Internet of Agents: Incident Network

# From the chio workspace root
cargo build --bin chio
cd examples/internet-of-agents-incident-network
./smoke.sh

# Optional: live agent reasoning
export OPENAI_API_KEY=...
./smoke.sh

# Run a non-default scenario via orchestrate.py --mode
./scenario/01-happy-path.sh
./scenario/02-attenuation-deny.sh
./scenario/03-revoke-midchain.sh
./scenario/04-approval-required.sh
./scenario/05-expiry-async-failure.sh

incident = json.loads(
    (ROOT / "workspaces" / "customer-lab" / "incident" / "current-incident.json").read_text()
)
ids = {n: gen_identity(n) for n in [
    "commander-agent", "triage-agent", "change-agent",
    "vendor-liaison-agent", "provider-coordinator", "provider-executor",
]}

root_cap = trust.issue_capability(
    ids["commander-agent"].pk,
    _scope(
        _grant("mcp-observability", "get_incident_summary", ["invoke", "delegate"]),
        _grant("mcp-observability", "query_spans", ["invoke", "delegate"]),
        _grant("mcp-observability", "get_deploy_timeline", ["invoke", "delegate"]),
        _grant("mcp-observability", "get_slo_status", ["invoke", "delegate"]),
        _grant("mcp-github", "search_commits", ["invoke", "delegate"]),
        _grant("mcp-github", "get_diff", ["invoke", "delegate"]),
        _grant("mcp-github", "get_file", ["invoke", "delegate"]),
        _grant("mcp-pagerduty", "get_oncall_state", ["invoke", "delegate"]),
        _grant("mcp-pagerduty", "get_escalation_timeline", ["invoke", "delegate"]),
        _grant("acp-broker", "create_task", ["invoke", "delegate"],
               max_cost=1000, max_per_call=500),
    ),
    ttl=1800,
)
trust.record_lineage(root_cap, None)

triage_cap = delegate(
    parent=root_cap, delegator=ids["commander-agent"], delegatee=ids["triage-agent"],
    scope=_scope(
        _grant("mcp-observability", "get_incident_summary", ["invoke"]),
        _grant("mcp-observability", "query_spans", ["invoke"]),
        # ... investigation grants without "delegate" ...
    ),
    ttl=900, cap_id=f"{incident['incident_id']}-triage",
)

vendor_cap = delegate(
    parent=root_cap, delegator=ids["commander-agent"], delegatee=ids["vendor-liaison-agent"],
    scope=_scope(_grant("acp-broker", "create_task", ["invoke", "delegate"],
                        max_cost=500, max_per_call=500)),
    ttl=vendor_ttl, cap_id=f"{incident['incident_id']}-vendor",
)

{
  "schema": "chio.capability.v1",
  "id": "cap-01a07189-5280-7ca1-acea-66b0ce120347",
  "issuer": "210611cd27f2e29bd71150dc258b79afbecb11b6d5b987fde31bd5264c99b201",
  "subject": "a07f105a5b2c528ffba4362c6f6a5172e7fd3bb8e12c858e5b8fe6cd1ee4f577",
  "scope": {
    "grants": [
      {
        "server_id": "acp-broker",
        "tool_name": "create_task",
        "operations": ["invoke", "delegate"]
      }
    ]
  },
  "issued_at": 1788611220,
  "expires_at": 1788613020,
  "signature": "b55460285c721115730b4b9255153b449e41be26c5c8149e88d5eff04fe007e0..."
}

coord_cap = delegate(
    parent=vendor_cap, delegator=ids["vendor-liaison-agent"],
    delegatee=PublicKey(name="provider-coordinator", pk=ids["provider-coordinator"].pk),
    scope=_scope(_grant("provider-ops", "disable_edge_rule", ["invoke", "delegate"],
                        max_cost=500, max_per_call=500, max_invocations=2)),
    ttl=600, cap_id=f"{task['task_id']}-provider-coordinator",
)

{
  "task_id": "acp-task-4f2c1e90b7a3",
  "incident_id": "inc-meridian-inference-gw-2026-04-15-0317z",
  "target_service": "inference-gateway",
  "target_rule": "geo-restrict-v42",
  "bounded_action": "disable_rule",
  "provider_instructions": "Disable the geo-restrict rule for the affected region.",
  "vendor_liaison_capability": { "id": "inc-meridian-inference-gw-2026-04-15-0317z-vendor", "...": "..." },
  "execution_deadline": 1776273675
}

{
  "task": {
    "task_id": "acp-task-4f2c1e90b7a3",
    "target_service": "inference-gateway",
    "target_rule": "geo-restrict-v42",
    "bounded_action": "disable_rule",
    "provider_coordinator_capability": {
      "id": "acp-task-4f2c1e90b7a3-provider-coordinator",
      "delegation_depth": 2,
      "parent_capability_id": "inc-meridian-inference-gw-2026-04-15-0317z-vendor"
    }
  },
  "provider_coordinator_seed_hex": "...",
  "provider_executor_public_key": "executor-pk-...",
  "control_url": "http://127.0.0.1:<TRUST_PORT>",
  "service_token": "demo-token",
  "provider_executor_url": "http://127.0.0.1:<EXEC_PORT>",
  "executor_ttl_seconds": 600
}

for label, cid in cap_ids.items():
    _write(out / "lineage" / f"{label}-chain.json", trust.lineage_chain(cid))

budget_state = trust.query_budgets()
_write(out / "financial" / "budget-usage.json", budget_state)
exposure = trust.exposure_ledger(agent_subject=executor_pk)
_write(out / "financial" / "exposure-ledger.json", exposure)
scorecard = trust.credit_scorecard(agent_subject=executor_pk)
_write(out / "financial" / "credit-scorecard.json", scorecard)
settlements = trust.settlement_report()
_write(out / "financial" / "settlement-report.json", settlements)

curl -sS -H "Authorization: Bearer $SERVICE_TOKEN" \
  "$CONTROL_URL/v1/lineage/$CAP_ID/chain" \
  | jq 'map({capability_id, delegation_depth, parent_capability_id})'

[
  { "capability_id": "cap-01a07189-5280-7ca1-acea-66b0ce120347",
    "delegation_depth": 0, "parent_capability_id": null },
  { "capability_id": "inc-meridian-inference-gw-2026-04-15-0317z-vendor",
    "delegation_depth": 1,
    "parent_capability_id": "cap-01a07189-5280-7ca1-acea-66b0ce120347" },
  { "capability_id": "acp-task-4f2c1e90b7a3-provider-coordinator",
    "delegation_depth": 2,
    "parent_capability_id": "inc-meridian-inference-gw-2026-04-15-0317z-vendor" },
  { "capability_id": "acp-task-4f2c1e90b7a3-provider-executor",
    "delegation_depth": 3,
    "parent_capability_id": "acp-task-4f2c1e90b7a3-provider-coordinator" }
]

{
  "capabilityId": "inc-meridian-inference-gw-2026-04-15-0317z-vendor",
  "revoked": true,
  "newlyRevoked": true
}

{
  "execution": {
    "verdict": "deny",
    "reason": "revoked_ancestor",
    "executor_capability_id": "acp-task-4f2c1e90b7a3-provider-executor",
    "revoked_capability_id": "inc-meridian-inference-gw-2026-04-15-0317z-vendor",
    "requested_service": "inference-gateway",
    "requested_rule": "geo-restrict-v42"
  }
}

uv run --project "${EXAMPLE_ROOT}" python -c "
import sys; sys.path.insert(0, '${EXAMPLE_ROOT}')
from incident_network.verify import verify_bundle
import json
r = verify_bundle('${ARTIFACT_ROOT}')
json.dump(r, open('${ARTIFACT_ROOT}/review-result.json', 'w'), indent=2)
assert r['ok'], r['errors']
"

printf 'internet-of-agents-incident-network smoke passed\n'
printf 'artifacts: %s\n' "${ARTIFACT_ROOT}"

cd artifacts/live/<timestamp>
export TRUST_DB="$(pwd)/state/trust-receipts.sqlite3"
export REVOKE_DB="$(pwd)/state/trust-revocations.sqlite3"
export BUDGET_DB="$(pwd)/state/trust-budgets.sqlite3"

# Receipts grouped by tool and verdict
sqlite3 "$TRUST_DB" \
  'select tool_server, tool_name, decision_kind, count(*) from chio_tool_receipts group by tool_server, tool_name, decision_kind;'

# Revocation table after a revoke-midchain run
sqlite3 "$REVOKE_DB" \
  'select capability_id, revoked_at from revoked_capabilities;'

# Budget consumption per grant
sqlite3 "$BUDGET_DB" \
  'select capability_id, grant_index, invocation_count, total_cost_exposed, total_cost_realized_spend from capability_grant_budgets;'

# Lineage projection (one file per capability)
ls lineage/
jq 'length' lineage/provider-executor-chain.json
# 4    -- root, vendor, coordinator, executor (a bare array, not {chain: [...]})

# Final ACP task state
cat acp/task-final.json | jq '{status, completed_at}'

cd artifacts/live/<timestamp>

cat incident.json
cat identities/public-identities.json

# One file per capability on the chain
ls capabilities/
cat capabilities/root-commander.json
cat capabilities/triage-agent.json
cat capabilities/provider-executor.json

# One lineage chain per capability
ls lineage/
cat lineage/provider-executor-chain.json

# Agent decisions
cat agents/triage-output.json
cat agents/commander-output.json
cat agents/vendor-liaison-output.json

# ACP task lifecycle
cat acp/task-created.json
cat acp/task-final.json
cat provider/process-task-response.json

# Financial reports from trust-control
cat financial/budget-usage.json
cat financial/exposure-ledger.json
cat financial/credit-scorecard.json
cat financial/settlement-report.json

# Manifest hash list for offline verification
cat bundle-manifest.json
cat summary.json