[tanmayyyyayyy]

Summary

Adds the governance-hardening capabilities that were missing from the Warden gateway, without touching working code paths.

• Tamper-evident audit log — each JSONL record now hash-chains to the previous one (prevHash + hash, SHA-256 over a canonical encoding, GENESIS anchor). AuditLog.verify() recomputes the chain and reports the first modified, reordered, deleted, or unchained record; a missing log is never reported valid.
• Agent controls — server-side pause / resume / quarantine (AgentControlStore) enforced at the top of /intercept, so neither client-supplied claims nor a previously pending approval can bypass them.
• Deterministic demo fixture — cerberus demo seed writes an allow / block / human-review-and-denied fixture through the real AuditLog (records events only; runs no tool) and keeps the chain valid.
• One-command startup — npm run demo checks Node/deps, installs/builds if needed, seeds, then starts the gateway.
• Dashboard — live audit-verification status badge, agent status controls panel, and hello now carries recent audit history so the Live counters reflect seeded/historical state.

No bugs were found in the existing enforcement; the baseline suites were already green. One authored test expectation was corrected (an absent audit file must be invalid, not valid).

Security

• Governance enforcement: unchanged single choke point at /intercept; the new pause/quarantine gate runs before the signal pipeline, the pending queue, and tool execution.
• Approval handling: unchanged behavior preserved; the new gate is checked ahead of any held approval, so a paused/quarantined session cannot execute via an old pending request.
• Agent pause and quarantine: server-side only (AgentControlStore), exposed via GET /agents and POST /agents/status (origin-gated); CLI cerberus agents|pause|resume|quarantine.
• Audit integrity: hash-chained and verifiable via cerberus audit verify / GET /audit/verify. Explicitly tamper-evident, not tamper-proof — a locally editable file makes modification detectable, not impossible.

Testing

Executed locally (Node v25.9.0):

• npm run typecheck — PASS
• npm run build (engine tsc + dashboard tsc --noEmit && vite build) — PASS
• Unit suites — PASS, including new test:audit-chain (11) and test:controls (11); all 22 pre-existing suites green (behavioral 9, content 31, injection 9, bypass 138, fp 37, hook 3, store 11, mcp-scan 32, proxy 8, deps 21, ioc 19, risk 15, init 20, projector 21, audit 14, notify 6, security 7, policy 31, adapters 22, validate 13).
• scripts/smoke.mjs engine smoke — 11/11 PASS.
• Custom engine integration — 12/12 PASS: allow / block / HITL-approve / pause-block / quarantine-block / resume / agents overview / audit chain valid / tamper detected.
• Could not run: test:mitm fails on Node v25 (ERR_INVALID_ARG_VALUE: TLS servername must not be an IP) — pre-existing and environmental; CI pins Node 20. Unrelated to these changes.

Both new suites are wired into .github/workflows/ci.yml.

Demo

npm install && npm --prefix dashboard install
npm run demo            # seeds the fixture + starts the gateway → http://127.0.0.1:9000/

• Live operations: decisions, audit-verified badge, and agent controls.
• Sessions: the seeded allow / block / human-review run.
• Tamper demo: edit a line in .cerberus/audit.jsonl, then node bin/cerberus.mjs audit verify (exits non-zero, names the first bad record).
• Kill switch: node bin/cerberus.mjs pause <sessionId> then re-issue a governed call; it is blocked.

Limitations

• Fork of the Cerberus engine; upstream attribution and notices are preserved.
• The hash-chained log is tamper-evident, not tamper-proof (no remote anchor/retention).
• Pause/quarantine state is in-memory per engine process (single local tier); the store interface is the seam for a Redis-backed multi-instance tier.
• The original brief's finance-agent scenarios (transfer_money, currency thresholds) do not exist in this repository and were intentionally not fabricated.
• Not production-ready; this is a hackathon prototype with the demo path verified end-to-end.