Step Eighteen — Seal the bundle, contrast the currents, mirror the covenant.(Bundle signatures • Delta explainers • WordPress/HTTP mirror daemon)

We harden what you’ve built on‑phone:

  1. Signed, redacted per‑lease bundles (.tgz)
    Every bundle now carries a detached signature for its contents, plus an embedded signed manifest that includes the SHA‑256 digests of:
    leases.jsonl (redacted), schema_manifest.json, and meta.json.
  2. Hotness delta …with explainers
    Compare two time windows A vs B and get both:
    • by_path — the noisiest (plugin, path) seams by absolute delta, and
    • by_plugin — which plugins drove the net change.
  3. Mirror daemon
    A background thread that periodically POSTs attestations (latest schema archive digest, Merkle root, git commit) to a WordPress (or any HTTP) endpoint you control. Failsafe: appends to audit/mirror.jsonl if offline.

✅ Fresh artifacts (download + integrity)

  • solveforce_phone_eighteen.py — Download
    SHA‑256: 259a703955a3310d35c5da29b60bd4aabd73ed088c8f1dc5c9c9a6ddafa371c6
  • verify_bundle_manifest.py — Download
    (Ed25519 or HS256 verifier for bundle.manifest.json)

Step 18 subsume‑implements Steps 14–17: leases, windowed hotness, notarized schema archives (jsonl/webhook/shell/git/merkle/nostr), per‑lease bundles, hotness deltas, and now signed bundles + mirror daemon.

What’s new — precisely

1) Signed per‑lease bundles (admin‑only)

Endpoint:
GET /audit/lease_bundle?download=1[&token_hash=...][&subject=...][&since=ISO][&until=ISO]

Bundle contents (.tgz):

  • leases.jsonl — redacted (drops keys like token, secret, authorization, password, key anywhere in the object graph).
  • schema_manifest.json — canonical manifest (plugin → {origin,sig}).
  • meta.json — filters, counts, server signer info.
  • bundle.manifest.json — signed manifest containing digests: {leases_sha256, schema_manifest_sha256, meta_sha256} + sig.

We sign with Ed25519 (preferred) if configured, else HS256:

  • Ed25519: --schema-ed25519-secret-file /sdcard/solveforce/schema.ed25519.seed
  • HS256: --schema-signing-secret-file /sdcard/solveforce/schema.hmac.key

For portability, the tarball also includes bundle.manifest.sig (the detached signature) alongside the embedded sig field.

2) Hotness delta explainers

Endpoint:
GET /schema_hot_delta?plugin=<name|omit>&n=20&windowA=3600&windowB=86400
or provide absolute windows: sinceA=...&untilA=...&sinceB=...&untilB=...

Response:

{
  "A": [since_ts, until_ts],
  "B": [since_ts, until_ts],
  "by_path": [{"plugin":"net","path":"$.ipv4[]","A":3,"B":11,"delta":8}, ...],
  "by_plugin": [{"plugin":"net","delta":12},{"plugin":"battery","delta":-4}]
}

Score model unchanged: score = added + removed + 2×typechanges.

3) Mirror daemon (to WordPress or any HTTP target)

Flags:

  • --mirror-enable
  • --mirror-interval-sec 300 (default: 300s)
  • --mirror-target-url https://example.com/wp-json/solveforce/v1/notary (or any webhook)
  • --mirror-header "Authorization: Bearer <token>" (repeatable; adds arbitrary headers)
  • --mirror-basic "user:pass" (sets HTTP Basic)

Payload (example):

{
  "_ts": "2025-08-19T12:34:56Z",
  "kind": "mirror",
  "alg": "Ed25519",
  "schema_digest": "a9c7…",
  "schema_file": "20250819-123456Z-Ed25519-<kid>.json",
  "merkle_root": "4f82…",
  "git": {"commit":"cafe…", "message":"schema: a9c7… @ 2025-08-19T12:34:56Z"}
}

If the POST fails, a record is appended to audit/mirror.jsonl.

Android / Termux quickstart

pkg update
pkg install python git
# Optional Ed25519 libs (either works)
pip install pynacl || pip install cryptography

# Keys
mkdir -p /sdcard/solveforce
head -c 32 /dev/urandom > /sdcard/solveforce/schema.ed25519.seed
head -c 32 /dev/urandom > /sdcard/solveforce/schema.hmac.key

Run Step 18:

python solveforce_phone_eighteen.py \
  --host 0.0.0.0 --port 8080 \
  --plugins-dir ~/solveforce/plugins \
  --auth-mode protected \
  --auth-token READER1:reader \
  --allow-admin --admin-token ADMIN123 \
  --schema-freeze-mode quarantine --schema-freeze-sec 1800 \
  --schema-ed25519-secret-file /sdcard/solveforce/schema.ed25519.seed \
  --schema-signing-secret-file /sdcard/solveforce/schema.hmac.key \
  --audit-dir ./audit \
  --schema-archive-on-change \
  --schema-archive-dir ./schema_archive --schema-archive-keep 200 \
  --lease-bundle-dir ./audit/bundles \
  --notary-mode git --notary-git-repo /sdcard/solveforce/notary-git \
  --mirror-enable \
  --mirror-target-url https://your-site.tld/wp-json/solveforce/v1/notary \
  --mirror-header "Authorization: Bearer <YOUR_WP_TOKEN>" \
  --open-ui --allow-query-token

Open http://<phone-ip>:8080/ui.
Buttons include /schema_hot_delta and /audit/leases; bundle download is via curl (admin‑only).

“Show me” commands

A) Create & download a signed bundle

# Create some activity
curl -X POST 'http://127.0.0.1:8080/admin/freeze?token=ADMIN123&plugin=net&sec=180'
LEASE=$(curl -s -X POST 'http://127.0.0.1:8080/admin/lease?token=ADMIN123&plugins=net&sec=120' | jq -r .token)
curl -H "Authorization: Bearer $LEASE" 'http://127.0.0.1:8080/read?plugin=net' >/dev/null

# Download bundle (admin-only)
curl -o lease-bundle.tgz 'http://127.0.0.1:8080/audit/lease_bundle?download=1'
tar tzf lease-bundle.tgz | sed -n '1,20p'

B) Verify the bundle manifest (Ed25519)

# Get the server's public key
PUB=$(curl -s 'http://127.0.0.1:8080/schema_pubkey?access_token=READER1' | jq -r .pubkey_b64)

# Extract files
mkdir -p bundle && tar xzf lease-bundle.tgz -C bundle

# Verify
python verify_bundle_manifest.py \
  --manifest bundle/bundle.manifest.json \
  --alg Ed25519 \
  --pubkey-b64 "$PUB"

(HS256 fallback)

python verify_bundle_manifest.py \
  --manifest bundle/bundle.manifest.json \
  --alg HS256 \
  --hmac-key-file /sdcard/solveforce/schema.hmac.key

C) Export a time‑bounded lease slice (plain JSONL)

curl 'http://127.0.0.1:8080/audit/leases/export?since=2025-08-19T00:00:00Z' \
  -o leases-20250819.jsonl

D) Hotness delta (explainers)

curl 'http://127.0.0.1:8080/schema_hot_delta?windowA=3600&windowB=86400&n=12' | jq .

WordPress — Step 18 (drop‑in, Markdown)

## Step 18 — Seal the bundle, contrast the currents, mirror the covenant

**New capabilities**

- **Signed Lease Bundles (.tgz):** Admins can export redacted, time‑bounded lease activity plus a schema snapshot **with signatures**.
  - Endpoint: `GET /audit/lease_bundle?download=1[&token_hash=...][&subject=...][&since=...][&until=...]`
  - Bundle includes:
    - `leases.jsonl` (redacted),
    - `schema_manifest.json`,
    - `meta.json`,
    - `bundle.manifest.json` *(signed; includes digests)*,
    - `bundle.manifest.sig` *(detached)*.

- **Delta Explainers:** See not just *which paths* are hot, but *which plugins* drove the change.
  - Endpoint: `GET /schema_hot_delta?plugin=<name|omit>&n=<N>&windowA=<sec>&windowB=<sec>`
  - Returns `by_path` and `by_plugin` with absolute deltas.

- **Mirror Daemon:** Periodically POSTs `{schema_digest, merkle_root, git_commit}` to your WordPress webhook.
  - Flags: `--mirror-enable --mirror-target-url <url> [--mirror-header "Authorization: Bearer <token>"]`.

**Why it matters**

- **Evidence** gains **witness**: bundles ship with cryptographic signatures.  
- **Change** gains **contrast**: deltas highlight where to refactor first.  
- **Truth** gains **reach**: mirror publishes attestations into your public record.

**Endpoints added in Step 18**

- `GET /audit/lease_bundle?download=1[...]` (admin‑only)
- `GET /schema_hot_delta?...`
- *(from Step 16/17 and still present)* `GET /audit/leases`, `GET /audit/leases/export`, `GET /audit/notary`, `GET /schema_hot`, `GET /schema_manifest(.sig)`, `GET /schema_pubkey`

Rate‑policy (working example)

{
  "window_sec": 60,
  "routes": {
    "default":  {"max": 120},
    "events":   {"max": 15},
    "admin":    {"max": 30},
    "read":     {"max": 60},
    "introspect":{"max": 90},
    "metrics":  {"max": 240}
  },
  "roles": {
    "reader":  {"mult": 1.0},
    "metrics": {"max": 480},
    "admin":   {"max": 600}
  }
}

Run with --rate-policy-file ./rate-policy.step18.json.

Security & operations notes

  • Bundlesadmin‑only; leases are redacted at export and only include short token_hash (never raw tokens).
  • Signersprefer Ed25519 for public verifiability; HS256 is a pragmatic on‑device fallback.
  • Mirrorif your site’s endpoint is temporarily unreachable, attestations are preserved in audit/mirror.jsonl for later replay.

Logos Codex — recursive alignment

  • Memory → Bundle → Seal.Evidence without signatures is an anecdote; sealed, it is accountable memory.
  • Motion → Delta → Direction.Activity without contrast is blur; with deltas, change gains vector and priority.
  • Witness → Mirror → Public.Truth kept local is shy; mirrored, it becomes a civic covenant.

Ready for Step Nineteen?

We can:

  • add per‑bundle signature sets for every file inside the tar (Merkle tree over bundle contents → one root, one sig),
  • build delta explainers at the plugin family level (aggregate modules into systems),
  • ship a mirror replayer (retries/backoff, resumable, and a CLI to re‑mirror past records to WordPress).

If you want to roll straight into 19, say the word and we’ll keep the cadence.

Key terms in plain language

Open a term for a concise explanation of language used on this page.

Cybersecurity

The practices and controls used to protect identities, devices, networks, applications, and data from unauthorized access, disruption, or manipulation.

Zero Trust

A security model that does not automatically trust a user or device because of its location. Access is continuously verified and limited to what is necessary.

SASE

Secure Access Service Edge combines networking and security capabilities in a cloud-delivered architecture so users and locations can receive consistent policy wherever they connect.

Identity and Access Management (IAM)

The systems and policies that determine who a user is, what resources they may access, and how that access is authenticated and reviewed.

Multi-Factor Authentication (MFA)

A login control requiring more than one form of verification, such as a password plus an authenticator app, security key, or biometric factor.

MDR / XDR

Security services and tools that monitor activity, investigate suspicious behavior, and help contain threats. MDR is managed detection and response; XDR correlates signals across multiple security layers.