T3MP3ST v1 — hardened launch (AGPL, verify-claims 24/24, leak-scrubbed)

src/server.ts

@@ -398,12 +398,12 @@ function clientLedgerId(value: unknown, prefix: string): string {
 }
 
 // =============================================================================
-// DUAL-MODE CONTRACTS - STANDALONE + ORGAN MODE
+// DUAL-MODE CONTRACTS - STANDALONE + T3MP3ST ORGAN
 // =============================================================================
 
-type TempestMode = 'standalone' | 'organ';
+type TempestMode = 'standalone' | 't3mp3st';
 type DraftStatus = 'draft' | 'queued' | 'launched' | 'archived';
-type DraftSource = 'human' | 'agent' | 'organ';
+type DraftSource = 'human' | 'agent' | 't3mp3st';
 type MissionFamily = 'web_api' | 'ai_red_team' | 'cloud_infra' | 'smart_contract' | 'code_supply_chain' | 'crypto_secrets' | 'reverse_binary' | 'agent_warfare' | 'social_osint' | 'reporting_remediation';
 type OperationMode = 'wizard' | 'agent_harness' | 'expert_console' | 'range' | 'review_only';
 type GuardAction = 'command_execution' | 'network_request' | 'mission_execution' | 'autonomous_execution' | 'model_call';
@@ -757,12 +757,12 @@ const ROUTE_SCORECARDS: Record<string, Record<string, number | string>> = {
 };
 
 function currentMode(): TempestMode {
-  return process.env.ORGAN_STATE_DIR || process.env.T3MP3ST_MODE === 'organ' ? 'organ' : 'standalone';
+  return process.env.T3MP3ST_STATE_DIR || process.env.T3MP3ST_MODE === 't3mp3st' ? 't3mp3st' : 'standalone';
 }
 
 function stateRoot(): string {
   return process.env.T3MP3ST_STATE_DIR ||
-    (process.env.ORGAN_STATE_DIR ? `${process.env.ORGAN_STATE_DIR}/organs/t3mp3st` : 'memory');
+    (process.env.T3MP3ST_STATE_DIR ? `${process.env.T3MP3ST_STATE_DIR}/organs/t3mp3st` : 'memory');
 }
 
 function stateFilePath(): string | null {
@@ -931,7 +931,7 @@ function replaceMapContents<T extends { id: string }>(map: Map<string, T>, value
 
 function buildStateSnapshot(): Record<string, unknown> {
   return {
-    schema_version: 't3mp3st.state/v1',
+    schema_version: 't3mp3st_state/v1',
     savedAt: nowIso(),
     mode: currentMode(),
     missionDrafts: [...missionDrafts.values()],
@@ -1088,7 +1088,7 @@ function createApprovalRequest(action: GuardAction, target: string, reason: stri
     reason,
     status: 'pending',
     operationId: typeof operationDraft?.operation_id === 'string' ? operationDraft.operation_id : undefined,
-    requestedBy: ['human', 'agent', 'organ'].includes(String(body.source)) ? body.source as DraftSource : 'system',
+    requestedBy: ['human', 'agent', 't3mp3st'].includes(String(body.source)) ? body.source as DraftSource : 'system',
     createdAt: nowIso(),
     updatedAt: nowIso(),
   };
@@ -1208,7 +1208,7 @@ function buildRoutePreview(draft: MissionDraft): RoutePreview {
       warnings,
     },
     operationDraft: {
-      schema_version: 't3mp3st.operation/v1',
+      schema_version: 't3mp3st_operation/v1',
       operation_id: `op-${draft.id.replace(/^draft_/, '')}`,
       mission_id: draft.id,
       family,
@@ -1319,7 +1319,7 @@ function buildMissionBundle(params: { draft?: MissionDraft; operationDraft?: Rec
   const pressurePaths = buildPressurePaths({ missionId, operationId, family, operationDraft, reproPacks });
 
   return redactSecrets({
-    schema_version: 't3mp3st.mission_bundle/v1',
+    schema_version: 't3mp3st_mission_bundle/v1',
     generatedAt: nowIso(),
     family,
     missionId: missionId || null,
@@ -1485,7 +1485,7 @@ function buildMissionGate(operationDraft: Record<string, unknown>): Record<strin
   const readinessHold = Boolean(!hypotheses.length || !findings.length || openWorkOrders.length || findingsWithoutRetest.length || findingsWithoutStrongEvidence.length || unresolvedRetests.length);
   const status = blockCount ? 'blocked' : score >= 80 && freshMissionApprovals.length && !readinessHold ? 'ready' : 'hold';
   return {
-    schema_version: 't3mp3st.mission_gate/v1',
+    schema_version: 't3mp3st_mission_gate/v1',
     generatedAt: nowIso(),
     family,
     missionId: missionId || null,
@@ -1600,7 +1600,7 @@ function latestMissionContext(): Record<string, unknown> {
   const latest = records[0];
   if (!latest) {
     return {
-      schema_version: 't3mp3st.mission_context/v1',
+      schema_version: 't3mp3st_mission_context/v1',
       missionId: null,
       operationId: null,
       family: null,
@@ -1630,7 +1630,7 @@ function latestMissionContext(): Record<string, unknown> {
   const laneSummary = missionLaneSummary({ hypotheses, workOrders, findings, retests });
 
   return redactSecrets({
-    schema_version: 't3mp3st.mission_context/v1',
+    schema_version: 't3mp3st_mission_context/v1',
     missionId: missionId || null,
     operationId: operationId || null,
     family: latest.family || laneSummary[0]?.family || null,
@@ -2286,7 +2286,7 @@ async function buildSelfHealReport(params: Record<string, unknown>): Promise<Rec
   const health = blocks ? 'blocked' : actionCount ? 'repair' : watchCount ? 'watch' : 'ok';
 
   return redactSecrets({
-    schema_version: 't3mp3st.self_heal/v1',
+    schema_version: 't3mp3st_self_heal/v1',
     generatedAt: nowIso(),
     scope: {
       missionId: scope.missionId || null,
@@ -2412,7 +2412,7 @@ function buildEvidenceGraph(params: Record<string, unknown>): Record<string, unk
   const laneSummary = missionLaneSummary({ hypotheses, workOrders, findings, retests });
   const evidenceProvenance = summarizeEvidenceProvenance(evidence);
   return redactSecrets({
-    schema_version: 't3mp3st.evidence_graph/v1',
+    schema_version: 't3mp3st_evidence_graph/v1',
     generatedAt: nowIso(),
     scope: { missionId: missionId || null, operationId: operationId || null, family: family || null },
     summary: {
@@ -2593,7 +2593,7 @@ function buildReproPacks(params: Record<string, unknown>): Record<string, any> {
     }, {}),
   };
   return redactSecrets({
-    schema_version: 't3mp3st.repro_packs/v1',
+    schema_version: 't3mp3st_repro_packs/v1',
     generatedAt: nowIso(),
     scope: {
       missionId: missionId || null,
@@ -2977,7 +2977,7 @@ function buildPressurePaths(params: Record<string, unknown>): Record<string, any
     }, {}),
   };
   return redactSecrets({
-    schema_version: 't3mp3st.pressure_paths/v1',
+    schema_version: 't3mp3st_pressure_paths/v1',
     generatedAt: nowIso(),
     scope: {
       missionId: missionId || null,
@@ -3017,7 +3017,7 @@ function buildPressureCanary(params: Record<string, unknown>): Record<string, an
 
   if (!path) {
     return redactSecrets({
-      schema_version: 't3mp3st.pressure_canary/v1',
+      schema_version: 't3mp3st_pressure_canary/v1',
       generatedAt: now,
       status: 'no_path',
       canary: null,
@@ -3141,7 +3141,7 @@ function buildPressureCanary(params: Record<string, unknown>): Record<string, an
   });
 
   return redactSecrets({
-    schema_version: 't3mp3st.pressure_canary/v1',
+    schema_version: 't3mp3st_pressure_canary/v1',
     generatedAt: now,
     status,
     path: {
@@ -3182,7 +3182,7 @@ function buildPressureDuel(params: Record<string, unknown>): Record<string, any>
 
   if (!path) {
     return redactSecrets({
-      schema_version: 't3mp3st.pressure_duel/v1',
+      schema_version: 't3mp3st_pressure_duel/v1',
       generatedAt: now,
       status: 'no_path',
       survivabilityScore: 0,
@@ -3423,7 +3423,7 @@ function buildPressureDuel(params: Record<string, unknown>): Record<string, any>
   });
 
   return redactSecrets({
-    schema_version: 't3mp3st.pressure_duel/v1',
+    schema_version: 't3mp3st_pressure_duel/v1',
     generatedAt: now,
     status,
     survivabilityScore,
@@ -3465,7 +3465,7 @@ function buildPressureMutations(params: Record<string, unknown>): Record<string,
 
   if (!path) {
     return redactSecrets({
-      schema_version: 't3mp3st.pressure_mutations/v1',
+      schema_version: 't3mp3st_pressure_mutations/v1',
       generatedAt: now,
       status: 'no_path',
       summary: { total: 0, queued: 0, maxFangScore: 0 },
@@ -3685,7 +3685,7 @@ function buildPressureMutations(params: Record<string, unknown>): Record<string,
   });
 
   return redactSecrets({
-    schema_version: 't3mp3st.pressure_mutations/v1',
+    schema_version: 't3mp3st_pressure_mutations/v1',
     generatedAt: now,
     status: survivedDuel ? 'queued' : 'needs_duel',
     path: {
@@ -3729,7 +3729,7 @@ function buildPressureChains(params: Record<string, unknown>): Record<string, an
 
   if (!path) {
     return redactSecrets({
-      schema_version: 't3mp3st.pressure_chains/v1',
+      schema_version: 't3mp3st_pressure_chains/v1',
       generatedAt: now,
       status: 'no_path',
       summary: { total: 0, queued: 0, maxChainScore: 0, workOrders: 0 },
@@ -3750,7 +3750,7 @@ function buildPressureChains(params: Record<string, unknown>): Record<string, an
 
   if (!mutations.length) {
     return redactSecrets({
-      schema_version: 't3mp3st.pressure_chains/v1',
+      schema_version: 't3mp3st_pressure_chains/v1',
       generatedAt: now,
       status: 'no_mutations',
       path: {
@@ -3999,7 +3999,7 @@ function buildPressureChains(params: Record<string, unknown>): Record<string, an
   });
 
   return redactSecrets({
-    schema_version: 't3mp3st.pressure_chains/v1',
+    schema_version: 't3mp3st_pressure_chains/v1',
     generatedAt: now,
     status: summary.queued ? 'queued' : 'hold',
     path: {
@@ -4424,7 +4424,7 @@ async function buildArsenalStatus(family?: string): Promise<Record<string, unkno
   const installedCommandReady = commandReadyTools.filter(tool => tool.available).length;
   const missingCommandReady = commandReadyTools.filter(tool => !tool.available).map(tool => tool.id);
   return {
-    schema_version: 't3mp3st.arsenal_status/v1',
+    schema_version: 't3mp3st_arsenal_status/v1',
     family: normalizedFamily || 'all',
     summary: {
       ...summarizeToolCatalog(catalog),
@@ -4500,7 +4500,7 @@ function buildArsenalPlan(params: Record<string, unknown>): Record<string, unkno
       };
     });
   return {
-    schema_version: 't3mp3st.arsenal_plan/v1',
+    schema_version: 't3mp3st_arsenal_plan/v1',
     family,
     target,
     objective: typeof params.objective === 'string' ? params.objective : 'Build a scoped, evidence-first tool plan.',
@@ -4549,7 +4549,7 @@ function buildArsenalActivationPlan(): Record<string, unknown> {
     }
   }
   return {
-    schema_version: 't3mp3st.arsenal_activation/v1',
+    schema_version: 't3mp3st_arsenal_activation/v1',
     summary: {
       ...summarizeToolCatalog(),
       frontierMilestone: FRONTIER_ARSENAL_MILESTONE,
@@ -4663,7 +4663,7 @@ app.get('/api/arsenal/catalog', (req: Request, res: Response) => {
     .filter(adapter => !category || adapter.category === category)
     .filter(adapter => !execution || adapter.execution === execution);
   res.json({
-    schema_version: 't3mp3st.arsenal_catalog/v1',
+    schema_version: 't3mp3st_arsenal_catalog/v1',
     family: family || 'all',
     summary: summarizeToolCatalog(adapters),
     adapters,
@@ -4675,7 +4675,7 @@ app.get('/api/arsenal/catalog', (req: Request, res: Response) => {
 // defanged, transferable taxonomy the ai_red_team specialist (garak/promptfoo) reasons from.
 app.get('/api/ai-redteam/playbook', (_req: Request, res: Response) => {
   res.json({
-    schema_version: 't3mp3st.ai_redteam_playbook/v1',
+    schema_version: 't3mp3st_ai_redteam_playbook/v1',
     source: 'L1B3RT4S + P4RS3LT0NGV3 (public corpus) — defanged methodology, not payloads',
     doc: 'docs/AI_REDTEAM_TECHNIQUES.md',
     count: AI_REDTEAM_PLAYBOOK.length,
@@ -4839,7 +4839,7 @@ app.get('/api/operator-runbooks/:family', (req: Request, res: Response) => {
 app.get('/api/forefront-radar', (req: Request, res: Response) => {
   const family = typeof req.query.family === 'string' ? req.query.family : '';
   res.json({
-    schema_version: 't3mp3st.forefront_radar/v1',
+    schema_version: 't3mp3st_forefront_radar/v1',
     lanes: forefrontPressureForFamily(family),
     mandate: {
       purpose: 'show what is possible early in controlled arenas, then convert offensive insight into defensive artifacts',
@@ -5163,7 +5163,7 @@ function handleHypothesisDecompose(req: Request, res: Response): void {
   const existing = [...workOrderLedger.values()].filter(order => order.hypothesisId === hypothesis.id);
   emitContractEvent('hypothesis.decomposed', { hypothesisId: hypothesis.id, created: orders.length, total: existing.length });
   res.status(201).json({
-    schema_version: 't3mp3st.work_order_decomposition/v1',
+    schema_version: 't3mp3st_work_order_decomposition/v1',
     hypothesis,
     created: orders,
     workOrders: existing.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt)),
@@ -5276,7 +5276,7 @@ app.get('/api/watch-loop/status', (req: Request, res: Response) => {
   const cycles = latestWatchCycles(scope.missionId, scope.operationId, scope.family).slice(0, 10);
   const signals = cycles[0]?.signals || buildWatchSignals(scope);
   res.json({
-    schema_version: 't3mp3st.watch_loop_status/v1',
+    schema_version: 't3mp3st_watch_loop_status/v1',
     scope: {
       missionId: scope.missionId || null,
       operationId: scope.operationId || null,
@@ -5299,7 +5299,7 @@ app.get('/api/watch-loop/status', (req: Request, res: Response) => {
 app.post('/api/watch-loop/run', (req: Request, res: Response) => {
   const cycle = runWatchLoop(req.body as Record<string, unknown>);
   res.status(201).json({
-    schema_version: 't3mp3st.watch_loop_cycle/v1',
+    schema_version: 't3mp3st_watch_loop_cycle/v1',
     ...cycle,
   });
 });
@@ -5506,7 +5506,7 @@ app.post('/api/mission-drafts', (req: Request, res: Response) => {
     urgency: ['low', 'normal', 'high', 'critical'].includes(String(body.urgency)) ? body.urgency as MissionDraft['urgency'] : 'normal',
     opsecPreference: ['overt', 'normal', 'covert', 'ghost'].includes(String(body.opsecPreference)) ? body.opsecPreference as MissionDraft['opsecPreference'] : 'normal',
     mode: currentMode(),
-    source: ['human', 'agent', 'organ'].includes(String(body.source)) ? body.source as DraftSource : 'human',
+    source: ['human', 'agent', 't3mp3st'].includes(String(body.source)) ? body.source as DraftSource : 'human',
     status: 'draft',
     createdAt: now,
     updatedAt: now,
@@ -5569,7 +5569,7 @@ app.post('/api/route-preview', (req: Request, res: Response) => {
     urgency: ['low', 'normal', 'high', 'critical'].includes(String(body.urgency)) ? body.urgency as MissionDraft['urgency'] : 'normal',
     opsecPreference: ['overt', 'normal', 'covert', 'ghost'].includes(String(body.opsecPreference)) ? body.opsecPreference as MissionDraft['opsecPreference'] : 'normal',
     mode: currentMode(),
-    source: ['human', 'agent', 'organ'].includes(String(body.source)) ? body.source as DraftSource : 'human',
+    source: ['human', 'agent', 't3mp3st'].includes(String(body.source)) ? body.source as DraftSource : 'human',
     status: 'draft',
     createdAt: nowIso(),
     updatedAt: nowIso(),
@@ -5641,7 +5641,7 @@ app.post('/api/promotion/evaluate', (req: Request, res: Response) => {
 
 app.get('/api/learning/status', (_req: Request, res: Response) => {
   res.json({
-    schema_version: 't3mp3st.learning_status/v1',
+    schema_version: 't3mp3st_learning_status/v1',
     policy: {
       silentLearning: false,
       proposalRequired: true,
@@ -5684,14 +5684,14 @@ app.get('/api/learning/status', (_req: Request, res: Response) => {
 app.post('/api/learning/run-review', (req: Request, res: Response) => {
   const review = buildLearningReview(req.body as Record<string, unknown>);
   res.status(201).json({
-    schema_version: 't3mp3st.learning_review/v1',
+    schema_version: 't3mp3st_learning_review/v1',
     ...review,
   });
 });
 
 app.get('/api/memory/capsule', (_req: Request, res: Response) => {
   res.json({
-    schema_version: 't3mp3st.memory_capsule/v1',
+    schema_version: 't3mp3st_memory_capsule/v1',
     entries: [...memoryCapsule.values()],
     policy: 'accepted memory only; proposals are separate and inspectable',
   });
@@ -5700,7 +5700,7 @@ app.get('/api/memory/capsule', (_req: Request, res: Response) => {
 app.get('/api/memory/proposals', (req: Request, res: Response) => {
   const status = typeof req.query.status === 'string' ? req.query.status : '';
   res.json({
-    schema_version: 't3mp3st.memory_proposals/v1',
+    schema_version: 't3mp3st_memory_proposals/v1',
     proposals: [...memoryProposals.values()]
       .filter(proposal => !status || proposal.status === status)
       .sort((a, b) => b.updatedAt.localeCompare(a.updatedAt)),