tenuo 0.3.4

Task-scoped authorization for AI agents: signed warrants that constrain tools and arguments, narrow on delegation, and verify offline. Rust core of Tenuo.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

# Tenuo SDK examples

## `sdk_mcp_demo`

Section 16 validation target: a holder process signs, encodes `params._meta.tenuo` from `AuthorizedCall` (no second signature), and an enforcement process verifies through `Guard::guard_received`.

This is the MCP hop. It does not embed `rmcp`; MCP protocol handling stays in the caller.

```bash
cargo run --example sdk_mcp_demo --features sdk,mcp-transport
```

What it shows:

1. Allow: client `guard` → encode → server `guard_received`
2. Constraint deny: the operation does not run, and nothing is encoded
3. Missing `_meta`: `ObservingGuard` records a finding and still runs the tool
4. Approval retry: first attempt returns the core `ApprovalRequest`, `resolve_approvals` signs it, the retry carries approvals on the wire

`ObservingGuard` is an assessment window. It is not enforcement.