Metadata-Version: 2.4
Name: algovoi-keystone-secure-lite
Version: 0.2.1
Summary: Open, content-addressed flow-point hardening refs for the AlgoVoi keystone (decision audit binding + guard context + freshness window; L1 frozen)
Author-email: AlgoVoi <chopmob@gmail.com>
License: Apache-2.0
Project-URL: Conformance vectors, https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors
Project-URL: Commercial Keystone Secure, https://docs.algovoi.co.uk/keystone
Keywords: jcs,rfc8785,keystone,audit,decision,guard,freshness,agentic-payments,algovoi
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
License-File: NOTICE
Requires-Dist: algovoi-substrate>=0.4.0
Provides-Extra: dev
Requires-Dist: pytest>=8.0; extra == "dev"
Requires-Dist: build>=1.2; extra == "dev"
Requires-Dist: rfc8785>=0.1.2; extra == "dev"
Dynamic: license-file

# algovoi-keystone-secure-lite

The **open, lite** flow-point hardening layer for the [AlgoVoi keystone](https://docs.algovoi.co.uk/keystone).
Several canonical keystone flow points emit a ref that proves a fact was recorded, but not that it was
recorded *correctly* or *freshly*. This package closes that with three securing refs, each a
deterministic, offline-recomputable content address. **Moves no funds; adds no new crypto.**

```
decision_audit_ref = "sha256:" + SHA-256(JCS({decision_ref, passport_credential_ref, mandate_ref, policy_bound_ref[, screen_binding_ref]}))
guard_context_ref  = "sha256:" + SHA-256(JCS({canon_version, type, guard_timestamp_ms, policy_ref, mandate_ref, passport_credential_ref}))
with_validity / check_freshness  -- attach + enforce an integer-millisecond validity window on any ref preimage
```

Each input is imported by hash. Swap the passport, the mandate, the policy, the screen, or the moment
and the ref diverges: a decision audited under policy P **does not recompute under a rotated policy P'**,
and a guard context is bound to the exact instant the gate evaluated it. Timestamps are epoch-millisecond
integers hashed directly (Substrate Rule 2) -- no floating point, no RFC 3339 strings.

## Lite vs commercial

| | Lite (this package) | [Keystone Secure](https://docs.algovoi.co.uk/keystone) |
|---|---|---|
| Licence | Apache-2.0, open | Commercial OEM |
| Hardening refs | content-addressed, recompute offline | same construction, **Falcon-1024 signed** |
| Evidence | bring your own | signed, hash-linked chain into the **Compliance Command Center** posture tiers |
| Enforcement | recompute + compare | **fail-closed** decision-audit, freshness, and guard-context enforcement |

The lite ref you pin is **byte-identical** to the ref the commercial tier signs: pin lite, anchor a
vector hash, carry the `NOTICE` → free v0 key; upgrade for post-quantum signing + CCC posture + enforcement.

## Install & use

```bash
pip install algovoi-keystone-secure-lite
```

```python
from algovoi_keystone_secure_lite import (
    decision_audit_ref, verify_decision_audit, guard_context_ref, with_validity, check_freshness,
)

# each input is imported by hash: a decision_ref, a passport_ref, a mandate_ref, a policy_bound_ref, a screen_ref
audit = decision_audit_ref(decision_ref, passport_ref, mandate_ref, policy_bound_ref, screen_binding_ref)
verify_decision_audit(audit, decision_ref, passport_ref, mandate_ref, policy_bound_ref, screen_binding_ref)  # True

# pin what the admission gate saw at a moment in time
gc = guard_context_ref(guard_timestamp_ms, policy_ref, mandate_ref, passport_ref)

# attach + enforce a validity window on any preimage
policy = with_validity({"required_scope": "payments.send"}, issued_at_ms=1_720_000_000_000, expires_at_ms=1_720_003_600_000)
check_freshness(policy, now_ms=1_720_000_060_000)   # True, inside the window
```

A decision audited under policy P returns a different `decision_audit_ref` if recomputed against the
`policy_bound_ref` under a rotated P'; rotation is detectable. Malformed refs and non-integer timestamps
are rejected, not hashed.

## Conformance

- `conformance/keystone_decision_audit_v1/`: 2 positives, 3 divergence/omission negatives, 1 rejection
  negative, 2 invariants.
- `conformance/keystone_guard_context_v1/`: 1 positive, 2 divergence negatives, 2 rejection negatives,
  2 invariants.

Each verifier imports only stdlib + `rfc8785`:

```bash
pip install rfc8785
python conformance/keystone_decision_audit_v1/verify.py
python conformance/keystone_guard_context_v1/verify.py
```

## Adopters

The 4-check gate is `scripts/check_v0_adoption.py` (dependency + canonical hash anchor + NOTICE + version
pin → ISSUE_V0_KEY). Apply: [chopmob@gmail.com](mailto:chopmob@gmail.com).

## License

Apache-2.0. Copyright 2026 AlgoVoi. Preserve the `NOTICE` in any distribution.
