{
  "markdown": "# PolicyVault\n\n**Non-custodial delegated-spending vaults on Kaspa L1 — for people and AI agents.**\n\nPolicyVault lets a vault **owner** hand a spending key to an **agent** — an\nemployee, a service, a bot, or an AI agent — without handing over control of\nthe funds. The spending policy is enforced by **Kaspa L1 consensus** through\na covenant: even an agent who bypasses this entire application and talks\ndirectly to a Kaspa node cannot exceed the owner's policy.\n\nThe authority model, stated once and everywhere enforced:\n\n> **AI MAY REQUEST. POLICYVAULT DETERMINISTICALLY DECIDES.\n> THE COVENANT ENFORCES. SIGNERS RETAIN CUSTODY.**\n\n## Production status (honest labels)\n\n| Surface | Status |\n|---|---|\n| **Web / Agent platform** | **PRODUCTION — LIVE** at https://app.policy-vault.org (hosted deployment of this source; you can also fully self-host) |\n| Current production source | **PUBLIC — this repository** (buildId `1c02162`; exact identity chain in `PUBLIC_RELEASE_MANIFEST.md`) |\n| v0.5 token-controller covenant (byte-frozen) + least-privilege discovery / console correctives + MCP 1.4.2 (v1.5.0) | **LIVE** — production runtime successor `fullscale-rc8` (buildId `1c02162`) deployed and automated-accepted on 2026-09-02: principal-scoped capability discovery, no dev-signer probe on production, zero privileged reads while signed out, opt-in wallet diagnostics; `policyvault-mcp@1.4.2` advertises only the tools a credential's scopes cover (server-side enforcement unchanged). The v0.5 TOKEN CONTROLLER covenant (`contracts/PolicyVault.v0.5.sil`, sha256 `c693aeff…`) ships as SOURCE — COVENANT-BYTE-FROZEN, VM-verified with production bytes and testnet-verified with one live lifecycle; NOT production (no v0.5 surface, no mainnet v0.5 vault). Illustrated onboarding walkthrough (presentation only). See CHANGELOG |\n| Distribution: MCP registry, agent examples, self-hosting (v1.4.0) | Source/distribution release — NO runtime change (production keeps buildId `6c3177f`): the MCP server is npm/registry-packaged (`policyvault-mcp`, `io.github.zapsoblige-hash/policyvault`), thin OpenAI-Agents-SDK/LangChain/CrewAI wiring examples ship in `examples/agents/`, and one-command self-hosting ships in `deploy/selfhost.sh` + `docs/selfhost-quickstart.md`; see CHANGELOG |\n| Bearer wallet-sessions + native mobile transport (v1.3.0) | **LIVE**: opt-in bearer wallet-session authentication for non-browser clients (authentication only — never signing authority or custody; cookie web auth unchanged), plus the native Android transport (explicit CapacitorHttp at the platform seam; no CORS widening, web client stays strict same-origin). The full bearer lifecycle was proven from the real packaged Android runtime against live production; see CHANGELOG |\n| Responsive client + quiet signed-out UX (v1.2.0) | Faster signed-in navigation (retained state, parallel reads, truthful progress states — pending is never success) and no spurious signed-out error toasts; see CHANGELOG |\n| Network-identity banner fix (v1.1.1) | The web client's network banner now derives from the server's node-verified `/network/status` and FAILS CLOSED to an explicit UNKNOWN state — never a stale or assumed network; see CHANGELOG |\n| In-app documentation discovery (v1.1.0) | Docs link + contextual help in the web client, deep-linking to https://docs.policy-vault.org — presentation-only successor; see CHANGELOG |\n| External-approver discovery fix (2026-08-27) | **DEPLOYED + AUTOMATED-ACCEPTED** (fail-closed availability defect, no funds/authority/privacy exposure; see CHANGELOG \"Fixed\". Acceptance was automated; no human acceptance test is claimed) |\n| Covenant protocol v0.4.1 | Mainnet-operational (real mainnet lifecycle evidence; see SECURITY.md for exactly what is proven and how) |\n| Covenant protocol v0.5 (token controller) | **COVENANT-BYTE-FROZEN** (2026-09-02): VM-verified on the real engine with production bytes and testnet-verified (live testnet-10 lifecycle, consensus-rejected negatives); **not production** — no server/API/web surface, no mainnet instance; see `docs/postlaunch/v0.5-covenant-byte-freeze.md` |\n| Python client, MCP server, x402/AP2 adapters, platform agent API | Shipped; covered by the automated conformance/integration suites in this repository |\n| **Native mobile (iOS/Android)** | **DEVELOPMENT — NOT YET PRODUCTION-CAPABLE.** The Android app (full Capacitor project in `mobile/`, incl. the native production transport and bearer sign-in) has been validated on a real emulator against live production — reads, full bearer auth lifecycle, fail-closed negatives — but production signing, store packaging, and camera/QR capture remain pending; do not build custody workflows on it yet |\n| External professional security audit | **Has NOT occurred.** Planned. Nothing in this repository claims otherwise |\n\n## What the covenant enforces (consensus, not software)\n\n- **Owner-controlled vaults** — create, manage, pause, recover, close.\n- **Delegated spending** — up to 10 independent agents per vault, each with\n  its own policy, spending real KAS within owner-defined limits.\n- **Per-transaction caps** and **cumulative periodic budgets**\n  (DAA-score-based accounting verified by consensus).\n- **Recipient allowlists** — Merkle-committed; an agent can pay only\n  owner-approved recipients.\n- **M-of-N approvals** above an owner-set threshold.\n- **Covenant-controlled fee reserve** — agents need no gas wallet; network\n  fees come from a reserve the covenant accounts for exactly.\n- **Break-glass owner pause and terminal recovery** — never gated by any\n  hosted workflow.\n\n## What the platform adds ABOVE the covenant (hosted coordination, not authority)\n\n- **Intent manifests + independent browser verification** — before any\n  signature, the browser re-derives what the transaction does from the exact\n  bytes to be signed and refuses on any mismatch (`web/verify-intent.js`,\n  `docs/postlaunch/intent-manifest-spec.md`, `docs/postlaunch/browser-verification.md`).\n- **Governance** — proposal/approval ceremony (Schnorr-verified,\n  domain-separated) for authority-expanding policy changes\n  (`docs/postlaunch/governance-spec.md`).\n- **Risk pipeline** — restrictive-only configurable review/deny adapters\n  (`docs/postlaunch/risk-adapter-spec.md`).\n- **Budget reservations, hash-chained audit, webhooks/notifications,\n  machine identities + scoped capabilities, idempotency, dry-run simulation**\n  (`docs/postlaunch/*`).\n- **Universal Signer Interface** with KasWare mapping and an offline CLI\n  signer reference (`docs/postlaunch/signer-interface-spec.md`,\n  `signer-kasware-mapping.md`, `signer-cli-reference.md`).\n- **Agent surfaces**: REST platform API, MCP server, Python client, x402 +\n  AP2 payment-protocol adapters — all thin consumers of one deterministic\n  core; none holds independent financial authority.\n\nNone of this hosted machinery can move funds: every funds-moving signature is\nmade by the owner's or agent's own wallet over frozen bytes, and Kaspa\nconsensus checks the covenant regardless of what any server says.\n\n## Repository map\n\n| Path | What it is |\n|---|---|\n| `contracts/` | The covenant sources (v0.1…v0.4.1), regenerable byte-identically (`tools/gen_v4_1.js`) |\n| `core/` | Portable deterministic core: model, intent manifests, explanations, governance, risk, signer, cross-runtime equivalence |\n| `sdk/` | The Node SDK: builders, freeze/sign/finalize, VM preflight, submission + chain proof, reconciliation, stores (JSON + PostgreSQL) |\n| `server/` | Hosted runtime: API, auth/tenancy/request protection, governance/risk enforcement, audit chain, webhooks, notifications, migrations 001–009 |\n| `web/` | Browser client + **browser-local independent verification** (`verify-intent.js`, `core-bundle.js`) |\n| `mcp/`, `python/`, `integrations/` | MCP server, Python client, x402 + AP2 adapters |\n| `conformance/` | One matrix driving JS + Python + MCP + x402 + AP2 through identical scenarios (cross-path byte equivalence) |\n| `security/` | Internal adversarial (hostile-AI) test suites over the agent-facing boundaries |\n| `mobile/` | Native mobile app (Capacitor Android project + portable web payload, native production transport, bearer sign-in) — DEVELOPMENT status (see above) |\n| `tests/vm/` | Real Kaspa VM covenant verification workspace (Rust; TxScriptEngine) |\n| `deploy/` | Container build + staging/production compose examples + env templates |\n| `docs/` | Protocol specs, architecture, threat model, invariants, hosted design, per-surface specs |\n\n## Quick start (self-hosted, testnet-10)\n\n```bash\n# prerequisites: Node 20.x; a local Kaspa testnet-10 node with --utxoindex\n#   (rusty-kaspa; JSON wRPC on ws://127.0.0.1:18210)\ncd sdk && npm ci && npm test          # the SDK suite (serialized)\ncd ../server && node src/server.js    # self-hosted mode, JSON persistence\n# open http://127.0.0.1:3080 — connect a testnet KasWare wallet\n```\n\nFull instructions, including PostgreSQL-backed hosted mode, container builds,\ncovenant regeneration + byte-identity verification, and the VM suite:\n`docs/deployment.md`, `docs/hosted-deployment.md`, `docs/test-plan.md`.\nThe VM workspace expects sibling checkouts of the public `silverscript` and\n`rusty-kaspa` projects (see `tests/vm/` and `tools/stage-vendor.sh`).\n\n## Product policy (permanent)\n\nFree forever, including commercial use — no subscriptions, no transaction\nfees, no paid security, no usage caps. No patents on the protocol or its\nmechanisms. Apache-2.0. Voluntary support only — KAS donations:\n`kaspa:qyppakv5y7kmeynffldl9zshwgkjrl3fy9jjj8wf24v7f64v0gnuragz7ehdqhn`\n(public receiving address; nothing in this software ever asks for or handles\ndonation-wallet keys). Details: `docs/product-policy.md`.\n\n## Security\n\nRead `SECURITY.md` for the security model, the exact claim → enforcement →\ntest → evidence discipline, what is PROVEN versus DESIGN TARGET, and how to\nreport vulnerabilities.\n",
  "bytes": 9907,
  "sha": "0e5712eb70ef45dfb19d6d020fdd10d7f830dae32948ff58271b25739437aae0",
  "repo_slug": "zapsoblige-hash/policyvault",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_zapsoblige_hash_policyvault_ca293bf6/readme"
}