agentskeptic 3.4.0 → 3.6.0

package/schemas/openapi-commercial-v1.in.yaml

@@ -117,7 +117,7 @@ paths:
   /api/v1/enforcement/baselines:
     post:
       operationId: createEnforcementBaseline
-      summary: Create or replace accepted enforcement baseline for a workflow
+      summary: Establish accepted enforcement baseline (baseline_missing → baseline_active only)
       security:
         - bearerAuth: []
       requestBody:
@@ -128,11 +128,17 @@ paths:
               $ref: "#/components/schemas/EnforcementEvidenceRequestV2"
       responses:
         "200":
-          description: Baseline created or replaced
+          description: Lifecycle transition completed
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/EnforcementStateResponse"
+                $ref: "#/components/schemas/EnforcementFsmEnvelopeV2"
+        "409":
+          description: Invalid transition or decision-grade certificate required
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/EnforcementFsmEnvelopeV2"
         "400":
           description: Invalid request
           content:
@@ -148,7 +154,7 @@ paths:
   /api/v1/enforcement/check:
     post:
       operationId: checkEnforcementDrift
-      summary: Compare current run projection against accepted baseline
+      summary: Compare current material-truth projection against accepted baseline (verification attempt)
       security:
         - bearerAuth: []
       requestBody:
@@ -159,21 +165,21 @@ paths:
               $ref: "#/components/schemas/EnforcementEvidenceRequestV2"
       responses:
         "200":
-          description: Comparison result (ok or drift)
+          description: Check completed (match, open drift, rerun pass/fail, etc.)
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/EnforcementCheckResponse"
+                $ref: "#/components/schemas/EnforcementFsmEnvelopeV2"
         "409":
-          description: Baseline not initialized
+          description: Baseline missing, remediation acknowledgement required, or other enforce guard
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/ProblemDetails"
+                $ref: "#/components/schemas/EnforcementFsmEnvelopeV2"
   /api/v1/enforcement/accept:
     post:
       operationId: acceptEnforcementDrift
-      summary: Accept current projection as new baseline
+      summary: Procedural drift accept (action_required → rerun_required; not a verification verdict)
       security:
         - bearerAuth: []
       requestBody:
@@ -181,14 +187,20 @@ paths:
         content:
           application/json:
             schema:
-              $ref: "#/components/schemas/EnforcementEvidenceRequestV2"
+              $ref: "#/components/schemas/EnforcementAcceptEvidenceRequestV2"
       responses:
         "200":
-          description: Drift accepted
+          description: Baseline updated; rerun POST /check required before returning to trusted-only posture
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/EnforcementStateResponse"
+                $ref: "#/components/schemas/EnforcementFsmEnvelopeV2"
+        "409":
+          description: Stale lifecycle version, hash pin mismatch, or invalid transition
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/EnforcementFsmEnvelopeV2"
   /api/v1/enforcement/history:
     get:
       operationId: getEnforcementHistory
@@ -241,7 +253,7 @@ paths:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/GovernanceAuditBundleV1"
+                $ref: "#/components/schemas/GovernanceAuditBundleV2"
         "400":
           description: Invalid request
           content:
@@ -562,27 +574,31 @@ components:
           type: string
         certificate_sha256:
           type: string
-    EnforcementStateResponse:
+    EnforcementFsmEnvelopeV2:
       type: object
-      required: [schema_version, status, workflow_id]
+      description: Hosted enforcement lifecycle + verification attempt payload (schema_version 2).
+      required: [schema_version, code]
       properties:
         schema_version:
           type: integer
-          const: 1
-        status:
-          type: string
-        workflow_id:
+          const: 2
+        code:
           type: string
-    EnforcementCheckResponse:
+        quota_enforced_via_reserve:
+          type: boolean
+      additionalProperties: true
+    EnforcementAcceptEvidenceRequestV2:
       allOf:
-        - $ref: "#/components/schemas/EnforcementStateResponse"
+        - $ref: "#/components/schemas/EnforcementEvidenceRequestV2"
         - type: object
-          required: [expected_projection_hash, actual_projection_hash]
+          required: [expected_projection_hash, lifecycle_state_version]
           properties:
             expected_projection_hash:
               type: string
-            actual_projection_hash:
-              type: string
+              description: Must equal expected_projection_hash_for_accept from the open drift POST /check response.
+            lifecycle_state_version:
+              type: integer
+              description: Optimistic concurrency token; must match lifecycle_state_version from the prior response.
     EnforcementHistoryResponse:
       type: object
       required: [schema_version, workflow_id, events]
@@ -630,6 +646,58 @@ components:
           items:
             type: object
             additionalProperties: true
+    GovernanceAuditBundleV2:
+      type: object
+      description: Governance export including authoritative lifecycle FSM rows and verification decisions.
+      required: [schemaVersion, generatedAt, userId, workflowId, baseline, events]
+      properties:
+        schemaVersion:
+          type: integer
+          const: 2
+        generatedAt:
+          type: string
+          format: date-time
+        userId:
+          type: string
+        workflowId:
+          type: string
+        window:
+          type: object
+          required: [from, to]
+          properties:
+            from:
+              type: string
+              format: date-time
+            to:
+              type: string
+              format: date-time
+        lifecycle:
+          type: object
+          nullable: true
+          additionalProperties: true
+        fsmTransitions:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
+        verificationDecisions:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
+        baseline:
+          type: object
+          nullable: true
+          additionalProperties: true
+        events:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
+        decisionEvidenceExport:
+          type: object
+          additionalProperties: true
+      additionalProperties: true
     ProblemDetails:
       type: object
       required: [type, title, status, detail]

package/schemas/openapi-commercial-v1.yaml

@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 info:
   title: AgentSkeptic commercial license API
-  version: "3.4.0"
+  version: "3.6.0"
   contact:
     url: https://agentskeptic.com
   x-agentskeptic-distribution:
@@ -117,7 +117,7 @@ paths:
   /api/v1/enforcement/baselines:
     post:
       operationId: createEnforcementBaseline
-      summary: Create or replace accepted enforcement baseline for a workflow
+      summary: Establish accepted enforcement baseline (baseline_missing → baseline_active only)
       security:
         - bearerAuth: []
       requestBody:
@@ -128,11 +128,17 @@ paths:
               $ref: "#/components/schemas/EnforcementEvidenceRequestV2"
       responses:
         "200":
-          description: Baseline created or replaced
+          description: Lifecycle transition completed
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/EnforcementStateResponse"
+                $ref: "#/components/schemas/EnforcementFsmEnvelopeV2"
+        "409":
+          description: Invalid transition or decision-grade certificate required
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/EnforcementFsmEnvelopeV2"
         "400":
           description: Invalid request
           content:
@@ -148,7 +154,7 @@ paths:
   /api/v1/enforcement/check:
     post:
       operationId: checkEnforcementDrift
-      summary: Compare current run projection against accepted baseline
+      summary: Compare current material-truth projection against accepted baseline (verification attempt)
       security:
         - bearerAuth: []
       requestBody:
@@ -159,21 +165,21 @@ paths:
               $ref: "#/components/schemas/EnforcementEvidenceRequestV2"
       responses:
         "200":
-          description: Comparison result (ok or drift)
+          description: Check completed (match, open drift, rerun pass/fail, etc.)
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/EnforcementCheckResponse"
+                $ref: "#/components/schemas/EnforcementFsmEnvelopeV2"
         "409":
-          description: Baseline not initialized
+          description: Baseline missing, remediation acknowledgement required, or other enforce guard
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/ProblemDetails"
+                $ref: "#/components/schemas/EnforcementFsmEnvelopeV2"
   /api/v1/enforcement/accept:
     post:
       operationId: acceptEnforcementDrift
-      summary: Accept current projection as new baseline
+      summary: Procedural drift accept (action_required → rerun_required; not a verification verdict)
       security:
         - bearerAuth: []
       requestBody:
@@ -181,14 +187,20 @@ paths:
         content:
           application/json:
             schema:
-              $ref: "#/components/schemas/EnforcementEvidenceRequestV2"
+              $ref: "#/components/schemas/EnforcementAcceptEvidenceRequestV2"
       responses:
         "200":
-          description: Drift accepted
+          description: Baseline updated; rerun POST /check required before returning to trusted-only posture
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/EnforcementStateResponse"
+                $ref: "#/components/schemas/EnforcementFsmEnvelopeV2"
+        "409":
+          description: Stale lifecycle version, hash pin mismatch, or invalid transition
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/EnforcementFsmEnvelopeV2"
   /api/v1/enforcement/history:
     get:
       operationId: getEnforcementHistory
@@ -241,7 +253,7 @@ paths:
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/GovernanceAuditBundleV1"
+                $ref: "#/components/schemas/GovernanceAuditBundleV2"
         "400":
           description: Invalid request
           content:
@@ -562,27 +574,31 @@ components:
           type: string
         certificate_sha256:
           type: string
-    EnforcementStateResponse:
+    EnforcementFsmEnvelopeV2:
       type: object
-      required: [schema_version, status, workflow_id]
+      description: Hosted enforcement lifecycle + verification attempt payload (schema_version 2).
+      required: [schema_version, code]
       properties:
         schema_version:
           type: integer
-          const: 1
-        status:
-          type: string
-        workflow_id:
+          const: 2
+        code:
           type: string
-    EnforcementCheckResponse:
+        quota_enforced_via_reserve:
+          type: boolean
+      additionalProperties: true
+    EnforcementAcceptEvidenceRequestV2:
       allOf:
-        - $ref: "#/components/schemas/EnforcementStateResponse"
+        - $ref: "#/components/schemas/EnforcementEvidenceRequestV2"
         - type: object
-          required: [expected_projection_hash, actual_projection_hash]
+          required: [expected_projection_hash, lifecycle_state_version]
           properties:
             expected_projection_hash:
               type: string
-            actual_projection_hash:
-              type: string
+              description: Must equal expected_projection_hash_for_accept from the open drift POST /check response.
+            lifecycle_state_version:
+              type: integer
+              description: Optimistic concurrency token; must match lifecycle_state_version from the prior response.
     EnforcementHistoryResponse:
       type: object
       required: [schema_version, workflow_id, events]
@@ -630,6 +646,58 @@ components:
           items:
             type: object
             additionalProperties: true
+    GovernanceAuditBundleV2:
+      type: object
+      description: Governance export including authoritative lifecycle FSM rows and verification decisions.
+      required: [schemaVersion, generatedAt, userId, workflowId, baseline, events]
+      properties:
+        schemaVersion:
+          type: integer
+          const: 2
+        generatedAt:
+          type: string
+          format: date-time
+        userId:
+          type: string
+        workflowId:
+          type: string
+        window:
+          type: object
+          required: [from, to]
+          properties:
+            from:
+              type: string
+              format: date-time
+            to:
+              type: string
+              format: date-time
+        lifecycle:
+          type: object
+          nullable: true
+          additionalProperties: true
+        fsmTransitions:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
+        verificationDecisions:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
+        baseline:
+          type: object
+          nullable: true
+          additionalProperties: true
+        events:
+          type: array
+          items:
+            type: object
+            additionalProperties: true
+        decisionEvidenceExport:
+          type: object
+          additionalProperties: true
+      additionalProperties: true
     ProblemDetails:
       type: object
       required: [type, title, status, detail]

package/schemas/verification-receipt-v1.schema.json

@@ -0,0 +1,108 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agentskeptic.com/schemas/verification-receipt-v1.schema.json",
+  "title": "AgentSkeptic verification receipt v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "$schema",
+    "receiptVersion",
+    "kind",
+    "outcome",
+    "exitCode",
+    "emittedAt",
+    "pid",
+    "receiptPathRelative",
+    "runtime",
+    "verificationSummary",
+    "inputIntegrity",
+    "executionIdentityEmbedded",
+    "executionIdentitySha256",
+    "abortReason",
+    "phaseTimingsMs"
+  ],
+  "properties": {
+    "$schema": { "type": "string" },
+    "receiptVersion": { "type": "string", "const": "1.0.0" },
+    "kind": { "type": "string", "enum": ["merge_gate", "verify", "enforce"] },
+    "outcome": { "type": "string", "enum": ["success", "failure", "operational_abort"] },
+    "exitCode": { "type": "integer" },
+    "emittedAt": { "type": "string" },
+    "pid": { "type": "integer", "minimum": 1 },
+    "receiptPathRelative": { "type": "string", "minLength": 1 },
+    "runtime": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["nodeProcessVersion", "platform", "arch"],
+      "properties": {
+        "nodeProcessVersion": { "type": "string" },
+        "platform": { "type": "string" },
+        "arch": { "type": "string" }
+      }
+    },
+    "verificationSummary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["workflowStatus", "operationalCode", "enforceExitKind"],
+      "properties": {
+        "workflowStatus": { "type": ["string", "null"] },
+        "operationalCode": { "type": ["string", "null"] },
+        "enforceExitKind": { "type": ["string", "null"] }
+      }
+    },
+    "inputIntegrity": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "workflowId",
+        "dbKind",
+        "eventsSha256",
+        "registrySha256",
+        "npmTestScript",
+        "verificationTruthExitPhase"
+      ],
+      "properties": {
+        "workflowId": { "type": "string" },
+        "dbKind": { "type": "string", "enum": ["sqlite", "postgres", "none"] },
+        "eventsSha256": { "type": ["string", "null"] },
+        "registrySha256": { "type": ["string", "null"] },
+        "npmTestScript": { "type": ["string", "null"] },
+        "verificationTruthExitPhase": { "type": ["string", "null"] }
+      }
+    },
+    "executionIdentityEmbedded": {
+      "anyOf": [{ "type": "object" }, { "type": "null" }]
+    },
+    "executionIdentitySha256": {
+      "anyOf": [{ "type": "string", "pattern": "^[0-9a-f]{64}$" }, { "type": "null" }]
+    },
+    "abortReason": {
+      "anyOf": [{ "type": "string", "const": "MISSING_DIST_EXECUTION_IDENTITY" }, { "type": "null" }]
+    },
+    "phaseTimingsMs": {
+      "anyOf": [
+        { "type": "null" },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "regeneration",
+            "preflightDriftRoster",
+            "gitDiffGate",
+            "structuralGuards",
+            "postgresDistribution",
+            "journeyTail"
+          ],
+          "properties": {
+            "regeneration": { "type": "integer", "minimum": 0 },
+            "preflightDriftRoster": { "type": "integer", "minimum": 0 },
+            "gitDiffGate": { "type": "integer", "minimum": 0 },
+            "structuralGuards": { "type": "integer", "minimum": 0 },
+            "postgresDistribution": { "type": "integer", "minimum": 0 },
+            "journeyTail": { "type": "integer", "minimum": 0 }
+          }
+        }
+      ]
+    }
+  }
+}

package/scripts/emit-primary-marketing.cjs

@@ -177,7 +177,7 @@ Normative **public distribution** and anchor sync: [\`docs/public-distribution.m
 - Verification Contract Manifest (canonical): ${contractPin.url}
 - Verification Contract Manifest (repo raw): ${contractRaw}
 - Acquisition page (canonical): ${acquisitionUrl}
-- CI regeneration + drift pathspecs: [\`schemas/ci/verification-truth.manifest.json\`](schemas/ci/verification-truth.manifest.json) (validated by [\`test/verification-truth.manifest.completeness.test.mjs\`](test/verification-truth.manifest.completeness.test.mjs))
+- CI regeneration + drift pathspecs: [\`schemas/ci/verification-truth.manifest.json\`](schemas/ci/verification-truth.manifest.json) (validated by [\`test/verification-truth.closed-drift.contract.test.mjs\`](test/verification-truth.closed-drift.contract.test.mjs))
 `;
   writeFileSync(join(ROOT, "AGENTS.md"), body, "utf8");
 }