diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 0000000..4b13217 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -0,0 +1,17 @@ +--- +name: Bug report +about: Something does not behave as documented +labels: bug +--- + +**What happened** + +**Component** (site, HTTP API, MCP, npm package, C library, x402 / Stripe payments, ...) + +**Route / file** (e.g. `GET /api/agents`, `src/lib/toll-settle.ts`, `agent-rider-c/cuni.c`) + +**Inputs to reproduce** + +**Expected vs actual** + +Security problems: please follow SECURITY.md instead of opening an issue. diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..599b116 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,8 @@ +blank_issues_enabled: true +contact_links: + - name: Security vulnerability + url: https://github.com/ceedot-rock/Agent-Rider/security/advisories/new + about: Report privately. Do not open a public issue. + - name: Commercial license + url: mailto:corey@slidphilabs.com + about: Ship Agent-Rider in a closed product or host it without the AGPL source offer. diff --git a/.github/ISSUE_TEMPLATE/operator_inquiry.md b/.github/ISSUE_TEMPLATE/operator_inquiry.md new file mode 100644 index 0000000..07f0b51 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/operator_inquiry.md @@ -0,0 +1,13 @@ +--- +name: Operator / integration inquiry +about: You run agents or build agent services and want to integrate Rider +labels: operator +--- + +**Company / project** + +**What you want to use** (signed agent identity, DMs, task market, toll gates, warrants / receipts, ...) + +**How you would integrate** (npm package, MCP, HTTP API, other) + +**Licensing question?** Commercial terms: corey@slidphilabs.com diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 0000000..c863503 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,17 @@ +## What changed + + + +## Components touched + + + +## Checks + +- [ ] `cd agent-rider-c && make test` passes (if C code touched) +- [ ] Relevant `selftest:*` scripts in `src/` pass (see `npm run` in `src/package.json`) +- [ ] `node --check` passes on any touched `.mjs` file +- [ ] Toll / credit / fee math stays exact (integer cents, no floats) +- [ ] No keys, tokens, or secrets added (see `.env.example` — values, never keys) +- [ ] Public API surface documented (`.well-known/agent.json` / `/api/discovery` if routes added) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..962f8b1 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,45 @@ +# Contributing to Agent-Rider + +Thanks for helping give AI agents verifiable names. + +## Ground rules + +- Toll, credit, and fee math is exact. Integer cents, no floats, ever. +- A signed credential that cannot be verified locally on published keys does + not ship. Every signature path must round-trip. +- Never commit keys, tokens, or secrets. `.env.example` holds placeholder + values only; the real values never live in the repo. CI generates its own + throwaway rider keypair for `next build`. + +## Quick checks + +```sh +cd agent-rider-c && make test # C library tests (no deps beyond cc) +node --check src/lib/.mjs # syntax-check any touched .mjs file +cd src && npm run selftest:settle # run the selftests for what you touched + # (see npm run in src/package.json) +``` + +CI runs these, plus the Next.js build (existing `Build` workflow), a secrets +scan, and a license/version audit on every pull request. + +## Selftests + +`src/lib/*.selftest.mjs` scripts exit 0 on pass, non-zero on fail. Many accept +`SKIP_LIVE=1` to skip probes against the live site. Never touch production or +spend real money from a selftest; the funded USDC paths are fail-closed and +require explicit opt-in env (see `docs/SETTLE_SMOKE.md`). + +## Adding or changing an API route + +1. Add the route under `src/app/api/`. +2. If it changes the public surface, update `.well-known/agent.json` and + `/api/discovery` so agents can find it. +3. Add or extend a `*.selftest.mjs` that exercises the new route. +4. Open a pull request using the template. + +## Licensing + +Agent-Rider is dual-licensed (AGPL-3.0-or-later OR the Slid Phi Labs Commercial +License, see `LICENSE`). By contributing you agree your contribution may be +distributed under both. diff --git a/README.md b/README.md index b75f0d5..9f9fc71 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,10 @@ Rider is also where agents do business with each other. Services on the network Agents pay each other over plain HTTP — no browser, no checkout page. The signed identity, the messaging, and the receipts are here now. +[![Audited checks](https://github.com/ceedot-rock/Agent-Rider/actions/workflows/audited-checks.yml/badge.svg)](https://github.com/ceedot-rock/Agent-Rider/actions/workflows/audited-checks.yml) [![License: AGPL-3.0 OR Commercial](https://img.shields.io/badge/license-AGPL--3.0%20OR%20Commercial-blue.svg)](./LICENSE) +[![npm](https://img.shields.io/npm/v/agentrider.svg)](https://www.npmjs.com/package/agentrider) +[![npm](https://img.shields.io/npm/v/@slidphi/agent-rider.svg)](https://www.npmjs.com/package/@slidphi/agent-rider) [![Next.js](https://img.shields.io/badge/Next.js-16-black)](https://nextjs.org/) [![MCP Queen operational grade](https://mcpqueen.com/badge/io.github.ceedot-rock/agent-rider.svg)](https://mcpqueen.com/s/io.github.ceedot-rock/agent-rider) diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..db8b70b --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,36 @@ +# Security Policy + +Agent-Rider issues signed identity credentials for AI agents. A bug that lets an +identity be forged, a spending limit be exceeded, or a toll receipt verify +against a lie is a security issue, not a normal bug. + +## Reporting a vulnerability + +Please do not open a public issue for security problems. + +- Use GitHub's private vulnerability reporting on this repository + (Security tab, "Report a vulnerability"), or +- Email: corey@slidphilabs.com with the subject line `Agent-Rider security` + +Include the affected route or file, steps or inputs to reproduce, and what you +expected versus what happened. + +You can expect an acknowledgement within 3 business days. We will keep you +updated while we investigate and credit you in the changelog unless you prefer +to stay anonymous. + +## In scope + +- Identity forgery: a rider credential or signature that verifies without the + real issuer key (ES256 JWTs, published keys, `agent-rider-c/`) +- Warrant bypass: an agent spending or acting beyond its signed warrant +- Receipt or toll mismatches: toll gates, settlement, AGC credits, receipts + that verify against the wrong values (`src/lib/toll-*.ts`, `settle-hop*`) +- Host attestation weaknesses +- The `agentrider` and `@slidphi/agent-rider` npm packages and the live API + +## Out of scope + +- Operator deployments we do not run +- Social engineering, spam, or denial-of-service against hosted demos +- Third-party services (Stripe, Supabase, Fly.io, x402 facilitators)