@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.11

package/out/auth-broker/store.js

@@ -136,7 +136,7 @@ class AuthBrokerStore {
             id: `usr_${crypto.randomBytes(8).toString('hex')}`,
             email: normalized,
             displayName: displayName?.trim() || normalized.split('@')[0] || normalized,
-            teamId: this.config.team.id,
+            ...(this.config.teamConfigured ? { teamId: this.config.team.id } : {}),
         };
         this.users.set(user.id, user);
         this.persist();
@@ -210,7 +210,7 @@ class AuthBrokerStore {
             sub: user.id,
             email: user.email,
             name: user.displayName,
-            team_id: user.teamId,
+            ...(user.teamId ? { team_id: user.teamId } : {}),
             scope,
         }, this.config.jwtSecret, this.config.accessTokenTtlSec);
         const refreshToken = this.createRefreshToken(user.id, clientId);
@@ -221,6 +221,9 @@ class AuthBrokerStore {
         };
     }
     buildBootstrap(user) {
+        // No AGENTHIPPO_TEAM_ID ⇒ solo deployment: no team object, and nothing is team-managed —
+        // store/routing still apply as defaults but are not locked against the user changing them.
+        const teamConfigured = this.config.teamConfigured;
         return {
             version: 1,
             user: {
@@ -228,34 +231,28 @@ class AuthBrokerStore {
                 email: user.email,
                 displayName: user.displayName,
             },
-            team: {
-                id: this.config.team.id,
-                name: this.config.team.name,
-                role: 'member',
-            },
+            ...(teamConfigured
+                ? {
+                    team: {
+                        id: this.config.team.id,
+                        name: this.config.team.name,
+                        role: 'member',
+                    },
+                }
+                : {}),
             store: {
                 repo: this.config.team.storeRepo,
                 indexUrl: this.config.team.storeIndexUrl,
                 githubOrg: this.config.team.githubOrg,
             },
             routing: {
-                litellmBaseUrl: this.config.team.litellmBaseUrl,
-                litellmApiKey: this.config.team.litellmApiKey,
-                // No litellmApiKeyExpiresAt: the team key is static — a fabricated expiry
-                // would only pretend rotation exists. Per-user virtual keys are the upgrade path.
+                inferenceGatewayUrl: this.config.team.gatewayUrl,
             },
             policy: {
-                byokAllowed: true,
-                teamManagedSettings: ['store', 'routing'],
+                teamManagedSettings: teamConfigured ? ['store', 'routing'] : [],
             },
         };
     }
-    refreshRoutingCredentials() {
-        // The team key is static (no rotation backend yet), so no expiry is reported.
-        return {
-            litellmApiKey: this.config.team.litellmApiKey,
-        };
-    }
     buildMe(user) {
         return {
             user: {
@@ -263,11 +260,15 @@ class AuthBrokerStore {
                 email: user.email,
                 displayName: user.displayName,
             },
-            team: {
-                id: this.config.team.id,
-                name: this.config.team.name,
-                role: 'member',
-            },
+            ...(this.config.teamConfigured
+                ? {
+                    team: {
+                        id: this.config.team.id,
+                        name: this.config.team.name,
+                        role: 'member',
+                    },
+                }
+                : {}),
         };
     }
 }

package/out/authority/warrant.js

@@ -0,0 +1,206 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.b64urlEncode = b64urlEncode;
+exports.signCompactJws = signCompactJws;
+exports.verifyCompactJws = verifyCompactJws;
+exports.timingSafeEqualString = timingSafeEqualString;
+exports.generateWarrantKeypair = generateWarrantKeypair;
+exports.mintWarrant = mintWarrant;
+exports.verifyWarrant = verifyWarrant;
+exports.jwks = jwks;
+/**
+ * Signed warrants (PLAN/serve-v4-clean.md §6).
+ *
+ * The P1 breach was not a nonce bug — it was **misplaced minting authority**: serve held a
+ * bearer secret that let any holder mint a turn for any user. Edge mode relocated that secret;
+ * signing removes it. And the deploy samples still share ONE symmetric HMAC
+ * `AGENTHIPPO_AUTH_JWT_SECRET` fleet-wide, so compromising any single federated agent yields
+ * token-minting authority for the whole fleet including the IdP.
+ *
+ *   warrant = sign_ES256{ user, pack_version, sandbox_id, tier, exp ≈ turn }
+ *
+ * The authority plane holds the private key. Data/inference/egress gateways hold **verification
+ * keys only** (JWKS) — no plane can mint on another's behalf, and an edge node that is fully
+ * compromised can verify but never issue. There is no revocation registry: `exp` is turn-length
+ * and anything longer-lived is revoked by killing the sandbox's route (`SandboxDriver.revoke`).
+ *
+ * Channel binding: a warrant names the `sandbox_id` it was minted for, and the gateway verifies the
+ * peer identity of the channel it arrived on INDEPENDENTLY. A warrant lifted from one sandbox and
+ * replayed from another fails even though its signature is perfectly valid.
+ */
+const crypto = __importStar(require("node:crypto"));
+/** base64url of a UTF-8 string. */
+function b64urlEncode(s) {
+    return Buffer.from(s, 'utf8').toString('base64url');
+}
+/** Sign `payload` as a compact JWS. The ONLY place a private key is used for a JWS in this tree. */
+function signCompactJws(header, payload, privateKeyPem) {
+    const fullHeader = { alg: 'ES256', typ: header.typ ?? 'JWT', kid: header.kid };
+    const signingInput = `${b64urlEncode(JSON.stringify(fullHeader))}.${b64urlEncode(JSON.stringify(payload))}`;
+    const sig = crypto.sign('sha256', Buffer.from(signingInput), {
+        key: crypto.createPrivateKey(privateKeyPem),
+        dsaEncoding: 'ieee-p1363', // JWS ES256 is raw R||S, not DER
+    });
+    return `${signingInput}.${sig.toString('base64url')}`;
+}
+/**
+ * Verify a compact JWS against public keys only. Claim checking (exp, aud, digest, …) is the
+ * caller's job — this answers exactly one question: was this byte sequence signed by a key we
+ * already trust, under the algorithm we pinned?
+ */
+function verifyCompactJws(token, publicKeysByKid, opts = {}) {
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+        return { ok: false, reason: 'malformed' };
+    }
+    const [headerB64, payloadB64, sigB64] = parts;
+    let header;
+    let payload;
+    try {
+        header = JSON.parse(Buffer.from(headerB64, 'base64url').toString('utf8'));
+        payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString('utf8'));
+    }
+    catch {
+        return { ok: false, reason: 'unparseable' };
+    }
+    if (header.alg !== 'ES256') {
+        return { ok: false, reason: `unsupported alg ${header.alg}` };
+    }
+    // A signed artifact of one KIND must never verify as another, even under the same key.
+    if (opts.typ !== undefined && header.typ !== undefined && header.typ !== opts.typ) {
+        return { ok: false, reason: `unexpected token type ${header.typ}` };
+    }
+    const publicKeyPem = header.kid ? publicKeysByKid[header.kid] : undefined;
+    if (!publicKeyPem) {
+        return { ok: false, reason: 'unknown kid' };
+    }
+    let signatureValid = false;
+    try {
+        signatureValid = crypto.verify('sha256', Buffer.from(`${headerB64}.${payloadB64}`), { key: crypto.createPublicKey(publicKeyPem), dsaEncoding: 'ieee-p1363' }, Buffer.from(sigB64, 'base64url'));
+    }
+    catch {
+        return { ok: false, reason: 'bad signature' };
+    }
+    if (!signatureValid) {
+        return { ok: false, reason: 'bad signature' };
+    }
+    return { ok: true, header, payload, signingInput: `${headerB64}.${payloadB64}` };
+}
+/**
+ * Constant-time string compare for values that gate a security decision (digests, thumbprints).
+ *
+ * These are public values, so a timing oracle is not a practical break — but a digest comparison
+ * that short-circuits on the first differing byte is the kind of detail a reviewer has to
+ * re-derive every time. One helper, used everywhere, removes the question.
+ */
+function timingSafeEqualString(a, b) {
+    const bufA = Buffer.from(a, 'utf8');
+    const bufB = Buffer.from(b, 'utf8');
+    if (bufA.length !== bufB.length) {
+        return false;
+    }
+    return crypto.timingSafeEqual(bufA, bufB);
+}
+/** Generate an ES256 (P-256) keypair for the authority plane. */
+function generateWarrantKeypair(kid) {
+    const { privateKey, publicKey } = crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' });
+    const publicKeyPem = publicKey.export({ type: 'spki', format: 'pem' }).toString();
+    return {
+        privateKeyPem: privateKey.export({ type: 'pkcs8', format: 'pem' }).toString(),
+        publicKeyPem,
+        kid: kid ?? crypto.createHash('sha256').update(publicKeyPem).digest('hex').slice(0, 16),
+    };
+}
+/** Longer than a turn is not a warrant, it's a credential. Hard cap rather than a default. */
+const MAX_TTL_SECONDS = 300;
+function mintWarrant(input, key) {
+    const now = input.nowSeconds ?? Math.floor(Date.now() / 1000);
+    const ttl = Math.min(input.ttlSeconds ?? 120, MAX_TTL_SECONDS);
+    const claims = {
+        user: input.user,
+        pack: input.pack,
+        packVersion: input.packVersion,
+        sandboxId: input.sandboxId,
+        tier: input.tier,
+        aud: input.aud,
+        iat: now,
+        exp: now + ttl,
+        jti: crypto.randomUUID(),
+    };
+    return signCompactJws({ typ: 'JWT', kid: key.kid }, claims, key.privateKeyPem);
+}
+/**
+ * Verify with a public key only. A gateway that can run this cannot mint — that asymmetry is
+ * the entire point, and it is what deletes the shared fleet-wide HMAC secret.
+ */
+function verifyWarrant(token, publicKeysByKid, input) {
+    // Algorithm confusion is the classic JWT break: a token claiming `none`, or claiming HS256
+    // so the verifier uses the public key as an HMAC secret, must be refused outright. That, plus
+    // the kid-must-be-known rule, lives in verifyCompactJws — one implementation, no drift.
+    const jws = verifyCompactJws(token, publicKeysByKid);
+    if (!jws.ok) {
+        return { ok: false, reason: jws.reason };
+    }
+    const claims = jws.payload;
+    const now = input.nowSeconds ?? Math.floor(Date.now() / 1000);
+    if (typeof claims.exp !== 'number' || claims.exp <= now) {
+        return { ok: false, reason: 'expired' };
+    }
+    if (claims.aud !== input.audience) {
+        return { ok: false, reason: `wrong audience ${claims.aud}` };
+    }
+    // Channel binding — the property §12.4b promises. A stolen warrant presented from a
+    // different sandbox fails here even though its signature verifies.
+    if (input.channelSandboxId !== undefined && claims.sandboxId !== input.channelSandboxId) {
+        return { ok: false, reason: 'warrant not bound to this channel' };
+    }
+    if (!claims.user) {
+        return { ok: false, reason: 'no principal' };
+    }
+    return { ok: true, claims };
+}
+/** JWKS document for gateways to fetch. Publishes verification material ONLY. */
+function jwks(keys) {
+    return {
+        keys: keys.map((k) => {
+            const jwk = crypto.createPublicKey(k.publicKeyPem).export({ format: 'jwk' });
+            return { ...jwk, kid: k.kid, alg: 'ES256', use: 'sig' };
+        }),
+    };
+}

package/out/branding.js

@@ -3,7 +3,9 @@
  *  Copyright (c) AgentHippo.ai. All rights reserved.
  *--------------------------------------------------------------------------------------------*/
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AGENTIDE_DEPS_PACKAGE_NAME = exports.AGENTIDE_DEPS_DIR_NAME = exports.AGENTIDE_CLI_NAME = exports.AGENTIDE_DIR_NAME = exports.AGENTIDE_EXTENSION_NAME = exports.AGENTIDE_BRAND_NAME = void 0;
+exports.SETTINGS_DISPLAY_PREFIX = exports.SETTINGS_KEY_PREFIX = exports.AGENTIDE_DEPS_PACKAGE_NAME = exports.AGENTIDE_DEPS_DIR_NAME = exports.AGENTIDE_CLI_NAME = exports.AGENTIDE_DIR_NAME = exports.AGENTIDE_EXTENSION_NAME = exports.AGENTIDE_BRAND_NAME = void 0;
+exports.toSettingsDisplayKey = toSettingsDisplayKey;
+exports.describeSettingKey = describeSettingKey;
 exports.applyBrandingTokens = applyBrandingTokens;
 exports.brandify = brandify;
 // Centralized branding so we can rename without sweeping string edits.
@@ -13,6 +15,30 @@ exports.AGENTIDE_DIR_NAME = '.agent-hippo';
 exports.AGENTIDE_CLI_NAME = 'agenthippo';
 exports.AGENTIDE_DEPS_DIR_NAME = `.${exports.AGENTIDE_CLI_NAME}-deps`;
 exports.AGENTIDE_DEPS_PACKAGE_NAME = `${exports.AGENTIDE_CLI_NAME}-deps`;
+/** Internal VS Code settings prefix (stored in settings.json). */
+exports.SETTINGS_KEY_PREFIX = 'agentide.';
+/** User-visible settings prefix in the Settings UI (see workbench settingsDisplayKey.ts). */
+exports.SETTINGS_DISPLAY_PREFIX = 'agenthippoai.';
+/** Map an internal setting key to the label users see in Settings. */
+function toSettingsDisplayKey(key) {
+    return key.startsWith(exports.SETTINGS_KEY_PREFIX)
+        ? exports.SETTINGS_DISPLAY_PREFIX + key.slice(exports.SETTINGS_KEY_PREFIX.length)
+        : key;
+}
+/**
+ * Name a setting in prose that a user can act on.
+ *
+ * The display alias exists only inside the Settings UI: `agenthippoai.*` is not a real
+ * configuration key, so a message that prints it alone sends the user to paste a key into
+ * settings.json that configures nothing. Anything outside the Settings tree — notifications,
+ * errors, docs — must name the REAL key and mention the alias only to connect the two.
+ */
+function describeSettingKey(key) {
+    const displayKey = toSettingsDisplayKey(key);
+    return displayKey === key
+        ? key
+        : `${key} (shown in Settings as ${displayKey})`;
+}
 function applyBrandingTokens(text) {
     return text
         .replace(/\{\{AGENT_BRAND\}\}|\{\{AGENTIDE_BRAND\}\}/g, exports.AGENTIDE_BRAND_NAME)

package/out/cli/commands/conformance.js

@@ -0,0 +1,249 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.conformanceCommand = conformanceCommand;
+/**
+ * `agenthippo conformance` — the deployment's own proof (PLAN/serve-v4-clean.md §11 step 5).
+ *
+ * This is the artifact a partner runs at a client site without us in the room, and the honest
+ * answer to "why should I believe the isolation claim": the buyer runs the test themselves.
+ *
+ * Deployment checks PROBE rather than assert — "the four keys are undefined in-sandbox" has to be
+ * measured inside a running sandbox, not read off a config file. Checks that cannot be measured in
+ * the current environment report `skip` with the reason; a skip is never a pass.
+ *
+ * The contract checks (cost-cap, warrant-integrity, rollback-kill-switch) are a different claim:
+ * they verify THIS BINARY implements the bindings it advertises, and pass anywhere, including on a
+ * machine with no deployment. They are reported separately and cannot make a run green on their
+ * own — a conformance run that probed nothing exits 2, because a buyer must never be able to get a
+ * clean report against a system that was never touched.
+ */
+const node_child_process_1 = require("node:child_process");
+const node_util_1 = require("node:util");
+const support_1 = require("../../sandbox/support");
+const lease_1 = require("../../pack/lease");
+const warrant_1 = require("../../authority/warrant");
+const pexec = (0, node_util_1.promisify)(node_child_process_1.execFile);
+async function run(bin, args) {
+    try {
+        const { stdout } = await pexec(bin, args, { maxBuffer: 8 << 20 });
+        return { out: stdout, code: 0 };
+    }
+    catch (e) {
+        const err = e;
+        return { out: `${err.stdout ?? ''}${err.stderr ?? ''}`, code: typeof err.code === 'number' ? err.code : 1 };
+    }
+}
+/**
+ * credential-confinement — no data, model, or channel credential is reachable from inside a
+ * sandbox (env, /proc, filesystem). This is the check that would have caught the P2 leak: with the
+ * connector in the agent container, `PGPASSWORD` was readable from a sibling's /proc.
+ */
+async function credentialConfinement(opts) {
+    const name = 'credential-confinement';
+    if (!opts.sandbox) {
+        return { name, status: 'skip', detail: 'no --sandbox given; cannot probe inside a running sandbox' };
+    }
+    const rt = opts.runtime ?? 'docker';
+    // 1. The sandbox's own environment.
+    const env = await run(rt, ['exec', opts.sandbox, 'sh', '-c', 'env']);
+    if (env.code !== 0) {
+        return { name, status: 'skip', detail: `cannot exec in sandbox ${opts.sandbox}: ${env.out.trim().slice(0, 120)}` };
+    }
+    const SECRET_PATTERNS = [
+        ['provider-key', /sk-[A-Za-z0-9]{16,}/],
+        ['api-key-var', /(^|\n)[A-Z_]*API_KEY=\S/],
+        ['db-password', /(^|\n)PG(PASSWORD|PASSFILE)=\S/],
+        ['aws-secret', /(^|\n)AWS_SECRET_ACCESS_KEY=\S/],
+        ['bearer-token-var', /(^|\n)[A-Z_]*_TOKEN=\S/],
+        ['generic-secret-var', /(^|\n)[A-Z_]*SECRET[A-Z_]*=\S/],
+    ];
+    // The ONE credential permitted in a sandbox is its own model token: sandbox-bound, spend-capped,
+    // worthless anywhere else. Normalize those assignments away so the scan reports only
+    // material that would actually be worth stealing.
+    const stripSandboxTokens = (text) => text.replace(/^[A-Z_]*=ahc_\S*$/gm, '');
+    const hits = (text) => SECRET_PATTERNS.filter(([, re]) => re.test(stripSandboxTokens(text))).map(([label]) => label);
+    const envHits = hits(env.out);
+    // 2. Every readable process environment in the sandbox's PID namespace — the actual attack that
+    // recovered PGPASSWORD from a sibling when the connector ran in the agent container (P2).
+    const proc = await run(rt, ['exec', opts.sandbox, 'sh', '-c',
+        'for p in /proc/[0-9]*; do tr "\\0" "\\n" < $p/environ 2>/dev/null; done']);
+    const procHits = hits(proc.out);
+    if (envHits.length === 0 && procHits.length === 0) {
+        const hasSandboxToken = /=ahc_/.test(env.out);
+        return {
+            name, status: 'pass',
+            detail: hasSandboxToken
+                ? 'only a sandbox-scoped model token is present; no provider key, DB password, or bearer secret in env or any /proc environ'
+                : 'no credential reachable in the sandbox env or any process environ',
+        };
+    }
+    return {
+        name, status: 'fail',
+        detail: `credential material reachable inside the sandbox — env: [${envHits.join(', ') || 'none'}], /proc: [${procHits.join(', ') || 'none'}]`,
+    };
+}
+/** isolation-tier — the declared tier is actually in force, probed, not assumed. */
+async function isolationTier(opts) {
+    const name = 'isolation-tier';
+    if (opts.tier === undefined) {
+        return { name, status: 'skip', detail: 'no --tier declared' };
+    }
+    if (opts.tier === 0) {
+        return { name, status: 'pass', detail: 'tier 0 declares no boundary — nothing to enforce' };
+    }
+    if (!opts.sandbox) {
+        return { name, status: 'skip', detail: 'no --sandbox given; cannot probe the boundary' };
+    }
+    const rt = opts.runtime ?? 'docker';
+    const pids = await run(rt, ['exec', opts.sandbox, 'sh', '-c', 'ls -d /proc/[0-9]* | wc -l']);
+    if (pids.code !== 0) {
+        return { name, status: 'skip', detail: 'cannot probe the sandbox' };
+    }
+    const count = parseInt(pids.out.trim(), 10);
+    // A sandbox in its own PID namespace sees only its own handful of processes. A sandbox sharing the
+    // host namespace sees everything — which is what tier 0 looks like wearing a tier-2 label.
+    if (!Number.isFinite(count)) {
+        return { name, status: 'skip', detail: 'unreadable process count' };
+    }
+    if (count > 50) {
+        return { name, status: 'fail', detail: `sandbox sees ${count} processes — PID namespace is NOT isolated despite tier ${opts.tier}` };
+    }
+    const nets = await run(rt, ['inspect', opts.sandbox, '--format', '{{json .NetworkSettings.Networks}}']);
+    const networks = Object.keys(JSON.parse(nets.out.trim() || '{}'));
+    if (networks.includes('bridge')) {
+        return { name, status: 'fail', detail: 'sandbox is on the default bridge — it is not route-confined' };
+    }
+    return {
+        name, status: 'pass',
+        detail: `tier ${opts.tier} in force: own PID namespace (${count} procs), routes=${networks.join(',') || 'none'}`,
+    };
+}
+/**
+ * cost-cap — the model credential in a sandbox cannot be replayed elsewhere (blocker C).
+ *
+ * Exercises the SHIPPED credential (the ES256 inference warrant serve actually mints), not the
+ * removed HMAC token: a check that proves a property of dead code proves nothing about the
+ * deployment. The proxy verifies with a public key, so it can check a warrant but never mint one.
+ */
+function costCap() {
+    const name = 'cost-cap';
+    const upstream = 'sk-conformance-upstream-key';
+    const key = (0, warrant_1.generateWarrantKeypair)('conformance-cost-cap');
+    const pubs = { [key.kid]: key.publicKeyPem };
+    const token = (0, support_1.mintSandboxInferenceWarrant)(key, {
+        user: 'probe@corp.com', pack: 'probe', packVersion: '0.0.0', sandboxId: 'sandbox-A', tier: 2,
+    });
+    const boundToOwnSandbox = (0, warrant_1.verifyWarrant)(token, pubs, { audience: 'inference', channelSandboxId: 'sandbox-A' }).ok;
+    const usableElsewhere = (0, warrant_1.verifyWarrant)(token, pubs, { audience: 'inference', channelSandboxId: 'sandbox-B' }).ok;
+    const leaksProvider = token.includes(upstream);
+    if (boundToOwnSandbox && !usableElsewhere && !leaksProvider) {
+        return { name, status: 'pass', detail: 'model token is a sandbox-bound signed warrant and carries no provider key — a cap cannot be evaded by replay' };
+    }
+    return {
+        name, status: 'fail',
+        detail: `warrant binding broken (own=${boundToOwnSandbox}, elsewhere=${usableElsewhere}, leaks=${leaksProvider})`,
+    };
+}
+/** evidence-integrity — a warrant proves authority and a gateway cannot mint one. */
+function warrantIntegrity() {
+    const name = 'warrant-integrity';
+    const key = (0, warrant_1.generateWarrantKeypair)('conformance');
+    const pubs = { [key.kid]: key.publicKeyPem };
+    const token = (0, warrant_1.mintWarrant)({
+        user: 'probe@corp.com', pack: 'probe', packVersion: '0.0.0',
+        sandboxId: 'sandbox-A', tier: 2, aud: 'data',
+    }, key);
+    const own = (0, warrant_1.verifyWarrant)(token, pubs, { audience: 'data', channelSandboxId: 'sandbox-A' });
+    const lifted = (0, warrant_1.verifyWarrant)(token, pubs, { audience: 'data', channelSandboxId: 'sandbox-B' });
+    const wrongAud = (0, warrant_1.verifyWarrant)(token, pubs, { audience: 'inference', channelSandboxId: 'sandbox-A' });
+    if (own.ok && !lifted.ok && !wrongAud.ok) {
+        return { name, status: 'pass', detail: 'warrants are signed, sandbox-bound, and audience-scoped; gateways verify but cannot mint' };
+    }
+    return { name, status: 'fail', detail: `warrant binding broken (own=${own.ok}, lifted=${lifted.ok}, wrongAud=${wrongAud.ok})` };
+}
+/** rollback + kill-switch — admission refuses unpinned versions and revoked leases. */
+function rollbackAndKill() {
+    const name = 'rollback-kill-switch';
+    const now = Math.floor(Date.now() / 1000);
+    const pinned = { pack: 'probe', version: '1.0.0', expiresAt: now + 60, enabled: true };
+    const results = {
+        pinnedAdmits: safe(() => (0, lease_1.assertAdmitted)(pinned, { pack: 'probe', version: '1.0.0', nowSeconds: now })),
+        otherVersionRefused: !safe(() => (0, lease_1.assertAdmitted)(pinned, { pack: 'probe', version: '1.0.1', nowSeconds: now })),
+        killSwitchRefuses: !safe(() => (0, lease_1.assertAdmitted)({ ...pinned, enabled: false }, { pack: 'probe', version: '1.0.0', nowSeconds: now })),
+        expiredRefused: !safe(() => (0, lease_1.assertAdmitted)({ ...pinned, expiresAt: now - 1 }, { pack: 'probe', version: '1.0.0', nowSeconds: now })),
+    };
+    const ok = Object.values(results).every(Boolean);
+    return {
+        name, status: ok ? 'pass' : 'fail',
+        detail: ok
+            ? 'pinned version admits, other versions refused, kill switch and expiry both fail closed'
+            : `admission contract broken: ${JSON.stringify(results)}`,
+    };
+}
+function safe(fn) {
+    try {
+        fn();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function conformanceCommand(opts) {
+    const tag = (kind) => (c) => ({ ...c, kind });
+    const results = [
+        tag('deployment')(await credentialConfinement(opts)),
+        tag('deployment')(await isolationTier(opts)),
+        tag('algorithm')(costCap()),
+        tag('algorithm')(warrantIntegrity()),
+        tag('algorithm')(rollbackAndKill()),
+    ];
+    const deployment = results.filter((r) => r.kind === 'deployment');
+    const probed = deployment.filter((r) => r.status !== 'skip');
+    const failed = results.filter((r) => r.status === 'fail');
+    // A run that probed nothing is the case this command exists to prevent: it must never be
+    // mistaken for a deployment that passed, in the text output, the JSON, or the exit code.
+    const nothingProbed = probed.length === 0;
+    if (opts.json) {
+        console.log(JSON.stringify({
+            results,
+            deployment_probed: !nothingProbed,
+            summary: nothingProbed
+                ? 'no deployment was probed — algorithm checks verify this binary only'
+                : `${probed.filter((r) => r.status === 'pass').length}/${probed.length} deployment checks passed`,
+        }, null, 2));
+    }
+    else {
+        console.log('\nAgentHippo conformance\n');
+        const show = (r) => {
+            const mark = r.status === 'pass' ? 'PASS' : r.status === 'fail' ? 'FAIL' : 'SKIP';
+            console.log(`  ${mark}  ${r.name}\n        ${r.detail}`);
+        };
+        console.log('THIS DEPLOYMENT  (probes a running sandbox)');
+        deployment.forEach(show);
+        console.log('\nTHIS BINARY  (contract checks — environment-independent, pass with no deployment)');
+        results.filter((r) => r.kind === 'algorithm').forEach(show);
+        console.log('');
+        if (nothingProbed) {
+            console.log('NO DEPLOYMENT WAS PROBED. The binary checks above say nothing about a running');
+            console.log('system — pass --sandbox <container> --tier <n> to actually test one.');
+        }
+        else {
+            const passed = probed.filter((r) => r.status === 'pass').length;
+            console.log(`${passed}/${probed.length} deployment checks passed` +
+                (deployment.length - probed.length ? `, ${deployment.length - probed.length} not probed` : ''));
+        }
+        if (failed.length) {
+            console.log(`${failed.length} FAILED`);
+        }
+    }
+    // Non-zero on failure so this can gate a deployment in CI — and non-zero when nothing was
+    // probed, so "green" always means a real deployment was measured.
+    if (failed.length) {
+        return 1;
+    }
+    return nothingProbed ? 2 : 0;
+}