2 commits

Author	SHA1	Message	Date
mrwulf	65772b3d2e	warden hardening round: policy engine, ledger rotation, MCP UX, treasury LIVE, ops docs ... Tier 2: - request_signature decomposed into named gates (latch, freshness, intent, policy, signer, firewall) - ledger: O(1) tail-read appends under a dedicated lock file (survives rotation rename); hash-chained segment rotation at policy ledger.rotate_at; verify-ledger walks all segments to genesis; archive tampering detected (tested) - docs/threat-model.md (attacker matrix 1-9, proven-vs-trusted, design invariants) + docs/runbook-latch.md (diagnose-first recovery) - lecture 10: executable corrupt-a-member exercise (capsule pin catches one appended byte), honest note on what the pin does NOT stop Lightweight policy engine (POLICY_DENIED wired): - policy.json: per-request/per-day amount ceilings, counterparty allow/deny lists, per-identity overrides; rules make their intent fields mandatory; daily sums from the ledger - Agent UX: - signed refusal receipts travel inside MCP errors (receipt + receipt_path in structuredContent) - airgap over MCP: request_signature signer=airgap + request_id, new airgap_pending tool; park -> list -> device answers -> complete (tested end-to-end) - all 8 tools carry readOnly/destructive annotations - sliding-window rate limiter per tool class (custody/verify/liveness); RATE_LIMITED refusal code; surface control, not ledgered warden-treasury LIVE: - treasury.py: stdlib base58, compact-u16, legacy+v0 wire parsing; every required signature quorum-verified over exact message bytes; completeness gap named in every verdict; RPC fetch uses response as bytes only - - live-quorum test: synthetic Solana tx signed with wallet key -> authentic via 4 proven forks; flipped byte -> not authentic 100 tests green (was 85). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 13:38:42 +02:00
mrwulf	60f0c09bc9	warden agent-native surfaces: MCP server, self-proving custody card, proof-of-posture ... - walletmcp.py: stdlib stdio JSON-RPC MCP server; 7 outcome-first tools with strict schemas; errors are structured (code/missing/remediation), never prose; results carry evidence (structuredContent) - custodycard.py: A2A-style card sharpened to self-proving - embeds each member's LTL inclusion proof + STH so a counterparty recomputes trust instead of believing it; proof-of-posture nonce challenge returns a firewalled, signed posture attestation with the full quorum trail - cli.py: - verified end-to-end on the live wallet: all 7 MCP tools, structured refusal on bad input, and a counterparty recomputing all 4 inclusion proofs + STH signatures from the card alone (no operator trust) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-06 23:35:47 +02:00