piqrypt_export_audit

Instructions

Implementation Reference

• src/python/bridge.py:201-233 (handler)

  The Python bridge handler for 'export_audit' called by the MCP server when the 'piqrypt_export_audit' tool is invoked. Loads the agent identity and events from AISS, exports the audit chain to a JSON file, and returns status/path/events_count.

  def export_audit(params: Dict[str, Any]) -> Dict[str, Any]:
      """
      Export agent audit trail.
  
      Args:
          params: dict with agent_name (or agent_id), optional certified,
                  output_path
  
      Returns:
          dict with status, path, certified, vigil_url
      """
      agent_name = params.get("agent_name", params.get("agent_id", "default"))
      certified  = params.get("certified", False)
      output     = params.get("output_path",
                              str(pathlib.Path.home() / ".piqrypt"
                                  / f"audit_{agent_name}.json"))
  
      identity = aiss.load_agent_identity(agent_name)
      events   = aiss.load_events(agent_name=agent_name)
      audit    = aiss.export_audit_chain(identity, events)
  
      output_path = pathlib.Path(output)
      output_path.parent.mkdir(parents=True, exist_ok=True)
      with open(output_path, "w") as f:
          json.dump(audit, f, indent=2)
  
      return {
          "status": "success",
          "path": str(output_path),
          "events_count": len(events),
          "certified": certified,
          "vigil_url": VIGIL_URL,
      }

• src/index.ts:209-215 (handler)

  The TypeScript MCP server handler that dispatches the 'piqrypt_export_audit' tool call to the Python bridge with the 'export' command, passing agent_id, certified, and output_format parameters.

  case 'piqrypt_export_audit':
    result = callPythonBridge('export', {
      agent_id: args.agent_id,
      certified: args.certified || false,
      output_format: args.output_format || 'json',
    });
    break;

• src/index.ts:106-130 (registration)

  The tool registration in the tools array, defining the 'piqrypt_export_audit' tool with its description, inputSchema (agent_id required, certified boolean, output_format enum), and metadata.

  {
    name: 'piqrypt_export_audit',
    description: 'Export the complete agent audit trail to a portable JSON archive. Set certified=true to request a PiQrypt CA signature for legal admissibility (eIDAS Art.26). The export is self-contained and verifiable without PiQrypt installed.',
    inputSchema: {
      type: 'object',
      properties: {
        agent_id: {
          type: 'string',
          description: 'Agent ID to export',
        },
        certified: {
          type: 'boolean',
          description: 'Create certified export (requires Pro license)',
          default: false,
        },
        output_format: {
          type: 'string',
          enum: ['json', 'pqz'],
          description: 'Output format (json or encrypted pqz archive)',
          default: 'json',
        },
      },
      required: ['agent_id'],
    },
  },

• src/python/bridge.py:267-270 (registration)

  The CLI command dispatch that routes the 'export' command string to the export_audit() Python function.

  elif command == "export":
      result = export_audit(params)
  else:
      raise PiQryptBridgeError(f"Unknown command: {command}")

• src/index.ts:46-56 (helper)

  The callPythonBridge helper function that spawns the Python bridge subprocess with the given command and params, returning the parsed JSON result.

  function callPythonBridge(command: string, params: any): any {
    const pythonCmd = process.env.PIQRYPT_PYTHON
      || (process.platform === 'win32' ? 'python' : 'python3');
  
    const result = spawnSync(
      pythonCmd,
      [PYTHON_BRIDGE, command, JSON.stringify(params)],
      { encoding: 'utf-8', timeout: 30000 }
    );
  
    if (result.error) throw new Error(`PiQrypt bridge spawn error: ${result.error.message}`);