@kashscript/hudhud — the Agent Protocol (accountable runtime)

Where agents act, ventures consume Hudhud and never reach for raw neuron. Commercial (SSLA Schedule B). Built in phase M5 — the final protocol — of the Manifestation (ADR-0016).

The generic accountable agent runtime, lifted from the oreoasis-core-host engine: SOP compilation, MCP governance (allowlist + fail-closed circuit breaker + PII redaction), scope-gating, a signed action ledger + forensic scan and chain anchor on @kashscript/attest, exception classification, AIUC-1 work certificates (DSSE), a DID registry, an identity gate (@kashscript/identity-server agent tokens, MCP OAuth 2.1), and a @kashscript/neuron-backed execution runtime. Everything an agent does is Ed25519-signed into an append-only, hash-chained ledger; restricted actions suspend for a two-key human sign-off. SOP content, fixtures, storage schemas, and text UIs stay venture-side. Full contract: specs/hudhud.md.

The signed run loop

import { WorkItemRunner } from "@kashscript/hudhud/runtime";
import { ForensicLedgerService, InMemoryLedgerStore, SessionMutex, createEd25519HostSigner } from "@kashscript/hudhud/ledger";
import { McpClientPoolManager } from "@kashscript/hudhud/mcp";

const forensicLedger = new ForensicLedgerService({
  ledger: new InMemoryLedgerStore(),
  sessionMutex: new SessionMutex(),
  didRegistry,                       // resolves the agent DID → Ed25519 key
  hostSigner: createEd25519HostSigner({ actorDid, actorClass: "AGENT", privateKey }),
});

const runner = new WorkItemRunner({ mcpClientPool: new McpClientPoolManager(), forensicLedger });
const result = await runner.run({ sessionId, dag, bindings });   // DELIVERED | ESCALATED | FAILED
// one Ed25519-signed ledger row per tool dispatch; a restricted tool with no
// approval envelope SUSPENDS the run to ESCALATED.

Modules (subpath exports)

• ./sop — compileSopStructural (numbered/bulleted → content-addressable TaskDag) + SopCompilerService (goto back-edges + DFS cycle detection). Pure.
• ./mcp — validateToolArgs / decomposeToolName / McpAllowlistStore; McpClientPoolManager — JSON-RPC 2.0 client + fail-closed circuit breaker (a transport failure trips it; a JSON-RPC application error does not), injectable fetchImpl.
• ./privacy — scanAndRedact + 15 builtin PII/secret patterns; recall-biased, category tags never raw values.
• ./scope — assertScopeAllowsTool — a RESTRICTED session cannot dispatch administrative tools.
• ./ledger — ForensicLedgerService (self-signing + caller-signed append under a per-session mutex; gap-free hash chain; forensicConsistencyScan throws on tamper), LedgerEventSchema (closed vocab). Signing / chain-hash / scan are attest's (M1 seed), re-exported.
• ./anchor — computeAnchorMerkleRoot + ChainAnchor / AnchorReceiptStore — out-of-band chain-tip publication so a full-ledger rewrite is still detectable.
• ./exception — signed exception-classification dataset; failureClass is mandatory (no default), each record Ed25519-signed over its exact bytes; class-mix + per-workflow stats.
• ./certificate — buildWorkCertificate (DSSE) + verifyWorkCertificate (signature and count re-derivation from the enumerated outcomes) + AIUC-1 (A–F) coverage + HTML renderer (brand hook).
• ./identity — verifyAccountableIdentity(token, {expectedAudience}) → {ok, actor:{owner,agent}, scope} over identity-server agent tokens.
• ./runtime — NeuronToolDispatcher (neuron ToolDispatcher SPI; inline signed ledger append per dispatch), WorkItemRunner, two-key escalation (buildHumanApprovalEnvelope / appendOperatorSignoff / ResumeGuard).
• ./did-registry — DidRegistry + InMemoryDidRegistry (attest's M1 seed).
• ./adapters/prisma — structural-delegate PrismaLedgerStore / PrismaAnchorReceiptStore / PrismaExceptionClassificationStore / PrismaDidRegistry. No @prisma/client dependency — pass a client model that satisfies the narrow { create, findFirst, findMany, count } delegate; the schema is venture-side.

Two-key escalation

An autonomous run that reaches a restricted tool suspends; a human must sign off before it resumes. The guarantee is literal: the approval envelope's two signatures use distinct keys (the host holds the agent key but cannot mint the separate operator key), the sign-off is a signed OPERATOR_ADMIN ledger row plus a mandatory exception classification, and a resume key can be claimed at most once (ResumeGuard).

Status

0.x — the API stays 0.x until oreoasis-core-host becomes a thin host on the published package with its full test suite green (consumer-as-acceptance, ADR-0016; the atomic swap is a separate venture session per the hudhud-last guard). The runtime license assertion + registry tier mapping land in M6. Depends on @kashscript/identity-core, @kashscript/attest, @kashscript/identity-server, and @kashscript/neuron.

Commercial — SSLA Schedule B; see LICENSE.