User/jhendler/0.3.6 (#31)

* CHANGELOG.md

* dns

* fix

* fixing bootstrap

* fix race condition

* dilithium fix

* agent fixure

* dnssec not working

* dns

* dns agent verification from cli

* clean up observability

* change log

* keystore mod

* cleaned up key loading

* fixes

* fix tests

* warning cleanup

* changelog

* starting embeded mcp and http

* jacs mcp

* CHANGELOG.md

* doc

* tests

* jacsgp

* fixes in jacgo to run tests

* fix lint main issue

* readme

* a2a

* a2a

* bugfix

* misc fixes w/ libs and a2a

* changelog

* refactor filestysem read write

* cargo upgrade

* add a new post quantum algorithm for signing

* passing pq tests

* permission

* add jacsBranch

* a2a updates

* a2a updates

* updating a2a, rust, cleanup errors

* a2a updates

* cleanup code

* ignore

* Security fixes: PBKDF2 KDF, panic handling, verification status, file permissions

CRITICAL SECURITY FIXES:

1. [CRITICAL] Key derivation now uses PBKDF2-HMAC-SHA256 with 100,000 iterations
   instead of single SHA-256 hash. Previous approach was vulnerable to brute-force.
   - jacs/src/crypt/aes_encrypt.rs: Added derive_key_pbkdf2() with configurable
     iterations, salt generation, and proper key derivation
   - Added MAGIC_HEADER to distinguish new format from legacy encrypted keys
   - Backward compatible: auto-detects and reads legacy format

2. [CRITICAL] Crypto panic handling: Replaced .expect() with .map_err() in
   AES-GCM encrypt/decrypt. Crypto failures now return errors instead of panicking.
   - Prevents potential denial of service from malformed ciphertext

3. [HIGH] Foreign signature verification: verify_wrapped_artifact() now properly
   returns Unverified status for foreign agent signatures when public key is
   unavailable. Previously incorrectly indicated verified.
   - jacs/src/a2a/provenance.rs: Added VerificationStatus enum with Verified,
     SelfSigned, Unverified, Invalid states
   - Added is_verified(), is_invalid(), is_unverified() helper methods

4. [HIGH] Parent signature verification: verify_parent_signatures() now actually
   recursively verifies parent signatures instead of always returning true.

MEDIUM SECURITY FIXES:

5. [MEDIUM] jacsnpm global singleton: Refactored from lazy_static! mutex to
   JacsAgent NAPI class pattern. Multiple agents can now be used concurrently
   in same Node.js process without shared mutable state.
   - jacsnpm/src/lib.rs: Added JacsAgent struct with instance methods
   - Legacy functions preserved with LEGACY_AGENT static for backward compat

6. [MEDIUM] Secure file permissions: Private keys now get 0600 permissions
   (owner read/write only) and key directories get 0700 (owner rwx only) on
   Unix systems. Prevents other users from reading private keys.
   - jacs/src/keystore/mod.rs: Added set_secure_permissions() with Unix/non-Unix
     conditional compilation

OTHER CHANGES:

- Added serial_test crate for test isolation (prevents env var conflicts)
- Regenerated test encrypted key fixtures with correct passwords per config
- Updated CHANGELOG.md with all security fixes under 0.3.6

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* - **[MEDIUM] Fixed jacspy global singleton**: Refactored from global `lazy_static!` mutex to `JacsAgent` PyO3 class pattern. Multiple agents can now be used concurrently in the same Python process. The `Arc<Mutex<Agent>>` pattern ensures thread-safety and works with Python's GIL as well as future free-threading (Python 3.13+). Legacy functions preserved for backwards compatibility.
+

* openclaw?

* openclaw

* jacsnpm security updates

* fix test, doc

* cli for fetch

* moar openclaw

* update gooooo

* better test coverage

* start updating book

* update book

* books update

* update rust build versions

* fix test

* fix test

* fix defaults

* add test config for CI

* test fix

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Author: Hendler

.github/workflows/rust.yml

@@ -24,7 +24,12 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4 # Use v4
 
+    - name: Install Rust toolchain
+      uses: dtolnay/rust-toolchain@stable
+      with:
+        toolchain: '1.93'
+
     - name: Run jacs tests
       # Specify the working directory for the test command
-      working-directory: jacs 
-      run: cargo test --verbose
+      working-directory: jacs
+      run: cargo test --verbose --features cli

.github/workflows/static.yml

@@ -33,10 +33,16 @@ jobs:
         uses: actions/checkout@v4
       - name: Setup Pages
         uses: actions/configure-pages@v5
+      - name: Install mdbook
+        run: |
+          curl -L https://github.com/rust-lang/mdBook/releases/download/v0.4.37/mdbook-v0.4.37-x86_64-unknown-linux-gnu.tar.gz | tar xz
+          sudo mv mdbook /usr/local/bin/
+      - name: Build book
+        run: mdbook build jacs/docs/jacsbook
       - name: Upload artifact
         uses: actions/upload-pages-artifact@v3
         with:
-          path: './docs/jacsbook/book/'
+          path: './jacs/docs/jacsbook/book/'
       - name: Deploy to GitHub Pages
         id: deployment
         uses: actions/deploy-pages@v4

.gitignore

@@ -3,7 +3,7 @@
 debug/
 target/
 .idea
-
+jacs/documents/*
 # Remove Cargo.lock from gitignore if creating an executable, leave it for libraries
 # More information here https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html
 Cargo.lock
@@ -13,8 +13,9 @@ Cargo.lock
 
 # MSVC Windows builds of rustc generate these, which store debugging information
 *.pdb
-
+.cursor
 grant.md
 scratch.md
 jacs.config.json
+!jacs/jacs.config.json
 .DS_Store

A2A_QUICKSTART.md

@@ -0,0 +1,135 @@
+# JACS A2A Quick Start Guide
+
+JACS extends Google's A2A (Agent-to-Agent) protocol with cryptographic document provenance.
+
+## What JACS Adds to A2A
+
+- **Document signatures** that persist with data (not just transport security)
+- **Post-quantum cryptography** for future-proof security  
+- **Chain of custody** tracking for multi-agent workflows
+- **Self-verifying artifacts** that work offline
+
+## Installation
+
+```bash
+# Rust
+cargo add jacs
+
+# Python
+pip install jacs
+
+# Node.js
+npm install jacsnpm
+```
+
+## Basic Usage
+
+### 1. Export Agent to A2A Format
+
+```python
+from jacs.a2a import JACSA2AIntegration
+
+a2a = JACSA2AIntegration("jacs.config.json")
+agent_card = a2a.export_agent_card({
+    "jacsId": "my-agent",
+    "jacsName": "My Agent",
+    "jacsServices": [{
+        "name": "Process Data",
+        "tools": [{
+            "url": "/api/process",
+            "function": {
+                "name": "process",
+                "description": "Process data"
+            }
+        }]
+    }]
+})
+```
+
+### 2. Wrap A2A Artifacts with Provenance
+
+```javascript
+const { JACSA2AIntegration } = require('jacsnpm');
+const a2a = new JACSA2AIntegration();
+
+// Wrap any A2A artifact
+const wrapped = a2a.wrapArtifactWithProvenance({
+    taskId: 'task-123',
+    operation: 'analyze',
+    data: { /* ... */ }
+}, 'task');
+```
+
+### 3. Verify Wrapped Artifacts
+
+```rust
+use jacs::a2a::provenance::verify_wrapped_artifact;
+
+let result = verify_wrapped_artifact(&agent, &wrapped_artifact)?;
+if result.valid {
+    println!("Verified by: {}", result.signer_id);
+}
+```
+
+### 4. Create Chain of Custody
+
+```python
+# Track multi-step workflows
+step1 = a2a.wrap_artifact_with_provenance(data1, "step")
+step2 = a2a.wrap_artifact_with_provenance(data2, "step", [step1])
+step3 = a2a.wrap_artifact_with_provenance(data3, "step", [step2])
+
+chain = a2a.create_chain_of_custody([step1, step2, step3])
+```
+
+## Well-Known Endpoints
+
+Serve these endpoints for A2A discovery:
+
+- `/.well-known/agent.json` - A2A Agent Card (JWS signed)
+- `/.well-known/jacs-agent.json` - JACS agent descriptor
+- `/.well-known/jacs-pubkey.json` - JACS public key
+
+## JACS Extension in Agent Cards
+
+```json
+{
+  "capabilities": {
+    "extensions": [{
+      "uri": "urn:hai.ai:jacs-provenance-v1",
+      "description": "JACS cryptographic document signing",
+      "params": {
+        "supportedAlgorithms": ["dilithium", "rsa", "ecdsa"],
+        "verificationEndpoint": "/jacs/verify"
+      }
+    }]
+  }
+}
+```
+
+## Examples
+
+- **Rust**: [jacs/examples/a2a_complete_example.rs](./jacs/examples/a2a_complete_example.rs)
+- **Python**: [jacspy/examples/fastmcp/a2a_agent_server.py](./jacspy/examples/fastmcp/a2a_agent_server.py)
+- **Node.js**: [jacsnpm/examples/a2a-agent-example.js](./jacsnpm/examples/a2a-agent-example.js)
+
+## Key Concepts
+
+1. **Dual Keys**: JACS generates two key pairs:
+   - Post-quantum (Dilithium) for document signatures
+   - Traditional (RSA/ECDSA) for A2A compatibility
+
+2. **Separation of Concerns**:
+   - A2A handles discovery and transport
+   - JACS handles document provenance
+
+3. **Zero Trust**: Every artifact is self-verifying with complete audit trail
+
+## Next Steps
+
+1. Set up JACS configuration with keys
+2. Export your agent as A2A Agent Card
+3. Implement verification endpoints
+4. Register with A2A discovery services
+
+See full documentation: [jacs/src/a2a/README.md](./jacs/src/a2a/README.md)

CHANGELOG.md

@@ -11,6 +11,7 @@
 . ai.pydantic.dev
 - secure storage of private key for shared server envs https://crates.io/crates/tss-esapi, https://docs.rs/cryptoki/latest/cryptoki/
 - qr code integration
+- https://github.com/sourcemeta/one
 
 ## 0.4.0
 - Domain integration
@@ -22,20 +23,49 @@
    - load document whatever storage config is
    - function test output metadata about current config and current agent
 
+- [] add more feature flags for modular integrations
+- [] a2a integration
+- [] acp integration
+
+
 ## jacs-mcp 0.1.0
 
  - [] use rmcp
  - [] auth or all features
  - [] integration test with client
  - [] https://github.com/modelcontextprotocol/specification/discussions
 
+### devrel
+- [] github actions builder for auto build/deploy of platform specific versions
+--------------------
 
+- [] cli install for brew
+- [] cli install via shell script
+- [] open license
+ - [] api for easier integratios data processing 
+
+ - [] clickhous demo
+ - [] test centralized logging output without file output 
+ 
 --------------------
 
 ## 0.3.7
 
-### devrel
-- [] github actions builder for auto build/deploy of platform specific versions
+### internals
+
+- [x] Updated A2A integration to protocol v0.4.0: rewrote AgentCard schema (protocolVersions array, supportedInterfaces, embedded JWS signatures, SecurityScheme enum, AgentSkill with id/tags), updated well-known path to agent-card.json, and aligned Rust, Python, and Node.js bindings with passing tests across all three.
+- [] remove in memory map if users don't request it. Refactor and DRY storage to prep for DB storage
+- [] test a2a across libraries
+- [] store in database
+- [] awareness of branch, merge, latest for documents. 
+
+### hai.ai
+
+- integration with 
+
+ 1. register
+ 2. 
+
 
 ### jacsnpm
 
@@ -59,11 +89,12 @@
       1. cli create agent 
       2. config jacspy to load each agent
  - [] github actions builder for linux varieties
+ - [] switch to uv from pip/etc
 
 ### JACS core
- - [] acp integration
+ 
  - [] brew installer, review installation instrucitons,  cli install instructions. a .sh command?
- - [] a2a integration
+ - [] more a2a tests
  - [] ensure if a user wants standard logging they can use that
 
 
@@ -78,33 +109,7 @@
  ### minor core
 - [] don't store  "jacs_private_key_password":  in config, don't display
 - [] minor feature - no_save = false should save document and still return json string instead of message on create document
-
---------------------
-
-## 0.3.6
-
-
-### devex
-
-- [] add more feature flags for modular integrations
-- [] a2a integration
-- [] acp integration
-- [] add updates to book
-- [] cli install for brew
-- [] cli install via shell script
-- [] open license
-- [] crew.ai
-- [] langchain
-
-### jacs
-
- - [] redesign api for easier bootstrapping
- - [] PKI choice (dkim, ke)
- - [] private key bootstrapping with vault, kerberos - filesystem
- - [] api for easier integratios data processing 
- - [x] add observability to configuration
-
- - [] test centralized logging output without file output 
+ - [] default to dnssec if domain is present - or WARN
 
 ### jacsmcp
 
@@ -115,14 +120,56 @@
 - [] refactor api
 - [] publish to pipy 
 - [] tracing and logging integration tests
-- [] switch to uv from pip/etc
+
 
 ### jacsnpm
 
 - [] publish to npm
 - [] tracing and logging integration tests
 
 
+==== 
+## 0.3.6
+
+### Security
+
+- **[CRITICAL] Fixed key derivation**: Changed from single SHA-256 hash to proper PBKDF2-HMAC-SHA256 with 100,000 iterations for deriving encryption keys from passwords. The previous single-hash approach was vulnerable to brute-force attacks.
+
+- **[CRITICAL] Fixed crypto panic handling**: Replaced `.expect()` with proper `.map_err()` error handling in AES-GCM encryption/decryption. Crypto failures now return proper errors instead of panicking, which could cause denial of service.
+
+- **[HIGH] Fixed foreign signature verification**: The `verify_wrapped_artifact` function now properly returns `Unverified` status for foreign agent signatures when the public key is not available, rather than incorrectly indicating signatures were verified. Added `VerificationStatus` enum to explicitly distinguish between `Verified`, `SelfSigned`, `Unverified`, and `Invalid` states.
+
+- **[HIGH] Fixed parent signature verification**: The `verify_parent_signatures` function now actually verifies parent signatures recursively. Previously it always returned true regardless of verification status.
+
+- Added `serial_test` for test isolation to prevent environment variable conflicts between tests.
+
+- Added `regenerate_test_keys.rs` utility example for re-encrypting test fixtures with the new KDF.
+
+- **[MEDIUM] Fixed jacsnpm global singleton**: Refactored from global `lazy_static!` mutex to `JacsAgent` NAPI class pattern. Multiple agents can now be used concurrently in the same Node.js process. Legacy functions preserved for backwards compatibility but marked deprecated.
+
+- **[MEDIUM] Fixed jacspy global singleton**: Refactored from global `lazy_static!` mutex to `JacsAgent` PyO3 class pattern. Multiple agents can now be used concurrently in the same Python process. The `Arc<Mutex<Agent>>` pattern ensures thread-safety and works with Python's GIL as well as future free-threading (Python 3.13+). Legacy functions preserved for backwards compatibility.
+
+- **[MEDIUM] Added secure file permissions**: Private keys now get 0600 permissions (owner read/write only) and key directories get 0700 (owner rwx only) on Unix systems. This prevents other users on shared systems from reading private keys.
+
+### devex
+- [x] add updates to book
+- [x] add observability demo
+
+### jacs
+ - [x] a2a integration
+- [x] clean up observability
+   - Observability: added feature-gated backends (`otlp-logs`, `otlp-metrics`, `otlp-tracing`) and optional `observability-convenience`. Default build is minimal (stderr/file logs only), no tokio/OpenTelemetry; clear runtime errors if a requested backend isn’t compiled. Docs now include a feature matrix and compile recipes. Tests updated and all pass with features.
+
+ - [x] dns verification of pubic key hash
+      - DNS: implemented fingerprint-in-DNS (TXT under `_v1.agent.jacs.<domain>.`), CLI emitters for BIND/Route53/Azure/Cloudflare, DNSSEC validation with non-strict fallback, and config flags (`jacs_agent_domain`, `jacs_dns_validate`, `jacs_dns_strict`, `jacs_dns_required`). Added CLI flags `--require-dns`, `--require-strict-dns`, `--ignore-dns`, and `--no-dns` (alias preserved). Improved error messages, updated docs, and added policy/encoding tests.
+
+ 
+ - [x] scaffold private key bootstrapping with vault, kerberos - filesystem
+
+
+
+
+
 --------------------
 
 ## 0.3.5

Cargo.toml

@@ -1,19 +1,19 @@
 [workspace]
 members = [
-    "jacs",   
-    "jacsnpm",       
-     # "mcp-server",      
-    "jacspy"          
+    "jacs",
+    "jacsnpm",
+    "jacspy",
+    "jacs-mcp",
+    "jacsgo/lib"
 ]
 resolver = "3"
-rust-version = "1.85"
-
 
+[workspace.package]
+rust-version = "1.93"
 readme = "README.md"
 authors = ["HAI.AI <engineering@hai.io>"]
 license-file = "LICENSE"
 homepage = "https://humanassisted.github.io/JACS"
 repository = "https://github.com/HumanAssisted/JACS"
 keywords = ["cryptography", "json", "ai", "data", "ml-ops"]
-categories = ["cryptography", "text-processing", "data-structures" ]
-build = "build.rs"
+categories = ["cryptography", "text-processing", "data-structures"]