agentcert 0.5.4 → 0.6.0

package/README.md

@@ -57,6 +57,29 @@ npx agentcert connect --server https://agentcert.app --project your-project-id
 npx agentcert push --evidence .agentcert/latest/agentcert-evidence.json
 ```
 
+Bind a release, pull-request, or nightly run to an issued continuous assurance
+case by declaring the exact reviewed scope:
+
+```bash
+npx agentcert run --config agentcert.config.json --push \
+  --assurance-case "$AGENTCERT_ASSURANCE_CASE_ID" \
+  --assurance-scope agentcert.assurance-scope.json \
+  --assurance-trigger auto
+```
+
+Validate the scope before CI uses it:
+
+```bash
+npx agentcert schema validate \
+  --schema assurance-scope \
+  --file agentcert.assurance-scope.json
+```
+
+`auto` treats pull requests as prospective, scheduled workflows as nightly,
+and other GitHub runs as release checks. Authoritative failure or scope drift
+sets the Hosted contract to `REVALIDATION_REQUIRED`; only an independently
+issued successor case establishes a new `CURRENT` baseline.
+
 Add `--push` to `agentcert run` to run locally and upload the resulting bundle
 in one command. By default, both commands also upload local files referenced by
 the bundle. Reads are confined to `--artifact-root` (the current directory by

package/dist/cli.js

@@ -611,6 +611,7 @@ async function pushHostedEvidence(bundle, bytes, fileName) {
         externalId: readFlag("--external-id"),
         companionArtifacts: companions?.artifacts,
         skippedCompanionArtifacts: companions?.skipped,
+        assurance: await readContinuousAssuranceBinding(),
     });
     process.stdout.write(`Hosted run: ${result.runId}\nHosted evidence: ${result.evidenceId}\n`);
     if (companions) {
@@ -623,6 +624,31 @@ async function pushHostedEvidence(bundle, bytes, fileName) {
         }
     }
 }
+async function readContinuousAssuranceBinding() {
+    const caseId = readFlag("--assurance-case");
+    const scopePath = readFlag("--assurance-scope");
+    if (!caseId && !scopePath)
+        return undefined;
+    if (!caseId || !scopePath)
+        throw new Error("--assurance-case and --assurance-scope must be provided together.");
+    const scope = await readJson(scopePath);
+    const validation = validateAgentCertSchema("assurance-scope", scope);
+    if (!validation.valid)
+        throw new Error(`Assurance scope is invalid:\n${validation.errors.map((error) => `- ${error}`).join("\n")}`);
+    return { caseId, trigger: assuranceTriggerFromEnvironment(readFlag("--assurance-trigger") ?? "auto"), scope: scope };
+}
+function assuranceTriggerFromEnvironment(value) {
+    if (value === "pull_request" || value === "release" || value === "nightly")
+        return value;
+    if (value !== "auto")
+        throw new Error("--assurance-trigger must be auto, pull_request, release, or nightly.");
+    const event = process.env.GITHUB_EVENT_NAME;
+    if (event === "pull_request" || event === "pull_request_target")
+        return "pull_request";
+    if (event === "schedule")
+        return "nightly";
+    return "release";
+}
 async function promptValue(label) {
     if (!process.stdin.isTTY || !process.stdout.isTTY) {
         throw new Error(`Missing ${label.trim().replace(/:$/, "").toLowerCase()}. Pass it as a flag or environment variable.`);

package/dist/command-help.js

@@ -34,6 +34,9 @@ Options:
   --project <id>         Hosted project ID
   --api-key <key>        Project API key (prefer AGENTCERT_API_KEY in CI)
   --external-id <id>     Idempotent hosted run ID
+  --assurance-case <id>  Issued assurance case to reconcile
+  --assurance-scope <p>  Declared agent/model/prompt/tools/policy/suite scope JSON
+  --assurance-trigger <t> auto, pull_request, release, or nightly (default: auto)
   --artifact-root <dir>  Allowed root for companion artifacts (default: current directory)
   --no-artifacts         Upload only the evidence bundle
   --help, -h             Show this help

package/dist/control-plane.js

@@ -70,6 +70,7 @@ export async function pushEvidenceToControlPlane(options) {
                 subject: bundle.subject,
                 products: bundle.summary.products,
             },
+            assurance: options.assurance,
         }),
     });
     await requestJson(request, `${projectUrl}/runs/${encodeURIComponent(run.id)}/events`, {

package/dist/schema-validator.js

@@ -13,6 +13,7 @@ export function parseSchemaId(input) {
         value === "release-gate" ||
         value === "assurance-report" ||
         value === "assurance-delivery" ||
+        value === "assurance-scope" ||
         value === "evidence-signature" ||
         value === "evidence-strength" ||
         value === "action-mandate" ||
@@ -20,7 +21,7 @@ export function parseSchemaId(input) {
         value === "trusted-run-receipt") {
         return value;
     }
-    throw new Error(`Unsupported schema "${value}". Use evidence-bundle, result, corpus-record, failure-review, classifier-eval, monitor-snapshot, robustness-lab, release-gate, assurance-report, assurance-delivery, evidence-signature, evidence-strength, action-mandate, trusted-action-record, or trusted-run-receipt.`);
+    throw new Error(`Unsupported schema "${value}". Use evidence-bundle, result, corpus-record, failure-review, classifier-eval, monitor-snapshot, robustness-lab, release-gate, assurance-report, assurance-delivery, assurance-scope, evidence-signature, evidence-strength, action-mandate, trusted-action-record, or trusted-run-receipt.`);
 }
 export function validateAgentCertSchema(schema, input) {
     const errors = [];
@@ -52,6 +53,8 @@ export function validateAgentCertSchema(schema, input) {
             validateAssuranceReport(value, errors);
         if (schema === "assurance-delivery")
             validateAssuranceDelivery(value, errors);
+        if (schema === "assurance-scope")
+            validateAssuranceScope(value, errors);
         if (schema === "evidence-strength")
             validateEvidenceStrength(value, errors);
         if (schema === "action-mandate")
@@ -293,6 +296,7 @@ function validateAssuranceReport(value, errors) {
         errors.push("evaluationPlanSha256 must be a lowercase SHA-256 digest.");
     validateTimestamp(value.issuedAt, "issuedAt", errors);
     validateTimestamp(value.expiresAt, "expiresAt", errors);
+    validateAssuranceContinuity(value.continuousAssurance, errors);
 }
 function validateAssuranceDelivery(value, errors) {
     requiredConst(value, "schemaVersion", "agentcert.assurance_delivery.v0.1", errors);
@@ -320,6 +324,69 @@ function validateAssuranceDelivery(value, errors) {
     const decision = recordValue(value.decision);
     if (decision)
         requiredEnum(decision, "verdict", ["RELEASE", "RELEASE_WITH_CONTROLS", "BLOCK"], errors);
+    validateAssuranceContinuity(value.continuousAssurance, errors);
+}
+function validateAssuranceContinuity(input, errors) {
+    if (input === undefined)
+        return;
+    const value = recordValue(input);
+    if (!value) {
+        errors.push("continuousAssurance must be an object.");
+        return;
+    }
+    requiredConst(value, "schemaVersion", "agentcert.assurance_continuity.v0.1", errors);
+    requiredObject(value, "scope", errors);
+    requiredSha256At(value, "scopeFingerprintSha256", "continuousAssurance.scopeFingerprintSha256", errors);
+    requiredConst(value, "freshnessAtIssuance", "CURRENT", errors);
+    requiredArray(value, "revalidationRequiredWhen", errors);
+    stringArray(value.revalidationRequiredWhen, "continuousAssurance.revalidationRequiredWhen", errors);
+    const scope = recordValue(value.scope);
+    if (scope) {
+        const nested = [];
+        validateAssuranceScope(scope, nested);
+        errors.push(...nested.map((error) => `continuousAssurance.scope.${error}`));
+    }
+}
+function validateAssuranceScope(value, errors) {
+    requiredConst(value, "schemaVersion", "agentcert.assurance_scope.v0.1", errors);
+    for (const key of ["agent", "model", "prompt", "tools", "policy", "scenarioSuite"])
+        requiredObject(value, key, errors);
+    const agent = recordValue(value.agent);
+    const model = recordValue(value.model);
+    const prompt = recordValue(value.prompt);
+    const tools = recordValue(value.tools);
+    const policy = recordValue(value.policy);
+    const suite = recordValue(value.scenarioSuite);
+    if (agent) {
+        requiredStringAt(agent, "id", "agent.id", errors);
+        requiredStringAt(agent, "version", "agent.version", errors);
+        optionalSha256At(agent, "artifactSha256", "agent.artifactSha256", errors);
+    }
+    if (model)
+        for (const key of ["provider", "name", "version"])
+            requiredStringAt(model, key, `model.${key}`, errors);
+    if (prompt)
+        requiredSha256At(prompt, "sha256", "prompt.sha256", errors);
+    if (tools)
+        requiredSha256At(tools, "manifestSha256", "tools.manifestSha256", errors);
+    if (policy) {
+        requiredStringAt(policy, "id", "policy.id", errors);
+        requiredStringAt(policy, "version", "policy.version", errors);
+        optionalSha256At(policy, "sha256", "policy.sha256", errors);
+    }
+    if (suite) {
+        requiredStringAt(suite, "id", "scenarioSuite.id", errors);
+        requiredStringAt(suite, "version", "scenarioSuite.version", errors);
+        requiredSha256At(suite, "sha256", "scenarioSuite.sha256", errors);
+    }
+}
+function requiredSha256At(value, key, path, errors) {
+    if (typeof value[key] !== "string" || !/^[0-9a-f]{64}$/.test(value[key]))
+        errors.push(`${path} must be a lowercase SHA-256 digest.`);
+}
+function optionalSha256At(value, key, path, errors) {
+    if (value[key] !== undefined && (typeof value[key] !== "string" || !/^[0-9a-f]{64}$/.test(value[key])))
+        errors.push(`${path} must be a lowercase SHA-256 digest.`);
 }
 function validateFailureReview(value, errors) {
     requiredConst(value, "schemaVersion", "1", errors);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentcert",
-  "version": "0.5.4",
+  "version": "0.6.0",
   "description": "Assurance release gates, runtime evidence, and regression CI for AI agents.",
   "type": "module",
   "license": "Apache-2.0",