@frontier-infra/audit

Publishable Node package for local Frontier static audit packets. Current release: 0.1.0-rc.2.

It installs the frontier-audit executable and bundles generated, provenance-locked snapshots of:

• the-machine/kit for static conformance scoring.
• agentcontrolplane/tools/aar.mjs for detached AAR signing and offline verification.

Snapshots are generated by npm run sync:audit from the SDK root and checked by npm run check:audit. Do not edit files under assets/generated by hand.

Requirements: Node.js 20 or newer, Python 3, Git, and a target inside a Git repository. The package has no runtime npm dependencies and performs no network access during an audit.

Run

frontier-audit run /path/to/deployment --out /tmp/frontier-audit --shape auto

--out must resolve outside the audited Git repository. Paths equal to the repo, nested in the repo, or routed into it through a symlink are rejected before any audit artifacts are created.

Outputs:

• evidence.json — SDK audit wrapper with target commit, dirty-tree binding, canonical kit JSON, and live checks preserved as NOT_RUN.
• evidence.md — Markdown evidence packet with the canonical kit packet embedded.
• kit-score.json / kit-packet.md — raw canonical kit outputs.

Detached Signing

Signing is opt-in and local. The CLI never generates keys, fetches DID documents, or installs dependencies. Signature artifacts record the public DID JSON path and evidence hash, not the private signing key path.

frontier-audit run /path/to/deployment \
  --out /tmp/frontier-audit \
  --sign-key /secure/operator-ed25519.jwk.json \
  --did-json /secure/did.json

When both paths are supplied, the CLI writes aar.json, immediately verifies it with the provided DID JSON, and writes signature.json plus aar-verify.txt. The AAR signs evidence.json as a detached payload so the evidence packet remains stable and hashable.

Verify

frontier-audit verify \
  --evidence /tmp/frontier-audit/evidence.json \
  --aar /tmp/frontier-audit/aar.json \
  --did-json /secure/did.json

Verification first recomputes the evidence.json SHA-256 and checks it against the signed AAR commitment, then invokes the bundled AAR verifier offline with the provided DID JSON. Tampering with evidence.json fails even if aar.json itself is unchanged.

Verification also requires the DID document, controller, and assertion method to match sig.by; requires sig.by == verifier.id and verifier.id != subject; requires AAR L2; and requires the receipt's SDK version and scorer-policy SHA-256 to match the signed evidence packet.

The AAR stamps the exact SDK version and the SHA-256 of audit-snapshot-lock.json in verifier.model and verifier.policy_sha256. That makes receipts comparable against a pinned scoring procedure rather than model-generated instructions.

verifier.id != subject establishes only AAR L2 structural separation. The separately disclosed verifier.independence field defaults to same_principal, which is an organizational attestation and is not third-party audit independence. A separate process, deterministic scorer, or distinct signing key does not change that relationship. An authorized external verifier may explicitly set --verifier-independence separate_principal or third_party, but must also supply the audited --subject DID and its --principal DID. The principal must differ from the signing verifier DID. Consumers still apply their own identity and trust policy to that signed disclosure.

Boundary

frontier-audit verifies its generated snapshot hashes against audit-snapshot-lock.json before execution. It runs static structural checks only. It does not perform network actions, live chaos/replay checks, DID resolution, or dependency installation. Full conformance still requires executed deployment evidence outside this local SDK audit packet.