feat(trust): add standalone Covenant Trust service

[mizuki0x]

Standalone, catalog-neutral service layer for pre-payment agent checks. Marketplaces, skill catalogs, and x402 clients stay consumers: they ask for evidence, apply their own policy, and decide whether to pay.

It returns facts rather than a universal trusted: true verdict:

• MPL Core asset facts, indexed AgentIdentity-plugin presence, registry PDA owner matching, and Covenant validation envelopes
• coverage-limited PayAI-sponsored USDC transfer history for a Solana wallet
• Ed25519 attestation integrity, with optional expected-signer matching

Every operation is read-only or pure cryptographic verification. The service holds no transaction signer and cannot move funds.

Interfaces: MCP over Streamable HTTP (POST /mcp), OpenAPI (GET /openapi.json), plus GET /v1/agents/{asset}, GET /v1/payment-history/{wallet}, POST /v1/attestations/verify, and GET /health. The MCP surface exposes the same three checks as structured tools.

Limits are documented in the README and carried in the responses rather than papered over. Transfer history covers only the reported window of PayAI fee-payer signatures, and fee sponsorship does not prove an x402 request, a settlement receipt, or job completion. A valid covenant.attest.v1 signature proves authorship by the carried key, and Covenant authorship only when that key is independently trusted. recordAuthentic covers the validation envelope and author key only; the MIP-014 registration decode is still null. The v1 record list is a bounded ownership scan, so it always reports coverage.complete: false. Registration and metadata URIs are returned but never fetched.

Build is clean and all 28 tests pass.

Recreates #120 under the neutral publication identity. Branch and commit unchanged.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​express@​5.0.0
	npm/​@​types/​node@​22.10.2
	npm/​tsx@​4.23.1
	npm/​express@​5.1.0
	npm/​typescript@​5.7.2
	npm/​@​modelcontextprotocol/​sdk@​1.30.0

View full report