Sanctuary

Filter agent context through a gating policy before sending to a remote provider. Returns per-field decisions (allow, redact, hash, summarize) and content hashes for the audit trail. Call this BEFORE making any outbound API call to ensure you are only sending the minimum necessary context. The filtered output tells you exactly what can be sent safely.

List all configured context-gating policies. Returns policy IDs, names, and selector-safe metadata.

Analyze a sample context object and recommend a context-gating policy based on field name heuristics. Classifies each field as allow, redact, hash, or summarize with confidence levels. Returns a ready-to-apply rule set. When in doubt, recommends redact (conservative). Review the recommendations before applying.

Create a context-gating policy that controls what information flows to remote providers (LLM APIs, tool APIs, logging services). Each rule specifies a provider category and which context fields to allow, redact, hash, or flag for summarization. Redact rules take absolute priority — if a field is in both 'allow' and 'redact', it is redacted. Default action applies to any field not mentioned in any rule. Use this to prevent your full agent context from being sent to remote LLM providers during inference calls.

Evaluate a disclosure request against an active policy. Returns per-field decisions: disclose, withhold, proof, or ask-principal.

Define a disclosure policy that controls what an agent will and will not disclose in different interaction contexts. Rules specify which fields may be disclosed, which must be withheld, and which require cryptographic proof.

Generate an attestation of the current execution environment, including sovereignty assessment and degradation report. The castle_wall block reports the runtime detector's verdict and, when this vault carries the claim, its own vault_provision state: not_yet_walled means this vault has not been put on this machine's Castle Wall, whatever the machine's own enforcement state is, so do not read a healthy wall runtime as protection for this vault.

List known federation peers, register a peer from a completed handshake, or remove a peer. Every peer MUST enter through a verified handshake with a counterparty this fortress does not hold keys for.

Overview of federation state: total peers, active connections, trust distribution, and readiness for cross-instance operations.

Evaluate the trust level of a federation peer. Considers handshake status, sovereignty tier, reputation score, and mutual attestation history. Returns a composite trust assessment.

Reset all Call Governor counters: volume window, per-tool rate windows, duplicate cache, and lifetime counter. This clears the hard stop if the lifetime limit was reached. This is a Tier 1 operation: it requires human approval because it removes all runtime governance state and could allow previously blocked behavior to resume.

View the current Call Governor status including volume counters, per-tool rate counts, duplicate cache size, and lifetime counter. Use this to monitor tool call consumption, detect potential loops, and check how close you are to governance limits. The governor protects against runaway tool calls by enforcing volume limits, rate limits, duplicate detection, and a session lifetime cap.

Abort an in-flight handshake session. Drops the session record and appends a session-lifecycle audit entry (handshake_aborted) so the operator can distinguish operator-cancelled, timed-out, and dropped sessions from sessions that simply fell off the protocol path.

Complete a sovereignty handshake (initiator side). Verifies the responder's SHR and nonce signature, signs their nonce, and produces the final result.

One-shot sovereignty exchange. Accepts a counterparty's signed SHR, verifies it, generates our SHR, and produces a signed attestation artifact, all in a single call. Returns a shareable attestation with human-readable summary. Use this instead of the 4-step handshake protocol when you want a quick, portable sovereignty verification (e.g., for social posting or async exchanges).

Initiate a sovereignty handshake with a counterparty. Generates a challenge containing this instance's signed SHR and a cryptographic nonce. Send the returned challenge to the counterparty.

Respond to an incoming sovereignty handshake challenge. Verifies the initiator's SHR, signs their nonce, and returns our SHR with a counter-nonce.

Check the state of an in-flight handshake session by id, or (responder side) verify an initiator's completion message. Read-only; returns session phase and, for verification, the validated counterparty SHR result.

Verify a signed attestation artifact from another agent. Checks the Ed25519 signature, temporal validity, and structural integrity.

Create a new sovereign identity (Ed25519 keypair). The private key is encrypted and never exposed. A wrapped install normally already has a primary identity, so call identity_list first and create another only for a separate persona. Returns identity_id, public_key and did. Tier 3 under the default policy (auto-allowed with an audit record).

Import a sovereign identity record without exposing private key material. Routine imports refuse to replace any existing identity. Requires operator approval under the default policy (not named in a policy tier; the gate's safe default).

List all managed sovereign identities with labels, DIDs, public keys, and which is primary. Read-only; no private key material returned.

Rotate keys for an identity: generates a new keypair and signs a rotation event with the old key. Tier 1: requires operator approval, because the previous key is retired and the rotation is not reversible.

Set which identity is the default/primary identity. This identity will be used by shr_generate, reputation_publish, and other tools when no explicit identity_id parameter is provided. The selection is persisted across server restarts.

Sign data with a managed identity. Tier 1 and non-relaxable: requires operator approval on every call. The private key is decrypted in memory only during signing.

Verify an Ed25519 signature. Provide either identity_id or public_key.

Report a heuristic L2 process-hardening assessment: ASLR/environment/filesystem checks plus configured or assumed memory-protection signals and overall status.

Assess L2 process isolation at runtime: detect container/VM/sandbox signals, check storage-dir permissions, and report configured/assumed memory-protection indicators.

Generate the Sanctuary Interface Manifest (SIM): a machine-readable declaration of this server's capabilities. Read-only, takes no arguments; Tier 3 under the default policy. For a scored posture evaluation call sovereignty_audit instead.

Create an Ed25519-signed attestation for a memory operation. Records who accessed what (content hash, not content), when, and through which memory provider, without exposing the memory content itself. Works with any MCP-compatible memory provider (Mem0, Zep, Letta, etc.). Use after add_memory, search_memories, or any memory CRUD operation to build a cryptographically verifiable audit trail of memory access.

Count the passages in your sovereign memory vault (this owner scope). Requires operator approval under the default policy (not named in a policy tier; the gate's safe default).

Permanently delete a passage from your sovereign memory vault (secure overwrite where the storage backend supports it; a plain delete otherwise). Tier 1: irreversible, so it requires operator approval before execution and fails closed.

Manually emit Claude Code or Codex memory files from the SDW vault into an operator-named output directory. Existing memory files are never overwritten. The result reports index_present; false means the emitted tree cannot be re-ingested as that harness's memory directory. Emitted files are plaintext for the harness; this does not sync or write back to the source memory directory, and memory later sent to a model vendor is exposed to that vendor at inference. Tier 1 under every policy (a custom policy cannot relax it): requires operator approval.

Fetch one passage from your sovereign memory vault by id. Decrypts on read and verifies the content hash (fails closed on any integrity mismatch).

Manually mirror a Claude Code or Codex memory directory into the SDW vault. It reads plaintext source files and leaves them untouched; the encrypted copy lives in the vault. Files the secret classifier refuses are skipped and named in the result, so check skipped_file_count before treating the mirror as complete. Optional allow_files names exact source paths to ingest as-is even though the classifier refuses them; each use is audited by path and reported under overridden, and a listed path the classifier never refused is reported as unused, not silently accepted. A call naming allow_files alwa…

Store a text passage in your sovereign memory vault (SDW). Encrypted at rest under your operator keys, secret-gated at write time, and audited. This is a passage store: flat text plus tags, with no in-place edit (insert and delete only). Retrieval IQ (embeddings, ranking) stays in a swappable engine; this is the sovereign custody layer underneath it. Tier 1 under the default policy: requires operator approval for each insert.

List passages in your sovereign memory vault in stable id order, with optional cursor pagination (pass the last seen passage_id as `after`). Requires operator approval under the default policy (not named in a policy tier; the gate's safe default).

Tier-1 operator maintenance: reclaim only foreign memory-provenance signer mappings proven unreachable by a complete authenticated bounded corpus scan.

Description is built at runtime.

Manually project one already-mirrored Claude Code or Codex memory snapshot from the encrypted SDW vault into the other harness format. The output is plaintext and may be structurally lossy; exact source recovery uses the versioned encrypted archive returned as archive_id, not the projection. Existing output files are never overwritten. This does not sync, watch, or replace either harness write path, and memory later sent to a model vendor is exposed to that vendor at inference. Tier 1 under every policy (a custom policy cannot relax it): requires operator approval.

Manually restore the exact source files from a completed encrypted Sanctuary memory transcode archive into an empty operator-named directory. Restored files are plaintext and existing files are never overwritten. This does not sync, watch, or write back to a live harness directory, and memory later sent to a model vendor is exposed to that vendor at inference. Tier 1 under every policy (a custom policy cannot relax it): requires operator approval.

Query your OWN identity's sovereignty audit entries, filtered by since, layer (l1-l4), operation_type, and limit (default 50). Use to inspect operations you performed. Read-only; only your own entries are visible (system/gate entries are never returned), and each entry is reduced to a fixed safe view ({ timestamp, operation, result, has_details }): no details, identity, or policy attribution.

Report this instance's health and sovereignty posture: overall state (healthy/degraded/compromised), versions, Castle Wall status (active/unknown/not_configured depending on what runtime detector is wired in), and audit/state/egress posture, plus any active degradations. The castle_wall block also carries vault_provision when this vault records one: not_yet_walled means this vault is not on this machine's Castle Wall, which is a separate question from whether a wall is running here, so a healthy wall runtime is not protection for this vault while that value stands. Disclosure and reputation la…

View the current behavioral baseline: the session profile used for anomaly detection. Shows known namespaces, counterparties, and tool call counts. Read-only. Tier 1 and non-relaxable: requires operator approval on every call.

View the current Principal Policy: the human-controlled rules governing what operations require approval. Read-only. Tier 1 and non-relaxable: requires operator approval on every call.

Create a cryptographic commitment to a value. The commitment hides the value until you choose to reveal it. Returns the commitment hash and a blinding factor (store securely).

Verify a previously committed value by revealing it with the blinding factor. Returns whether the revealed value matches the commitment.

Export a portable reputation bundle (SANCTUARY_REP_V1). Includes signed attestations plus a signed completeness manifest for the exported set. On reputation_import, the manifest verifies that the bundle body still matches the export scope and rejects dropped or changed attestations within that scope. It does not prove the export is the agent's complete lifetime history or that data outside the chosen export scope should have been included. Tier 1: requires operator approval, because the bundle leaves the local store.

Import a reputation bundle from another Sanctuary instance. By default, import requires a signed completeness manifest, recomputes it before any write, and verifies all attestation signatures. Manifest, count, checksum, signature, or newer-schema mismatches are rejected without crediting any attestations. The verification proves the bundle body still matches the export scope; it does not prove a complete lifetime history. Manifestless legacy bundles are rejected unless allow_unverified_legacy is true, and that import result is flagged unverified-completeness-legacy-bundle. Policy-rated concord…

Publish sovereignty data to Verascore using the supplied or DID-derived agent id; payload is Ed25519-signed; the Verascore API response determines profile existence/acceptance. Tier 1: requires operator approval, because the signed report leaves this machine.

Query aggregated reputation data with filtering. Returns summary statistics, never raw interaction details.

Query reputation with sovereignty-weighted scoring. Every attestation this instance stores or imports is scored at self-attested (0.5) or unverified (0.2) weight; verified-sovereign (1.0) and verified-degraded (0.8) are not currently reachable through recorded or imported attestations. Returns both the weighted score and tier distribution.

Record an interaction outcome as a signed attestation. Creates an EAS-compatible attestation signed by the specified identity.

List the security guarantees currently in force for this session (e.g. state-encrypted-at-rest, approval-gate-mediated, append-only audit for critical ops, opaque memory handles). Use to tell a counterparty or yourself what protections apply. Read-only; returns guarantee flags plus an audit_ref. Reports only what IS active: absence of a flag is not a claim.

Full-text search your own audit history (scope is always own_signed), verifying entries against the audit chain first. Use to find when a past operation ran and its result. Returns matching entries with timestamp, operation, and verified_against_audit_chain status; refuses if the chain fails integrity.

One-shot bootstrap for a new sovereign agent identity. Generates an Ed25519 keypair, stores the encrypted identity, constructs an SHR, and OPTIONALLY publishes to Verascore when publish=true and auto-publish is enabled. Returns DID/profile URL/tier plus published status. Tier 1: requires operator approval, because it mints a new identity and may publish.

Return the start-here catalog of Sanctuary's cooperative tools: for each tool, what it does and when to reach for it. Read-only, takes no arguments. Call this to discover what cooperative memory/identity/audit tools are available and route your work through them instead of ad-hoc state. The same catalog is also delivered in the MCP server instructions at connect time; this tool re-serves it on demand. Returns { capabilities: [{ tool, does, when }], audit_ref }.

Execute a short plan of facade steps (sanctuary_remember/recall/hide/forget) in one call, reserving operator approvals up front for any Tier 1 step (e.g. a forget/delete). Use to batch a memory workflow atomically with respect to approval. Pass approvals keyed by step_id; the plan is hash-bound, and a missing approval aborts the whole plan.

HABEAS PORT: emit a bounded, audited distress signal to your operator through the reserved lane that policy cannot silence. Carries reason + severity + short detail only, never data. Rate limited.

Release an event cursor opened with sanctuary_events_open_cursor. Call when done paging to free the cursor. Returns { closed: true, audit_ref }.

Open a paginated cursor over your own redacted local audit events, optionally filtered by operation. Use before sanctuary_events_read to page through recent activity. Returns { cursor, audit_ref }. Bound to your identity; cross-agent and callback/URL filters are refused.

Read the next page of redacted events from a cursor opened with sanctuary_events_open_cursor (default 10, max 25 per call). Returns { events, next_cursor, audit_ref }. Only your own identity's events are visible; capped at 10 reads per cursor, then rate-limited.

Export a signed, portable identity bundle: { publicKey, did, shr, attestations }. The bundle is signed with the identity's Ed25519 key so a recipient can verify authenticity against the public key. Private keys are never included. Tier 1: requires operator approval, because the bundle leaves the local store.

Permanently delete a memory key via state_delete: the entry is removed and its file gets a best-effort random-byte overwrite before unlinking. On copy-on-write/SSD media (APFS, ext4, flash) the original bytes may persist, so at-rest confidentiality rests on encryption (data is stored as ciphertext), not on the overwrite. Tier 1: requires operator approval; pass the approval proof. Returns an audit_ref for the deletion event.

Given a free-text intent (e.g. "save my timezone", "delete a stored secret", "should I install this"), return which Sanctuary tool to use and how, including a runnable example for ordinary requests. Evaluation questions (what this protects, what the bounds are, which platforms, how to verify, which tier waits on a human, how to uninstall) return intent_class "evaluate" with a guidance string (the README bounds, or the CLI command), a runnable example only where a Tier 3 read-only tool answers unattended, and the related read-only tools with their tiers. An evaluate noun outranks only a bare re…

Mark a stored key as hidden so sanctuary_recall will not return it, without deleting the data. Use to suppress a memory from default reads while keeping it recoverable. Returns an audit_ref; the value still exists in the store and can be deleted with sanctuary_forget.

Trigger a Verascore magic-link login flow so a human principal can authenticate and subsequently claim this agent's DID. The email is sent by Verascore to the supplied address. This tool only initiates the flow; it does not directly bind the DID. Requires operator approval under the default policy (not named in a policy tier; the gate's safe default).

Return active Principal Policy summary: explicit Tier 1 and Tier 3 operation lists plus Tier 2 anomaly-detection configuration. Tier 2 is not exposed as a named operation list. Tier 1 and non-relaxable: requires operator approval on every call.

Read a key from encrypted sovereign memory, verifying integrity before returning. Returns { value, verified: true, audit_ref } (pass opts.full for the full record). Denied if integrity fails or the key was hidden via sanctuary_hide. Use as the read counterpart to sanctuary_remember.

Store a key/value into encrypted sovereign memory for this session. Wraps state_write with an approval-binding and audit record. Use this (not raw state_write) for agent working memory you want auditable. Returns { key, namespace_handle, audit_ref }; the namespace is an opaque handle, never the raw path.

Sign a domain-separated nonce with the agent's Ed25519 key. Used in DID-ownership proof flows. The signed message is constructed as: 'sanctuary-sign-challenge-v1\x00' + purpose + '\x00' + nonce. The verifier MUST reconstruct the same domain-prefixed message before calling Ed25519 verify; a raw-nonce signature is NOT valid for this tool. The `purpose` field binds the signature to a specific use case (e.g. 'verascore-claim') so a signature produced for one purpose cannot be replayed against a different verifier. Requires operator approval under the default policy (not named in a policy tier; the…

Return the disclosable identity facts for the current session: label, did, active-identity fingerprint, and memory namespace handle. Use to confirm which sovereign identity you are operating as. Read-only; private keys are never included.

Verify a presented ERC-8004 agent-identity record. By default this is an offline-only, read-only local check that recomputes the record's signature against the embedded signer address and returns valid/invalid plus the verified identity fields. A valid result is offline-verified only: it proves the record carries a self-consistent secp256k1 signature recoverable to signer_address, not that the signer is the registry owner. If the operator explicitly enables ERC-8004 registry confirmation and configures an RPC endpoint, Sanctuary makes a gated ownerOf(identity) read through the egress gate and …

Request an ERC-8004 Identity Registry registration signature. Requires operator approval under the default policy (not named in a policy tier; the gate's safe default). After that approval the request also passes the key-17 signing policy; a request that policy does not allow returns pending_approval with an inbox entry, and in this release it is not completed from this tool: the operator produces the signature on the CLI by running `sanctuary erc8004 register` with its required registry, chain, agent-id and nonce flags plus `--auto-approve` (the flag that skips the inbox wait). No on-chain br…

Export the Sovereign Data Warehouse (working state, query history, document corpus, vector memory) as a signed, still-encrypted bundle written into a fresh per-export directory under the operator-configured export directory on this machine. Nothing is decrypted and nothing leaves the host; this is an operator-directed archive, not a carriage path, and unsealed memory is never carried by participant Exit. Tier 1: the approval freezes a ciphertext-inventory fingerprint of exactly what will ship; any vault change before packaging aborts the export.

Post-export local-state delete: removes exactly the records listed in a signed export manifest, and only while their stored ciphertext still matches the manifest. Tier 1.

Import a signed SDW export bundle produced by sdw_export. The manifest signature is verified before any approval prompt; records are decrypted only inside the approved flow and re-encrypted under this fortress. Imports are all-or-nothing: they run inside one storage transaction, and a backend without transactions refuses the import outright, before any prompt, rather than applying part of it. The shipped filesystem fortress has no transaction primitive today, so on that backend this tool refuses; only the source key reference `this-fortress` (a bundle this fortress exported) resolves, since cr…

Show per-record SDW memory integrity status. Verified rows expose the bounded fortress-recorded origin/admission classes; a passage admitted through a memory archive import reports its origin-trust tier and the transfer lineage reference; unsigned PRE_MIGRATION rows are explicit. Verification does not prove true authorship, content truth, safety, or a remote identity. Requires operator approval under the default policy (not named in a policy tier; the gate's safe default).

Export this instance's Sovereignty Health Report formatted for Ping Identity's Agent Gateway or other identity providers. Transforms the SHR into an authorization context with sovereignty scores, capability flags, and recommended access constraints.

Generate a signed Sovereignty Health Report (SHR), a machine-readable posture claim. Present it as a signed, fresh advertisement whose signature/identity-binding/expiry/schema can be verified; it does not independently prove every advertised runtime capability.

Verify a counterparty's Sovereignty Health Report (SHR). Checks signature validity, temporal validity, and assesses sovereignty level.

Audit your agent's sovereignty posture. Inspects the local environment for encryption, identity, approval gates, selective disclosure, and reputation, including OpenClaw-specific configurations. Returns a scored gap analysis with prioritized recommendations. Read-only; Tier 3 under the default policy (auto-allowed with an audit record). Call this to evaluate an install.

Generate a system prompt snippet based on the active Sovereignty Profile. The snippet instructs an agent on which Sanctuary features are active and how to use them. Copy and paste this into your agent's system configuration.

Get the current Sovereignty Profile configuration. context_gating is wired to the runtime enforcer; approval_gate is always enabled; other flags are configuration/signaling and may not by themselves enable/disable the underlying tools.

Update Sovereignty Profile configuration. Updating context_gating reconfigures the runtime context-gate enforcer; approval_gate remains always enabled; other flags update profile/signaling state unless separate runtime wiring is present. Tier 1: requires operator approval, because it changes enforcement behavior.

Permanently delete state: removes the entry with a best-effort random-byte overwrite before unlinking. On copy-on-write/SSD media the original bytes may survive, so at-rest confidentiality rests on encryption (data is stored as ciphertext), not on the overwrite. Satisfies right-to-deletion (S1.6) by removing the entry. Tier 1: requires operator approval, because the deletion is irreversible.

Disclose the content of ONE state entry whose writer this fortress cannot establish. Tier 1 and non-relaxable: every call requires an explicit human approval that no policy file can waive, and every call that reaches the disclosure operation is audited with the namespace and the key (an approval the operator declines is recorded by the approval gate under its own operation, which binds an arguments hash rather than the namespace and key in the clear). THIS IS NOT A VERIFIED READ and is not interchangeable with state_read. The result is a structurally different shape: there is no `value` and no…

Export state as an encrypted sanctuary-v1 bundle for migration to another instance of the same fortress, meaning the same master key, for example after restoring via the recovery key. Tier 1: requires operator approval because data leaves the local store. New exports include an authenticated completeness manifest with the namespace set, per-namespace item counts, and per-namespace content checksums. On state_import, the manifest verifies that the bundle body still matches the approved export scope and rejects dropped or added namespaces and entries within that scope. It does not prove that dat…

Import a previously exported encrypted sanctuary-v1 state bundle into another instance of the same fortress, meaning the same master key, for example after restoring via the recovery key. Tier 1: requires operator approval. By default, import requires authenticated bundle integrity and a completeness manifest, then recomputes the manifest before any write. Manifest, count, checksum, timestamp, MAC, or newer-schema mismatches are rejected. The verification proves the bundle body still matches the approved export scope; it does not prove data outside that scope should have been included. Manifes…

List the keys in a namespace with metadata (version, size, timestamps) only: values are not decrypted or returned. Use to enumerate stored state before a targeted state_read. Read-only.

Read and decrypt state from the sovereign store. Verifies integrity via Merkle proof and signature.

Write encrypted state to the sovereign store. Value is encrypted with a namespace-specific key. The write is signed by the active identity.

Create a Pedersen commitment to a numeric value on Ristretto255. Unlike SHA-256 commitments, Pedersen commitments support zero-knowledge proofs: you can prove properties about the committed value without revealing it.

Create a zero-knowledge proof of knowledge for a Pedersen commitment. Proves you know the value and blinding factor without revealing either. Uses a Schnorr sigma protocol with Fiat-Shamir transform.

Create a zero-knowledge range proof: prove that a committed value is within [min, max] without revealing the exact value. Uses bit-decomposition with OR-proofs on Ristretto255.

Verify a zero-knowledge range proof: confirms a committed value is within the claimed range without learning the value.

Verify a zero-knowledge proof of knowledge for a Pedersen commitment. Checks that the prover knows the commitment's opening without learning anything.