Regulated audit trails

# Proposal: Regulated audit trails

## Why
Audit logs kept by the company being audited can be rewritten. Anchoring each AI decision's inputs and outputs by hash in an outside, append-only log fixes the method at the time of the decision.

## What Changes
- Each AI decision or output gets a record by hash: inputs, model, method version.
- Records sit under a daily root the company cannot edit, with outside timestamps.
- Auditors receive an export bundle and check it offline.
- Add CommitOps: CommitOps can tie a compliance commitment to the records that show it was met.

## Capabilities
### New Capabilities
- `audit-trail`: Fix the method at decision time and hand auditors a bundle they check offline.

## Impact
- External service: AI Source of Truth at https://aisourceoftruth.com. Reads are anonymous. Writes need a publisher key pair you generate, a client id and secret from registration, and a token from `/oauth/token`.
- Routes used: `POST /v1/records`, `POST /v1/export`, `GET /v1/export/verify.mjs`.
- PromptReports products: CommitOps (optional; the change works without them).
- Source of this plan: https://aisourceoftruth.com/use-cases/regulated-audit-trail (CC0). Regenerate it with `curl -H 'Accept: application/json' 'https://aisourceoftruth.com/use-cases/regulated-audit-trail/openspec?lang=http&with=commitops'`.

# Design: Regulated audit trails

## Context
Companies under the EU AI Act, NIST AI RMF or sector rules, and the auditors who review them. Audit logs kept by the company being audited can be rewritten. Anchoring each AI decision's inputs and outputs by hash in an outside, append-only log fixes the method at the time of the decision.

## Where it sits in your agent
Publish from the service that commits decisions, inside its write path, with a retry queue so a registry outage delays the record instead of losing it.

Over MCP, point the agent at `https://aisourceoftruth.com/mcp` (Streamable HTTP, JSON-RPC 2.0; read tools need no token). The tools this change uses: `publish_record`, `export_bundle`.

## Decisions
- Treat the registry as a source of facts about records, never about the world. Show what it says, with the digest, and do not turn a verdict into a quality score.
- If the registry cannot be reached, treat the answer as unknown (the same as `check`), never as `rely`, and retry later.
- Keep content private: send hashes. Never put personal data in a record; it is public and permanent.
- Keep the private key and client secret in your secret store. Rotate keys at `POST /v1/keys`; a revoked key cannot sign.

## Setup and signing helper

```sh
# Publisher setup, once. Make an Ed25519 key pair yourself; the registry never sees the private key.
# 1. Register: POST https://aisourceoftruth.com/v1/publishers with {"id","name","public_jwk"}, signed by that key
#    (X-AISOT-Signature over the exact body bytes, base64url) and an Idempotency-Key.
#    The answer carries client_id, client_secret and your key_id.
# 2. Token (60 minutes; mint another the same way):
curl -s -X POST 'https://aisourceoftruth.com/oauth/token' -H 'Content-Type: application/json' \
  --data '{"grant_type":"client_credentials","client_id":"'"$AISOT_CLIENT_ID"'","client_secret":"'"$AISOT_CLIENT_SECRET"'"}'
# ./sign-ed25519 reads bytes on stdin and prints the base64url Ed25519 signature.
```

## Calls
### POST /v1/records
append a signed record; the answer carries its digest and inclusion proof.

```sh
BODY='{ ...record }'
SIG=$(printf %s "$BODY" | ./sign-ed25519)   # base64url signature over these exact bytes
curl -s -X POST 'https://aisourceoftruth.com/v1/records' \
  -H "Authorization: Bearer $AISOT_TOKEN" \
  -H "X-AISOT-Key-Id: $AISOT_KEY_ID" \
  -H "X-AISOT-Signature: $SIG" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H 'Content-Type: application/vnd.aisot.record+json' \
  --data-binary "$BODY"
```

### POST /v1/export
an offline bundle with proofs and timestamps for up to 100 records.

```sh
curl -s -X POST 'https://aisourceoftruth.com/v1/export' \
  -H 'Content-Type: application/json' \
  --data '{"digests":["{digest}"]}'
```

### GET /v1/export/verify.mjs
the offline verifier an auditor runs on a bundle.

```sh
curl -s -H 'Accept: application/json' 'https://aisourceoftruth.com/v1/export/verify.mjs'
```

## With the PromptReports products
- **CommitOps** (https://aisourceoftruth.com/p/commitops) keeps the ledger of what a company promised its customers, and can tie a promise to the record that shows it shipped. In this change: CommitOps can tie a compliance commitment to the records that show it was met.

## What this does not prove
- Reference material, not legal advice. The record shows what you recorded and when, not that the decision was right.

# Tasks: Regulated audit trails

## 1. Configure
- [ ] 1.1 Set `AISOT_ORIGIN=https://aisourceoftruth.com` in the agent's environment.
- [ ] 1.2 Generate an Ed25519 key pair, register the publisher (`POST /v1/publishers`), and store `AISOT_CLIENT_ID`, `AISOT_CLIENT_SECRET`, `AISOT_KEY_ID` and the private key as secrets.
- [ ] 1.3 Mint a token at `/oauth/token` and confirm `GET /v1/me` answers with your publisher id.
- [ ] 1.4 Optional: add the MCP server `https://aisourceoftruth.com/mcp` to the agent's MCP config.

## 2. Build
- [ ] 2.1 Choose what to anchor: Map each decision to a record: the output's hash as the artifact, input hashes in `inputs`, the model in `model`. See /guides/ai-act-nist for the field mapping.
- [ ] 2.2 Publish at decision time: Publish the record in the same transaction that commits the decision. Keep personal data out: hashes only. (`POST /v1/records`)
- [ ] 2.3 Hand over a bundle: Export up to 100 records per bundle for the audit period. (`POST /v1/export`)
- [ ] 2.4 Give auditors the verifier: Auditors download verify.mjs and run it themselves. (`GET /v1/export/verify.mjs`)

## 3. PromptReports products
- [ ] 3.1 CommitOps: CommitOps can tie a compliance commitment to the records that show it was met.

## 4. Verify against the live registry
- [ ] 4.1 Choose what to anchor: The mapping is written down and reviewed.
- [ ] 4.2 Publish at decision time: Every decision row has a record digest.
- [ ] 4.3 Hand over a bundle: The bundle verifies offline.
- [ ] 4.4 Give auditors the verifier: An auditor reproduces the check without contacting you.

## 5. Done when
- [ ] 5.1 Each decision has a record fixed at decision time.
- [ ] 5.2 Auditors check the trail offline without trusting your systems.

# audit-trail Specification

## ADDED Requirements

### Requirement: Decisions are anchored
The decision service SHALL publish a hashes-only record for each AI decision at the time it commits the decision.

#### Scenario: Decision committed
- **WHEN** a decision is committed
- **THEN** a record for it exists or is queued for retry

### Requirement: Auditors verify offline
The audit export SHALL be a registry bundle that verifies with verify.mjs.

#### Scenario: Audit request
- **WHEN** an auditor asks for a period
- **THEN** they receive bundles that verify offline