agentcert 0.5.2 → 0.5.4

package/README.md

@@ -6,8 +6,8 @@ AgentCert checks what an agent may do, whether it passed pre-release evidence,
 whether a high-risk runtime action may proceed, and who can verify the observed
 outcome. It writes portable reports and accumulates a local failure corpus.
 
-[Public assurance demo](https://agentcert-control-plane.onrender.com/demo) |
-[Private workspace](https://agentcert-control-plane.onrender.com/app) |
+[Public evidence](https://agentcert.app/evidence) |
+[Private workspace](https://agentcert.app/app) |
 [GitHub source](https://github.com/Kakarottoooo/agentcert)
 
 ## 5-minute local path
@@ -53,7 +53,7 @@ Default outputs:
 Push the validated evidence bundle into a hosted AgentCert project:
 
 ```bash
-npx agentcert connect --server https://agentcert-control-plane.onrender.com --project your-project-id
+npx agentcert connect --server https://agentcert.app --project your-project-id
 npx agentcert push --evidence .agentcert/latest/agentcert-evidence.json
 ```
 

package/dist/bundle.js

@@ -36,6 +36,7 @@ export function buildEvidenceBundle(results, subjectName, subjectType = "agent")
         results,
         evidence,
         artifacts,
+        evidenceStrength: evidenceStrengthFor(results),
         standards: [
             {
                 id: "aiuc-1",
@@ -58,6 +59,24 @@ export function buildEvidenceBundle(results, subjectName, subjectType = "agent")
         ],
     };
 }
+const STRENGTH_ORDER = ["reported", "recorded", "enforced", "outcome_verified", "independently_reviewed"];
+function evidenceStrengthFor(results) {
+    const values = results.map((result) => result.evidenceStrength ?? {
+        schemaVersion: "agentcert.evidence_strength.v0.1",
+        level: "reported",
+        claims: ["A producer supplied a result for this run."],
+        limitations: ["The result does not contain a source-signed action record."],
+    });
+    const weakest = values.length
+        ? values.reduce((left, right) => STRENGTH_ORDER.indexOf(left.level) <= STRENGTH_ORDER.indexOf(right.level) ? left : right)
+        : { schemaVersion: "agentcert.evidence_strength.v0.1", level: "reported", claims: [], limitations: ["The bundle contains no results."] };
+    return {
+        schemaVersion: "agentcert.evidence_strength.v0.1",
+        level: weakest.level,
+        claims: [...new Set(values.flatMap((value) => value.claims))],
+        limitations: [...new Set(values.flatMap((value) => value.limitations))],
+    };
+}
 function levelForScore(score, passed) {
     if (!passed) {
         return "Not certified";

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { validateEvidenceArtifacts } from "./artifact-validation.js";
@@ -8,6 +8,7 @@ import { buildEvidenceBundle } from "./bundle.js";
 import { collectCompanionArtifacts, MAX_REPORTED_COMPANION_ARTIFACT_SKIPS } from "./companion-artifacts.js";
 import { recordsFromAgentCertResult, evaluateFailureClassifier, renderCorpusSummary, summarizeCorpus, writeReviewedFailureDataset, } from "./corpus.js";
 import { openCorpusStore, parseCorpusStoreKind } from "./corpus-store.js";
+import { deleteCorpusRecords, exportGovernedCorpus, governCorpusRecords, parseCorpusConsent } from "./corpus-governance.js";
 import { pushEvidenceToControlPlane, verifyControlPlaneConnection } from "./control-plane.js";
 import { runEvidenceConformance } from "./conformance.js";
 import { DEFAULT_AGENTCERT_SERVER, resolveConnection, saveConnection } from "./credentials.js";
@@ -62,7 +63,7 @@ else if (command === "init") {
 else if (command === "connect") {
     if (readBoolFlag("--help")) {
         process.stdout.write(`Usage:
-  agentcert connect --server https://agentcert-control-plane.onrender.com --project <project-id>
+  agentcert connect --server https://agentcert.app --project <project-id>
   agentcert connect --name staging --server https://staging.example.com --project <project-id>
 
 The API key is read from AGENTCERT_API_KEY or requested with hidden input.
@@ -124,7 +125,7 @@ else if (command === "corpus") {
             throw new Error("No input artifacts were provided. Use --mcpbench, --tripwire, --onegent, or --config.");
         }
         const reviews = await readFailureReviews(readReviewsPath());
-        const records = applyFailureReviews(loaded.flatMap(({ result, path, raw }) => recordsFromAgentCertResult(result, path, subject, raw)), reviews);
+        const records = governCorpusRecords(applyFailureReviews(loaded.flatMap(({ result, path, raw }) => recordsFromAgentCertResult(result, path, subject, raw)), reviews), { consent: parseCorpusConsent(readFlag("--consent")), consentSource: readFlag("--consent-source") ?? "local-default" });
         const store = await openCorpusStore(storeOptions);
         try {
             await store.append(records, { replace });
@@ -169,6 +170,38 @@ else if (command === "corpus") {
             await store.close();
         }
     }
+    else if (action === "export") {
+        const outPath = readFlag("--out") ?? ".agentcert/latest/governed-corpus.jsonl";
+        const allowed = (readFlag("--consent") ?? "public,anonymous").split(",").map((item) => parseCorpusConsent(item.trim()));
+        const store = await openCorpusStore(readCorpusStoreOptions(".agentcert/corpus/corpus.jsonl"));
+        try {
+            const records = exportGovernedCorpus(await store.readAll(), allowed);
+            await mkdir(dirname(resolve(outPath)), { recursive: true });
+            await writeFile(outPath, records.map((record) => JSON.stringify(record)).join("\n") + (records.length ? "\n" : ""));
+            process.stdout.write(`Exported ${records.length} consented corpus records to ${resolve(outPath)}\n`);
+        }
+        finally {
+            await store.close();
+        }
+    }
+    else if (action === "delete") {
+        const ids = requiredFlag("--record-id").split(",").map((item) => item.trim()).filter(Boolean);
+        const reason = requiredFlag("--reason");
+        const journalPath = readFlag("--journal") ?? ".agentcert/corpus/deletion-journal.jsonl";
+        const store = await openCorpusStore(readCorpusStoreOptions(".agentcert/corpus/corpus.jsonl"));
+        try {
+            const result = deleteCorpusRecords(await store.readAll(), ids, reason);
+            if (!result.tombstones.length)
+                throw new Error("No corpus records matched --record-id; nothing was deleted.");
+            await store.append(result.retained, { replace: true });
+            await mkdir(dirname(resolve(journalPath)), { recursive: true });
+            await appendFile(journalPath, result.tombstones.map((item) => JSON.stringify(item)).join("\n") + "\n");
+            process.stdout.write(`Deleted ${result.tombstones.length} corpus records and wrote non-identifying tombstones to ${resolve(journalPath)}\n`);
+        }
+        finally {
+            await store.close();
+        }
+    }
     else if (action === "classifier-eval") {
         const outPath = readFlag("--out");
         const store = await openCorpusStore(readCorpusStoreOptions(".agentcert/corpus/corpus.jsonl"));
@@ -231,9 +264,12 @@ else if (command === "corpus") {
         process.stdout.write(`Usage:
   agentcert corpus ingest --tripwire .tripwire/latest/tripwire-result.json --out .agentcert/corpus/corpus.jsonl --subject my-agent
   agentcert corpus ingest --store sqlite --sqlite .agentcert/corpus/agentcert.sqlite --tripwire .tripwire/latest/tripwire-result.json --subject my-agent
+  agentcert corpus ingest --tripwire result.json --consent anonymous --consent-source "pilot agreement 2026-07"
   agentcert corpus review --corpus .agentcert/corpus/corpus.jsonl --reviews .agentcert/corpus/failure-reviews.jsonl --pattern-key tripwire:ui_drift:modal-overlay:url_contains --type ui_drift --status confirmed --reviewer you@example.com --confidence 0.8 --why "Visible evidence supports the ui_drift label."
   agentcert corpus metrics --corpus .agentcert/corpus/corpus.jsonl
   agentcert corpus export-reviewed --corpus .agentcert/corpus/corpus.jsonl --out .agentcert/latest/reviewed-failure-dataset.jsonl
+  agentcert corpus export --corpus .agentcert/corpus/corpus.jsonl --consent public,anonymous --out .agentcert/latest/governed-corpus.jsonl
+  agentcert corpus delete --corpus .agentcert/corpus/corpus.jsonl --record-id <id> --reason "participant withdrawal"
   agentcert corpus classifier-eval --corpus .agentcert/corpus/corpus.jsonl --out .agentcert/latest/failure-classifier-evaluation.json
   agentcert corpus summary --corpus .agentcert/corpus/corpus.jsonl
   agentcert corpus summary --store postgres --database-url "$DATABASE_URL"
@@ -452,6 +488,8 @@ else if (command === "schema") {
   agentcert schema validate --schema corpus-record --file examples/agentcert/corpus-record.example.json
   agentcert schema validate --schema classifier-eval --file examples/agentcert/classifier-eval.example.json
   agentcert schema validate --schema release-gate --file .agentcert/latest/agentcert-release-gate.json
+  agentcert schema validate --schema assurance-report --file assurance-report.json
+  agentcert schema validate --schema assurance-delivery --file assurance-delivery.json
   agentcert schema validate --schema evidence-signature --file .agentcert/latest/agentcert-evidence.json.sig.json
 `);
     }
@@ -515,7 +553,7 @@ else if (command === "conformance") {
 else {
     process.stdout.write(`Usage:
   agentcert init --subject my-browser-agent
-  agentcert connect --server https://agentcert-control-plane.onrender.com --project <project-id>
+  agentcert connect --server https://agentcert.app --project <project-id>
   agentcert sandbox init
   agentcert sandbox certify --adapter ./agentcert.sandbox.mjs
   agentcert sandbox push --adapter ./agentcert.sandbox.mjs

package/dist/corpus-governance.js

@@ -0,0 +1,126 @@
+import { createHash } from "node:crypto";
+import { basename } from "node:path";
+const SECRET_PATTERNS = [
+    /\bsk-(?:proj-|live_|test_)?[A-Za-z0-9_-]{16,}\b/g,
+    /\brk_(?:live|test)_[A-Za-z0-9]{12,}\b/g,
+    /\bnpm_[A-Za-z0-9]{16,}\b/g,
+    /\bac_(?:live|test)_[A-Za-z0-9_-]{12,}\b/g,
+    /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/gi,
+];
+const EMAIL_PATTERN = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi;
+export function governCorpusRecords(records, input) {
+    if (input.consent === "denied")
+        throw new Error("Corpus consent is denied; no record was retained.");
+    if (!input.consentSource.trim())
+        throw new Error("Corpus consent source is required.");
+    const recordedAt = input.recordedAt ?? new Date().toISOString();
+    return records.map((record) => {
+        const [redacted, replacements] = redactValue(structuredClone(record), input.consent === "anonymous");
+        const governed = redacted;
+        if (input.consent === "anonymous") {
+            const identity = pseudonym(record.subject);
+            governed.subject = `anonymous-${identity}`;
+            governed.agentName = `anonymous-agent-${identity}`;
+            governed.sourcePath = basename(record.sourcePath.replaceAll("\\", "/"));
+            governed.artifacts = Object.fromEntries(Object.entries(governed.artifacts).map(([key, value]) => [key, basename(value.replaceAll("\\", "/"))]));
+        }
+        governed.governance = {
+            schemaVersion: "agentcert.corpus_governance.v0.1",
+            consent: input.consent,
+            consentSource: redactText(input.consentSource, input.consent === "anonymous")[0],
+            consentRecordedAt: recordedAt,
+            provenance: {
+                sourcePath: input.consent === "anonymous" ? basename(record.sourcePath.replaceAll("\\", "/")) : record.sourcePath,
+                sourceRecordSha256: createHash("sha256").update(JSON.stringify(record)).digest("hex"),
+                collectedAt: record.ingestedAt,
+            },
+            redaction: { policyVersion: "agentcert.redaction.v0.1", replacements, secretScanPassed: !containsSecret(JSON.stringify(governed)) },
+        };
+        if (!governed.governance.redaction.secretScanPassed)
+            throw new Error(`Corpus record ${record.id} still contains a recognized secret after redaction.`);
+        return governed;
+    });
+}
+export function exportGovernedCorpus(records, allowed = ["public", "anonymous"]) {
+    const allow = new Set(allowed);
+    return records
+        .filter((record) => record.governance && allow.has(record.governance.consent))
+        .map((record) => {
+        const [redacted, replacements] = redactValue(structuredClone(record), record.governance.consent === "anonymous");
+        const exported = redacted;
+        if (record.governance.consent === "anonymous") {
+            const identity = record.subject.startsWith("anonymous-") ? record.subject.slice("anonymous-".length) : pseudonym(record.subject);
+            exported.subject = `anonymous-${identity}`;
+            exported.agentName = `anonymous-agent-${identity}`;
+            exported.sourcePath = basename(record.sourcePath.replaceAll("\\", "/"));
+            exported.artifacts = Object.fromEntries(Object.entries(exported.artifacts).map(([key, value]) => [key, basename(value.replaceAll("\\", "/"))]));
+        }
+        exported.governance = {
+            ...record.governance,
+            redaction: {
+                ...record.governance.redaction,
+                replacements: record.governance.redaction.replacements + replacements,
+                secretScanPassed: !containsSecret(JSON.stringify(exported)),
+            },
+        };
+        if (!exported.governance.redaction.secretScanPassed)
+            throw new Error(`Corpus record ${record.id} failed the export secret scan.`);
+        return exported;
+    });
+}
+export function deleteCorpusRecords(records, ids, reason, deletedAt = new Date().toISOString()) {
+    if (!reason.trim())
+        throw new Error("Corpus deletion requires a reason.");
+    const requested = new Set(ids);
+    const deleted = records.filter((record) => requested.has(record.id));
+    return {
+        retained: records.filter((record) => !requested.has(record.id)),
+        tombstones: deleted.map((record) => ({
+            schemaVersion: "agentcert.corpus_deletion.v0.1",
+            recordIdSha256: createHash("sha256").update(record.id).digest("hex"),
+            reason: redactText(reason, true)[0],
+            deletedAt,
+        })),
+    };
+}
+export function parseCorpusConsent(value) {
+    const consent = value ?? "private";
+    if (consent === "private" || consent === "anonymous" || consent === "public" || consent === "denied")
+        return consent;
+    throw new Error(`Unsupported corpus consent "${consent}". Use private, anonymous, public, or denied.`);
+}
+function redactValue(value, anonymous) {
+    if (typeof value === "string")
+        return redactText(value, anonymous);
+    if (Array.isArray(value)) {
+        let replacements = 0;
+        const output = value.map((item) => { const [next, count] = redactValue(item, anonymous); replacements += count; return next; });
+        return [output, replacements];
+    }
+    if (value && typeof value === "object") {
+        let replacements = 0;
+        const output = {};
+        for (const [key, item] of Object.entries(value)) {
+            const [next, count] = redactValue(item, anonymous);
+            output[key] = next;
+            replacements += count;
+        }
+        return [output, replacements];
+    }
+    return [value, 0];
+}
+function redactText(value, anonymous) {
+    let output = value;
+    let replacements = 0;
+    for (const pattern of SECRET_PATTERNS)
+        output = output.replace(pattern, () => { replacements += 1; return "[REDACTED_SECRET]"; });
+    if (anonymous)
+        output = output.replace(EMAIL_PATTERN, () => { replacements += 1; return "[REDACTED_EMAIL]"; });
+    return [output, replacements];
+}
+function containsSecret(value) {
+    return SECRET_PATTERNS.some((pattern) => { pattern.lastIndex = 0; return pattern.test(value); });
+}
+function pseudonym(value) {
+    return createHash("sha256").update(value).digest("hex").slice(0, 12);
+}

package/dist/corpus-store.js

@@ -62,11 +62,10 @@ async function createSqliteCorpusStore(path, tableNameInput) {
         kind: "sqlite",
         description: `SQLite corpus at ${outPath}`,
         append: async (records, options) => {
-            if (options?.replace) {
-                db.exec(`DELETE FROM ${table}`);
-            }
             db.exec("BEGIN");
             try {
+                if (options?.replace)
+                    db.exec(`DELETE FROM ${table}`);
                 for (const record of records) {
                     insert.run(...recordSqlValues(record, "sqlite"), JSON.stringify(record));
                 }
@@ -97,11 +96,10 @@ async function createPostgresCorpusStore(databaseUrl, tableNameInput) {
         kind: "postgres",
         description: `Postgres corpus table ${tableName}`,
         append: async (records, options) => {
-            if (options?.replace) {
-                await client.query(`DELETE FROM ${table}`);
-            }
             await client.query("BEGIN");
             try {
+                if (options?.replace)
+                    await client.query(`DELETE FROM ${table}`);
                 for (const record of records) {
                     await client.query(insertSql(table, "$"), [...recordSqlValues(record, "postgres"), JSON.stringify(record)]);
                 }

package/dist/credentials.js

@@ -2,7 +2,7 @@ import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { randomUUID } from "node:crypto";
-export const DEFAULT_AGENTCERT_SERVER = "https://agentcert-control-plane.onrender.com";
+export const DEFAULT_AGENTCERT_SERVER = "https://agentcert.app";
 export async function saveConnection(name, input, options = {}) {
     const connectionName = validateConnectionName(name);
     const connection = validateConnection(input);

package/dist/normalizers.js

@@ -42,6 +42,7 @@ export function normalizeMcpBenchResult(input, artifactPath) {
         passed,
         certLevel: stringValue(value.cert_level),
         summary: passed ? "MCPBench completed without blocking violations." : "MCPBench found blocking evidence.",
+        evidenceStrength: reportedStrength("MCPBench result was imported without a source-signed action journal."),
         artifacts: recordOfStrings(value.artifact_paths, { results: artifactPath }),
         evidence,
     };
@@ -85,6 +86,7 @@ export function normalizeTripwireResult(input, artifactPath) {
         score: overallScore,
         passed,
         summary: passed ? "Tripwire CI gate passed." : "Tripwire CI gate failed.",
+        evidenceStrength: reportedStrength("Tripwire result was imported without a source-signed action journal."),
         artifacts: { result: artifactPath, outDir: stringValue(value.outDir) ?? "" },
         evidence,
     };
@@ -98,6 +100,10 @@ export function normalizeOnegentAuditPacket(input, artifactPath) {
     const authorization = asRecord(value.authorizationDecision);
     const verification = asRecord(value.verificationResult);
     const auditEvents = Array.isArray(value.auditEvents) ? value.auditEvents : [];
+    const trusted = asRecord(value.trustedActionEvidence);
+    const trustedStrength = evidenceStrengthValue(trusted.evidenceStrength);
+    const mandate = asRecord(trusted.mandate);
+    const receipt = asRecord(trusted.runReceipt);
     const verificationSuccess = verification.success === true;
     const approved = approval.status === "APPROVED" || approval.status === undefined;
     const passed = verificationSuccess && approved;
@@ -158,6 +164,25 @@ export function normalizeOnegentAuditPacket(input, artifactPath) {
         artifactPath,
         metadata: verification,
     });
+    if (trustedStrength) {
+        evidence.push({
+            id: "onegent_action_mandate",
+            kind: "action_mandate",
+            severity: "info",
+            message: `High-risk action was bound to mandate ${stringValue(mandate.mandateId) ?? "UNKNOWN"}.`,
+            source: "onegent-runtime",
+            artifactPath,
+            metadata: { mandateId: mandate.mandateId, mandateDigestSha256: mandate.digestSha256 },
+        }, {
+            id: "onegent_trusted_journal",
+            kind: "trusted_action_journal",
+            severity: asRecord(receipt.journal).valid === true ? "info" : "critical",
+            message: `Source-signed action journal strength: ${trustedStrength.level}.`,
+            source: "onegent-runtime",
+            artifactPath,
+            metadata: { receiptSha256: receipt.receiptSha256, collector: receipt.collector, journal: receipt.journal },
+        });
+    }
     for (const event of auditEvents) {
         const record = asRecord(event);
         evidence.push({
@@ -181,10 +206,32 @@ export function normalizeOnegentAuditPacket(input, artifactPath) {
         summary: passed
             ? "Runtime action was approved, mock-executed, verified, and audited."
             : "Runtime action did not complete the approval and verification gate.",
+        evidenceStrength: trustedStrength ?? reportedStrength("Onegent audit packet does not include a trusted action receipt."),
         artifacts: { auditPacket: artifactPath },
         evidence,
     };
 }
+function reportedStrength(limitation) {
+    return {
+        schemaVersion: "agentcert.evidence_strength.v0.1",
+        level: "reported",
+        claims: ["A producer supplied a result for this run."],
+        limitations: [limitation],
+    };
+}
+function evidenceStrengthValue(input) {
+    const value = asRecord(input);
+    const level = value.level;
+    if (value.schemaVersion !== "agentcert.evidence_strength.v0.1"
+        || !["reported", "recorded", "enforced", "outcome_verified", "independently_reviewed"].includes(String(level)))
+        return undefined;
+    return {
+        schemaVersion: "agentcert.evidence_strength.v0.1",
+        level: level,
+        claims: Array.isArray(value.claims) ? value.claims.filter((item) => typeof item === "string") : [],
+        limitations: Array.isArray(value.limitations) ? value.limitations.filter((item) => typeof item === "string") : [],
+    };
+}
 function normalizeScore(value) {
     return value <= 1 ? Math.round(value * 100) : Math.round(value);
 }

package/dist/report.js

@@ -6,7 +6,12 @@ export function renderMarkdownReport(bundle) {
         `Generated: ${bundle.generatedAt}`,
         `Verdict: ${bundle.verdict.passed ? "PASS" : "FAIL"}`,
         `Score: ${bundle.verdict.score}`,
-        `Level: ${bundle.verdict.level}`,
+        `Evidence strength: ${bundle.evidenceStrength?.level ?? "reported"}`,
+        "",
+        "## Evidence Strength",
+        "",
+        ...(bundle.evidenceStrength?.claims ?? ["A producer supplied a result for this run."]).map((claim) => `- Claim: ${claim}`),
+        ...(bundle.evidenceStrength?.limitations ?? ["This legacy bundle does not declare stronger source controls."]).map((limitation) => `- Limitation: ${limitation}`),
         "",
         "## Results",
         "",
@@ -34,6 +39,11 @@ export function renderMarkdownReport(bundle) {
     return `${lines.join("\n")}\n`;
 }
 export function renderHtmlReport(bundle) {
+    const strength = bundle.evidenceStrength ?? {
+        level: "reported",
+        claims: ["A producer supplied a result for this run."],
+        limitations: ["This legacy bundle does not declare stronger source controls."],
+    };
     const resultCards = bundle.results
         .map((result) => `<article class="card ${result.passed ? "pass" : "fail"}">
         <span>${escapeHtml(result.phase)}</span>
@@ -108,10 +118,17 @@ export function renderHtmlReport(bundle) {
       <div class="summary">
         <div class="metric"><span>Verdict</span><strong class="${bundle.verdict.passed ? "verdict-pass" : "verdict-fail"}">${bundle.verdict.passed ? "PASS" : "FAIL"}</strong></div>
         <div class="metric"><span>Score</span><strong>${bundle.verdict.score}/100</strong></div>
-        <div class="metric"><span>Level</span><strong>${escapeHtml(bundle.verdict.level)}</strong></div>
+        <div class="metric"><span>Evidence strength</span><strong>${escapeHtml(bundle.evidenceStrength?.level ?? "reported")}</strong></div>
         <div class="metric"><span>Evidence</span><strong>${bundle.summary.totalEvidence}</strong></div>
       </div>
       <div class="cards">${resultCards}</div>
+      <section>
+        <h2>Evidence strength: ${escapeHtml(strength.level)}</h2>
+        <h3>Supported claims</h3>
+        <ul>${strength.claims.map((claim) => `<li>${escapeHtml(claim)}</li>`).join("")}</ul>
+        <h3>Limitations</h3>
+        <ul>${strength.limitations.map((limitation) => `<li>${escapeHtml(limitation)}</li>`).join("")}</ul>
+      </section>
       <section>
         <h2>Evidence</h2>
         <table>

package/dist/runner.js

@@ -7,6 +7,7 @@ import { buildEvidenceBundle } from "./bundle.js";
 import { recordsFromAgentCertResult, renderCorpusSummary, summarizeCorpus, writeReviewedFailureDataset, } from "./corpus.js";
 import { openCorpusStore, parseCorpusStoreKind } from "./corpus-store.js";
 import { applyFailureReviews, readFailureReviews } from "./failure-review.js";
+import { governCorpusRecords } from "./corpus-governance.js";
 import { buildMonitorSnapshot, writeMonitorSnapshot } from "./monitor.js";
 import { normalizeMcpBenchResult, normalizeOnegentAuditPacket, normalizeTripwireResult } from "./normalizers.js";
 import { renderHtmlReport, renderMarkdownReport } from "./report.js";
@@ -168,7 +169,7 @@ export async function runAgentCertProfile(profileInput, options = {}) {
     const bundle = buildEvidenceBundle(loaded.map((artifact) => artifact.result), profile.subject.name, profile.subject.type);
     const reviewsPath = profile.run?.corpus?.reviewsPath;
     const reviews = await readFailureReviews(reviewsPath ? resolve(cwd, reviewsPath) : undefined);
-    const records = applyFailureReviews(loaded.flatMap(({ result, path, raw }) => recordsFromAgentCertResult(result, path, profile.subject.name, raw)), reviews);
+    const records = governCorpusRecords(applyFailureReviews(loaded.flatMap(({ result, path, raw }) => recordsFromAgentCertResult(result, path, profile.subject.name, raw)), reviews), { consent: "private", consentSource: "agentcert-runner-default" });
     const outputs = { monitor: [], reviewedDataset: [] };
     const reportEnabled = profile.run?.report?.enabled ?? true;
     const reportDir = profile.run?.report?.outDir ?? profile.outputDir;

package/dist/schema-validator.js

@@ -11,10 +11,16 @@ export function parseSchemaId(input) {
         value === "monitor-snapshot" ||
         value === "robustness-lab" ||
         value === "release-gate" ||
-        value === "evidence-signature") {
+        value === "assurance-report" ||
+        value === "assurance-delivery" ||
+        value === "evidence-signature" ||
+        value === "evidence-strength" ||
+        value === "action-mandate" ||
+        value === "trusted-action-record" ||
+        value === "trusted-run-receipt") {
         return value;
     }
-    throw new Error(`Unsupported schema "${value}". Use evidence-bundle, result, corpus-record, failure-review, classifier-eval, monitor-snapshot, robustness-lab, release-gate, or evidence-signature.`);
+    throw new Error(`Unsupported schema "${value}". Use evidence-bundle, result, corpus-record, failure-review, classifier-eval, monitor-snapshot, robustness-lab, release-gate, assurance-report, assurance-delivery, evidence-signature, evidence-strength, action-mandate, trusted-action-record, or trusted-run-receipt.`);
 }
 export function validateAgentCertSchema(schema, input) {
     const errors = [];
@@ -42,6 +48,18 @@ export function validateAgentCertSchema(schema, input) {
             validateMonitorSnapshot(value, errors);
         if (schema === "robustness-lab")
             validateRobustnessLab(value, errors);
+        if (schema === "assurance-report")
+            validateAssuranceReport(value, errors);
+        if (schema === "assurance-delivery")
+            validateAssuranceDelivery(value, errors);
+        if (schema === "evidence-strength")
+            validateEvidenceStrength(value, errors);
+        if (schema === "action-mandate")
+            validateActionMandate(value, errors);
+        if (schema === "trusted-action-record")
+            validateTrustedActionRecord(value, errors);
+        if (schema === "trusted-run-receipt")
+            validateTrustedRunReceipt(value, errors);
     }
     return { schema, valid: errors.length === 0, errors };
 }
@@ -59,6 +77,13 @@ function validateEvidenceBundle(value, errors) {
     requiredArray(value, "evidence", errors);
     requiredObject(value, "artifacts", errors);
     requiredArray(value, "standards", errors);
+    if (value.evidenceStrength !== undefined) {
+        const strength = recordValue(value.evidenceStrength);
+        if (!strength)
+            errors.push("evidenceStrength must be an object.");
+        else
+            validateEvidenceStrength(strength, errors, "evidenceStrength.");
+    }
     const subject = recordValue(value.subject);
     if (subject) {
         requiredStringAt(subject, "name", "subject.name", errors);
@@ -83,6 +108,88 @@ function validateEvidenceBundle(value, errors) {
     validateEvidenceArray(value.evidence, "evidence", errors);
     validateStandards(value.standards, errors);
 }
+const EVIDENCE_LEVELS = ["reported", "recorded", "enforced", "outcome_verified", "independently_reviewed"];
+const ACTION_TYPES = ["SUBMIT", "PAY", "SEND", "UPDATE"];
+function validateEvidenceStrength(value, errors, prefix = "") {
+    requiredConst(value, "schemaVersion", "agentcert.evidence_strength.v0.1", errors);
+    requiredEnumAt(value, "level", EVIDENCE_LEVELS, `${prefix}level`, errors);
+    requiredArray(value, "claims", errors);
+    requiredArray(value, "limitations", errors);
+    stringArray(value.claims, `${prefix}claims`, errors);
+    stringArray(value.limitations, `${prefix}limitations`, errors);
+}
+function validateActionMandate(value, errors) {
+    requiredConst(value, "schemaVersion", "agentcert.action_mandate.v0.1", errors);
+    for (const field of ["mandateId", "policySha256", "validFrom", "expiresAt", "issuedAt", "digestSha256"])
+        requiredString(value, field, errors);
+    requiredObject(value, "issuer", errors);
+    requiredObject(value, "subject", errors);
+    requiredObject(value, "scope", errors);
+    requiredObject(value, "sourceSignature", errors);
+    sha256Field(value, "policySha256", errors);
+    sha256Field(value, "digestSha256", errors);
+    for (const field of ["validFrom", "expiresAt", "issuedAt"])
+        validateTimestamp(value[field], field, errors);
+    const scope = recordValue(value.scope);
+    if (scope) {
+        requiredArray(scope, "actionTypes", errors);
+        requiredArray(scope, "targetSystems", errors);
+        requiredArray(scope, "permissions", errors);
+        if (Array.isArray(scope.actionTypes))
+            scope.actionTypes.forEach((item, index) => {
+                if (!ACTION_TYPES.includes(String(item)))
+                    errors.push(`scope.actionTypes[${index}] is not supported.`);
+            });
+    }
+    validateSourceSignature(value.sourceSignature, "sourceSignature", errors);
+}
+function validateTrustedActionRecord(value, errors) {
+    requiredConst(value, "schemaVersion", "agentcert.trusted_action_record.v0.1", errors);
+    for (const field of ["recordId", "runId", "occurredAt", "type", "payloadSha256", "eventHash"])
+        requiredString(value, field, errors);
+    requiredNonNegativeInteger(value, "sequence", "sequence", errors);
+    requiredObject(value, "collector", errors);
+    requiredObject(value, "payload", errors);
+    requiredObject(value, "sourceSignature", errors);
+    sha256Field(value, "payloadSha256", errors);
+    sha256Field(value, "eventHash", errors);
+    if (value.previousEventHash !== undefined)
+        sha256Field(value, "previousEventHash", errors);
+    validateTimestamp(value.occurredAt, "occurredAt", errors);
+    validateSourceSignature(value.sourceSignature, "sourceSignature", errors);
+}
+function validateTrustedRunReceipt(value, errors) {
+    requiredConst(value, "schemaVersion", "agentcert.trusted_run_receipt.v0.1", errors);
+    for (const field of ["runId", "startedAt", "completedAt", "firstEventHash", "lastEventHash", "sourcePublicKeyPem", "receiptSha256"])
+        requiredString(value, field, errors);
+    for (const field of ["eventCount", "droppedEventCount"])
+        requiredNonNegativeInteger(value, field, field, errors);
+    requiredObject(value, "collector", errors);
+    requiredArray(value, "mandateDigests", errors);
+    requiredArray(value, "actionIds", errors);
+    requiredObject(value, "journal", errors);
+    requiredObject(value, "evidenceStrength", errors);
+    requiredObject(value, "sourceSignature", errors);
+    for (const field of ["firstEventHash", "lastEventHash", "receiptSha256"])
+        sha256Field(value, field, errors);
+    const strength = recordValue(value.evidenceStrength);
+    if (strength)
+        validateEvidenceStrength(strength, errors, "evidenceStrength.");
+    validateSourceSignature(value.sourceSignature, "sourceSignature", errors);
+}
+function sha256Field(value, field, errors) {
+    if (typeof value[field] === "string" && !/^[0-9a-f]{64}$/.test(value[field]))
+        errors.push(`${field} must be a lowercase SHA-256 digest.`);
+}
+function validateSourceSignature(value, path, errors) {
+    const signature = recordValue(value);
+    if (!signature)
+        return;
+    if (signature.algorithm !== "Ed25519")
+        errors.push(`${path}.algorithm must equal Ed25519.`);
+    requiredStringAt(signature, "keyId", `${path}.keyId`, errors);
+    requiredStringAt(signature, "signature", `${path}.signature`, errors);
+}
 function validateResult(value, errors) {
     requiredConst(value, "schemaVersion", "1", errors);
     requiredString(value, "product", errors);
@@ -160,6 +267,59 @@ function validateCorpusRecord(value, errors) {
     requiredString(value, "runId", errors);
     requiredBoolean(value, "passed", errors);
     requiredArray(value, "failurePatterns", errors);
+    if (value.governance !== undefined) {
+        const governance = recordValue(value.governance);
+        if (!governance)
+            errors.push("governance must be an object.");
+        else {
+            requiredConst(governance, "schemaVersion", "agentcert.corpus_governance.v0.1", errors);
+            requiredEnum(governance, "consent", ["private", "anonymous", "public", "denied"], errors);
+            requiredString(governance, "consentSource", errors);
+            requiredString(governance, "consentRecordedAt", errors);
+            requiredObject(governance, "provenance", errors);
+            requiredObject(governance, "redaction", errors);
+        }
+    }
+}
+function validateAssuranceReport(value, errors) {
+    requiredConst(value, "schemaVersion", "agentcert.assurance_report.v0.1", errors);
+    for (const key of ["assuranceCaseId", "projectId", "policyPackVersion", "evaluationPlanSha256", "reviewerId", "issuedAt", "expiresAt", "statement"])
+        requiredString(value, key, errors);
+    requiredObject(value, "subject", errors);
+    requiredArray(value, "evidence", errors);
+    requiredConst(value, "decision", "issued", errors);
+    requiredArray(value, "limitations", errors);
+    if (!/^[0-9a-f]{64}$/.test(String(value.evaluationPlanSha256 ?? "")))
+        errors.push("evaluationPlanSha256 must be a lowercase SHA-256 digest.");
+    validateTimestamp(value.issuedAt, "issuedAt", errors);
+    validateTimestamp(value.expiresAt, "expiresAt", errors);
+}
+function validateAssuranceDelivery(value, errors) {
+    requiredConst(value, "schemaVersion", "agentcert.assurance_delivery.v0.1", errors);
+    for (const key of ["engagementId", "projectId", "assuranceCaseId", "dueAt", "deliveredAt", "evaluationPlanSha256", "statement"])
+        requiredString(value, key, errors);
+    for (const key of ["customer", "subject", "sandbox", "workflow", "terms", "decision", "integration", "evidenceStrength", "attestation"])
+        requiredObject(value, key, errors);
+    for (const key of ["baselineEvidence", "remediationItems", "retestEvidence"])
+        requiredArray(value, key, errors);
+    if (!/^[0-9a-f]{64}$/.test(String(value.evaluationPlanSha256 ?? "")))
+        errors.push("evaluationPlanSha256 must be a lowercase SHA-256 digest.");
+    validateTimestamp(value.dueAt, "dueAt", errors);
+    validateTimestamp(value.deliveredAt, "deliveredAt", errors);
+    const terms = recordValue(value.terms);
+    if (terms) {
+        if (terms.priceUsd !== 5000)
+            errors.push("terms.priceUsd must equal 5000.");
+        if (terms.workflowCount !== 1)
+            errors.push("terms.workflowCount must equal 1.");
+        if (terms.includedRetests !== 1)
+            errors.push("terms.includedRetests must equal 1.");
+        if (terms.privacy !== "private_by_default")
+            errors.push("terms.privacy must equal private_by_default.");
+    }
+    const decision = recordValue(value.decision);
+    if (decision)
+        requiredEnum(decision, "verdict", ["RELEASE", "RELEASE_WITH_CONTROLS", "BLOCK"], errors);
 }
 function validateFailureReview(value, errors) {
     requiredConst(value, "schemaVersion", "1", errors);

package/dist/vendor/onegent-runtime/sdk.d.ts

@@ -17,7 +17,7 @@ export interface OnegentRuntime {
     executeAfterApproval(action: ActionIntent | string, adapter?: LocalActionAdapter): Promise<ActionExecutionSummary>;
     rollbackAfterExecution(action: ActionIntent | string, adapter: LocalActionAdapter, reason: string): Promise<ActionExecutionReceipt>;
     getExecutionReceipt(action: ActionIntent | string): Promise<ActionExecutionReceipt | undefined>;
-    verifyOutcome(action: ActionIntent | string, observedState?: ActionExecutionSummary | Record<string, unknown>): VerificationResult;
+    verifyOutcome(action: ActionIntent | string, observedState?: ActionExecutionSummary | Record<string, unknown>, method?: import("./types.js").VerificationMethod): VerificationResult;
     writeAuditPacket(action: ActionIntent | string): Promise<ActionAuditPacket>;
     getActionReview(action: ActionIntent | string): ActionReview;
     listActionReviews(): ActionReview[];

package/dist/vendor/onegent-runtime/sdk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/sdk.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EACV,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,eAAe,EACf,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,KAAK,EAAE,uBAAuB,GAAG,YAAY,CAAC;IAC5D,UAAU,CAAC,MAAM,EAAE,YAAY,GAAG,cAAc,CAAC;IACjD,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,gBAAgB,CAAC;IAC9E,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9F,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;IAC1G,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;IACzG,oBAAoB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnH,sBAAsB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACpI,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;IAChG,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,aAAa,CAAC,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,kBAAkB,CAAC;IACnI,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC5E,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,YAAY,CAAC;IAC7D,iBAAiB,IAAI,YAAY,EAAE,CAAC;CACrC;AAED,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B,GAAG,cAAc,CA2GxF;AAED,wBAAgB,4BAA4B,CAAC,IAAI,SAA8B,GAAG,cAAc,GAAG;IACjG,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;CAC/C,CAQA"}
+{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/sdk.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EACV,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,eAAe,EACf,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,KAAK,EAAE,uBAAuB,GAAG,YAAY,CAAC;IAC5D,UAAU,CAAC,MAAM,EAAE,YAAY,GAAG,cAAc,CAAC;IACjD,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,gBAAgB,CAAC;IAC9E,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9F,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;IAC1G,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;IACzG,oBAAoB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnH,sBAAsB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACpI,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;IAChG,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,aAAa,CAAC,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,YAAY,EAAE,kBAAkB,GAAG,kBAAkB,CAAC;IACrL,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC5E,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,YAAY,CAAC;IAC7D,iBAAiB,IAAI,YAAY,EAAE,CAAC;CACrC;AAED,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B,GAAG,cAAc,CA2GxF;AAED,wBAAgB,4BAA4B,CAAC,IAAI,SAA8B,GAAG,cAAc,GAAG;IACjG,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;CAC/C,CAQA"}

package/dist/vendor/onegent-runtime/sdk.js

@@ -105,7 +105,7 @@ export function createOnegentRuntime(options = {}) {
             return next;
         },
         getExecutionReceipt: async (actionInput) => executionStore.get(getActionReview(actionId(actionInput)).action.idempotencyKey),
-        verifyOutcome: (action, observedState) => verifyActionOutcome(actionId(action), observedStateForVerification(observedState)),
+        verifyOutcome: (action, observedState, method) => verifyActionOutcome(actionId(action), observedStateForVerification(observedState), method),
         writeAuditPacket: async (action) => {
             const packet = generateAuditPacket(actionId(action));
             await options.auditStore?.writeAuditPacket(packet);

package/dist/vendor/onegent-runtime/service.d.ts

@@ -1,4 +1,4 @@
-import type { ActionAuditPacket, ActionExecutionSummary, ActionRollbackResult, ActionReview, AuthorizationPolicy, ApprovalRequest, CreateActionIntentInput, LocalActionAdapter, PolicyEngine, PolicyRule, VerificationResult } from "./types.js";
+import type { ActionAuditPacket, ActionExecutionSummary, ActionRollbackResult, ActionReview, AuthorizationPolicy, ApprovalRequest, CreateActionIntentInput, LocalActionAdapter, PolicyEngine, PolicyRule, VerificationMethod, VerificationResult } from "./types.js";
 export interface ActionGatewayOptions {
     policyRules?: PolicyRule[];
     policyEngine?: PolicyEngine;
@@ -18,8 +18,8 @@ export declare function executeAfterApprovalWithAdapter(actionId: string, adapte
 }): Promise<ActionExecutionSummary>;
 export declare function recordRollback(actionId: string, adapterName: string, reason: string, result: ActionRollbackResult): ActionReview;
 export declare function executeMockAction(actionId: string): ActionExecutionSummary;
-export declare function verifyOutcome(actionId: string, observedState?: Record<string, unknown>): VerificationResult;
-export declare function verifyAction(actionId: string, observedState?: Record<string, unknown>): VerificationResult;
+export declare function verifyOutcome(actionId: string, observedState?: Record<string, unknown>, method?: VerificationMethod): VerificationResult;
+export declare function verifyAction(actionId: string, observedState?: Record<string, unknown>, methodOverride?: VerificationMethod): VerificationResult;
 export declare function getActionReview(actionId: string): ActionReview;
 export declare function listActionReviews(): ActionReview[];
 export declare function writeAuditPacket(actionId: string): ActionAuditPacket;

package/dist/vendor/onegent-runtime/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EAEpB,YAAY,EAEZ,mBAAmB,EACnB,eAAe,EAGf,uBAAuB,EACvB,kBAAkB,EAClB,YAAY,EACZ,UAAU,EAEV,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,uBAAuB,EAAE,OAAO,GAAE,oBAAyB,GAAG,YAAY,CAuGpH;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,UAAU,SAAiC,EAC3C,eAAe,SAAuC,EACtD,OAAO,GAAE,eAAoB,GAC5B,YAAY,CAwBd;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,UAAU,SAAiC,EAC3C,WAAW,SAAoB,GAC9B,eAAe,CA2BjB;AAED,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,UAAU,SAAiC,EAC3C,eAAe,SAAgC,GAC9C,YAAY,CAmBd;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAQ7E;AAED,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,kBAAkB,EAC3B,OAAO,CAAC,EAAE;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpD,OAAO,CAAC,sBAAsB,CAAC,CA6BjC;AAED,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,oBAAoB,GAC3B,YAAY,CAkBd;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAyC1E;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,kBAAkB,CAE3G;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,kBAAkB,CAoC1G;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAuB9D;AAED,wBAAgB,iBAAiB,IAAI,YAAY,EAAE,CAElD;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CAEpE;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CA+BvE"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EAEpB,YAAY,EAEZ,mBAAmB,EACnB,eAAe,EAGf,uBAAuB,EACvB,kBAAkB,EAClB,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,uBAAuB,EAAE,OAAO,GAAE,oBAAyB,GAAG,YAAY,CAwGpH;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,UAAU,SAAiC,EAC3C,eAAe,SAAuC,EACtD,OAAO,GAAE,eAAoB,GAC5B,YAAY,CAwBd;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,UAAU,SAAiC,EAC3C,WAAW,SAAoB,GAC9B,eAAe,CA2BjB;AAED,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,UAAU,SAAiC,EAC3C,eAAe,SAAgC,GAC9C,YAAY,CAmBd;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAQ7E;AAED,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,kBAAkB,EAC3B,OAAO,CAAC,EAAE;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpD,OAAO,CAAC,sBAAsB,CAAC,CA6BjC;AAED,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,oBAAoB,GAC3B,YAAY,CAkBd;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAyC1E;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,kBAAkB,GAAG,kBAAkB,CAExI;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,CAAC,EAAE,kBAAkB,GAAG,kBAAkB,CAoC/I;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAuB9D;AAED,wBAAgB,iBAAiB,IAAI,YAAY,EAAE,CAElD;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CAEpE;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CA+BvE"}

package/dist/vendor/onegent-runtime/service.js

@@ -15,6 +15,7 @@ export function captureActionIntent(input, options = {}) {
         sourceAgentRunId: input.sourceAgentRunId,
         principal: input.principal ?? { id: input.sourceAgentName, type: "agent" },
         requestedPermissions: input.requestedPermissions ?? [`${input.targetSystem}:${input.actionType}`],
+        mandateId: input.mandateId,
         actionType: input.actionType,
         targetSystem: input.targetSystem,
         targetUrl: input.targetUrl,
@@ -246,10 +247,10 @@ export function executeMockAction(actionId) {
         observedState,
     };
 }
-export function verifyOutcome(actionId, observedState) {
-    return verifyAction(actionId, observedState);
+export function verifyOutcome(actionId, observedState, method) {
+    return verifyAction(actionId, observedState, method);
 }
-export function verifyAction(actionId, observedState) {
+export function verifyAction(actionId, observedState, methodOverride) {
     const action = requireAction(actionId);
     if (action.status !== "EXECUTED" && action.status !== "VERIFIED" && action.status !== "FAILED_VERIFICATION") {
         throw new Error(`Action ${actionId} must be mock-executed before verification.`);
@@ -257,7 +258,8 @@ export function verifyAction(actionId, observedState) {
     const effectiveObservedState = observedState ?? observeActionState(action);
     const differences = diffState(action.proposedAfterState, effectiveObservedState);
     const success = differences.length === 0;
-    const method = action.businessObjectType === "purchase_order" && action.targetSystem === "MockERP" ? "LOCAL_MOCK_ERP" : "MOCK";
+    const method = methodOverride ??
+        (action.businessObjectType === "purchase_order" && action.targetSystem === "MockERP" ? "LOCAL_MOCK_ERP" : "MOCK");
     const result = {
         id: nextId("verify"),
         actionIntentId: action.id,

package/dist/vendor/onegent-runtime/trust-types.d.ts

@@ -0,0 +1,163 @@
+import type { ActionExecutionSummary, ActionIntent, ActionType, CreateActionIntentInput, LocalActionAdapter, VerificationResult } from "./types.js";
+export declare const EVIDENCE_STRENGTH_LEVELS: readonly ["reported", "recorded", "enforced", "outcome_verified", "independently_reviewed"];
+export type EvidenceStrengthLevel = (typeof EVIDENCE_STRENGTH_LEVELS)[number];
+export interface EvidenceStrengthAssessment {
+    schemaVersion: "agentcert.evidence_strength.v0.1";
+    level: EvidenceStrengthLevel;
+    claims: string[];
+    limitations: string[];
+}
+export interface CollectorIdentity {
+    id: string;
+    version: string;
+    keyId: string;
+    publicKeySha256: string;
+    environment: string;
+}
+export interface SourceSigner {
+    keyId: string;
+    privateKeyPem: string;
+    publicKeyPem?: string;
+}
+export interface SourceSignature {
+    algorithm: "Ed25519";
+    keyId: string;
+    signature: string;
+}
+export interface ActionMandateScope {
+    actionTypes: ActionType[];
+    targetSystems: string[];
+    permissions: string[];
+    businessObjectIds?: string[];
+    recipients?: string[];
+    currencies?: string[];
+    maxAmount?: number;
+}
+export interface ActionMandatePayload {
+    schemaVersion: "agentcert.action_mandate.v0.1";
+    mandateId: string;
+    issuer: {
+        id: string;
+        type: "human" | "organization" | "service";
+    };
+    subject: {
+        principalId: string;
+        agentVersion?: string;
+    };
+    scope: ActionMandateScope;
+    expectedOutcome?: Record<string, unknown>;
+    policySha256: string;
+    validFrom: string;
+    expiresAt: string;
+    issuedAt: string;
+}
+export interface ActionMandate extends ActionMandatePayload {
+    digestSha256: string;
+    sourceSignature: SourceSignature;
+}
+export interface CreateActionMandateInput extends Omit<ActionMandatePayload, "schemaVersion" | "issuedAt"> {
+    issuedAt?: string;
+}
+export interface MandateVerification {
+    valid: boolean;
+    digestMatches: boolean;
+    signatureMatches: boolean;
+    active: boolean;
+    errors: string[];
+}
+export interface MandateStore {
+    readonly name: string;
+    get(mandateId: string): Promise<ActionMandate | undefined>;
+    put(mandate: ActionMandate): Promise<ActionMandate>;
+    list(): Promise<ActionMandate[]>;
+}
+export type TrustedRecordType = "RUN_STARTED" | "JOURNAL_RECOVERED" | "EVENTS_DROPPED" | "MANDATE_BOUND" | "ACTION_CAPTURED" | "APPROVAL_REQUESTED" | "ACTION_APPROVED" | "ACTION_REJECTED" | "EXECUTION_STARTED" | "EXECUTION_COMPLETED" | "OUTCOME_OBSERVED" | "VERIFICATION_PASSED" | "VERIFICATION_FAILED" | "RUN_COMPLETED";
+export interface TrustedActionRecord {
+    schemaVersion: "agentcert.trusted_action_record.v0.1";
+    recordId: string;
+    runId: string;
+    sequence: number;
+    occurredAt: string;
+    type: TrustedRecordType;
+    collector: CollectorIdentity;
+    previousEventHash?: string;
+    payload: Record<string, unknown>;
+    payloadSha256: string;
+    eventHash: string;
+    sourceSignature: SourceSignature;
+}
+export interface JournalGap {
+    afterSequence: number;
+    beforeSequence: number;
+    missing: number;
+    declared: boolean;
+}
+export interface JournalValidation {
+    valid: boolean;
+    complete: boolean;
+    sourceSigned: boolean;
+    gaps: JournalGap[];
+    duplicateSequences: number[];
+    duplicateRecordIds: string[];
+    hashMismatches: number[];
+    signatureFailures: number[];
+    droppedEventCount: number;
+    recoveredTailBytes: number;
+    errors: string[];
+}
+export interface TrustedRunReceipt {
+    schemaVersion: "agentcert.trusted_run_receipt.v0.1";
+    runId: string;
+    collector: CollectorIdentity;
+    startedAt: string;
+    completedAt: string;
+    eventCount: number;
+    droppedEventCount: number;
+    firstEventHash: string;
+    lastEventHash: string;
+    mandateDigests: string[];
+    actionIds: string[];
+    journal: JournalValidation;
+    evidenceStrength: EvidenceStrengthAssessment;
+    sourcePublicKeyPem: string;
+    receiptSha256: string;
+    sourceSignature: SourceSignature;
+}
+export interface TrustedRecorderSink {
+    name: string;
+    write(record: TrustedActionRecord): Promise<void>;
+}
+export interface ControlledAdapterBoundary {
+    mode: "agentcert_gateway";
+    credentials: "gateway_managed";
+    bypassPrevention: "credentials_unavailable_to_agent";
+    allowedActionTypes: ActionType[];
+    allowedTargetSystems: string[];
+}
+export interface ControlledActionAdapter extends LocalActionAdapter {
+    control: ControlledAdapterBoundary;
+}
+export interface OutcomeObservation {
+    observationId: string;
+    observedAt: string;
+    observedState: Record<string, unknown>;
+    source: string;
+}
+export interface IndependentOutcomeProbe {
+    name: string;
+    independent: true;
+    observe(action: ActionIntent, execution: ActionExecutionSummary): Promise<OutcomeObservation>;
+}
+export interface TrustedActionEvidence {
+    schemaVersion: "agentcert.trusted_action_evidence.v0.1";
+    mandate: ActionMandate;
+    runReceipt: TrustedRunReceipt;
+    outcomeObservation?: OutcomeObservation;
+    verification?: VerificationResult;
+    evidenceStrength: EvidenceStrengthAssessment;
+}
+export interface TrustedCaptureInput {
+    action: CreateActionIntentInput;
+    mandateId: string;
+}
+//# sourceMappingURL=trust-types.d.ts.map

package/dist/vendor/onegent-runtime/trust-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-types.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/trust-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACZ,UAAU,EACV,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,wBAAwB,6FAM3B,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E,MAAM,WAAW,0BAA0B;IACzC,aAAa,EAAE,kCAAkC,CAAC;IAClD,KAAK,EAAE,qBAAqB,CAAC;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,+BAA+B,CAAC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,cAAc,GAAG,SAAS,CAAA;KAAE,CAAC;IACnE,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAc,SAAQ,oBAAoB;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,wBAAyB,SAAQ,IAAI,CAAC,oBAAoB,EAAE,eAAe,GAAG,UAAU,CAAC;IACxG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IAC3D,GAAG,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACpD,IAAI,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;CAClC;AAED,MAAM,MAAM,iBAAiB,GACzB,aAAa,GACb,mBAAmB,GACnB,gBAAgB,GAChB,eAAe,GACf,iBAAiB,GACjB,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,mBAAmB,GACnB,qBAAqB,GACrB,kBAAkB,GAClB,qBAAqB,GACrB,qBAAqB,GACrB,eAAe,CAAC;AAEpB,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,sCAAsC,CAAC;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;IACtB,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,oCAAoC,CAAC;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,iBAAiB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,gBAAgB,EAAE,0BAA0B,CAAC;IAC7C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,gBAAgB,EAAE,kCAAkC,CAAC;IACrD,kBAAkB,EAAE,UAAU,EAAE,CAAC;IACjC,oBAAoB,EAAE,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,uBAAwB,SAAQ,kBAAkB;IACjE,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,IAAI,CAAC;IAClB,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAC/F;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,wCAAwC,CAAC;IACxD,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,gBAAgB,EAAE,0BAA0B,CAAC;CAC9C;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,uBAAuB,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/vendor/onegent-runtime/trust-types.js

@@ -0,0 +1,7 @@
+export const EVIDENCE_STRENGTH_LEVELS = [
+    "reported",
+    "recorded",
+    "enforced",
+    "outcome_verified",
+    "independently_reviewed",
+];

package/dist/vendor/onegent-runtime/types.d.ts

@@ -4,7 +4,7 @@ export type ActionIntentStatus = "CAPTURED" | "NEEDS_REVIEW" | "APPROVED" | "REJ
 export type RiskLevel = "LOW" | "MEDIUM" | "HIGH" | "CRITICAL";
 export type PolicyEffect = "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
 export type ApprovalStatus = "PENDING" | "APPROVED" | "REJECTED" | "EXPIRED";
-export type VerificationMethod = "MOCK" | "LOCAL_MOCK_ERP" | "LOCAL_ADAPTER";
+export type VerificationMethod = "MOCK" | "LOCAL_MOCK_ERP" | "LOCAL_ADAPTER" | "INDEPENDENT_PROBE";
 export interface ActionFieldChange {
     field: string;
     before?: unknown;
@@ -25,6 +25,7 @@ export interface ActionIntent {
     sourceAgentRunId?: string;
     principal: AgentPrincipal;
     requestedPermissions: string[];
+    mandateId?: string;
     actionType: ActionType;
     targetSystem: string;
     targetUrl?: string;
@@ -52,6 +53,7 @@ export interface CreateActionIntentInput {
     sourceAgentRunId?: string;
     principal?: AgentPrincipal;
     requestedPermissions?: string[];
+    mandateId?: string;
     actionType: ActionType;
     targetSystem: string;
     targetUrl?: string;
@@ -270,6 +272,7 @@ export interface ActionAuditPacket {
     execution: ActionExecutionSummary;
     verificationResult?: VerificationResult;
     auditEvents: AuditEvent[];
+    trustedActionEvidence?: import("./trust-types.js").TrustedActionEvidence;
     disclaimer: string;
 }
 export interface AuditStore {

package/dist/vendor/onegent-runtime/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE9D,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAElE,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,cAAc,GACd,UAAU,GACV,UAAU,GACV,UAAU,GACV,UAAU,GACV,qBAAqB,GACrB,aAAa,GACb,iBAAiB,GACjB,WAAW,CAAC;AAEhB,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/D,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,kBAAkB,GAAG,OAAO,CAAC;AAElE,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;AAE7E,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,gBAAgB,GAAG,eAAe,CAAC;AAE7E,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,cAAc,CAAC;IAC1B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,iBAAiB,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,aAAa,EAAE,iBAAiB,EAAE,CAAC;IACnC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,aAAa,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACpC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,GAAG,WAAW,GAAG,aAAa,GAAG,oBAAoB,GAAG,UAAU,GAAG,iBAAiB,GAAG,UAAU,CAAC;IACtH,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,GAAG,CAAC;IACnB,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,YAAY,CAAC;IACrB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAC;CAC7F;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,yBAAyB,CAAC;CAC5D;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,gBAAgB,CAAC;IACzB,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,KAAK,EAAE,sBAAsB,GAAG,uBAAuB,GAAG,IAAI,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;CAC1H;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,uBAAuB,GACvB,eAAe,GACf,kBAAkB,GAClB,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,wBAAwB,GACxB,0BAA0B,GAC1B,kBAAkB,GAClB,kBAAkB,GAClB,oBAAoB,GACpB,iBAAiB,GACjB,qBAAqB,GACrB,qBAAqB,GACrB,wBAAwB,CAAC;AAE7B,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,cAAc,CAAC;IAC1B,SAAS,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,GAAG,WAAW,CAAC;IAC9B,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,YAAY,CAAC;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,MAAM,EAAE,cAAc,GAAG,WAAW,CAAC;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,SAAS,CAAC;IAChB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,aAAa,EAAE,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC9H,QAAQ,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,sBAAsB,EAAE,OAAO,EAAE,qBAAqB,GAAG,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC1J;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,WAAW,GAAG,aAAa,GAAG,iBAAiB,CAAC;IACxD,SAAS,EAAE,sBAAsB,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,oBAAoB,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3E;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,cAAc,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;IAC9G,GAAG,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,2BAA2B,CAAC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,cAAc,CAAC;IAC/B,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,iBAAiB,EAAE,UAAU,EAAE,CAAC;IAChC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,SAAS,EAAE,sBAAsB,CAAC;IAClC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,iBAAiB,CAAC;IACjC,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE9D,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAElE,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,cAAc,GACd,UAAU,GACV,UAAU,GACV,UAAU,GACV,UAAU,GACV,qBAAqB,GACrB,aAAa,GACb,iBAAiB,GACjB,WAAW,CAAC;AAEhB,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/D,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,kBAAkB,GAAG,OAAO,CAAC;AAElE,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;AAE7E,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,gBAAgB,GAAG,eAAe,GAAG,mBAAmB,CAAC;AAEnG,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,cAAc,CAAC;IAC1B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,iBAAiB,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,aAAa,EAAE,iBAAiB,EAAE,CAAC;IACnC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,aAAa,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACpC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,GAAG,WAAW,GAAG,aAAa,GAAG,oBAAoB,GAAG,UAAU,GAAG,iBAAiB,GAAG,UAAU,CAAC;IACtH,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,GAAG,CAAC;IACnB,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,YAAY,CAAC;IACrB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAC;CAC7F;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,yBAAyB,CAAC;CAC5D;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,gBAAgB,CAAC;IACzB,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,KAAK,EAAE,sBAAsB,GAAG,uBAAuB,GAAG,IAAI,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;CAC1H;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,uBAAuB,GACvB,eAAe,GACf,kBAAkB,GAClB,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,wBAAwB,GACxB,0BAA0B,GAC1B,kBAAkB,GAClB,kBAAkB,GAClB,oBAAoB,GACpB,iBAAiB,GACjB,qBAAqB,GACrB,qBAAqB,GACrB,wBAAwB,CAAC;AAE7B,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,cAAc,CAAC;IAC1B,SAAS,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,GAAG,WAAW,CAAC;IAC9B,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,YAAY,CAAC;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,MAAM,EAAE,cAAc,GAAG,WAAW,CAAC;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,SAAS,CAAC;IAChB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,aAAa,EAAE,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC9H,QAAQ,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,sBAAsB,EAAE,OAAO,EAAE,qBAAqB,GAAG,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC1J;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,WAAW,GAAG,aAAa,GAAG,iBAAiB,CAAC;IACxD,SAAS,EAAE,sBAAsB,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,oBAAoB,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3E;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,cAAc,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;IAC9G,GAAG,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,2BAA2B,CAAC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,cAAc,CAAC;IAC/B,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,iBAAiB,EAAE,UAAU,EAAE,CAAC;IAChC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,SAAS,EAAE,sBAAsB,CAAC;IAClC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,qBAAqB,CAAC,EAAE,OAAO,kBAAkB,EAAE,qBAAqB,CAAC;IACzE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,iBAAiB,CAAC;IACjC,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC"}

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "agentcert",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "Assurance release gates, runtime evidence, and regression CI for AI agents.",
   "type": "module",
   "license": "Apache-2.0",
-  "homepage": "https://agentcert-control-plane.onrender.com/demo",
+  "homepage": "https://agentcert.app/",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Kakarottoooo/agentcert.git",