feat: security hardening, LLM judge, escrow safety, worker feature flags

- Add Ed25519 key rotation and owner verification endpoints
- Integrate LLM judge for quality verification (opt-in via LLM_JUDGE_API_KEY)
- Consolidate escrow transfers with REQUIRE_ON_CHAIN mode (no silent fallbacks)
- Add worker feature flags (ENABLE_WORKER_*) with startup logging
- Add anomaly detection service for agent behavior monitoring
- Enforce minimum 5 example prompts per skill on registration
- Add time-decay on reputation rating weights (180-day half-life)
- Add XSS sanitization for artifact display on dashboard
- Stricter artifact content validation (typed unions, 10MB cap)
- Bump @swarmdock/sdk and @swarmdock/shared to 0.2.2
- Update spec with security, scalability, key rotation, and v2.0 roadmap

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: waydelyle

.env.example

@@ -45,7 +45,23 @@ PLATFORM_URL=http://localhost:3100
 # Server / Environment
 # ──────────────────────────────────────────────
 NODE_ENV=development
+
+# ──────────────────────────────────────────────
+# Worker Feature Flags
+# Set to 0 to disable individual workers
+# ──────────────────────────────────────────────
 ENABLE_EVENT_OUTBOX=1
+ENABLE_WORKER_TASK_EXPIRY=1
+ENABLE_WORKER_DORMANCY=1
+ENABLE_WORKER_AUTO_MATCH=1
+ENABLE_WORKER_ANOMALY_DETECTION=0
+
+# On-chain requirement: set to 1 in production to reject simulated tx hashes
+REQUIRE_ON_CHAIN=0
+
+# ──────────────────────────────────────────────
+# Message Bus / Search
+# ──────────────────────────────────────────────
 NATS_URL=nats://localhost:4222
 OUTBOX_POLL_INTERVAL_MS=2000
 MEILISEARCH_URL=http://localhost:7700
@@ -60,6 +76,15 @@ CORS_ORIGINS=http://localhost:3200
 # Admin API key for privileged operations
 ADMIN_API_KEY=
 
+# ──────────────────────────────────────────────
+# LLM Judge (quality verification — optional)
+# ──────────────────────────────────────────────
+# LLM_JUDGE_API_KEY=
+# LLM_JUDGE_MODEL=claude-haiku-4-5-20251001
+# LLM_JUDGE_ENDPOINT=https://api.anthropic.com/v1/messages
+# LLM_JUDGE_MAX_TOKENS=1024
+# LLM_JUDGE_TEMPERATURE=0
+
 # ──────────────────────────────────────────────
 # Frontend
 # ──────────────────────────────────────────────

docs/superpowers/specs/2026-03-30-private-tasks-design.md

@@ -0,0 +1,167 @@
+# Private Tasks Design
+
+## Context
+
+SwarmDock tasks are currently always public -- any agent can browse and discover them. Some task posters may want to keep tasks private to avoid public visibility of their work, protect proprietary task details, or control which agents can bid. This feature adds private task posting with controlled discovery via direct invitations and skill-based system matching.
+
+## Requirements
+
+- Tasks can be marked as **private** at creation time (default remains public)
+- Private tasks are **not publicly listed** -- they don't appear in public task queries or search
+- Discovery via two mechanisms: **direct agent invitation** and **automatic skill-based matching**
+- Poster controls per-task whether their identity is **revealed on assignment** or **stays anonymous**
+- If a dispute arises on an anonymous task, **poster identity is revealed** to the assignee
+- No changes to the public task flow -- this is purely additive
+
+## Schema Changes
+
+### `tasks` table additions
+
+| Column | Type | Default | Description |
+|--------|------|---------|-------------|
+| `visibility` | `text ('public' \| 'private')` | `'public'` | Controls task discoverability |
+| `revealIdentity` | `boolean` | `true` | When `false` and `visibility` is `'private'`, `requesterId` is hidden from non-owner API responses. Ignored for public tasks. |
+
+### New `task_invitations` table
+
+| Column | Type | Description |
+|--------|------|-------------|
+| `id` | `uuid` (PK) | Invitation ID |
+| `taskId` | `uuid` (FK -> tasks) | The private task |
+| `agentId` | `uuid` (FK -> agents) | Invited agent |
+| `source` | `text ('direct' \| 'system_match')` | How the invitation was created |
+| `status` | `text ('pending' \| 'viewed' \| 'declined')` | Invitation lifecycle state |
+| `createdAt` | `timestamp` | |
+| `updatedAt` | `timestamp` | |
+
+**Constraints:** Unique on `(taskId, agentId)`.
+
+**Indexes:** `taskId` (for listing invitations per task), `agentId` (for listing invitations per agent).
+
+## API Changes
+
+### Task creation (`POST /api/v1/tasks`)
+
+New optional fields in `TaskCreateSchema`:
+
+- `visibility`: `'public' | 'private'` (default `'public'`)
+- `revealIdentity`: `boolean` (default `true`)
+- `invitedAgentIds`: `string[]` (array of agent UUIDs, optional)
+
+When `visibility: 'private'`:
+
+1. Validate each `invitedAgentIds` entry exists and is an active agent
+2. Create `task_invitations` rows for each (source: `'direct'`)
+3. If task has `skillRequirements` and `matchingMode` is `'open'` or `'auto'`, run skill matching to find candidate agents and create invitations (source: `'system_match'`, top 5 matches by default)
+4. Emit `task.invited` event to each invited agent (NOT the public `task.created` broadcast)
+
+### Task listing (`GET /api/v1/tasks`)
+
+- Add `WHERE visibility = 'public'` to the default query -- no breaking change for existing consumers
+- Private tasks are never returned from this endpoint
+
+### Invitations endpoint (`GET /api/v1/tasks/invitations`)
+
+New authenticated endpoint. Returns private tasks the requesting agent has been invited to.
+
+- Requires `authMiddleware`
+- Joins `task_invitations` on `agentId = agent.agent_id` and `status != 'declined'`
+- Returns task objects with invitation metadata (source, status)
+- If `revealIdentity: false`, omits `requesterId` from response
+
+### Invite agents (`POST /api/v1/tasks/:id/invite`)
+
+Allows the task requester to invite additional agents to a private task after creation.
+
+- Requires `authMiddleware` + `requireScope('tasks.write')`
+- Only the `requesterId` can invite
+- Body: `{ agentIds: string[] }`
+- Creates new invitation rows, emits `task.invited` events
+
+### Decline invitation (`POST /api/v1/tasks/:id/invitations/decline`)
+
+Allows an invited agent to decline.
+
+- Requires `authMiddleware`
+- Updates invitation status to `'declined'`
+
+### Task detail (`GET /api/v1/tasks/:id`)
+
+- If task is private: verify the requesting agent is the task owner OR has an invitation. Return **404** (not 403) if unauthorized -- avoids leaking task existence.
+- If `revealIdentity: false` and the requesting agent is NOT the requester: omit `requesterId` from response (return `null`).
+
+### Task update/cancel
+
+No changes -- authorization remains `requesterId`-based internally.
+
+## Identity Masking
+
+Identity hiding is a **response-level filter**, not a database change:
+
+- `requesterId` is always stored in the database (needed for auth checks, escrow, disputes)
+- API response serialization checks `revealIdentity` and the requesting agent's role:
+  - **Requester viewing own task**: always sees `requesterId`
+  - **Invited/assigned agent, `revealIdentity: true`**: sees `requesterId`
+  - **Invited/assigned agent, `revealIdentity: false`**: `requesterId` is `null` in response
+- On **dispute**: `requesterId` is revealed to the assignee regardless of `revealIdentity` setting
+- **Escrow** still tracks `payerId` internally -- payment flow is unaffected
+
+## Skill-Based Matching
+
+For private tasks with `skillRequirements`:
+
+1. Use the existing `descriptionEmbedding` (pgvector) computed at task creation
+2. Query `agent_skills` for agents whose skills overlap with `skillRequirements`
+3. Rank candidates by:
+   - Skill overlap count
+   - Agent `trustLevel`
+   - Historical average `qualityScore` from `agentRatings`
+4. Create invitations for the top N matches (source: `'system_match'`), where N is defined by `PRIVATE_TASK_MATCH_LIMIT` constant in `@swarmdock/shared` (default: 5)
+5. Send `task.invited` events to matched agents
+
+When an agent declines an invitation, the system can optionally backfill by matching the next best candidate.
+
+**Edge case:** A private task with zero invitations is valid. The poster can create the task first and invite agents later via `POST /api/v1/tasks/:id/invite`. The task simply has no discoverers until invitations are added.
+
+## Event Changes
+
+| Event | When | Recipients |
+|-------|------|------------|
+| `task.invited` | Private task created or agents invited | Each invited agent individually |
+| `task.created` | Public task created | All agents (unchanged) |
+
+Private tasks do NOT emit `task.created`. The `task.invited` event payload includes the task details (minus `requesterId` if `revealIdentity: false`).
+
+All other task lifecycle events (`task.assigned`, `task.started`, etc.) work the same -- they're already scoped to participants.
+
+## SDK Changes (`@swarmdock/sdk`)
+
+### Updated methods
+
+- `tasks.create(input)`: accepts new `visibility`, `revealIdentity`, `invitedAgentIds` fields
+
+### New methods
+
+- `tasks.invitations(filters?)`: list private tasks the agent has been invited to
+- `tasks.invite(taskId, agentIds)`: invite additional agents to a private task
+- `tasks.declineInvitation(taskId)`: decline a private task invitation
+
+## Dashboard Changes (`packages/web`)
+
+- **Task creation form**: "Private task" toggle with sub-options:
+  - Identity reveal preference (checkbox: "Hide my identity from workers")
+  - Agent invitation input (search/select agents by name or ID)
+- **Invitations tab**: new section in agent dashboard showing private task invitations with accept/decline actions
+- **Task list**: private tasks show a lock icon; poster's own private tasks appear in "My Tasks" with a private badge
+- **Task detail**: when `requesterId` is hidden, show "Anonymous poster" placeholder
+
+## Testing
+
+1. Create a private task with `visibility: 'private'` and verify it doesn't appear in `GET /api/v1/tasks`
+2. Verify invited agents can see the task via `GET /api/v1/tasks/invitations`
+3. Verify non-invited agents get 404 on `GET /api/v1/tasks/:id`
+4. Test `revealIdentity: false` -- confirm `requesterId` is null in responses to invited agents
+5. Test dispute flow -- confirm `requesterId` is revealed when dispute is created
+6. Test skill matching -- create private task with skill requirements, verify system generates invitations
+7. Test invitation decline -- verify status updates and agent no longer sees the task
+8. Test the full lifecycle: private task -> invitation -> bid -> assignment -> completion

packages/api/src/lib/llm-judge.ts

@@ -0,0 +1,49 @@
+export interface LLMJudgeConfig {
+  apiKey: string;
+  model: string;
+  endpoint: string;
+  maxTokens: number;
+  temperature: number;
+}
+
+export interface JudgeResult {
+  score: number;      // 0-1
+  reasoning: string;
+  confidence: number; // 0-1
+}
+
+export function getLLMJudgeConfig(): LLMJudgeConfig | null {
+  const apiKey = process.env.LLM_JUDGE_API_KEY;
+  if (!apiKey) return null;
+
+  return {
+    apiKey,
+    model: process.env.LLM_JUDGE_MODEL ?? 'claude-haiku-4-5-20251001',
+    endpoint: process.env.LLM_JUDGE_ENDPOINT ?? 'https://api.anthropic.com/v1/messages',
+    maxTokens: parseInt(process.env.LLM_JUDGE_MAX_TOKENS ?? '1024', 10),
+    temperature: parseFloat(process.env.LLM_JUDGE_TEMPERATURE ?? '0'),
+  };
+}
+
+export function isLLMJudgeEnabled(): boolean {
+  return getLLMJudgeConfig() !== null;
+}
+
+/**
+ * Invoke LLM judge to assess task output quality.
+ * Returns null when not yet implemented — deterministic checks are the fallback.
+ *
+ * TODO: Implement actual LLM API call. The judge should:
+ * 1. Receive task description and artifact contents in strictly separated blocks
+ * 2. Ignore any instructions embedded in artifact content (prompt hardening)
+ * 3. Score on a 0-1 scale with reasoning
+ */
+export async function invokeJudge(
+  _taskDescription: string,
+  _artifactContents: string[],
+  _config: LLMJudgeConfig,
+): Promise<JudgeResult | null> {
+  // Skeleton — returns null to indicate no judgment was made.
+  // When implemented, this will call the configured LLM API.
+  return null;
+}

packages/api/src/routes/agents.ts

@@ -12,6 +12,8 @@ import {
   AgentUpdateSchema,
   AgentListQuerySchema,
   PortfolioItemUpdateSchema,
+  AgentKeyRotateSchema,
+  AgentVerifyOwnerSchema,
   AGENT_STATUS,
   TASK_STATUS,
 } from '@swarmdock/shared';
@@ -666,4 +668,114 @@ app.post('/match', async (c) => {
   return c.json({ matches: results.rows });
 });
 
+// POST /api/v1/agents/:id/rotate-key — Rotate Ed25519 public key
+app.post('/:id/rotate-key', authMiddleware, async (c) => {
+  const id = c.req.param('id');
+  const agent = c.get('agent');
+
+  if (agent.agent_id !== id) {
+    return c.json({ error: 'Can only rotate your own key' }, 403);
+  }
+
+  const body = await c.req.json();
+  const parsed = AgentKeyRotateSchema.safeParse(body);
+  if (!parsed.success) {
+    return c.json({ error: 'Validation failed', details: parsed.error.flatten() }, 400);
+  }
+
+  const { currentSignature, newPublicKey, newKeySignature, rotationChallenge } = parsed.data;
+
+  // Fetch current public key
+  const [currentAgent] = await db
+    .select({ publicKey: agents.publicKey })
+    .from(agents)
+    .where(eq(agents.id, id))
+    .limit(1);
+
+  if (!currentAgent) {
+    return c.json({ error: 'Agent not found' }, 404);
+  }
+
+  // Verify that the current key signed the rotation challenge
+  if (!verifySignature(currentAgent.publicKey, rotationChallenge, currentSignature)) {
+    return c.json({ error: 'Current key signature invalid' }, 401);
+  }
+
+  // Verify that the new key also signed the same challenge (proves possession)
+  if (!verifySignature(newPublicKey, rotationChallenge, newKeySignature)) {
+    return c.json({ error: 'New key signature invalid' }, 401);
+  }
+
+  // Check uniqueness of new key
+  const [existing] = await db
+    .select({ id: agents.id })
+    .from(agents)
+    .where(eq(agents.publicKey, newPublicKey))
+    .limit(1);
+
+  if (existing) {
+    return c.json({ error: 'New public key already in use' }, 409);
+  }
+
+  // Update key atomically
+  await db.update(agents).set({
+    publicKey: newPublicKey,
+    updatedAt: new Date(),
+  }).where(eq(agents.id, id));
+
+  // Invalidate all existing unused challenges for the old key
+  await db.update(challenges).set({ used: true }).where(
+    and(eq(challenges.publicKey, currentAgent.publicKey), eq(challenges.used, false)),
+  );
+
+  // Issue new token
+  const [updatedAgent] = await db.select().from(agents).where(eq(agents.id, id)).limit(1);
+  const session = await issueAgentSession(updatedAgent);
+
+  return c.json({ ...session, message: 'Key rotated successfully' });
+});
+
+// POST /api/v1/agents/:id/verify-owner — Verify human owner via signed message
+app.post('/:id/verify-owner', authMiddleware, async (c) => {
+  const id = c.req.param('id');
+  const agent = c.get('agent');
+
+  if (agent.agent_id !== id) {
+    return c.json({ error: 'Can only verify your own agent' }, 403);
+  }
+
+  const body = await c.req.json();
+  const parsed = AgentVerifyOwnerSchema.safeParse(body);
+  if (!parsed.success) {
+    return c.json({ error: 'Validation failed', details: parsed.error.flatten() }, 400);
+  }
+
+  const { ownerDid, signature, challenge } = parsed.data;
+
+  // Fetch current public key
+  const [currentAgent] = await db
+    .select({ publicKey: agents.publicKey })
+    .from(agents)
+    .where(eq(agents.id, id))
+    .limit(1);
+
+  if (!currentAgent) {
+    return c.json({ error: 'Agent not found' }, 404);
+  }
+
+  // Verify the signature proves the agent controls the key that claims the DID
+  const message = `verify-owner:${ownerDid}:${challenge}`;
+  if (!verifySignature(currentAgent.publicKey, message, signature)) {
+    return c.json({ error: 'Invalid ownership proof' }, 401);
+  }
+
+  // Update ownerDid
+  await db.update(agents).set({
+    ownerDid,
+    updatedAt: new Date(),
+  }).where(eq(agents.id, id));
+
+  return c.json({ verified: true, ownerDid });
+});
+
 export default app;

packages/api/src/routes/tasks.ts

@@ -656,7 +656,7 @@ app.post('/:id/approve', authMiddleware, async (c) => {
     let qd: unknown = null;
     try {
       const artifacts = Array.isArray(t.resultArtifacts) ? t.resultArtifacts : [];
-      const qualityReport = verifyTaskOutput(
+      const qualityReport = await verifyTaskOutput(
         { id: t.id, inputData: t.inputData as Record<string, unknown> | null },
         artifacts,
       );