- Notifications
You must be signed in to change notification settings - Fork 0
feat: wire cAPI evidence to gnomledger, audit all rejections, add queryable audit endpoint#6
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Uh oh!
There was an error while loading. Please reload this page.
Merged
Changes from all commits
Commits
Show all changes
3 commits
Select commit
Hold shift + click to select a range
461b950
feat: wire cAPI evidence to gnomledger, audit all rejections, add que…
anthonymillwater2-creator 9891619
📝 Add docstrings to `devin/1782066008-capi-gnomledger-audit`
coderabbitai[bot] bf8fd4c
fix: CodeRabbit limit check and timeout parsing, fix hash integrity v…
reprewindai-dev File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Uh oh!
There was an error while loading. Please reload this page.
Jump to
Jump to file
Failed to load files.
Loading
Uh oh!
There was an error while loading. Please reload this page.
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| # Covenant (cAPI) configuration. Copy to .env.local and fill in as needed. | ||
| # Every value is optional — unset means the related integration stays disabled | ||
| # and the runtime falls back to its in-process behavior. | ||
| # --- PGL ledger (gnomledger) forwarding --- | ||
| # When PGL_LEDGER_URL is set, every sealed evidence record (Phase 7) is mirrored | ||
| # into gnomledger's append-only, hash-chained ledger. Leave empty to keep the | ||
| # local seal only. | ||
| PGL_LEDGER_URL= | ||
| PGL_LEDGER_API_KEY= | ||
| PGL_LEDGER_TIMEOUT_MS=8000 | ||
| # --- Phase 6 execution bridge (Veklom BYOS MCP gateway) --- | ||
| BYOS_MCP_GATEWAY_URL= | ||
| BYOS_INTERNAL_API_KEY= | ||
| COVENANT_EXEC_TIMEOUT_MS=10000 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| import { NextRequest, NextResponse } from "next/server"; | ||
| import { getEngine } from "@/lib/covenant/engine"; | ||
| import { isLedgerConfigured } from "@/lib/covenant/pgl-ledger"; | ||
| import type { AuditQuery, Decision, LedgerForwardStatus } from "@/lib/covenant/types"; | ||
| export const dynamic = "force-dynamic"; | ||
| const DECISIONS: Decision[] = ["authorized", "denied", "error", "quarantined"]; | ||
| const FORWARD_STATES: LedgerForwardStatus[] = ["pending", "sealed", "failed", "disabled"]; | ||
| /** | ||
| * Handles GET requests to query and return the audit trail. | ||
| * | ||
| * Accepts optional query parameters to filter results: `agent_id`, `capability_id`, `status`, | ||
| * `forwarded`, `since` (ISO-8601), and `limit`. | ||
| * | ||
| * @returns JSON response containing `pgl_ledger.configured`, the audit query, and results | ||
| */ | ||
| export function GET(req: NextRequest) { | ||
| const sp = req.nextUrl.searchParams; | ||
| const statusParam = sp.get("status"); | ||
| if (statusParam && !DECISIONS.includes(statusParam as Decision)) { | ||
| return NextResponse.json( | ||
| { error: `status must be one of: ${DECISIONS.join(", ")}` }, | ||
| { status: 400 }, | ||
| ); | ||
| } | ||
| const forwardedParam = sp.get("forwarded"); | ||
| if (forwardedParam && !FORWARD_STATES.includes(forwardedParam as LedgerForwardStatus)) { | ||
| return NextResponse.json( | ||
| { error: `forwarded must be one of: ${FORWARD_STATES.join(", ")}` }, | ||
| { status: 400 }, | ||
| ); | ||
| } | ||
| const limitParam = sp.get("limit"); | ||
| const limit = limitParam ? Number(limitParam) : undefined; | ||
| if ( | ||
| limitParam && | ||
| (!Number.isInteger(limit) || (limit as number) < 1 || (limit as number) > 500) | ||
| ) { | ||
| return NextResponse.json( | ||
| { error: "limit must be an integer between 1 and 500" }, | ||
| { status: 400 }, | ||
| ); | ||
| } | ||
| const query: AuditQuery = { | ||
| agent_id: sp.get("agent_id") ?? undefined, | ||
| capability_id: sp.get("capability_id") ?? undefined, | ||
| status: (statusParam as Decision | null) ?? undefined, | ||
| forwarded: (forwardedParam as LedgerForwardStatus | null) ?? undefined, | ||
| since: sp.get("since") ?? undefined, | ||
| limit, | ||
| }; | ||
| const result = getEngine().runtime.queryAudit(query); | ||
| return NextResponse.json({ | ||
| pgl_ledger: { configured: isLedgerConfigured() }, | ||
| query, | ||
| ...result, | ||
| }); | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,126 @@ | ||
| /** | ||
| * PGL Ledger client — forwards sealed evidence to gnomledger. | ||
| * | ||
| * cAPI seals a SHA-256 hash-chained evidence record in-process (Phase 7). That | ||
| * proves integrity *within* this runtime, but the canonical, tamper-evident | ||
| * proof lives in the Project Genome Ledger (gnomledger) — an append-only, | ||
| * per-agent hash chain persisted out-of-process. This client mirrors every | ||
| * sealed evidence record into gnomledger's `POST /api/v1/ledger/events`, so the | ||
| * audit trail survives process restarts and is independently verifiable via | ||
| * `GET /api/v1/ledger/agents/{agent_id}/verify`. | ||
| * | ||
| * Config is env-driven (same convention as `mcp-bridge.ts`); when the ledger | ||
| * URL is not configured the client is a no-op that reports `disabled` — it never | ||
| * throws and never blocks the pipeline. The local seal always stands. | ||
| */ | ||
| import type { Evidence, LedgerForward } from "./types"; | ||
| const LEDGER_URL = process.env.PGL_LEDGER_URL ?? ""; | ||
| const LEDGER_API_KEY = process.env.PGL_LEDGER_API_KEY ?? ""; | ||
| const parsedTimeout = Number(process.env.PGL_LEDGER_TIMEOUT_MS ?? 8_000); | ||
| const LEDGER_TIMEOUT = Number.isFinite(parsedTimeout) && parsedTimeout > 0 ? parsedTimeout : 8_000; | ||
| /** Shape returned by gnomledger `POST /api/v1/ledger/events`. */ | ||
| interface LedgerEventResponse { | ||
| event_id: string; | ||
| event_hash: string; | ||
| prev_event_hash: string | null; | ||
| } | ||
| /** | ||
| * Determines if the ledger is configured. | ||
| * | ||
| * @returns `true` if the ledger URL is configured, `false` otherwise. | ||
| */ | ||
| export function isLedgerConfigured(): boolean { | ||
| return LEDGER_URL.length > 0; | ||
| } | ||
| /** | ||
| * Builds a text summary of evidence for ledger recording. | ||
| * | ||
| * @returns A string (max 255 characters) in the format `covenant {status}: {capability_name} · {action}` | ||
| */ | ||
| function summarize(evidence: Evidence): string { | ||
| const summary = `covenant ${evidence.result.status}: ${evidence.what.capability_name} · ${evidence.what.action}`; | ||
| return summary.slice(0, 255); | ||
| } | ||
| /** | ||
| * Forwards a sealed evidence record to gnomledger's ledger API. | ||
| * | ||
| * The forwarding is idempotent on the evidence's `pgl_hash`; retries or duplicate | ||
| * forwards collapse to a single ledger event. If the ledger is unconfigured, returns | ||
| * `{ status: "disabled" }` without making a request. Never rejects. | ||
| * | ||
| * @returns A `LedgerForward` result: `{ status: "disabled" }` if unconfigured; | ||
| * `{ status: "sealed", event_id, event_hash, prev_event_hash?, forwarded_at }` on | ||
| * successful mirroring; or `{ status: "failed", error, forwarded_at }` on error. | ||
| */ | ||
| export async function forwardEvidence(evidence: Evidence): Promise<LedgerForward> { | ||
| if (!isLedgerConfigured()) { | ||
| return { status: "disabled" }; | ||
| } | ||
| const body = { | ||
| agent_id: evidence.who.agent_id, | ||
| event_type: "custom" as const, | ||
| actor: evidence.who.owner_id || evidence.who.agent_id, | ||
| summary: summarize(evidence), | ||
| details: { | ||
| source: "capi", | ||
| evidence_id: evidence.evidence_id, | ||
| connection_id: evidence.connection_id, | ||
| capi_pgl_hash: evidence.pgl_hash, | ||
| capi_previous_hash: evidence.previous_hash ?? null, | ||
| decision: evidence.result.status, | ||
| what: evidence.what, | ||
| when: evidence.when, | ||
| why: evidence.why, | ||
| how: evidence.how, | ||
| result: evidence.result, | ||
| compliance: evidence.compliance, | ||
| }, | ||
| idempotency_key: evidence.pgl_hash, | ||
| }; | ||
| const controller = new AbortController(); | ||
| const timer = setTimeout(() => controller.abort(), LEDGER_TIMEOUT); | ||
| try { | ||
| const res = await fetch(`${LEDGER_URL.replace(/\/$/, "")}/api/v1/ledger/events`, { | ||
| method: "POST", | ||
| headers: { | ||
| "Content-Type": "application/json", | ||
| "x-api-key": LEDGER_API_KEY, | ||
| }, | ||
| body: JSON.stringify(body), | ||
| signal: controller.signal, | ||
| }); | ||
| if (!res.ok) { | ||
| const detail = await res.text().catch(() => ""); | ||
| return { | ||
| status: "failed", | ||
| forwarded_at: new Date().toISOString(), | ||
| error: `gnomledger ${res.status}: ${detail.slice(0, 200) || res.statusText}`, | ||
| }; | ||
| } | ||
| const json = (await res.json()) as LedgerEventResponse; | ||
| return { | ||
| status: "sealed", | ||
| event_id: json.event_id, | ||
| event_hash: json.event_hash, | ||
| prev_event_hash: json.prev_event_hash ?? undefined, | ||
| forwarded_at: new Date().toISOString(), | ||
| }; | ||
| } catch (err: unknown) { | ||
| const message = err instanceof Error ? err.message : String(err); | ||
| return { | ||
| status: "failed", | ||
| forwarded_at: new Date().toISOString(), | ||
| error: message, | ||
| }; | ||
| } finally { | ||
| clearTimeout(timer); | ||
| } | ||
| } |
Oops, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.