witnora 0.13.11 → 0.14.0

package/dist/cli.js

@@ -246,7 +246,7 @@ else if (command === "gateway") {
             maxConcurrency: readFlag("--max-concurrency") ? Number(readFlag("--max-concurrency")) : undefined,
             force: readBoolFlag("--force"),
         });
-        process.stdout.write(`Configured the Managed Workflow Harness for ${result.config.workflowIds.length} exact Workflow Contract(s).\nConfig: ${result.path}\nRestart the managed Gateway to activate it.\n`);
+        process.stdout.write(`Configured the Managed Workflow Harness for ${result.config.workflowIds?.length ?? "all active"} Workflow Contract(s).\nConfig: ${result.path}\nRestart the managed Gateway to activate it.\n`);
     }
     else {
         throw new Error("Use witnora gateway init|doctor|start|status|logs|restart|stop|run|workflow-harness.");

package/dist/gateway.js

@@ -1,8 +1,8 @@
 import { createHash, createPrivateKey, createPublicKey, randomBytes } from "node:crypto";
 import { spawn } from "node:child_process";
 import { closeSync, openSync } from "node:fs";
-import { access, chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { basename, dirname, join, resolve } from "node:path";
+import { access, chmod, mkdir, readFile, realpath, rename, rm, writeFile } from "node:fs/promises";
+import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { loadConnection } from "./credentials.js";
 import { authorizeProjectConnection } from "./device-authorization.js";
@@ -14,6 +14,7 @@ const CONFIG_SCHEMA = "witnora.customer_gateway_setup.v0.1";
 const SECRETS_SCHEMA = "witnora.customer_gateway_local_secrets.v0.1";
 const RUNTIME_SCHEMA = "witnora.managed_gateway_runtime.v0.1";
 const WORKFLOW_HARNESS_SCHEMA = "witnora.managed_workflow_harness.v0.1";
+const MANAGED_WORKFLOW_HARNESS_SCHEMA = "witnora.managed_workflow_harness.v0.2";
 export async function initializeCustomerGateway(options) {
     const repository = resolve(options.repository ?? process.cwd());
     const outDir = resolve(repository, options.outDir ?? ".witnora/gateway");
@@ -547,6 +548,9 @@ export async function runCustomerGateway(options) {
                             fixtureReady: false,
                         } } : {}),
                 } } : {}),
+            ...(workflowHarnessConfig?.schemaVersion === MANAGED_WORKFLOW_HARNESS_SCHEMA && workflowHarness
+                ? { assuranceHarness: { status: () => workflowHarness.status() } }
+                : {}),
         });
         workflowHarness?.start();
         process.stdout.write(`Witnora customer-owned Gateway listening on ${gateway.baseUrl}\n`);
@@ -567,10 +571,24 @@ export async function runCustomerGateway(options) {
 function configManagedWorkflowHarnessImport() {
     return import(new URL("./vendor/onegent-runtime/managed-workflow-harness.js", import.meta.url).href);
 }
+function configBusinessTaskEvaluatorImport() {
+    return import(new URL("./vendor/onegent-runtime/business-task-evaluator.js", import.meta.url).href);
+}
 export async function createConfiguredWorkflowHarness(input) {
     const requestFetch = input.fetch ?? fetch;
-    const credential = await readSecretProviderHandle(input.config.evaluatorCredentialHandle);
-    const health = await requestFetch(`${input.config.evaluatorOrigin}/healthz`, {
+    let managedEvaluator;
+    let credential;
+    let evaluatorOrigin;
+    if (input.config.schemaVersion === MANAGED_WORKFLOW_HARNESS_SCHEMA) {
+        managedEvaluator = await startManagedLocalEvaluator(input.directory, input.config, input.evaluatorKit);
+        credential = managedEvaluator.credential;
+        evaluatorOrigin = managedEvaluator.origin;
+    }
+    else {
+        credential = await readSecretProviderHandle(input.config.evaluatorCredentialHandle);
+        evaluatorOrigin = input.config.evaluatorOrigin;
+    }
+    const health = await requestFetch(`${evaluatorOrigin}/healthz`, {
         headers: { authorization: `Bearer ${credential}` },
         redirect: "error",
         signal: AbortSignal.timeout(2_000),
@@ -580,6 +598,7 @@ export async function createConfiguredWorkflowHarness(input) {
         || healthBody.schemaVersion !== "witnora.business_task_evaluator.v0.1"
         || healthBody.contractSha256 !== input.config.evaluatorContractSha256
         || healthBody.ready !== true) {
+        await managedEvaluator?.close();
         throw new Error("Managed Workflow evaluator health did not match its pinned local contract.");
     }
     const hosted = input.managed.createManagedWorkflowHostedClient({
@@ -594,7 +613,7 @@ export async function createConfiguredWorkflowHarness(input) {
         checkpoints: new input.managed.FileWorkflowEvaluationCheckpointStore(join(input.directory, "data", "workflow-evaluations")),
         maxConcurrency: input.config.maxConcurrency,
         evaluate: async ({ task, evaluation }) => {
-            const response = await requestFetch(`${input.config.evaluatorOrigin}/v1/evaluate`, {
+            const response = await requestFetch(`${evaluatorOrigin}/v1/evaluate`, {
                 method: "POST",
                 headers: { authorization: `Bearer ${credential}`, "content-type": "application/json" },
                 body: JSON.stringify({ schemaVersion: "witnora.business_task_evaluation_request.v0.1", task, evaluation }),
@@ -610,12 +629,23 @@ export async function createConfiguredWorkflowHarness(input) {
     });
     let timer;
     let closing = false;
+    let lastTickAt;
+    let lastError;
     const tick = async () => {
-        const result = await worker.tick();
-        if ((result.evaluationsFailed ?? 0) > 0) {
-            process.stderr.write(`Managed Workflow Harness stopped ${result.evaluationsFailed} evaluation(s) fail-closed. ${result.limitations?.[0] ?? "Inspect the customer evaluator and retry."}\n`);
+        try {
+            const result = await worker.tick();
+            lastTickAt = new Date().toISOString();
+            lastError = (result.evaluationsFailed ?? 0) > 0 ? result.limitations?.[0] ?? "One or more evaluations failed closed." : undefined;
+            if ((result.evaluationsFailed ?? 0) > 0) {
+                process.stderr.write(`Managed Workflow Harness stopped ${result.evaluationsFailed} evaluation(s) fail-closed. ${lastError}\n`);
+            }
+            return result;
+        }
+        catch (error) {
+            lastTickAt = new Date().toISOString();
+            lastError = error instanceof Error ? error.message.slice(0, 500) : "Managed Workflow Harness tick failed.";
+            throw error;
         }
-        return result;
     };
     return {
         start() {
@@ -630,10 +660,58 @@ export async function createConfiguredWorkflowHarness(input) {
             if (timer)
                 clearInterval(timer);
             timer = undefined;
+            await managedEvaluator?.close();
+        },
+        async status() {
+            return {
+                moduleDigestSha256: input.config.schemaVersion === MANAGED_WORKFLOW_HARNESS_SCHEMA ? input.config.evaluatorModuleSha256 : input.config.evaluatorContractSha256,
+                evaluatorContractSha256: input.config.evaluatorContractSha256,
+                workerReady: !closing && !lastError,
+                ...(lastTickAt ? { lastTickAt } : {}),
+                ...(lastError ? { lastError } : {}),
+            };
         },
         tick,
     };
 }
+async function startManagedLocalEvaluator(directory, config, evaluatorKit) {
+    const repository = resolve(directory, "..", "..");
+    const modulePath = resolve(repository, config.evaluatorModulePath);
+    const repositoryRelative = relative(repository, modulePath);
+    if (!repositoryRelative || repositoryRelative.startsWith("..") || resolve(repository, repositoryRelative) !== modulePath) {
+        throw new Error("Managed evaluator module escaped the Agent repository.");
+    }
+    const [realRepository, realModulePath] = await Promise.all([realpath(repository), realpath(modulePath)]);
+    const realRelative = relative(realRepository, realModulePath);
+    if (!realRelative || realRelative.startsWith("..") || resolve(realRepository, realRelative) !== realModulePath) {
+        throw new Error("Managed evaluator module symlink escaped the Agent repository.");
+    }
+    const source = await readFile(modulePath);
+    if (createHash("sha256").update(source).digest("hex") !== config.evaluatorModuleSha256) {
+        throw new Error("Managed evaluator module digest did not match workflow-harness.json.");
+    }
+    const imported = await import(`${pathToFileURL(modulePath).href}?sha256=${config.evaluatorModuleSha256}`);
+    if (typeof imported.createWitnoraBusinessTaskEvaluatorOptions !== "function") {
+        throw new Error("Managed evaluator module did not export createWitnoraBusinessTaskEvaluatorOptions().");
+    }
+    const customerOptions = await imported.createWitnoraBusinessTaskEvaluatorOptions({
+        repository,
+        dataDirectory: join(directory, "data", "business-task-evaluator"),
+    });
+    if (!customerOptions || typeof customerOptions !== "object" || Array.isArray(customerOptions)) {
+        throw new Error("Managed evaluator module returned invalid Evaluator Kit options.");
+    }
+    const credential = randomBytes(32).toString("base64url");
+    const evaluator = (evaluatorKit ?? await configBusinessTaskEvaluatorImport()).createBusinessTaskEvaluatorServer({
+        ...customerOptions,
+        credential,
+        contractSha256: config.evaluatorContractSha256,
+        host: "127.0.0.1",
+        port: 0,
+    });
+    const started = await evaluator.start();
+    return { origin: started.origin, credential, close: () => evaluator.close() };
+}
 async function runtimeSandboxFixtureReady(config) {
     try {
         if (config.adapterId !== LOCAL_SANDBOX_ADAPTER_ID || !config.sandboxOrigin || !config.probeTargetCredentialHandle || !config.fixtureContractSha256)
@@ -1026,16 +1104,20 @@ function parseConfig(raw) {
 }
 export function parseManagedWorkflowHarnessConfig(raw) {
     const value = JSON.parse(raw);
-    if (value.schemaVersion !== WORKFLOW_HARNESS_SCHEMA
-        || value.enabled !== true
-        || !literalLoopbackOrigin(value.evaluatorOrigin)
-        || !credentialHandle(value.evaluatorCredentialHandle ?? "")
-        || !validDigest(value.evaluatorContractSha256 ?? "")
-        || !Array.isArray(value.workflowIds)
-        || !value.workflowIds.length
-        || value.workflowIds.length > 100
-        || new Set(value.workflowIds).size !== value.workflowIds.length
-        || value.workflowIds.some((id) => typeof id !== "string" || !/^[A-Za-z0-9._:-]{1,200}$/.test(id))) {
+    const workflowIds = value.workflowIds;
+    const workflowIdsValid = workflowIds === undefined || (Array.isArray(workflowIds)
+        && workflowIds.length > 0
+        && workflowIds.length <= 100
+        && new Set(workflowIds).size === workflowIds.length
+        && workflowIds.every((id) => typeof id === "string" && /^[A-Za-z0-9._:-]{1,200}$/.test(id)));
+    const external = value.schemaVersion === WORKFLOW_HARNESS_SCHEMA
+        && literalLoopbackOrigin(value.evaluatorOrigin)
+        && credentialHandle(value.evaluatorCredentialHandle ?? "")
+        && Array.isArray(workflowIds);
+    const managed = value.schemaVersion === MANAGED_WORKFLOW_HARNESS_SCHEMA
+        && safeRelativeModulePath(value.evaluatorModulePath)
+        && validDigest(value.evaluatorModuleSha256 ?? "");
+    if (value.enabled !== true || !validDigest(value.evaluatorContractSha256 ?? "") || !workflowIdsValid || (!external && !managed)) {
         throw new Error("workflow-harness.json requires an enabled, digest-pinned literal-loopback evaluator and a local credential handle.");
     }
     if (value.pollIntervalMs !== undefined && (!Number.isInteger(value.pollIntervalMs) || value.pollIntervalMs < 1_000 || value.pollIntervalMs > 60_000)) {
@@ -1046,6 +1128,56 @@ export function parseManagedWorkflowHarnessConfig(raw) {
     }
     return value;
 }
+export async function activateManagedWorkflowHarness(options) {
+    const repository = resolve(options.repository ?? process.cwd());
+    const directory = join(repository, ".witnora", "gateway");
+    if (!await exists(join(directory, "gateway.json")))
+        throw new Error("Initialize the customer-owned Gateway before activating its Assurance Harness.");
+    const absoluteModulePath = resolve(repository, options.modulePath ?? "witnora.assurance-harness.mjs");
+    const moduleRelativeToRepository = relative(repository, absoluteModulePath);
+    if (!moduleRelativeToRepository || moduleRelativeToRepository.startsWith("..") || resolve(repository, moduleRelativeToRepository) !== absoluteModulePath) {
+        throw new Error("The customer Assurance Harness module must remain inside the Agent repository.");
+    }
+    const [realRepository, realModulePath] = await Promise.all([realpath(repository), realpath(absoluteModulePath).catch(() => absoluteModulePath)]);
+    const realRelative = relative(realRepository, realModulePath);
+    if (realRelative.startsWith("..") || resolve(realRepository, realRelative) !== realModulePath) {
+        throw new Error("The customer Assurance Harness module symlink must remain inside the Agent repository.");
+    }
+    const source = await readFile(absoluteModulePath, "utf8").catch((error) => {
+        if (error.code === "ENOENT") {
+            throw new Error("No customer Assurance Harness was found. Add witnora.assurance-harness.mjs through the approved Business Task integration before activation.");
+        }
+        throw error;
+    });
+    if (!source.includes("createWitnoraBusinessTaskEvaluatorOptions")) {
+        throw new Error("The customer Assurance Harness must export createWitnoraBusinessTaskEvaluatorOptions().");
+    }
+    const digestSha256 = createHash("sha256").update(source).digest("hex");
+    const evaluatorModulePath = moduleRelativeToRepository.replaceAll("\\", "/");
+    const config = parseManagedWorkflowHarnessConfig(JSON.stringify({
+        schemaVersion: MANAGED_WORKFLOW_HARNESS_SCHEMA,
+        enabled: true,
+        evaluatorModulePath,
+        evaluatorModuleSha256: digestSha256,
+        evaluatorContractSha256: digestSha256,
+        ...(options.workflowIds ? { workflowIds: options.workflowIds } : {}),
+        ...(options.pollIntervalMs === undefined ? {} : { pollIntervalMs: options.pollIntervalMs }),
+        ...(options.maxConcurrency === undefined ? {} : { maxConcurrency: options.maxConcurrency }),
+    }));
+    const path = join(directory, "workflow-harness.json");
+    const serialized = `${JSON.stringify(config, null, 2)}\n`;
+    let created = false;
+    if (await exists(path)) {
+        const current = await readFile(path, "utf8");
+        if (current !== serialized)
+            throw new Error("Existing workflow-harness.json differs from the generated Assurance Harness binding; refusing to overwrite customer configuration.");
+    }
+    else {
+        await writeFile(path, serialized, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        created = true;
+    }
+    return { state: "READY_TO_START", path, modulePath: evaluatorModulePath, config, created };
+}
 export async function configureManagedWorkflowHarness(options) {
     const directory = resolve(options.repository ?? process.cwd(), options.dir ?? ".witnora/gateway");
     if (!await exists(join(directory, "gateway.json")))
@@ -1081,6 +1213,12 @@ function literalLoopbackOrigin(value) {
         return false;
     }
 }
+function safeRelativeModulePath(value) {
+    if (typeof value !== "string" || !value || value.length > 500 || !value.endsWith(".mjs"))
+        return false;
+    const normalized = value.replaceAll("\\", "/");
+    return !normalized.startsWith("/") && !/^[A-Za-z]:\//.test(normalized) && normalized.split("/").every((part) => part && part !== "." && part !== "..");
+}
 function validateRuntimeWorkerConfig(value) {
     if (value.enabled !== true || !value.adapterModulePath || !/^[a-f0-9]{64}$/.test(value.adapterModuleSha256)
         || !value.probeModulePath || !/^[a-f0-9]{64}$/.test(value.probeModuleSha256)

package/dist/internal/control-client/collector-gateway.d.ts

@@ -1,4 +1,4 @@
-import { CustomerSourceKeyRing, type CustomerSourceSigner, type CollectorRuntimeHeartbeat, type RuntimeReadinessBinding, type RemoteCollectorAck, type RemoteTrustedSourceRecord } from "./remote-collector.js";
+import { CustomerSourceKeyRing, type CustomerSourceSigner, type CollectorRuntimeHeartbeat, type AssuranceHarnessHeartbeat, type RuntimeReadinessBinding, type RemoteCollectorAck, type RemoteTrustedSourceRecord } from "./remote-collector.js";
 export interface RemoteCollectorTransport {
     registerSourceKey(input: {
         collectorId: string;
@@ -13,6 +13,7 @@ export interface RemoteCollectorTransport {
         pendingRecordCount: number;
         lastAckSequence?: number;
         runtime?: CollectorRuntimeHeartbeat;
+        assuranceHarness?: AssuranceHarnessHeartbeat;
     }): Promise<Record<string, unknown>>;
     reconcile(runId: string, receipt: Record<string, unknown>): Promise<Record<string, unknown>>;
     proposeAction(proposal: Record<string, unknown>, idempotencyKey: string): Promise<Record<string, unknown>>;
@@ -45,6 +46,9 @@ export interface CustomerOwnedCollectorGatewayOptions {
             workerReady?: boolean;
         };
     };
+    assuranceHarness?: {
+        status(): Promise<AssuranceHarnessHeartbeat>;
+    };
     runtimeBinding?: RuntimeReadinessBinding;
 }
 export interface CustomerOwnedCollectorGateway {
@@ -67,6 +71,7 @@ export interface CollectorGatewayStatus {
     lastRemoteSuccessAt?: string;
     lastRemoteError?: string;
     actionWorker?: Record<string, unknown>;
+    assuranceHarness?: AssuranceHarnessHeartbeat;
 }
 export declare function startCustomerOwnedCollectorGateway(options: CustomerOwnedCollectorGatewayOptions): Promise<CustomerOwnedCollectorGateway>;
 //# sourceMappingURL=collector-gateway.d.ts.map

package/dist/internal/control-client/collector-gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collector-gateway.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/collector-gateway.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,qBAAqB,EAGrB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjJ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClH,SAAS,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,yBAAyB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACrM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3G,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjI;AAED,MAAM,WAAW,oCAAoC;IACnD,MAAM,EAAE,wBAAwB,CAAC;IACjC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE;QACb,KAAK,CAAC,KAAK,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACxF,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,cAAc,CAAC,EAAE;YAAE,cAAc,EAAE,oBAAoB,CAAC;YAAC,OAAO,EAAE,uBAAuB,CAAC;YAAC,YAAY,EAAE,OAAO,CAAC;YAAC,WAAW,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAC3I,CAAC;IACF,cAAc,CAAC,EAAE,uBAAuB,CAAC;CAC1C;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,KAAK,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,MAAM,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,kDAAkD,CAAC;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAUD,wBAAsB,kCAAkC,CAAC,OAAO,EAAE,oCAAoC,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAmM9I"}
+{"version":3,"file":"collector-gateway.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/collector-gateway.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,qBAAqB,EAGrB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjJ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClH,SAAS,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;QAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnP,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3G,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjI;AAED,MAAM,WAAW,oCAAoC;IACnD,MAAM,EAAE,wBAAwB,CAAC;IACjC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE;QACb,KAAK,CAAC,KAAK,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACxF,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,cAAc,CAAC,EAAE;YAAE,cAAc,EAAE,oBAAoB,CAAC;YAAC,OAAO,EAAE,uBAAuB,CAAC;YAAC,YAAY,EAAE,OAAO,CAAC;YAAC,WAAW,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAC3I,CAAC;IACF,gBAAgB,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAAA;KAAE,CAAC;IACpE,cAAc,CAAC,EAAE,uBAAuB,CAAC;CAC1C;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,KAAK,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,MAAM,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,kDAAkD,CAAC;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,gBAAgB,CAAC,EAAE,yBAAyB,CAAC;CAC9C;AAUD,wBAAsB,kCAAkC,CAAC,OAAO,EAAE,oCAAoC,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAqM9I"}

package/dist/internal/control-client/collector-gateway.js

@@ -89,6 +89,7 @@ export async function startCustomerOwnedCollectorGateway(options) {
             lastRemoteSuccessAt,
             lastRemoteError,
             ...(options.actionWorker ? { actionWorker: await options.actionWorker.status() } : {}),
+            ...(options.assuranceHarness ? { assuranceHarness: await options.assuranceHarness.status() } : {}),
         };
     };
     const server = createServer(async (request, response) => {
@@ -181,6 +182,7 @@ export async function startCustomerOwnedCollectorGateway(options) {
                 pendingRecordCount: current.pendingRecordCount,
                 lastAckSequence: current.lastAckSequence,
                 runtime: runtimeBinding && workerStatus ? runtimeHeartbeat(runtimeBinding, workerStatus, options.actionWorker?.runtimeBinding?.fixtureReady) : undefined,
+                assuranceHarness: options.assuranceHarness ? await options.assuranceHarness.status() : undefined,
             });
             lastRemoteSuccessAt = new Date().toISOString();
             lastRemoteError = undefined;

package/dist/internal/control-client/remote-collector.d.ts

@@ -57,6 +57,13 @@ export interface CollectorRuntimeHeartbeat {
     fixtureReady: boolean;
     lastError?: string;
 }
+export interface AssuranceHarnessHeartbeat {
+    moduleDigestSha256: string;
+    evaluatorContractSha256: string;
+    workerReady: boolean;
+    lastTickAt?: string;
+    lastError?: string;
+}
 export interface RemoteCollectorClientOptions {
     baseUrl: string;
     projectId: string;
@@ -105,6 +112,7 @@ export declare class RemoteCollectorClient {
         lastAckSequence?: number;
         occurredAt?: string;
         runtime?: CollectorRuntimeHeartbeat;
+        assuranceHarness?: AssuranceHarnessHeartbeat;
     }): Promise<Record<string, unknown>>;
     reconcile(runId: string, receipt: Record<string, unknown>): Promise<Record<string, unknown>>;
     proposeAction(proposal: Record<string, unknown>, idempotencyKey: string): Promise<Record<string, unknown>>;

package/dist/internal/control-client/remote-collector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-collector.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/remote-collector.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAeD,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,sCAAsC,CAAC;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IACxG,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE;QAAE,SAAS,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,qCAAqC,CAAC;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,2BAA2B,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,cAAc,EAAE,oBAAoB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,qBAAa,qBAAqB;IACZ,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAAE,OAAO,CAAC,KAAK;IAA5D,OAAO;WAEM,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,SAAwF,GAAG,OAAO,CAAC,qBAAqB,CAAC;WAY5K,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAOnE,IAAI,WAAW,IAAI,MAAM,CAAmC;IAE5D,YAAY,IAAI,oBAAoB;IAMpC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB;IAM9C,YAAY,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE;IAMpH,MAAM,CAAC,KAAK,SAA6F,GAAG,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE,CAAC;YAcpK,OAAO;CAOtB;AAED,qBAAa,qBAAqB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;gBAEhC,OAAO,EAAE,4BAA4B;IAQjD,iBAAiB,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAIhJ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,SAAoD,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQ5J,SAAS,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,yBAAyB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAkBzO,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ5F,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ1G,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAI7D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ/H,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEpC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAItE,IAAI,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE;YAOnE,IAAI;CASnB;AAED,qBAAa,2BAA2B;IAKP,QAAQ,CAAC,KAAK,EAAE,MAAM;IAJrD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,WAAW,CAAoC;gBAE3C,SAAS,EAAE,MAAM,EAAW,KAAK,EAAE,MAAM;IAK/C,OAAO,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzD,OAAO,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAO/C,GAAG,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAU3C,UAAU,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAO/D,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;YAkB5M,OAAO;YAWP,QAAQ;CAcvB;AAUD,qBAAa,uBAAwB,SAAQ,KAAK;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAmB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM;gBAAlF,MAAM,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAW,QAAQ,CAAC,EAAE,MAAM,YAAA;CAIxG"}
+{"version":3,"file":"remote-collector.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/remote-collector.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAeD,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,sCAAsC,CAAC;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IACxG,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE;QAAE,SAAS,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,qCAAqC,CAAC;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,2BAA2B,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,cAAc,EAAE,oBAAoB,CAAC;IACrC,OAAO,EAAE,uBAAuB,CAAC;IACjC,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,uBAAuB,EAAE,MAAM,CAAC;IAChC,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,qBAAa,qBAAqB;IACZ,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAAE,OAAO,CAAC,KAAK;IAA5D,OAAO;WAEM,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,SAAwF,GAAG,OAAO,CAAC,qBAAqB,CAAC;WAY5K,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAOnE,IAAI,WAAW,IAAI,MAAM,CAAmC;IAE5D,YAAY,IAAI,oBAAoB;IAMpC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB;IAM9C,YAAY,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE;IAMpH,MAAM,CAAC,KAAK,SAA6F,GAAG,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE,CAAC;YAcpK,OAAO;CAOtB;AAED,qBAAa,qBAAqB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;gBAEhC,OAAO,EAAE,4BAA4B;IAQjD,iBAAiB,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAIhJ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,SAAoD,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQ5J,SAAS,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;QAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAmBvR,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ5F,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ1G,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAI7D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQ/H,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEpC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAItE,IAAI,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE;YAOnE,IAAI;CASnB;AAED,qBAAa,2BAA2B;IAKP,QAAQ,CAAC,KAAK,EAAE,MAAM;IAJrD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,WAAW,CAAoC;gBAE3C,SAAS,EAAE,MAAM,EAAW,KAAK,EAAE,MAAM;IAK/C,OAAO,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzD,OAAO,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAO/C,GAAG,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAU3C,UAAU,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAO/D,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;YAkB5M,OAAO;YAWP,QAAQ;CAcvB;AAUD,qBAAa,uBAAwB,SAAQ,KAAK;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAmB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM;gBAAlF,MAAM,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAW,QAAQ,CAAC,EAAE,MAAM,YAAA;CAIxG"}

package/dist/internal/control-client/remote-collector.js

@@ -105,6 +105,7 @@ export class RemoteCollectorClient {
             pendingRecordCount: input.pendingRecordCount,
             lastAckSequence: input.lastAckSequence,
             runtime: input.runtime,
+            assuranceHarness: input.assuranceHarness,
         };
         const payloadSha256 = sha256(canonicalJson(payload));
         return this.json("collector-heartbeats", {

package/dist/onboard.js

@@ -7,7 +7,7 @@ import { verifyControlPlaneConnection } from "./control-plane.js";
 import { inferPrivateCapabilities, runPrivateCapabilityDiscovery } from "./private-discovery.js";
 import { parseAgentTemplate, starterAdapter, starterProfile, starterTripwireConfig } from "./onboarding-templates.js";
 import { writeTryEvidence } from "./try.js";
-import { doctorCustomerGateway, initializeCustomerGateway, inspectLocalRuntimeBinding, inspectCustomerGatewayFiles, startManagedCustomerGateway, stopManagedCustomerGateway, upgradeCustomerGatewayRuntime, RuntimeSetupNotReadyError, } from "./gateway.js";
+import { doctorCustomerGateway, activateManagedWorkflowHarness, initializeCustomerGateway, inspectLocalRuntimeBinding, inspectCustomerGatewayFiles, startManagedCustomerGateway, stopManagedCustomerGateway, upgradeCustomerGatewayRuntime, RuntimeSetupNotReadyError, } from "./gateway.js";
 import { discoverRuntimeReferences, planRuntimeSandboxModules } from "./runtime-sandbox-kit.js";
 import { automaticRuntimeReferencesUsable, bootstrapLocalRuntime, verifyAutomaticRuntimeProbe } from "./runtime-bootstrap.js";
 export async function runOnboard(options) {
@@ -85,6 +85,11 @@ export async function runOnboard(options) {
     let gatewayMigration;
     let managedGateway;
     let runtimeUpgrade;
+    let assuranceHarnessReadiness = {
+        state: "WAITING_FOR_CUSTOMER_HARNESS",
+        limitation: "No approved customer Harness module is bound to this Agent repository.",
+    };
+    let assuranceHarnessChanged = false;
     await reportInstall(requestFetch, server, token.projectId, token.apiKey, setupPlan.id, { status: "installing", attemptId });
     try {
         generatedFiles.push(...await generateRepositoryConfig(repositoryPath, repository.template, repository.name));
@@ -183,6 +188,24 @@ export async function runOnboard(options) {
         }
         const runtimeConfigured = await gatewayHasRuntimeWorker(repositoryPath);
         generatedFiles.push(...await generateAutopilotFiles(repositoryPath, repository.name, runtimeConfigured));
+        try {
+            const activation = await activateManagedWorkflowHarness({ repository: repositoryPath });
+            if (activation.created)
+                generatedFiles.push(activation.path);
+            assuranceHarnessChanged = activation.created;
+            assuranceHarnessReadiness = { state: "ACTIVE" };
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : "The customer Harness could not be activated.";
+            if (!detail.startsWith("No customer Assurance Harness was found."))
+                throw error;
+            assuranceHarnessReadiness = { state: "WAITING_FOR_CUSTOMER_HARNESS", limitation: detail };
+        }
+        if (assuranceHarnessChanged && gatewayState.status !== "absent") {
+            const stopped = await gatewayLifecycle.stop({ repository: repositoryPath, configHome: options.configHome, fetch: requestFetch });
+            if (stopped.state !== "STOPPED" && stopped.state !== "STALE")
+                throw new Error("The prior managed Gateway process did not stop before Assurance Harness activation.");
+        }
         managedGateway = await gatewayLifecycle.start({
             repository: repositoryPath,
             configHome: options.configHome,
@@ -210,11 +233,14 @@ export async function runOnboard(options) {
         output(runtimeReadiness.state === "LOCAL_SANDBOX_READY"
             ? "Runtime: LOCAL_SANDBOX_READY. This proves only the generated localhost sandbox loop is ready; it does not establish coverage, CURRENT, or a verified customer outcome.\n"
             : `Runtime: RECORDED_ONLY. ${runtimeReadiness.limitations[0]}\n`);
+        output(assuranceHarnessReadiness.state === "ACTIVE"
+            ? "Assurance Harness: ACTIVE. Nora can dispatch authority-ready Replay and no-write Shadow evaluations without manual Workflow IDs, evaluator origins, credentials, or contract digests.\n"
+            : `Assurance Harness: WAITING_FOR_CUSTOMER_HARNESS. ${assuranceHarnessReadiness.limitation}\n`);
         output("The self-test remains isolated. The Gateway is ready in the background; run the agent normally. The first source-signed, server-reconciled Gateway run completes onboarding.\n");
         return { projectId: token.projectId, connectionName: token.connectionName, credentialsPath, template: repository.template,
             repositoryKind: repository.kind, generatedFiles, receiptPath, discovery, setupPlanId: setupPlan.id,
             gatewayDirectory: join(repositoryPath, ".witnora", "gateway"), gatewayArchiveDirectory: gatewayMigration?.archiveDirectory,
-            gateway: managedGateway, runtimeReadiness };
+            gateway: managedGateway, runtimeReadiness, assuranceHarnessReadiness };
     }
     catch (error) {
         const diagnosis = error instanceof Error ? error.message : String(error);

package/dist/vendor/onegent-runtime/production-evaluator-kit.d.ts

@@ -0,0 +1,85 @@
+export declare const PRODUCTION_EVALUATOR_OBSERVATION_VERSION: "witnora.production_evaluator_observation.v0.1";
+export type ProductionEvaluatorTemplate = "CRM_RECORD_STATE" | "TICKET_STATUS" | "EMAIL_DELIVERY" | "DATABASE_READ_ONLY" | "WEBHOOK_DELIVERY" | "QUEUE_JOB_COMPLETION" | "PAYMENT_REFUND_RESULT" | "BROWSER_WORKFLOW_OUTCOME";
+type SafeScalar = string | number | boolean | null;
+type SafeFields = Record<string, SafeScalar>;
+export interface ProductionEvaluatorRequest {
+    resourceId: string;
+    criterionId: string;
+    expected: SafeFields;
+    parameters?: SafeScalar[];
+}
+export interface ProductionEvaluatorObservation {
+    schemaVersion: typeof PRODUCTION_EVALUATOR_OBSERVATION_VERSION;
+    template: ProductionEvaluatorTemplate;
+    provider: string;
+    environment: "sandbox" | "staging" | "production";
+    criterion: {
+        id: string;
+        expectedDigestSha256: string;
+    };
+    scope: {
+        resourceIdSha256: string;
+        credentialHandleSha256: string;
+    };
+    result: "SATISFIED" | "NOT_SATISFIED" | "NOT_OBSERVED";
+    observation: {
+        fields: SafeFields;
+        digestSha256: string;
+        observedAt: string;
+    };
+    evaluatorIdentity?: {
+        id: string;
+        version: string;
+        digestSha256: string;
+    };
+    limitations: string[];
+}
+export interface ProductionOutcomeEvaluator {
+    readonly template: ProductionEvaluatorTemplate;
+    evaluate(request: ProductionEvaluatorRequest): Promise<ProductionEvaluatorObservation>;
+}
+interface CommonOptions {
+    provider: string;
+    environment: "sandbox" | "staging" | "production";
+    credentialHandle: string;
+    resolveCredential(handle: string): Promise<string>;
+    select(value: Record<string, unknown>): Record<string, unknown>;
+    timeoutMs?: number;
+    now?: () => Date;
+}
+export interface HttpProductionEvaluatorOptions extends CommonOptions {
+    allowedOrigin: string;
+    resourcePath(resourceId: string): string;
+    fetch?: typeof fetch;
+}
+export interface DatabaseReadOnlyEvaluatorOptions extends CommonOptions {
+    statementId: string;
+    executePrepared(input: {
+        statementId: string;
+        parameters: SafeScalar[];
+        credential: string;
+        signal: AbortSignal;
+    }): Promise<Record<string, unknown>>;
+}
+export interface BrowserWorkflowOutcomeEvaluatorOptions extends CommonOptions {
+    observerIdentity: {
+        id: string;
+        version: string;
+        digestSha256: string;
+    };
+    observe(input: {
+        resourceId: string;
+        credential: string;
+        signal: AbortSignal;
+    }): Promise<Record<string, unknown>>;
+}
+export declare const createCrmRecordStateEvaluator: (options: HttpProductionEvaluatorOptions) => ProductionOutcomeEvaluator;
+export declare const createTicketStatusEvaluator: (options: HttpProductionEvaluatorOptions) => ProductionOutcomeEvaluator;
+export declare const createEmailDeliveryEvaluator: (options: HttpProductionEvaluatorOptions) => ProductionOutcomeEvaluator;
+export declare const createWebhookDeliveryEvaluator: (options: HttpProductionEvaluatorOptions) => ProductionOutcomeEvaluator;
+export declare const createQueueJobCompletionEvaluator: (options: HttpProductionEvaluatorOptions) => ProductionOutcomeEvaluator;
+export declare const createPaymentRefundResultEvaluator: (options: HttpProductionEvaluatorOptions) => ProductionOutcomeEvaluator;
+export declare function createDatabaseReadOnlyEvaluator(options: DatabaseReadOnlyEvaluatorOptions): ProductionOutcomeEvaluator;
+export declare function createBrowserWorkflowOutcomeEvaluator(options: BrowserWorkflowOutcomeEvaluatorOptions): ProductionOutcomeEvaluator;
+export {};
+//# sourceMappingURL=production-evaluator-kit.d.ts.map

package/dist/vendor/onegent-runtime/production-evaluator-kit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-evaluator-kit.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/production-evaluator-kit.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,wCAAwC,EAAG,+CAAwD,CAAC;AACjH,MAAM,MAAM,2BAA2B,GAAG,kBAAkB,GAAG,eAAe,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,kBAAkB,GAAG,sBAAsB,GAAG,uBAAuB,GAAG,0BAA0B,CAAC;AAC9N,KAAK,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AACnD,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAE7C,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,UAAU,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,8BAA8B;IAC7C,aAAa,EAAE,OAAO,wCAAwC,CAAC;IAC/D,QAAQ,EAAE,2BAA2B,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAClD,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,KAAK,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,sBAAsB,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,MAAM,EAAE,WAAW,GAAG,eAAe,GAAG,cAAc,CAAC;IACvD,WAAW,EAAE;QAAE,MAAM,EAAE,UAAU,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9E,iBAAiB,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1E,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;CACxF;AAED,UAAU,aAAa;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAClD,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,8BAA+B,SAAQ,aAAa;IACnE,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;IACzC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,gCAAiC,SAAQ,aAAa;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,UAAU,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACtJ;AAED,MAAM,WAAW,sCAAuC,SAAQ,aAAa;IAC3E,gBAAgB,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACxE,OAAO,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnH;AAED,eAAO,MAAM,6BAA6B,GAAI,SAAS,8BAA8B,+BAAqD,CAAC;AAC3I,eAAO,MAAM,2BAA2B,GAAI,SAAS,8BAA8B,+BAAkD,CAAC;AACtI,eAAO,MAAM,4BAA4B,GAAI,SAAS,8BAA8B,+BAAmD,CAAC;AACxI,eAAO,MAAM,8BAA8B,GAAI,SAAS,8BAA8B,+BAAqD,CAAC;AAC5I,eAAO,MAAM,iCAAiC,GAAI,SAAS,8BAA8B,+BAAyD,CAAC;AACnJ,eAAO,MAAM,kCAAkC,GAAI,SAAS,8BAA8B,+BAA0D,CAAC;AAErJ,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,gCAAgC,GAAG,0BAA0B,CAOrH;AAED,wBAAgB,qCAAqC,CAAC,OAAO,EAAE,sCAAsC,GAAG,0BAA0B,CAGjI"}

package/dist/vendor/onegent-runtime/production-evaluator-kit.js

@@ -0,0 +1,131 @@
+import { createHash } from "node:crypto";
+import { isIP } from "node:net";
+import { canonicalJson } from "./trust-crypto.js";
+export const PRODUCTION_EVALUATOR_OBSERVATION_VERSION = "witnora.production_evaluator_observation.v0.1";
+export const createCrmRecordStateEvaluator = (options) => createHttpEvaluator("CRM_RECORD_STATE", options);
+export const createTicketStatusEvaluator = (options) => createHttpEvaluator("TICKET_STATUS", options);
+export const createEmailDeliveryEvaluator = (options) => createHttpEvaluator("EMAIL_DELIVERY", options);
+export const createWebhookDeliveryEvaluator = (options) => createHttpEvaluator("WEBHOOK_DELIVERY", options);
+export const createQueueJobCompletionEvaluator = (options) => createHttpEvaluator("QUEUE_JOB_COMPLETION", options);
+export const createPaymentRefundResultEvaluator = (options) => createHttpEvaluator("PAYMENT_REFUND_RESULT", options);
+export function createDatabaseReadOnlyEvaluator(options) {
+    validateCommon(options);
+    identifier(options.statementId, "statementId");
+    return evaluator("DATABASE_READ_ONLY", options, async (request, credential, signal) => {
+        const parameters = request.parameters ?? [request.resourceId];
+        if (parameters.length > 20 || parameters.some((value) => typeof value === "string" && value.length > 500))
+            throw new Error("Database evaluator parameters exceed the bounded contract.");
+        return options.executePrepared({ statementId: options.statementId, parameters, credential, signal });
+    });
+}
+export function createBrowserWorkflowOutcomeEvaluator(options) {
+    validateCommon(options);
+    componentIdentity(options.observerIdentity);
+    return evaluator("BROWSER_WORKFLOW_OUTCOME", options, (request, credential, signal) => options.observe({ resourceId: request.resourceId, credential, signal }), options.observerIdentity);
+}
+function createHttpEvaluator(template, options) {
+    validateCommon(options);
+    const origin = safeOrigin(options.allowedOrigin);
+    const requestFetch = options.fetch ?? fetch;
+    return evaluator(template, options, async (request, credential, signal) => {
+        const path = options.resourcePath(request.resourceId);
+        if (typeof path !== "string" || !path.startsWith("/") || path.startsWith("//") || path.includes("..") || path.length > 1_000)
+            throw new Error("Evaluator resource path is outside the fixed origin contract.");
+        const url = new URL(path, origin);
+        if (url.origin !== origin)
+            throw new Error("Evaluator resource path changed the fixed origin.");
+        const response = await requestFetch(url, { method: "GET", headers: { accept: "application/json", authorization: `Bearer ${credential}` }, redirect: "error", signal });
+        if (!response.ok)
+            throw new Error(`Read-only evaluator returned HTTP ${response.status}.`);
+        const contentLength = Number(response.headers.get("content-length") ?? 0);
+        if (contentLength > 64 * 1024)
+            throw new Error("Read-only evaluator response exceeded 64 KiB.");
+        const bytes = Buffer.from(await response.arrayBuffer());
+        if (bytes.length > 64 * 1024)
+            throw new Error("Read-only evaluator response exceeded 64 KiB.");
+        const parsed = JSON.parse(bytes.toString("utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            throw new Error("Read-only evaluator response must be a JSON object.");
+        return parsed;
+    });
+}
+function evaluator(template, options, observe, evaluatorIdentity) {
+    return Object.freeze({
+        template,
+        async evaluate(request) {
+            const resourceId = identifier(request.resourceId, "resourceId");
+            const criterionId = identifier(request.criterionId, "criterionId");
+            const expected = safeFields(request.expected, "expected");
+            const credential = await options.resolveCredential(options.credentialHandle);
+            if (typeof credential !== "string" || credential.length < 1 || credential.length > 8_192)
+                throw new Error("Read-only evaluator credential was unavailable.");
+            const timeoutMs = boundedTimeout(options.timeoutMs);
+            const raw = await observe({ ...request, resourceId, criterionId, expected }, credential, AbortSignal.timeout(timeoutMs));
+            const fields = safeFields(options.select(raw), "selected observation");
+            const result = Object.entries(expected).every(([key, value]) => Object.is(fields[key], value)) ? "SATISFIED" : "NOT_SATISFIED";
+            const observedAt = (options.now ?? (() => new Date()))().toISOString();
+            return {
+                schemaVersion: PRODUCTION_EVALUATOR_OBSERVATION_VERSION, template, provider: identifier(options.provider, "provider"), environment: options.environment,
+                criterion: { id: criterionId, expectedDigestSha256: sha256(canonicalJson(expected)) },
+                scope: { resourceIdSha256: sha256(resourceId), credentialHandleSha256: sha256(options.credentialHandle) },
+                result, observation: { fields, digestSha256: sha256(canonicalJson(fields)), observedAt },
+                ...(evaluatorIdentity ? { evaluatorIdentity } : {}),
+                limitations: [
+                    "This result proves one bounded read-only observation and does not authorize a write or generalize to future executions.",
+                    "Credentials and raw provider payloads remain in the customer environment; only allowlisted scalar fields and digests are returned.",
+                ],
+            };
+        },
+    });
+}
+function validateCommon(options) {
+    identifier(options.provider, "provider");
+    identifier(options.credentialHandle, "credentialHandle");
+    if (!["sandbox", "staging", "production"].includes(options.environment))
+        throw new Error("environment is invalid.");
+    boundedTimeout(options.timeoutMs);
+}
+function safeOrigin(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error("Evaluator origin is invalid.");
+    }
+    const literalLoopback = (url.hostname === "127.0.0.1" || url.hostname === "[::1]") && isIP(url.hostname.replace(/^\[|\]$/g, ""));
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && literalLoopback))
+        throw new Error("Remote evaluator origins must use HTTPS; local development must use a literal loopback address.");
+    if (url.username || url.password || url.pathname !== "/" || url.search || url.hash)
+        throw new Error("Evaluator origin must contain only scheme, host, and port.");
+    return url.origin;
+}
+function safeFields(value, field) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`${field} must be an object.`);
+    const entries = Object.entries(value);
+    if (entries.length > 32)
+        throw new Error(`${field} contains too many fields.`);
+    const result = {};
+    for (const [key, item] of entries.sort(([left], [right]) => left.localeCompare(right))) {
+        if (!/^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(key) || /(secret|token|credential|password|authorization|cookie|email|phone|name|address|payload|body|text|prompt)/i.test(key))
+            throw new Error(`${field} contains an unsafe field.`);
+        if (item !== null && typeof item !== "string" && typeof item !== "number" && typeof item !== "boolean")
+            throw new Error(`${field}.${key} must be a scalar.`);
+        if (typeof item === "string" && item.length > 500 || typeof item === "number" && !Number.isFinite(item))
+            throw new Error(`${field}.${key} exceeds the bounded contract.`);
+        result[key] = item;
+    }
+    return result;
+}
+function componentIdentity(value) {
+    identifier(value.id, "observerIdentity.id");
+    identifier(value.version, "observerIdentity.version");
+    if (!/^[a-f0-9]{64}$/.test(value.digestSha256))
+        throw new Error("observerIdentity.digestSha256 is invalid.");
+}
+function identifier(value, field) { if (typeof value !== "string" || !value.trim() || value.length > 200 || !/^[A-Za-z0-9][A-Za-z0-9._:/@-]*$/.test(value))
+    throw new Error(`${field} is invalid.`); return value; }
+function boundedTimeout(value = 5_000) { if (!Number.isSafeInteger(value) || value < 100 || value > 10_000)
+    throw new Error("Evaluator timeout must be from 100 to 10000 ms."); return value; }
+function sha256(value) { return createHash("sha256").update(value).digest("hex"); }

package/dist/vendor/onegent-runtime/signed-change-manifest.d.ts

@@ -0,0 +1,40 @@
+import type { SourceSigner } from "./trust-types.js";
+export declare const SIGNED_CHANGE_MANIFEST_SCHEMA_VERSION: "witnora.signed_change_manifest.v0.1";
+export interface ChangeManifestComponentIdentity {
+    id: string;
+    version: string;
+    digestSha256: string;
+}
+export interface SignedChangeManifestPayload {
+    schemaVersion: typeof SIGNED_CHANGE_MANIFEST_SCHEMA_VERSION;
+    manifestId: string;
+    projectId: string;
+    agentId: string;
+    agentVersion: string;
+    environment: "sandbox" | "staging" | "production";
+    observedAt: string;
+    modelDigest?: string;
+    promptWorkflowDigest?: string;
+    toolManifestDigest?: string;
+    policyRevision?: string;
+    evaluatorIdentity?: ChangeManifestComponentIdentity;
+    adapterIdentity?: ChangeManifestComponentIdentity;
+    previousManifestDigest?: string;
+}
+export interface SignedChangeManifestEnvelope {
+    payload: SignedChangeManifestPayload;
+    signature: {
+        algorithm: "Ed25519";
+        keyId: string;
+        signature: string;
+    };
+}
+export declare function createSignedChangeManifestEnvelope(payload: SignedChangeManifestPayload, signer: SourceSigner): SignedChangeManifestEnvelope;
+export declare function uploadSignedChangeManifest(options: {
+    baseUrl: string;
+    projectId: string;
+    apiKey: string;
+    envelope: SignedChangeManifestEnvelope;
+    fetch?: typeof fetch;
+}): Promise<unknown>;
+//# sourceMappingURL=signed-change-manifest.d.ts.map

package/dist/vendor/onegent-runtime/signed-change-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-change-manifest.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/signed-change-manifest.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,eAAO,MAAM,qCAAqC,EAAG,qCAA8C,CAAC;AACpG,MAAM,WAAW,+BAA+B;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE;AACtG,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,OAAO,qCAAqC,CAAC;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,+BAA+B,CAAC;IACpD,eAAe,CAAC,EAAE,+BAA+B,CAAC;IAClD,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AACD,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,2BAA2B,CAAC;IACrC,SAAS,EAAE;QAAE,SAAS,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACvE;AAED,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,2BAA2B,EAAE,MAAM,EAAE,YAAY,GAAG,4BAA4B,CAM3I;AAED,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,4BAA4B,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAQhM"}

package/dist/vendor/onegent-runtime/signed-change-manifest.js

@@ -0,0 +1,22 @@
+import { createPrivateKey, sign } from "node:crypto";
+import { canonicalJson } from "./trust-crypto.js";
+export const SIGNED_CHANGE_MANIFEST_SCHEMA_VERSION = "witnora.signed_change_manifest.v0.1";
+export function createSignedChangeManifestEnvelope(payload, signer) {
+    if (payload.schemaVersion !== SIGNED_CHANGE_MANIFEST_SCHEMA_VERSION)
+        throw new Error("Signed Change Manifest schemaVersion is unsupported.");
+    return {
+        payload: structuredClone(payload),
+        signature: { algorithm: "Ed25519", keyId: signer.keyId, signature: sign(null, Buffer.from(canonicalJson(payload)), createPrivateKey(signer.privateKeyPem)).toString("base64url") },
+    };
+}
+export async function uploadSignedChangeManifest(options) {
+    const response = await (options.fetch ?? fetch)(`${options.baseUrl.replace(/\/$/, "")}/v1/projects/${encodeURIComponent(options.projectId)}/change-manifests`, {
+        method: "POST", headers: { "content-type": "application/json", authorization: `Bearer ${options.apiKey}` }, body: JSON.stringify(options.envelope), redirect: "error", signal: AbortSignal.timeout(10_000),
+    });
+    const text = await response.text();
+    if (Buffer.byteLength(text) > 256 * 1024)
+        throw new Error("Witnora Change Manifest response exceeded 256 KiB.");
+    if (!response.ok)
+        throw new Error(`Witnora Change Manifest upload returned HTTP ${response.status}.`);
+    return JSON.parse(text);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.13.11",
+  "version": "0.14.0",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "Apache-2.0",
@@ -44,6 +44,14 @@
       "types": "./dist/vendor/onegent-runtime/business-task-evaluator.d.ts",
       "import": "./dist/vendor/onegent-runtime/business-task-evaluator.js"
     },
+    "./production-evaluator-kit": {
+      "types": "./dist/vendor/onegent-runtime/production-evaluator-kit.d.ts",
+      "import": "./dist/vendor/onegent-runtime/production-evaluator-kit.js"
+    },
+    "./change-manifest": {
+      "types": "./dist/vendor/onegent-runtime/signed-change-manifest.d.ts",
+      "import": "./dist/vendor/onegent-runtime/signed-change-manifest.js"
+    },
     "./deployment-enforcement": {
       "types": "./dist/internal/control-client/deployment-enforcement.d.ts",
       "import": "./dist/internal/control-client/deployment-enforcement.js"