agentskeptic 3.4.0 → 3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentskeptic",
-  "version": "3.4.0",
+  "version": "3.5.0",
   "description": "AgentSkeptic compares agent claims with real downstream state — databases, APIs, object stores, and vector stores — and returns a clear verdict.",
   "license": "MIT",
   "type": "module",
@@ -30,7 +30,7 @@
     "prepublishOnly": "node scripts/build-commercial.mjs",
     "codegen:types": "openapi-typescript schemas/openapi-commercial-v1.yaml -o src/sdk/_generated/openapi-types.ts",
     "codegen:error-codes": "node scripts/generate-agentskeptic-error-codes.mjs",
-    "build": "node scripts/write-commercial-build-flags.mjs --oss && node scripts/sync-failure-origin-from-schema.mjs && tsc && node scripts/copy-cli-init-assets.mjs && node scripts/copy-debug-ui.mjs && node scripts/write-discovery-payload.mjs",
+    "build": "node scripts/write-commercial-build-flags.mjs --oss && node scripts/sync-failure-origin-from-schema.mjs && tsc && node scripts/write-execution-identity.mjs && node scripts/copy-cli-init-assets.mjs && node scripts/copy-debug-ui.mjs && node scripts/write-discovery-payload.mjs",
     "build:commercial": "node scripts/build-commercial.mjs",
     "start": "npm run build && node scripts/demo.mjs",
     "dev": "npm run dev -w agentskeptic-web",
@@ -40,7 +40,8 @@
     "test:postgres": "node scripts/run-postgres-node-test-batch.mjs",
     "test:workflow-truth-contract": "node scripts/run-workflow-truth-contract.mjs",
     "validate-ttfv": "node scripts/validate-ttfv.mjs",
-    "test:python": "node scripts/check-python-no-subprocess.mjs && node scripts/assert-python-langgraph-primacy.mjs && cd python && python -m pip install -e \".[dev]\" -q && python -m pytest tests/ -q",
+    "replay:verification": "docker compose -f compose.verification-replay.yml run --rm verifier",
+    "test:python": "node scripts/run-python-test-suite.mjs",
     "test": "node scripts/verification-truth.mjs",
     "test:debug-ui": "playwright test",
     "test:ci": "node scripts/verification-truth.mjs",

package/schemas/agentskeptic-error-codes.json

@@ -345,6 +345,20 @@
       "retryable": false,
       "remediation": "See docs/migrate-2.md and the AgentSkeptic 2.0 integrator guide (docs/integrate.md)."
     },
+    {
+      "code": "EXECUTION_IDENTITY_MISMATCH",
+      "category": "operational",
+      "httpStatus": null,
+      "retryable": false,
+      "remediation": "See docs/migrate-2.md and the AgentSkeptic 2.0 integrator guide (docs/integrate.md)."
+    },
+    {
+      "code": "EXECUTION_IDENTITY_USAGE",
+      "category": "operational",
+      "httpStatus": null,
+      "retryable": false,
+      "remediation": "See docs/migrate-2.md and the AgentSkeptic 2.0 integrator guide (docs/integrate.md)."
+    },
     {
       "code": "EXECUTION_TRACE_USAGE",
       "category": "operational",
@@ -520,6 +534,20 @@
       "retryable": false,
       "remediation": "See docs/migrate-2.md and the AgentSkeptic 2.0 integrator guide (docs/integrate.md)."
     },
+    {
+      "code": "RECEIPT_PERSIST_FAILED",
+      "category": "operational",
+      "httpStatus": null,
+      "retryable": false,
+      "remediation": "See docs/migrate-2.md and the AgentSkeptic 2.0 integrator guide (docs/integrate.md)."
+    },
+    {
+      "code": "RECEIPT_SCHEMA_INVALID",
+      "category": "operational",
+      "httpStatus": null,
+      "retryable": false,
+      "remediation": "See docs/migrate-2.md and the AgentSkeptic 2.0 integrator guide (docs/integrate.md)."
+    },
     {
       "code": "REGISTRY_DUPLICATE_TOOL_ID",
       "category": "config",

package/schemas/ci/verification-truth.manifest.json

@@ -23,7 +23,36 @@
       "website/src/generated/",
       "src/publicDistribution.generated.ts",
       "src/sdk/_generated/",
-      "src/agentskeptic-error-codes.json"
+      "src/agentskeptic-error-codes.json",
+      "website/content/surfaces/guides/",
+      "website/src/content/embeddedReports/",
+      "python/tests/parity_vectors/"
+    ],
+    "closedDriftPaths": [
+      "AGENTS.md",
+      "README.md",
+      "llms.txt",
+      "package.json",
+      "python/tests/parity_vectors/langgraph_lct_a2/golden_certificate.json",
+      "python/tests/parity_vectors/langgraph_lct_b/golden_certificate.json",
+      "python/tests/parity_vectors/langgraph_lct_c/golden_certificate.json",
+      "python/tests/parity_vectors/langgraph_lct_d/golden_certificate.json",
+      "schemas/openapi-commercial-v1.yaml",
+      "src/publicDistribution.generated.ts",
+      "src/sdk/_generated/openapi-types.ts",
+      "website/content/surfaces/guides/buyer-ci-enforcement-metering.md",
+      "website/content/surfaces/guides/buyer-commercial-boundary.md",
+      "website/content/surfaces/guides/buyer-trust-production-implications.md",
+      "website/public/contract/v1.json",
+      "website/src/content/embeddedReports/langgraph-lct-a2-ineligible.v1.json",
+      "website/src/content/embeddedReports/langgraph-lct-b-verified.v1.json",
+      "website/src/content/embeddedReports/langgraph-lct-c-mismatch.v1.json",
+      "website/src/content/embeddedReports/langgraph-lct-d-incomplete.v1.json",
+      "website/src/generated/buyerTruthCodegenHash.ts",
+      "website/src/generated/buyerTruthProjection.snap.json",
+      "website/src/generated/epistemicContractIntegrator.ts",
+      "website/src/generated/integrateActivationShellStatic.ts",
+      "website/src/generated/integratorDocsEmbedded.ts"
     ]
   }
 }

package/schemas/ci/verification-truth.manifest.schema.json

@@ -34,12 +34,17 @@
     "gating": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["gitPathspecs"],
+      "required": ["gitPathspecs", "closedDriftPaths"],
       "properties": {
         "gitPathspecs": {
           "type": "array",
           "minItems": 1,
           "items": { "type": "string", "minLength": 1 }
+        },
+        "closedDriftPaths": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "type": "string", "minLength": 1 }
         }
       }
     }

package/schemas/execution-identity-v1.schema.json

@@ -0,0 +1,36 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agentskeptic.com/schemas/execution-identity-v1.schema.json",
+  "title": "AgentSkeptic execution identity (packaged build)",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "$schema",
+    "identityVersion",
+    "npmPackageVersion",
+    "nodeEnginesDeclared",
+    "verificationContractManifest",
+    "pythonPipExtrasFragment",
+    "closedDriftPathCount",
+    "mergeGateFingerprintSha256"
+  ],
+  "properties": {
+    "$schema": { "type": "string" },
+    "identityVersion": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" },
+    "npmPackageVersion": { "type": "string", "minLength": 1 },
+    "nodeEnginesDeclared": { "type": "string" },
+    "verificationContractManifest": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["version", "manifestSha256", "url"],
+      "properties": {
+        "version": { "type": "string" },
+        "manifestSha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+        "url": { "type": "string", "format": "uri" }
+      }
+    },
+    "pythonPipExtrasFragment": { "type": "string", "minLength": 1 },
+    "closedDriftPathCount": { "type": "integer", "minimum": 0 },
+    "mergeGateFingerprintSha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" }
+  }
+}

package/schemas/openapi-commercial-v1.yaml

@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 info:
   title: AgentSkeptic commercial license API
-  version: "3.4.0"
+  version: "3.5.0"
   contact:
     url: https://agentskeptic.com
   x-agentskeptic-distribution:

package/schemas/verification-receipt-v1.schema.json

@@ -0,0 +1,108 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agentskeptic.com/schemas/verification-receipt-v1.schema.json",
+  "title": "AgentSkeptic verification receipt v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "$schema",
+    "receiptVersion",
+    "kind",
+    "outcome",
+    "exitCode",
+    "emittedAt",
+    "pid",
+    "receiptPathRelative",
+    "runtime",
+    "verificationSummary",
+    "inputIntegrity",
+    "executionIdentityEmbedded",
+    "executionIdentitySha256",
+    "abortReason",
+    "phaseTimingsMs"
+  ],
+  "properties": {
+    "$schema": { "type": "string" },
+    "receiptVersion": { "type": "string", "const": "1.0.0" },
+    "kind": { "type": "string", "enum": ["merge_gate", "verify", "enforce"] },
+    "outcome": { "type": "string", "enum": ["success", "failure", "operational_abort"] },
+    "exitCode": { "type": "integer" },
+    "emittedAt": { "type": "string" },
+    "pid": { "type": "integer", "minimum": 1 },
+    "receiptPathRelative": { "type": "string", "minLength": 1 },
+    "runtime": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["nodeProcessVersion", "platform", "arch"],
+      "properties": {
+        "nodeProcessVersion": { "type": "string" },
+        "platform": { "type": "string" },
+        "arch": { "type": "string" }
+      }
+    },
+    "verificationSummary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["workflowStatus", "operationalCode", "enforceExitKind"],
+      "properties": {
+        "workflowStatus": { "type": ["string", "null"] },
+        "operationalCode": { "type": ["string", "null"] },
+        "enforceExitKind": { "type": ["string", "null"] }
+      }
+    },
+    "inputIntegrity": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "workflowId",
+        "dbKind",
+        "eventsSha256",
+        "registrySha256",
+        "npmTestScript",
+        "verificationTruthExitPhase"
+      ],
+      "properties": {
+        "workflowId": { "type": "string" },
+        "dbKind": { "type": "string", "enum": ["sqlite", "postgres", "none"] },
+        "eventsSha256": { "type": ["string", "null"] },
+        "registrySha256": { "type": ["string", "null"] },
+        "npmTestScript": { "type": ["string", "null"] },
+        "verificationTruthExitPhase": { "type": ["string", "null"] }
+      }
+    },
+    "executionIdentityEmbedded": {
+      "anyOf": [{ "type": "object" }, { "type": "null" }]
+    },
+    "executionIdentitySha256": {
+      "anyOf": [{ "type": "string", "pattern": "^[0-9a-f]{64}$" }, { "type": "null" }]
+    },
+    "abortReason": {
+      "anyOf": [{ "type": "string", "const": "MISSING_DIST_EXECUTION_IDENTITY" }, { "type": "null" }]
+    },
+    "phaseTimingsMs": {
+      "anyOf": [
+        { "type": "null" },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "regeneration",
+            "preflightDriftRoster",
+            "gitDiffGate",
+            "structuralGuards",
+            "postgresDistribution",
+            "journeyTail"
+          ],
+          "properties": {
+            "regeneration": { "type": "integer", "minimum": 0 },
+            "preflightDriftRoster": { "type": "integer", "minimum": 0 },
+            "gitDiffGate": { "type": "integer", "minimum": 0 },
+            "structuralGuards": { "type": "integer", "minimum": 0 },
+            "postgresDistribution": { "type": "integer", "minimum": 0 },
+            "journeyTail": { "type": "integer", "minimum": 0 }
+          }
+        }
+      ]
+    }
+  }
+}

package/scripts/emit-primary-marketing.cjs

@@ -177,7 +177,7 @@ Normative **public distribution** and anchor sync: [\`docs/public-distribution.m
 - Verification Contract Manifest (canonical): ${contractPin.url}
 - Verification Contract Manifest (repo raw): ${contractRaw}
 - Acquisition page (canonical): ${acquisitionUrl}
-- CI regeneration + drift pathspecs: [\`schemas/ci/verification-truth.manifest.json\`](schemas/ci/verification-truth.manifest.json) (validated by [\`test/verification-truth.manifest.completeness.test.mjs\`](test/verification-truth.manifest.completeness.test.mjs))
+- CI regeneration + drift pathspecs: [\`schemas/ci/verification-truth.manifest.json\`](schemas/ci/verification-truth.manifest.json) (validated by [\`test/verification-truth.closed-drift.contract.test.mjs\`](test/verification-truth.closed-drift.contract.test.mjs))
 `;
   writeFileSync(join(ROOT, "AGENTS.md"), body, "utf8");
 }