sint-protocol AGENTS.md

SINT Protocol — AI Agent Guide

This file is optimized for AI agents (LLMs) working in this codebase. For human contributor guidance, see CONTRIBUTING.md. For implementation details and pitfalls, see CLAUDE.md.

What This Repo Does

SINT Protocol is a security enforcement layer that sits between AI agents and physical systems (robots, PLCs, drones, tool calls), ensuring every action is authorized via capability tokens, constrained to safe physical limits, and recorded in a tamper-evident audit log. It is a pnpm monorepo with 30 workspace members built on TypeScript 5.7 + Node.js 22.

Key Invariants (Never Violate These)

1. Every authorization decision flows through PolicyGateway.intercept() — no bridge or route handler makes authorization decisions directly
2. Tokens are attenuation-only: scope(child) ⊆ scope(parent) — permissions only narrow, never expand (invariant I-T1)
3. EvidenceLedger is append-only and SHA-256 hash-chained — never modify or delete emitted events (invariant I-G3)
4. UUID v7 is required for requestId — crypto.randomUUID() gives v4 and WILL fail schema validation. Use generateUUIDv7() from @sint/gate-capability-tokens
5. Physical constraints live in the token, not in config files — velocity, force, geofence are enforced cryptographically
6. E-stop is unconditional — estop event transitions any non-terminal DFA state to ROLLEDBACK, bypassing all token checks (invariant I-G2)

Quick Orientation

Package Dependency Graph

@sint/core
  ↓
@sint/gate-capability-tokens   @sint/persistence
  ↓                               ↓
@sint/gate-evidence-ledger
  ↓
@sint/gate-policy-gateway
  ↓
@sint/bridge-*   @sint/engine-*   @sint/avatar
  ↓
@sint/gateway-server   @sint/mcp
  ↓
@sint/conformance-tests   @sint/dashboard

Workspace Layout

packages/core/              → Shared types, Zod schemas, tier constants, DFA states
packages/capability-tokens/ → Ed25519 token issuance, delegation, revocation
packages/policy-gateway/    → THE choke point: tiers, constraints, rate limiting, M-of-N
packages/evidence-ledger/   → SHA-256 hash-chained append-only audit log
packages/bridge-*/          → Protocol adapters (MCP, ROS2, A2A, IoT, OPC-UA, MAVLink, ...)
packages/engine-*/          → AI execution layer (System1, System2, HAL, capsule sandbox)
packages/avatar/            → Behavioral identity profiles, CSML-driven tier escalation
packages/persistence/       → Storage interfaces + in-memory implementations
packages/persistence-postgres/ → PostgreSQL adapters
packages/client/            → TypeScript HTTP client for the gateway API
packages/conformance-tests/ → Security regression suite (must pass on every PR)
apps/gateway-server/        → Hono HTTP API (port 3100)
apps/sint-mcp/              → Security-first multi-MCP proxy
apps/dashboard/             → Real-time approval dashboard
sdks/typescript/            → Zero-dependency public SDK
capsules/navigation/        → Reference capsule: waypoint navigation
capsules/inspection/        → Reference capsule: visual anomaly detection
capsules/pick-and-place/    → Reference capsule: gripper control