agentic-engineering-harness 0.8.3 → 0.8.4

package/dist/certification/bootstrap.js

@@ -0,0 +1,138 @@
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { executeArgv } from "./provider.js";
+import { CertificationCore } from "./core.js";
+import { defaultCertificationPolicy } from "./policy.js";
+import { createCertificationOracleResult } from "./oracle.js";
+import { writeCertificationReport } from "./artifacts.js";
+/** Deterministic black-box oracle for a fixture command; model output is never consulted. */
+export function createCommandOracle(options) {
+    let protectedRoot;
+    const protectedArgs = new Map();
+    return {
+        id: `command:${options.command}`,
+        independent: true,
+        async prepare({ candidate }) {
+            protectedRoot = await fs.mkdtemp(path.join(os.tmpdir(), "aeh-cert-oracle-"));
+            for (const arg of options.args ?? []) {
+                if (!arg || path.isAbsolute(arg) || arg.startsWith("-"))
+                    continue;
+                const source = path.resolve(candidate.root, arg);
+                try {
+                    const stat = await fs.stat(source);
+                    if (!stat.isFile())
+                        continue;
+                    const destination = path.join(protectedRoot, `${protectedArgs.size}-${path.basename(arg)}`);
+                    await fs.copyFile(source, destination);
+                    protectedArgs.set(arg, destination);
+                }
+                catch { /* non-file argv values remain unchanged */ }
+            }
+        },
+        async dispose() {
+            if (protectedRoot)
+                await fs.rm(protectedRoot, { recursive: true, force: true });
+            protectedRoot = undefined;
+            protectedArgs.clear();
+        },
+        async evaluate({ candidate, actor }) {
+            const args = (options.args ?? []).map((arg) => protectedArgs.get(arg) ?? arg);
+            const result = await executeArgv(options.command, args, { cwd: candidate.root, timeoutMs: options.timeoutMs ?? 300_000, maxOutputBytes: options.maxOutputBytes ?? 8 * 1024 * 1024, allowNetwork: false });
+            const commandPassed = result.status === "COMPLETED" && result.exitCode === 0;
+            let modelEvidence = false;
+            try {
+                const parsed = JSON.parse(result.stdout.trim().split(/\r?\n/).filter(Boolean).at(-1) ?? "null");
+                modelEvidence = parsed.modelExecuted === true;
+            }
+            catch { /* structured model evidence is optional for deterministic lanes */ }
+            const candidateIntentExecuted = Boolean(actor?.events.some((event) => event.type === "json" && event.data && typeof event.data === "object" && event.data.type === "item.completed" && event.data.item && typeof event.data.item === "object" && String(event.data.item.command ?? "").includes("node_modules/agentic-engineering-harness/dist/main.js intent") && event.data.item.exit_code === 0 && /INFORMATIONAL/.test(String(event.data.item.aggregated_output ?? ""))));
+            modelEvidence = modelEvidence && candidateIntentExecuted;
+            const checks = [{ id: "fixture.command", status: commandPassed ? "PASS" : "FAIL", required: true, message: commandPassed ? "Fixture command passed." : `Fixture command failed (${result.status}, exit ${result.exitCode}).`, evidence: { exitCode: result.exitCode, status: result.status, stdout: result.stdout.slice(-4_000), stderr: result.stderr.slice(-4_000) } }];
+            if (options.requireModelEvidence)
+                checks.push({ id: "model.evidence", status: commandPassed && modelEvidence ? "PASS" : "FAIL", required: true, message: commandPassed && modelEvidence ? "Fixture verified model-produced journey evidence and successful candidate intent execution." : "Fixture did not verify model-produced journey evidence and successful candidate intent execution.", evidence: { modelExecuted: modelEvidence, candidateIntentExecuted } });
+            return createCertificationOracleResult({ oracleId: `command:${options.command}`, checks, evidence: { command: options.command, args: options.args ?? [], durationMs: result.durationMs, modelEvidenceRequired: Boolean(options.requireModelEvidence) } });
+        }
+    };
+}
+/** Pack the checkout and run it only inside a disposable fixture. */
+export async function runExternalSelfDogfood(input) {
+    const root = await fs.realpath(path.resolve(input.root));
+    const fixtureSource = await fs.realpath(path.resolve(input.fixture.sourceDir));
+    await assertNoSymlinks(fixtureSource);
+    const staging = await fs.mkdtemp(path.join(os.tmpdir(), "aeh-cert-pack-"));
+    const fixtureRoot = await fs.mkdtemp(path.join(os.tmpdir(), "aeh-cert-fixture-"));
+    try {
+        const pack = await executeArgv("npm", ["pack", "--json", "--ignore-scripts", "--pack-destination", staging], { cwd: root, timeoutMs: 120_000, maxOutputBytes: 2 * 1024 * 1024, allowNetwork: false });
+        if (pack.status !== "COMPLETED" || pack.exitCode !== 0)
+            throw new Error(`Candidate packaging failed: ${pack.stderr || pack.stdout}`);
+        const artifactName = parsePackFilename(pack.stdout);
+        const artifactPath = path.resolve(staging, artifactName);
+        await fs.stat(artifactPath);
+        await fs.cp(fixtureSource, fixtureRoot, { recursive: true, force: true, dereference: false, verbatimSymlinks: true });
+        for (const setup of input.fixture.setup ?? []) {
+            const result = await executeArgv(setup.command, setup.args, { cwd: fixtureRoot, timeoutMs: setup.timeoutMs ?? 120_000, maxOutputBytes: 2 * 1024 * 1024, allowNetwork: false });
+            if (result.status !== "COMPLETED" || result.exitCode !== 0)
+                throw new Error(`Fixture setup failed: ${result.stderr || result.stdout}`);
+        }
+        const install = await executeArgv("npm", ["install", "--ignore-scripts", "--no-save", "--prefix", fixtureRoot, artifactPath], { cwd: fixtureRoot, timeoutMs: 300_000, maxOutputBytes: 8 * 1024 * 1024, allowNetwork: false });
+        if (install.status !== "COMPLETED" || install.exitCode !== 0)
+            throw new Error(`Fixture installation failed: ${install.stderr || install.stdout}`);
+        const candidateArtifact = path.join(fixtureRoot, ".aeh-candidate.tgz");
+        await fs.copyFile(artifactPath, candidateArtifact);
+        const candidate = { version: 1, id: path.basename(artifactName, ".tgz"), root: fixtureRoot, artifactPath: candidateArtifact, baseRef: "packed-checkout", sourceDigest: await sha256File(candidateArtifact), metadata: { artifactDigest: await sha256File(candidateArtifact), packaging: "npm-pack-ignore-scripts", ...(await sourceIdentity(root)) } };
+        const report = await new CertificationCore(input.oracle, input.provider).certify({ candidate, policy: input.policy ?? defaultCertificationPolicy(), actor: input.actor?.(fixtureRoot), capability: input.capability, requireModelE2E: input.requireModelE2E, requireModelEvidence: input.requireModelE2E });
+        if (input.persistRoot) {
+            const directory = input.persistDirectory ?? ".aeh-test-results/certification";
+            const relative = path.relative(path.resolve(input.persistRoot), path.resolve(input.persistRoot, directory)).replaceAll("\\", "/");
+            const predicted = path.join(relative, `${report.certificationId}.json`).replaceAll("\\", "/");
+            const durableReport = { ...report, persistedReport: predicted };
+            await writeCertificationReport(input.persistRoot, durableReport, directory);
+            return durableReport;
+        }
+        return report;
+    }
+    finally {
+        await input.oracle.dispose?.();
+        await fs.rm(staging, { recursive: true, force: true });
+        await fs.rm(fixtureRoot, { recursive: true, force: true });
+    }
+}
+async function sha256File(file) {
+    return crypto.createHash("sha256").update(await fs.readFile(file)).digest("hex");
+}
+async function sourceIdentity(root) {
+    const commit = await executeArgv("git", ["rev-parse", "HEAD"], { cwd: root, timeoutMs: 10_000, maxOutputBytes: 4_096, allowNetwork: false });
+    const branch = await executeArgv("git", ["branch", "--show-current"], { cwd: root, timeoutMs: 10_000, maxOutputBytes: 4_096, allowNetwork: false });
+    return {
+        ...(commit.status === "COMPLETED" && commit.exitCode === 0 ? { sourceCommit: commit.stdout.trim() } : {}),
+        ...(branch.status === "COMPLETED" && branch.exitCode === 0 ? { sourceBranch: branch.stdout.trim() } : {})
+    };
+}
+function parsePackFilename(stdout) {
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout);
+    }
+    catch {
+        throw new Error("npm pack did not return JSON.");
+    }
+    const record = Array.isArray(parsed) ? parsed[0] : parsed && typeof parsed === "object" && Object.values(parsed)[0];
+    const filename = record && typeof record === "object" && typeof record.filename === "string" ? record.filename : undefined;
+    if (!filename || path.basename(filename) !== filename || !filename.endsWith(".tgz"))
+        throw new Error("npm pack returned an unsafe artifact filename.");
+    return filename;
+}
+async function assertNoSymlinks(root) {
+    const entries = await fs.readdir(root, { withFileTypes: true });
+    for (const entry of entries) {
+        const full = path.join(root, entry.name);
+        const stat = await fs.lstat(full);
+        if (stat.isSymbolicLink())
+            throw new Error(`Fixture contains a symlink and cannot be isolated: ${full}`);
+        if (stat.isDirectory())
+            await assertNoSymlinks(full);
+    }
+}
+//# sourceMappingURL=bootstrap.js.map

package/dist/certification/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/certification/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AA6B1D,6FAA6F;AAC7F,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,IAAI,aAAiC,CAAC;IACtC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,OAAO;QACL,EAAE,EAAE,WAAW,OAAO,CAAC,OAAO,EAAE;QAChC,WAAW,EAAE,IAAI;QACjB,KAAK,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE;YACzB,aAAa,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;YAC7E,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;gBACrC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAClE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACjD,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACnC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;wBAAE,SAAS;oBAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,aAAa,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC5F,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;oBACvC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;gBACtC,CAAC;gBAAC,MAAM,CAAC,CAAC,2CAA2C,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,OAAO;YACX,IAAI,aAAa;gBAAE,MAAM,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChF,aAAa,GAAG,SAAS,CAAC;YAC1B,aAAa,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE;YACjC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1M,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;YAC7E,IAAI,aAAa,GAAG,KAAK,CAAC;YAC1B,IAAI,CAAC;gBAAC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAA4B,CAAC;gBAAC,aAAa,GAAG,MAAM,CAAC,aAAa,KAAK,IAAI,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,mEAAmE,CAAC,CAAC;YAChQ,MAAM,uBAAuB,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAK,KAAK,CAAC,IAAgC,CAAC,IAAI,KAAK,gBAAgB,IAAK,KAAK,CAAC,IAAgC,CAAC,IAAI,IAAI,OAAQ,KAAK,CAAC,IAAgC,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAG,KAAK,CAAC,IAAgC,CAAC,IAAgC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,8DAA8D,CAAC,IAAM,KAAK,CAAC,IAAgC,CAAC,IAAgC,CAAC,SAAS,KAAK,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAG,KAAK,CAAC,IAAgC,CAAC,IAAgC,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACntB,aAAa,GAAG,aAAa,IAAI,uBAAuB,CAAC;YACzD,MAAM,MAAM,GAAyB,CAAC,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,2BAA2B,MAAM,CAAC,MAAM,UAAU,MAAM,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YAChY,IAAI,OAAO,CAAC,oBAAoB;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,aAAa,IAAI,aAAa,CAAC,CAAC,CAAC,MAAe,CAAC,CAAC,CAAC,MAAe,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,IAAI,aAAa,CAAC,CAAC,CAAC,6FAA6F,CAAC,CAAC,CAAC,mGAAmG,EAAE,QAAQ,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;YACxd,OAAO,+BAA+B,CAAC,EAAE,QAAQ,EAAE,WAAW,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,qBAAqB,EAAE,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5P,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAiC;IAC5E,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/E,MAAM,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAClF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QACtM,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACrI,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACzD,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5B,MAAM,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtH,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/K,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACzI,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9N,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAClJ,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;QACvE,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QACnD,MAAM,SAAS,GAAsB,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,yBAAyB,EAAE,GAAG,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;QAC1W,MAAM,MAAM,GAAG,MAAM,IAAI,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,0BAA0B,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,oBAAoB,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QAC5S,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,KAAK,CAAC,gBAAgB,IAAI,iCAAiC,CAAC;YAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAClI,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,eAAe,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC9F,MAAM,aAAa,GAAG,EAAE,GAAG,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;YAChE,MAAM,wBAAwB,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;YAC5E,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/B,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnF,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7I,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACpJ,OAAO;QACL,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1G,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAAC,CAAC;IAChG,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAiC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/I,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAQ,MAAiC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAE,MAA+B,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACjL,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACvJ,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAY;IAC1C,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,IAAI,EAAE,CAAC,CAAC;QACzG,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;AACH,CAAC"}

package/dist/certification/codex.d.ts

@@ -0,0 +1,26 @@
+import type { AgentProviderRequest, AgentProviderResult } from "./types.js";
+import { LocalAgentProvider } from "./provider.js";
+export interface CodexProviderOptions {
+    command?: string;
+    model?: string;
+    reasoningEffort?: "low" | "medium" | "high" | "xhigh";
+    extraArgs?: string[];
+}
+export interface CodexCapabilities {
+    version?: string;
+    supportsReasoningFlag: boolean;
+    supportsConfigOverride: boolean;
+    supportsJson: boolean;
+    supportsEphemeral: boolean;
+    supportsSkipGitRepoCheck: boolean;
+    source: string;
+}
+/** Bootstrap adapter only. CertificationCore knows nothing about this provider. */
+export declare class CodexAgentProvider extends LocalAgentProvider {
+    readonly name = "codex";
+    private readonly options;
+    constructor(options?: CodexProviderOptions);
+    execute(request: AgentProviderRequest): Promise<AgentProviderResult>;
+}
+export declare function codexCommandPreview(options: CodexProviderOptions | undefined, request: Pick<AgentProviderRequest, "args" | "prompt">): string[];
+export declare function resolveCodexCapabilities(command?: string, cwd?: string): Promise<CodexCapabilities>;

package/dist/certification/codex.js

@@ -0,0 +1,125 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { LocalAgentProvider } from "./provider.js";
+import { executeArgv } from "./provider.js";
+/** Bootstrap adapter only. CertificationCore knows nothing about this provider. */
+export class CodexAgentProvider extends LocalAgentProvider {
+    name = "codex";
+    options;
+    constructor(options = {}) {
+        super();
+        this.options = { command: options.command ?? "codex", model: options.model ?? "gpt-5.6-luna", reasoningEffort: options.reasoningEffort ?? "high", extraArgs: options.extraArgs ?? [] };
+    }
+    async execute(request) {
+        const capabilities = await resolveCodexCapabilities(this.options.command, request.cwd);
+        if (!capabilities.supportsJson)
+            throw new Error("Codex CLI does not support structured JSONL output required by certification.");
+        if (!capabilities.supportsEphemeral || !capabilities.supportsSkipGitRepoCheck)
+            throw new Error("Codex CLI lacks the isolation/bootstrap flags required by the certification adapter.");
+        const controlled = await createControlledCodexHome(request.cwd, this.options.model, this.options.reasoningEffort);
+        try {
+            const args = ["exec", "--json", "--ephemeral", "--skip-git-repo-check", "--sandbox", "workspace-write", "--model", this.options.model];
+            let effectiveReasoning;
+            if (capabilities.supportsReasoningFlag) {
+                args.push("--reasoning-effort", this.options.reasoningEffort);
+                effectiveReasoning = this.options.reasoningEffort;
+            }
+            else if (capabilities.supportsConfigOverride) {
+                args.push("-c", `model_reasoning_effort=${JSON.stringify(this.options.reasoningEffort)}`);
+                effectiveReasoning = this.options.reasoningEffort;
+            }
+            else {
+                throw new Error(`Codex CLI cannot honor requested reasoning effort '${this.options.reasoningEffort}'.`);
+            }
+            args.push(...(this.options.extraArgs ?? []), ...request.args, request.prompt);
+            const result = await super.execute({
+                ...request,
+                command: this.options.command,
+                args,
+                environment: { ...(request.environment ?? {}), HOME: controlled.home, CODEX_HOME: controlled.codexHome },
+                environmentAllowlist: [...new Set([...(request.environmentAllowlist ?? []), "HOME", "CODEX_HOME"])]
+            });
+            const sessionId = findSessionId(result.structuredOutput);
+            return {
+                ...result,
+                executionEvidence: {
+                    started: true,
+                    provider: this.name,
+                    command: this.options.command,
+                    requestedModel: this.options.model,
+                    effectiveModel: this.options.model,
+                    requestedReasoningEffort: this.options.reasoningEffort,
+                    effectiveReasoningEffort: effectiveReasoning,
+                    capabilitySource: capabilities.source,
+                    sessionId,
+                    processExitCode: result.exitCode,
+                    startedAt: result.events.find((event) => event.type === "started")?.at ?? new Date().toISOString(),
+                    finishedAt: new Date().toISOString()
+                }
+            };
+        }
+        finally {
+            await fs.rm(controlled.home, { recursive: true, force: true });
+        }
+    }
+}
+export function codexCommandPreview(options = {}, request) {
+    return ["exec", "--json", "--ephemeral", "--skip-git-repo-check", "--sandbox", "workspace-write", "--model", options.model ?? "gpt-5.6-luna", "-c", `model_reasoning_effort=${JSON.stringify(options.reasoningEffort ?? "high")}`, ...(options.extraArgs ?? []), ...request.args, request.prompt];
+}
+let capabilityCache;
+export async function resolveCodexCapabilities(command = "codex", cwd = process.cwd()) {
+    capabilityCache ??= (async () => {
+        const result = await executeArgv(command, ["exec", "--help"], { cwd, timeoutMs: 30_000, maxOutputBytes: 512 * 1024, allowNetwork: false });
+        if (result.status !== "COMPLETED" || result.exitCode !== 0)
+            throw new Error(`Unable to inspect Codex CLI capabilities: ${result.stderr || result.stdout}`);
+        const help = `${result.stdout}\n${result.stderr}`;
+        return {
+            supportsReasoningFlag: /(?:^|\s)--reasoning-effort(?:\s|$)/m.test(help),
+            supportsConfigOverride: /(?:^|\s)-c, --config\s+<key=value>/m.test(help) || /--config\s+<key=value>/m.test(help),
+            supportsJson: /--json(?:\s|$)/m.test(help),
+            supportsEphemeral: /--ephemeral(?:\s|$)/m.test(help),
+            supportsSkipGitRepoCheck: /--skip-git-repo-check/.test(help),
+            source: "codex exec --help"
+        };
+    })();
+    return capabilityCache;
+}
+async function createControlledCodexHome(cwd, model, reasoningEffort) {
+    const home = await fs.mkdtemp(path.join(os.tmpdir(), "aeh-cert-codex-home-"));
+    const codexHome = path.join(home, ".codex");
+    await fs.mkdir(codexHome, { recursive: true, mode: 0o700 });
+    const hostCodexHome = process.env.CODEX_HOME?.trim() || path.join(os.homedir(), ".codex");
+    const auth = path.join(hostCodexHome, "auth.json");
+    try {
+        await fs.copyFile(auth, path.join(codexHome, "auth.json"));
+        await fs.chmod(path.join(codexHome, "auth.json"), 0o600);
+    }
+    catch { /* provider will report unauthenticated startup */ }
+    await fs.writeFile(path.join(codexHome, "config.toml"), `model = ${JSON.stringify(model)}\nmodel_reasoning_effort = ${JSON.stringify(reasoningEffort)}\n`, { mode: 0o600 });
+    await fs.writeFile(path.join(home, ".codex-home-marker"), `cwd=${cwd}\n`, { mode: 0o600 });
+    return { home, codexHome };
+}
+function findSessionId(value) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            const found = findSessionId(item);
+            if (found)
+                return found;
+        }
+        return undefined;
+    }
+    const record = value;
+    for (const key of ["thread_id", "threadId", "session_id", "sessionId"])
+        if (typeof record[key] === "string")
+            return record[key];
+    for (const item of Object.values(record)) {
+        const found = findSessionId(item);
+        if (found)
+            return found;
+    }
+    return undefined;
+}
+//# sourceMappingURL=codex.js.map

package/dist/certification/codex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../src/certification/codex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAmB5C,mFAAmF;AACnF,MAAM,OAAO,kBAAmB,SAAQ,kBAAkB;IAC/C,IAAI,GAAG,OAAO,CAAC;IACP,OAAO,CAA0H;IAElJ,YAAY,UAAgC,EAAE;QAC5C,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,OAAO,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,cAAc,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;IACzL,CAAC;IAEQ,KAAK,CAAC,OAAO,CAAC,OAA6B;QAClD,MAAM,YAAY,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACvF,IAAI,CAAC,YAAY,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACjI,IAAI,CAAC,YAAY,CAAC,iBAAiB,IAAI,CAAC,YAAY,CAAC,wBAAwB;YAAE,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;QACvL,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAClH,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,uBAAuB,EAAE,WAAW,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACvI,IAAI,kBAAsC,CAAC;YAC3C,IAAI,YAAY,CAAC,qBAAqB,EAAE,CAAC;gBACvC,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBAC9D,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;YACpD,CAAC;iBAAM,IAAI,YAAY,CAAC,sBAAsB,EAAE,CAAC;gBAC/C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,0BAA0B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;gBAC1F,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,sDAAsD,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC;YAC1G,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC;gBACjC,GAAG,OAAO;gBACV,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;gBAC7B,IAAI;gBACJ,WAAW,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,SAAS,EAAE;gBACxG,oBAAoB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;aACpG,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACzD,OAAO;gBACL,GAAG,MAAM;gBACT,iBAAiB,EAAE;oBACjB,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;oBAC7B,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;oBAClC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;oBAClC,wBAAwB,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe;oBACtD,wBAAwB,EAAE,kBAAkB;oBAC5C,gBAAgB,EAAE,YAAY,CAAC,MAAM;oBACrC,SAAS;oBACT,eAAe,EAAE,MAAM,CAAC,QAAQ;oBAChC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBAClG,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACrC;aACF,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB,CAAC,UAAgC,EAAE,EAAE,OAAsD;IAC5H,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,uBAAuB,EAAE,WAAW,EAAE,iBAAiB,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,IAAI,cAAc,EAAE,IAAI,EAAE,0BAA0B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,IAAI,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AACpS,CAAC;AAED,IAAI,eAAuD,CAAC;AAE5D,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAO,GAAG,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IACnF,eAAe,KAAK,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,GAAG,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3I,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3J,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAClD,OAAO;YACL,qBAAqB,EAAE,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC;YACvE,sBAAsB,EAAE,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;YAChH,YAAY,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1C,iBAAiB,EAAE,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;YACpD,wBAAwB,EAAE,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5D,MAAM,EAAE,mBAAmB;SAC5B,CAAC;IACJ,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,GAAW,EAAE,KAAa,EAAE,eAAuB;IAC1F,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACnD,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kDAAkD,CAAC,CAAC;IAC1L,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5K,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,EAAE,OAAO,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAAC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAAC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;IACzI,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,CAAC;QAAE,IAAI,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,GAAG,CAAW,CAAC;IAC1I,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAAC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAAC,CAAC;IACzG,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/certification/core.d.ts

@@ -0,0 +1,15 @@
+import type { AgentProviderRequest, AgentProviderResult, CandidateRevision, CertificationOracle, CertificationPolicy, CertificationReport, CertificationRequest } from "./types.js";
+export interface AgentProvider {
+    readonly name: string;
+    /** The provider must explicitly prove OS-level network isolation before denied-network requests run. */
+    readonly networkIsolation: "enforced" | "unavailable";
+    execute(request: AgentProviderRequest): Promise<AgentProviderResult>;
+}
+export declare class CertificationCore {
+    private readonly oracle;
+    private readonly provider?;
+    constructor(oracle: CertificationOracle, provider?: AgentProvider | undefined);
+    certify(input: CertificationRequest): Promise<CertificationReport>;
+}
+export declare function assertCertificationEntryAllowed(policy: Pick<CertificationPolicy, "security">): void;
+export declare function assertProviderRequest(request: AgentProviderRequest, candidate: CandidateRevision, policy: CertificationPolicy): void;