asqav-kaibanjs

Prove what your KaibanJS agents did, task by task. Signs every multi-agent task state transition with NIST FIPS 204 ML-DSA-65 via the Asqav API, producing a tamper-evident record of what each agent attempted. This integration records task transitions as they happen. To stop a rogue agent before it acts, enforce policies on the Asqav side.

Data handling

asqav-kaibanjs is a thin client that calls the Asqav API directly. The data sent depends on which deployment you point baseUrl at:

• Asqav cloud (https://api.asqav.com): the cloud applies GDPR-aware data minimization on its side, retaining only the metadata bag (action_type, agent_id, session_id, model_name, tool_name) and storing a hash of the rest where possible.
• Self-hosted: the full action context lands on the server you control, enabling policy checks, PII redaction, and richer audit views.

If you want client-side hash-only behavior with auto-detection (so raw context never leaves your infrastructure when targeting cloud), use the @asqav/sdk package directly alongside this integration:

import { init } from '@asqav/sdk';

await init({ apiKey: 'sk_...', baseUrl: 'https://api.asqav.com', mode: 'hash-only' });

See docs/fingerprint-spec.md in the SDK repo for the fingerprint spec and conformance vectors.

Install

asqav-kaibanjs is published from this repository as a workspace package. An npm registry release is not yet cut. Use the source path until it lands:

git clone https://github.com/jagmarques/asqav-kaibanjs.git
cd asqav-kaibanjs
npm install

Then add it as a local path dependency in your KaibanJS app's package.json:

{
  "dependencies": {
    "asqav-kaibanjs": "file:../asqav-kaibanjs"
  }
}

Quick start

const { Agent, Task, Team } = require('kaibanjs');
const { AsqavClient, subscribeToTeam } = require('asqav-kaibanjs');

// Initialize Asqav client
const client = new AsqavClient({ apiKey: 'sk_...', agentName: 'my-crew' });
await client.init();

// Set up your KaibanJS team
const team = new Team({
  name: 'Research Team',
  agents: [researcher],
  tasks: [researchTask],
  env: { OPENAI_API_KEY: process.env.OPENAI_API_KEY }
});

// Subscribe to task transitions - every status change gets signed
subscribeToTeam(team, client);

// Run the workflow
await team.start();

How it works

KaibanJS manages agent workflows through a Zustand store with task status transitions from TODO to DOING to DONE. The subscribeToTeam function hooks into the store's subscribeWithSelector middleware to watch for task status changes.

When a task status changes, it calls the Asqav API to sign the transition. Signing happens server-side with NIST FIPS 204 ML-DSA-65, so the agent never holds the signing key and cannot forge the resulting compliance receipt.

Signing is fail-open. If the API is unreachable, your KaibanJS workflow continues without interruption.

Advanced: Zustand middleware

If you need lower-level control, use createAsqavMiddleware directly with a Zustand store:

const { createAsqavMiddleware } = require('asqav-kaibanjs');
const { create } = require('zustand');

const store = create(
  createAsqavMiddleware(client)((set) => ({
    tasks: [],
    // your store config
  }))
);

Manual signing

// Sign any action
const receipt = await client.sign('task:complete', { task_id: '123', result: 'done' });

// Optional preflight check before destructive actions.
// Requires the cloud preflight endpoint to be enabled on your tier;
// when unavailable, preflight returns { cleared: true } with a console.warn.
const check = await client.preflight('data:delete');
if (check.cleared) {
  // proceed
}

License

MIT