SSWP MCP

SSWP records what configured software checks actually establish. Its MCP and CLI entry points share one implementation and a persistent SQLite registry.

Version 2.1 fixes false Git PASS results, missing execution timeouts, source/bundle divergence, incomplete nested hashes and inconsistent ledger timestamps. Witness execution requires a short-lived operator-policy receipt from Omega Brain. Caller-supplied approval strings are no longer accepted.

Use Node 22 or newer and pnpm 11. Install with pnpm install --frozen-lockfile, run pnpm build, then start node dist/sswp.cjs. pnpm check checks TypeScript. Build receipts contain source, lockfile and artifact hashes. Native SQLite and esbuild install scripts are explicitly allowed by the workspace configuration.

Configure an absolute SSWP_DB path and the same VERITAS_SHARED_DIR used by Brain and Stenographer. Add the server command to persistent user MCP configuration. sswp_check_repo is read-only; sswp_witness runs only explicitly configured project commands, checks the receipt, writes an attestation and durably queues an event for Brain.

PASS, FAIL, ERROR, INCONCLUSIVE and NOT_APPLICABLE remain distinct. BUILD_SUCCESS and REPRODUCIBLE_BUILD are separate gates. Reproducibility requires nonempty matching outputs from two fresh source copies. sswp_verify covers nested fields in v2 attestations and reports older formats as LEGACY_UNVERIFIED; a content hash does not authenticate an author.

sswp_registry_health reports the latest run per node, timestamps, current path availability, pending materializations and delivery status. Registry writes, gate rows, ledger events and outbox jobs commit together. Committed attestations can be materialized and delivered again after interruption. Historical records remain historical.

See current operating contract for exact permission boundaries, missing-evidence behavior, dependency coverage and recovery. Tests use local synthetic projects. pnpm test additionally exercises Python-to-Node receipts when an Omega Brain checkout and .venv are present as siblings, as arranged by CI.