Activate a reviewed tool

python -m pip install https://docs.soterias.io/downloads/api-preview/soterias_local-0.1.0rc5%2Bapi2-cp311-abi3-win_amd64.whl

npm install https://docs.soterias.io/downloads/api-preview/soterias-core-0.1.0-rc.5-api.2.tgz
npm install --save-dev typescript@5.8.3 @types/node@24

import json
import os
from pathlib import Path
import tempfile
from soterias import security


def save_artifact(name, data):
    # The operator supplies an existing private parent; create files without replacement.
    descriptor = os.open(output / name, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
    with os.fdopen(descriptor, "wb") as stream:
        stream.write(data)
        stream.flush()
        os.fsync(stream.fileno())

import assert from 'node:assert/strict';
import fs from 'node:fs';
import os from 'node:os';
import path from 'node:path';
import { security } from '@soterias/core';

# %% Open an operator-provisioned registry against its retained checkpoint
# Only the trusted administrator holds this token, unlock and custody path.
root = Path(os.environ["SOTERIAS_ROOT"])
read = lambda name: (root / name).read_bytes()
checkpoint = Path(os.environ["SOTERIAS_CHECKPOINT"]).read_bytes()
output = Path(os.environ["SOTERIAS_OUTPUT"])
with security.Registry.open(root / "registry", signing_store_path=root / "keys",
        configuration=read("configuration.json"), human_token=read("human.json"),
        checkpoint=checkpoint, passphrase=os.environ["SOTERIAS_UNLOCK"].encode()) as registry:

// %% Open an operator-provisioned registry against its retained checkpoint
// Only the trusted administrator holds this token, unlock and custody path.
const root = process.env.SOTERIAS_ROOT!;
const read = (name: string) => fs.readFileSync(path.join(root, name));
const output = process.env.SOTERIAS_OUTPUT!;
const registry = security.Registry.open({ registryPath: path.join(root, 'registry'),
  signingStorePath: path.join(root, 'keys'), configuration: read('configuration.json'),
  humanToken: read('human.json'), checkpoint: fs.readFileSync(process.env.SOTERIAS_CHECKPOINT!),
  passphrase: Buffer.from(process.env.SOTERIAS_UNLOCK!) });
try {

    # %% Activate the complete signed review
    # Rust checks the review signature and advances the persistent registry generation.
    next_checkpoint = registry.activate(read("review.json"))
    save_artifact("checkpoint.json", next_checkpoint)

  // %% Activate the complete signed review
  // Rust checks the review signature and advances the persistent registry generation.
  const checkpoint = registry.activate(read('review.json'));
  fs.writeFileSync(path.join(output, 'checkpoint.json'), checkpoint, { flag: 'wx', mode: 0o600 });

    # %% Describe the reviewed argument and resource mapping
    # An activated description is data; it cannot authorize or execute an effect.
    descriptor = json.loads(registry.describe(read("request.json")))
    assert descriptor["current_permission"] is False
    print(json.dumps({"status": "PASS", "current_permission": False,
                      "effect_category": descriptor["effect"]["category"],
                      "evidence_directory": str(output)}))

  // %% Describe the reviewed argument and resource mapping
  // An activated description is data; it cannot authorize or execute an effect.
  const descriptor = JSON.parse(registry.describe(read('request.json')).toString());
  assert.equal(descriptor.current_permission, false);
  console.log(JSON.stringify({ status: 'PASS', current_permission: false,
    effect_category: descriptor.effect.category, evidence_directory: output }));
} finally { registry.close(); }

import fs from 'node:fs';
import path from 'node:path';
import { security } from '@soterias/core';
import { listenAccountingHttp } from '@soterias/mcp-server/accounting-http';

// %% Open the operator-selected native owner
// Enrollment, tool review, warrants and exact operation approval happen beforehand.
const root = process.env.SOTERIAS_ROOT;
const read = name => fs.readFileSync(path.join(root, name));
const owner = security.Host.open({ root, custody: process.env.SOTERIAS_CUSTODY,
  configuration: read('configuration.json'),
  checkpoint: fs.readFileSync(process.env.SOTERIAS_CHECKPOINT),
  passphrase: Buffer.from(process.env.SOTERIAS_UNLOCK) });

// %% Start a loopback host with authenticated native admission
// The agent cannot replace the policy, custody or signed approval through a tool call.
let listener;
try {
  listener = await listenAccountingHttp(owner, {
    transportPolicy: read('transport-policy.json'),
    operationApproval: read('operation-approval.json'),
  });
  const token = owner.issueTransportCredential().toString('base64url');
  fs.writeFileSync(process.env.SOTERIAS_CONNECTION,
    JSON.stringify({url: listener.url, token}), {flag: 'wx', mode: 0o600});
} catch (error) { owner.close(); throw error; }

// %% Retain the acknowledged checkpoint when shutting down
// Keep this output independently of the writable host and signing custody.
let stopping;
function stop() {
  stopping ??= (async () => {
    await listener.close();
    fs.writeFileSync(process.env.SOTERIAS_NEXT_CHECKPOINT, listener.checkpoint(),
      {flag: 'wx', mode: 0o600});
  })();
  return stopping;
}
for (const signal of ['SIGINT', 'SIGTERM']) process.once(signal, () => {
  void stop().catch(() => { process.stderr.write('host_shutdown_failed\n'); process.exitCode = 1; });
});
// A parent process can close this control stream for orderly local shutdown.
process.stdin.resume();
process.stdin.once('end', () => { void stop(); });

import fs from 'node:fs';
import { Client, StreamableHTTPClientTransport } from '@modelcontextprotocol/client';

// %% Connect to an operator-configured protected MCP host
// The token is scoped to execution. Reviewer keys never enter this client.
const client = new Client({ name: 'invoice-assistant', version: '1.0.0' });
const transport = new StreamableHTTPClientTransport(new URL(process.env.SOTERIAS_MCP_URL),
  { requestInit: { headers: { Authorization: 'Bearer ' + process.env.SOTERIAS_MCP_TOKEN },
    redirect: 'error', credentials: 'omit' } });
try {
  await client.connect(transport);

  // %% Execute through the native host's real accounting tool
  // The host selects routes and approval evidence; the tool receives a request.
  const requestJson = fs.readFileSync(process.env.SOTERIAS_REQUEST, 'utf8');
  const result = await client.callTool({ name: 'execute_accounting', arguments: { requestJson } });
  if (result.isError) throw new Error('Protected tool refused the request');
  const content = result.content.find(block => block.type === 'text');
  if (!content || content.type !== 'text') throw new Error('Expected an accounting outcome');
  const outcome = JSON.parse(content.text);

  // %% Inspect the outcome instead of treating transport success as business success
  // Verify original receipts separately with your own retained trust.
  console.log(JSON.stringify({ status: outcome.status, target_observed: outcome.targetObserved }));
} finally { await client.close(); }