 42, "ratio": 0.1},
+                   "_meta": {"other": 1}}}
+
+
+class FakeResp:
+    def __init__(self, status, body):
+        self.status, self.body = status, body
+    def read(self): return self.body
+    def __enter__(self): return self
+    def __exit__(self, *a): return False
+
+
+def opener_echo(captured):
+    def op(req, timeout):
+        body = json.loads(req.data)
+        captured.append({"body": body, "headers": dict(req.header_items()), "timeout": timeout})
+        return FakeResp(200, json.dumps({
+            "commitment": body["commitment"], "digest": body["digest"],
+            "issuer_proof": {"method": "registry",
+                             "url": "https://reg.test/orc/v0/commitments/" + body["commitment"]}}).encode())
+    return op
+
+
+def test_vendored_orc_is_byte_identical_to_reference():
+    assert (PKG / "orc_seal" / "orc.py").read_bytes() == (ROOT / "fleet_utils" / "orc.py").read_bytes()
+
+
+def test_m1_m6_result_preserved_and_only_meta_added():
+    s = Sealer(ISSUER, agent="demo")
+    out = s.seal_tools_call(REQ, json.loads(json.dumps(RESP)))
+    assert {k: v for k, v in out["result"].items() if k != "_meta"} == \
+        {k: v for k, v in RESP["result"].items() if k != "_meta"}
+    assert out["result"]["_meta"]["other"] == 1
+    assert set(out["result"]["_meta"]) == {"other", META_KEY}
+    assert RESP["result"]["_meta"] == {"other": 1}          # input not mutated
+
+
+def test_m2_receipt_verifies_intact_and_tamper_fails():
+    s = Sealer(ISSUER, agent="demo")
+    r = s.seal_tools_call(REQ, RESP)["result"]["_meta"][META_KEY]
+    assert verify(r)["label"] == "INTACT"
+    bad = json.loads(json.dumps(r)); bad["output"]["result"]["structuredContent"]["value"] = 43
+    assert verify(bad)["level"] == 0
+    assert r["verify"]["page"].endswith("/verify?c=" + r["commitment"]["value"])
+
+
+def test_m3_args_never_in_receipt_nor_registry_payload():
+    cap = []
+    s = Sealer(ISSUER, registry=RegistryClient("https://reg.test", "k", opener=opener_echo(cap)))
+    r = s.seal_tools_call(REQ, RESP)["result"]["_meta"][META_KEY]
+    assert "hunter2" not in json.dumps(r)
+    sent = json.dumps(cap[0]["body"])
+    assert "hunter2" not in sent and "42" not in sent.replace(r["commitment"]["value"], "").replace(r["digest"]["value"], "").replace(r["commitment"]["salt"], "")
+    assert set(cap[0]["body"]) == {"commitment", "salt", "digest", "profile", "issuer", "subject", "issued_at"}
+    assert cap[0]["headers"]["Authorization"] == "Bearer k"
+
+
+def test_m4_registry_success_adds_proof_and_l2():
+    cap = []
+    s = Sealer(ISSUER, registry=RegistryClient("https://reg.test", "k", opener=opener_echo(cap)))
+    r = s.seal("double", {"x": 1}, {"v": 2})
+    assert r["issuer_proof"]["url"].endswith(r["commitment"]["value"])
+    rec = {"commitment": r["commitment"]["value"], "digest": r["digest"]["value"]}
+    assert verify(r, registry_lookup=lambda u: rec)["label"] == "ISSUED"
+    assert verify(r, registry_lookup=lambda u: {**rec, "digest": "0" * 64})["label"] == "INTACT"
+
+
+@pytest.mark.parametrize("opener", [
+    lambda req, timeout: (_ for _ in ()).throw(OSError("down")),
+    lambda req, timeout: FakeResp(500, b"{}"),
+    lambda req, timeout: FakeResp(200, b"not json"),
+    lambda req, timeout: FakeResp(200, json.dumps({"commitment": "0" * 64, "digest": "0" * 64,
+                                                   "issuer_proof": {"method": "registry", "url": "https://x"}}).encode()),
+])
+def test_m4_registry_failures_fail_open_to_intact(opener):
+    reg = RegistryClient("https://reg.test", "k", opener=opener)
+    s = Sealer(ISSUER, registry=reg)
+    out = s.seal_tools_call(REQ, RESP)
+    r = out["result"]["_meta"][META_KEY]
+    assert "issuer_proof" not in r and verify(r)["label"] == "INTACT"
+    assert reg.last_error
+
+
+def test_m5_normalization_deterministic_and_idempotent():
+    x = {1: (0.1, float("nan"), float("inf"), -float("inf"), b"ab"), "k": [True, None, 3]}
+    n = normalize(x)
+    assert n == {"1": ["0.1", "NaN", "Infinity", "-Infinity",
+                       {"bytes_sha256": "fb8e20fc2e4c3f248c60c39bd652f3c1347298bb977b8b4d5903b85055620603"}],
+                 "k": [True, None, 3]}
+    assert normalize(n) == n
+    s = Sealer(ISSUER)
+    a, b = s.seal("t", {"x": 0.1}, {"y": 1.5}), s.seal("t", {"x": 0.1}, {"y": 1.5})
+    assert a["digest"]["value"] == b["digest"]["value"]
+
+
+def test_m6_errors_and_iserror_pass_through():
+    s = Sealer(ISSUER)
+    err = {"jsonrpc": "2.0", "id": 7, "error": {"code": -1, "message": "x"}}
+    assert s.seal_tools_call(REQ, err) is err
+    ie = {"jsonrpc": "2.0", "id": 7, "result": {"content": [], "isError": True}}
+    assert s.seal_tools_call(REQ, ie) is ie
+    other = {"jsonrpc": "2.0", "id": 1, "result": {"tools": []}}
+    assert s.seal_tools_call({"method": "tools/list", "id": 1}, other) is other
+
+
+def test_m7_oversized_not_sealed():
+    s = Sealer(ISSUER)
+    big = {"jsonrpc": "2.0", "id": 7, "result": {"content": [{"type": "text", "text": "a" * 300_000}]}}
+    out = s.seal_tools_call(REQ, big)
+    assert out["result"]["_meta"][META_KEY] == {"skipped": "too_large"}
+    assert out["result"]["content"] == big["result"]["content"]
+
+
+def test_decorator_sync_and_async():
+    s = Sealer(ISSUER)
+
+    @sealed(s)
+    def add(a, b): return a + b
+
+    @sealed(s, tool="mul")
+    async def mul(a, b): return a * b
+
+    r1 = add(2, 3)
+    assert r1["result"] == 5 and verify(r1["orc"])["level"] == 1
+    r2 = asyncio.run(mul(2, 3))
+    assert r2["result"] == 6 and r2["orc"]["subject"]["tool"] == "mul"
+
+
+def test_issuer_required():
+    with pytest.raises(ValueError):
+        Sealer({"name": "no id"})
+
+
+# ---- proxy -----------------------------------------------------------------
+def test_p1_non_tool_lines_byte_identical():
+    s, t = Sealer(ISSUER), Tracker()
+    for line in [b"garbage\n", b'{"jsonrpc":"2.0","method":"notifications/x"}\n',
+                 b'{"jsonrpc":"2.0","id":9,"result":{"a":1.50}}\n', b"[1,2]\n"]:
+        assert transform_server_line(line, t, s) == line
+
+
+def test_p_end_to_end_subprocess_proxy():
+    cmd = [sys.executable, "-m", "orc_seal", "--issuer", "did:web:example.com", "--",
+           sys.executable, str(HERE / "fake_server.py")]
+    msgs = [{"jsonrpc": "2.0", "id": 1, "method": "initialize", "params": {}},
+            {"jsonrpc": "2.0", "method": "notifications/initialized"},
+            {"jsonrpc": "2.0", "id": "a", "method": "tools/call", "params": {"name": "double", "arguments": {"x": 4}}},
+            {"jsonrpc": "2.0", "id": 3, "method": "tools/call", "params": {"name": "fail"}},
+            {"jsonrpc": "2.0", "id": 4, "method": "tools/call", "params": {"name": "iserror"}}]
+    stdin = "".join(json.dumps(m) + "\n" for m in msgs).encode()
+    p = subprocess.run(cmd, input=stdin, capture_output=True, cwd=PKG, timeout=30,
+                       env={"PATH": "/usr/bin:/bin", "PYTHONPATH": str(PKG)})
+    assert p.returncode == 0, p.stderr
+    lines = [json.loads(x) for x in p.stdout.decode().splitlines()]
+    assert [m["id"] for m in lines] == [1, "a", 3, 4]                     # P2
+    assert lines[0]["result"] == {"echo": "initialize"}
+    r = lines[1]["result"]
+    assert r["content"][0]["text"] == "8" and r["structuredContent"]["ratio"] == 0.1
+    assert verify(r["_meta"][META_KEY])["label"] == "INTACT"
+    assert "error" in lines[2] and "_meta" not in lines[3]["result"]
+
+
+def test_p_real_mcp_sdk_server_through_proxy(tmp_path):
+    # The fleet (and production gateway) pins mcp 1.x. mcp 2.x renamed FastMCP
+    # to MCPServer; skip rather than fail if a 2.x SDK is installed here.
+    pytest.importorskip("mcp.server.fastmcp", reason="needs the mcp 1.x SDK (FastMCP)")
+    server = tmp_path / "srv.py"
+    server.write_text(
+        "from mcp.server.fastmcp import FastMCP\n"
+        "m = FastMCP('demo')\n"
+        "@m.tool()\n"
+        "def carbon(kwh: float) -> dict:\n"
+        "    return {'kg_co2e': round(kwh * 0.386, 3)}\n"
+        "m.run()\n")
+    from mcp import ClientSession, StdioServerParameters
+    from mcp.client.stdio import stdio_client
+
+    async def go():
+        params = StdioServerParameters(
+            command=sys.executable,
+            args=["-m", "orc_seal", "--issuer", "did:web:example.com", "--agent", "demo",
+                  "--", sys.executable, str(server)],
+            env={"PYTHONPATH": str(PKG), "PATH": "/usr/bin:/bin"}, cwd=str(PKG))
+        async with stdio_client(params) as (r, w):
+            async with ClientSession(r, w) as s:
+                await s.initialize()
+                tools = await s.list_tools()
+                assert [t.name for t in tools.tools] == ["carbon"]
+                res = await s.call_tool("carbon", {"kwh": 1000})
+                return res
+    res = asyncio.run(go())
+    receipt = res.meta[META_KEY]
+    assert verify(receipt)["label"] == "INTACT"
+    sealed_text = json.dumps(receipt["output"]["result"])
+    assert "386.0" in sealed_text                      # the tool's answer is what got sealed
+    assert [c.text for c in res.content] == [c["text"] for c in receipt["output"]["result"]["content"]]
+    assert receipt["subject"] == {"agent": "demo", "tool": "carbon"}
+
+
+def test_browser_verifier_agrees(tmp_path):
+    """The public verify page's JS core accepts orc-seal receipts and rejects tampering."""
+    import shutil
+    node = shutil.which("node")
+    if not node:
+        pytest.skip("node not installed")
+    r = Sealer(ISSUER, agent="demo").seal(
+        "carbon", {"kwh": 1000},
+        {"content": [{"type": "text", "text": "Café ☀ 386.0"}], "structuredContent": {"kg": 0.386}})
+    good = tmp_path / "good.json"; good.write_text(json.dumps(r))
+    t = json.loads(json.dumps(r)); t["output"]["result"]["structuredContent"]["kg"] = "0.387"
+    bad = tmp_path / "bad.json"; bad.write_text(json.dumps(t))
+    js = (
+        "const fs=require('fs');"
+        f"const h=fs.readFileSync({json.dumps(str(ROOT / 'products/signed-cliff-check/verify.html'))},'utf8');"
+        "const s=[...h.matchAll(/<script(?:\\s[^>]*)?>([\\s\\S]*?)<\\/script>/g)].map(x=>x[1]).find(x=>x.includes('verifyReceipt'));"
+        "const m={exports:{}};new Function('module','require',s)(m,require);"
+        f"Promise.all([{json.dumps(str(good))},{json.dumps(str(bad))}].map(p=>m.exports.verifyReceipt(fs.readFileSync(p,'utf8'))))"
+        ".then(v=>console.log(JSON.stringify(v.map(x=>x.verified))))")
+    out = subprocess.run([node, "-e", js], capture_output=True, text=True, timeout=30)
+    assert out.stdout.strip() == "[true,false]", out.stderr
+
+
+def test_p4_server_dies_early_proxy_exits_with_its_code_cleanly(tmp_path):
+    """P4 regression: server exits while the client's stdin is still open."""
+    dead = tmp_path / "dead.py"
+    dead.write_text("import sys; sys.stderr.write('boom\\n'); sys.exit(3)\n")
+    p = subprocess.Popen([sys.executable, "-m", "orc_seal", "--issuer", "did:web:example.com", "--",
+                          sys.executable, str(dead)],
+                         stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+                         cwd=PKG, env={"PATH": "/usr/bin:/bin", "PYTHONPATH": str(PKG)})
+    try:
+        out, err = p.communicate(timeout=15)   # stdin is left open until communicate closes it
+    except subprocess.TimeoutExpired:
+        p.kill(); raise
+    assert p.returncode == 3
+    assert b"Fatal Python error" not in err
+
+
+def test_p4_server_dies_early_with_client_still_writing(tmp_path):
+    """Same, but the client keeps its stdin pipe open (not closed by communicate)."""
+    import time
+    dead = tmp_path / "dead.py"
+    dead.write_text("import sys, time; time.sleep(0.2); sys.exit(5)\n")
+    p = subprocess.Popen([sys.executable, "-m", "orc_seal", "--issuer", "did:web:example.com", "--",
+                          sys.executable, str(dead)],
+                         stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+                         cwd=PKG, env={"PATH": "/usr/bin:/bin", "PYTHONPATH": str(PKG)})
+    p.stdin.write(b'{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}\n'); p.stdin.flush()
+    deadline = time.time() + 15
+    while p.poll() is None and time.time() < deadline:
+        time.sleep(0.05)
+    assert p.returncode == 5, "proxy must exit when the server exits, even with stdin open"
+    err = p.stderr.read()
+    assert b"Fatal Python error" not in err
+    p.stdin.close()
+
+
+def test_cli_help_without_server_command(capsys):
+    from orc_seal.__main__ import main
+    with pytest.raises(SystemExit) as exc:
+        main(["--help"])
+    assert exc.value.code == 0
+    assert "usage: orc-seal" in capsys.readouterr().out