zaxy-memory 2.3.4__tar.gz → 2.4.0__tar.gz

{zaxy_memory-2.3.4 → zaxy_memory-2.4.0}/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 All notable Zaxy release changes are recorded here.
 
+## 2.4.0 - 2026-06-14
+
+- **Portable signed memory export — EXPERIMENTAL / UNAUDITED, opt-in.** New
+  `zaxy.portable` module (install `zaxy-memory[export]`) for self-sovereign,
+  cryptographically-signed, verifiable memory export:
+  - Signed bundles: post-quantum **ML-DSA-65** (FIPS-204) primary, Ed25519
+    fallback; a domain-separated Merkle tree binds the entries and enables
+    **verifiable partial disclosure** (prove a subset without revealing the rest);
+    the signature binds the root and all metadata; public-key pinning.
+  - **Injection-resistant rehydration** of recalled content (data-not-instructions
+    fencing); opt-in `zaxy offload-get --fenced`.
+  - **Encryption envelope + cryptographic erasure** (per-cell AES-256-GCM, KEK
+    wrap, key-destruction erasure for GDPR Art.17) and capability-scoped sharing.
+  - Pluggable public anchor (offline stub + OpenTimestamps hook).
+  - CLI: `export-keygen`, `export`, `verify-export`.
+  > ⚠️ This is **experimental, unaudited** cryptographic code. It uses only vetted
+  > primitives (pyca/cryptography) and ships behind an opt-in extra with a loud
+  > import-time warning. **Do not rely on it for high-value secrets or compliance.**
+  > It has had an adversarial self-review (a layer, not a substitute for
+  > independent human review); see `docs/experimental/portable-export-security.md`.
+- No changes to the default runtime, capture, recall, or existing MCP tools;
+  nothing in core imports `zaxy.portable`.
+
 ## 2.3.4 - 2026-06-14
 
 - **Opt-in full tool-I/O provenance (offload sink).** Default capture stays lean

{zaxy_memory-2.3.4 → zaxy_memory-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: zaxy-memory
-Version: 2.3.4
+Version: 2.4.0
 Summary: Coordinator memory for auditable multi-agent projects
 Project-URL: Homepage, https://syndicalt.github.io/zaxy/
 Project-URL: Documentation, https://syndicalt.github.io/zaxy/docs/getting-started.html
@@ -48,6 +48,8 @@ Requires-Dist: twine>=5.0.0; extra == 'dev'
 Requires-Dist: types-pyyaml>=6.0.12; extra == 'dev'
 Requires-Dist: types-requests>=2.32.0; extra == 'dev'
 Provides-Extra: embedded
+Provides-Extra: export
+Requires-Dist: cryptography>=46.0; extra == 'export'
 Provides-Extra: frameworks
 Requires-Dist: autogen-agentchat>=0.7; extra == 'frameworks'
 Requires-Dist: crewai>=0.100; extra == 'frameworks'

zaxy_memory-2.4.0/docs/experimental/portable-export-conformance.md

@@ -0,0 +1,62 @@
+# Portable Export — W3C Interop Conformance Mapping (dev target #3)
+
+Status: **reference implementation, held for independent review. Not released.**
+
+This maps Zaxy's signed portable-export implementation to the scope of the W3C
+"AI Agent Memory Interoperability" Community Group (proposed 2026-05-18). **Full
+conformance is intentionally deferred until the CG spec is finalized** — you
+cannot conform to an unfinalized standard. The pieces below are built against the
+*announced scope* and will be reconciled to exact field names / serialization once
+the spec stabilizes.
+
+| W3C CG scope item | Zaxy implementation | Status |
+|---|---|---|
+| Identity binding (post-quantum signatures, ML-DSA-65 / FIPS-204 reference) | `portable/signing.py` — ML-DSA-65 primary, Ed25519 classical fallback (vetted pyca) | ✅ built |
+| Tamper-evident provenance | `portable/merkle.py` + `export.py` — domain-separated Merkle root, signed; verifiable subset disclosure | ✅ built |
+| Memory cell shape (encrypted unit + metadata) | `portable/envelope.py` — per-cell AES-256-GCM | ⚠️ primitive built; canonical cell schema pending spec |
+| Encryption envelope (per-cell DEK; KEK wrap; rotation) | `portable/envelope.py` — DEK + KEK wrap (local KEK; wallet-derived KEK deferred) | ⚠️ partial |
+| Cryptographic erasure (DEK destroy + tombstone + content-address blacklist; GDPR Art.17) | `portable/envelope.py::ErasureVault` | ✅ built |
+| Sharing contracts (temporary / permanent / syndicate + revocation) | `portable/envelope.py::Capability` | ✅ built (policy layer) |
+| Audit anchor (public-chain receipts; operator-independent verifiability) | `portable/anchor.py` — pluggable; deterministic stub + OpenTimestamps hook | ⚠️ interface built; real public-chain anchor not wired |
+| Serialization (JSON-first, optional CBOR) | JSON bundle implemented | ⚠️ CBOR deferred |
+
+## Trust model (no external authority required)
+Self-sovereign: the exporter holds its own keypair; the public key (or a DID) is
+the identity. No CA. Verifiers pin the key / trust-on-first-use. Operator-
+independent verification is provided by the public-chain anchor (OpenTimestamps),
+not a private signing authority. A managed "notary" service is a future product
+layer, never a dependency.
+
+## Adversarial self-review (2026-06-14)
+
+A structured red-team of the protocol logic (not a credentialed human audit).
+Held: domain-separated Merkle blocks the duplicate-leaf forgery class
+(CVE-2012-2459); the signature binds the root **and** all metadata; `verify_*`
+fails closed on exceptions; per-cell DEKs avoid AES-GCM nonce reuse; the fence
+escape prevents literal delimiter forgery.
+
+**Fixed by this pass:**
+- *Crypto-erasure invariant* — made explicit (see `ErasureVault` docstring): key
+  material must NEVER enter the immutable Eventloom, or erasure is a false claim.
+- *`temporary` capability without expiry* now fails **closed** (was grant-forever).
+- *`verify_*` now version-allow-lists* the bundle (rejects unknown versions).
+
+**Residual caveats (documented, not yet addressed — for human review / later phases):**
+- *Canonicalization*: signing uses sorted-key compact JSON; adopt JCS (RFC 8785)
+  and forbid floats/NaN to remove canonicalization ambiguity before production.
+- *KEK nonce volume*: random 96-bit nonces are safe per-DEK (used once) but a KEK
+  wrapping many DEKs should rotate or use counter nonces beyond ~2^32 wraps.
+- *Anchor stub*: `verify_anchor` on a `type: "stub"` anchor proves internal
+  consistency only — NOT external timestamping. Real assurance needs the
+  OpenTimestamps/public-chain hook.
+- *Subset proof length* leaks an approximate total entry count (tree depth).
+- *Rehydration (P2)* is defense-in-depth (semantic guard), explicitly NOT a
+  guarantee against indirect prompt injection.
+
+## Review gate
+This is security-critical reference code using vetted primitives only. The
+adversarial self-review above is a layer, **not** a substitute for independent
+human review. For a resource-constrained project the proportionate path is:
+ship clearly labeled `experimental / unaudited`, open it for community + W3C-CG
+scrutiny, and pursue a formal audit only when usage/stakes warrant. Until then,
+make no "audited/secure" claims. Nothing here has been published.

zaxy_memory-2.4.0/docs/experimental/portable-export-security.md

@@ -0,0 +1,95 @@
+# Portable Export — Security Status & Review Requests
+
+> ## ⚠️ EXPERIMENTAL · UNAUDITED
+> The portable signed-export / rehydration / envelope code (`src/zaxy/portable/`)
+> is a **reference implementation**. It has **not** had independent cryptographic
+> review. **Do not rely on it to protect high-value secrets or for compliance
+> guarantees.** No "audited" or "secure" claim is made. It lives on a feature
+> branch and has not been released.
+
+## What is and isn't assured
+
+**Assured by design / tests:**
+- Only **vetted primitives** (pyca/cryptography): ML-DSA-65, Ed25519, AES-256-GCM,
+  SHA-256. No homegrown cryptographic primitives.
+- Adversarial test suite (forge, tamper, drop, swapped-key, metadata-binding,
+  subset non-leakage, forged-proof, GCM auth-fail, key-destruction erasure,
+  capability expiry/revocation, anchor tamper-detection).
+- An **adversarial self-review** of the protocol/composition logic
+  (see `portable-export-conformance.md`). This is a *layer*, **not** a substitute
+  for independent human review.
+
+**Not assured (needs human review and/or later phases):**
+- Protocol composition beyond the tested cases.
+- Canonicalization is sorted-key compact JSON — not yet JCS (RFC 8785); floats
+  are a known canonicalization hazard.
+- KEK nonce management at high volume; wallet-derived KEK not implemented.
+- The public anchor ships as an offline **stub**; real OpenTimestamps/public-chain
+  anchoring is a hook, not wired. A stub anchor proves *consistency only*, not
+  external timestamping.
+- W3C interop conformance is deferred until the spec (CG proposed 2026-05-18)
+  finalizes.
+
+## What it provides (threat model summary)
+- **Authenticity + integrity** of an exported memory bundle (signature binds the
+  Merkle root and all metadata), with **self-sovereign** keys (no CA; pin the key
+  or use a DID; trust-on-first-use).
+- **Verifiable partial disclosure**: prove a subset of entries belongs to the
+  signed set without revealing the rest.
+- **Confidentiality + cryptographic erasure** of memory cells (per-cell DEK;
+  destroy-the-key erasure). **Invariant:** key material must never enter the
+  immutable Eventloom log, or erasure is void.
+- **Injection-resistant rehydration**: defense-in-depth fencing of recalled
+  untrusted content — explicitly **not** a guarantee against prompt injection.
+
+**Non-goals (v1):** CA/PKI federation, threshold/multi-party signing, confidential
+compute, replay/rollback prevention beyond per-bundle nonce + timestamp.
+
+## Reporting issues
+Found a flaw? Please open a private report (security contact / GitHub security
+advisory) rather than a public issue, and allow reasonable time to fix. Since this
+is pre-release experimental code, coordinated disclosure is appreciated but there
+is no production deployment at risk.
+
+---
+
+## Review request — W3C AI Agent Memory Interoperability CG
+
+> **Subject: Reference impl + review request — self-sovereign signed memory export (ML-DSA-65 + Merkle subset proofs)**
+>
+> Hi all — I've built an open, experimental reference implementation aligned with
+> the CG's announced scope (identity binding via ML-DSA-65/FIPS-204, Merkle
+> provenance with verifiable partial disclosure, per-cell encryption envelope,
+> cryptographic erasure for GDPR Art.17, capability-scoped sharing). It's
+> self-sovereign (no CA) with a public-chain anchor hook.
+>
+> It is **experimental and unaudited** — I'm a resource-constrained project and
+> can't commission a formal audit, so I'd hugely value eyes on the *protocol/
+> composition logic*: how the signature binds the Merkle root + metadata, the
+> subset-disclosure proofs, and the crypto-erasure model in an append-only store.
+> Vetted primitives only (pyca/cryptography); adversarial tests included.
+>
+> Repo + threat model: <link>. Happy to align field names/serialization to the
+> spec as it stabilizes, and to contribute findings back. What have I gotten wrong?
+
+## Review request — crypto.stackexchange
+
+> **Title: Is this composition sound? Signed Merkle-root memory bundle with verifiable subset disclosure + crypto-erasure**
+>
+> I have an experimental protocol for portable, signed agent-memory bundles and
+> want to sanity-check the *composition* (primitives are pyca: ML-DSA-65/Ed25519,
+> AES-256-GCM, SHA-256 — I'm not rolling my own).
+>
+> 1. A bundle's signature is computed over a canonical header that includes the
+>    Merkle root of the entries **plus** all metadata (version, alg, pubkey,
+>    session id, created-at, nonce). Is binding metadata-with-root this way
+>    sufficient to prevent metadata-swap / cross-bundle attacks?
+> 2. Subset disclosure reveals chosen entries + Merkle inclusion proofs (leaf
+>    prefix `0x00`, node prefix `0x01`, unpaired nodes promoted not duplicated).
+>    Any forgery/second-preimage concern, given the proofs aren't position-bound?
+> 3. "Cryptographic erasure" = destroy the (wrapped) DEK + tombstone + blacklist;
+>    ciphertext is otherwise immutable. Are there pitfalls beyond "ensure no other
+>    copy of the key survives"?
+>
+> Canonicalization is sorted-key compact JSON (I know JCS/RFC 8785 is the better
+> answer). Threat model + code: <link>. Where does this break?

{zaxy_memory-2.3.4 → zaxy_memory-2.4.0}/docs/hooks.md

@@ -138,6 +138,32 @@ session, long tool run, or roadmap/status question, Zaxy appends
 the agent: call `memory_bootstrap` if awareness is unclear, then call
 `memory_checkout` and trust only cited current checkout facts.
 
+## Per-Turn Memory Injection (`UserPromptSubmit`)
+
+Capture is deterministic, but recall used to be advisory: nothing re-injected the
+memory contract into the model's context, so long sessions drifted. The
+`UserPromptSubmit` hook closes that recall gap. On every turn it re-checks memory
+freshness and, when memory is stale, injects a single terse declarative line that
+names the session, how many events have passed since the last memory use, and the
+recommended `memory_checkout`. When memory is fresh it stays silent and adds no
+context noise. Wire it via:
+
+```bash
+zaxy hooks claude-code --eventloom-path .eventloom --domain my-project
+```
+
+Codex ships Claude-parity hooks, so the same `UserPromptSubmit` /
+`additionalContext` injection works there too. `render_hook_config("codex")`
+emits a `.codex/hooks.json` with the same per-turn recall behavior:
+
+```bash
+zaxy hooks codex --eventloom-path .eventloom --domain my-project
+```
+
+The injected line is plain prose rather than JSON or glyphs, and it is assembled
+read-only from Eventloom-backed state, so it stays small enough to prepend to the
+prompt verbatim without risking stale context after a checkout.
+
 Checkpoint hooks can include retrieval-useful metadata:
 
 ```bash
@@ -241,6 +267,23 @@ persist argument keys but not raw argument values. Transcript-turn observations
 sanitize content before append so they can serve as source-recall material
 without storing obvious secrets.
 
+### Tool-I/O Offload Provenance (`ZAXY_OFFLOAD_TOOL_IO`)
+
+Default capture stays lean, so it truncates command output and keeps only tool
+argument keys. When you need full, replayable provenance for tool I/O, set
+`ZAXY_OFFLOAD_TOOL_IO`. The full command output or tool arguments are then written
+to a content-addressed, tamper-evident blob under `<eventloom>/refs/` (the blob id
+is its own sha256), and the lean event carries a `full_io_ref` pointer. Context
+assembly and `memory_checkout` still see only the summary; drill down to the full
+text on demand:
+
+```bash
+zaxy offload-get <sha256>
+```
+
+Offload is opt-in, and secret-looking argument values are still masked before the
+blob is written, so the lean default and the privacy guarantees are preserved.
+
 ## Payload
 
 Hook events use actor `zaxy-hook` and append to the selected session log. The

{zaxy_memory-2.3.4 → zaxy_memory-2.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "zaxy-memory"
-version = "2.3.4"
+version = "2.4.0"
 description = "Coordinator memory for auditable multi-agent projects"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -76,6 +76,11 @@ embedded = [
 latticedb = [
     "latticedb>=0.9.6",
 ]
+export = [
+    # Portable signed export. Ed25519 works with the cryptography that PyJWT[crypto]
+    # already pulls in; ML-DSA-65 (post-quantum) requires cryptography >= 46.
+    "cryptography>=46.0",
+]
 frameworks = [
     "langgraph>=0.6",
     "crewai>=0.100",

{zaxy_memory-2.3.4 → zaxy_memory-2.4.0}/scripts/build-site-docs.py

@@ -52,6 +52,10 @@ def main() -> int:
 
 def build_pages() -> list[RenderedPage]:
     sources = [ROOT / "README.md", *sorted(DOCS_ROOT.rglob("*.md"))]
+    # docs/experimental/ is contributor-only (e.g. unreleased/experimental crypto)
+    # and must never be rendered into the public site.
+    experimental = DOCS_ROOT / "experimental"
+    sources = [s for s in sources if not is_relative_to(s, experimental)]
     return [render_page(source) for source in sources]
 
 

{zaxy_memory-2.3.4 → zaxy_memory-2.4.0}/site/docs/hooks.html

@@ -139,6 +139,12 @@ zaxy hook-event heartbeat --eventloom-path .eventloom --session-id my-project-de
       </table>
       <p>Unknown triggers are rejected before writing.</p>
       <p>Lifecycle hooks also run the memory persistence policy. If Zaxy has not been used recently, or the hook marks a session start, resume, compaction, long session, long tool run, or roadmap/status question, Zaxy appends <code>memory.reminder.suggested</code>. That event is intentionally read-only guidance for the agent: call <code>memory_bootstrap</code> if awareness is unclear, then call <code>memory_checkout</code> and trust only cited current checkout facts.</p>
+      <h2 id="per-turn-memory-injection-userpromptsubmit">Per-Turn Memory Injection (<code>UserPromptSubmit</code>)</h2>
+      <p>Capture is deterministic, but recall used to be advisory: nothing re-injected the memory contract into the model&#x27;s context, so long sessions drifted. The <code>UserPromptSubmit</code> hook closes that recall gap. On every turn it re-checks memory freshness and, when memory is stale, injects a single terse declarative line that names the session, how many events have passed since the last memory use, and the recommended <code>memory_checkout</code>. When memory is fresh it stays silent and adds no context noise. Wire it via:</p>
+      <pre><code class="language-bash">zaxy hooks claude-code --eventloom-path .eventloom --domain my-project</code></pre>
+      <p>Codex ships Claude-parity hooks, so the same <code>UserPromptSubmit</code> / <code>additionalContext</code> injection works there too. <code>render_hook_config(&quot;codex&quot;)</code> emits a <code>.codex/hooks.json</code> with the same per-turn recall behavior:</p>
+      <pre><code class="language-bash">zaxy hooks codex --eventloom-path .eventloom --domain my-project</code></pre>
+      <p>The injected line is plain prose rather than JSON or glyphs, and it is assembled read-only from Eventloom-backed state, so it stays small enough to prepend to the prompt verbatim without risking stale context after a checkout.</p>
       <p>Checkpoint hooks can include retrieval-useful metadata:</p>
       <pre><code class="language-bash">zaxy hook-event checkpoint \
   --eventloom-path .eventloom \
@@ -204,6 +210,10 @@ zaxy hook-event transcript-turn \
 }</code></pre>
       <p>Any harness with a post-compaction or resume hook can use the same command; the packet is plain text bracketed by <code>=== ZAXY RECOVERY PACKET ... ===</code> markers. <code>zaxy doctor</code> complements the loop with hash-chain, projection freshness, embedding-dimension, and vector-cache headroom checks so a resumed session can trust what it recovers.</p>
       <p>Command observations redact common secret-bearing arguments and bound stdout and stderr excerpts. File-edit observations persist path, operation, summary, and line count metadata; they do not persist source content. Tool-call observations persist argument keys but not raw argument values. Transcript-turn observations sanitize content before append so they can serve as source-recall material without storing obvious secrets.</p>
+      <h3 id="tool-io-offload-provenance-zaxyoffloadtoolio">Tool-I/O Offload Provenance (<code>ZAXY_OFFLOAD_TOOL_IO</code>)</h3>
+      <p>Default capture stays lean, so it truncates command output and keeps only tool argument keys. When you need full, replayable provenance for tool I/O, set <code>ZAXY_OFFLOAD_TOOL_IO</code>. The full command output or tool arguments are then written to a content-addressed, tamper-evident blob under <code>&lt;eventloom&gt;/refs/</code> (the blob id is its own sha256), and the lean event carries a <code>full_io_ref</code> pointer. Context assembly and <code>memory_checkout</code> still see only the summary; drill down to the full text on demand:</p>
+      <pre><code class="language-bash">zaxy offload-get &lt;sha256&gt;</code></pre>
+      <p>Offload is opt-in, and secret-looking argument values are still masked before the blob is written, so the lean default and the privacy guarantees are preserved.</p>
       <h2 id="payload">Payload</h2>
       <p>Hook events use actor <code>zaxy-hook</code> and append to the selected session log. The payload is intentionally small:</p>
       <pre><code class="language-json">{

{zaxy_memory-2.3.4 → zaxy_memory-2.4.0}/site/index.html

@@ -62,7 +62,7 @@
     </section>
 
     <section class="proof-strip" aria-label="Project status">
-      <span>PyPI 2.3.1</span>
+      <span>PyPI 2.4.0</span>
       <span>47 MCP tools, 8-tool core profile</span>
       <span>cognitive ranking default</span>
       <span>embedded local runtime</span>
@@ -334,7 +334,7 @@ zaxy coordinate checkout --mission auth-main</code></pre>
   </main>
 
   <footer>
-    <span>Zaxy v2.3.1 - MIT</span>
+    <span>Zaxy v2.4.0 - MIT</span>
     <span><a href="README.html">README</a> <a href="docs/runbook.html">Runbook</a></span>
   </footer>
 </body>

{zaxy_memory-2.3.4 → zaxy_memory-2.4.0}/src/zaxy/cli/workspace.py

@@ -716,8 +716,13 @@ def hook_event(
 def offload_get(
     sha256: str = typer.Argument(..., help="sha256 id from a full_io_ref pointer"),  # noqa: B008
     eventloom_path: str = typer.Option(".eventloom", help="Eventloom directory holding refs/"),
+    fenced: bool = typer.Option(False, "--fenced", help="Wrap as injection-resistant untrusted data (when feeding the blob back to a model)"),  # noqa: B008
 ) -> None:
-    """Drill down to the full offloaded tool I/O behind a `full_io_ref` sha256."""
+    """Drill down to the full offloaded tool I/O behind a `full_io_ref` sha256.
+
+    Raw by default (for tooling); `--fenced` applies injection-resistant rehydration
+    so captured (attacker-influenceable) content is safe to re-inject into a model.
+    """
     from zaxy.offload import read_offload_ref
 
     content = read_offload_ref(eventloom_path, sha256)
@@ -725,7 +730,94 @@ def offload_get(
         raise typer.BadParameter(
             f"no offload blob for {sha256} under {eventloom_path}/refs (missing or integrity mismatch)"
         )
-    typer.echo(content, nl=False)
+    if fenced:
+        from zaxy.portable.rehydration import rehydrate
+
+        typer.echo(rehydrate(content, origin="offload", label="offloaded tool I/O")["text"])
+    else:
+        typer.echo(content, nl=False)
+
+
+@app.command("export-keygen")
+def export_keygen(
+    out_private: Path = typer.Option(..., "--out-private", help="Write PKCS8 PEM private key here (chmod 600)"),  # noqa: B008
+    out_public: Path = typer.Option(..., "--out-public", help="Write hex public key here"),  # noqa: B008
+    algorithm: str | None = typer.Option(None, "--algorithm", help="ml-dsa-65 (default if available) or ed25519"),  # noqa: B008
+) -> None:
+    """Generate a self-sovereign signing keypair for portable memory export."""
+    from zaxy.portable import generate_keypair
+
+    keypair = generate_keypair(algorithm)
+    out_private.write_bytes(keypair["private_pem"])
+    out_private.chmod(0o600)
+    out_public.write_text(keypair["public_key"].hex(), encoding="utf-8")
+    typer.echo(
+        f"keypair {keypair['algorithm']}: private -> {out_private} (chmod 600); public -> {out_public}"
+    )
+
+
+@app.command("export")
+def export_memory(
+    out: Path = typer.Option(..., "--out", help="Write the signed bundle JSON here"),  # noqa: B008
+    private_key: Path = typer.Option(..., "--private-key", help="PKCS8 PEM private key file"),  # noqa: B008
+    public_key: Path = typer.Option(..., "--public-key", help="hex public key file"),  # noqa: B008
+    algorithm: str = typer.Option("ml-dsa-65", "--algorithm", help="signature algorithm of the key"),
+    eventloom_path: str = typer.Option(".eventloom", "--eventloom-path"),
+    session_id: str = typer.Option("default", "--session-id"),
+    types: str = typer.Option("decision.made,goal.created,task.completed", "--types", help="comma-separated event types to export"),
+    limit: int = typer.Option(200, "--limit", help="cap to the most recent N matching events"),
+) -> None:
+    """Build a signed, verifiable export bundle from a session's declarative events."""
+    import secrets
+    from datetime import UTC, datetime
+
+    from zaxy.event import EventLog
+    from zaxy.portable import build_export
+
+    keep = {t.strip() for t in types.split(",") if t.strip()}
+    base = Path(eventloom_path)
+    log = base if base.suffix == ".jsonl" else base / f"{session_id}.jsonl"
+    events = EventLog(log).read_all()
+    entries = [
+        {"type": e.type, "actor": e.actor, "seq": e.seq, "payload": e.payload}
+        for e in events
+        if e.type in keep
+    ][-limit:]
+    if not entries:
+        raise typer.BadParameter(f"no events of types {sorted(keep)} in session {session_id}")
+    keypair = {
+        "algorithm": algorithm,
+        "private_pem": private_key.read_bytes(),
+        "public_key": bytes.fromhex(public_key.read_text(encoding="utf-8").strip()),
+    }
+    bundle = build_export(
+        entries,
+        keypair=keypair,
+        session_id=session_id,
+        created_at=datetime.now(UTC).isoformat(),
+        nonce=secrets.token_hex(16),
+    )
+    out.write_text(json.dumps(bundle, indent=2, ensure_ascii=False), encoding="utf-8")
+    typer.echo(
+        f"exported {len(entries)} entries -> {out} (alg={algorithm}, root={bundle['merkle_root'][:16]})"
+    )
+
+
+@app.command("verify-export")
+def verify_export_cmd(
+    bundle: Path = typer.Argument(..., help="signed bundle JSON file"),  # noqa: B008
+    expect_public_key: str | None = typer.Option(None, "--expect-public-key", help="pin: hex public key the bundle must be signed by"),  # noqa: B008
+) -> None:
+    """Verify a signed export bundle (integrity + authenticity); exit 1 on failure."""
+    from zaxy.portable import verify_export
+
+    result = verify_export(
+        json.loads(bundle.read_text(encoding="utf-8")), expect_public_key=expect_public_key
+    )
+    suffix = f" - {result['reason']}" if result.get("reason") else ""
+    typer.echo(f"verify: {'OK' if result['ok'] else 'FAIL'}{suffix}")
+    if not result["ok"]:
+        raise typer.Exit(code=1)
 
 
 def _resolve_cli_projection_backend(

zaxy_memory-2.4.0/src/zaxy/portable/__init__.py

@@ -0,0 +1,44 @@
+"""Portable, signed Zaxy memory export (dev target #3, Phase 1).
+
+SECURITY-CRITICAL. Provides self-sovereign cryptographic *authenticity* (signing)
+on top of Eventloom's existing hash-chain *integrity*, plus a Merkle tree enabling
+verifiable PARTIAL disclosure of an exported memory subset.
+
+Trust model: self-sovereign — the signer holds its own keypair; the public key is
+the identity. No CA. Verifiers establish trust out-of-band (pin the public key /
+DID, trust-on-first-use). Operator-independent timestamping (OpenTimestamps /
+public-chain anchoring) is a later phase; the `anchor` bundle field is reserved.
+
+NOT YET REVIEWED — Phase 1 reference implementation pending the independent
+cryptographic review the goal (seq 78021) mandates before any release.
+"""
+
+import warnings
+
+from zaxy.portable.export import (
+    BUNDLE_VERSION,
+    build_export,
+    disclose_subset,
+    verify_export,
+    verify_subset,
+)
+from zaxy.portable.signing import default_algorithm, generate_keypair, mldsa_available
+
+warnings.warn(
+    "zaxy.portable is EXPERIMENTAL and UNAUDITED cryptographic code. Do not rely on it "
+    "to protect high-value secrets or for compliance guarantees. "
+    "See docs/experimental/portable-export-security.md.",
+    category=UserWarning,
+    stacklevel=2,
+)
+
+__all__ = [
+    "BUNDLE_VERSION",
+    "build_export",
+    "disclose_subset",
+    "verify_export",
+    "verify_subset",
+    "default_algorithm",
+    "generate_keypair",
+    "mldsa_available",
+]

zaxy_memory-2.4.0/src/zaxy/portable/anchor.py

@@ -0,0 +1,48 @@
+"""Public-anchor interface for export bundles (P4).
+
+Operator-independent verifiability: commit a bundle's signed core to an external
+timestamp/ledger. The default is a deterministic OFFLINE STUB (no network); a real
+OpenTimestamps / public-chain anchor is a pluggable hook (intentionally not run
+here). Full W3C-spec conformance is blocked on the unfinalized standard (CG
+proposed 2026-05-18) -- see docs/experimental/portable-export-conformance.md.
+"""
+
+from __future__ import annotations
+
+import hashlib
+from collections.abc import Callable
+from typing import Any
+
+
+def bundle_commitment(bundle: dict[str, Any]) -> str:
+    """A stable commitment over the bundle's signed core (root + signature + key)."""
+    h = hashlib.sha256()
+    for key in ("merkle_root", "signature", "public_key"):
+        h.update(str(bundle[key]).encode("utf-8"))
+    return h.hexdigest()
+
+
+def stub_anchor(commitment: str) -> dict[str, Any]:
+    return {
+        "type": "stub",
+        "commitment": commitment,
+        "note": "offline stub; replace with OpenTimestamps / public-chain anchor",
+    }
+
+
+def anchor_bundle(
+    bundle: dict[str, Any], anchor_fn: Callable[[str], dict[str, Any]] | None = None
+) -> dict[str, Any]:
+    """Return a copy of `bundle` with its `anchor` field set to an anchor receipt."""
+    receipt = (anchor_fn or stub_anchor)(bundle_commitment(bundle))
+    out = dict(bundle)
+    out["anchor"] = receipt
+    return out
+
+
+def verify_anchor(bundle: dict[str, Any]) -> bool:
+    """True if the bundle carries an anchor whose commitment matches the bundle."""
+    anchor = bundle.get("anchor")
+    if not isinstance(anchor, dict):
+        return False
+    return anchor.get("commitment") == bundle_commitment(bundle)

zaxy_memory-2.4.0/src/zaxy/portable/envelope.py

@@ -0,0 +1,109 @@
+"""Encryption envelope, cryptographic erasure, and capability contracts (P3).
+
+SECURITY-CRITICAL reference implementation. Uses ONLY vetted pyca/cryptography
+primitives (AES-256-GCM); HELD FOR INDEPENDENT REVIEW before any release.
+
+- Envelope: each memory cell is encrypted under its own random DEK (data
+  encryption key); the DEK is wrapped by a KEK (key encryption key). Confidential
+  per-cell; rotate by re-wrapping.
+- Cryptographic erasure (GDPR Art.17 in an append-only world): destroy the wrapped
+  DEK + write a tombstone + blacklist the content address. The (immutable)
+  ciphertext remains but is permanently undecryptable.
+- Capability contracts: scoped, revocable, optionally-expiring grants
+  (temporary / permanent / syndicate).
+
+Timestamps (`now`, `expires_at`) are passed in explicitly for deterministic,
+testable behavior.
+"""
+
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass, field
+from typing import Any
+
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+
+_NONCE = 12  # AES-GCM standard nonce length
+
+
+def new_dek() -> bytes:
+    return AESGCM.generate_key(bit_length=256)
+
+
+def encrypt_cell(plaintext: bytes, dek: bytes | None = None) -> dict[str, Any]:
+    key = dek or new_dek()
+    nonce = os.urandom(_NONCE)
+    ciphertext = AESGCM(key).encrypt(nonce, plaintext, None)
+    return {"dek": key, "nonce": nonce.hex(), "ciphertext": ciphertext.hex()}
+
+
+def decrypt_cell(ciphertext_hex: str, nonce_hex: str, dek: bytes) -> bytes:
+    return AESGCM(dek).decrypt(bytes.fromhex(nonce_hex), bytes.fromhex(ciphertext_hex), None)
+
+
+def wrap_dek(dek: bytes, kek: bytes) -> dict[str, str]:
+    nonce = os.urandom(_NONCE)
+    return {"nonce": nonce.hex(), "wrapped": AESGCM(kek).encrypt(nonce, dek, None).hex()}
+
+
+def unwrap_dek(wrapped: dict[str, str], kek: bytes) -> bytes:
+    return AESGCM(kek).decrypt(bytes.fromhex(wrapped["nonce"]), bytes.fromhex(wrapped["wrapped"]), None)
+
+
+class ErasureVault:
+    """Holds wrapped DEKs; cryptographic erasure destroys the key, not the data.
+
+    CRITICAL INVARIANT (correctness condition for the GDPR-erasure claim):
+    key material (DEKs and *wrapped* DEKs) and the KEK MUST NEVER be written to the
+    immutable, hash-chained Eventloom log. They must live ONLY in this mutable,
+    truly-erasable vault. If a wrapped DEK ever lands in the append-only log it is
+    permanent, and `erase()` becomes a no-op against anyone with the KEK — erasure
+    would be a false claim. Only ciphertext (which is useless without the key)
+    may be persisted in the immutable log.
+    """
+
+    def __init__(self) -> None:
+        self._wrapped: dict[str, dict[str, Any]] = {}
+        self._tombstones: dict[str, dict[str, Any]] = {}
+        self._blacklist: set[str] = set()
+
+    def store(self, cell_id: str, wrapped_dek: dict[str, str], content_address: str) -> None:
+        self._wrapped[cell_id] = {"wrapped": wrapped_dek, "address": content_address}
+
+    def get_dek(self, cell_id: str, kek: bytes) -> bytes:
+        if cell_id in self._tombstones:
+            raise KeyError(f"cell {cell_id} cryptographically erased")
+        return unwrap_dek(self._wrapped[cell_id]["wrapped"], kek)
+
+    def erase(self, cell_id: str, *, erased_at: str) -> None:
+        entry = self._wrapped.pop(cell_id, None)  # destroy the only copy of the wrapped DEK
+        address = entry["address"] if entry else None
+        self._tombstones[cell_id] = {"erased_at": erased_at, "address": address}
+        if address:
+            self._blacklist.add(address)
+
+    def is_erased(self, cell_id: str) -> bool:
+        return cell_id in self._tombstones
+
+    def is_blacklisted(self, content_address: str) -> bool:
+        return content_address in self._blacklist
+
+
+@dataclass
+class Capability:
+    """A scoped sharing grant. `cells` may contain '*' for all."""
+
+    cap_id: str
+    kind: str  # "temporary" | "permanent" | "syndicate"
+    cells: tuple[str, ...] = field(default_factory=tuple)
+    expires_at: float | None = None  # epoch seconds; None = no expiry
+    revoked: bool = False
+
+    def authorizes(self, cell_id: str, *, now: float) -> bool:
+        if self.revoked:
+            return False
+        # fail closed: a temporary grant without an expiry, or past expiry, denies
+        if self.kind == "temporary" and (self.expires_at is None or now > self.expires_at):
+            return False
+        return "*" in self.cells or cell_id in self.cells