agentcert 0.2.6 → 0.2.7

package/dist/cli.js

@@ -9,6 +9,7 @@ import { collectCompanionArtifacts, MAX_REPORTED_COMPANION_ARTIFACT_SKIPS } from
 import { recordsFromAgentCertResult, evaluateFailureClassifier, renderCorpusSummary, summarizeCorpus, writeReviewedFailureDataset, } from "./corpus.js";
 import { openCorpusStore, parseCorpusStoreKind } from "./corpus-store.js";
 import { pushEvidenceToControlPlane, verifyControlPlaneConnection } from "./control-plane.js";
+import { runEvidenceConformance } from "./conformance.js";
 import { DEFAULT_AGENTCERT_SERVER, resolveConnection, saveConnection } from "./credentials.js";
 import { applyFailureReviews, appendFailureReview, createFailureReview, findFailurePattern, parseFailureReviewStatus, parseFailureType, parseReviewConfidence, readFailureReviews, } from "./failure-review.js";
 import { buildMonitorSnapshot, writeMonitorSnapshot } from "./monitor.js";
@@ -515,6 +516,32 @@ else if (command === "validate") {
         }
     }
 }
+else if (command === "conformance") {
+    const file = readFlag("--file") ?? readFirstPositionalAfterCommand();
+    if (!file)
+        throw new Error("Missing evidence file. Usage: agentcert conformance <file> --artifact-root <directory>.");
+    const artifactRoot = resolve(readFlag("--artifact-root") ?? dirname(resolve(file)));
+    const report = await runEvidenceConformance(await readJson(file), {
+        evidenceFile: file,
+        artifactRoot,
+        implementation: readFlag("--implementation"),
+    });
+    const output = `${JSON.stringify(report, null, 2)}\n`;
+    const outPath = readFlag("--out");
+    if (outPath) {
+        await mkdir(dirname(resolve(outPath)), { recursive: true });
+        await writeFile(outPath, output);
+        process.stdout.write(`Wrote conformance report: ${resolve(outPath)}\n`);
+    }
+    process.stdout.write(`${report.valid ? "Conformant" : "Non-conformant"} evidence implementation: ${report.implementation}\n`);
+    for (const item of report.checks) {
+        process.stdout.write(`- ${item.status === "passed" ? "PASS" : "FAIL"} ${item.id}: ${item.message}\n`);
+        for (const error of item.errors)
+            process.stdout.write(`  - ${error}\n`);
+    }
+    if (!report.valid)
+        process.exitCode = 1;
+}
 else {
     process.stdout.write(`Usage:
   agentcert init --subject my-browser-agent
@@ -543,6 +570,7 @@ else {
   agentcert serve --corpus .agentcert/corpus/corpus.jsonl --static public-demo/agentcert-monitor --artifact-root public-demo/browser-agent-robustness/evidence/tripwire-public-demo
   agentcert validate .agentcert/latest/agentcert-evidence.json
   agentcert validate .agentcert/latest/agentcert-evidence.json --check-artifacts
+  agentcert conformance .agentcert/latest/agentcert-evidence.json --artifact-root . --implementation my-agent
   agentcert schema validate --schema evidence-bundle --file .agentcert/latest/agentcert-evidence.json
 `);
 }
@@ -911,12 +939,13 @@ jobs:
     # permissions:
     #   contents: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
         with:
           node-version: "20"
 
-      - uses: Kakarottoooo/agentcert/actions/tripwire@v0
+      - id: agentcert
+        uses: Kakarottoooo/agentcert/actions/tripwire@v0
         with:
           config: tripwire.yml
           out: .tripwire/latest

package/dist/command-help.js

@@ -1,4 +1,10 @@
 export function renderCommandHelp(command) {
+    if (command === "conformance")
+        return `Usage:
+  agentcert conformance <evidence.json> --artifact-root <directory> [--implementation <name>] [--out <report.json>]
+
+Checks schema identity, v0.1 compatibility, artifact manifest structure, and exact artifact hashes and sizes.
+`;
     if (command !== "push")
         return undefined;
     return `Usage:

package/dist/conformance.js

@@ -0,0 +1,115 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { normalizeManifestPath } from "./artifact-manifest.js";
+import { validateAgentCertSchema } from "./schema-validator.js";
+const SUPPORTED_TOP_LEVEL_FIELDS = new Set([
+    "schemaName", "schemaVersion", "schemaSemver", "kind", "runId", "generatedAt", "subject", "verdict", "summary",
+    "results", "evidence", "artifacts", "artifactManifest", "standards",
+]);
+export async function runEvidenceConformance(input, options) {
+    const checks = [];
+    const schema = validateAgentCertSchema("evidence-bundle", input);
+    checks.push(check("schema", "Evidence bundle satisfies the AgentCert v0.1 semantic contract.", schema.errors));
+    const bundle = object(input);
+    const compatibilityErrors = bundle
+        ? Object.keys(bundle).filter((key) => !SUPPORTED_TOP_LEVEL_FIELDS.has(key)).map((key) => `Unsupported top-level field: ${key}.`)
+        : ["Evidence bundle must be an object."];
+    checks.push(check("compatibility", "Evidence bundle uses only v0.1-compatible top-level fields.", compatibilityErrors));
+    const manifestErrors = [];
+    const entries = parseManifest(bundle?.artifactManifest, manifestErrors);
+    checks.push(check("manifest", "Artifact manifest declares unique normalized paths, SHA-256, byte size, and kind.", manifestErrors));
+    const byteErrors = [];
+    if (manifestErrors.length === 0) {
+        const root = resolve(options.artifactRoot);
+        for (const entry of entries) {
+            const path = resolve(root, entry.path);
+            if (path !== root && !path.startsWith(`${root}\\`) && !path.startsWith(`${root}/`)) {
+                byteErrors.push(`${entry.path}: resolved path escapes artifact root.`);
+                continue;
+            }
+            try {
+                const bytes = await readFile(path);
+                const digest = createHash("sha256").update(bytes).digest("hex");
+                if (bytes.byteLength !== entry.sizeBytes)
+                    byteErrors.push(`${entry.path}: expected ${entry.sizeBytes} bytes, observed ${bytes.byteLength}.`);
+                if (digest !== entry.sha256)
+                    byteErrors.push(`${entry.path}: SHA-256 does not match the declared digest.`);
+            }
+            catch (error) {
+                const code = error && typeof error === "object" && "code" in error ? String(error.code) : "read_failed";
+                byteErrors.push(`${entry.path}: artifact could not be read (${code}).`);
+            }
+        }
+    }
+    else {
+        byteErrors.push("Artifact bytes were not checked because the manifest is invalid.");
+    }
+    checks.push(check("artifact-bytes", "Every declared artifact matches its exact runtime bytes.", byteErrors));
+    const passed = checks.filter((item) => item.status === "passed").length;
+    const failed = checks.length - passed;
+    return {
+        schemaVersion: "agentcert.conformance.v0.1",
+        kind: "agentcert.evidence_conformance_report",
+        implementation: options.implementation?.trim() || "third-party",
+        evidenceFile: resolve(options.evidenceFile),
+        artifactRoot: resolve(options.artifactRoot),
+        generatedAt: (options.now ?? new Date()).toISOString(),
+        valid: failed === 0,
+        summary: { passed, failed },
+        checks,
+    };
+}
+function parseManifest(input, errors) {
+    const manifest = object(input);
+    if (!manifest) {
+        errors.push("artifactManifest is required for conformance.");
+        return [];
+    }
+    if (manifest.schemaVersion !== "agentcert.artifact_manifest.v0.1")
+        errors.push("artifactManifest.schemaVersion must be agentcert.artifact_manifest.v0.1.");
+    if (!Array.isArray(manifest.entries)) {
+        errors.push("artifactManifest.entries must be an array.");
+        return [];
+    }
+    if (manifest.entries.length > 500)
+        errors.push("artifactManifest.entries cannot exceed 500 entries.");
+    const paths = new Set();
+    const entries = [];
+    manifest.entries.forEach((inputEntry, index) => {
+        const entry = object(inputEntry);
+        if (!entry) {
+            errors.push(`artifactManifest.entries[${index}] must be an object.`);
+            return;
+        }
+        let path;
+        try {
+            path = typeof entry.path === "string" ? normalizeManifestPath(entry.path) : undefined;
+        }
+        catch (error) {
+            errors.push(`artifactManifest.entries[${index}].path: ${error.message}`);
+        }
+        if (!path)
+            errors.push(`artifactManifest.entries[${index}].path must be a normalized relative path.`);
+        else if (paths.has(path))
+            errors.push(`artifactManifest contains duplicate path ${path}.`);
+        else
+            paths.add(path);
+        if (typeof entry.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(entry.sha256))
+            errors.push(`artifactManifest.entries[${index}].sha256 must be 64 lowercase hex characters.`);
+        if (!Number.isInteger(entry.sizeBytes) || entry.sizeBytes < 0)
+            errors.push(`artifactManifest.entries[${index}].sizeBytes must be a non-negative integer.`);
+        if (typeof entry.kind !== "string" || !/^[a-z][a-z0-9_-]{0,63}$/.test(entry.kind))
+            errors.push(`artifactManifest.entries[${index}].kind must be a stable lowercase identifier.`);
+        if (path && typeof entry.sha256 === "string" && Number.isInteger(entry.sizeBytes) && typeof entry.kind === "string") {
+            entries.push({ path, sha256: entry.sha256, sizeBytes: entry.sizeBytes, kind: entry.kind });
+        }
+    });
+    return entries;
+}
+function check(id, message, errors) {
+    return { id, status: errors.length === 0 ? "passed" : "failed", message, errors };
+}
+function object(input) {
+    return input && typeof input === "object" && !Array.isArray(input) ? input : undefined;
+}

package/dist/index.js

@@ -2,6 +2,7 @@ export * from "./bundle.js";
 export * from "./corpus.js";
 export * from "./corpus-store.js";
 export * from "./control-plane.js";
+export * from "./conformance.js";
 export * from "./credentials.js";
 export * from "./failure-review.js";
 export * from "./evidence-signing.js";

package/dist/schema-validator.js

@@ -59,10 +59,33 @@ function validateEvidenceBundle(value, errors) {
     requiredArray(value, "evidence", errors);
     requiredObject(value, "artifacts", errors);
     requiredArray(value, "standards", errors);
+    const subject = recordValue(value.subject);
+    if (subject) {
+        requiredStringAt(subject, "name", "subject.name", errors);
+        requiredEnumAt(subject, "type", ["agent", "mcp-server", "tool", "application", "unknown"], "subject.type", errors);
+    }
+    const verdict = recordValue(value.verdict);
+    if (verdict) {
+        requiredBooleanAt(verdict, "passed", "verdict.passed", errors);
+        requiredNumberRange(verdict, "score", "verdict.score", 0, 100, errors);
+        requiredStringAt(verdict, "level", "verdict.level", errors);
+    }
+    const summary = recordValue(value.summary);
+    if (summary) {
+        stringArray(summary.products, "summary.products", errors);
+        requiredNonNegativeInteger(summary, "criticalEvidence", "summary.criticalEvidence", errors);
+        requiredNonNegativeInteger(summary, "highEvidence", "summary.highEvidence", errors);
+        requiredNonNegativeInteger(summary, "totalEvidence", "summary.totalEvidence", errors);
+    }
+    validateTimestamp(value.generatedAt, "generatedAt", errors);
+    validateArtifactMap(value.artifacts, "artifacts", errors);
+    validateResultArray(value.results, "results", errors);
+    validateEvidenceArray(value.evidence, "evidence", errors);
+    validateStandards(value.standards, errors);
 }
 function validateResult(value, errors) {
     requiredConst(value, "schemaVersion", "1", errors);
-    requiredEnum(value, "product", ["mcpbench", "tripwire-ci", "onegent-runtime", "agentcert-cli"], errors);
+    requiredString(value, "product", errors);
     requiredString(value, "runId", errors);
     requiredString(value, "timestamp", errors);
     requiredEnum(value, "phase", ["pre-release", "runtime"], errors);
@@ -70,6 +93,62 @@ function validateResult(value, errors) {
     requiredBoolean(value, "passed", errors);
     requiredObject(value, "artifacts", errors);
     requiredArray(value, "evidence", errors);
+    requiredNumberRange(value, "score", "score", 0, 100, errors);
+    validateTimestamp(value.timestamp, "timestamp", errors);
+    validateArtifactMap(value.artifacts, "artifacts", errors);
+    validateEvidenceArray(value.evidence, "evidence", errors);
+}
+function validateResultArray(input, path, errors) {
+    if (!Array.isArray(input))
+        return;
+    input.forEach((item, index) => {
+        const value = object(item, `${path}[${index}]`, errors);
+        if (!value)
+            return;
+        const nested = [];
+        validateResult(value, nested);
+        errors.push(...nested.map((error) => `${path}[${index}].${error}`));
+    });
+}
+function validateEvidenceArray(input, path, errors) {
+    if (!Array.isArray(input))
+        return;
+    input.forEach((item, index) => {
+        const value = object(item, `${path}[${index}]`, errors);
+        if (!value)
+            return;
+        requiredStringAt(value, "id", `${path}[${index}].id`, errors);
+        requiredStringAt(value, "kind", `${path}[${index}].kind`, errors);
+        requiredEnumAt(value, "severity", ["critical", "high", "medium", "low", "info"], `${path}[${index}].severity`, errors);
+        requiredStringAt(value, "message", `${path}[${index}].message`, errors);
+        for (const field of ["source", "artifactPath", "suggestedFix"]) {
+            if (value[field] !== undefined && typeof value[field] !== "string")
+                errors.push(`${path}[${index}].${field} must be a string.`);
+        }
+        if (value.metadata !== undefined && !recordValue(value.metadata))
+            errors.push(`${path}[${index}].metadata must be an object.`);
+    });
+}
+function validateArtifactMap(input, path, errors) {
+    const value = recordValue(input);
+    if (!value)
+        return;
+    for (const [key, item] of Object.entries(value))
+        if (typeof item !== "string")
+            errors.push(`${path}.${key} must be a string.`);
+}
+function validateStandards(input, errors) {
+    if (!Array.isArray(input))
+        return;
+    input.forEach((item, index) => {
+        const value = object(item, `standards[${index}]`, errors);
+        if (!value)
+            return;
+        requiredStringAt(value, "id", `standards[${index}].id`, errors);
+        requiredStringAt(value, "name", `standards[${index}].name`, errors);
+        requiredEnumAt(value, "status", ["mapped", "planned"], `standards[${index}].status`, errors);
+        requiredStringAt(value, "note", `standards[${index}].note`, errors);
+    });
 }
 function validateCorpusRecord(value, errors) {
     requiredConst(value, "schemaVersion", "1", errors);
@@ -161,3 +240,37 @@ function requiredEnum(input, key, values, errors) {
         errors.push(`${key} must be one of: ${values.join(", ")}.`);
     }
 }
+function recordValue(input) {
+    return input && typeof input === "object" && !Array.isArray(input) ? input : undefined;
+}
+function requiredStringAt(input, key, path, errors) {
+    if (typeof input[key] !== "string" || input[key] === "")
+        errors.push(`${path} must be a non-empty string.`);
+}
+function requiredBooleanAt(input, key, path, errors) {
+    if (typeof input[key] !== "boolean")
+        errors.push(`${path} must be a boolean.`);
+}
+function requiredEnumAt(input, key, values, path, errors) {
+    if (typeof input[key] !== "string" || !values.includes(input[key]))
+        errors.push(`${path} must be one of: ${values.join(", ")}.`);
+}
+function requiredNumberRange(input, key, path, minimum, maximum, errors) {
+    const value = input[key];
+    if (typeof value !== "number" || !Number.isFinite(value) || value < minimum || value > maximum) {
+        errors.push(`${path} must be a finite number from ${minimum} to ${maximum}.`);
+    }
+}
+function requiredNonNegativeInteger(input, key, path, errors) {
+    const value = input[key];
+    if (!Number.isInteger(value) || value < 0)
+        errors.push(`${path} must be a non-negative integer.`);
+}
+function stringArray(input, path, errors) {
+    if (!Array.isArray(input) || input.some((item) => typeof item !== "string"))
+        errors.push(`${path} must be an array of strings.`);
+}
+function validateTimestamp(input, path, errors) {
+    if (typeof input === "string" && !Number.isFinite(Date.parse(input)))
+        errors.push(`${path} must be a valid date-time string.`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentcert",
-  "version": "0.2.6",
+  "version": "0.2.7",
   "description": "Assurance release gates, runtime evidence, and regression CI for AI agents.",
   "type": "module",
   "license": "Apache-2.0",