feat(hermes-attestation-guardian): harden attestation verification and drift controls

skills/hermes-attestation-guardian/CHANGELOG.md

@@ -0,0 +1,11 @@
+# Changelog
+
+## [0.0.1] - 2026-04-15
+
+- Implemented deterministic Hermes attestation generator CLI (`scripts/generate_attestation.mjs`).
+- Implemented fail-closed verifier CLI with schema, canonical digest, expected checksum, and optional detached signature checks (`scripts/verify_attestation.mjs`).
+- Implemented meaningful baseline diff engine with stable severity mapping for risky toggle regressions, feed verification regressions, trust anchor drift, and watched file drift (`lib/diff.mjs`).
+- Implemented Hermes-only cron setup helper with print-only default and managed-block apply mode (`scripts/setup_attestation_cron.mjs`).
+- Added shared attestation library for canonicalization, schema validation, digest generation, and policy parsing (`lib/attestation.mjs`).
+- Expanded tests for schema determinism, diff behavior, generator/verifier fail-closed behavior, and cron helper Hermes-only output.
+- Updated metadata/docs to match actual implemented behavior and ClawSec release pipeline expectations.

skills/hermes-attestation-guardian/README.md

@@ -0,0 +1,45 @@
+# hermes-attestation-guardian
+
+Hermes-only security attestation and drift detection skill.
+
+Status: implemented (v0.0.1), Hermes-only.
+
+## What it does
+
+- Generates deterministic Hermes runtime posture attestations.
+- Verifies attestation schema + canonical digest with fail-closed semantics.
+- Optionally verifies detached signatures using a provided public key.
+- Fails closed on baseline diffing unless baseline authenticity is verified (trusted digest and/or detached signature).
+- Restricts attestation output writes to Hermes attestation scope (`$HERMES_HOME/security/attestations`).
+- Compares baseline vs current attestations with stable severity classification.
+- Provides an optional Hermes-oriented cron setup helper (print-only by default).
+
+## Scope boundaries
+
+In scope:
+- Hermes environment posture snapshots
+- deterministic baseline diffing
+- fail-closed verification semantics
+- Hermes optional scheduling helper
+
+Out of scope / unsupported (v0.0.1):
+- OpenClaw runtime hooks (unsupported)
+- destructive auto-remediation
+- automatic rollback of runtime configuration
+
+## Quickstart
+
+```bash
+node scripts/generate_attestation.mjs
+node scripts/verify_attestation.mjs --input ~/.hermes/security/attestations/current.json
+node scripts/setup_attestation_cron.mjs --every 6h --print-only
+```
+
+## Tests
+
+```bash
+node test/attestation_schema.test.mjs
+node test/attestation_diff.test.mjs
+node test/attestation_cli.test.mjs
+node test/setup_attestation_cron.test.mjs
+```

skills/hermes-attestation-guardian/SKILL.md

@@ -0,0 +1,96 @@
+---
+name: hermes-attestation-guardian
+version: 0.0.1
+description: Hermes-only runtime security attestation and drift detection skill for operator-managed Hermes infrastructure.
+homepage: https://clawsec.prompt.security
+clawdis:
+  emoji: "🛡️"
+  requires:
+    bins: [node]
+---
+
+# Hermes Attestation Guardian
+
+IMPORTANT SCOPE:
+- This skill targets Hermes infrastructure only (CLI/Gateway/profile-managed deployments).
+- This skill is not an OpenClaw runtime hook package.
+
+## Goal
+
+Generate deterministic Hermes posture attestations, verify them with fail-closed integrity checks, and compare baseline drift using stable severity mapping.
+
+## Commands
+
+```bash
+# Generate attestation (default output: ~/.hermes/security/attestations/current.json)
+node scripts/generate_attestation.mjs
+
+# Generate with explicit policy + deterministic timestamp
+node scripts/generate_attestation.mjs \
+  --policy ~/.hermes/security/attestation-policy.json \
+  --generated-at 2026-04-15T18:00:00.000Z \
+  --write-sha256
+
+# Verify schema + canonical digest
+node scripts/verify_attestation.mjs --input ~/.hermes/security/attestations/current.json
+
+# Verify with baseline diff (baseline must be authenticated)
+node scripts/verify_attestation.mjs \
+  --input ~/.hermes/security/attestations/current.json \
+  --baseline ~/.hermes/security/attestations/baseline.json \
+  --baseline-expected-sha256 <trusted-baseline-sha256> \
+  --fail-on-severity high
+
+# Optional detached signature verification
+node scripts/verify_attestation.mjs \
+  --input ~/.hermes/security/attestations/current.json \
+  --signature ~/.hermes/security/attestations/current.json.sig \
+  --public-key ~/.hermes/security/keys/attestation-public.pem
+
+# Preview scheduler config without mutating user schedule state
+node scripts/setup_attestation_cron.mjs --every 6h --print-only
+
+# Apply managed scheduler block
+node scripts/setup_attestation_cron.mjs --every 6h --apply
+```
+
+## Attestation payload (implemented)
+
+The generator emits:
+- schema_version, platform, generated_at
+- generator metadata (skill + node version)
+- host metadata (hostname/platform/arch)
+- posture.runtime (gateway enabled flags + risky toggles)
+- posture.feed_verification status (verified|unverified|unknown)
+- posture.integrity watched_files and trust_anchors (existence + sha256)
+- digests.canonical_sha256 over a stable canonical JSON representation
+
+## Fail-closed behavior
+
+Verifier exits non-zero when:
+- schema validation fails
+- canonical digest algorithm is unsupported or digest binding mismatches
+- expected file sha256 mismatches (if configured)
+- detached signature verification fails (if configured)
+- baseline is provided without authenticated trust binding (`--baseline-expected-sha256` and/or baseline signature + public key)
+- baseline authenticity or baseline schema/digest validation fails
+- baseline diff highest severity is at/above `--fail-on-severity` (default: critical)
+
+Severity messages are emitted as INFO / WARNING / CRITICAL style lines.
+
+## Side effects
+
+- `generate_attestation.mjs` writes one JSON file (and optional `.sha256`) under `$HERMES_HOME/security/attestations`.
+- `verify_attestation.mjs` is read-only.
+- `setup_attestation_cron.mjs` is read-only unless `--apply` is provided.
+- `setup_attestation_cron.mjs --apply` rewrites only the current user managed schedule block delimited by:
+  - `# >>> hermes-attestation-guardian >>>`
+  - `# <<< hermes-attestation-guardian <<<`
+
+## Notes
+
+- Default output root is `~/.hermes/security/attestations/`.
+- No destructive remediation actions (delete/restore/quarantine) are implemented.
+- Operator policy file is optional JSON with:
+  - `watch_files`: list of file paths
+  - `trust_anchor_files`: list of file paths