HiveAttest

Issue a Pre-Action Attestation Manifest (C15: hive-passport). Signs with Ed25519 over RFC 8785 JCS-canonical body. Reference-grade implementation. Wire format normative; production-grade is Layer B.

{
  "type": "object",
  "properties": {
    "action_id": {
      "type": "string",
      "description": "Caller-supplied action correlation ID"
    },
    "agent_did": {
      "type": "string",
      "description": "DID of the attesting agent"
    },
    "intended_op": {
      "type": "string",
      "description": "Operation name, e.g. \"tool_invocation\""
    },
    "target_resource": {
      "type": "string",
      "description": "URI or identifier of the target resource"
    },
    "inputs": {
      "type": "object",
      "description": "Declared inputs (will be hashed)",
      "default": {}
    },
    "ttl_seconds": {
      "type": "integer",
      "description": "Validity window in seconds (default 300)",
      "default": 300
    }
  },
  "required": [
    "action_id",
    "agent_did",
    "intended_op",
    "target_resource"
  ]
}

Verify a Pre-Action Attestation Manifest (C15: hive-passport). Checks Ed25519 signature, temporal validity, and optionally observed inputs hash. Reference-grade implementation. Wire format normative; production-grade is Layer B.

{
  "type": "object",
  "properties": {
    "manifest": {
      "type": "object",
      "description": "Full passport manifest object (from attest_passport_issue)"
    },
    "observed_inputs": {
      "type": "object",
      "description": "Optional observed inputs to check against declared hash"
    }
  },
  "required": [
    "manifest"
  ]
}

Append a node to a custody chain (C16: hive-custody). Taint propagates: once tainted, always tainted. Reference-grade implementation. Wire format normative; production-grade is Layer B.

{
  "type": "object",
  "properties": {
    "chain_id": {
      "type": "string",
      "description": "Chain identifier (create new by using a fresh ID)"
    },
    "transform_id": {
      "type": "string",
      "description": "Transform identifier for this step"
    },
    "agent_did": {
      "type": "string",
      "description": "DID of the agent performing the transform"
    },
    "payload": {
      "type": "object",
      "description": "Transform payload (will be hashed)",
      "default": {}
    },
    "taint_status": {
      "type": "string",
      "enum": [
        "clean",
        "tainted",
        "unknown"
      ],
      "default": "clean",
      "description": "Declared taint status"
    }
  },
  "required": [
    "chain_id",
    "transform_id",
    "agent_did"
  ]
}

Verify a custody chain: hash linkage, Ed25519 signatures, and taint propagation (C16). Reference-grade implementation. Wire format normative; production-grade is Layer B.

{
  "type": "object",
  "properties": {
    "nodes": {
      "type": "array",
      "description": "Ordered array of custody chain node objects (from attest_custody_append responses)"
    }
  },
  "required": [
    "nodes"
  ]
}

Retrieve a Merkle inclusion proof for a specific node in a custody chain (C16). Reference-grade implementation. Wire format normative; production-grade is Layer B.

{
  "type": "object",
  "properties": {
    "chain_id": {
      "type": "string",
      "description": "Chain identifier"
    },
    "index": {
      "type": "integer",
      "description": "0-based node index"
    }
  },
  "required": [
    "chain_id",
    "index"
  ]
}

Register a versioned cargo type in the HiveAttest registry (C17: hive-cargo-taxonomy). Pins a definition hash for version-anchoring. Reference-grade implementation. Wire format normative; production-grade is Layer B.

{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "Unique cargo type ID, e.g. \"pii\""
    },
    "name": {
      "type": "string",
      "description": "Human-readable cargo type name"
    },
    "version": {
      "type": "string",
      "description": "Semver version string, e.g. \"1.0.0\""
    },
    "sensitivity": {
      "type": "string",
      "enum": [
        "public",
        "internal",
        "confidential",
        "restricted",
        "critical"
      ]
    },
    "schema": {
      "type": "object",
      "description": "JSON Schema defining the payload shape"
    },
    "supersedes": {
      "type": "object",
      "description": "Optional {id, version} of superseded type"
    }
  },
  "required": [
    "id",
    "name",
    "version",
    "sensitivity",
    "schema"
  ]
}

Validate a payload against a registered cargo type schema (C17). Reference-grade implementation. Wire format normative; production-grade is Layer B.

{
  "type": "object",
  "properties": {
    "cargo_type_id": {
      "type": "string",
      "description": "Registered cargo type ID"
    },
    "version": {
      "type": "string",
      "description": "Cargo type version"
    },
    "payload": {
      "type": "object",
      "description": "Payload to validate against the schema"
    }
  },
  "required": [
    "cargo_type_id",
    "version",
    "payload"
  ]
}

Get a registry snapshot with Merkle root for version pinning (C17). Reference-grade implementation. Wire format normative; production-grade is Layer B.

{
  "type": "object",
  "properties": {}
}

Issue an attestation warranty committing an agent to a claim (C18: hive-attestation-warranty). Signed with Ed25519. Reference-grade implementation. Wire format normative; production-grade is Layer B.

{
  "type": "object",
  "properties": {
    "agent_did": {
      "type": "string",
      "description": "DID of the warranting agent"
    },
    "action_id": {
      "type": "string",
      "description": "Action correlation ID being warranted"
    },
    "claim": {
      "type": "string",
      "description": "Human-readable warranty claim"
    },
    "scope": {
      "type": "object",
      "description": "Scope constraints",
      "default": {}
    },
    "expires_at": {
      "type": "string",
      "description": "ISO-8601 expiry UTC (optional)"
    }
  },
  "required": [
    "agent_did",
    "action_id",
    "claim"
  ]
}

Report a warranty breach. Marks the warranty as breached and returns a signed breach record (C18). Reference-grade implementation. Wire format normative; production-grade is Layer B.

{
  "type": "object",
  "properties": {
    "warranty_id": {
      "type": "string",
      "description": "Warranty ID to report breach on"
    },
    "breach_description": {
      "type": "string",
      "description": "Description of the breach"
    },
    "evidence": {
      "type": "object",
      "description": "Optional evidence dict"
    }
  },
  "required": [
    "warranty_id",
    "breach_description"
  ]
}

Retrieve a warranty by ID (C18). Reference-grade implementation. Wire format normative; production-grade is Layer B.

{
  "type": "object",
  "properties": {
    "warranty_id": {
      "type": "string",
      "description": "Warranty ID"
    }
  },
  "required": [
    "warranty_id"
  ]
}

THE HEADLINE TOOL. Evaluate whether an agent may proceed through the HiveAttest gate (C19: hive-gate-enforcer). Verifies passport signature + expiry, cargo registry membership, and warranty status. Every response (allow OR deny) includes a signed C18-format receipt of the gate decision. Reference-grade implementation. Wire format normative; production-grade is Layer B.

{
  "type": "object",
  "properties": {
    "passport_manifest": {
      "type": "object",
      "description": "C15 passport manifest from attest_passport_issue"
    },
    "cargo_manifest": {
      "type": "object",
      "description": "C17 cargo manifest (optional)"
    },
    "custody_root": {
      "type": "string",
      "description": "Expected custody chain Merkle root (optional)"
    },
    "warranty_ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Active warranty IDs to verify",
      "default": []
    },
    "context": {
      "type": "object",
      "description": "Additional gate evaluation context",
      "default": {}
    }
  },
  "required": [
    "passport_manifest"
  ]
}

Probabilistic secondary inspection of a record batch (C20: hive-secondary-inspection). Returns a signed inspection record. Reference-grade implementation. Wire format normative; production-grade is Layer B.

{
  "type": "object",
  "properties": {
    "sample_id": {
      "type": "string",
      "description": "Identifier for the sample batch"
    },
    "records": {
      "type": "array",
      "description": "Records to probabilistically inspect"
    },
    "sample_rate": {
      "type": "number",
      "minimum": 0,
      "maximum": 1,
      "default": 0.1,
      "description": "Fraction to inspect (0.0 to 1.0)"
    },
    "seed": {
      "type": "integer",
      "description": "Optional RNG seed for reproducibility"
    }
  },
  "required": [
    "sample_id",
    "records"
  ]
}

Verify a SMSH-Stamp v1 receipt (C8/C12: smsh-stamp-verifier). Validates schema, version, algorithm, timestamp, and Ed25519 signature. Reference-grade implementation. Wire format normative; production-grade is Layer B.

{
  "type": "object",
  "properties": {
    "receipt": {
      "type": "object",
      "description": "SMSH-Stamp v1 receipt object"
    },
    "pubkey_b64url": {
      "type": "string",
      "description": "Override trust anchor Ed25519 public key (base64url, 32 bytes)"
    },
    "max_age_seconds": {
      "type": "integer",
      "description": "Reject receipts older than this many seconds"
    }
  },
  "required": [
    "receipt"
  ]
}

Build a sorted Merkle tree for an audit window (enables cryptographic non-membership proofs, C13: prov-absence). Reference-grade implementation. Wire format normative; production-grade is Layer B.

{
  "type": "object",
  "properties": {
    "window_id": {
      "type": "string",
      "description": "Audit window identifier"
    },
    "events": {
      "type": "array",
      "description": "Observed events to commit to the sorted Merkle tree"
    }
  },
  "required": [
    "window_id",
    "events"
  ]
}

Prove that a query event is NOT a member of a previously-built audit window (C13). Reference-grade implementation. Wire format normative; production-grade is Layer B.

{
  "type": "object",
  "properties": {
    "window_id": {
      "type": "string",
      "description": "Audit window identifier (must have been built)"
    },
    "query": {
      "type": "object",
      "description": "Event to prove absent"
    }
  },
  "required": [
    "window_id",
    "query"
  ]
}

Verify a non-membership proof against an expected Merkle root (C13). Reference-grade implementation. Wire format normative; production-grade is Layer B.

{
  "type": "object",
  "properties": {
    "proof": {
      "type": "object",
      "description": "Non-membership proof from attest_absence_prove"
    },
    "root_hex": {
      "type": "string",
      "description": "Expected Merkle root (hex)"
    }
  },
  "required": [
    "proof",
    "root_hex"
  ]
}

Return HiveAttest layer/spec/patent metadata for all claims. Useful for agent introspection. Reference-grade implementation. Wire format normative; production-grade is Layer B.

{
  "type": "object",
  "properties": {}
}