# Trust Fleet v1 — Catalog Guardian **Status:** local-first implemented · dry-run validated against five packaging pilots **Scope:** skills that already have packaging metadata only **Commerce:** sealed-pack + x402 unlock path is **never** mutated by this fleet --- ## 1. Purpose Continuously maintain **honest** scan and signature status for packaged skills: - Re-scan Dockerfiles (policy lint / available scanners) - Re-verify detached signatures - Downgrade badges or quarantine on failure - Emit explainability + auditor trail on every decision - Escalate to humans when action is adverse or tools fail **Never:** autonomous deletion, inventing scan success, emitting `enterprise_ready`. --- ## 2. Roles (four agents) | Role | Agent id | Responsibility | Reuses | |------|----------|----------------|--------| | **Catalog Scanner** | `trust-fleet-catalog-scanner` | Load packaging-eligible skills; run scan + signature verify; write evidence files | `packaging/container-skill/scripts/*`, `dockerfile-lint.mjs`, openssl | | **Trust Reporter** | `trust-fleet-trust-reporter` | Compare prior pilot status vs observed; score maturity honestly | `agent-orchestration` handoff shape; explainability posture | | **Quarantine / Badge Manager** | `trust-fleet-quarantine-badge` | Decide `keep` / `badge_downgrade` / `quarantine` only | badge rules in `build-catalog.js` `trustBadgesFor` | | **Escalation** | `trust-fleet-escalation` | Open human tickets for fail/quarantine/tool-gap | supervisor/human-in-loop pattern; no auto-delete | Each role is a **thin local wrapper** (not a new LLM runtime). Fleet agents ship reference Dockerfiles so they are **treatable as** packaging skills and can climb to `scanned_and_signed` via the same harden path. --- ## 3. Data flow ``` data/packaging-pilot.json (skills with packaging only) │ ▼ Catalog Scanner ──► evidence per skill (scan.json, verify.json) │ ▼ Trust Reporter ───► observed maturity + delta report │ ▼ Quarantine/Badge ─► decision (keep | badge_downgrade | quarantine) │ ▼ Escalation ───────► open tickets if adverse or tool error │ ▼ audit trail (schemas/trust-fleet-audit.v1.schema.json) │ ┌─────┴─────┐ │ dry_run │ apply ▼ ▼ no writes packaging-pilot.json status fields + recommended: node scripts/build-catalog.js ``` **Integration write surface (apply mode only):** | Target | What fleet may write | |--------|----------------------| | `data/packaging-pilot.json` | `maturity`, `security.scan.*`, `security.signature.*` (status/timestamps), `trust_badges`, `security.quarantine` (optional object), notes | | `public/catalog.json` | **Indirect** — rebuild via `node scripts/build-catalog.js` (fleet does not patch catalog by hand) | | Sealed packs / `/api/pay` | **Never** | --- ## 4. Decision rules (explainable) | Rule id | Condition | Action | |---------|-----------|--------| | `TF-SCOPE-01` | Skill has no packaging metadata | `noop_no_packaging` (skip) | | `TF-KEEP-01` | scan=`pass` AND signature=`verified` | `keep` + maturity `scanned_and_signed` | | `TF-DOWN-01` | scan=`fail` OR signature≠`verified` | `badge_downgrade` to honest maturity | | `TF-QUAR-01` | scan=`fail` with high/critical policy errors OR signature=`invalid` | `quarantine` (badge strip of scanned/signed; mark quarantine; **no delete**) | | `TF-ESC-01` | Any quarantine, tool crash, or unexpected delta | `escalate` (human required) | | `TF-NEVER-01` | — | Never emit `enterprise_ready`; never delete skill/files | Quarantine meaning: catalog packaging badges drop to sealed-pack baseline + `reference_dockerfile` if Dockerfile still present; `security.quarantine = { active: true, reason, at }`. Skill remains buyable via x402. --- ## 5. Scheduling | Trigger | Cadence / event | Mode | |---------|-----------------|------| | Cron (local) | Daily `06:15 UTC` | dry_run by default; apply if `TRUST_FLEET_APPLY=1` | | Post-harden | After `harden-pilot.mjs` | dry_run verify | | Packaging metadata change | When `data/packaging-pilot.json` changes | dry_run | | Manual | Operator runs CLI | dry_run or `--apply` | | Upload pipeline | **Planned** when open marketplace accepts packaging | not wired | Schedule config: `packaging/trust-fleet/schedule/schedule.json` Runner: `node packaging/trust-fleet/scripts/run-fleet.mjs` Optional cron example: ```cron 15 6 * * * cd /path/to/lvlltd-agent-marketplace && node packaging/trust-fleet/scripts/run-fleet.mjs >> packaging/trust-fleet/evidence/cron.log 2>&1 ``` --- ## 6. Escalation | Severity | When | Human action | |----------|------|--------------| | low | Tool gap documented (trivy missing) | Install scanner later | | medium | Badge downgrade from dual-harden | Re-run harden; review Dockerfile | | high | Signature invalid | Rotate key or re-sign; check tamper | | critical | Multiple pilots fail same run | Pause apply mode; investigate | Escalations are **files** under `packaging/trust-fleet/evidence/escalations/` (local-first). No Slack/email required for v1. --- ## 7. Fleet agent packaging Fleet agents live under `packaging/trust-fleet/agents/*` with reference Dockerfiles. They are hardened with the same lint + openssl path so their packaging maturity can be `scanned_and_signed` without claiming image publish or enterprise readiness. Metadata: `packaging/trust-fleet/packaging-meta.json` (fleet-owned; separate from the five product pilots unless promoted later). --- ## 8. Gaps (honest) | Gap | Severity | Smallest addition | |-----|----------|-------------------| | trivy / hadolint / cosign missing | medium | Install tools; scanner already prefers them when present | | No live upload-hook | medium | Call `run-fleet.mjs --skill=` from upload QC after packaging fields appear | | No remote ticket system | low | Keep local escalation JSON; optional webhook later | | Fleet agents not in public catalog | low | Optional: register as internal skills when productized | | Continuous multi-host fleet | n/a | Out of scope — local operator only | --- ## 9. Commands ```bash # Dry-run (default) — five pilots from packaging-pilot.json node packaging/trust-fleet/scripts/run-fleet.mjs # Apply status writes to packaging-pilot.json (still no sealed-pack/x402 touch) node packaging/trust-fleet/scripts/run-fleet.mjs --apply # Self-scan fleet agents as packaging subjects node packaging/trust-fleet/scripts/run-fleet.mjs --self-package # Rebuild catalog after apply node scripts/build-catalog.js ``` ## 10. Related - `docs/CONTAINER-SKILL-PACKAGING.md` — maturity ladder - `schemas/container-skill-packaging.v1.schema.json` - `schemas/trust-fleet-audit.v1.schema.json` - `packaging/container-skill/scripts/harden-pilot.mjs` - `docs/A2A-SWARM.md` — orchestration / human escalation culture