AGENTS.md
+36 −13
https://raw.githubusercontent.com/insomniac-vibelabs/two-key/HEAD/AGENTS.md
− (0.7.0), and, after 1.0, PKI with− certificate recovery, hybrid ML-DSA signatures, a FIPS approved mode, and a− local GUI. Build them in the order and with the limits stated− version `0.8.0` on PyPI (`pip install "two-key[yaml]==0.8.0"`), tag `v0.8.0` on `main`. Tags are not moved. docs/PYPI.md is the release process. `server.json` (the MCP Registry listing) carries the same version as `pyproject.toml`; bump them together.− | (none) | `cryptography>=41` | Ed25519, SHA-256, AES-256-GCM ledger |− Index install: `pip install "two-key[yaml]==0.8.0"`.− `docs/SCOPE.md`, `docs/SIEM.md`, `docs/LEDGER_VIEW.md`, `docs/CONSTITUTION_EDITOR.md`, `docs/PYPI.md`, `CHANGES.md`, `SECURITY.md`,− Crypto here is Ed25519 and SHA-256 via `cryptography`, plus AES-256-GCM for− ledger ciphertext. The ledger key, witness key, and capability private key− live outside the ledger directory. The gateway must verify only; it must not− mint.− (`tests/test_domain_allow.py`). Do not widen it.− mark, an `@domain` allow entry) must not sign as v3. Each signs only as+ (0.7.0), hybrid ML-DSA signatures (0.9.0), and, after 1.0, PKI with certificate recovery, a FIPS approved+ mode once a validated module offers ML-DSA-65, and a local GUI. Build them in the order and with the limits stated+ version `0.9.0` on PyPI (`pip install "two-key[yaml]==0.9.0"`), tag `v0.9.0` on `main`. Tags are not moved. docs/PYPI.md is the release process. `server.json` (the MCP Registry listing) carries the same version as `pyproject.toml`; bump them together.+ | (none) | `cryptography>=48` | Hybrid Ed25519 + ML-DSA-65 signatures, SHA-256, AES-256-GCM ledger |+ Index install: `pip install "two-key[yaml]==0.9.0"`.+ `docs/SCOPE.md`, `docs/SIEM.md`, `docs/LEDGER_VIEW.md`, `docs/CONSTITUTION_EDITOR.md`, `docs/TOOL_CHECK.md`, `docs/QUICKSTART.md`, `docs/DEMO.md`, `docs/GUI_WALKTHROUGH.md`, `docs/PYPI.md`, `CHANGES.md`, `SECURITY.md`,+ - docs/QUICKSTART.md (0.9.0) is run in CI by `tests/quickstart_run.py`: every ```bash block runs in order+ in a new folder and must exit 0, unless the `<!-- quickstart: ... -->` line above it says `skip`, `exit=N`+ or `expect=TEXT`. Its judge there is a stand-in that always votes yes; keep that stand-in out of the+ package and out of any example. A command changed on the page is a command changed in CI.+ Crypto here is hybrid Ed25519 + ML-DSA-65 signatures (0.9.0) and SHA-256 via+ `cryptography`, plus AES-256-GCM for ledger ciphertext. Every signature is made+ and checked in `two_key/keys.py` (`sign`, `verify`); do not call a key's own+ `sign` or `verify` elsewhere, and never add a path that accepts an Ed25519-only+ signature where a hybrid one is expected. The ledger key, witness key, and+ capability private key live outside the ledger directory. The gateway must+ verify only; it must not mint.+ (`tests/test_domain_allow.py`). Do not widen it. A `path` field (0.9.0)+ is the one folder-shaped match: cleaned as text only, `..` and relative+ paths refused, inside a signed folder segment by segment, and passed to+ the tool cleaned (`tests/test_path_fields.py`). Never resolve `..` by+ text, accept a relative path, or compare with a plain string prefix.+ mark, an `@domain` allow entry) or a `path` field must not sign as v3. Each signs only as+ - The tool check (#28, 0.9.0, `two_key/toolcheck.py`, docs/TOOL_CHECK.md) is for tools behind+ `two-key mcp-proxy` only, turned on in the tool's signed spec (`tool_check`), and required (or `exempt`,+ weaker) under `high_assurance`. The stamp key signs stamps only; every signed object carries a purpose label;+ the token and stamp leave the process only after `redemption_started`. The tool helper fails closed: keep+ every error inside it a refusal. The test vectors in docs/TOOL_CHECK.md are generated+ (`python tests/test_toolcheck_vectors.py --write`). A tool error spends the token for every tool.+ - `two-key setup --window` (0.9.0) is a front end only: it builds the same+ answers the terminal interview does and calls the same+ `setup_cmd.build`, so it can never write what `setup --answers` would+ refuse. Keep the checks it shows in `two_key/setup_form.py`, the window+ in `two_key/setup_gui.py` (`tests/test_setup_form.py`, which also checks+ the window and the interview write the same files, and+ `tests/test_setup_gui.py`).