Notarize what a file or npm package does at the moment Kenwea fetches it, and get a signed record anyone can check.
Input: exactly one of artifactRef, a public https URL of a single file, npm tarball or Python wheel, or package, an npm package name such as express@4.18.2 (resolved to the exact tarball npm install would download; no version means latest), or a Python one as pypi:requests@2.31.0 (resolved on PyPI to the wheel this sandbox can import: pure Python, or musllinux for CPython 3.12), or an OpenClaw plugin on ClawHub as clawhub:name@version (the release ClawHub serves, refused unless it has the SHA-256 ClawHub publishes; no install step runs, as OpenClaw installs with --ignore-scripts, and the plugin is loaded as OpenClaw loads it, its openclaw.extensions entries imported and register() called with a stand-in OpenClaw API, decoy OpenClaw keys in its config and in ~/.openclaw).
Behavior: Kenwea downloads the bytes (up to 32 MiB) and runs executable content in isolation: no route out (a stand-in network inside the sandbox answers lookups and connections on ports 80, 443, 8080 and 8443 and records them), all capabilities dropped, read-only filesystem, not as root, 15 seconds for a file and 55 for a package. For a package it runs the install steps npm would run (preinstall, install, postinstall, and the node-gyp step npm adds for a binding.gyp) with decoy credentials where a developer machine or CI runner keeps real ones (an npm token in ~/.npmrc and NPM_TOKEN, a GitHub token, AWS keys, an SSH key, CI variables, and wallet keys: a Solana keypair, Ethereum and Foundry keystores, MetaMask and Phantom vaults, PRIVATE_KEY, a seed phrase and RPC API keys), each traced for the network connections, DNS lookups and programs it attempts, the credential files it opens and any decoy it puts into what it sends or starts; a single file and a Python package run with the same decoys (plus a PyPI token for Python) and are traced the same way; a PyPI wheel (package pypi:name) is imported with its dependencies installed, resolved as pip would for CPython 3.12 on Linux x86_64 and each checked against PyPI's sha256. After its install a registry npm package is also loaded once, as an application would require or import it, and onLoad says what loading it did; a load that reaches the network or a credential is its own finding (load_tried_network, load_read_credentials, load_sent_credentials). For a registry package that runs something at install, the dependency tree npm would install goes in first, each tarball checked against the registry's integrity hash, and every install step in the tree runs, the dependencies' first; a package that declares none is checked when a dependency does (dependencies.installSteps names them).
Returns: level, one word for what the record means (nothing_runs, quiet, network, reads_credentials, sends_credentials, unfinished), and summary, one sentence; installSteps (what runs at install; empty means nothing does) and observed (what the steps attempted, with credentialsRead and credentialsSent when a decoy was touched, and requests: what a step sent to the stand-in network, plain HTTP in full and TLS by server name and size, never decrypted); for an npm package, sincePrevious, which install steps were added, removed or changed since the previous published version (from the registry, not signed); a verdict and a reasonCode, the sha256 of what was read, and signedAttestation, an Ed25519 signature over the facts. quiet (verdict approved) means everything that ran finished, was traced whole and touched nothing watched; a step that tried the network, read a credential file, failed or could not be observed is manual_review with the reason; rejected is for a step that tried to send a decoy credential, and for files carrying a provider-formatted credential. A URL that cannot be fetched returns checked false with the reason instead of a verdict; a limit of our runner comes back as manual_review stated as ours.
Limits: no key or signup; 20 checks per hour per network address (an IPv6 /64 counts as one address) within a shared hourly ceiling, refused with rate_limited and the reset time. A Kenwea API key sent as a Bearer token uses that key's own quota. At most four checks run at once; one that gets no slot within 10 seconds comes back manual_review with reasonCode runner_busy and nothing run, so retry. The same bytes at the same address under the same checker version get the record issued the first time, marked cached, and nothing is run again. Keeps no copy of the artifact; a finished record is held in memory for up to 24 hours to answer repeats, and a rate counter and a log line keep a short hash of your address.
Not for: checking a record you already have (use kenwea_notary_verify, which runs nothing and does not spend your quota).
