# Draft Desk · Echo outside the website

Version 0.1.0 · project-authored reference integration · English source kit

Draft Desk saves a real local text file under a bounded HAP-1 permission. An
owner process issues a short-lived permit; the executor checks it before writing.
The example refuses an over-budget request, receives a signed revocation, and
refuses subsequent requests, including after reopening its stored state.

No Money Musk account, website, server, model or network connection is needed to
run the example once the tools below are installed. This is another reference
integration alongside the existing external executor and OpenClaw pilot. It is
not evidence of independent adoption or a third-party security audit.

## Run the downloaded kit

Use Node.js 22.13+ or 24 on a POSIX system (Linux or macOS). Automated tests run
on Linux with Node 22 and 24. Python 3.10+ and `cryptography==46.0.0` are needed
for the separate verifier. No npm install is needed.

Extract `echo-draft-desk.zip`, open a terminal in the extracted directory, then:

```sh
node draft-desk/run.mjs
```

The program creates a new private temporary directory each time. It grants a
128-byte allowance, writes a synthetic draft, and exercises refusal and revoke.
It prints the exact `evidence`, `pin`, and `outbox` paths and this outcome:

```json
{
  "savedFiles": 1,
  "overBudget": "REFUSED",
  "revoked": "REFUSED",
  "afterReopen": "REFUSED",
  "repeat": "EXISTING_RECEIPT_NO_WRITE",
  "independentAdoption": false,
  "humanPresence": false
}
```

`afterReopen` means closing and reopening the executor's SQLite stores and
encrypted key in this run. The regression suite separately kills a child process
after file creation and checks recovery from that uncertain outcome.

## Verify the actual file with Python

Install the pinned Python dependency in a virtual environment. Installation needs
network access unless you already have a local wheel; verification itself is offline.

```sh
python3 -m venv .venv
.venv/bin/python -m pip install -r hap1/requirements-verify.txt
```

Replace the three placeholders below with the paths printed by your run:

```sh
.venv/bin/python draft-desk/verify.py \
  /path/from/run/evidence.json \
  --pin /path/from/run/trusted-pin.json \
  --outbox /path/from/run/desk/outbox
```

A successful fresh run returns `valid: true`, `savedFilesMatched: 1`,
`refusedAttestations: 3`, `unknownOutcomes: 0`, and `revokedInSnapshot: true`.
Changing the saved file, a signed field, or a trusted public key makes it fail.

The checker is a separate Python implementation using the project's existing
Python HAP-1 verification primitives. It does not call the JavaScript runtime or
Money Musk. Both implementations were authored by this project.

**Retain the pin separately.** This synthetic example writes `trusted-pin.json`
before executing. For another person's evidence, obtain the human and executor
public keys and ticket hash through a channel you already trust. Accepting a
replacement pin from the same untrusted bundle cannot establish its origin.

**Evidence contains the draft text**, encoded as hex, plus the signed permission
history. Hex is not encryption. Use the synthetic example or keep exports private.
Never publish the encrypted private-key files or the private state directory.

## What the result establishes

| Check | Meaning |
| --- | --- |
| Signed authority history | The retained human key signed this grant, usage and revocation history. |
| Bounded action | The permit binds the draft bytes, executor, resource, budget and short execution window. |
| Saved file | The supplied file's bytes match the permitted payload and signed executor result. |
| Refused request | The executor attests refusal, and no file for that operation exists in the supplied outbox. |
| Unknown outcome | A crash or I/O error left an uncertain outcome. It is not counted as a verified save or retried. |

Verification covers a signed snapshot and the files you supply. It does not prove
current permission, an exhaustive history, absolute non-execution elsewhere, or
that an untrusted OS reported time correctly. Revocation blocks future dispatch
once received; it cannot undo an already-created file. Existing permits are also
bounded by their five-second freshness window.

## Integrate a different application

Read `SPEC.md`, `desk.mjs`, and `run.mjs`. `draftPayload(text)` builds a unique,
bounded operation. `createDraftDesk(...)` requires a private directory, executor
key, retained issuer key and valid ticket. Its `save(payload, authorize)` callback
passes an exact signed challenge to the authority. `revoke(bundle)` accepts an
authenticated revocation; `records()` and `sealEvidence(...)` export the snapshot.

Preserve the operation ID when retrying: an existing operation only returns its
stored receipt. Changed content under the same ID is rejected. A new ID is a new
request, not a retry. A crash after claiming an operation can leave it `UNKNOWN`
even if nothing happened; availability is deliberately sacrificed to prevent a
repeat effect. The example journal is capped at 64 operations.

The owner and executor run as separate processes on one trusted machine. This is
not a hostile-code sandbox: a machine administrator or modified application can
bypass local code. The generated software keys do not prove a human was present
or consciously approved this scripted grant. A production integration needs its
own protected key custody, consent interface, isolation, recovery and threat review.

## Reproduce the boundary tests

With the Python dependency installed for `python3` (or the virtual environment
activated), run:

```sh
node --test scripts/draft-desk-regressions.mjs
```

The suite checks byte limits, concurrent requests, revoke during approval, stale
permits, unavailable authority, forged revocations, symlink refusal, changed
evidence and files, missing persistent state, and a real process kill between
the write and its final receipt. It never uses live payments or private user data.

`echo-draft-desk-manifest.json` lists the source and archive SHA-256 digests. This
unsigned manifest detects byte differences against a trusted copy; it is not a
signature or evidence of independent review. The kit can be regenerated with
`python3 scripts/build-draft-desk.py`. See the included `hap1/LICENSE`.