witnora 0.11.0 → 0.12.0

package/README.md

@@ -13,18 +13,21 @@ outcome. It writes portable reports and accumulates a local failure corpus.
 
 ## 5-minute hosted path
 
-Create a Hosted project, open a terminal in the agent repository, and run the
-one command shown by Witnora:
+Create a Hosted project. The Setup Wizard pre-fills a metadata-only plan and
+asks for two decisions: **Confirm plan** and **Authorize install**. Then open a
+terminal in the agent repository and run the one command shown by Witnora:
 
 ```bash
 npx witnora@latest onboard --project your-project-id
 ```
 
-The browser approval creates a restricted project credential without exposing
-it in Hosted, then the CLI saves it outside the repository, detects the agent
-boundary, writes only missing configuration, and verifies the local evidence
-path. `.witnora/onboarding/receipt.json` is synthetic: it cannot create a run,
-evidence object, release decision, or `CURRENT` assurance.
+The browser approval creates one restricted project credential, then the CLI
+saves it outside the repository, detects capability groups, and installs only
+missing Gateway, outcome-probe, CI, policy, review, configuration, and boundary
+files. It verifies each component and reports progress to Hosted. A failed
+attempt removes only files created by that attempt. The onboarding receipt is
+synthetic: it cannot create a run, evidence object, release decision, or
+`CURRENT` assurance.
 
 Onboarding also performs the default private capability discovery locally. It
 does not read source-file contents or upload source code, prompt text,
@@ -42,12 +45,10 @@ explicit GitHub authorization and is never enabled implicitly.
 
 ### Customer-owned Gateway
 
-For a durable recorder that runs beside the Agent in the customer environment,
-choose **Customer-owned Gateway** in Hosted and run:
+The default Setup Wizard installs a durable customer-owned Gateway beside the
+Agent automatically. Start it, then run the Agent's normal sandbox workflow:
 
 ```bash
-npx witnora@latest gateway init --project your-project-id
-npx witnora@latest gateway doctor
 npx witnora@latest gateway run
 ```
 
@@ -56,20 +57,28 @@ Initialization writes a reusable `.witnora/gateway/client.mjs`. Import its
 workflow boundary. The generated README contains the exact code and privacy
 boundary; no Hosted key or source-signing key is written into the repository.
 
-The browser approval issues only `runs:read`, `events:write`, and
-`collector:manage`. The Hosted key is stored in the user's Witnora credential
-directory; the repository contains only metadata-only config plus ignored local
-secrets and queue data. This reference path establishes **RECORDED** evidence.
+The browser approval issues one bounded credential for setup, evidence, the
+customer-owned recorder, and covered runtime actions. It has no team,
+retention, administrative, target-system, or customer-data permissions. The
+Hosted key is stored in the user's Witnora credential directory; the repository
+contains only metadata-only config plus ignored local secrets and queue data.
+This reference path establishes **RECORDED** evidence.
 It does not claim **ENFORCED** until target write credentials are placed behind a
 controlled execution adapter, or **OUTCOME VERIFIED** until an independent
 read-only probe checks the target state.
 
+Enterprises that require self-hosted or manual component control can use the
+individual `gateway init`, `gateway doctor`, policy, probe, CI, and review
+commands under Hosted **Advanced**. They are not part of the default customer
+journey.
+
 After the connection self-test, Hosted shows one template-specific next step.
-Place the generated boundary in one meaningful sandbox workflow and run it
-normally. The generated local adapter reuses the saved restricted connection;
-CI and production should use the same project-scoped values from a secret
-manager. The first non-synthetic run completes onboarding, but remains
-`reported` evidence and does not establish a release decision or `CURRENT`.
+Place the generated Gateway client at one meaningful sandbox boundary and run
+it normally. The Gateway reuses the saved restricted connection; CI and
+production should use the same project-scoped values from a secret manager.
+Only a source-signed Gateway run whose journal is reconciled by Hosted completes
+onboarding. A direct run is still visible, but cannot verify the Gateway or
+establish a release decision or `CURRENT` assurance.
 
 Without an agent repository, run `npx witnora@latest try --template workflow`
 for an offline-only sample.

package/dist/gateway.js

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-import { access, chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { access, chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import { loadConnection } from "./credentials.js";
 import { authorizeProjectConnection } from "./device-authorization.js";
@@ -11,30 +11,27 @@ export async function initializeCustomerGateway(options) {
     const output = options.output ?? ((message) => process.stdout.write(message));
     const slug = safeSlug(basename(repository));
     const connectionName = options.connectionName ?? `${slug}-gateway`;
-    const configPath = join(outDir, "gateway.json");
-    const secretsPath = join(outDir, "secrets.json");
-    const gitignorePath = join(outDir, ".gitignore");
-    const readmePath = join(outDir, "README.md");
-    const clientPath = join(outDir, "client.mjs");
+    const [configPath, secretsPath, gitignorePath, clientPath, readmePath] = gatewayPaths(outDir);
     if (!(options.force ?? false)) {
-        const existing = (await Promise.all([configPath, secretsPath, gitignorePath, readmePath, clientPath].map(async (path) => await exists(path) ? path : undefined)))
-            .filter((path) => path !== undefined);
+        const { existing } = await inspectCustomerGatewayFiles({ repository, outDir });
         if (existing.length > 0) {
             throw new Error(`Gateway setup already exists at ${existing.join(", ")}. Use --force only after reviewing the existing local setup.`);
         }
     }
-    const authorization = await authorizeProjectConnection({
-        projectId: options.projectId,
-        connectionName,
-        credentialProfile: "customer_gateway",
-        server: options.server,
-        openBrowser: options.openBrowser,
-        fetch: options.fetch,
-        sleep: options.sleep,
-        timeoutMs: options.timeoutMs,
-        output,
-        configHome: options.configHome,
-    });
+    const authorization = options.authorization
+        ? options.authorization
+        : await authorizeProjectConnection({
+            projectId: options.projectId,
+            connectionName,
+            credentialProfile: "customer_gateway",
+            server: options.server,
+            openBrowser: options.openBrowser,
+            fetch: options.fetch,
+            sleep: options.sleep,
+            timeoutMs: options.timeoutMs,
+            output,
+            configHome: options.configHome,
+        });
     const expectedScopes = ["runs:read", "events:write", "collector:manage"];
     const missingScopes = expectedScopes.filter((scope) => !authorization.scopes.includes(scope));
     if (missingScopes.length > 0)
@@ -45,8 +42,8 @@ export async function initializeCustomerGateway(options) {
         server: authorization.server,
         connectionName: authorization.connectionName,
         collectorId: `${slug}-collector`,
-        host: "127.0.0.1",
-        port: 8787,
+        host: process.env.WITNORA_GATEWAY_HOST?.trim() || "127.0.0.1",
+        port: gatewayPort(process.env.WITNORA_GATEWAY_PORT, 8787),
         storageDirectory: "data",
         privacyMode: "metadata_only",
         coverage: { recorded: "configured", enforced: "not_configured", outcomeVerified: "not_configured" },
@@ -56,11 +53,28 @@ export async function initializeCustomerGateway(options) {
         gatewayToken: randomBytes(32).toString("base64url"),
     };
     await mkdir(outDir, { recursive: true });
-    await writeExclusive(configPath, `${JSON.stringify(config, null, 2)}\n`, options.force ?? false, 0o644);
-    await writeExclusive(secretsPath, `${JSON.stringify(secrets, null, 2)}\n`, options.force ?? false, 0o600);
-    await writeExclusive(gitignorePath, "secrets.json\ndata/\n", options.force ?? false, 0o644);
-    await writeExclusive(clientPath, gatewayClient(config), options.force ?? false, 0o644);
-    await writeExclusive(readmePath, gatewayReadme(config), options.force ?? false, 0o644);
+    const generatedFiles = [];
+    const force = options.force ?? false;
+    try {
+        for (const [path, content, mode] of [
+            [configPath, `${JSON.stringify(config, null, 2)}\n`, 0o644],
+            [secretsPath, `${JSON.stringify(secrets, null, 2)}\n`, 0o600],
+            [gitignorePath, "secrets.json\ndata/\n", 0o644],
+            [clientPath, gatewayClient(config), 0o644],
+            [readmePath, gatewayReadme(config), 0o644],
+        ]) {
+            await writeExclusive(path, content, force, mode);
+            if (!force)
+                generatedFiles.push(path);
+        }
+    }
+    catch (error) {
+        if (!force) {
+            for (const path of [...generatedFiles].reverse())
+                await rm(path, { force: true }).catch(() => undefined);
+        }
+        throw error;
+    }
     output("\nCustomer-owned Gateway initialized.\n");
     output(`Configuration: ${configPath}\nLocal secret: ${secretsPath} (never commit or upload)\n`);
     output("Next:\n");
@@ -69,7 +83,22 @@ export async function initializeCustomerGateway(options) {
     output("  3. Import .witnora/gateway/client.mjs at one sandbox workflow boundary.\n");
     output("  4. Run that workflow normally; start, event, and complete are recorded locally.\n");
     output("This reference path establishes RECORDED evidence only. ENFORCED requires target write credentials behind a controlled execution adapter; OUTCOME VERIFIED requires a separate read-only probe.\n");
-    return { configPath, secretsPath, config };
+    return { configPath, secretsPath, config, generatedFiles };
+}
+export async function inspectCustomerGatewayFiles(options) {
+    const repository = resolve(options.repository ?? process.cwd());
+    const directory = resolve(repository, options.outDir ?? ".witnora/gateway");
+    const paths = gatewayPaths(directory);
+    const states = await Promise.all(paths.map(async (path) => ({ path, exists: await exists(path) })));
+    const existing = states.filter((item) => item.exists).map((item) => item.path);
+    const missing = states.filter((item) => !item.exists).map((item) => item.path);
+    return {
+        status: existing.length === 0 ? "absent" : missing.length === 0 ? "complete" : "partial",
+        directory,
+        paths,
+        existing,
+        missing,
+    };
 }
 export async function doctorCustomerGateway(options) {
     const directory = resolve(options.repository ?? process.cwd(), options.dir ?? ".witnora/gateway");
@@ -142,8 +171,8 @@ export async function runCustomerGateway(options) {
         keyRing,
         gatewayToken: secrets.gatewayToken,
         storageDirectory: dataDirectory,
-        host: config.host,
-        port: config.port,
+        host: process.env.WITNORA_GATEWAY_HOST?.trim() || config.host,
+        port: gatewayPort(process.env.WITNORA_GATEWAY_PORT, config.port),
         environment: "customer-owned",
     });
     process.stdout.write(`Witnora customer-owned Gateway listening on ${gateway.baseUrl}\n`);
@@ -179,6 +208,15 @@ function parseSecrets(raw) {
     }
     return value;
 }
+function gatewayPort(value, fallback) {
+    if (!value?.trim())
+        return fallback;
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 1 || parsed > 65_535) {
+        throw new Error("WITNORA_GATEWAY_PORT must be an integer between 1 and 65535.");
+    }
+    return parsed;
+}
 function gatewayReadme(config) {
     return `# Witnora customer-owned Gateway\n\nThis directory configures a metadata-only Gateway for project \`${config.projectId}\`.\n\n## Start the Gateway\n\n\`\`\`bash\nnpx witnora@latest gateway doctor\nnpx witnora@latest gateway run\n\`\`\`\n\nKeep \`gateway run\` open. In the Agent repository, import the generated client at one meaningful sandbox workflow boundary:\n\n\`\`\`js\nimport { randomUUID } from "node:crypto";\nimport { witnoraGateway } from "./.witnora/gateway/client.mjs";\n\nconst runId = randomUUID();\nawait witnoraGateway.start(runId, { workflow: "sandbox-workflow" });\ntry {\n  // Run the existing customer workflow here. Do not add raw inputs or outputs.\n  await witnoraGateway.event(runId, "workflow.step.completed", { step: "meaningful-boundary" });\n  await witnoraGateway.complete(runId, { status: "completed" });\n} catch (error) {\n  await witnoraGateway.event(runId, "workflow.failed", { errorType: error?.name ?? "Error" });\n  await witnoraGateway.complete(runId, { status: "failed" });\n  throw error;\n}\n\`\`\`\n\nThe generated client reads only the local ignored Gateway token and sends metadata to \`http://${config.host}:${config.port}\`. The Hosted API key and source-signing key stay in the Gateway process. Do not commit \`secrets.json\` or \`data/\`.\n\nThis reference process creates source-signed, durable **RECORDED** evidence. It does not claim complete mediation. **ENFORCED** requires the target write credential to be removed from the Agent and placed behind a controlled execution adapter. **OUTCOME VERIFIED** requires a separate read-only credential and independent probe.\n`;
 }
@@ -201,6 +239,15 @@ async function exists(path) {
         return false;
     }
 }
+function gatewayPaths(directory) {
+    return [
+        join(directory, "gateway.json"),
+        join(directory, "secrets.json"),
+        join(directory, ".gitignore"),
+        join(directory, "client.mjs"),
+        join(directory, "README.md"),
+    ];
+}
 function safeSlug(value) {
     return (value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "agent-repository").slice(0, 48);
 }

package/dist/onboard.js

@@ -1,12 +1,13 @@
 import { createHash } from "node:crypto";
-import { access, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { access, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import { DEFAULT_WITNORA_SERVER } from "./credentials.js";
 import { authorizeProjectConnection } from "./device-authorization.js";
 import { verifyControlPlaneConnection } from "./control-plane.js";
 import { inferPrivateCapabilities, runPrivateCapabilityDiscovery } from "./private-discovery.js";
-import { parseAgentTemplate, starterAdapter, starterInstructions, starterProfile, starterTripwireConfig } from "./onboarding-templates.js";
+import { parseAgentTemplate, starterAdapter, starterProfile, starterTripwireConfig } from "./onboarding-templates.js";
 import { writeTryEvidence } from "./try.js";
+import { doctorCustomerGateway, initializeCustomerGateway, inspectCustomerGatewayFiles } from "./gateway.js";
 export async function runOnboard(options) {
     const requestFetch = options.fetch ?? fetch;
     const output = options.output ?? ((message) => process.stdout.write(message));
@@ -17,7 +18,7 @@ export async function runOnboard(options) {
     const token = await authorizeProjectConnection({
         projectId: options.projectId,
         connectionName,
-        credentialProfile: "repository",
+        credentialProfile: "autopilot",
         server,
         openBrowser: options.openBrowser,
         fetch: requestFetch,
@@ -28,40 +29,124 @@ export async function runOnboard(options) {
     });
     const credentialsPath = token.credentialsPath;
     await verifyControlPlaneConnection({ baseUrl: server, projectId: token.projectId, apiKey: token.apiKey, fetch: requestFetch });
-    const generatedFiles = await generateRepositoryConfig(repositoryPath, repository.template, repository.name);
-    const selfTest = await writeTryEvidence({
-        template: repository.template,
-        subject: `witnora-onboarding-${repository.slug}`,
-        outDir: join(repositoryPath, ".witnora", "onboarding", "self-test"),
+    const planSnapshot = await jsonRequest(requestFetch, `${server}/v1/projects/${encodeURIComponent(token.projectId)}/setup-plans`, {
+        method: "GET", headers: { authorization: `Bearer ${token.apiKey}` },
     });
-    const bundleBytes = Buffer.from(`${JSON.stringify(selfTest.bundle, null, 2)}\n`);
-    const receipt = await jsonRequest(requestFetch, `${server}/v1/projects/${encodeURIComponent(token.projectId)}/onboarding/self-test`, {
-        method: "POST", headers: { authorization: `Bearer ${token.apiKey}`, "content-type": "application/json" },
-        body: JSON.stringify({
+    const setupPlan = planSnapshot.plan;
+    if (!setupPlan || !setupPlan.authorizedOperations.some((item) => item.kind === "authorize_install")) {
+        throw new Error("Confirm the Setup Plan and authorize installation in the Witnora Workspace before running onboard.");
+    }
+    const attemptId = `install-${Date.now()}-${randomSuffix()}`;
+    const generatedFiles = [];
+    await reportInstall(requestFetch, server, token.projectId, token.apiKey, setupPlan.id, { status: "installing", attemptId });
+    try {
+        generatedFiles.push(...await generateRepositoryConfig(repositoryPath, repository.template, repository.name));
+        const selfTestDir = join(repositoryPath, ".witnora", "onboarding", "self-test", attemptId);
+        const selfTest = await writeTryEvidence({
             template: repository.template,
-            repository: { kind: repository.kind, name: repository.name, fingerprintSha256: repository.fingerprintSha256 },
-            bundleSha256: createHash("sha256").update(bundleBytes).digest("hex"),
-        }),
-    });
-    const receiptPath = join(repositoryPath, ".witnora", "onboarding", "receipt.json");
-    await mkdir(dirname(receiptPath), { recursive: true });
-    await writeFile(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`);
-    const discovery = await runPrivateCapabilityDiscovery({
-        connection: { server, projectId: token.projectId, apiKey: token.apiKey },
-        repository,
-        connectionName: token.connectionName,
-        configHome: options.configHome,
-        fetch: requestFetch,
+            subject: `witnora-onboarding-${repository.slug}`,
+            outDir: selfTestDir,
+        });
+        generatedFiles.push(selfTestDir);
+        const bundleBytes = Buffer.from(`${JSON.stringify(selfTest.bundle, null, 2)}\n`);
+        const receipt = await jsonRequest(requestFetch, `${server}/v1/projects/${encodeURIComponent(token.projectId)}/onboarding/self-test`, {
+            method: "POST", headers: { authorization: `Bearer ${token.apiKey}`, "content-type": "application/json" },
+            body: JSON.stringify({
+                template: repository.template,
+                repository: { kind: repository.kind, name: repository.name, fingerprintSha256: repository.fingerprintSha256 },
+                bundleSha256: createHash("sha256").update(bundleBytes).digest("hex"),
+            }),
+        });
+        const receiptPath = join(repositoryPath, ".witnora", "onboarding", "receipts", `${attemptId}.json`);
+        await mkdir(dirname(receiptPath), { recursive: true });
+        await writeFile(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`);
+        generatedFiles.push(receiptPath);
+        const legacyReceiptPath = join(repositoryPath, ".witnora", "onboarding", "receipt.json");
+        if (!await exists(legacyReceiptPath)) {
+            await writeFile(legacyReceiptPath, `${JSON.stringify(receipt, null, 2)}\n`);
+            generatedFiles.push(legacyReceiptPath);
+        }
+        const discovery = await runPrivateCapabilityDiscovery({
+            connection: { server, projectId: token.projectId, apiKey: token.apiKey },
+            repository,
+            connectionName: token.connectionName,
+            configHome: options.configHome,
+            fetch: requestFetch,
+        });
+        const gatewayState = await inspectCustomerGatewayFiles({ repository: repositoryPath });
+        if (gatewayState.status === "partial") {
+            throw new Error(`Existing Gateway setup is incomplete. Preserve the existing files and repair or remove the partial setup in Advanced mode. Missing: ${gatewayState.missing.map((path) => basename(path)).join(", ")}.`);
+        }
+        if (gatewayState.status === "absent") {
+            const gateway = await initializeCustomerGateway({
+                projectId: token.projectId, server, repository: repositoryPath, authorization: token,
+                fetch: requestFetch, configHome: options.configHome, output,
+            });
+            generatedFiles.push(...gateway.generatedFiles);
+        }
+        else {
+            output("\nExisting complete customer-owned Gateway found; verifying and reusing it.\n");
+        }
+        generatedFiles.push(...await generateAutopilotFiles(repositoryPath, repository.name));
+        const doctor = await doctorCustomerGateway({ repository: repositoryPath, configHome: options.configHome, fetch: requestFetch });
+        if (doctor.overall !== "READY_TO_RECORD")
+            throw new Error(doctor.checks.filter((check) => check.status === "FAIL").map((check) => check.message).join(" "));
+        await reportInstall(requestFetch, server, token.projectId, token.apiKey, setupPlan.id, {
+            status: "verified", attemptId, generatedFiles: relativeGeneratedFiles(repositoryPath, generatedFiles),
+        });
+        output(`\nWitnora Setup Autopilot completed for ${repository.name}.\n`);
+        output(`Project: ${token.projectId}\nTemplate: ${repository.template} (${repository.kind})\n`);
+        output(`Credentials: ${credentialsPath}\nSelf-test receipt: ${receiptPath}\n`);
+        output(`Private discovery: ${discovery.capabilityCount} capability group(s); ${discovery.unknownCapabilityCount} pending confirmation.\n`);
+        output("Installed: customer-owned Gateway, default-deny policy, independent-probe contract, review contract, and PR/release/nightly CI.\n");
+        output("The self-test remains isolated. Start the generated Gateway and run the agent normally; the first source-signed, server-reconciled Gateway run completes onboarding.\n");
+        return { projectId: token.projectId, connectionName: token.connectionName, credentialsPath, template: repository.template,
+            repositoryKind: repository.kind, generatedFiles, receiptPath, discovery, setupPlanId: setupPlan.id,
+            gatewayDirectory: join(repositoryPath, ".witnora", "gateway") };
+    }
+    catch (error) {
+        const diagnosis = error instanceof Error ? error.message : String(error);
+        await rollbackGeneratedFiles(generatedFiles);
+        await reportInstall(requestFetch, server, token.projectId, token.apiKey, setupPlan.id, {
+            status: "failed", attemptId, generatedFiles: relativeGeneratedFiles(repositoryPath, generatedFiles), diagnosis, rolledBack: true,
+        }).catch(() => undefined);
+        throw new Error(`Witnora Setup Autopilot rolled back this install attempt: ${diagnosis}`);
+    }
+}
+async function generateAutopilotFiles(repositoryPath, subject) {
+    const files = new Map([
+        [".witnora/setup/policy.json", `${JSON.stringify({ schemaVersion: "witnora.setup_policy.v0.1", subject, unknownCapabilities: "pending_confirmation", defaultDecision: "deny", environment: "sandbox" }, null, 2)}\n`],
+        [".witnora/setup/outcome-probe.json", `${JSON.stringify({ schemaVersion: "witnora.outcome_probe_contract.v0.1", mode: "independent_read_only", credentialEnv: "WITNORA_OUTCOME_PROBE_CREDENTIAL", status: "awaiting_customer_secret", uploadsCredential: false }, null, 2)}\n`],
+        [".witnora/setup/review.json", `${JSON.stringify({ schemaVersion: "witnora.review_contract.v0.1", independentReviewRequired: true, syntheticEvidenceEligible: false }, null, 2)}\n`],
+        [".github/workflows/witnora-assurance.yml", continuousAssuranceWorkflow()],
+    ]);
+    const written = [];
+    for (const [relativePath, content] of files) {
+        const target = join(repositoryPath, relativePath);
+        if (await exists(target))
+            continue;
+        await mkdir(dirname(target), { recursive: true });
+        await writeFile(target, content);
+        written.push(target);
+    }
+    return written;
+}
+function continuousAssuranceWorkflow() {
+    return `name: Witnora assurance\non:\n  pull_request:\n  push:\n    tags: [\"v*\"]\n  schedule:\n    - cron: \"17 3 * * *\"\n  workflow_dispatch:\npermissions:\n  contents: read\njobs:\n  assurance:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 22\n      - run: npx witnora@latest release-gate --config witnora.config.json --strict\n`;
+}
+async function reportInstall(requestFetch, server, projectId, apiKey, setupPlanId, body) {
+    await jsonRequest(requestFetch, `${server}/v1/projects/${encodeURIComponent(projectId)}/setup-plans/${encodeURIComponent(setupPlanId)}/install-status`, {
+        method: "POST", headers: { authorization: `Bearer ${apiKey}`, "content-type": "application/json" }, body: JSON.stringify(body),
     });
-    output(`\nConnected ${repository.name} to Witnora.\n`);
-    output(`Project: ${token.projectId}\nTemplate: ${repository.template} (${repository.kind})\n`);
-    output(`Credentials: ${credentialsPath}\nSelf-test receipt: ${receiptPath}\n`);
-    output(`Private discovery: ${discovery.capabilityCount} capability group(s); source code, prompts, credentials, and payloads stayed local.\n`);
-    output("The synthetic self-test verified the local evidence path. It did not create a run, evidence object, release decision, or CURRENT assurance.\n");
-    output(starterInstructions(repository.template, repository.name));
-    return { projectId: token.projectId, connectionName: token.connectionName, credentialsPath, template: repository.template,
-        repositoryKind: repository.kind, generatedFiles, receiptPath, discovery };
 }
+async function rollbackGeneratedFiles(files) {
+    for (const path of [...files].reverse())
+        await rm(path, { recursive: true, force: true }).catch(() => undefined);
+}
+function relativeGeneratedFiles(repositoryPath, files) {
+    return files.map((file) => file.startsWith(repositoryPath) ? file.slice(repositoryPath.length + 1).replaceAll("\\", "/") : file).filter(Boolean);
+}
+function randomSuffix() { return Math.random().toString(36).slice(2, 10); }
 export async function inspectRepository(repositoryPath, explicitTemplate) {
     const entries = await readdir(repositoryPath, { withFileTypes: true });
     const names = entries.map((entry) => entry.name).sort();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "Apache-2.0",