agentcert 0.2.0 → 0.2.1

package/README.md

@@ -34,6 +34,19 @@ Default outputs:
 - `.agentcert/latest/reviewed-failure-dataset.jsonl`
 - `.agentcert/latest/monitor.json`
 
+Push the validated evidence bundle into a hosted AgentCert project:
+
+```bash
+export AGENTCERT_BASE_URL="https://agentcert.example.com"
+export AGENTCERT_PROJECT_ID="your-project-id"
+export AGENTCERT_API_KEY="ac_live_..."
+npx agentcert push --evidence .agentcert/latest/agentcert-evidence.json
+```
+
+Add `--push` to `agentcert run` to run locally and upload the resulting bundle
+in one command. Project API keys can create runs, record events, and upload
+evidence, but cannot approve their own runtime actions.
+
 Review/export helpers:
 
 ```bash

package/dist/cli.js

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { dirname, join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { validateEvidenceArtifacts } from "./artifact-validation.js";
 import { renderAgentCertBadge } from "./badge.js";
 import { buildEvidenceBundle } from "./bundle.js";
 import { recordsFromAgentCertResult, evaluateFailureClassifier, renderCorpusSummary, summarizeCorpus, writeReviewedFailureDataset, } from "./corpus.js";
 import { openCorpusStore, parseCorpusStoreKind } from "./corpus-store.js";
+import { pushEvidenceToControlPlane } from "./control-plane.js";
 import { applyFailureReviews, appendFailureReview, createFailureReview, findFailurePattern, parseFailureReviewStatus, parseFailureType, parseReviewConfidence, readFailureReviews, } from "./failure-review.js";
 import { buildMonitorSnapshot, writeMonitorSnapshot } from "./monitor.js";
 import { normalizeMcpBenchResult, normalizeOnegentAuditPacket, normalizeTripwireResult } from "./normalizers.js";
@@ -269,8 +270,27 @@ else if (command === "run") {
         overrides,
     });
     process.stdout.write(renderRunSummary(outcome));
+    if (readBoolFlag("--push")) {
+        await pushHostedEvidence(outcome.bundle, Buffer.from(`${JSON.stringify(outcome.bundle, null, 2)}\n`), "agentcert-evidence.json");
+    }
     process.exitCode = outcome.exitCode;
 }
+else if (command === "push") {
+    const evidencePath = resolve(readFlag("--evidence") ?? ".agentcert/latest/agentcert-evidence.json");
+    const evidenceBytes = await readFile(evidencePath);
+    let bundle;
+    try {
+        bundle = JSON.parse(evidenceBytes.toString("utf8"));
+    }
+    catch {
+        throw new Error(`Evidence file is not valid JSON: ${evidencePath}`);
+    }
+    const validation = validateAgentCertSchema("evidence-bundle", bundle);
+    if (!validation.valid) {
+        throw new Error(`Evidence bundle is invalid:\n${validation.errors.map((error) => `- ${error}`).join("\n")}`);
+    }
+    await pushHostedEvidence(bundle, evidenceBytes, basename(evidencePath));
+}
 else if (command === "release-gate") {
     const overrides = readRunOverrides();
     const profileName = readFlag("--profile");
@@ -471,6 +491,8 @@ else {
   agentcert monitor build --corpus .agentcert/corpus/corpus.jsonl --out .agentcert/latest/monitor.json --subject my-agent
   agentcert monitor build --store sqlite --sqlite .agentcert/corpus/agentcert.sqlite --out .agentcert/latest/monitor.json --subject my-agent
   agentcert run --profile public-demo
+  agentcert push --evidence .agentcert/latest/agentcert-evidence.json --server https://agentcert.example.com --project <project-id>
+  agentcert run --tripwire .tripwire/latest/tripwire-result.json --push
   agentcert run --mcpbench .mcpbench/latest/results.json --tripwire .tripwire/latest/tripwire-result.json --onegent .onegent/procurement/audit-packet.json --out .agentcert/latest --corpus .agentcert/corpus/corpus.jsonl --monitor-out .agentcert/latest/monitor.json --reviewed-dataset-out .agentcert/latest/reviewed-failure-dataset.jsonl
   agentcert release-gate --config agentcert.config.json --strict
   agentcert release-gate --evidence .agentcert/latest/agentcert-evidence.json --baseline .agentcert/baselines/main.json
@@ -492,6 +514,24 @@ async function loadConfig(path) {
     }
     return (await readJson(path));
 }
+async function pushHostedEvidence(bundle, bytes, fileName) {
+    const baseUrl = readFlag("--server") ?? process.env.AGENTCERT_BASE_URL;
+    const projectId = readFlag("--project") ?? process.env.AGENTCERT_PROJECT_ID;
+    const apiKey = readFlag("--api-key") ?? process.env.AGENTCERT_API_KEY;
+    if (!baseUrl || !projectId || !apiKey) {
+        throw new Error("Hosted push requires AGENTCERT_BASE_URL, AGENTCERT_PROJECT_ID, and AGENTCERT_API_KEY (or --server, --project, and --api-key).");
+    }
+    const result = await pushEvidenceToControlPlane({
+        baseUrl,
+        projectId,
+        apiKey,
+        bundle,
+        evidenceBytes: bytes,
+        fileName,
+        externalId: readFlag("--external-id"),
+    });
+    process.stdout.write(`Hosted run: ${result.runId}\nHosted evidence: ${result.evidenceId}\n`);
+}
 async function readJson(path) {
     const raw = await readFile(resolve(path), "utf8");
     return JSON.parse(raw);
@@ -683,6 +723,12 @@ function errorHint(message, code) {
     if (message.includes("already exists")) {
         return "Hint: re-run with `--force` to overwrite starter files, or choose a different `--out` path.";
     }
+    if (message.includes("Hosted push requires")) {
+        return "Hint: create a project API key in AgentCert Integrations, then set AGENTCERT_BASE_URL, AGENTCERT_PROJECT_ID, and AGENTCERT_API_KEY.";
+    }
+    if (message.includes("Authentication required") || message.includes("API key")) {
+        return "Hint: check AGENTCERT_API_KEY and confirm the key belongs to AGENTCERT_PROJECT_ID.";
+    }
     return undefined;
 }
 function starterTripwireConfig(subject) {

package/dist/control-plane.js

@@ -0,0 +1,109 @@
+export async function pushEvidenceToControlPlane(options) {
+    const baseUrl = options.baseUrl.replace(/\/$/, "");
+    if (!baseUrl || !options.projectId || !options.apiKey) {
+        throw new Error("baseUrl, projectId, and apiKey are required to push evidence.");
+    }
+    const request = options.fetch ?? fetch;
+    const projectUrl = `${baseUrl}/v1/projects/${encodeURIComponent(options.projectId)}`;
+    const externalId = options.externalId ?? options.bundle.runId;
+    const kind = hostedRunKind(options.bundle);
+    const headers = { authorization: `Bearer ${options.apiKey}` };
+    const run = await requestJson(request, `${projectUrl}/runs`, {
+        method: "POST",
+        headers: { ...headers, "content-type": "application/json" },
+        body: JSON.stringify({
+            externalId,
+            kind,
+            schemaVersion: options.bundle.schemaVersion,
+            startedAt: options.bundle.generatedAt,
+            metadata: {
+                subject: options.bundle.subject,
+                products: options.bundle.summary.products,
+            },
+        }),
+    });
+    await requestJson(request, `${projectUrl}/runs/${encodeURIComponent(run.id)}/events`, {
+        method: "POST",
+        headers: { ...headers, "content-type": "application/json" },
+        body: JSON.stringify({
+            events: [{
+                    sequence: 0,
+                    type: "agentcert.evidence.created",
+                    actor: "agentcert-cli",
+                    occurredAt: options.bundle.generatedAt,
+                    payload: {
+                        verdict: options.bundle.verdict,
+                        totalEvidence: options.bundle.summary.totalEvidence,
+                        criticalEvidence: options.bundle.summary.criticalEvidence,
+                        highEvidence: options.bundle.summary.highEvidence,
+                    },
+                }],
+        }),
+    });
+    const query = new URLSearchParams({
+        fileName: options.fileName ?? "agentcert-evidence.json",
+        kind: "evidence_bundle",
+        schemaVersion: options.bundle.schemaVersion,
+        runId: run.id,
+    });
+    const evidence = await requestJson(request, `${projectUrl}/evidence?${query}`, {
+        method: "POST",
+        headers: { ...headers, "content-type": "application/json" },
+        body: new Uint8Array(options.evidenceBytes).buffer,
+    });
+    const firstDivergence = options.bundle.evidence.find((item) => item.severity === "critical" || item.severity === "high")?.message;
+    await requestJson(request, `${projectUrl}/runs/${encodeURIComponent(run.id)}/complete`, {
+        method: "POST",
+        headers: { ...headers, "content-type": "application/json" },
+        body: JSON.stringify({
+            status: options.bundle.verdict.passed ? "passed" : "failed",
+            score: options.bundle.verdict.score,
+            summary: `${options.bundle.subject.name}: ${options.bundle.verdict.level}`,
+            firstDivergence,
+            completedAt: options.bundle.generatedAt,
+            metadata: {
+                evidenceId: evidence.id,
+                evidenceSchemaVersion: options.bundle.schemaVersion,
+            },
+        }),
+    });
+    return { runId: run.id, evidenceId: evidence.id, externalId };
+}
+function hostedRunKind(bundle) {
+    const products = new Set(bundle.summary.products);
+    if (products.size > 1)
+        return "release_gate";
+    if (products.has("mcpbench"))
+        return "mcpbench";
+    if (products.has("tripwire-ci"))
+        return "tripwire";
+    if (products.has("onegent-runtime"))
+        return "runtime";
+    return "custom";
+}
+async function requestJson(request, url, init) {
+    let response;
+    try {
+        response = await request(url, { ...init, signal: init.signal ?? AbortSignal.timeout(30_000) });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`AgentCert control plane request failed: ${message}`);
+    }
+    const text = await response.text();
+    let value = {};
+    if (text) {
+        try {
+            value = JSON.parse(text);
+        }
+        catch {
+            if (!response.ok)
+                throw new Error(`AgentCert control plane returned HTTP ${response.status}.`);
+            throw new Error("AgentCert control plane returned invalid JSON.");
+        }
+    }
+    if (!response.ok) {
+        throw new Error(typeof value.error === "string" ? value.error : `AgentCert control plane returned HTTP ${response.status}.`);
+    }
+    return value;
+}

package/dist/index.js

@@ -1,6 +1,7 @@
 export * from "./bundle.js";
 export * from "./corpus.js";
 export * from "./corpus-store.js";
+export * from "./control-plane.js";
 export * from "./failure-review.js";
 export * from "./evidence-signing.js";
 export * from "./local-server.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentcert",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Assurance release gates, runtime evidence, and regression CI for AI agents.",
   "type": "module",
   "license": "Apache-2.0",