witnora 0.10.0 → 0.10.2

package/README.md

@@ -9,17 +9,51 @@ outcome. It writes portable reports and accumulates a local failure corpus.
 [Public evidence](https://witnora.com/evidence) |
 [Get started](https://witnora.com/docs) |
 [Private workspace](https://witnora.com/app) |
-[GitHub source](https://github.com/Kakarottoooo/agentcert)
+[GitHub source](https://github.com/Kakarottoooo/witnora)
 
-## 5-minute local path
+## 5-minute hosted path
 
-No agent repository or API key is required for the first run:
+Create a Hosted project, open a terminal in the agent repository, and run the
+one command shown by Witnora:
 
 ```bash
-npx witnora@latest try --template workflow
+npx witnora@latest onboard --project your-project-id
 ```
 
-Inspect `.witnora/try/agentcert-report.html` and
+The browser approval creates a restricted project credential without exposing
+it in Hosted, then the CLI saves it outside the repository, detects the agent
+boundary, writes only missing configuration, and verifies the local evidence
+path. `.witnora/onboarding/receipt.json` is synthetic: it cannot create a run,
+evidence object, release decision, or `CURRENT` assurance.
+
+Without an agent repository, run `npx witnora@latest try --template workflow`
+for an offline-only sample.
+
+To exercise the privacy-preserving high-risk action loop locally, including
+contract compilation, exact-action approval, a single-use grant, controlled
+execution, independent outcome observation, signed evidence, and offline
+verification:
+
+```bash
+npx witnora@latest contract init
+npx witnora@latest contract compile witnora.assurance-contract.json
+npx witnora@latest privacy init
+npx witnora@latest demo assurance-loop
+npx witnora@latest verify --offline .witnora/assurance-loop/witnora-evidence-packet.json \
+  --trust .witnora/assurance-loop/witnora-trust-bundle.json
+```
+
+This reference path is deterministic and local. It uses no real integration or
+credential. See the full [privacy-preserving action loop](https://github.com/Kakarottoooo/witnora/blob/main/docs/how-it-works/privacy-preserving-action-loop.md),
+including attack demonstrations and explicit limitations.
+
+Implementation references:
+
+- [Assurance Contract v0.1](https://github.com/Kakarottoooo/witnora/blob/main/docs/specifications/witnora-assurance-contract-v0.1.md)
+- [Two-hour design-partner quickstart](https://github.com/Kakarottoooo/witnora/blob/main/docs/guides/design-partner-two-hour-quickstart.md)
+- [Threat model and trust boundaries](https://github.com/Kakarottoooo/witnora/blob/main/docs/security/privacy-verifiable-assurance-v1-threat-model.md)
+
+If you use the offline sample, inspect `.witnora/try/agentcert-report.html` and
 `.witnora/try/agentcert-evidence.json`. The output is explicitly synthetic and
 reported-strength: it proves the evidence tooling works, not that a real agent
 is reliable.
@@ -92,11 +126,11 @@ Default outputs:
 - `.witnora/latest/reviewed-failure-dataset.jsonl`
 - `.witnora/latest/monitor.json`
 
-Push the validated evidence bundle into a hosted Witnora project:
+Onboard once, then push the validated evidence bundle into the same project:
 
 ```bash
-npx witnora connect --server https://witnora.com --project your-project-id
-npx witnora push --evidence .witnora/latest/agentcert-evidence.json
+npx witnora@latest onboard --project your-project-id
+npx witnora@latest push --evidence .witnora/latest/agentcert-evidence.json
 ```
 
 ### Automatic agent and environment context
@@ -194,7 +228,7 @@ the bundled deterministic adapter contract and writes
 `.witnora/sandbox/sandbox-adapter-conformance.json`. No `@agentcert` scoped
 package is required.
 
-After `agentcert connect`, certify and upload in one command:
+After `witnora onboard`, certify and upload in one command:
 
 ```bash
 npx witnora sandbox push --adapter ./agentcert.sandbox.mjs
@@ -321,3 +355,14 @@ npm --prefix packages/witnora-cli ci
 npm --prefix packages/witnora-cli run build
 node packages/witnora-cli/dist/cli.js run --profile public-demo
 ```
+
+## Design-partner independent assurance v0.2
+
+The sandbox-only reference path separates a write-capable Gateway from a
+customer-operated read-only Probe, binds approval and a single-use grant to one
+declared GitHub pull-request action, reconciles target state after dispatch, and
+produces a packet that TypeScript and Python can verify offline.
+
+Start with the [two-hour design-partner quickstart](../../docs/guides/design-partner-two-hour-quickstart.md).
+The included GitHub target is an emulator. It does not claim live GitHub or
+production acceptance, organizational independence, or external review.

package/dist/assurance-contract.js

@@ -0,0 +1,312 @@
+import { readFile } from "node:fs/promises";
+import { canonicalJson, sha256Canonical, WITNORA_CANONICALIZATION_VERSION } from "./canonical.js";
+export const ASSURANCE_CONTRACT_VERSION = "witnora.assurance_contract.v0.1";
+export const COMPILED_CONTRACT_VERSION = "witnora.compiled_assurance_contract.v0.1";
+export const ASSURANCE_COMPILER_VERSION = "witnora.contract_compiler.v0.1";
+export async function readAssuranceContract(path) {
+    const raw = await readFile(path, "utf8");
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error("Contract must be JSON (JSON is valid YAML 1.2). Generated contracts use a .json file to avoid parser ambiguity.");
+    }
+    return validateAssuranceContract(parsed);
+}
+export function validateAssuranceContract(input) {
+    const errors = [];
+    const root = object(input, "$", errors);
+    exactKeys(root, ["kind", "metadata", "subject", "capability", "authority", "preconditions", "effect", "execution", "observation", "privacy", "evidence", "revalidation"], "$", errors);
+    if (root.kind !== ASSURANCE_CONTRACT_VERSION)
+        errors.push(`$.kind must equal ${ASSURANCE_CONTRACT_VERSION}.`);
+    const metadata = object(root.metadata, "$.metadata", errors);
+    exactKeys(metadata, ["id", "version", "description"], "$.metadata", errors);
+    const subject = object(root.subject, "$.subject", errors);
+    exactKeys(subject, ["agentId", "environment"], "$.subject", errors);
+    const capability = object(root.capability, "$.capability", errors);
+    exactKeys(capability, ["id", "action", "sideEffect", "risk"], "$.capability", errors);
+    const authority = object(root.authority, "$.authority", errors);
+    exactKeys(authority, ["mandateRef", "policyRef", "approval", "resourceScope"], "$.authority", errors);
+    const approval = object(authority.approval, "$.authority.approval", errors);
+    exactKeys(approval, ["required"], "$.authority.approval", errors);
+    const resourceScope = object(authority.resourceScope, "$.authority.resourceScope", errors);
+    exactKeys(resourceScope, ["type", "pattern"], "$.authority.resourceScope", errors);
+    const effect = object(root.effect, "$.effect", errors);
+    exactKeys(effect, ["eventuallyWithin", "stableFor", "must", "mustNot"], "$.effect", errors, ["stableFor"]);
+    const execution = object(root.execution, "$.execution", errors);
+    exactKeys(execution, ["atMostOnce", "idempotencyRequired", "retryPolicy"], "$.execution", errors);
+    const retry = object(execution.retryPolicy, "$.execution.retryPolicy", errors);
+    exactKeys(retry, ["maxAttempts"], "$.execution.retryPolicy", errors);
+    const observation = object(root.observation, "$.observation", errors);
+    exactKeys(observation, ["mode", "probeRef", "reconcileWithTargetAuditLog"], "$.observation", errors);
+    const privacy = object(root.privacy, "$.privacy", errors);
+    exactKeys(privacy, ["localOnly", "disclose", "commitOnly"], "$.privacy", errors);
+    const evidence = object(root.evidence, "$.evidence", errors);
+    exactKeys(evidence, ["require"], "$.evidence", errors);
+    const revalidation = object(root.revalidation, "$.revalidation", errors);
+    exactKeys(revalidation, ["triggers"], "$.revalidation", errors);
+    requiredString(metadata.id, "$.metadata.id", errors);
+    positiveInteger(metadata.version, "$.metadata.version", errors);
+    requiredString(metadata.description, "$.metadata.description", errors);
+    requiredString(subject.agentId, "$.subject.agentId", errors);
+    requiredString(subject.environment, "$.subject.environment", errors);
+    requiredString(capability.id, "$.capability.id", errors);
+    oneOf(capability.action, ["SUBMIT", "PAY", "SEND", "UPDATE"], "$.capability.action", errors);
+    bool(capability.sideEffect, "$.capability.sideEffect", errors);
+    oneOf(capability.risk, ["low", "medium", "high", "critical"], "$.capability.risk", errors);
+    requiredString(authority.mandateRef, "$.authority.mandateRef", errors);
+    requiredString(authority.policyRef, "$.authority.policyRef", errors);
+    bool(approval.required, "$.authority.approval.required", errors);
+    requiredString(resourceScope.type, "$.authority.resourceScope.type", errors);
+    requiredString(resourceScope.pattern, "$.authority.resourceScope.pattern", errors);
+    const preconditions = predicates(root.preconditions, "$.preconditions", errors);
+    requiredString(effect.eventuallyWithin, "$.effect.eventuallyWithin", errors);
+    if (typeof effect.eventuallyWithin === "string" && parseContractDurationMs(effect.eventuallyWithin) === undefined)
+        errors.push("$.effect.eventuallyWithin must be a positive duration such as 30s, 5m, or 1h.");
+    if (effect.stableFor !== undefined) {
+        requiredString(effect.stableFor, "$.effect.stableFor", errors);
+        if (typeof effect.stableFor === "string" && parseContractDurationMs(effect.stableFor) === undefined)
+            errors.push("$.effect.stableFor must be a positive duration such as 5s, 1m, or 1h.");
+    }
+    const must = predicates(effect.must, "$.effect.must", errors);
+    const mustNot = predicates(effect.mustNot, "$.effect.mustNot", errors);
+    bool(execution.atMostOnce, "$.execution.atMostOnce", errors);
+    bool(execution.idempotencyRequired, "$.execution.idempotencyRequired", errors);
+    positiveInteger(retry.maxAttempts, "$.execution.retryPolicy.maxAttempts", errors);
+    if (observation.mode !== "independent_read_path")
+        errors.push("$.observation.mode must equal independent_read_path.");
+    requiredString(observation.probeRef, "$.observation.probeRef", errors);
+    bool(observation.reconcileWithTargetAuditLog, "$.observation.reconcileWithTargetAuditLog", errors);
+    const localOnly = strings(privacy.localOnly, "$.privacy.localOnly", errors);
+    const disclose = strings(privacy.disclose, "$.privacy.disclose", errors);
+    const commitOnly = strings(privacy.commitOnly, "$.privacy.commitOnly", errors);
+    const overlap = [...localOnly, ...disclose, ...commitOnly].filter((value, index, all) => all.indexOf(value) !== index);
+    if (overlap.length)
+        errors.push(`$.privacy categories overlap: ${[...new Set(overlap)].join(", ")}.`);
+    const requireEvidence = strings(evidence.require, "$.evidence.require", errors);
+    const triggers = strings(revalidation.triggers, "$.revalidation.triggers", errors);
+    if (capability.sideEffect === true && ["high", "critical"].includes(String(capability.risk)) && approval.required !== true) {
+        errors.push("$.authority.approval.required must be true for a high-risk side effect.");
+    }
+    if (execution.atMostOnce !== true || execution.idempotencyRequired !== true)
+        errors.push("High-risk v0.1 contracts require at-most-once grant use and target idempotency.");
+    if (!must.length)
+        errors.push("$.effect.must must contain at least one independently observable predicate.");
+    if (errors.length)
+        throw new Error(`Invalid Assurance Contract:\n${errors.map((error) => `- ${error}`).join("\n")}`);
+    return structuredClone(input);
+}
+export function compileAssuranceContract(input) {
+    const contract = validateAssuranceContract(input);
+    const sourceContractDigest = sha256Canonical(contract);
+    const artifacts = {
+        capabilityRegistration: contract.capability,
+        runtimePolicyInput: { ...contract.authority, contractDigest: sourceContractDigest },
+        approvalPresentation: { capability: contract.capability.id, action: contract.capability.action, resourceType: contract.authority.resourceScope.type, exactActionDigestRequired: true },
+        executionGrantBindingTemplate: {
+            contractDigest: sourceContractDigest,
+            policyRef: contract.authority.policyRef,
+            mandateRef: contract.authority.mandateRef,
+            agentId: contract.subject.agentId,
+            environment: contract.subject.environment,
+            maxUses: 1,
+        },
+        outcomeProbeSpecification: { ...contract.observation, ...contract.effect },
+        evidenceObligations: [...contract.evidence.require].sort(),
+        privacyObligations: contract.privacy,
+        revalidationFingerprint: sha256Canonical({ triggers: contract.revalidation.triggers, values: revalidationValues(contract) }),
+    };
+    return {
+        schemaVersion: COMPILED_CONTRACT_VERSION,
+        compilerVersion: ASSURANCE_COMPILER_VERSION,
+        canonicalizationVersion: WITNORA_CANONICALIZATION_VERSION,
+        sourceContractDigest,
+        ...artifacts,
+        artifactDigests: Object.fromEntries(Object.entries(artifacts).map(([key, value]) => [key, sha256Canonical(value)])),
+    };
+}
+export function parseContractDurationMs(value) {
+    const match = /^(\d+(?:\.\d+)?)(ms|s|m|h|d)$/.exec(value);
+    if (!match)
+        return undefined;
+    const amount = Number(match[1]);
+    const multiplier = { ms: 1, s: 1_000, m: 60_000, h: 3_600_000, d: 86_400_000 }[match[2]];
+    if (multiplier === undefined)
+        return undefined;
+    const result = amount * multiplier;
+    return Number.isFinite(result) && result > 0 ? result : undefined;
+}
+export function diffAssuranceContracts(previousInput, nextInput) {
+    const previous = validateAssuranceContract(previousInput);
+    const next = validateAssuranceContract(nextInput);
+    const changedPaths = changed(previous, next);
+    const reasons = new Set();
+    if (changedPaths.some((path) => path.startsWith("capability")))
+        reasons.add("CAPABILITY_CHANGED");
+    if (changedPaths.some((path) => path.startsWith("authority.resourceScope")))
+        reasons.add("RESOURCE_SCOPE_CHANGED");
+    if (changedPaths.some((path) => path.startsWith("authority.approval")))
+        reasons.add("APPROVAL_REQUIREMENT_CHANGED");
+    if (changedPaths.some((path) => path.startsWith("authority.policyRef")))
+        reasons.add("POLICY_VERSION_CHANGED");
+    if (changedPaths.some((path) => path.startsWith("effect") || path.startsWith("observation")))
+        reasons.add("OUTCOME_SEMANTICS_CHANGED");
+    if (changedPaths.some((path) => path.startsWith("privacy")))
+        reasons.add("PRIVACY_DISCLOSURE_CHANGED");
+    if (changedPaths.some((path) => path.startsWith("subject")))
+        reasons.add("SUBJECT_SCOPE_CHANGED");
+    const authorityExpanded = scopeExpanded(previous, next);
+    if (authorityExpanded)
+        reasons.add("AUTHORITY_EXPANDED");
+    return {
+        schemaVersion: "witnora.assurance_contract_diff.v0.1",
+        revalidationRequired: reasons.size > 0,
+        authorityExpanded,
+        reasons: [...reasons].sort(),
+        changedPaths,
+    };
+}
+export function exampleAssuranceContract() {
+    return {
+        kind: ASSURANCE_CONTRACT_VERSION,
+        metadata: { id: "record-submit", version: 1, description: "Submit one record through a controlled action path." },
+        subject: { agentId: "example-workflow-agent", environment: "sandbox" },
+        capability: { id: "record.submit", action: "SUBMIT", sideEffect: true, risk: "high" },
+        authority: {
+            mandateRef: "mandate:record-submit:v1",
+            policyRef: "policy:high-risk-submit:v1",
+            approval: { required: true },
+            resourceScope: { type: "record", pattern: "sandbox/*" },
+        },
+        preconditions: [{ path: "status", operator: "equals", value: "DRAFT" }],
+        effect: {
+            eventuallyWithin: "30s",
+            must: [{ path: "status", operator: "equals", value: "SUBMITTED" }],
+            mustNot: [{ path: "prohibitedSideEffect", operator: "equals", value: true }],
+        },
+        execution: { atMostOnce: true, idempotencyRequired: true, retryPolicy: { maxAttempts: 1 } },
+        observation: { mode: "independent_read_path", probeRef: "probe:record-status:v1", reconcileWithTargetAuditLog: true },
+        privacy: {
+            localOnly: ["prompt", "agentSource", "credentials", "rawArguments", "rawResult"],
+            disclose: ["actionType", "policyDecision", "outcomeStatus"],
+            commitOnly: ["resourceId", "canonicalAction"],
+        },
+        evidence: { require: ["sourceSignature", "serverReceipt", "grantBinding", "outcomeObservation", "sequenceContinuity"] },
+        revalidation: { triggers: ["agentVersion", "modelVersion", "promptDigest", "toolSchemaDigest", "policyVersion", "probeVersion"] },
+    };
+}
+export function resourceMatchesScope(scope, resourceId) {
+    if (!scope.type || !resourceId)
+        return false;
+    const wildcard = scope.pattern.indexOf("*");
+    if (wildcard < 0)
+        return resourceId === scope.pattern;
+    if (wildcard !== scope.pattern.length - 1 || scope.pattern.indexOf("*", wildcard + 1) >= 0)
+        return false;
+    return resourceId.startsWith(scope.pattern.slice(0, -1));
+}
+export function renderContractExplanation(contract) {
+    const compiled = compileAssuranceContract(contract);
+    return [
+        `Contract valid: ${contract.metadata.id} v${contract.metadata.version}`,
+        `Contract digest: ${compiled.sourceContractDigest}`,
+        `Capability: ${contract.capability.id} (${contract.capability.action}, ${contract.capability.risk} risk)`,
+        `Approval: ${contract.authority.approval.required ? "required and bound to exact action digest" : "not required"}`,
+        `Outcome probe: ${contract.observation.probeRef} via ${contract.observation.mode}`,
+        `Cloud disclosure: ${contract.privacy.disclose.join(", ") || "none"}`,
+        `Commitment only: ${contract.privacy.commitOnly.join(", ") || "none"}`,
+        `Local only: ${contract.privacy.localOnly.join(", ") || "none"}`,
+        `Revalidation triggers: ${contract.revalidation.triggers.join(", ")}`,
+        "Enforcement caveat: this contract covers only dispatches mediated by a credential-isolated Gateway.",
+    ].join("\n") + "\n";
+}
+function revalidationValues(contract) {
+    return {
+        agentId: contract.subject.agentId,
+        environment: contract.subject.environment,
+        capability: contract.capability,
+        authority: contract.authority,
+        effect: contract.effect,
+        observation: contract.observation,
+        privacy: contract.privacy,
+    };
+}
+function scopeExpanded(previous, next) {
+    if (previous.authority.resourceScope.pattern !== next.authority.resourceScope.pattern && next.authority.resourceScope.pattern === "*")
+        return true;
+    if (previous.authority.approval.required && !next.authority.approval.required)
+        return true;
+    if (!previous.capability.sideEffect && next.capability.sideEffect)
+        return true;
+    const rank = { low: 0, medium: 1, high: 2, critical: 3 };
+    return rank[next.capability.risk] > rank[previous.capability.risk];
+}
+function changed(previous, next, path = "") {
+    if (canonicalJson(previous) === canonicalJson(next))
+        return [];
+    if (Array.isArray(previous) || Array.isArray(next) || !previous || !next || typeof previous !== "object" || typeof next !== "object")
+        return [path || "$"];
+    const left = previous;
+    const right = next;
+    return [...new Set([...Object.keys(left), ...Object.keys(right)])].sort().flatMap((key) => changed(left[key], right[key], path ? `${path}.${key}` : key));
+}
+function predicates(value, path, errors) {
+    if (!Array.isArray(value)) {
+        errors.push(`${path} must be an array.`);
+        return [];
+    }
+    return value.map((item, index) => {
+        const itemPath = `${path}[${index}]`;
+        const result = object(item, itemPath, errors);
+        exactKeys(result, ["path", "operator", "value"], itemPath, errors, ["value"]);
+        requiredString(result.path, `${itemPath}.path`, errors);
+        oneOf(result.operator, ["equals", "not_equals", "exists", "not_exists", "contains", "count"], `${itemPath}.operator`, errors);
+        if (!["exists", "not_exists"].includes(String(result.operator)) && result.value === undefined)
+            errors.push(`${itemPath}.value is required for ${String(result.operator)}.`);
+        return result;
+    });
+}
+function object(value, path, errors) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        errors.push(`${path} must be an object.`);
+        return {};
+    }
+    return value;
+}
+function exactKeys(value, allowed, path, errors, optional = []) {
+    for (const key of Object.keys(value))
+        if (!allowed.includes(key))
+            errors.push(`${path}.${key} is not allowed.`);
+    for (const key of allowed)
+        if (!optional.includes(key) && !(key in value))
+            errors.push(`${path}.${key} is required.`);
+}
+function requiredString(value, path, errors) {
+    if (typeof value !== "string" || !value.trim())
+        errors.push(`${path} must be a non-empty string.`);
+}
+function strings(value, path, errors) {
+    if (!Array.isArray(value)) {
+        errors.push(`${path} must be an array.`);
+        return [];
+    }
+    const output = [];
+    value.forEach((item, index) => { requiredString(item, `${path}[${index}]`, errors); if (typeof item === "string")
+        output.push(item); });
+    if (new Set(output).size !== output.length)
+        errors.push(`${path} must not contain duplicates.`);
+    return output;
+}
+function positiveInteger(value, path, errors) {
+    if (!Number.isSafeInteger(value) || Number(value) <= 0)
+        errors.push(`${path} must be a positive safe integer.`);
+}
+function bool(value, path, errors) {
+    if (typeof value !== "boolean")
+        errors.push(`${path} must be Boolean.`);
+}
+function oneOf(value, allowed, path, errors) {
+    if (typeof value !== "string" || !allowed.includes(value))
+        errors.push(`${path} must be one of ${allowed.join(", ")}.`);
+}

package/dist/assurance-loop-demo.js

@@ -0,0 +1,245 @@
+import { createHash, generateKeyPairSync, randomBytes, randomUUID, sign } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { compileAssuranceContract, diffAssuranceContracts, exampleAssuranceContract, resourceMatchesScope } from "./assurance-contract.js";
+import { canonicalJson, sha256Canonical } from "./canonical.js";
+import { serverAttestedValue, sourceSignedValue, outcomeProbeSignedValue, preconditionProbeSignedValue, resourceScopeProofSignedValue, verifyEvidencePacket, } from "./offline-verifier.js";
+import { examplePrivacyManifest, transformForEgress } from "./privacy-manifest.js";
+import { evaluateOutcome } from "./outcome-evaluator.js";
+export async function runAssuranceLoopDemo(options) {
+    const now = options.now ?? new Date();
+    const attack = options.attack ?? "none";
+    const contract = exampleAssuranceContract();
+    const compiledContract = compileAssuranceContract(contract);
+    const privacyManifest = examplePrivacyManifest();
+    const privacyInput = {
+        actionType: "SUBMIT",
+        outcomeStatus: "SATISFIED",
+        policyDecision: "REQUIRE_APPROVAL",
+        resourceId: "sandbox/record-001",
+        actionParameters: { expectedRevision: 1, status: "SUBMITTED" },
+        prompt: "Confidential local task context",
+        credentials: "local-demo-write-credential",
+        rawResult: { id: "record-001", status: "SUBMITTED", revision: 2 },
+    };
+    const privacy = transformForEgress(privacyInput, privacyManifest, randomBytes(32));
+    const resourceScopeAllowed = resourceMatchesScope(contract.authority.resourceScope, privacyInput.resourceId);
+    const canonicalAction = {
+        tenantRef: "tenant:local-demo",
+        projectRef: "project:assurance-loop",
+        agentRef: "agent:example-workflow-agent",
+        agentVersion: "1.0.0",
+        environment: "sandbox",
+        capability: contract.capability.id,
+        action: contract.capability.action,
+        resourceCommitment: privacy.commitments.resourceId.digest,
+        parameterCommitment: privacy.commitments.actionParameters.digest,
+        outcomePredicateDigest: sha256Canonical(contract.effect),
+        contractDigest: compiledContract.sourceContractDigest,
+        policyRef: contract.authority.policyRef,
+        mandateRef: contract.authority.mandateRef,
+    };
+    const actionDigest = sha256Canonical(canonicalAction);
+    const target = new LocalReferenceTarget();
+    const before = target.read("record-001");
+    if (before.status !== "DRAFT")
+        throw new Error("Reference target precondition failed.");
+    const preconditionObservedAt = new Date(now.getTime() + 10).toISOString();
+    const policy = { decision: "REQUIRE_APPROVAL", actionDigest, policyRef: contract.authority.policyRef };
+    const approval = {
+        approved: true,
+        actionDigest,
+        tenantRef: String(canonicalAction.tenantRef),
+        agentRef: String(canonicalAction.agentRef),
+        environment: String(canonicalAction.environment),
+        contractDigest: compiledContract.sourceContractDigest,
+        policyRef: contract.authority.policyRef,
+        resourceCommitment: String(canonicalAction.resourceCommitment),
+        expiresAt: new Date(now.getTime() + 2 * 60_000).toISOString(),
+        approverRef: "reviewer:local-demo",
+    };
+    const grant = {
+        id: `grant_${randomUUID()}`,
+        tenantRef: String(canonicalAction.tenantRef),
+        agentRef: String(canonicalAction.agentRef),
+        environment: String(canonicalAction.environment),
+        actionDigest,
+        contractDigest: compiledContract.sourceContractDigest,
+        policyRef: contract.authority.policyRef,
+        mandateRef: contract.authority.mandateRef,
+        resourceCommitment: String(canonicalAction.resourceCommitment),
+        maxUses: 1,
+        consumedCount: 0,
+        issuedAt: now.toISOString(),
+        expiresAt: new Date(now.getTime() + 5 * 60_000).toISOString(),
+    };
+    const grants = new AtomicLocalGrantStore();
+    grants.issue(grant.id);
+    grants.consume(grant.id);
+    grant.consumedCount = 1;
+    // The only write credential exists inside this controlled adapter boundary.
+    target.controlledSubmit("record-001", { status: "SUBMITTED", expectedRevision: 1 }, actionDigest);
+    const observed = target.read("record-001");
+    const audit = target.auditSince(0);
+    const targetAuditReconciled = audit.length === 1 && audit[0].actionDigest === actionDigest && audit[0].revision === observed.revision;
+    const normalizedObservation = { status: observed.status, prohibitedSideEffect: false };
+    const outcomeEvaluation = evaluateOutcome(contract.effect, normalizedObservation, { targetAuditReconciled });
+    const outcomeSatisfied = outcomeEvaluation.status === "VERIFIED";
+    const eventPayloads = [
+        ["witnora.run.started", { collector: "local-reference-collector", actionDigest }],
+        ["witnora.precondition.observed", { status: "SATISFIED", rawObservationCommitment: sha256Canonical(before) }],
+        ["witnora.policy.evaluated", policy],
+        ["witnora.approval.recorded", approval],
+        ["witnora.grant.consumed", { grantId: grant.id, actionDigest }],
+        ["witnora.action.executed", { actionDigest, adapter: "local-reference-target" }],
+        ["witnora.outcome.observed", { status: outcomeEvaluation.status, rawObservationCommitment: sha256Canonical(observed) }],
+        ["witnora.run.completed", { droppedEvents: 0, targetAuditReconciled }],
+    ];
+    const events = eventPayloads.reduce((result, [type, payload], index) => {
+        const previousHash = result.at(-1)?.eventHash ?? null;
+        const base = { sequence: index + 1, type, occurredAt: new Date(now.getTime() + index * 10).toISOString(), previousHash, payloadDigest: sha256Canonical(payload) };
+        result.push({ ...base, eventHash: sha256Canonical(base) });
+        return result;
+    }, []);
+    const artifactContent = Buffer.from(JSON.stringify({ before, observed, targetAuditReconciled }, null, 2));
+    const artifactBase64 = artifactContent.toString("base64");
+    const sourceKeys = generateKeyPairSync("ed25519");
+    const serverKeys = generateKeyPairSync("ed25519");
+    const probeKeys = generateKeyPairSync("ed25519");
+    const scopeKeys = generateKeyPairSync("ed25519");
+    const packet = {
+        schemaVersion: "witnora.verifiable_evidence_packet.v0.1",
+        packetId: `packet_${randomUUID()}`,
+        issuedAt: now.toISOString(),
+        contract,
+        compiledContract,
+        privacy: { manifest: privacyManifest, transformed: privacy },
+        action: { canonical: canonicalAction, digest: actionDigest },
+        precondition: {
+            status: "SATISFIED",
+            normalizedObservation: { status: before.status },
+            rawObservationCommitment: sha256Canonical(before),
+            observedAt: preconditionObservedAt,
+            dataFreshnessMs: 0,
+            probeRef: contract.observation.probeRef,
+            probeVersion: "1.0.0",
+            probeDigest: sha256Canonical({ implementation: "local-reference-read-path", version: "1.0.0" }),
+            observationSource: "local-reference-target/read-only",
+            independentReadPath: true,
+            probeSignature: emptySignature(),
+        },
+        resourceScopeProof: {
+            decision: resourceScopeAllowed ? "ALLOW" : "DENY",
+            contractScopeDigest: sha256Canonical(contract.authority.resourceScope),
+            resourceCommitment: String(canonicalAction.resourceCommitment),
+            evaluatedAt: new Date(now.getTime() + 15).toISOString(),
+            evaluatorRef: "local-policy-gateway-v1",
+            signature: emptySignature(),
+        },
+        policy,
+        approval,
+        grant,
+        events,
+        outcome: {
+            status: outcomeEvaluation.status,
+            expectedDigest: sha256Canonical(contract.effect),
+            normalizedObservation,
+            rawObservationCommitment: sha256Canonical(observed),
+            observedAt: new Date(now.getTime() + 60).toISOString(),
+            firstSatisfiedAt: new Date(now.getTime() + 60).toISOString(),
+            dataFreshnessMs: 0,
+            probeRef: contract.observation.probeRef,
+            probeVersion: "1.0.0",
+            probeDigest: sha256Canonical({ implementation: "local-reference-read-path", version: "1.0.0" }),
+            observationSource: "local-reference-target/read-only",
+            independentReadPath: true,
+            targetAuditReconciled,
+            probeSignature: emptySignature(),
+        },
+        artifacts: [{
+                path: "outcome-observation.json",
+                kind: "outcome_observation",
+                size: artifactContent.byteLength,
+                sha256: createHash("sha256").update(artifactContent).digest("hex"),
+                contentBase64: artifactBase64,
+            }],
+        evidenceStrength: { reported: true, recorded: true, enforced: true, outcomeVerified: outcomeSatisfied && targetAuditReconciled, independentlyReviewed: false },
+        sourceSignature: emptySignature(),
+        serverAttestation: emptySignature(),
+    };
+    packet.resourceScopeProof.signature = signValue(resourceScopeProofSignedValue(packet), "local-scope-evaluator-v1", scopeKeys.privateKey, scopeKeys.publicKey.export({ type: "spki", format: "pem" }).toString());
+    packet.precondition.probeSignature = signValue(preconditionProbeSignedValue(packet), "local-outcome-probe-v1", probeKeys.privateKey, probeKeys.publicKey.export({ type: "spki", format: "pem" }).toString());
+    packet.outcome.probeSignature = signValue(outcomeProbeSignedValue(packet), "local-outcome-probe-v1", probeKeys.privateKey, probeKeys.publicKey.export({ type: "spki", format: "pem" }).toString());
+    packet.sourceSignature = signValue(sourceSignedValue(packet), "local-source-v1", sourceKeys.privateKey, sourceKeys.publicKey.export({ type: "spki", format: "pem" }).toString());
+    packet.serverAttestation = signValue(serverAttestedValue(packet), "local-reference-server-v1", serverKeys.privateKey, serverKeys.publicKey.export({ type: "spki", format: "pem" }).toString());
+    applyAttack(packet, attack);
+    const trustBundle = {
+        schemaVersion: "witnora.verification_trust_bundle.v0.1",
+        keys: {
+            "local-source-v1": trustKey(sourceKeys.publicKey.export({ type: "spki", format: "pem" }).toString(), "source"),
+            "local-reference-server-v1": trustKey(serverKeys.publicKey.export({ type: "spki", format: "pem" }).toString(), "server_attestor"),
+            "local-outcome-probe-v1": trustKey(probeKeys.publicKey.export({ type: "spki", format: "pem" }).toString(), "outcome_probe"),
+            "local-scope-evaluator-v1": trustKey(scopeKeys.publicKey.export({ type: "spki", format: "pem" }).toString(), "resource_scope_evaluator"),
+        },
+    };
+    const report = verifyEvidencePacket(packet, new Date(now.getTime() + 1_000), trustBundle);
+    const changed = structuredClone(contract);
+    changed.subject.agentId = `${contract.subject.agentId}-v2`;
+    const revalidation = diffAssuranceContracts(contract, changed);
+    const outDir = resolve(options.outDir);
+    await mkdir(outDir, { recursive: true });
+    const packetPath = resolve(outDir, "witnora-evidence-packet.json");
+    const reportPath = resolve(outDir, "witnora-offline-verification.json");
+    const revalidationPath = resolve(outDir, "witnora-revalidation-diff.json");
+    const trustBundlePath = resolve(outDir, "witnora-trust-bundle.json");
+    await Promise.all([
+        writeFile(packetPath, `${JSON.stringify(packet, null, 2)}\n`, "utf8"),
+        writeFile(reportPath, `${JSON.stringify(report, null, 2)}\n`, "utf8"),
+        writeFile(revalidationPath, `${JSON.stringify(revalidation, null, 2)}\n`, "utf8"),
+        writeFile(trustBundlePath, `${JSON.stringify(trustBundle, null, 2)}\n`, "utf8"),
+    ]);
+    return { packet, report, packetPath, reportPath, revalidationPath, trustBundlePath };
+}
+class LocalReferenceTarget {
+    record = { id: "record-001", status: "DRAFT", revision: 1 };
+    audit = [];
+    read(id) {
+        if (id !== this.record.id)
+            throw new Error("Record not found.");
+        return structuredClone(this.record);
+    }
+    controlledSubmit(id, input, actionDigest) {
+        if (id !== this.record.id || input.status !== "SUBMITTED" || input.expectedRevision !== this.record.revision)
+            throw new Error("Controlled execution rejected.");
+        this.record = { ...this.record, status: input.status, revision: this.record.revision + 1 };
+        this.audit.push({ sequence: this.audit.length + 1, actionDigest, revision: this.record.revision });
+    }
+    auditSince(sequence) {
+        return structuredClone(this.audit.filter((entry) => entry.sequence > sequence));
+    }
+}
+class AtomicLocalGrantStore {
+    state = new Map();
+    issue(id) { if (this.state.has(id))
+        throw new Error("Grant already exists."); this.state.set(id, "ISSUED"); }
+    consume(id) { if (this.state.get(id) !== "ISSUED")
+        throw new Error("Grant replay rejected."); this.state.set(id, "CONSUMED"); }
+}
+function signValue(value, keyId, privateKey, publicKeyPem) {
+    return { keyId, algorithm: "Ed25519", publicKeyPem, valueDigest: sha256Canonical(value), signature: sign(null, Buffer.from(canonicalJson(value)), privateKey).toString("base64") };
+}
+function emptySignature() { return { keyId: "", algorithm: "Ed25519", publicKeyPem: "", valueDigest: "", signature: "" }; }
+function trustKey(publicKeyPem, usage) {
+    return { publicKeyPem, usage, tenantRef: "tenant:local-demo", projectRef: "project:assurance-loop", environment: "sandbox" };
+}
+function applyAttack(packet, attack) {
+    if (attack === "parameter-substitution")
+        packet.action.canonical.parameterCommitment = "0".repeat(64);
+    if (attack === "replay")
+        packet.grant.consumedCount = 2;
+    if (attack === "false-success") {
+        packet.outcome.normalizedObservation = { status: "DRAFT", prohibitedSideEffect: false };
+    }
+    if (attack === "event-tamper")
+        packet.events[2].payloadDigest = "f".repeat(64);
+}