agentskeptic 7.6.1 → 7.7.0

package/README.md

@@ -114,7 +114,9 @@ See **[`docs/integrate.md`](docs/integrate.md)** (canonical integrator guide —
 
 ### CI (GitHub Actions)
 
-**Default:** copy **[`examples/github-actions/agentskeptic-check.yml`](examples/github-actions/agentskeptic-check.yml)** — first-party **[composite action](https://docs.github.com/en/actions/how-tos/sharing-actions-and-workflows/recording-deployment-history-and-assignments/creating-composite-actions)** at [`.github/actions/agentskeptic-check`](.github/actions/agentskeptic-check) wrapping **`agentskeptic check`** (default **`mode`**). No `AGENTSKEPTIC_API_KEY` on the OSS path. In another repo, pin upstream with `uses: jwekavanagh/agentskeptic/.github/actions/agentskeptic-check@<ref>` (not Marketplace). Advanced CLI flags pass through **`extra-args`**. Transparent manual fallback: invoke `npx agentskeptic check …` inline (same CLI contract). The composite’s default **`agentskeptic@latest`** **`package`** input is **not** a branch-protection posture—pin **`package`** per **[`docs/ambient-ci-distribution.md#composite-package-input-contract-normative`](docs/ambient-ci-distribution.md#composite-package-input-contract-normative)**. Details: **[`docs/ambient-ci-distribution.md`](docs/ambient-ci-distribution.md)**.
+**Default:** copy **[`examples/github-actions/agentskeptic-check.yml`](examples/github-actions/agentskeptic-check.yml)** — first-party **[composite action](https://docs.github.com/en/actions/how-tos/sharing-actions-and-workflows/recording-deployment-history-and-assignments/creating-composite-actions)** at [`.github/actions/agentskeptic-check`](.github/actions/agentskeptic-check) wrapping **`agentskeptic check`** (default **`mode`**). No `AGENTSKEPTIC_API_KEY` on the OSS path. In another repo, pin upstream with `uses: jwekavanagh/agentskeptic/.github/actions/agentskeptic-check@<ref>` (not Marketplace). Advanced CLI flags pass through **`extra-args`**. Transparent manual fallback: invoke `npx agentskeptic check …` inline (same CLI contract). The composite’s default **`agentskeptic@latest`** **`package`** input is **not** a branch-protection posture—pin **`package`** per **[`docs/ambient-ci-distribution.md#composite-package-input-contract-normative`](docs/ambient-ci-distribution.md#composite-package-input-contract-normative)**.
+
+Every composite run produces three CI surfaces: a **certificate-derived job summary** (failure spine + per-step table + witness kinds), a downloadable artifact named **`agentskeptic-outcome-certificate`** (`outcome-certificate.json`), and **structured composite outputs** (`verdict`, `state-relation`, `trust-decision`, `failing-tool-ids`, `primary-reason-codes`, `failing-witness-kinds`, `recommended-action`, `automation-safe`, `certificate-path`, plus the existing `stdout-path` / `stderr-path` / `exit-code`). The OSS example needs only **`permissions: contents: read`** — artifact upload uses `ACTIONS_RUNTIME_TOKEN`, not `GITHUB_TOKEN`, so no `actions: write` scope is required. Full contract: **[`docs/ambient-ci-distribution.md`](docs/ambient-ci-distribution.md)**.
 
 **Opt-in commercial / stateful enforcement** (baseline, drift, acceptance): **[`examples/github-actions/agentskeptic-commercial.yml`](examples/github-actions/agentskeptic-commercial.yml)** requires an API key and license server ([`docs/commercial-enforce-gate-normative.md`](docs/commercial-enforce-gate-normative.md)).
 <!-- adoption-canonical:end -->

package/dist/execution-identity.v1.json

@@ -4,7 +4,7 @@
   "identityVersion": "1.0.0",
   "mergeGateFingerprintSha256": "64b5ae2ed5025c08c7c9d7b601958cc90edc32c0d80ea207fdaa373de5b9c2fc",
   "nodeEnginesDeclared": "22.x || 24.x",
-  "npmPackageVersion": "7.6.1",
+  "npmPackageVersion": "7.7.0",
   "pythonPipExtrasFragment": "dev,postgres",
   "verificationContractManifest": {
     "manifestSha256": "c5f23ec43576716c4b9a13e752cd2962a78bb4b4da1f9e521f911e15dfd80268",

package/dist/publicDistribution.generated.d.ts

@@ -1,5 +1,5 @@
 export declare const PUBLIC_DISTRIBUTION_SSOT_BLOB_URL = "https://github.com/jwekavanagh/agentskeptic/blob/main/docs/public-distribution.md";
 export declare const PUBLIC_CANONICAL_SITE_ORIGIN = "https://agentskeptic.com";
-export declare const AGENTSKEPTIC_CLI_SEMVER = "7.6.1";
+export declare const AGENTSKEPTIC_CLI_SEMVER = "7.7.0";
 export declare function formatDistributionFooter(): string;
 //# sourceMappingURL=publicDistribution.generated.d.ts.map

package/dist/publicDistribution.generated.js

@@ -1,7 +1,7 @@
 // Generated by npm run emit-primary-marketing — do not hand edit.
 export const PUBLIC_DISTRIBUTION_SSOT_BLOB_URL = "https://github.com/jwekavanagh/agentskeptic/blob/main/docs/public-distribution.md";
 export const PUBLIC_CANONICAL_SITE_ORIGIN = "https://agentskeptic.com";
-export const AGENTSKEPTIC_CLI_SEMVER = "7.6.1";
+export const AGENTSKEPTIC_CLI_SEMVER = "7.7.0";
 export function formatDistributionFooter() {
     return "Context: https://agentskeptic.com/database-truth-vs-traces\n"
         + "https://agentskeptic.com/integrate\n"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentskeptic",
-  "version": "7.6.1",
+  "version": "7.7.0",
   "description": "Tool activity vs downstream state at verify: SQL, HTTP, vectors, documents, S3 objects—deterministic verdict artifacts (verification-state-stores.md).",
   "license": "MIT",
   "type": "module",

package/schemas/openapi-commercial-v1.yaml

@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 info:
   title: AgentSkeptic commercial license API
-  version: "7.6.1"
+  version: "7.7.0"
   contact:
     url: https://agentskeptic.com
   x-agentskeptic-distribution: