nanobot/agent/visibility.py

@@ -0,0 +1,27 @@
+# nanobot/agent/visibility.py
+"""Cryptographic signing for visibility markers to prevent model forgery."""
+
+import hmac
+import hashlib
+import re
+from typing import Tuple
+
+SECRET_KEY = "nanobot_visibility_secret_key_v1"
+
+
+def sign_content(content: str) -> str:
+    """
+    Sign content with HMAC and prepend marker.
+
+    Args:
+        content: The message content to sign
+
+    Returns:
+        Content with signed visibility marker: "[HIDDEN:{sig}] {content}"
+    """
+    sig = hmac.new(
+        SECRET_KEY.encode(),
+        content.encode(),
+        hashlib.sha256
+    ).hexdigest()[:8]
+    return f"[HIDDEN:{sig}] {content}"

tests/test_visibility_signing.py

@@ -0,0 +1,26 @@
+# tests/test_visibility_signing.py
+import pytest
+from nanobot.agent.visibility import sign_content
+
+def test_sign_content_adds_hmac_marker():
+    """Test that sign_content adds HMAC signature prefix."""
+    content = "HEARTBEAT_OK"
+    result = sign_content(content)
+
+    # Should start with [HIDDEN:{8 hex chars}]
+    assert result.startswith("[HIDDEN:")
+    assert "] " in result
+    marker_end = result.index("] ")
+    signature = result[8:marker_end]  # Extract signature after "[HIDDEN:"
+    assert len(signature) == 8
+    assert all(c in "0123456789abcdef" for c in signature)
+
+    # Should contain original content
+    assert result.endswith("HEARTBEAT_OK")
+
+def test_sign_content_is_deterministic():
+    """Test that same content produces same signature."""
+    content = "Test message"
+    sig1 = sign_content(content)
+    sig2 = sign_content(content)
+    assert sig1 == sig2