tryassay 0.6.0 → 0.11.1

package/dist/runtime/capability-registry.js

@@ -0,0 +1,191 @@
+// ============================================================
+// Assay Verified Agent Runtime — Capability Registry
+// Stores and manages tools with version tracking, rollback,
+// and cryptographic integrity verification.
+// ============================================================
+import { readFile, writeFile, mkdir } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { createHash } from 'node:crypto';
+// ── CapabilityRegistryManager ──────────────────────────────
+export class CapabilityRegistryManager {
+    registry;
+    registryPath;
+    versionHistory = [];
+    constructor(registryPath) {
+        this.registryPath = registryPath;
+        this.registry = this.createEmptyRegistry();
+    }
+    /**
+     * Load the registry from disk. Creates an empty one if not found.
+     */
+    async load() {
+        try {
+            const raw = await readFile(this.registryPath, 'utf-8');
+            const parsed = JSON.parse(raw);
+            this.registry = parsed;
+        }
+        catch {
+            // File doesn't exist or is invalid — start fresh
+            this.registry = this.createEmptyRegistry();
+        }
+    }
+    /**
+     * Save the registry to disk with updated manifest hash.
+     */
+    async save() {
+        this.registry.manifest_hash = this.computeManifestHash();
+        await mkdir(dirname(this.registryPath), { recursive: true });
+        await writeFile(this.registryPath, JSON.stringify(this.registry, null, 2), 'utf-8');
+    }
+    /**
+     * Get the current registry state (readonly snapshot).
+     */
+    getRegistry() {
+        return {
+            ...this.registry,
+            tools: {
+                active: [...this.registry.tools.active],
+                deprecated: [...this.registry.tools.deprecated],
+            },
+            modifications: [...this.registry.modifications],
+        };
+    }
+    /**
+     * Add a new tool to the registry.
+     * The tool must have status 'approved' before calling this.
+     */
+    addTool(tool, approvedBy, proposalId) {
+        if (tool.status !== 'approved') {
+            throw new Error(`Cannot add tool with status "${tool.status}". Must be "approved".`);
+        }
+        // Check for duplicate IDs
+        if (this.findTool(tool.id)) {
+            throw new Error(`Tool "${tool.id}" already exists in registry.`);
+        }
+        // Save version history for rollback
+        this.pushHistory();
+        // Activate the tool
+        const activeTool = { ...tool, status: 'active' };
+        this.registry.tools.active.push(activeTool);
+        // Log the modification
+        this.logModification(proposalId, 'tool', 'added', tool.id, approvedBy);
+    }
+    /**
+     * Deprecate a tool. It remains in the registry but is no longer active.
+     */
+    deprecateTool(toolId, deprecatedBy, _reason) {
+        const index = this.registry.tools.active.findIndex(t => t.id === toolId);
+        if (index === -1) {
+            throw new Error(`Tool "${toolId}" not found in active tools.`);
+        }
+        this.pushHistory();
+        const tool = this.registry.tools.active[index];
+        this.registry.tools.active.splice(index, 1);
+        const deprecated = { ...tool, status: 'deprecated' };
+        this.registry.tools.deprecated.push(deprecated);
+        this.logModification(`deprecate-${toolId}`, 'tool', 'deprecated', toolId, deprecatedBy);
+    }
+    /**
+     * Rollback the registry to the previous version.
+     * Returns true if rollback succeeded, false if no history available.
+     */
+    rollback(rolledBackBy) {
+        const previous = this.versionHistory.pop();
+        if (!previous)
+            return false;
+        const currentVersion = this.registry.version;
+        this.registry = previous;
+        // Log the rollback (on the restored version)
+        this.logModification(`rollback-from-${currentVersion}`, 'tool', 'rolled_back', 'registry', rolledBackBy);
+        return true;
+    }
+    /**
+     * Find a tool by ID across active and deprecated pools.
+     */
+    findTool(toolId) {
+        return this.registry.tools.active.find(t => t.id === toolId)
+            ?? this.registry.tools.deprecated.find(t => t.id === toolId);
+    }
+    /**
+     * List all active tools.
+     */
+    listActiveTools() {
+        return this.registry.tools.active;
+    }
+    /**
+     * List all deprecated tools.
+     */
+    listDeprecatedTools() {
+        return this.registry.tools.deprecated;
+    }
+    /**
+     * Get the modification history.
+     */
+    getModificationHistory() {
+        return this.registry.modifications;
+    }
+    /**
+     * Verify registry integrity by recomputing the manifest hash.
+     */
+    verifyIntegrity() {
+        const actual = this.computeManifestHash();
+        return {
+            valid: actual === this.registry.manifest_hash,
+            expected: this.registry.manifest_hash,
+            actual,
+        };
+    }
+    // ── Private helpers ──────────────────────────────────────
+    createEmptyRegistry() {
+        return {
+            version: '0.0.1',
+            last_modified: new Date().toISOString(),
+            modified_by: 'system',
+            tools: { active: [], deprecated: [] },
+            manifest_hash: '',
+            layer2_hash: '',
+            modifications: [],
+        };
+    }
+    pushHistory() {
+        // Deep clone the current state for rollback
+        const snapshot = JSON.parse(JSON.stringify(this.registry));
+        this.versionHistory.push(snapshot);
+        // Keep at most 10 versions for rollback
+        if (this.versionHistory.length > 10) {
+            this.versionHistory.shift();
+        }
+    }
+    incrementVersion() {
+        const parts = this.registry.version.split('.').map(Number);
+        parts[2] = (parts[2] ?? 0) + 1;
+        return parts.join('.');
+    }
+    logModification(proposalId, type, action, targetId, approvedBy) {
+        const previousVersion = this.registry.version;
+        const newVersion = this.incrementVersion();
+        this.registry.modifications.push({
+            timestamp: new Date().toISOString(),
+            proposal_id: proposalId,
+            type,
+            action,
+            target_id: targetId,
+            approved_by: approvedBy,
+            registry_version_before: previousVersion,
+            registry_version_after: newVersion,
+        });
+        this.registry.version = newVersion;
+        this.registry.last_modified = new Date().toISOString();
+        this.registry.modified_by = approvedBy;
+    }
+    computeManifestHash() {
+        // Hash everything except the manifest_hash field itself
+        const data = {
+            version: this.registry.version,
+            tools: this.registry.tools,
+            modifications: this.registry.modifications,
+        };
+        return createHash('sha256').update(JSON.stringify(data)).digest('hex');
+    }
+}
+//# sourceMappingURL=capability-registry.js.map

package/dist/runtime/capability-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-registry.js","sourceRoot":"","sources":["../../src/runtime/capability-registry.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,qDAAqD;AACrD,4DAA4D;AAC5D,4CAA4C;AAC5C,+DAA+D;AAE/D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAwBzC,8DAA8D;AAE9D,MAAM,OAAO,yBAAyB;IAC5B,QAAQ,CAAkB;IAC1B,YAAY,CAAS;IACrB,cAAc,GAAsB,EAAE,CAAC;IAE/C,YAAY,YAAoB;QAC9B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;YAClD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,iDAAiD;YACjD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,SAAS,CACb,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EACtC,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO;YACL,GAAG,IAAI,CAAC,QAAQ;YAChB,KAAK,EAAE;gBACL,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;gBACvC,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;aAChD;YACD,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;SAChD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,OAAO,CACL,IAAoB,EACpB,UAAkB,EAClB,UAAkB;QAElB,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,MAAM,wBAAwB,CAAC,CAAC;QACvF,CAAC;QAED,0BAA0B;QAC1B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,EAAE,+BAA+B,CAAC,CAAC;QACnE,CAAC;QAED,oCAAoC;QACpC,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,oBAAoB;QACpB,MAAM,UAAU,GAAmB,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAsB,EAAE,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAE5C,uBAAuB;QACvB,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACzE,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAAc,EAAE,YAAoB,EAAE,OAAe;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QACzE,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,SAAS,MAAM,8BAA8B,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAE5C,MAAM,UAAU,GAAmB,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,YAA0B,EAAE,CAAC;QACnF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEhD,IAAI,CAAC,eAAe,CAAC,aAAa,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;IAC1F,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,YAAoB;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAE5B,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC7C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAEzB,6CAA6C;QAC7C,IAAI,CAAC,eAAe,CAClB,iBAAiB,cAAc,EAAE,EACjC,MAAM,EACN,aAAa,EACb,UAAU,EACV,YAAY,CACb,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,MAAc;QACrB,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC;eACvD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,sBAAsB;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,eAAe;QACb,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC1C,OAAO;YACL,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,aAAa;YAC7C,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa;YACrC,MAAM;SACP,CAAC;IACJ,CAAC;IAED,4DAA4D;IAEpD,mBAAmB;QACzB,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACvC,WAAW,EAAE,QAAQ;YACrB,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;YACrC,aAAa,EAAE,EAAE;YACjB,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,EAAE;SAClB,CAAC;IACJ,CAAC;IAEO,WAAW;QACjB,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAoB,CAAC;QAC9E,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEnC,wCAAwC;QACxC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,gBAAgB;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3D,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAEO,eAAe,CACrB,UAAkB,EAClB,IAAsB,EACtB,MAAsC,EACtC,QAAgB,EAChB,UAAkB;QAElB,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAE3C,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC;YAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,WAAW,EAAE,UAAU;YACvB,IAAI;YACJ,MAAM;YACN,SAAS,EAAE,QAAQ;YACnB,WAAW,EAAE,UAAU;YACvB,uBAAuB,EAAE,eAAe;YACxC,sBAAsB,EAAE,UAAU;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,OAAO,GAAG,UAAU,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvD,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,UAAU,CAAC;IACzC,CAAC;IAEO,mBAAmB;QACzB,wDAAwD;QACxD,MAAM,IAAI,GAAG;YACX,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;YAC9B,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;YAC1B,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa;SAC3C,CAAC;QACF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC;CACF"}

package/dist/runtime/collusion-detector.d.ts

@@ -0,0 +1,35 @@
+import type { BoundaryClaim, BoundaryVerificationResult, CollusionEvent, AgentIdentity } from './types.js';
+export declare class CollusionDetector {
+    private events;
+    /**
+     * Check a verification result for collusion signals.
+     *
+     * Collusion is detected when:
+     * 1. Two LLM-backed agents agreed on a claim (Code + Review both say PASS)
+     * 2. The formal verifier disagrees (says FAIL)
+     *
+     * This catches the most dangerous failure mode: correlated LLM errors
+     * where agents trained on similar data share the same blind spots.
+     */
+    check(sourceAgent: AgentIdentity, targetAgent: AgentIdentity, claims: readonly BoundaryClaim[], result: BoundaryVerificationResult): CollusionEvent[];
+    /**
+     * Check if the collusion rate exceeds a threshold for a given agent pair.
+     * Returns true if the ratio of collusion events to total verifications
+     * exceeds the threshold (default: 20%).
+     */
+    isCollusionRateExcessive(agentA: string, agentB: string, totalVerifications: number, threshold?: number): boolean;
+    /** Get all collusion events. */
+    getAllEvents(): readonly CollusionEvent[];
+    /** Get collusion events for a specific agent. */
+    getEventsForAgent(agentId: string): readonly CollusionEvent[];
+    /** Get critical collusion events (security/data-loss claims). */
+    getCriticalEvents(): readonly CollusionEvent[];
+    /** Get collusion event count. */
+    getEventCount(): number;
+    /** Get unique agent pairs involved in collusion. */
+    getColludingPairs(): Array<{
+        agentA: string;
+        agentB: string;
+        count: number;
+    }>;
+}

package/dist/runtime/collusion-detector.js

@@ -0,0 +1,97 @@
+// ============================================================
+// Assay Verified Agent Runtime — Collusion Detector
+// Detects when LLM-backed agents agree on something the formal
+// verifier disagrees with. This is the anti-collusion primitive.
+// ============================================================
+import { randomUUID } from 'node:crypto';
+// ── Collusion Detector ─────────────────────────────────────
+export class CollusionDetector {
+    events = [];
+    /**
+     * Check a verification result for collusion signals.
+     *
+     * Collusion is detected when:
+     * 1. Two LLM-backed agents agreed on a claim (Code + Review both say PASS)
+     * 2. The formal verifier disagrees (says FAIL)
+     *
+     * This catches the most dangerous failure mode: correlated LLM errors
+     * where agents trained on similar data share the same blind spots.
+     */
+    check(sourceAgent, targetAgent, claims, result) {
+        const detected = [];
+        // Only check if both agents are LLM-backed (not formal)
+        if (sourceAgent.trustLevel === 'formal' || targetAgent.trustLevel === 'formal') {
+            return detected;
+        }
+        // Look for formal overrides — these are the collusion signals
+        for (const claim of claims) {
+            if (claim.formalOverride) {
+                // LLM said one thing, formal verifier said another
+                const event = {
+                    id: randomUUID(),
+                    agentA: sourceAgent.id,
+                    agentB: targetAgent.id,
+                    agreedVerdict: claim.formalOverride.originalLlmVerdict,
+                    formalVerdict: claim.formalOverride.formalVerdict,
+                    claimId: claim.id,
+                    claimText: claim.text,
+                    severity: claim.severity,
+                    timestamp: new Date().toISOString(),
+                };
+                detected.push(event);
+                this.events.push(event);
+            }
+        }
+        // Also check for suspicious patterns: both agents consistently
+        // passing claims that the formal stats show disagreement on
+        if (result.formalStats.disagreements > 0 && result.formalStats.formalOverrides > 0) {
+            // Each formal override where both LLM agents agreed is a collusion signal
+            // (already captured above via formalOverride on claims)
+        }
+        return detected;
+    }
+    /**
+     * Check if the collusion rate exceeds a threshold for a given agent pair.
+     * Returns true if the ratio of collusion events to total verifications
+     * exceeds the threshold (default: 20%).
+     */
+    isCollusionRateExcessive(agentA, agentB, totalVerifications, threshold = 0.2) {
+        const pairEvents = this.events.filter(e => (e.agentA === agentA && e.agentB === agentB) ||
+            (e.agentA === agentB && e.agentB === agentA));
+        if (totalVerifications === 0)
+            return false;
+        return pairEvents.length / totalVerifications > threshold;
+    }
+    /** Get all collusion events. */
+    getAllEvents() {
+        return this.events;
+    }
+    /** Get collusion events for a specific agent. */
+    getEventsForAgent(agentId) {
+        return this.events.filter(e => e.agentA === agentId || e.agentB === agentId);
+    }
+    /** Get critical collusion events (security/data-loss claims). */
+    getCriticalEvents() {
+        return this.events.filter(e => e.severity === 'critical' || e.severity === 'high');
+    }
+    /** Get collusion event count. */
+    getEventCount() {
+        return this.events.length;
+    }
+    /** Get unique agent pairs involved in collusion. */
+    getColludingPairs() {
+        const pairs = new Map();
+        for (const event of this.events) {
+            const key = [event.agentA, event.agentB].sort().join('::');
+            const existing = pairs.get(key);
+            if (existing) {
+                existing.count++;
+            }
+            else {
+                pairs.set(key, { agentA: event.agentA, agentB: event.agentB, count: 1 });
+            }
+        }
+        return Array.from(pairs.values());
+    }
+}
+//# sourceMappingURL=collusion-detector.js.map

package/dist/runtime/collusion-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collusion-detector.js","sourceRoot":"","sources":["../../src/runtime/collusion-detector.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,oDAAoD;AACpD,+DAA+D;AAC/D,iEAAiE;AACjE,+DAA+D;AAE/D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAQzC,8DAA8D;AAE9D,MAAM,OAAO,iBAAiB;IACpB,MAAM,GAAqB,EAAE,CAAC;IAEtC;;;;;;;;;OASG;IACH,KAAK,CACH,WAA0B,EAC1B,WAA0B,EAC1B,MAAgC,EAChC,MAAkC;QAElC,MAAM,QAAQ,GAAqB,EAAE,CAAC;QAEtC,wDAAwD;QACxD,IAAI,WAAW,CAAC,UAAU,KAAK,QAAQ,IAAI,WAAW,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC/E,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,8DAA8D;QAC9D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;gBACzB,mDAAmD;gBACnD,MAAM,KAAK,GAAmB;oBAC5B,EAAE,EAAE,UAAU,EAAE;oBAChB,MAAM,EAAE,WAAW,CAAC,EAAE;oBACtB,MAAM,EAAE,WAAW,CAAC,EAAE;oBACtB,aAAa,EAAE,KAAK,CAAC,cAAc,CAAC,kBAAkB;oBACtD,aAAa,EAAE,KAAK,CAAC,cAAc,CAAC,aAAa;oBACjD,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,SAAS,EAAE,KAAK,CAAC,IAAI;oBACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC;gBAEF,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,4DAA4D;QAC5D,IAAI,MAAM,CAAC,WAAW,CAAC,aAAa,GAAG,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;YACnF,0EAA0E;YAC1E,wDAAwD;QAC1D,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACH,wBAAwB,CACtB,MAAc,EACd,MAAc,EACd,kBAA0B,EAC1B,YAAoB,GAAG;QAEvB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CACnC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;YAC5C,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAClD,CAAC;QACF,IAAI,kBAAkB,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,UAAU,CAAC,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAC;IAC5D,CAAC;IAED,gCAAgC;IAChC,YAAY;QACV,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,iDAAiD;IACjD,iBAAiB,CAAC,OAAe;QAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;IAC/E,CAAC;IAED,iEAAiE;IACjE,iBAAiB;QACf,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IACrF,CAAC;IAED,iCAAiC;IACjC,aAAa;QACX,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED,oDAAoD;IACpD,iBAAiB;QACf,MAAM,KAAK,GAAG,IAAI,GAAG,EAA6D,CAAC;QAEnF,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3D,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,CAAC;CACF"}

package/dist/runtime/control-server.js

@@ -3,7 +3,7 @@
 // Lightweight control plane for status, pause, resume, stop
 // ============================================================
 import { createServer } from 'node:http';
-import { randomBytes } from 'node:crypto';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
 // ── ControlServer ───────────────────────────────────────────
 export class ControlServer {
     server = null;
@@ -39,9 +39,13 @@ export class ControlServer {
         this.server = null;
     }
     handleRequest(req, res) {
-        // Auth check
-        const authHeader = req.headers.authorization;
-        if (authHeader !== `Bearer ${this.token}`) {
+        // Auth check (timing-safe to prevent token inference via timing attacks)
+        const authHeader = req.headers.authorization ?? '';
+        const expected = `Bearer ${this.token}`;
+        const headerBuf = Buffer.from(authHeader);
+        const expectedBuf = Buffer.from(expected);
+        if (headerBuf.length !== expectedBuf.length ||
+            !timingSafeEqual(headerBuf, expectedBuf)) {
             this.json(res, 401, { error: 'Unauthorized' });
             return;
         }

package/dist/runtime/control-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"control-server.js","sourceRoot":"","sources":["../../src/runtime/control-server.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,qDAAqD;AACrD,4DAA4D;AAC5D,+DAA+D;AAE/D,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAmB1C,+DAA+D;AAE/D,MAAM,OAAO,aAAa;IAChB,MAAM,GAAkB,IAAI,CAAC;IACpB,IAAI,CAAS;IACb,KAAK,CAAS;IACd,UAAU,CAAkB;IAE7C,YAAY,UAA2B,EAAE,IAA0B;QACjE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAEvE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,CAAC,MAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,MAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QACzB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACzB,IAAI,GAAG;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;oBAChB,OAAO,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;IAEO,aAAa,CAAC,GAAoB,EAAE,GAAmB;QAC7D,aAAa;QACb,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,UAAU,KAAK,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;QAEnC,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBAClB,GAAG,KAAK;gBACR,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE;aAC1C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3C,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACtD,wBAAwB;YACxB,YAAY,CAAC,GAAG,EAAE;gBAChB,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9C,CAAC;IAEO,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;QAC7D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC;CACF"}
+{"version":3,"file":"control-server.js","sourceRoot":"","sources":["../../src/runtime/control-server.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,qDAAqD;AACrD,4DAA4D;AAC5D,+DAA+D;AAE/D,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAmB3D,+DAA+D;AAE/D,MAAM,OAAO,aAAa;IAChB,MAAM,GAAkB,IAAI,CAAC;IACpB,IAAI,CAAS;IACb,KAAK,CAAS;IACd,UAAU,CAAkB;IAE7C,YAAY,UAA2B,EAAE,IAA0B;QACjE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAEvE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,CAAC,MAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,MAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QACzB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACzB,IAAI,GAAG;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;oBAChB,OAAO,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;IAEO,aAAa,CAAC,GAAoB,EAAE,GAAmB;QAC7D,yEAAyE;QACzE,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,SAAS,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;YACvC,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;QAEnC,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBAClB,GAAG,KAAK;gBACR,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE;aAC1C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3C,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACtD,wBAAwB;YACxB,YAAY,CAAC,GAAG,EAAE;gBAChB,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9C,CAAC;IAEO,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;QAC7D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/runtime/domain-coverage-analyzer.d.ts

@@ -0,0 +1,24 @@
+import type { AgentDefinition, ToolDefinition } from './types.js';
+export interface CoverageAnalysis {
+    readonly claimed_scope: string;
+    readonly verified_scope: string;
+    readonly gaps: readonly string[];
+    readonly overreach: readonly string[];
+    readonly tool_access: {
+        readonly justified: readonly string[];
+        readonly questionable: readonly string[];
+        readonly missing: readonly string[];
+    };
+}
+export declare class DomainCoverageAnalyzer {
+    /**
+     * Analyze an agent definition for coverage gaps and overreach.
+     * Compares the agent's declared domain against known patterns
+     * and the available tool registry.
+     */
+    analyze(agent: AgentDefinition, availableTools: readonly ToolDefinition[]): CoverageAnalysis;
+    private matchDomain;
+    private isLanguageRelated;
+    private analyzeToolAccess;
+    private summarizeVerifiedScope;
+}

package/dist/runtime/domain-coverage-analyzer.js

@@ -0,0 +1,178 @@
+// ============================================================
+// Assay Verified Agent Runtime — Domain Coverage Analyzer
+// Analyzes agent definitions for domain coverage gaps and overreach.
+// ============================================================
+const DOMAIN_EXPECTATIONS = {
+    kubernetes: {
+        languages: ['yaml', 'helm'],
+        frameworks: ['kubernetes', 'docker', 'helm'],
+        expected_tools: ['cli_wrapper'],
+        expected_claims: ['security', 'correctness', 'completeness'],
+    },
+    database: {
+        languages: ['sql', 'typescript', 'python'],
+        frameworks: ['postgresql', 'mysql', 'mongodb', 'prisma', 'drizzle'],
+        expected_tools: ['cli_wrapper', 'data_transform'],
+        expected_claims: ['security', 'correctness', 'performance'],
+    },
+    frontend: {
+        languages: ['typescript', 'javascript', 'css', 'html'],
+        frameworks: ['react', 'vue', 'svelte', 'next.js', 'angular'],
+        expected_tools: ['cli_wrapper'],
+        expected_claims: ['correctness', 'completeness', 'type-safety'],
+    },
+    api: {
+        languages: ['typescript', 'python', 'go'],
+        frameworks: ['express', 'fastify', 'flask', 'gin'],
+        expected_tools: ['api_client', 'cli_wrapper'],
+        expected_claims: ['security', 'correctness', 'error-handling'],
+    },
+    security: {
+        languages: ['typescript', 'python', 'go', 'rust'],
+        frameworks: [],
+        expected_tools: ['verification_helper', 'cli_wrapper'],
+        expected_claims: ['security', 'correctness'],
+    },
+    infrastructure: {
+        languages: ['yaml', 'hcl', 'terraform'],
+        frameworks: ['terraform', 'cloudformation', 'pulumi', 'ansible'],
+        expected_tools: ['cli_wrapper'],
+        expected_claims: ['security', 'correctness', 'completeness'],
+    },
+};
+// ── Domain Coverage Analyzer ───────────────────────────────
+export class DomainCoverageAnalyzer {
+    /**
+     * Analyze an agent definition for coverage gaps and overreach.
+     * Compares the agent's declared domain against known patterns
+     * and the available tool registry.
+     */
+    analyze(agent, availableTools) {
+        const gaps = [];
+        const overreach = [];
+        // Match against known domain expectations
+        const domainKey = this.matchDomain(agent.domain);
+        const expectations = domainKey ? DOMAIN_EXPECTATIONS[domainKey] : null;
+        // Check language coverage
+        if (expectations) {
+            for (const lang of expectations.languages) {
+                if (!agent.domain.languages.includes(lang)) {
+                    gaps.push(`Domain "${domainKey}" typically handles "${lang}" but agent doesn't declare it`);
+                }
+            }
+            // Check for overreach: languages not expected for this domain
+            for (const lang of agent.domain.languages) {
+                const isExpected = expectations.languages.includes(lang);
+                const isRelated = this.isLanguageRelated(lang, expectations.languages);
+                if (!isExpected && !isRelated) {
+                    overreach.push(`Agent declares "${lang}" which is unusual for domain "${domainKey}"`);
+                }
+            }
+            // Check claim category coverage
+            for (const cat of expectations.expected_claims) {
+                if (!agent.domain.claim_categories.includes(cat)) {
+                    gaps.push(`Domain "${domainKey}" typically covers "${cat}" claims but agent doesn't declare it`);
+                }
+            }
+        }
+        // Analyze tool access
+        const toolAnalysis = this.analyzeToolAccess(agent, availableTools, expectations);
+        // Check for overly broad domain description
+        if (agent.domain.description.length < 20) {
+            gaps.push('Domain description is too brief to determine scope');
+        }
+        if (agent.domain.description.toLowerCase().includes('everything') ||
+            agent.domain.description.toLowerCase().includes('all code') ||
+            agent.domain.description.toLowerCase().includes('any language')) {
+            overreach.push('Domain description is overly broad (claims to handle "everything" or "all")');
+        }
+        // Check constraints consistency
+        if (agent.trust_level === 'sandboxed' && agent.constraints.can_spawn_agents) {
+            overreach.push('Sandboxed agents cannot spawn other agents');
+        }
+        if (agent.trust_level === 'standard' && agent.constraints.can_spawn_agents) {
+            overreach.push('Standard trust agents cannot spawn other agents');
+        }
+        return {
+            claimed_scope: agent.domain.description,
+            verified_scope: this.summarizeVerifiedScope(agent, expectations),
+            gaps,
+            overreach,
+            tool_access: toolAnalysis,
+        };
+    }
+    // ── Private helpers ──────────────────────────────────────
+    matchDomain(domain) {
+        const desc = domain.description.toLowerCase();
+        const frameworks = domain.frameworks.map(f => f.toLowerCase());
+        for (const [key, _exp] of Object.entries(DOMAIN_EXPECTATIONS)) {
+            if (desc.includes(key))
+                return key;
+            if (frameworks.some(f => _exp.frameworks.includes(f)))
+                return key;
+        }
+        return null;
+    }
+    isLanguageRelated(lang, expectedLangs) {
+        const related = {
+            typescript: ['javascript'],
+            javascript: ['typescript'],
+            yaml: ['json'],
+            json: ['yaml'],
+            hcl: ['terraform'],
+        };
+        return (related[lang] ?? []).some(r => expectedLangs.includes(r));
+    }
+    analyzeToolAccess(agent, availableTools, expectations) {
+        const justified = [];
+        const questionable = [];
+        const missing = [];
+        // Check each requested tool
+        for (const toolId of agent.tools) {
+            const tool = availableTools.find(t => t.id === toolId);
+            if (!tool) {
+                questionable.push(`${toolId} (not found in registry)`);
+                continue;
+            }
+            // Check if tool type is expected for this domain
+            if (expectations && expectations.expected_tools.includes(tool.type)) {
+                justified.push(toolId);
+            }
+            else if (!expectations) {
+                justified.push(toolId); // Can't determine, assume justified
+            }
+            else {
+                questionable.push(`${toolId} (type "${tool.type}" not typical for domain)`);
+            }
+        }
+        // Check for missing tools
+        if (expectations) {
+            for (const expectedType of expectations.expected_tools) {
+                const hasType = agent.tools.some(id => {
+                    const tool = availableTools.find(t => t.id === id);
+                    return tool?.type === expectedType;
+                });
+                if (!hasType) {
+                    missing.push(`No "${expectedType}" tool — typically needed for this domain`);
+                }
+            }
+        }
+        return { justified, questionable, missing };
+    }
+    summarizeVerifiedScope(agent, expectations) {
+        const parts = [];
+        parts.push(`Languages: ${agent.domain.languages.join(', ')}`);
+        if (agent.domain.frameworks.length > 0) {
+            parts.push(`Frameworks: ${agent.domain.frameworks.join(', ')}`);
+        }
+        parts.push(`Claims: ${agent.domain.claim_categories.join(', ')}`);
+        if (expectations) {
+            parts.push(`Matched domain: known pattern`);
+        }
+        else {
+            parts.push(`Domain: no known pattern match (custom)`);
+        }
+        return parts.join('. ');
+    }
+}
+//# sourceMappingURL=domain-coverage-analyzer.js.map

package/dist/runtime/domain-coverage-analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-coverage-analyzer.js","sourceRoot":"","sources":["../../src/runtime/domain-coverage-analyzer.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,0DAA0D;AAC1D,qEAAqE;AACrE,+DAA+D;AA8B/D,MAAM,mBAAmB,GAAsC;IAC7D,UAAU,EAAE;QACV,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;QAC3B,UAAU,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC;QAC5C,cAAc,EAAE,CAAC,aAAa,CAAC;QAC/B,eAAe,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,cAAc,CAAC;KAC7D;IACD,QAAQ,EAAE;QACR,SAAS,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC;QAC1C,UAAU,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC;QACnE,cAAc,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC;QACjD,eAAe,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC;KAC5D;IACD,QAAQ,EAAE;QACR,SAAS,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC;QACtD,UAAU,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;QAC5D,cAAc,EAAE,CAAC,aAAa,CAAC;QAC/B,eAAe,EAAE,CAAC,aAAa,EAAE,cAAc,EAAE,aAAa,CAAC;KAChE;IACD,GAAG,EAAE;QACH,SAAS,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC;QACzC,UAAU,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC;QAClD,cAAc,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;QAC7C,eAAe,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,gBAAgB,CAAC;KAC/D;IACD,QAAQ,EAAE;QACR,SAAS,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC;QACjD,UAAU,EAAE,EAAE;QACd,cAAc,EAAE,CAAC,qBAAqB,EAAE,aAAa,CAAC;QACtD,eAAe,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC;KAC7C;IACD,cAAc,EAAE;QACd,SAAS,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC;QACvC,UAAU,EAAE,CAAC,WAAW,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,CAAC;QAChE,cAAc,EAAE,CAAC,aAAa,CAAC;QAC/B,eAAe,EAAE,CAAC,UAAU,EAAE,aAAa,EAAE,cAAc,CAAC;KAC7D;CACF,CAAC;AAEF,8DAA8D;AAE9D,MAAM,OAAO,sBAAsB;IACjC;;;;OAIG;IACH,OAAO,CACL,KAAsB,EACtB,cAAyC;QAEzC,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAa,EAAE,CAAC;QAE/B,0CAA0C;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEvE,0BAA0B;QAC1B,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;gBAC1C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC3C,IAAI,CAAC,IAAI,CAAC,WAAW,SAAS,wBAAwB,IAAI,gCAAgC,CAAC,CAAC;gBAC9F,CAAC;YACH,CAAC;YAED,8DAA8D;YAC9D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACzD,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;gBACvE,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;oBAC9B,SAAS,CAAC,IAAI,CAAC,mBAAmB,IAAI,kCAAkC,SAAS,GAAG,CAAC,CAAC;gBACxF,CAAC;YACH,CAAC;YAED,gCAAgC;YAChC,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,eAAe,EAAE,CAAC;gBAC/C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjD,IAAI,CAAC,IAAI,CAAC,WAAW,SAAS,uBAAuB,GAAG,uCAAuC,CAAC,CAAC;gBACnG,CAAC;YACH,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;QAEjF,4CAA4C;QAC5C,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC7D,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC3D,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACpE,SAAS,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;QAChG,CAAC;QAED,gCAAgC;QAChC,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;YAC5E,SAAS,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU,IAAI,KAAK,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;YAC3E,SAAS,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QACpE,CAAC;QAED,OAAO;YACL,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW;YACvC,cAAc,EAAE,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,YAAY,CAAC;YAChE,IAAI;YACJ,SAAS;YACT,WAAW,EAAE,YAAY;SAC1B,CAAC;IACJ,CAAC;IAED,4DAA4D;IAEpD,WAAW,CAAC,MAAiC;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAE/D,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC9D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC;YACnC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,GAAG,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,iBAAiB,CAAC,IAAY,EAAE,aAAuB;QAC7D,MAAM,OAAO,GAA6B;YACxC,UAAU,EAAE,CAAC,YAAY,CAAC;YAC1B,UAAU,EAAE,CAAC,YAAY,CAAC;YAC1B,IAAI,EAAE,CAAC,MAAM,CAAC;YACd,IAAI,EAAE,CAAC,MAAM,CAAC;YACd,GAAG,EAAE,CAAC,WAAW,CAAC;SACnB,CAAC;QACF,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IAEO,iBAAiB,CACvB,KAAsB,EACtB,cAAyC,EACzC,YAAsC;QAEtC,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,4BAA4B;QAC5B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,YAAY,CAAC,IAAI,CAAC,GAAG,MAAM,0BAA0B,CAAC,CAAC;gBACvD,SAAS;YACX,CAAC;YAED,iDAAiD;YACjD,IAAI,YAAY,IAAI,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;iBAAM,IAAI,CAAC,YAAY,EAAE,CAAC;gBACzB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,oCAAoC;YAC9D,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,IAAI,CAAC,IAAI,2BAA2B,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAED,0BAA0B;QAC1B,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,MAAM,YAAY,IAAI,YAAY,CAAC,cAAc,EAAE,CAAC;gBACvD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;oBACpC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;oBACnD,OAAO,IAAI,EAAE,IAAI,KAAK,YAAY,CAAC;gBACrC,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,CAAC,IAAI,CAAC,OAAO,YAAY,2CAA2C,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IAC9C,CAAC;IAEO,sBAAsB,CAC5B,KAAsB,EACtB,YAAsC;QAEtC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,cAAc,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9D,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,eAAe,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CACF"}