electricwolfemarshmallowhypertext · Sep 29, 2026 · Sep 29, 2026 · Sep 29, 2026 · Oct 24, 2026 · Oct 24, 2026
diff --git a/.dockerignore b/.dockerignore
@@ -0,0 +1,30 @@
+*
+!Dockerfile
+!requirements-cli.txt
+!requirements-server.txt
+!apps/
+!apps/api/
+!apps/api/src/
+!apps/api/src/**
+!cli/
+!cli/**
+!schemas/
+!schemas/**
+!public/
+!public/**
+!AGENTS.md
+!agentmd.yaml
+!skills/
+!skills/**
+!memory/
+!memory/**
+!policies/
+!policies/**
+!evals/
+!evals/**
+**/__pycache__/
+**/*.pyc
+**/.env
+**/.env.*
+**/*.pem
+**/*.key
diff --git a/.gitignore b/.gitignore
@@ -1,4 +1,4 @@
-venv/
+venv/
 __pycache__/
 .pytest_cache/
 .tmp/
@@ -21,3 +21,8 @@ data/
 !examples/lead-artifacts/**
 !examples/lead-output/
 !examples/lead-output/**
+
+# Local audit planning
+TODO.local.md
+.agentmd/identity/
+.agentmd/verification/
diff --git a/Dockerfile b/Dockerfile
@@ -0,0 +1,33 @@
+FROM python:3.11-slim
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=on \
+    PIP_NO_CACHE_DIR=on
+
+RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+COPY requirements-cli.txt requirements-server.txt ./
+RUN python -m pip install -r requirements-server.txt
+
+COPY apps/api/src ./apps/api/src
+COPY cli ./cli
+COPY schemas ./schemas
+COPY public ./public
+COPY AGENTS.md agentmd.yaml ./
+COPY skills ./skills
+COPY memory ./memory
+COPY policies ./policies
+COPY evals ./evals
+
+RUN useradd -u 10001 -m appuser \
+    && mkdir -p /app/receipts /app/.agentmd /app/.sticky /data/memory \
+    && chown -R appuser:appuser /app /data
+USER appuser
+
+EXPOSE 8000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+    CMD curl -fsS http://127.0.0.1:8000/health || exit 1
+CMD ["uvicorn", "apps.api.src.main:app", "--host", "0.0.0.0", "--port", "8000"]
diff --git a/PROJECT_STATUS.md b/PROJECT_STATUS.md
@@ -1,91 +1,46 @@
-# PROJECT_STATUS
+# PROJECT_STATUS
 
-## AgentMD Runtime security-hardening branch
+Status date: 2026-10-25. Local integration branch `codex/integrate-reviewed-fixes`; no new release is implied.
 
-Status date: 2026-09-28
+## Product and implemented behavior
 
-## Product framing
+AgentMD governs local context, normalizes tool-run artifacts and writes reproducible packets/receipts. The CLI performs real filesystem/schema/hash operations. `run` executes an explicit caller-provided local command with real terminal status and hash-only output receipts; it does not guess provider flags or pretend an adapter ran.
 
-**AI Work Lead**: AgentMD compiles scattered AI/tool run artifacts into one deterministic, verified current-state packet with proof receipts.
+- Published baseline: `v0.3.0-alpha.3`, `6602fc4874c1824faa4d2fd23d3ec560fd39db21`.
+- Historical September 29 Windows CI: 41 CLI tests plus scanner, dependency checks and demo. That historical result does not clear new advisories.
+- October review branch corrects final packet hashing, RFC3339 validation/ordering, failed workspace gates, bundle preflight/rollback, secret-key diagnostics and terminal-loop recommendations.
+- Additional defensive changes: nested workspace-root checks, receipt-chain continuity, zero-evidence honesty and real explicit-command execution.
+- Local compiler outputs: `.sticky/current-state.json`, `.sticky/current-state.md`, `.sticky/receipts/*.jsonl`.
+- Actual-checkout verification: `python -m cli.agentmd run --task "verify this checkout" -- python scripts/verify_local.py`, then compile `.agentmd/verification/run.lead-artifact.json`.
 
-Deployment model: **deployment-agnostic** (local, repo, CI, cloud, enterprise).
+## What verification establishes
 
-Current strongest claim:
+Acceptance is correct results on real local work, rejection without inconsistent outputs, source/packet/receipt hash agreement, and truthful process outcomes—not a test-count target. Parser/security regressions deliberately use synthetic inputs. Current commands and limitations are in `docs/proof_note.md` and `docs/local_execution.md`.
 
-- AgentMD compiles scattered AI/tool run artifacts into one deterministic current-state packet with proof receipts.
+## Remaining blockers and non-goals
 
-## What exists now
+- Sentence Transformers 6.0.0 and the isolated memory engine passed actual offline model/storage validation, including persistence/fallback/backup and model contract checks; the coupled OpenTelemetry/Firestore update passed offline dependency/client/serialization checks. These are scoped runtime checks, not full production API assurance.
+- Real local MiniLM CPU inference was run using an approved pinned safetensors snapshot. No paid model-provider calls, provider credentials, hosted auth/account actions or cloud deployments were run.
+- Skill edits verify supplied score/receipt/hash consistency, not the evaluator's truth or actual improvement; no optimizer/benchmark engine is implemented.
+- Imported claims remain source assertions; hashes are not authentication or truth verification.
+- Signed, append-only identity history remains implemented separately from work state. Execution/Lead receipts remain unsigned; no external notarization, production-SaaS assurance or multi-user execution isolation.
+- Windows/Python 3.12.10 integration verification: 87 CLI tests passed, one POSIX-only interruption test skipped; doctor, wrapper demo, real local execution and repeat compilation passed. Python 3.11 and complete Windows process-tree containment remain unverified.
+- Account credential rotation/revocation and review/signature enforcement are not established by source cleanup.
 
-- `agentmd lead compile` ingests `.json` / `.jsonl` artifacts via repeatable `--artifact` flags.
-- Lead Artifact input contract is versioned as **Lead Artifact v1** (`schema_version: "lead-artifact.v1"`).
-- Schema validation is strict and requires `jsonschema` (pinned in `requirements-cli.txt`).
-- Invalid artifacts fail with explicit schema errors.
-- Artifact paths, sizes, record counts, nesting, secrets, and output mutation boundaries are checked before writes.
-- Lead receipts bind source hashes, chain to prior valid receipts, and treat source identity as asserted rather than authenticated.
-- Accepted skill edits require a hash-bound `skill-validation.v1` receipt and may only mutate workspace-local `skills/*/SKILL.md`.
-- Runtime outputs are emitted to:
-  - `.sticky/current-state.json`
-  - `.sticky/current-state.md`
-  - `.sticky/receipts/*.jsonl`
-- Demo artifacts live in:
-  - `examples/lead-artifacts/`
-- Example outputs live in:
-  - `examples/lead-output/`
-- CI reproducibility workflow exists:
-  - `AgentMD Lead Demo` (`.github/workflows/agentmd-lead-demo.yml`)
+No push, merge, tag or release is authorized by this local repair.
 
-## Exact CLI demo command
+## Integration verification on 2026-10-25
 
-```powershell
-.\agentmd.cmd lead compile --task "compile ai work lead state" --artifact examples/lead-artifacts/run-codex.jsonl --artifact examples/lead-artifacts/run-claude.json --artifact examples/lead-artifacts/run-gemini.jsonl
-```
+- Imported repair commits `352b84a` and `ee1fb8c` from the supplied bundle after checking all archive SHA256 entries. Preserved identity commit `1400df6` and its tests.
+- CLI/CI hash-lock audit and API direct-pin audit reported no known vulnerabilities. API direct-pin auditing does not verify a fully installed transitive environment.
+- Local `apps.api.src.memory.server:app` startup and HTTP requests to `/health`, `/agentmd/results`, `/dashboard/agentmd-results.html`, and `/openapi.json` passed (200) using disposable SQLite storage. API smoke dependencies were installed in an ignored venv inheriting system packages; this is not a clean full-stack deployment qualification.
+- `scripts/verify_local.py` completed through the real runner. Compiling its actual artifact twice produced byte-identical current-state JSON and Markdown and hash `ba24cb9711cc8586959624b827e96a13ab9fe3209b05cdb956acc617eb7c67ad`.
+- Startup fixes verified: added the root `Dockerfile`, a restricted build context and `requirements-server.txt`. `apps.api.src.main` now forwards to the existing memory/results server; it no longer imports incomplete legacy provider wiring. This does not restore legacy chat/provider routes.
+- Live-provider calls were not made. Existing provider-registry defaults are legacy model identifiers; no current live-test model or hosted destination is designated. Credential values were not printed.
+- Native model/storage tests were not rerun: the approved model snapshot is absent. The review package's Linux model evidence remains a separate prior verification claim.
+## Docker startup verification on 2026-10-25
 
-## Output artifacts
-
-Runtime outputs:
-
-- `.sticky/current-state.json`
-- `.sticky/current-state.md`
-- `.sticky/receipts/*.jsonl`
-
-Example/shareable outputs:
-
-- `examples/lead-output/current-state.example.json`
-- `examples/lead-output/current-state.example.md`
-
-## Verification commands and results
-
-Commands:
-
-```powershell
-python -m py_compile cli/agentmd.py
-python -m pytest -q tests/agentmd/test_agentmd_cli.py
-.\scripts\demo-lead-compile.ps1
-```
-
-Results:
-
-- `py_compile`: PASS
-- `pytest`: PASS (`36 passed`)
-- demo script: PASS
-
-## Published checkpoints
-
-- `v0.2.0`: AI Work Lead + Lead Artifact v1 checkpoint.
-- `v0.3.0-alpha.2`: gated skill edit alpha published before the September 2026 security audit.
-- The local hardening branch is not a release until public `main` is remediated and fresh CI passes.
-
-## Intentionally out of scope
-
-- SaaS platform features
-- dashboard expansion/redesign
-- tool-specific adapters
-- auth/accounts
-- cloud service layer
-- agent swarm behavior
-- persona marketplace/product surfacing
-- unrelated runtime refactors
-
-## Next recommended technical step (NOT IMPLEMENTED)
-
-Remediate public `main`, rotate/audit repository credentials and integrations, then run fresh CI and `AgentMD Lead Demo` proof. Do not tag until those gates pass.
+- Docker was started by the operator. A clean Python 3.11 image built successfully from the root Dockerfile; `pip check` passed and an audit of its installed package freeze reported no known vulnerabilities.
+- An isolated Compose project with fresh Redis/SQLite volumes and disposable secrets became healthy. `/health`, `/agentmd/results`, `/dashboard/agentmd-results.html` and `/openapi.json` returned HTTP 200. A real Redis ping passed; container-generated context and receipts appeared in the results API.
+- Two isolated API startup regressions passed both on Windows and inside the clean image. The CLI suite remains 87 passed, 1 POSIX-only test skipped on Windows.
+- Provider packages/credentials are unnecessary for this server. No provider was initialized or called. PostgreSQL migration, remote hosting and live model integrations remain unverified.
diff --git a/README.md b/README.md
@@ -1,28 +1,25 @@
-# AgentMD Runtime
+# AgentMD Runtime
 
 [![CI](https://github.com/electricwolfemarshmallowhypertext/agentmd-runtime/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/electricwolfemarshmallowhypertext/agentmd-runtime/actions/workflows/ci.yml)
 [![AgentMD Lead Demo](https://github.com/electricwolfemarshmallowhypertext/agentmd-runtime/actions/workflows/agentmd-lead-demo.yml/badge.svg?branch=main)](https://github.com/electricwolfemarshmallowhypertext/agentmd-runtime/actions/workflows/agentmd-lead-demo.yml)
 [![Latest Release](https://img.shields.io/github/v/release/electricwolfemarshmallowhypertext/agentmd-runtime?display_name=tag)](https://github.com/electricwolfemarshmallowhypertext/agentmd-runtime/releases)
 
-**AgentMD compiles scattered AI/tool runs into one verified current-state packet.**
+**AgentMD compiles AI/tool run evidence into a reproducible current-state packet.**
 
-It compiles scattered AI/tool runs into one verified current-state packet, with schema validation, deterministic hashes, and proof receipts.
+Schema validation, deterministic hashes and receipts establish local integrity—not the truth of imported claims or authenticated provider identity.
 
 ![AgentMD Flow](docs/assets/agentmd-flow.png)
 
 ## Proof
 
-- Current public release: `v0.3.0-alpha.2`
-- `v0.2.0`: AI Work Lead checkpoint
-- `v0.3.0-alpha.2`: CI-verified alpha with gated skill edit primitive
-- Published alpha CI status predates the September 2026 security audit
-- Local security-hardening branch tests: `36 passed`
-- Public `main` remediation and fresh CI proof are required before the next release
-- Deterministic demo script: `scripts/demo-lead-compile.ps1`
-- Lead Artifact schema validation is enforced (`schemas/lead-artifact.schema.json`)
-- Lead receipts include chained hashes, source artifact hashes, replay resistance, and advisory `trust-weight.v1` metadata
-- Source identity is asserted, not authenticated; AgentMD does not convert self-reported status into an authorization score
-- Technical proof note: `docs/proof_note.md`
+- Public release baseline: `v0.3.0-alpha.3`, commit `6602fc4874c1824faa4d2fd23d3ec560fd39db21` (September 29, 2026).
+- Its historical Windows CI and demo passed with 41 targeted CLI tests; that is not a current dependency-safety guarantee.
+- October fixes on this review branch are local/unreleased. See `docs/proof_note.md` for outcome-based verification and remaining blockers.
+- The compiler, file hashes, receipts and bounded skill edits are real local operations.
+- `run` now executes caller-specified argv locally; provider-specific integrations are not implemented or verified.
+- Example provider-named artifacts are fixtures, not evidence of calls to Codex, Claude or Gemini.
+- Source identity is asserted, not authenticated; `what_is_true` means source-reported verified claims, never an authorization score.
+- The isolated memory engine now has real offline MiniLM/Chroma/SQLite validation; see `docs/embedding_validation.md`. This does not establish full legacy API/production readiness.
 
 ## Trust & adoption docs
 
@@ -32,6 +29,8 @@ It compiles scattered AI/tool runs into one verified current-state packet, with
 - `docs/determinism.md`
 - `docs/receipt_integrity.md`
 - `docs/threat_model.md`
+- `docs/identity_state.md`
+- `docs/embedding_validation.md`
 - `SECURITY.md`
 
 ## Problem
@@ -51,7 +50,7 @@ task
 
 ## AI Work Lead
 
-`agentmd lead compile` turns scattered run artifacts into one verified operating picture with deterministic hashing and proof receipts.
+`agentmd lead compile` turns scattered run artifacts into one evidence-labelled operating picture with deterministic hashing and proof receipts.
 
 ![Verified Current-State Packet](docs/assets/current-state-packet.png)
 
@@ -76,7 +75,8 @@ Lead Artifact is the portable input contract for any tool (Codex, Claude, Gemini
 
 - Schema: `schemas/lead-artifact.schema.json`
 - Required version field: `schema_version: "lead-artifact.v1"`
-- Strict validation dependency: `jsonschema`
+- Strict validation dependency: `jsonschema`; calendar/timezone validation is built in and does not rely on optional format extras
+- RFC3339 offsets and arbitrary fractional seconds are ordered chronologically; leap-second timestamps are rejected explicitly
 - Invalid artifacts fail compile with explicit schema errors
 - Artifact paths stay inside the workspace and hostile inputs are size/depth bounded
 - High-confidence credential patterns fail closed before outputs are written
@@ -106,15 +106,35 @@ Scope intentionally not implemented yet:
 - multi-epoch benchmark loop
 - autonomous self-editing runtime
 
+## Durable Agent Identity
+
+AgentMD can preserve a continuing agent identity separately from the current
+state of work. Identity versions are immutable, hash-chained, and signed with
+an external Ed25519 key that AgentMD never stores.
+
+- Commands: `agentmd identity init|verify|history|apply|rollback|export|import`
+- Schemas: `agent-identity.v1`, `identity-change.v1`, and `identity-envelope.v1`
+- Storage: `.agentmd/identity/records/*.json`
+- Rollback appends a new signed version; it never deletes history
+- Export/import uses a signed envelope and requires explicit fingerprint trust
+- Identity changes are schema-validated, secret-scanned, and atomically written
+
+Identity answers "which continuing agent is this?" The AI Work Lead packet
+continues to answer "what is currently true about the work?" The two states
+remain separate. See `docs/identity_state.md` for the trust model and key
+custody requirements.
+
 ## Core Commands
 
 ```powershell
 .\agentmd.cmd doctor
 .\agentmd.cmd resolve --task "review this repo for context drift"
 .\agentmd.cmd receipt
-.\agentmd.cmd run --adapter codex --task "review this repo for context drift"
+.\agentmd.cmd run --task "verify this checkout" -- python scripts/verify_local.py
 .\agentmd.cmd lead compile --task "compile ai work lead state" --artifact examples/lead-artifacts/run-codex.jsonl --artifact examples/lead-artifacts/run-claude.json --artifact examples/lead-artifacts/run-gemini.jsonl
 .\agentmd.cmd skill apply-edit --edit edits/validated-skill-edit.json
+.\agentmd.cmd identity verify --trust-fingerprint "sha256:<trusted-fingerprint>"
+.\agentmd.cmd identity history
 ```
 
 ## Quickstart
@@ -130,12 +150,38 @@ python -m pytest -q tests/agentmd/test_agentmd_cli.py
 .\scripts\demo-lead-compile.ps1
 ```
 
+For real local evidence (not the canned parser demo):
+
+```bash
+python -m cli.agentmd run --task "verify this checkout" -- python scripts/verify_local.py
+python -m cli.agentmd lead compile --artifact .agentmd/verification/run.lead-artifact.json
+```
+
+The verification command runs the CLI checks, records actual Git diff/status and log hashes, and verifies selected context bytes before emitting its artifact. A zero-input compile reports zero evidence, never an invented run. See `docs/local_execution.md` for process, privacy, failure and sandbox boundaries.
+
 CI installs from `requirements-ci.lock` with package hashes and runs dependency and repository security scans. Trust scoring is advisory metadata; it never grants execution permission.
 
+## API Startup
+
+The existing results API runs without a model-provider account:
+
+```powershell
+python -m pip install -r requirements-server.txt
+python -m uvicorn apps.api.src.main:app --host 127.0.0.1 --port 8011
+```
+
+Open `/dashboard/agentmd-results.html`; its data comes from `/agentmd/results`.
+`apps.api.src.main:app` and `apps.api.src.memory.server:app` expose the same server.
+The former incomplete legacy chat/provider startup is not used.
+
+For containers, build from the repository root with `docker build -t agentmd-runtime .`.
+The existing `docker-compose.yml` uses this Dockerfile and Redis; supply its declared
+`secrets/api_keys.txt` and `secrets/fernet.key` before running `docker compose up -d --build`.
+The image includes the results API and CLI dependencies, not the optional local-model or provider runtimes.
 ## License
 
 AgentMD Runtime is source-available under **BUSL-1.1**.
 
 Commercial production use, hosted service use, resale, embedding into commercial products, or offering substantially similar functionality as a service requires a commercial license from the Licensor.
 
-See `LICENSE`, `LICENSE.md`, and `NOTICE`.
+See `LICENSE`, `LICENSE.md`, and `NOTICE`.