articles-of-agreement-auditor

name	articles-of-agreement-auditor
description	Audits an Articles of Agreement contract — the daemon-witnessed agreement every official Port Daddy agent signs covering registration, transcript reporting, tool-use gating, file claims, parley conduct, budget limits, and operator control — against the enforcement-beats-hope bar: a clause counts as safe only when it resolves to a concrete, daemon-observable mechanism with a defined denial shape, never a promise the agent might honor. Use when drafting a new agent's Articles, reviewing a compliance-level (C0-C6) claim, deciding whether a clause is genuinely enforced or merely documented, or auditing whether an agent's claimed identity can be trusted. NOT for securing the inbound event-to-spawn path (fleet-event-spawn-trust), designing the relay's transport PKI and signing keys (pd-relay-zero-trust), or tracking an agent's identity and reputation across its whole lifetime after it signs (agent-identity-continuity-reputation).
license	Apache-2.0
allowed-tools	Read,Write,Edit,Bash,Grep,Glob
metadata	{"category":"Agent & Orchestration","tags":["articles-of-agreement","enforcement-beats-hope","daemon-observable","capability-lease","agent-contract"],"provenance":{"kind":"first-party","owners":["port-daddy"]},"pairs-with":[{"skill":"human-gate-designer","reason":"When a clause's mechanism is a human approval step, this skill designs the gate UX and approve/reject/modify routing; this auditor only checks a mechanism and denial shape exist."},{"skill":"runtime-verification-for-agents","reason":"This auditor checks a contract is enforceable on paper; this skill compiles the same invariants into runtime monitors that catch drift in live sessions."},{"skill":"agent-identity-continuity-reputation","reason":"This auditor checks identity is daemon-issued and signed at signing time; this skill tracks that same signed identity's behavior and reputation across its whole lifetime."}],"io-contract":{"kind":"deliverable","consumes":["[Truncated]","[Truncated]"],"produces":["[Truncated]","[Truncated]"]}}

Articles of Agreement Auditor

Decide whether an Articles of Agreement contract actually binds an agent, or just documents good intentions.

Use This For

• Drafting a new Agent Node's Articles before it registers: naming a concrete mechanism per obligation, not an aspiration.
• Reviewing a claimed compliance level (C0 Registered through C6 Resumable) against the clauses that supposedly back it.
• Deciding whether a specific clause is genuinely enforced (daemon can observe and, for gates, deny it) or merely written down.
• Auditing whether a signing identity is trustworthy: daemon-issued at agent.register, and signed, not self-asserted by the body.
• Catching a gate-style mechanism (pre-tool-gate, hook, capability-lease, mcp-gateway) with no defined denial shape before it ships.

Do Not Use This For

• Securing the path from an inbound webhook/email/SMS/GitHub comment to an agent spawn — that is fleet-event-spawn-trust; this skill audits the signed contract an already-spawned agent operates under.
• Designing the relay's transport PKI, per-publisher signing keys, or Merkle event chains — that is pd-relay-zero-trust; this skill is silent on wire-level trust between daemons.
• Tracking a signed identity's behavior, outcomes, or reputation over its whole lifetime — that is agent-identity-continuity-reputation; this skill only checks the contract is sound and the identity was legitimately issued at signing time.

Enforcement Decision Model

flowchart TD
  A[Draft identity: daemonIssued + signed] --> B[Enumerate every obligation as a clause]
  B --> C[Assign an enforcementMechanism per clause]
  C --> D{Gate mechanism?}
  D -->|pre-tool-gate/hook/capability-lease/mcp-gateway| E[Define denialShape]
  D -->|probe/transcript-event| F[Leave denialShape unset]
  D -->|none| G[Honest but unenforced -- must fix before signing]
  E --> H[Run scripts/articles_audit.mjs]
  F --> H
  G --> H
  H --> I{pass:true and zero critical findings?}
  I -->|No| J[Fix the exact clause/identity field the finding names]
  J --> C
  I -->|Yes| K[Sign the Articles and register the Agent Node]

1. Verify identity before evaluating anything else. Confirm identity.daemonIssued and identity.signed are both true. A body that can self-assert its own identity can also self-assert compliance — no clause matters until the signing identity itself is trustworthy.
2. Enumerate every obligation as its own clause. Registration, transcript reporting, tool-use gating, file/symbol claims, parley conduct, budget/lease limits, and operator control each get a named clause — see .