Skip to content

Agent Passports: signed audit trails and a text control plane for OpenClaw/Hermes (0337) - #533

Merged
crs48 merged 12 commits into
mainfrom
claude/0337-agent-passport-audit-trail
Jul 18, 2026
Merged

Agent Passports: signed audit trails and a text control plane for OpenClaw/Hermes (0337)#533
crs48 merged 12 commits into
mainfrom
claude/0337-agent-passport-audit-trail

Conversation

@crs48

@crs48 crs48 commented Jul 18, 2026

Copy link
Copy Markdown
Owner

Implements exploration 0337: external agents (OpenClaw, Hermes, Claude Code, …) become first-class, scoped, auditable identities in xNet.

What landed

  • @xnetjs/data — agent schema pack: AgentPassport, AgentSession, AgentAction, AgentApproval (stores only a nonce hash), AgentNotification, with deterministic-id helpers (DebugReport LWW-upsert pattern) and redactInstruction. Exported through the schemas sub-barrel per the 0276 policy; Tier-2 seed auto-generator covers all five (seed-coverage test green).
  • @xnetjs/identity — mintAgentPassport (fresh did:key + operator-signed UCAN; wildcard capabilities rejected at mint — the 0307 weakness cannot re-enter through this door), verifyAgentPassport, and rootIssuers for delegation-chain inspection.
  • @xnetjs/hub — trustedDids config: when set, a presented UCAN must chain to a trusted root, so self-issued {with:'*', can:'*'} tokens are rejected (first real consumer of the 0307 fix; legacy behavior preserved when unset). Per-author change index (idx_node_changes_author_lamport) + GET /audit/authors/:did/changes (self-reads free; others need audit/read).
  • @xnetjs/plugins — AgentAuditRecorder: every AI-surface tool call lands as an AgentAction node; risk-tiered ceremony (low = run, medium = chat APPROVE <nonce> with 5-min TTL, high/critical = xNet-surface only — no nonce exists, so the chat path is mechanically incapable of releasing them); xnet_approve / xnet_deny / xnet_pending_approvals / xnet_undo (honors reversibility) / xnet_poll_notifications (hub→operator outbox); wired via MCPServerConfig.agentAudit.
  • @xnetjs/cli — xnet agent enroll <name> --space <id> (passport to ~/.xnet/agents, 0600; prints OpenClaw + Hermes config snippets) and xnet mcp serve --agent <name> [--db <path>] (agent-signed local store — the change log is the tamper-evident half of the trail).
  • @xnetjs/devtools — Agent Audit panel: per-agent action table (risk/status/approval/change ids) with detail pane, live via store.subscribe.
  • Docs: integration guide + ClawHub/Hermes skill updated with the enrollment flow and ceremony script.

Validation

  • 42 new tests across data/identity/hub/plugins/cli/devtools; full suites for the six touched packages green (2,136 + 755 + 607 + 53 tests), typecheck green.
  • Tamper test (run): tampered payload fails verifyChangeHash; re-hashed forgery fails verifyChange — the hub runs both before appendNodeChange.
  • Author-index (run): EXPLAIN shows SEARCH … USING INDEX idx_node_changes_author_lamport; paging one agent's 5,000 changes out of a 100k-row log takes ~17 ms.
  • Ceremony: nonce expiry, wrong-nonce rejection, chat-cannot-release-high-risk, operator-signed app approvals, undo/refusal — all covered by tests.
  • Honest caveat: the "real OpenClaw gateway / Telegram / Hermes gateway" validation items were exercised at the MCP protocol surface (the exact wire OpenClaw and Hermes speak — enroll → serve → tools/call → pending → approve), not against a live gateway install; the printed config snippets match both gateways' documented formats.

🤖 Generated with Claude Code

xNet Test and others added 10 commits July 17, 2026 18:49
xNet Test @claude
docs(exploration): explore OpenClaw/Hermes integration, signed agent …
2328dd1 
…audit trails, and text control plane (0337)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: xNet Test <test@xnet.dev>
xNet Test @claude
feat(data): agent schema pack — AgentPassport, AgentSession, AgentAct…
1f1393f 
…ion, AgentApproval, AgentNotification (0337)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: xNet Test <test@xnet.dev>
xNet Test @claude
feat(identity): agent passport minting + rootIssuers delegation-chain…
6029f22 
… helper (0337)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: xNet Test <test@xnet.dev>
xNet Test @claude
feat(hub): trusted-root UCAN policy + per-author audit index and /aud…
952a3b1 
…it routes (0337)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: xNet Test <test@xnet.dev>
xNet Test @claude
feat(plugins): agent audit recorder, risk-tiered approval ceremony, u…
7cee86d 
…ndo, and outbox tools on the MCP surface (0337)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: xNet Test <test@xnet.dev>
xNet Test @claude
feat(cli): xnet agent enroll + agent-scoped mcp serve with agent-sign…
eff45e1 
…ed local store (0337)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: xNet Test <test@xnet.dev>
xNet Test @claude
feat(devtools): Agent Audit panel — per-agent action table with appro…
c8194cb 
…val trail (0337)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: xNet Test <test@xnet.dev>
xNet Test @claude
docs: agent passport enrollment, ceremony script, and Hermes section …
b988fa2 
…in skill + integration guide (0337)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: xNet Test <test@xnet.dev>
xNet Test @claude
docs(changelog): changeset + changelog fragment for agent passports (…
0a4a1de 
…0337)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: xNet Test <test@xnet.dev>
xNet Test @claude
docs(exploration): check off openclaw hermes integration signed agent…
cf6132a 
… audit trails and text control plane

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: xNet Test <test@xnet.dev>
@crs48
crs48 temporarily deployed to pr-533 July 18, 2026 02:22 — with GitHub Actions Inactive
xNet Test @claude
style: prettier formatting for 0337 files
91d9972 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: xNet Test <test@xnet.dev>
@crs48
crs48 temporarily deployed to pr-533 July 18, 2026 02:27 — with GitHub Actions Inactive
github-actions Bot added a commit that referenced this pull request Jul 18, 2026
@github-actions
deploy(preview): publish PR #533 preview
eeb077e
github-actions Bot added a commit that referenced this pull request Jul 18, 2026
@github-actions
deploy(preview): publish PR #533 demos preview
3b6c239
@github-actions

github-actions Bot commented Jul 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Preview removed for PR #533.

xNet Test @claude
fix(plugins): drop unused destructure in agent tool registration (lint)
5406ab6 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: xNet Test <test@xnet.dev>
@crs48
crs48 temporarily deployed to pr-533 July 18, 2026 02:35 — with GitHub Actions Inactive
github-actions Bot added a commit that referenced this pull request Jul 18, 2026
@github-actions
deploy(preview): publish PR #533 preview
3ac951a
github-actions Bot added a commit that referenced this pull request Jul 18, 2026
@github-actions
deploy(preview): publish PR #533 demos preview
9673fa3
@crs48
crs48 merged commit 56e70f8 into main Jul 18, 2026
21 checks passed
@crs48
crs48 deleted the claude/0337-agent-passport-audit-trail branch July 18, 2026 02:48
github-actions Bot added a commit that referenced this pull request Jul 18, 2026
@github-actions
deploy(preview): remove PR #533 preview
bf31bac
xnet-changelog-bot Bot pushed a commit that referenced this pull request Jul 18, 2026
@github-actions
docs(changelog): link PR #533 to its fragment [skip ci]
7d089c5
@github-actions github-actions Bot mentioned this pull request Jul 18, 2026
Merged
crs48 added a commit that referenced this pull request Jul 18, 2026
@crs48
chore(release): version packages (#526)
b3f9d1b 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @xnetjs/cli@0.2.0

### Minor Changes

- [#533](#533)
[`0a4a1de`](0a4a1de)
Thanks [@crs48](https://github.com/crs48)! - Agent Passports and signed
agent audit trails (exploration 0337).
- `@xnetjs/data`: new agent schema pack — `AgentPassport`,
`AgentSession`,
`AgentAction`, `AgentApproval`, `AgentNotification` — with deterministic
id
    helpers (`agentActionId`, …) and `redactInstruction`.
- `@xnetjs/identity`: `mintAgentPassport` / `verifyAgentPassport`
(per-agent
    `did:key` + operator-delegated, attenuation-checked UCAN; wildcards
    rejected) and `rootIssuers` for delegation-chain root inspection.
- `@xnetjs/plugins`: `AgentAuditRecorder` wraps the AI surface so every
tool
call lands as an `AgentAction` node and medium+ risk calls park behind a
risk-tiered approval ceremony (chat nonce with TTL for medium;
xNet-surface
only for high/critical); ceremony tools (`xnet_approve`, `xnet_deny`,
`xnet_pending_approvals`, `xnet_undo`) and the `xnet_poll_notifications`
outbox tool; `MCPServerConfig.agentAudit` wires it into the MCP server;
`NodeStoreAPI.create` now accepts an optional deterministic `id`; new AI
    scopes `agent.approve` and `agent.notifications`.
  - `@xnetjs/cli`: `xnet agent enroll <name>` mints and stores passports
(`~/.xnet/agents`, 0600) and prints OpenClaw/Hermes config; `xnet mcp
serve
--agent <name> [--db <path>]` serves an agent-scoped session over an
    agent-signed local store.

### Patch Changes

- Updated dependencies
[[`0a4a1de`](0a4a1de),
[`fa93e2f`](fa93e2f)]:
  - @xnetjs/data@2.1.0
  - @xnetjs/identity@2.1.0
  - @xnetjs/plugins@2.1.0
  - @xnetjs/runtime@0.5.1
  - @xnetjs/sync@2.1.0
  - @xnetjs/sqlite@2.1.0
  - @xnetjs/crypto@2.1.0
  - @xnetjs/core@2.1.0
## @xnetjs/data@2.1.0

### Minor Changes

- [#533](#533)
[`0a4a1de`](0a4a1de)
Thanks [@crs48](https://github.com/crs48)! - Agent Passports and signed
agent audit trails (exploration 0337).
- `@xnetjs/data`: new agent schema pack — `AgentPassport`,
`AgentSession`,
`AgentAction`, `AgentApproval`, `AgentNotification` — with deterministic
id
    helpers (`agentActionId`, …) and `redactInstruction`.
- `@xnetjs/identity`: `mintAgentPassport` / `verifyAgentPassport`
(per-agent
    `did:key` + operator-delegated, attenuation-checked UCAN; wildcards
    rejected) and `rootIssuers` for delegation-chain root inspection.
- `@xnetjs/plugins`: `AgentAuditRecorder` wraps the AI surface so every
tool
call lands as an `AgentAction` node and medium+ risk calls park behind a
risk-tiered approval ceremony (chat nonce with TTL for medium;
xNet-surface
only for high/critical); ceremony tools (`xnet_approve`, `xnet_deny`,
`xnet_pending_approvals`, `xnet_undo`) and the `xnet_poll_notifications`
outbox tool; `MCPServerConfig.agentAudit` wires it into the MCP server;
`NodeStoreAPI.create` now accepts an optional deterministic `id`; new AI
    scopes `agent.approve` and `agent.notifications`.
  - `@xnetjs/cli`: `xnet agent enroll <name>` mints and stores passports
(`~/.xnet/agents`, 0600) and prints OpenClaw/Hermes config; `xnet mcp
serve
--agent <name> [--db <path>]` serves an agent-scoped session over an
    agent-signed local store.

### Patch Changes

- Updated dependencies
[[`0a4a1de`](0a4a1de)]:
  - @xnetjs/identity@2.1.0
  - @xnetjs/sync@2.1.0
  - @xnetjs/storage@2.1.0
  - @xnetjs/sqlite@2.1.0
  - @xnetjs/crypto@2.1.0
  - @xnetjs/core@2.1.0
## @xnetjs/identity@2.1.0

### Minor Changes

- [#533](#533)
[`0a4a1de`](0a4a1de)
Thanks [@crs48](https://github.com/crs48)! - Agent Passports and signed
agent audit trails (exploration 0337).
- `@xnetjs/data`: new agent schema pack — `AgentPassport`,
`AgentSession`,
`AgentAction`, `AgentApproval`, `AgentNotification` — with deterministic
id
    helpers (`agentActionId`, …) and `redactInstruction`.
- `@xnetjs/identity`: `mintAgentPassport` / `verifyAgentPassport`
(per-agent
    `did:key` + operator-delegated, attenuation-checked UCAN; wildcards
    rejected) and `rootIssuers` for delegation-chain root inspection.
- `@xnetjs/plugins`: `AgentAuditRecorder` wraps the AI surface so every
tool
call lands as an `AgentAction` node and medium+ risk calls park behind a
risk-tiered approval ceremony (chat nonce with TTL for medium;
xNet-surface
only for high/critical); ceremony tools (`xnet_approve`, `xnet_deny`,
`xnet_pending_approvals`, `xnet_undo`) and the `xnet_poll_notifications`
outbox tool; `MCPServerConfig.agentAudit` wires it into the MCP server;
`NodeStoreAPI.create` now accepts an optional deterministic `id`; new AI
    scopes `agent.approve` and `agent.notifications`.
  - `@xnetjs/cli`: `xnet agent enroll <name>` mints and stores passports
(`~/.xnet/agents`, 0600) and prints OpenClaw/Hermes config; `xnet mcp
serve
--agent <name> [--db <path>]` serves an agent-scoped session over an
    agent-signed local store.

### Patch Changes

- Updated dependencies []:
  - @xnetjs/crypto@2.1.0
  - @xnetjs/core@2.1.0
## @xnetjs/plugins@2.1.0

### Minor Changes

- [#533](#533)
[`0a4a1de`](0a4a1de)
Thanks [@crs48](https://github.com/crs48)! - Agent Passports and signed
agent audit trails (exploration 0337).
- `@xnetjs/data`: new agent schema pack — `AgentPassport`,
`AgentSession`,
`AgentAction`, `AgentApproval`, `AgentNotification` — with deterministic
id
    helpers (`agentActionId`, …) and `redactInstruction`.
- `@xnetjs/identity`: `mintAgentPassport` / `verifyAgentPassport`
(per-agent
    `did:key` + operator-delegated, attenuation-checked UCAN; wildcards
    rejected) and `rootIssuers` for delegation-chain root inspection.
- `@xnetjs/plugins`: `AgentAuditRecorder` wraps the AI surface so every
tool
call lands as an `AgentAction` node and medium+ risk calls park behind a
risk-tiered approval ceremony (chat nonce with TTL for medium;
xNet-surface
only for high/critical); ceremony tools (`xnet_approve`, `xnet_deny`,
`xnet_pending_approvals`, `xnet_undo`) and the `xnet_poll_notifications`
outbox tool; `MCPServerConfig.agentAudit` wires it into the MCP server;
`NodeStoreAPI.create` now accepts an optional deterministic `id`; new AI
    scopes `agent.approve` and `agent.notifications`.
  - `@xnetjs/cli`: `xnet agent enroll <name>` mints and stores passports
(`~/.xnet/agents`, 0600) and prints OpenClaw/Hermes config; `xnet mcp
serve
--agent <name> [--db <path>]` serves an agent-scoped session over an
    agent-signed local store.

- [#525](#525)
[`fa93e2f`](fa93e2f)
Thanks [@crs48](https://github.com/crs48)! - Add the workspace-plugin
runtime (exploration 0331): author, hot-load, and
compose plugins whose source lives in the workspace as a `PluginSource`
node.
New public surface: `PluginSourceSchema` + `readPluginSourceNode`, an
in-browser
module builder (`buildPluginModuleGraph`) with a pinned import map, the
`SandboxedPluginHost` (`activateWorkspacePlugin`) that loads plugin code
only in
  an opaque-origin iframe and registers data-declared contributions over
MessagePort RPC, a gated store RPC (`createPluginStoreRpc`,
denylist-wins), a
250ms-debounce hot reloader (`createWorkspacePluginHotReloader`),
content-hash
pinning + drift diffing (`computePluginSourceHash`,
`assessPluginUpdate`), the
  `plugin_*` agent tools (`createWorkspacePluginAgentTools`) and the
`WRITING_XNET_PLUGINS_SKILL_MD` authoring skill, and both publish paths
(`requestWorkspacePluginPublish`, `buildCommunityRegistryEntry`).
`MCPServerConfig`
gains an `extraTools` field to expose the new tools beside the
built-ins.

### Patch Changes

- Updated dependencies
[[`0a4a1de`](0a4a1de)]:
  - @xnetjs/data@2.1.0
  - @xnetjs/abuse@2.1.0
  - @xnetjs/core@2.1.0
## @xnetjs/react@2.1.0

### Minor Changes

- [#534](#534)
[`5473a29`](5473a29)
Thanks [@crs48](https://github.com/crs48)! - `useGridDatabase` now pages
database rows through a growing window instead of a fixed 500-row page:
new `fetchMoreRows()` grows the window by `pageSize` (default 500) up to
`maxLoaded` (default 2000, configurable via options), and the result
exposes `totalRowCount` (exact matching count), `hasMoreRows`, and
`isFetchingMoreRows` so grids can render honest totals and infinite
scroll. Existing consumers keep working unchanged — rows still arrive
sorted by `sortKey` on the live query path.

### Patch Changes

- Updated dependencies
[[`0a4a1de`](0a4a1de),
[`fa93e2f`](fa93e2f)]:
  - @xnetjs/data@2.1.0
  - @xnetjs/identity@2.1.0
  - @xnetjs/plugins@2.1.0
  - @xnetjs/data-bridge@2.1.0
  - @xnetjs/history@2.1.0
  - @xnetjs/runtime@0.5.1
  - @xnetjs/sync@2.1.0
  - @xnetjs/crypto@2.1.0
  - @xnetjs/core@2.1.0
## @xnetjs/abuse@2.1.0

### Patch Changes

- Updated dependencies
[[`0a4a1de`](0a4a1de)]:
  - @xnetjs/identity@2.1.0
  - @xnetjs/crypto@2.1.0
## @xnetjs/crypto@2.1.0

### Patch Changes

- Updated dependencies []:
  - @xnetjs/core@2.1.0
## @xnetjs/data-bridge@2.1.0

### Patch Changes

- Updated dependencies
[[`0a4a1de`](0a4a1de)]:
  - @xnetjs/data@2.1.0
  - @xnetjs/sync@2.1.0
  - @xnetjs/sqlite@2.1.0
  - @xnetjs/core@2.1.0
## @xnetjs/history@2.1.0

### Patch Changes

- Updated dependencies
[[`0a4a1de`](0a4a1de)]:
  - @xnetjs/data@2.1.0
  - @xnetjs/sync@2.1.0
  - @xnetjs/core@2.1.0
## @xnetjs/runtime@0.5.1

### Patch Changes

- Updated dependencies
[[`0a4a1de`](0a4a1de),
[`fa93e2f`](fa93e2f)]:
  - @xnetjs/data@2.1.0
  - @xnetjs/identity@2.1.0
  - @xnetjs/plugins@2.1.0
  - @xnetjs/data-bridge@2.1.0
  - @xnetjs/history@2.1.0
  - @xnetjs/sync@2.1.0
  - @xnetjs/storage@2.1.0
  - @xnetjs/crypto@2.1.0
  - @xnetjs/core@2.1.0
## @xnetjs/storage@2.1.0

### Patch Changes

- Updated dependencies []:
  - @xnetjs/sqlite@2.1.0
  - @xnetjs/crypto@2.1.0
  - @xnetjs/core@2.1.0
## @xnetjs/sync@2.1.0

### Patch Changes

- Updated dependencies
[[`0a4a1de`](0a4a1de)]:
  - @xnetjs/identity@2.1.0
  - @xnetjs/crypto@2.1.0
  - @xnetjs/core@2.1.0
## @xnetjs/core@2.1.0


## @xnetjs/sqlite@2.1.0


## xnet-cloud@0.0.19

### Patch Changes

- Updated dependencies []:
  - @xnetjs/telemetry@0.0.1
  - @xnetjs/crypto@2.1.0
  - @xnetjs/core@2.1.0
  - @xnetjs/cloud@0.0.1
## xnet-demos@0.1.3

### Patch Changes

- Updated dependencies
[[`0a4a1de`](0a4a1de),
[`5473a29`](5473a29)]:
  - @xnetjs/data@2.1.0
  - @xnetjs/identity@2.1.0
  - @xnetjs/react@2.1.0
  - @xnetjs/devtools@0.1.0
## @xnetjs/brain@0.0.20

### Patch Changes

- Updated dependencies
[[`0a4a1de`](0a4a1de)]:
  - @xnetjs/data@2.1.0
  - @xnetjs/vectors@0.0.1
## @xnetjs/comms@0.0.20

### Patch Changes

- Updated dependencies
[[`0a4a1de`](0a4a1de)]:
  - @xnetjs/data@2.1.0
  - @xnetjs/crypto@2.1.0
## @xnetjs/dashboard@0.0.20

### Patch Changes

- Updated dependencies
[[`0a4a1de`](0a4a1de),
[`5473a29`](5473a29),
[`fa93e2f`](fa93e2f)]:
  - @xnetjs/data@2.1.0
  - @xnetjs/plugins@2.1.0
  - @xnetjs/react@2.1.0
  - @xnetjs/social@0.0.20
## @xnetjs/labs@0.0.20

### Patch Changes

- Updated dependencies
[[`0a4a1de`](0a4a1de),
[`fa93e2f`](fa93e2f)]:
  - @xnetjs/data@2.1.0
  - @xnetjs/plugins@2.1.0
## @xnetjs/licenses@0.0.20

### Patch Changes

- Updated dependencies []:
  - @xnetjs/crypto@2.1.0
## @xnetjs/maps@0.0.20

### Patch Changes

- Updated dependencies
[[`0a4a1de`](0a4a1de)]:
  - @xnetjs/data@2.1.0
## @xnetjs/meetings@0.0.13

### Patch Changes

- Updated dependencies
[[`0a4a1de`](0a4a1de),
[`fa93e2f`](fa93e2f)]:
  - @xnetjs/data@2.1.0
  - @xnetjs/plugins@2.1.0
## @xnetjs/server@0.0.19

### Patch Changes

- Updated dependencies
[[`0a4a1de`](0a4a1de)]:
  - @xnetjs/data@2.1.0
  - @xnetjs/identity@2.1.0
  - @xnetjs/data-bridge@2.1.0
  - @xnetjs/crypto@2.1.0
## @xnetjs/social@0.0.20

### Patch Changes

- Updated dependencies
[[`0a4a1de`](0a4a1de)]:
  - @xnetjs/data@2.1.0
  - @xnetjs/crypto@2.1.0
## @xnetjs/unreal@0.0.20

### Patch Changes

- Updated dependencies
[[`0a4a1de`](0a4a1de)]:
  - @xnetjs/data@2.1.0
## xnet-desktop@2.1.0

Desktop shell release riding the @xnetjs/core 2.1.0 train.
Desktop-specific changes are not tracked here; see the core packages'
changelogs for what shipped.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@crs48