# Changelog

All notable changes to `@takk/krikos` are documented in this file.

The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Every entry carries a UTC timestamp.

## [1.0.0] - 2026-06-17T17:22:40Z

Initial stable release. Krikos: identity registry and lifecycle management for fleets of Massive Intelligence (IM) agents and non-human entities (NHE), with zero runtime dependencies, that never calls a provider API on its own.

### Added

- **Agent identity registry.** Every agent is issued an opaque id, a deterministic content fingerprint, declared capabilities, an issuer, optional framework tag, and metadata. Records are immutable and frozen; the registry is deterministic, time comes from an injected clock and ids from a seeded counter.
- **Enforced lifecycle state machine.** Agents move through `provisioned`, `active`, `suspended`, `revoked`, `expired`, and `archived` via a single legal-transition table. Illegal moves throw `ERR_INVALID_TRANSITION` and leave the registry untouched. Operations: `activate`, `suspend`, `resume`, `revoke`, `rotate`, `renew`, `archive`.
- **Fail-closed capability authorization.** `can()` authorizes only an active, unexpired agent that declares a matching capability (name, action, and resource scope), with `*` and trailing-`*` resource patterns. `authorize()` is the same decision, recorded in the audit trail. Expiry is enforced on the read regardless of options, so authorization is always fail-closed. An optional `requireResourceScope` enforces least privilege: a resource-bearing request is denied against an unscoped capability.
- **Credential rotation and expiry.** `rotate()` bumps the credential version, recomputes the fingerprint, and clears any attached signature. `sweepExpired()` transitions past-expiry agents to `expired`; `renew()` extends expiry and can reactivate an expired identity. An optional `defaultTtlMs` applies a default expiration window.
- **Cryptographic identity** (`@takk/krikos/a2a`). Optional Ed25519 signing of an agent's canonical passport, with interchangeable Node (`node:crypto`) and Web Crypto signers and byte-identical raw base64url key encoding. A2A-aligned Signed Agent Card export and trust-anchored verification: `verifyAgent` and `verifyAgentCard` verify against a pinned issuer key so an impersonated card signed by any other key is rejected, while `verifyAgentConsistency` and `verifyCardConsistency` check internal consistency only (explicitly not a trust check). Includes `toA2ACard` and `issueSigned` convenience.
- **Hash-chained audit trail.** Every operation appends one frozen, hash-chained event; `verifyAuditChain()` detects tampering. The trail is append-only and is never pruned. `prune(beforeArchivedAt)` drops only archived agent records to bound the live registry.
- **Persistence backends:** in-memory, file (lazy `node:fs`, atomic tmp-then-rename writes with corrupt-snapshot quarantine), and any structural `KvLike` key-value store. Snapshots are versioned and persist the agents, the audit trail, and the id and sequence counters.
- **Vercel AI SDK tool authorization** (`@takk/krikos/vercel`): wrap a tools record so each call is authorized against the acting agent's capabilities before it runs; a denial is recorded and rejected.
- **Model Context Protocol identity validation** (`@takk/krikos/mcp`): a fail-closed guard mapping MCP routes (method, or method plus tool) to capability requirements.
- **Stateless edge verifier** (`@takk/krikos/edge`): verify a presented Signed Agent Card and its capability, status, and expiry with no registry and no I/O.
- **Registry adapters** (`@takk/krikos/store`): write-through mirrors for Postgres and SQLite (`sqlRegistryStore`) and key-value stores (`kvRegistryStore`), plus `syncAll` and a live `mirrorRegistry`. Krikos imports no database driver.
- **Framework registration and sibling bridges** (`@takk/krikos/integrations`): register Hermes Agent, Mastra, and LangChain agents as identities, and bridge lifecycle to `@takk/keymesh` (revoke credentials), `@takk/gaptime` (record bi-temporal facts), and `@takk/behavioralai` (behavioral signals), all through local structural interfaces with no runtime import of a sibling.
- **CLI** (`krikos`): `issue`, `list`, `show`, `activate`, `suspend`, `resume`, `revoke`, `rotate`, `renew`, `archive`, `grant`, `ungrant`, `can`, `authorize`, `sweep`, `audit`, `verify`, `stats`, `demo`, `inspect` (with `--watch`), and a hardened read-only `serve` bridge.
- **Entry points:** universal core, `./a2a`, `./vercel`, `./mcp`, `./integrations`, `./store`, `./web`, and `./edge`, dual ESM and CJS with their own type declarations. Runs in Node, edge runtimes, and the browser.

### Quality

- 126 tests across 16 suites, green on Node 22 and Node 24, including an S1 to S10 fleet-governance scenario benchmark, a trust-anchor impersonation-defense regression, and a cross-bundle dist-parity smoke test.
- Statement coverage about 92 percent, line coverage about 92 percent.
- Core bundle about 4.7 kB brotli. Zero runtime dependencies. `publint` clean, `attw` green across all entry points.