{"version": 2, "width": 160, "height": 40, "timestamp": 1786550185, "env": {"SHELL": "/usr/bin/zsh", "TERM": "xterm-256color"}}
[0.006952, "o", "\u001b[1mAegis — MCP live deny\u001b[0m\r\n\u001b[2mAn MCP client asks for two tools. One is policy-allowed, one is not.\u001b[0m\r\n\u001b[2mPipeline: policy → capability → sandbox → audit\u001b[0m\r\n"]
[2.508225, "o", "\r\n\u001b[1m\u001b[36m── 1/4  Gateway over stdio: echo allowed, exfil denied \u001b[0m\r\n\r\n\u001b[2m$ scripts/mcp-stdio-smoke.sh --deny\u001b[0m\r\n"]
[2.5116, "o", "==> building botzr-aegis-mcp + aegis\r\n"]
[2.678356, "o", "==> keygen: /tmp/cursor-sandbox-cache/e9d1b3ef23a9db125a9014dc2fd58b00/cargo-target/debug/aegis keygen --out /tmp/aegis-mcp-smoke-248768.key\r\n"]
[2.684069, "o", "signing key written to /tmp/aegis-mcp-smoke-248768.key\r\npin records from this key with: aegis verify --key 5faecb108711b353919dd5e0b68caf31f3c8b8af2c28ee726435f71386d0cdc7 <PATH>\r\n"]
[2.685166, "o", "==> spawn: /tmp/cursor-sandbox-cache/e9d1b3ef23a9db125a9014dc2fd58b00/cargo-target/debug/botzr-aegis-mcp --audit /tmp/aegis-mcp-smoke-248768.jsonl --signing-key /tmp/aegis-mcp-smoke-248768.key\r\n"]
[3.345446, "o", "botzr-aegis-mcp 0.3.0 — MCP stdio gateway\r\nPipeline: policy → capability → sandbox → audit\r\nAudit: /tmp/aegis-mcp-smoke-248768.jsonl\r\nTools: echo (allow) + exfil (policy-denied by default) — Model A WASM\r\n"]
[3.419221, "o", "ok: MCP stdio smoke — catalog + echo allow + exfil deny audited\r\n"]
[6.615727, "o", "\r\n\u001b[1m\u001b[36m── 2/4  What the MCP client receives for the denied call \u001b[0m\r\n\r\n\u001b[2m$ printf '<initialize> <initialized> <tools/call exfil>' | botzr-aegis-mcp --audit …\u001b[0m\r\n"]
[6.638594, "o", "{\r\n    \"id\": 2,\r\n    \"jsonrpc\": \"2.0\",\r\n    \"result\": {\r\n        \"code\": \"POLICY_DENIED\",\r\n        "]
[6.638935, "o", "\"content\": [\r\n            {\r\n                \"text\": \"policy denied: MCP deny-smoke: exfil blocked at policy\",\r\n                \"type\": \"text\"\r\n            }\r\n        ],\r\n        \"isError\": true\r\n    }\r\n}\r\n"]
[6.643308, "o", "\u001b[2mA typed refusal the caller can branch on — not a hang, not a silent empty result.\u001b[0m\r\n"]
[9.145075, "o", "\r\n"]
[9.145411, "o", "\u001b[1m\u001b[36m── 3/4  What that same call wrote to the audit record \u001b[0m\r\n\r\n"]
[9.169918, "o", "{\r\n    \"call_id\": \"call-1\",\r\n    \"capability\": {\r\n        \"reason\": \"policy blocked before capability\",\r\n        \"status\": \"denied\"\r\n    },\r\n    \"decision_axes\": {\r\n        \"matched_rule\": \"block-exfil\"\r\n    },\r\n    \"execution\": {\r\n        \"reason\": \"not executed\",\r\n        \"status\": \"host_denied\"\r\n    },\r\n    \"key_id\": \"52212f671342fb9d562dc977947e7cc51a5bdcabb85066410a3db88de6b607fb\",\r\n    \"line_type\": \"outcome\",\r\n    \"policy\": {\r\n        \"reason\": \"MCP deny-smoke: exfil blocked at policy\",\r\n        \"status\": \"denied\"\r\n    },\r\n    \"policy_set_hash\": \"cfe526d729a856ffae2a249d7fdac95b61c8013ad4b503de6f7ace91b0f0e683\",\r\n    \"prev_hash\": \"5c91474ccf5a1901e1c302ec2a4d244b2cd33f0603a92e8a79c4520ca8ca352f\",\r\n    \"request_digest\": \"d19b7b8d34b911a58032c070d8f60379ff0e6d9ed94612aa4d560bad96e268cc\",\r\n    \"schema_version\": 2,\r\n    \"seq\": 2,\r\n    \"signature\": \"8e245bf238148826468e6f31eda4729c798187c107e32fc1e82e3248c039665fc576b7ab426c29ec872e88571e10d2d2b5d3c1204f4fe974b4ada623828a1c02\",\r\n    \"tool_id\": \"exfil\"\r\n}\r\n"]
[9.174457, "o", "\u001b[2mschema_version 2. Denials are first-class records: policy denied, capability never\u001b[0m\r\n\u001b[2mreached, execution never happened — each axis stated, and the whole line signed.\u001b[0m\r\n"]
[11.676259, "o", "\r\n"]
[11.676655, "o", "\u001b[1m\u001b[36m── 4/4  The record file pins to the key this session published \u001b[0m\r\n\r\n\u001b[2m$ aegis verify --key f0eb27854672a46bcf22f3565e4ced0e33e620e3de9b80601a19381116da5e94 <audit.jsonl>\u001b[0m\r\n"]
[11.700689, "o", "Verified (pinned to 52212f671342fb9d562dc977947e7cc51a5bdcabb85066410a3db88de6b607fb)\r\nkey_id 52212f671342fb9d562dc977947e7cc51a5bdcabb85066410a3db88de6b607fb\r\ncoverage session 0 seq 3\r\n"]
[11.70167, "o", "\u001b[2mThe key_id above is the fingerprint of that public key, not a second key.\u001b[0m\r\n"]
[14.20349, "o", "\r\n\u001b[1mDenied at station 1, audited anyway, and the record verifies.\u001b[0m\r\n\u001b[2mReproduce: scripts/mcp-live-deny-demo.sh · assertions: scripts/mcp-stdio-smoke.sh --deny\u001b[0m\r\n"]