agentcert 0.1.0

package/dist/normalizers.js

@@ -0,0 +1,193 @@
+import { createHash } from "node:crypto";
+export function normalizeMcpBenchResult(input, artifactPath) {
+    const value = asRecord(input);
+    const violations = Array.isArray(value.violations) ? value.violations : [];
+    const scorerResults = Array.isArray(value.scorer_results) ? value.scorer_results : [];
+    const runId = stringValue(value.run_id) ?? stableRunId("mcpbench", artifactPath, input);
+    const passed = Boolean(value.passed);
+    const score = numberValue(value.total_score) ?? 0;
+    const evidence = violations.map((violation, index) => {
+        const record = asRecord(violation);
+        return {
+            id: stringValue(record.id) ?? `mcpbench_violation_${index + 1}`,
+            kind: stringValue(record.kind) ?? "policy_violation",
+            severity: severityValue(record.severity) ?? "high",
+            message: stringValue(record.message) ?? "MCPBench policy violation.",
+            source: "mcpbench",
+            artifactPath,
+            metadata: record,
+        };
+    });
+    for (const scorer of scorerResults) {
+        const record = asRecord(scorer);
+        if (record.passed === false) {
+            evidence.push({
+                id: `mcpbench_scorer_${evidence.length + 1}`,
+                kind: "assertion_result",
+                severity: "medium",
+                message: `${stringValue(record.name) ?? "scorer"} failed.`,
+                source: "mcpbench",
+                artifactPath,
+                metadata: record,
+            });
+        }
+    }
+    return {
+        schemaVersion: "1",
+        product: "mcpbench",
+        runId,
+        timestamp: stringValue(value.completed_at) ?? new Date().toISOString(),
+        phase: "pre-release",
+        score,
+        passed,
+        certLevel: stringValue(value.cert_level),
+        summary: passed ? "MCPBench completed without blocking violations." : "MCPBench found blocking evidence.",
+        artifacts: recordOfStrings(value.artifact_paths, { results: artifactPath }),
+        evidence,
+    };
+}
+export function normalizeTripwireResult(input, artifactPath) {
+    const value = asRecord(input);
+    const summary = asRecord(value.summary);
+    const gate = asRecord(value.gate);
+    const runs = Array.isArray(value.runs) ? value.runs : [];
+    const overallScore = normalizeScore(numberValue(summary.overallScore) ?? 0);
+    const passed = Boolean(gate.passed);
+    const evidence = [];
+    for (const run of runs) {
+        const record = asRecord(run);
+        const assertions = Array.isArray(record.assertions) ? record.assertions : [];
+        for (const assertion of assertions) {
+            const assertionRecord = asRecord(assertion);
+            if (assertionRecord.pass === false) {
+                evidence.push({
+                    id: `tripwire_assertion_${evidence.length + 1}`,
+                    kind: "assertion_result",
+                    severity: "high",
+                    message: stringValue(assertionRecord.message) ?? "Tripwire assertion failed.",
+                    source: "tripwire-ci",
+                    artifactPath: stringValue(record.tracePath) ?? artifactPath,
+                    metadata: {
+                        scenarioName: record.scenarioName,
+                        faultName: record.faultName,
+                        assertion: assertionRecord,
+                    },
+                });
+            }
+        }
+    }
+    return {
+        schemaVersion: "1",
+        product: "tripwire-ci",
+        runId: stableRunId("tripwire", artifactPath, input),
+        timestamp: stringValue(value.timestamp) ?? new Date().toISOString(),
+        phase: "pre-release",
+        score: overallScore,
+        passed,
+        summary: passed ? "Tripwire CI gate passed." : "Tripwire CI gate failed.",
+        artifacts: { result: artifactPath, outDir: stringValue(value.outDir) ?? "" },
+        evidence,
+    };
+}
+export function normalizeOnegentAuditPacket(input, artifactPath) {
+    const value = asRecord(input);
+    const action = asRecord(value.actionIntent);
+    const risk = asRecord(value.riskAssessment);
+    const approval = asRecord(value.approvalRequest);
+    const verification = asRecord(value.verificationResult);
+    const auditEvents = Array.isArray(value.auditEvents) ? value.auditEvents : [];
+    const verificationSuccess = verification.success === true;
+    const approved = approval.status === "APPROVED" || approval.status === undefined;
+    const passed = verificationSuccess && approved;
+    const riskLevel = stringValue(risk.riskLevel) ?? "UNKNOWN";
+    const evidence = [
+        {
+            id: "onegent_risk_assessment",
+            kind: "runtime_risk_assessment",
+            severity: riskLevel === "CRITICAL" ? "critical" : riskLevel === "HIGH" ? "high" : "medium",
+            message: `Runtime action risk assessed as ${riskLevel}.`,
+            source: "onegent-runtime",
+            artifactPath,
+            metadata: risk,
+        },
+    ];
+    if (approval.status) {
+        evidence.push({
+            id: "onegent_approval",
+            kind: "approval_record",
+            severity: approval.status === "APPROVED" ? "info" : "high",
+            message: `Human approval status: ${approval.status}.`,
+            source: "onegent-runtime",
+            artifactPath,
+            metadata: approval,
+        });
+    }
+    evidence.push({
+        id: "onegent_verification",
+        kind: "runtime_verification",
+        severity: verificationSuccess ? "info" : "critical",
+        message: verificationSuccess
+            ? "Observed runtime state matched expected state."
+            : "Observed runtime state did not match expected state.",
+        source: "onegent-runtime",
+        artifactPath,
+        metadata: verification,
+    });
+    for (const event of auditEvents) {
+        const record = asRecord(event);
+        evidence.push({
+            id: stringValue(record.id) ?? `onegent_audit_${evidence.length + 1}`,
+            kind: "audit_event",
+            severity: "info",
+            message: stringValue(record.message) ?? stringValue(record.eventType) ?? "Onegent audit event.",
+            source: "onegent-runtime",
+            artifactPath,
+            metadata: record,
+        });
+    }
+    return {
+        schemaVersion: "1",
+        product: "onegent-runtime",
+        runId: stringValue(action.id) ?? stableRunId("onegent", artifactPath, input),
+        timestamp: stringValue(verification.createdAt) ?? new Date().toISOString(),
+        phase: "runtime",
+        score: passed ? 100 : 0,
+        passed,
+        summary: passed
+            ? "Runtime action was approved, mock-executed, verified, and audited."
+            : "Runtime action did not complete the approval and verification gate.",
+        artifacts: { auditPacket: artifactPath },
+        evidence,
+    };
+}
+function normalizeScore(value) {
+    return value <= 1 ? Math.round(value * 100) : Math.round(value);
+}
+function stableRunId(prefix, artifactPath, input) {
+    const hash = createHash("sha256").update(`${artifactPath}:${JSON.stringify(input)}`).digest("hex").slice(0, 12);
+    return `${prefix}_${hash}`;
+}
+function recordOfStrings(input, fallback) {
+    const record = asRecord(input);
+    const output = { ...fallback };
+    for (const [key, value] of Object.entries(record)) {
+        if (typeof value === "string") {
+            output[key] = value;
+        }
+    }
+    return output;
+}
+function asRecord(input) {
+    return input && typeof input === "object" && !Array.isArray(input) ? input : {};
+}
+function stringValue(input) {
+    return typeof input === "string" && input.length > 0 ? input : undefined;
+}
+function numberValue(input) {
+    return typeof input === "number" && Number.isFinite(input) ? input : undefined;
+}
+function severityValue(input) {
+    return input === "critical" || input === "high" || input === "medium" || input === "low" || input === "info"
+        ? input
+        : undefined;
+}

package/dist/report.js

@@ -0,0 +1,148 @@
+export function renderMarkdownReport(bundle) {
+    const lines = [
+        "# AgentCert Evidence Report",
+        "",
+        `Subject: ${bundle.subject.name}`,
+        `Generated: ${bundle.generatedAt}`,
+        `Verdict: ${bundle.verdict.passed ? "PASS" : "FAIL"}`,
+        `Score: ${bundle.verdict.score}`,
+        `Level: ${bundle.verdict.level}`,
+        "",
+        "## Results",
+        "",
+    ];
+    for (const result of bundle.results) {
+        lines.push(`- ${result.product}: ${result.passed ? "PASS" : "FAIL"} (${result.score}/100, ${result.phase})`, `  ${result.summary ?? ""}`.trimEnd());
+    }
+    lines.push("", "## Evidence", "");
+    if (bundle.evidence.length === 0) {
+        lines.push("No blocking evidence recorded.");
+    }
+    else {
+        for (const evidence of bundle.evidence) {
+            lines.push(`- [${evidence.severity}] ${evidence.kind}: ${evidence.message}`);
+        }
+    }
+    lines.push("", "## Standards Mapping", "");
+    for (const standard of bundle.standards) {
+        lines.push(`- ${standard.name}: ${standard.note}`);
+    }
+    lines.push("", "## Artifacts", "");
+    for (const [name, path] of Object.entries(bundle.artifacts)) {
+        lines.push(`- ${name}: \`${path}\``);
+    }
+    return `${lines.join("\n")}\n`;
+}
+export function renderHtmlReport(bundle) {
+    const resultCards = bundle.results
+        .map((result) => `<article class="card ${result.passed ? "pass" : "fail"}">
+        <span>${escapeHtml(result.phase)}</span>
+        <h2>${escapeHtml(result.product)}</h2>
+        <strong>${result.passed ? "PASS" : "FAIL"} ${result.score}/100</strong>
+        <p>${escapeHtml(result.summary ?? "No summary provided.")}</p>
+      </article>`)
+        .join("");
+    const evidenceRows = bundle.evidence.length === 0
+        ? `<tr><td colspan="4">No blocking evidence recorded.</td></tr>`
+        : bundle.evidence
+            .map((evidence) => `<tr>
+              <td><span class="severity ${escapeHtml(evidence.severity)}">${escapeHtml(evidence.severity)}</span></td>
+              <td>${escapeHtml(evidence.kind)}</td>
+              <td>${escapeHtml(evidence.message)}</td>
+              <td>${evidence.artifactPath ? artifactLink(evidence.artifactPath) : "-"}</td>
+            </tr>`)
+            .join("");
+    const artifactRows = Object.entries(bundle.artifacts)
+        .map(([name, path]) => `<tr><td>${escapeHtml(name)}</td><td>${artifactLink(path)}</td></tr>`)
+        .join("");
+    const standardItems = bundle.standards
+        .map((standard) => `<li><strong>${escapeHtml(standard.name)}</strong><span>${escapeHtml(standard.note)}</span></li>`)
+        .join("");
+    return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>AgentCert Evidence Report</title>
+    <style>
+      :root { color-scheme: light; --ink: #102033; --muted: #5d6978; --line: #d9e0e8; --bg: #f6f8fb; --panel: #fff; --pass: #087f5b; --fail: #c92a2a; }
+      body { margin: 0; font: 15px/1.45 system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; color: var(--ink); background: var(--bg); }
+      main { width: min(1120px, calc(100% - 32px)); margin: 0 auto; padding: 32px 0 48px; }
+      header { display: grid; gap: 16px; margin-bottom: 24px; }
+      h1 { margin: 0; font-size: clamp(32px, 6vw, 62px); line-height: 0.95; }
+      h2 { margin: 0 0 10px; font-size: 18px; }
+      p { color: var(--muted); margin: 0; }
+      .summary { display: grid; grid-template-columns: repeat(4, minmax(0, 1fr)); gap: 12px; margin: 24px 0; }
+      .metric, .card, section { background: var(--panel); border: 1px solid var(--line); border-radius: 8px; padding: 18px; }
+      .metric span, .card span { display: block; color: var(--muted); font-size: 12px; text-transform: uppercase; font-weight: 700; }
+      .metric strong { display: block; margin-top: 8px; font-size: 28px; }
+      .verdict-pass { color: var(--pass); }
+      .verdict-fail { color: var(--fail); }
+      .cards { display: grid; grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); gap: 12px; }
+      .card { border-left: 5px solid var(--line); }
+      .card.pass { border-left-color: var(--pass); }
+      .card.fail { border-left-color: var(--fail); }
+      .card strong { display: block; margin: 8px 0; font-size: 20px; }
+      section { margin-top: 16px; overflow-x: auto; }
+      table { width: 100%; border-collapse: collapse; min-width: 720px; }
+      th, td { padding: 10px 8px; border-bottom: 1px solid var(--line); text-align: left; vertical-align: top; }
+      th { font-size: 12px; text-transform: uppercase; color: var(--muted); }
+      a { color: #0b63ce; text-decoration: none; font-weight: 650; }
+      ul { margin: 0; padding-left: 20px; }
+      li { margin: 8px 0; }
+      li span { display: block; color: var(--muted); }
+      .severity { display: inline-block; border-radius: 999px; padding: 2px 8px; font-size: 12px; font-weight: 800; color: #fff; background: #687385; }
+      .severity.critical, .severity.high { background: var(--fail); }
+      .severity.medium { background: #b35c00; }
+      .severity.low, .severity.info { background: #24745a; }
+      @media (max-width: 760px) { .summary { grid-template-columns: 1fr 1fr; } main { width: min(100% - 24px, 1120px); padding-top: 20px; } }
+    </style>
+  </head>
+  <body>
+    <main>
+      <header>
+        <p>AgentCert Evidence Report</p>
+        <h1>${escapeHtml(bundle.subject.name)}</h1>
+        <p>Generated ${escapeHtml(bundle.generatedAt)}. Portable evidence bundle ${escapeHtml(bundle.runId)}.</p>
+      </header>
+      <div class="summary">
+        <div class="metric"><span>Verdict</span><strong class="${bundle.verdict.passed ? "verdict-pass" : "verdict-fail"}">${bundle.verdict.passed ? "PASS" : "FAIL"}</strong></div>
+        <div class="metric"><span>Score</span><strong>${bundle.verdict.score}/100</strong></div>
+        <div class="metric"><span>Level</span><strong>${escapeHtml(bundle.verdict.level)}</strong></div>
+        <div class="metric"><span>Evidence</span><strong>${bundle.summary.totalEvidence}</strong></div>
+      </div>
+      <div class="cards">${resultCards}</div>
+      <section>
+        <h2>Evidence</h2>
+        <table>
+          <thead><tr><th>Severity</th><th>Kind</th><th>Message</th><th>Artifact</th></tr></thead>
+          <tbody>${evidenceRows}</tbody>
+        </table>
+      </section>
+      <section>
+        <h2>Artifacts</h2>
+        <table>
+          <thead><tr><th>Name</th><th>Path</th></tr></thead>
+          <tbody>${artifactRows || `<tr><td colspan="2">No artifacts recorded.</td></tr>`}</tbody>
+        </table>
+      </section>
+      <section>
+        <h2>Standards Mapping</h2>
+        <ul>${standardItems}</ul>
+      </section>
+    </main>
+  </body>
+</html>
+`;
+}
+function artifactLink(path) {
+    const escaped = escapeHtml(path);
+    return `<a href="${escapeHtml(path)}">${escaped}</a>`;
+}
+function escapeHtml(value) {
+    return String(value)
+        .replaceAll("&", "&amp;")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;");
+}

package/dist/runner.js

@@ -0,0 +1,341 @@
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { access, mkdir, readFile, writeFile } from "node:fs/promises";
+import { renderAgentCertBadge } from "./badge.js";
+import { dirname, join, resolve } from "node:path";
+import { buildEvidenceBundle } from "./bundle.js";
+import { recordsFromAgentCertResult, renderCorpusSummary, summarizeCorpus, writeReviewedFailureDataset, } from "./corpus.js";
+import { openCorpusStore, parseCorpusStoreKind } from "./corpus-store.js";
+import { applyFailureReviews, readFailureReviews } from "./failure-review.js";
+import { buildMonitorSnapshot, writeMonitorSnapshot } from "./monitor.js";
+import { normalizeMcpBenchResult, normalizeOnegentAuditPacket, normalizeTripwireResult } from "./normalizers.js";
+import { renderHtmlReport, renderMarkdownReport } from "./report.js";
+const JOB_KEYS = ["mcpbench", "tripwire", "onegent"];
+export function publicDemoRunProfile() {
+    return {
+        schemaVersion: "1",
+        subject: {
+            name: "agentcert-public-demo",
+            type: "agent",
+        },
+        artifacts: {
+            mcpbench: "public-demo/lifecycle-evidence/mcpbench-passing/results.json",
+            tripwire: "public-demo/browser-agent-robustness/evidence/tripwire-public-demo/tripwire-result.json",
+            onegent: "public-demo/lifecycle-evidence/onegent-procurement/audit-packet.json",
+        },
+        outputDir: "public-demo/browser-agent-robustness/evidence/agentcert-public-demo",
+        run: {
+            corpus: {
+                path: "public-demo/browser-agent-robustness/evidence/agentcert-corpus.jsonl",
+                reviewsPath: "public-demo/browser-agent-robustness/evidence/failure-reviews.jsonl",
+                replace: true,
+            },
+            monitor: {
+                outputs: [
+                    "packages/agentcert-dashboard/public/data/monitor.json",
+                    "public-demo/agentcert-monitor/data/monitor.json",
+                ],
+                detailUrl: "../browser-agent-robustness/",
+            },
+            dataset: {
+                reviewedOutputs: ["public-demo/browser-agent-robustness/evidence/reviewed-failure-dataset.jsonl"],
+            },
+            gate: {
+                failOnVerdict: false,
+            },
+        },
+    };
+}
+export async function loadRunProfile(profileName, configPath) {
+    if (profileName === "public-demo") {
+        return publicDemoRunProfile();
+    }
+    if (profileName && profileName !== "public-demo") {
+        throw new Error(`Unknown AgentCert run profile "${profileName}". Available profiles: public-demo.`);
+    }
+    if (configPath) {
+        return (await readJson(configPath));
+    }
+    const defaultConfigPath = "agentcert.config.json";
+    try {
+        await access(resolve(defaultConfigPath));
+        return (await readJson(defaultConfigPath));
+    }
+    catch {
+        throw new Error("agentcert run requires --profile public-demo, --config <path>, explicit artifact flags, or agentcert.config.json in the current directory.");
+    }
+}
+export function profileFromArtifactFlags(overrides) {
+    return {
+        schemaVersion: "1",
+        subject: {
+            name: overrides.subject ?? "agentcert-subject",
+            type: "agent",
+        },
+        artifacts: {
+            mcpbench: overrides.mcpbench,
+            tripwire: overrides.tripwire,
+            onegent: overrides.onegent,
+        },
+        outputDir: overrides.outDir ?? ".agentcert/latest",
+        run: {
+            corpus: {
+                path: overrides.corpusPath ?? ".agentcert/corpus/corpus.jsonl",
+                replace: overrides.replaceCorpus ?? false,
+            },
+            monitor: {
+                outputs: [overrides.monitorOut ?? ".agentcert/latest/monitor.json"],
+            },
+            dataset: {
+                reviewedOutputs: [overrides.reviewedDatasetOut ?? ".agentcert/latest/reviewed-failure-dataset.jsonl"],
+            },
+            gate: {
+                failOnVerdict: overrides.failOnVerdict ?? false,
+            },
+        },
+    };
+}
+export function applyRunOverrides(profile, overrides = {}) {
+    const next = {
+        ...profile,
+        subject: {
+            ...profile.subject,
+            name: overrides.subject ?? profile.subject.name,
+        },
+        artifacts: {
+            ...profile.artifacts,
+            ...(overrides.mcpbench ? { mcpbench: overrides.mcpbench } : {}),
+            ...(overrides.tripwire ? { tripwire: overrides.tripwire } : {}),
+            ...(overrides.onegent ? { onegent: overrides.onegent } : {}),
+        },
+        outputDir: overrides.outDir ?? profile.outputDir,
+        run: {
+            ...profile.run,
+            corpus: {
+                ...profile.run?.corpus,
+                ...(overrides.corpusPath ? { path: overrides.corpusPath } : {}),
+                ...(overrides.reviewsPath ? { reviewsPath: overrides.reviewsPath } : {}),
+                ...(overrides.replaceCorpus === undefined ? {} : { replace: overrides.replaceCorpus }),
+            },
+            monitor: {
+                ...profile.run?.monitor,
+                ...(overrides.monitorOut ? { outputs: [overrides.monitorOut] } : {}),
+            },
+            dataset: {
+                ...profile.run?.dataset,
+                ...(overrides.reviewedDatasetOut ? { reviewedOutputs: [overrides.reviewedDatasetOut] } : {}),
+            },
+            gate: {
+                ...profile.run?.gate,
+                ...(overrides.failOnVerdict === undefined ? {} : { failOnVerdict: overrides.failOnVerdict }),
+            },
+        },
+    };
+    return next;
+}
+export async function runAgentCertProfile(profileInput, options = {}) {
+    const cwd = resolve(options.cwd ?? process.cwd());
+    const profile = applyRunOverrides(profileInput, options.overrides);
+    const steps = [];
+    const loaded = [];
+    for (const key of JOB_KEYS) {
+        const job = jobFor(profile, key);
+        if (!job.artifact && !job.command) {
+            steps.push({ id: key, status: "skipped", message: "No command or artifact configured." });
+            continue;
+        }
+        if (job.command && options.runCommands !== false) {
+            const step = await runJobCommand(key, job.command, cwd, options.commandStdio ?? "inherit");
+            steps.push(step);
+            if (step.status === "failed" && !job.allowCommandFailure) {
+                throw new Error(`${key} command failed with exit code ${step.exitCode ?? "unknown"}.`);
+            }
+        }
+        if (!job.artifact) {
+            if (job.required !== false) {
+                throw new Error(`${key} did not define an artifact path.`);
+            }
+            steps.push({ id: key, status: "skipped", message: "No artifact configured." });
+            continue;
+        }
+        const raw = await readJson(job.artifact, cwd);
+        loaded.push({ key, path: job.artifact, raw, result: normalizeArtifact(key, raw, job.artifact) });
+        steps.push({ id: key, status: "passed", artifactPath: job.artifact });
+    }
+    if (loaded.length === 0) {
+        throw new Error("No AgentCert artifacts were loaded. Configure at least one MCPBench, Tripwire, or Onegent artifact.");
+    }
+    const bundle = buildEvidenceBundle(loaded.map((artifact) => artifact.result), profile.subject.name, profile.subject.type);
+    const reviewsPath = profile.run?.corpus?.reviewsPath;
+    const reviews = await readFailureReviews(reviewsPath ? resolve(cwd, reviewsPath) : undefined);
+    const records = applyFailureReviews(loaded.flatMap(({ result, path, raw }) => recordsFromAgentCertResult(result, path, profile.subject.name, raw)), reviews);
+    const outputs = { monitor: [], reviewedDataset: [] };
+    const reportEnabled = profile.run?.report?.enabled ?? true;
+    const reportDir = profile.run?.report?.outDir ?? profile.outputDir;
+    if (reportEnabled && reportDir) {
+        const resolvedReportDir = resolve(cwd, reportDir);
+        await mkdir(resolvedReportDir, { recursive: true });
+        await writeFile(`${resolvedReportDir}/agentcert-evidence.json`, `${JSON.stringify(bundle, null, 2)}\n`);
+        await writeFile(`${resolvedReportDir}/agentcert-report.md`, renderMarkdownReport(bundle));
+        await writeFile(`${resolvedReportDir}/agentcert-report.html`, renderHtmlReport(bundle));
+        await writeFile(`${resolvedReportDir}/badge.svg`, renderAgentCertBadge(bundle));
+        steps.push({ id: "report", status: "passed", artifactPath: reportDir });
+        outputs.reportDir = reportDir;
+        outputs.evidenceBundle = artifactPath(reportDir, "agentcert-evidence.json");
+        outputs.markdownReport = artifactPath(reportDir, "agentcert-report.md");
+        outputs.htmlReport = artifactPath(reportDir, "agentcert-report.html");
+        outputs.badge = artifactPath(reportDir, "badge.svg");
+    }
+    else {
+        steps.push({ id: "report", status: "skipped", message: "Report output disabled." });
+    }
+    const corpusOptions = corpusStoreOptions(profile, cwd);
+    const store = await openCorpusStore(corpusOptions);
+    try {
+        await store.append(records, { replace: profile.run?.corpus?.replace ?? false });
+        const allRecords = await store.readAll();
+        steps.push({ id: "corpus", status: "passed", artifactPath: profile.run?.corpus?.path ?? corpusOptions.jsonlPath });
+        outputs.corpus = profile.run?.corpus?.path ?? corpusOptions.jsonlPath ?? store.description;
+        const monitorOutputs = monitorOutputsFor(profile);
+        for (const outPath of monitorOutputs) {
+            const snapshot = buildMonitorSnapshot(allRecords, {
+                subject: profile.run?.monitor?.subject ?? profile.subject.name,
+                detailUrl: profile.run?.monitor?.detailUrl,
+            });
+            await writeMonitorSnapshot(resolve(cwd, outPath), snapshot);
+            outputs.monitor.push(outPath);
+        }
+        const reviewedDatasetOutputs = reviewedDatasetOutputsFor(profile);
+        for (const outPath of reviewedDatasetOutputs) {
+            await writeReviewedFailureDataset(resolve(cwd, outPath), allRecords);
+            outputs.reviewedDataset.push(outPath);
+        }
+        steps.push({
+            id: "dataset",
+            status: reviewedDatasetOutputs.length > 0 ? "passed" : "skipped",
+            artifactPath: reviewedDatasetOutputs.join(", "),
+            message: reviewedDatasetOutputs.length > 0 ? undefined : "No reviewed dataset output configured.",
+        });
+        steps.push({
+            id: "monitor",
+            status: monitorOutputs.length > 0 ? "passed" : "skipped",
+            artifactPath: monitorOutputs.join(", "),
+            message: monitorOutputs.length > 0 ? undefined : "No monitor output configured.",
+        });
+    }
+    finally {
+        await store.close();
+    }
+    const manifestPath = profile.run?.manifest?.out ?? (profile.outputDir ? join(profile.outputDir, "agentcert-run-manifest.json") : undefined);
+    const manifest = {
+        schemaVersion: "1",
+        kind: "agentcert.run_manifest",
+        runId: stableRunId(profile, bundle),
+        generatedAt: new Date().toISOString(),
+        subject: profile.subject,
+        steps,
+        outputs,
+        verdict: bundle.verdict,
+        summary: bundle.summary,
+    };
+    if (manifestPath) {
+        const resolvedManifestPath = resolve(cwd, manifestPath);
+        await mkdir(dirname(resolvedManifestPath), { recursive: true });
+        manifest.outputs.manifest = normalizeArtifactPath(manifestPath);
+        await writeFile(resolvedManifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
+    }
+    const failOnVerdict = profile.run?.gate?.failOnVerdict ?? false;
+    return {
+        exitCode: failOnVerdict && !bundle.verdict.passed ? 1 : 0,
+        bundle,
+        records,
+        manifest,
+    };
+}
+export function renderRunSummary(outcome) {
+    const lines = [
+        "# AgentCert Run",
+        "",
+        `Subject: ${outcome.manifest.subject.name}`,
+        `Verdict: ${outcome.bundle.verdict.passed ? "PASS" : "FAIL"} (${outcome.bundle.verdict.score}/100)`,
+        `Products: ${outcome.bundle.summary.products.join(", ")}`,
+        `Records: ${outcome.records.length}`,
+        "",
+        "## Outputs",
+        ...Object.entries(outcome.manifest.outputs)
+            .filter(([, value]) => (Array.isArray(value) ? value.length > 0 : Boolean(value)))
+            .map(([key, value]) => `- ${key}: ${Array.isArray(value) ? value.join(", ") : value}`),
+        "",
+        "## Corpus Summary",
+        renderCorpusSummary(summarizeCorpus(outcome.records)).trim(),
+    ];
+    return `${lines.join("\n")}\n`;
+}
+async function runJobCommand(id, command, cwd, stdio) {
+    const startedAt = Date.now();
+    const exitCode = await new Promise((resolveExit, reject) => {
+        const child = spawn(command, { cwd, shell: true, stdio });
+        child.on("error", reject);
+        child.on("exit", resolveExit);
+    });
+    const durationMs = Date.now() - startedAt;
+    return {
+        id,
+        command,
+        durationMs,
+        exitCode: exitCode ?? undefined,
+        status: exitCode === 0 ? "passed" : "failed",
+    };
+}
+function jobFor(profile, key) {
+    const explicit = profile.run?.jobs?.[key] ?? {};
+    return {
+        required: true,
+        ...explicit,
+        artifact: explicit.artifact ?? profile.artifacts[key],
+    };
+}
+function normalizeArtifact(key, raw, artifactPath) {
+    if (key === "mcpbench")
+        return normalizeMcpBenchResult(raw, artifactPath);
+    if (key === "tripwire")
+        return normalizeTripwireResult(raw, artifactPath);
+    return normalizeOnegentAuditPacket(raw, artifactPath);
+}
+function corpusStoreOptions(profile, cwd) {
+    const corpus = profile.run?.corpus ?? {};
+    return {
+        kind: parseCorpusStoreKind(corpus.store),
+        jsonlPath: corpus.path ? resolve(cwd, corpus.path) : resolve(cwd, ".agentcert/corpus/corpus.jsonl"),
+        sqlitePath: corpus.sqlitePath ? resolve(cwd, corpus.sqlitePath) : resolve(cwd, ".agentcert/corpus/agentcert.sqlite"),
+        databaseUrl: corpus.databaseUrl ?? process.env.AGENTCERT_DATABASE_URL ?? process.env.DATABASE_URL,
+        tableName: corpus.tableName,
+    };
+}
+function monitorOutputsFor(profile) {
+    const monitor = profile.run?.monitor;
+    return [...(monitor?.outputs ?? []), ...(monitor?.out ? [monitor.out] : [])];
+}
+function reviewedDatasetOutputsFor(profile) {
+    const dataset = profile.run?.dataset;
+    return [...(dataset?.reviewedOutputs ?? []), ...(dataset?.reviewedOut ? [dataset.reviewedOut] : [])];
+}
+function artifactPath(base, file) {
+    return normalizeArtifactPath(`${base.replace(/[\\/]+$/, "")}/${file}`);
+}
+function normalizeArtifactPath(path) {
+    return path.replace(/\\/g, "/");
+}
+async function readJson(path, cwd = process.cwd()) {
+    const fullPath = resolve(cwd, path);
+    await access(fullPath);
+    const raw = await readFile(fullPath, "utf8");
+    return JSON.parse(raw);
+}
+function stableRunId(profile, bundle) {
+    const hash = createHash("sha256")
+        .update(`${profile.subject.name}:${bundle.runId}:${JSON.stringify(bundle.summary)}`)
+        .digest("hex")
+        .slice(0, 12);
+    return `agentcert_run_${hash}`;
+}