// Register agent — one certificate per agent instance. Scope limits are encoded
// into the certificate, so verification enforces authority cryptographically.
const agent = await kakunin.agents.create({
  name: 'payment-processor-eu-v3',
  model_hash: await Kakunin.computeModelHash('payment-processor:v3.1.0'),
  model: 'payment-processor',
  version: '3.1.0',
  permitted_actions: ['charge', 'refund'],
  financial_scope: {
    max_single_trade_usd: 10_000,
    permitted_venues: ['stripe', 'revolut'],
  },
  metadata: { deployment: 'k8s-eu-west-1', instance: process.env.POD_NAME },
});

const cert = await kakunin.agents.certify(agent.id);
// cert.certificate_pem — public certificate (safe to share, embed in requests).
// The RSA private key stays in Kakunin's AWS KMS and never leaves the HSM.

Kakunin Root CA (AWS KMS RSA_4096, eu-west-1)
  └── Kakunin Intermediate CA (per-tenant)
        └── Agent Certificate (per-agent-instance)
              ├── Subject: CN=payment-processor-eu-v3
              ├── SAN: agent-id=a_xyz123
              ├── Scope extensions (custom X.509 extensions)
              └── Validity: 365 days

// Kakunin signs with the agent's KMS-backed key — you never hold key material.
async function signAction(agentId: string, payload: object) {
  const res = await fetch(`https://api.kakunin.ai/v1/agents/${agentId}/sign`, {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.KAKUNIN_API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ payload }),
  });
  // → { signature, certificate_serial, ... }. The signature is produced inside
  //   AWS KMS (RSASSA_PKCS1_V1_5_SHA_256); the private key never leaves the HSM.
  return res.json();
}

async function verifySignedAction(
  payload: Record<string, unknown>,
  signature: string,
  certificateSerial: string,
) {
  const res = await fetch('https://api.kakunin.ai/v1/verify/message', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ payload, signature, certificate_serial: certificateSerial }),
  });
  const result = await res.json();
  if (!result.valid) throw new Error('signature or certificate invalid');

  // Enforce scope from the verified certificate
  if ((payload.amount as number) > result.financial_scope.max_single_trade_usd) {
    throw new Error('Action exceeds certificate scope');
  }
  return { verified: true, agentId: result.agent_id };
}

import { createVerifier } from '@kakunin/sdk/verify';

const verifier = createVerifier();          // fail-closed, 60s cert cache
const serial = process.env.AGENT_CERT_SERIAL!;

// Wrap a tool so its scope is checked (fail-closed) before every call.
function guard<T>(action: string, fn: (p: T) => Promise<unknown>) {
  return async (params: T) => {
    const agent = await verifier.cert(serial);
    if (agent.status !== 'active' || !agent.permitted_actions.includes(action)) {
      throw new Error(`scope violation: '${action}' not permitted`);
    }
    // On failure the LLM receives a tool error, not unguarded execution.
    return fn(params);
  };
}

const tools = {
  charge: guard('charge', async (params) => stripe.charges.create(params)),
  refund: guard('refund', async (params) => stripe.refunds.create(params)),
};

import os
from kakunin import Kakunin, verify_agent_scope
from langchain_core.tools import tool

client = Kakunin(api_key=os.environ["KAKUNIN_API_KEY"])
AGENT_ID = os.environ["AGENT_ID"]

# verify_agent_scope confirms the agent is active and holds "charge" before the
# tool runs, raising ScopeViolationError otherwise (never swallowed).
@tool
@verify_agent_scope(client, agent_id=AGENT_ID, required_scopes=["charge"])
def process_payment(amount: float, currency: str, customer_id: str) -> str:
    """Process a customer payment."""
    result = stripe.charge(amount, currency, customer_id)
    return f"Charged {amount} {currency} to {customer_id}: {result.id}"

// Register the agent, then ingest events during a warm-up run.
const agent = await kakunin.agents.create({
  name: 'payment-processor-eu-v3',
  model_hash: await Kakunin.computeModelHash('payment-processor:v3'),
  model: 'payment-processor',
  version: '3.0.0',
});

// Kakunin builds the behavioral baseline automatically from ingested events over
// a rolling 30-day window — there is nothing to author or lock. Check progress
// with getRisk: drift.drift_score stays null until the baseline is established.
const risk = await kakunin.agents.getRisk(agent.id);
console.log(risk.drift.drift_score);  // null while warming up, then a number
console.log(risk.dominant_band);      // 'low' | 'medium' | 'high'

// Webhook received when anomaly threshold breached
app.post('/webhook/kakunin', async (req, res) => {
  const event = req.body;

  if (event.type === 'agent.pre_revocation_warning') {
    const { agent_id, risk_score, anomaly_details } = event.data;

    // 1. Page on-call
    await pagerduty.createIncident({
      title: `Agent ${agent_id} anomaly score ${risk_score}`,
      severity: 'high',
      details: anomaly_details,
    });

    // 2. Optional: suspend non-critical tasks while investigating
    await agentOrchestrator.pause(agent_id, { reason: 'anomaly_investigation' });

    res.json({ acknowledged: true });
  }

  if (event.type === 'agent.certificate_revoked') {
    const { agent_id, revocation_reason } = event.data;

    // 1. Hard stop — refuse all new tasks
    await agentOrchestrator.terminate(agent_id);

    // 2. Quarantine transactions from the anomaly window
    await compliance.flagForReview({
      agent_id,
      from: event.data.anomaly_start,
      to: event.data.revoked_at,
    });

    // 3. Spin up replacement agent (new certificate, fresh identity)
    await agentOrchestrator.spawn({
      template: agent_id,
      reason: 'post_revocation_replacement',
    });

    res.json({ acknowledged: true });
  }
});

// Pull all actions for the affected agent during the incident window
const auditTrail = await supabase
  .from('audit_log')
  .select('*')
  .eq('tenant_id', tenantId)
  .eq('actor_id', agentId)
  .gte('created_at', incidentStart.toISOString())
  .lte('created_at', incidentEnd.toISOString())
  .order('created_at', { ascending: true });

// Each row contains:
// - Signed action payload (proves what the agent intended)
// - Signature (proves it was this agent's certificate)
// - Risk score at time of action
// - Tool call parameters
// - Outcome

apiVersion: v1
kind: Pod
metadata:
  name: payment-agent-pod
  annotations:
    kakunin.ai/agent-id: "a_xyz123"
    kakunin.ai/certificate-fingerprint: "sha256:abc..."
spec:
  serviceAccountName: payment-agent-sa  # Minimal RBAC
  securityContext:
    runAsNonRoot: true
    runAsUser: 65534
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: agent
    image: myorg/payment-agent:v3.1.0
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop: [ALL]
      readOnlyRootFilesystem: true
    env:
    - name: AGENT_ID
      value: "a_xyz123"
    - name: KMS_KEY_ARN
      valueFrom:
        secretKeyRef:
          name: kakunin-creds
          key: kms-key-arn
    # KAKUNIN_API_KEY from Doppler / external-secrets
    volumeMounts:
    - name: cert-volume
      mountPath: /var/certs
      readOnly: true
    - name: tmp
      mountPath: /tmp
  volumes:
  - name: cert-volume
    projected:
      sources:
      - secret:
          name: agent-certificate
  - name: tmp
    emptyDir: {}

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: payment-agent-egress
spec:
  podSelector:
    matchLabels:
      app: payment-agent
  policyTypes: [Egress]
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0  # Stripe, Kakunin API
    ports:
    - protocol: TCP
      port: 443
  # Block all other egress (no DNS exfiltration, no metadata endpoints)