witnora 0.13.2 → 0.13.4

package/README.md

@@ -353,7 +353,7 @@ Control semantics and attestation format:
 [release gate checklist](https://github.com/Kakarottoooo/agentcert/blob/main/docs/release-gate-checklist.md).
 
 CI users can run Tripwire and Witnora together with
-`Kakarottoooo/agentcert/actions/tripwire@v0`.
+`Kakarottoooo/witnora/actions/tripwire@v0`.
 
 The public Real Agent Robustness Lab compares browser-use, Stagehand, and
 Playwright-based agents over the same fault suite:

package/dist/conformance.js

@@ -10,7 +10,7 @@ const SUPPORTED_TOP_LEVEL_FIELDS = new Set([
 export async function runEvidenceConformance(input, options) {
     const checks = [];
     const schema = validateAgentCertSchema("evidence-bundle", input);
-    checks.push(check("schema", "Evidence bundle satisfies the AgentCert v0.1 semantic contract.", schema.errors));
+    checks.push(check("schema", "Witnora evidence satisfies the stable agentcert v0.1 protocol contract.", schema.errors));
     const bundle = object(input);
     const compatibilityErrors = bundle
         ? Object.keys(bundle).filter((key) => !SUPPORTED_TOP_LEVEL_FIELDS.has(key)).map((key) => `Unsupported top-level field: ${key}.`)

package/dist/control-plane.js

@@ -397,7 +397,7 @@ async function requestJson(request, url, init) {
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        throw new ControlPlaneRequestError(`AgentCert control plane request failed: ${message}`);
+        throw new ControlPlaneRequestError(`Witnora control plane request failed: ${message}`);
     }
     const text = await response.text();
     let value = {};
@@ -407,12 +407,12 @@ async function requestJson(request, url, init) {
         }
         catch {
             if (!response.ok)
-                throw new ControlPlaneRequestError(`AgentCert control plane returned HTTP ${response.status}.`, response.status);
-            throw new ControlPlaneRequestError("AgentCert control plane returned invalid JSON.", response.status);
+                throw new ControlPlaneRequestError(`Witnora control plane returned HTTP ${response.status}.`, response.status);
+            throw new ControlPlaneRequestError("Witnora control plane returned invalid JSON.", response.status);
         }
     }
     if (!response.ok) {
-        throw new ControlPlaneRequestError([typeof value.error === "string" ? value.error : `AgentCert control plane returned HTTP ${response.status}.`,
+        throw new ControlPlaneRequestError([typeof value.error === "string" ? value.error : `Witnora control plane returned HTTP ${response.status}.`,
             typeof value.recovery === "string" ? value.recovery : undefined,
             typeof value.requestId === "string" ? `Request ID: ${value.requestId}.` : undefined].filter(Boolean).join(" "), response.status, typeof value.code === "string" ? value.code : undefined, typeof value.requestId === "string" ? value.requestId : response.headers.get("x-request-id") ?? undefined, typeof value.recovery === "string" ? value.recovery : undefined);
     }

package/dist/gateway.js

@@ -1,11 +1,12 @@
-import { randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { spawn } from "node:child_process";
 import { closeSync, openSync } from "node:fs";
 import { access, chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { loadConnection } from "./credentials.js";
 import { authorizeProjectConnection } from "./device-authorization.js";
+import { inspectIsolatedOutcomeProbe, observeInIsolatedOutcomeProbe } from "./probe-process.js";
 const CONFIG_SCHEMA = "witnora.customer_gateway_setup.v0.1";
 const SECRETS_SCHEMA = "witnora.customer_gateway_local_secrets.v0.1";
 const RUNTIME_SCHEMA = "witnora.managed_gateway_runtime.v0.1";
@@ -36,7 +37,7 @@ export async function initializeCustomerGateway(options) {
             output,
             configHome: options.configHome,
         });
-    const expectedScopes = ["runs:read", "events:write", "collector:manage"];
+    const expectedScopes = ["runs:read", "events:write", "collector:manage", "actions:read", "actions:propose", "actions:execute"];
     const missingScopes = expectedScopes.filter((scope) => !authorization.scopes.includes(scope));
     if (missingScopes.length > 0)
         throw new Error(`Gateway authorization is missing required scope(s): ${missingScopes.join(", ")}.`);
@@ -132,31 +133,67 @@ export async function doctorCustomerGateway(options) {
         catch (error) {
             checks.push({ id: "hosted_credential", status: "FAIL", message: message(error) });
         }
+        if (config.runtimeWorker) {
+            try {
+                const adapterModulePath = resolve(directory, config.runtimeWorker.adapterModulePath);
+                const probeModulePath = resolve(directory, config.runtimeWorker.probeModulePath);
+                if (adapterModulePath === probeModulePath)
+                    throw new Error("Adapter and outcome probe must use separate modules.");
+                const [adapterDigest, probeDigest] = await Promise.all([
+                    readFile(adapterModulePath).then((bytes) => createHash("sha256").update(bytes).digest("hex")),
+                    readFile(probeModulePath).then((bytes) => createHash("sha256").update(bytes).digest("hex")),
+                ]);
+                if (adapterDigest !== config.runtimeWorker.adapterModuleSha256 || probeDigest !== config.runtimeWorker.probeModuleSha256)
+                    throw new Error("Runtime adapter or probe module digest does not match gateway.json.");
+                const [primary, probe] = await Promise.all([
+                    loadConnection(config.connectionName, { configHome: options.configHome }),
+                    loadConnection(config.runtimeWorker.probeConnectionName, { configHome: options.configHome }),
+                ]);
+                if (!primary || !probe || probe.projectId !== config.projectId || probe.server !== config.server || probe.apiKey === primary.apiKey) {
+                    throw new Error("A separate outcome-probe credential bound to this project is required.");
+                }
+                checks.push({ id: "runtime_configuration", status: "PASS", message: "The digest-pinned adapter module and separate outcome-probe credential are present." });
+            }
+            catch (error) {
+                checks.push({ id: "runtime_configuration", status: "FAIL", message: message(error) });
+            }
+        }
         try {
-            const response = await (options.fetch ?? fetch)(`http://${config.host}:${config.port}/healthz`, { signal: AbortSignal.timeout(800) });
-            if (!response.ok)
-                throw new Error(`Gateway health returned HTTP ${response.status}.`);
+            const health = await gatewayHealth(`http://${config.host}:${config.port}`, options.fetch ?? fetch, Boolean(config.runtimeWorker));
+            if (!health)
+                throw new Error("Gateway health or runtime-worker readiness was not established.");
             checks.push({ id: "process", status: "PASS", message: `Gateway is listening at http://${config.host}:${config.port}.` });
         }
         catch {
             checks.push({ id: "process", status: "WARN", message: "Gateway is not running yet. Start managed mode with `witnora gateway start`." });
         }
     }
+    const runtimeConfigurationReady = checks.some((check) => check.id === "runtime_configuration" && check.status === "PASS")
+        && checks.some((check) => check.id === "process" && check.status === "PASS");
     if (config && secrets) {
-        checks.push({ id: "enforcement", status: "WARN", message: "Write-credential mediation is not configured; current evidence ceiling is RECORDED." });
-        checks.push({ id: "outcome_probe", status: "WARN", message: "An independent read-only outcome probe is not configured." });
+        checks.push(config.runtimeWorker && runtimeConfigurationReady
+            ? { id: "enforcement", status: "PASS", message: `Exact adapter ${config.runtimeWorker.adapterId}@${config.runtimeWorker.adapterVersion} is configured behind the durable worker.` }
+            : { id: "enforcement", status: "WARN", message: "Exact write-credential mediation is not proven ready; current evidence ceiling remains RECORDED." });
+        checks.push(config.runtimeWorker && runtimeConfigurationReady
+            ? { id: "outcome_probe", status: "PASS", message: `Separate read-only probe ${config.runtimeWorker.probeId} is configured.` }
+            : { id: "outcome_probe", status: "WARN", message: "An independent digest-pinned probe and read-only target credential are not proven ready." });
     }
     const failed = checks.some((check) => check.status === "FAIL");
     return {
         schemaVersion: "witnora.customer_gateway_doctor.v0.1",
-        overall: failed ? "SETUP_INCOMPLETE" : "READY_TO_RECORD",
+        overall: failed ? "SETUP_INCOMPLETE" : runtimeConfigurationReady ? "READY_FOR_RUNTIME" : "READY_TO_RECORD",
         checks,
-        evidenceCeiling: "recorded",
-        nextAction: failed ? "Run `witnora gateway init --project <project-id>` again after resolving failed checks." : "Ensure the managed Gateway is healthy, then send one sandbox run through its local event API.",
+        evidenceCeiling: runtimeConfigurationReady ? "outcome_verified" : "recorded",
+        nextAction: failed ? "Resolve the failed Gateway checks before sending another action." : runtimeConfigurationReady ? "Run the Agent normally; approved configured actions continue automatically after the human decision." : "Ensure the managed Gateway is healthy, then send one sandbox run through its local event API.",
     };
 }
 export async function runCustomerGateway(options) {
-    const { CustomerSourceKeyRing, RemoteCollectorClient, startCustomerOwnedCollectorGateway, } = await import("agentcert-sdk");
+    const remoteCollector = await import(new URL("./internal/control-client/remote-collector.js", import.meta.url).href);
+    const collectorGateway = await import(new URL("./internal/control-client/collector-gateway.js", import.meta.url).href);
+    const CustomerSourceKeyRing = remoteCollector.CustomerSourceKeyRing;
+    const RemoteCollectorClient = remoteCollector.RemoteCollectorClient;
+    const startCustomerOwnedCollectorGateway = collectorGateway.startCustomerOwnedCollectorGateway;
+    const durableWorker = configRuntimeWorkerImport();
     const directory = resolve(options.repository ?? process.cwd(), options.dir ?? ".witnora/gateway");
     const config = parseConfig(await readFile(join(directory, "gateway.json"), "utf8"));
     const secrets = parseSecrets(await readFile(join(directory, "secrets.json"), "utf8"));
@@ -169,6 +206,14 @@ export async function runCustomerGateway(options) {
     const keyRing = await (await exists(keyRingPath)
         ? CustomerSourceKeyRing.open(keyRingPath)
         : CustomerSourceKeyRing.create(keyRingPath, config.collectorId));
+    const actionWorker = config.runtimeWorker
+        ? await createConfiguredRuntimeActionWorker({
+            directory, config, connection, configHome: options.configHome,
+            DurableApprovedActionWorker: (await durableWorker).DurableApprovedActionWorker,
+            FileActionCheckpointStore: (await durableWorker).FileActionCheckpointStore,
+        })
+        : undefined;
+    actionWorker?.start();
     const gateway = await startCustomerOwnedCollectorGateway({
         client: new RemoteCollectorClient({ baseUrl: connection.server, projectId: connection.projectId, apiKey: connection.apiKey }),
         keyRing,
@@ -177,13 +222,143 @@ export async function runCustomerGateway(options) {
         host: process.env.WITNORA_GATEWAY_HOST?.trim() || config.host,
         port: gatewayPort(process.env.WITNORA_GATEWAY_PORT, config.port),
         environment: "customer-owned",
+        ...(actionWorker && config.runtimeWorker ? { actionWorker: {
+                track: (input) => isConfiguredRuntimeProposal(input.proposal, config.runtimeWorker) ? actionWorker.track(input) : Promise.resolve(undefined),
+                status: () => actionWorker.status(), close: () => actionWorker.stop(),
+            } } : {}),
     });
     process.stdout.write(`Witnora customer-owned Gateway listening on ${gateway.baseUrl}\n`);
-    process.stdout.write("Evidence ceiling: RECORDED. No target write credential or outcome-probe credential is loaded by this reference process.\n");
+    process.stdout.write(config.runtimeWorker
+        ? "Runtime worker: READY. Approved exact configured actions execute automatically, then use the separate read-only probe and Hosted signed receipt.\n"
+        : "Evidence ceiling: RECORDED. No exact target adapter and separate outcome probe are configured, so runtime writes remain fail-closed.\n");
     for (const signal of ["SIGINT", "SIGTERM"]) {
         process.once(signal, () => void gateway.close().finally(() => process.exit(0)));
     }
 }
+export async function createConfiguredRuntimeActionWorker(input) {
+    const workerConfig = input.config.runtimeWorker;
+    if (!workerConfig?.enabled)
+        throw new Error("Runtime worker is not enabled.");
+    const adapterModulePath = resolve(input.directory, workerConfig.adapterModulePath);
+    const probeModulePath = resolve(input.directory, workerConfig.probeModulePath);
+    if (adapterModulePath === probeModulePath)
+        throw new Error("Adapter and outcome probe must use separate modules.");
+    const [adapterBytes, probeBytes] = await Promise.all([readFile(adapterModulePath), readFile(probeModulePath)]);
+    const adapterModuleDigest = createHash("sha256").update(adapterBytes).digest("hex");
+    const probeModuleDigest = createHash("sha256").update(probeBytes).digest("hex");
+    if (adapterModuleDigest !== workerConfig.adapterModuleSha256 || probeModuleDigest !== workerConfig.probeModuleSha256)
+        throw new Error("Runtime adapter or probe module digest does not match gateway.json; refusing to load it.");
+    const adapterModule = await import(`${pathToFileURL(adapterModulePath).href}?sha256=${adapterModuleDigest}`);
+    if (typeof adapterModule.createWitnoraRuntimeAdapter !== "function")
+        throw new Error("Runtime adapter module must export its factory.");
+    const probeConnection = await loadConnection(workerConfig.probeConnectionName, { configHome: input.configHome });
+    if (!probeConnection || probeConnection.projectId !== input.config.projectId || probeConnection.server !== input.config.server) {
+        throw new Error("The separate outcome-probe credential does not match this Gateway project and server.");
+    }
+    if (probeConnection.apiKey === input.connection.apiKey)
+        throw new Error("The execution Gateway and outcome probe must use separate Hosted credentials.");
+    const adapterContext = Object.freeze({
+        adapterId: workerConfig.adapterId, adapterVersion: workerConfig.adapterVersion,
+        projectId: input.config.projectId,
+        hosted: runtimeHostedTransport(input.connection, input.fetch ?? fetch),
+        storageDirectory: resolve(input.directory, "data", "runtime-actions"),
+    });
+    const isolatedProbeConfig = {
+        modulePath: probeModulePath,
+        moduleSha256: probeModuleDigest,
+        probeId: workerConfig.probeId,
+        projectId: input.config.projectId,
+        credentialHandle: workerConfig.probeTargetCredentialHandle,
+    };
+    const runtime = await adapterModule.createWitnoraRuntimeAdapter(adapterContext);
+    await inspectIsolatedOutcomeProbe(isolatedProbeConfig);
+    if (runtime.id !== workerConfig.adapterId || runtime.version !== workerConfig.adapterVersion || runtime.reconcileReadOnly !== true
+        || typeof runtime.prepareClaim !== "function" || typeof runtime.execute !== "function" || typeof runtime.reconcile !== "function") {
+        throw new Error("Runtime adapter does not match the exact configured id/version or read-only reconciliation contract.");
+    }
+    const requestFetch = input.fetch ?? fetch;
+    const primary = projectTransport(input.connection, requestFetch);
+    const verifier = projectTransport(probeConnection, requestFetch);
+    return new input.DurableApprovedActionWorker({
+        config: {
+            adapterId: workerConfig.adapterId, adapterVersion: workerConfig.adapterVersion, probeId: workerConfig.probeId,
+            probeCredentialHandle: workerConfig.probeTargetCredentialHandle,
+            runtimeIdentityId: workerConfig.runtimeIdentityId, grantTtlSeconds: workerConfig.grantTtlSeconds, pollIntervalMs: workerConfig.pollIntervalMs,
+        },
+        store: new input.FileActionCheckpointStore(resolve(input.directory, "data", "runtime-actions", "checkpoints")),
+        hosted: {
+            getAction: (actionId) => primary(`actions/${encodeURIComponent(actionId)}`),
+            issueExecutionGrant: (actionId, body, idempotencyKey) => primary(`actions/${encodeURIComponent(actionId)}/execution-grant`, { method: "POST", body, idempotencyKey }),
+            verifyAction: (actionId, body, idempotencyKey) => verifier(`actions/${encodeURIComponent(actionId)}/verify`, { method: "POST", body, idempotencyKey }),
+            listActionReceipts: async (actionId) => (await primary(`actions/${encodeURIComponent(actionId)}/receipts`)).receipts ?? [],
+            claimExecutionGrant: (executionGrantId, claim, idempotencyKey) => claimHostedExecutionGrant(input.connection, requestFetch, executionGrantId, claim, idempotencyKey),
+        },
+        runtime: { reconcileReadOnly: true, prepareClaim: runtime.prepareClaim, execute: runtime.execute, reconcile: runtime.reconcile },
+        probe: {
+            id: workerConfig.probeId,
+            credentialHandle: workerConfig.probeTargetCredentialHandle,
+            readOnly: true,
+            observe: (request) => observeInIsolatedOutcomeProbe(isolatedProbeConfig, request),
+        },
+    });
+}
+function projectTransport(connection, requestFetch) {
+    return async (suffix, options = {}) => {
+        const response = await requestFetch(`${connection.server}/v1/projects/${encodeURIComponent(connection.projectId)}/${suffix}`, {
+            method: options.method ?? "GET",
+            headers: { authorization: `Bearer ${connection.apiKey}`, ...(options.body ? { "content-type": "application/json" } : {}), ...(options.idempotencyKey ? { "idempotency-key": options.idempotencyKey } : {}) },
+            ...(options.body ? { body: JSON.stringify(options.body) } : {}),
+        });
+        const body = await response.json().catch(() => ({}));
+        if (!response.ok)
+            throw new Error(String(body.error ?? `Witnora Hosted API returned HTTP ${response.status}.`));
+        return body;
+    };
+}
+function runtimeHostedTransport(connection, requestFetch) {
+    return {
+        baseUrl: connection.server,
+        projectId: connection.projectId,
+        async request(suffix, options = {}) {
+            if (!/^(execution-grants\/[A-Za-z0-9._:-]+\/consume|execution-attempts\/[A-Za-z0-9._:-]+\/phase|execution-sessions\/[A-Za-z0-9._:-]+\/evidence)$/.test(suffix)) {
+                throw new Error("Runtime adapter attempted to access a Hosted path outside its execution boundary.");
+            }
+            if ((options.method ?? "GET") !== "POST")
+                throw new Error("Runtime Hosted execution paths require POST.");
+            const response = await requestFetch(`${connection.server}/v1/runtime/projects/${encodeURIComponent(connection.projectId)}/${suffix}`, {
+                method: "POST",
+                headers: { authorization: `Bearer ${connection.apiKey}`, ...(options.body ? { "content-type": "application/json" } : {}), ...(options.idempotencyKey ? { "idempotency-key": options.idempotencyKey } : {}) },
+                ...(options.body ? { body: JSON.stringify(options.body) } : {}),
+            });
+            const body = await response.json().catch(() => ({}));
+            if (!response.ok)
+                throw new Error(String(body.error ?? `Witnora Hosted runtime API returned HTTP ${response.status}.`));
+            return body;
+        },
+    };
+}
+async function claimHostedExecutionGrant(connection, requestFetch, executionGrantId, claim, idempotencyKey) {
+    const response = await requestFetch(`${connection.server}/v1/runtime/projects/${encodeURIComponent(connection.projectId)}/execution-grants/${encodeURIComponent(executionGrantId)}/claim`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${connection.apiKey}`, "content-type": "application/json", "idempotency-key": idempotencyKey },
+        body: JSON.stringify(claim),
+    });
+    if (response.status === 409)
+        return { acquired: false };
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok)
+        throw new Error(String(body.error ?? `Witnora Hosted grant claim returned HTTP ${response.status}.`));
+    return { acquired: body.status === "CLAIMED" };
+}
+function configRuntimeWorkerImport() {
+    return import(new URL("./internal/control-client/durable-action-worker.js", import.meta.url).href);
+}
+function isConfiguredRuntimeProposal(proposal, config) {
+    const intent = proposal.executionIntent;
+    return Boolean(intent && typeof intent === "object" && !Array.isArray(intent)
+        && intent.adapterId === config.adapterId
+        && typeof intent.adapterVersionConstraint === "string");
+}
 export async function startManagedCustomerGateway(options = {}) {
     const repository = resolve(options.repository ?? process.cwd());
     const directory = resolve(repository, options.dir ?? ".witnora/gateway");
@@ -268,7 +443,7 @@ export async function statusManagedCustomerGateway(options = {}) {
     const config = parseConfig(await readFile(join(directory, "gateway.json"), "utf8"));
     const baseUrl = `http://${config.host}:${config.port}`;
     const runtime = await readRuntime(directory);
-    const health = await gatewayHealth(baseUrl, options.fetch ?? fetch);
+    const health = await gatewayHealth(baseUrl, options.fetch ?? fetch, Boolean(config.runtimeWorker));
     const base = {
         schemaVersion: "witnora.managed_gateway_status.v0.1",
         baseUrl,
@@ -383,8 +558,30 @@ function parseConfig(raw) {
         throw new Error("Gateway privacyMode must remain metadata_only.");
     if (!value.host || !Number.isSafeInteger(value.port) || Number(value.port) < 1 || Number(value.port) > 65_535)
         throw new Error("Gateway host and port are invalid.");
+    if (value.runtimeWorker)
+        validateRuntimeWorkerConfig(value.runtimeWorker);
     return value;
 }
+function validateRuntimeWorkerConfig(value) {
+    if (value.enabled !== true || !value.adapterModulePath || !/^[a-f0-9]{64}$/.test(value.adapterModuleSha256)
+        || !value.probeModulePath || !/^[a-f0-9]{64}$/.test(value.probeModuleSha256)
+        || !value.adapterId || !/^v?\d+\.\d+\.\d+$/.test(value.adapterVersion) || !value.probeId
+        || !value.probeConnectionName || !credentialHandle(value.probeTargetCredentialHandle) || !value.runtimeIdentityId) {
+        throw new Error("gateway.json runtimeWorker requires separate exact adapter/probe module digests, adapter id/version, probe credentials, and runtime identity.");
+    }
+    if (value.adapterModulePath === value.probeModulePath || value.adapterModuleSha256 === value.probeModuleSha256)
+        throw new Error("runtimeWorker adapter and outcome probe modules must be independently pinned.");
+    if (value.adapterId === value.probeId)
+        throw new Error("runtimeWorker adapter and outcome probe must be separate.");
+    if (value.grantTtlSeconds !== undefined && (!Number.isInteger(value.grantTtlSeconds) || value.grantTtlSeconds < 15 || value.grantTtlSeconds > 300))
+        throw new Error("runtimeWorker grantTtlSeconds must be between 15 and 300.");
+    if (value.pollIntervalMs !== undefined && (!Number.isInteger(value.pollIntervalMs) || value.pollIntervalMs < 250 || value.pollIntervalMs > 30_000))
+        throw new Error("runtimeWorker pollIntervalMs must be between 250 and 30000.");
+}
+function credentialHandle(value) {
+    return typeof value === "string" && value.length <= 256 && /^[a-z][a-z0-9+.-]*:\/\/[^\s]+$/i.test(value)
+        && !/(?:ac_live_|bearer\s|private.?key|password|token=)/i.test(value);
+}
 function parseSecrets(raw) {
     const value = JSON.parse(raw);
     if (value.schemaVersion !== SECRETS_SCHEMA || typeof value.gatewayToken !== "string" || value.gatewayToken.length < 32) {
@@ -405,6 +602,13 @@ function gatewayReadme(config) {
     return `# Witnora customer-owned Gateway\n\nThis directory configures a metadata-only Gateway for project \`${config.projectId}\`. The Setup Autopilot starts it in the background after browser authorization.\n\n## Operations\n\n\`\`\`bash\nnpx witnora@latest gateway status\nnpx witnora@latest gateway logs\nnpx witnora@latest gateway restart\nnpx witnora@latest gateway stop\n\`\`\`\n\n\`gateway run\` remains available as a foreground debugging command. In the Agent repository, import the generated client at one meaningful sandbox workflow boundary:\n\n\`\`\`js\nimport { randomUUID } from "node:crypto";\nimport { witnoraGateway } from "./.witnora/gateway/client.mjs";\n\nconst runId = randomUUID();\nawait witnoraGateway.start(runId, { workflow: "sandbox-workflow" });\ntry {\n  // Run the existing customer workflow here. Do not add raw inputs or outputs.\n  await witnoraGateway.event(runId, "workflow.step.completed", { step: "meaningful-boundary" });\n  await witnoraGateway.complete(runId, { status: "completed" });\n} catch (error) {\n  await witnoraGateway.event(runId, "workflow.failed", { errorType: error?.name ?? "Error" });\n  await witnoraGateway.complete(runId, { status: "failed" });\n  throw error;\n}\n\`\`\`\n\nThe generated client reads only the local ignored Gateway token and sends metadata to \`http://${config.host}:${config.port}\`. The Hosted API key and source-signing key stay in the Gateway process. Do not commit \`secrets.json\`, \`data/\`, or \`runtime/\`.\n\nThis reference process creates source-signed, durable **RECORDED** evidence. It does not claim complete mediation. **ENFORCED** requires the target write credential to be removed from the Agent and placed behind a controlled execution adapter. **OUTCOME VERIFIED** requires a separate read-only credential and independent probe.\n`;
 }
 function gatewayClient(config) {
+    const requestHelper = `async function actionRequest(path, init = {}) {\n  const headers = new Headers(init.headers);\n  headers.set("authorization", \`Bearer \${await token()}\`);\n  if (init.body) headers.set("content-type", "application/json");\n  const response = await fetch(\`\${baseUrl}\${path}\`, { ...init, headers });\n  const result = await response.json().catch(() => ({}));\n  if (!response.ok) throw new Error(result.error ?? \`Witnora Gateway returned HTTP \${response.status}.\`);\n  return result;\n}\n`;
+    const actionMethods = `  proposeAction(proposal, idempotencyKey = proposal?.externalId) {\n    if (typeof idempotencyKey !== "string" || !idempotencyKey) throw new Error("Witnora action proposal requires an idempotency key or externalId.");\n    return actionRequest("/v1/actions", { method: "POST", body: JSON.stringify({ proposal, idempotencyKey }) });\n  },\n  getAction(actionId) {\n    if (!/^[A-Za-z0-9._:-]+$/.test(actionId)) throw new Error("Witnora actionId contains unsupported characters.");\n    return actionRequest(\`/v1/actions/\${encodeURIComponent(actionId)}\`);\n  },\n  issueExecutionGrant(actionId, grant, idempotencyKey = \`grant:\${actionId}\`) {\n    if (!/^[A-Za-z0-9._:-]+$/.test(actionId)) throw new Error("Witnora actionId contains unsupported characters.");\n    return actionRequest(\`/v1/actions/\${encodeURIComponent(actionId)}/execution-grant\`, { method: "POST", body: JSON.stringify({ grant, idempotencyKey }) });\n  },\n`;
+    return recordedGatewayClient(config)
+        .replace("export const witnoraGateway = {", `${requestHelper}\nexport const witnoraGateway = {`)
+        .replace(/\n};\n$/, `\n${actionMethods}};\n`);
+}
+function recordedGatewayClient(config) {
     return `import { readFile } from "node:fs/promises";\n\nconst baseUrl = "http://${config.host}:${config.port}";\nlet gatewayToken;\n\nasync function token() {\n  if (gatewayToken) return gatewayToken;\n  const secrets = JSON.parse(await readFile(new URL("./secrets.json", import.meta.url), "utf8"));\n  if (typeof secrets.gatewayToken !== "string" || secrets.gatewayToken.length < 32) {\n    throw new Error("Witnora local Gateway token is missing or invalid.");\n  }\n  gatewayToken = secrets.gatewayToken;\n  return gatewayToken;\n}\n\nasync function post(runId, operation, body) {\n  if (!/^[A-Za-z0-9._:-]+$/.test(runId)) throw new Error("Witnora runId contains unsupported characters.");\n  const response = await fetch(\`\${baseUrl}/v1/runs/\${encodeURIComponent(runId)}/\${operation}\`, {\n    method: "POST",\n    headers: { authorization: \`Bearer \${await token()}\`, "content-type": "application/json" },\n    body: JSON.stringify(body),\n  });\n  const result = await response.json().catch(() => ({}));\n  if (!response.ok) throw new Error(result.error ?? \`Witnora Gateway returned HTTP \${response.status}.\`);\n  return result;\n}\n\nexport const witnoraGateway = {\n  start(runId, metadata = {}) {\n    return post(runId, "start", { payload: metadata, idempotencyKey: "run-start" });\n  },\n  event(runId, type, metadata = {}, idempotencyKey = \`\${type}-\${crypto.randomUUID()}\`) {\n    return post(runId, "events", { type, payload: metadata, idempotencyKey });\n  },\n  complete(runId, metadata = {}) {\n    return post(runId, "complete", {\n      payload: metadata,\n      evidenceStrength: {\n        schemaVersion: "agentcert.evidence_strength.v0.1",\n        level: "recorded",\n        claims: [],\n        limitations: ["No write-credential mediation or independent outcome probe is configured."],\n      },\n      idempotencyKey: "run-complete",\n    });\n  },\n};\n`;
 }
 async function writeExclusive(path, content, force, mode) {
@@ -432,12 +636,14 @@ function gatewayPaths(directory) {
         join(directory, "README.md"),
     ];
 }
-async function gatewayHealth(baseUrl, requestFetch) {
+async function gatewayHealth(baseUrl, requestFetch, requireRuntimeWorker = false) {
     try {
         const response = await requestFetch(`${baseUrl}/healthz`, { signal: AbortSignal.timeout(800) });
         if (!response.ok)
             return undefined;
         const value = await response.json();
+        if (requireRuntimeWorker && value.actionWorker?.ready !== true)
+            return undefined;
         return typeof value.collectorId === "string" && value.collectorId ? { collectorId: value.collectorId } : undefined;
     }
     catch {

package/dist/internal/control-client/canonical.d.ts

@@ -0,0 +1,2 @@
+export declare function canonicalJson(value: unknown): string;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/internal/control-client/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/canonical.ts"],"names":[],"mappings":"AAAA,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD"}

package/dist/internal/control-client/canonical.js

@@ -0,0 +1,19 @@
+export function canonicalJson(value) {
+    return JSON.stringify(canonicalValue(value));
+}
+function canonicalValue(value) {
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return value;
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            throw new Error("Canonical JSON does not support non-finite numbers.");
+        return Object.is(value, -0) ? 0 : value;
+    }
+    if (Array.isArray(value))
+        return value.map(canonicalValue);
+    if (value && typeof value === "object") {
+        const record = value;
+        return Object.fromEntries(Object.keys(record).sort().filter((key) => record[key] !== undefined).map((key) => [key, canonicalValue(record[key])]));
+    }
+    throw new Error(`Canonical JSON does not support ${typeof value}.`);
+}

package/dist/internal/control-client/collector-gateway.d.ts

@@ -0,0 +1,64 @@
+import { CustomerSourceKeyRing, type CustomerSourceSigner, type RemoteCollectorAck, type RemoteTrustedSourceRecord } from "./remote-collector.js";
+export interface RemoteCollectorTransport {
+    registerSourceKey(input: {
+        collectorId: string;
+        keyId: string;
+        publicKeyPem: string;
+        previousKeyId?: string;
+    }): Promise<Record<string, unknown>>;
+    append(runId: string, records: RemoteTrustedSourceRecord[], idempotencyKey?: string): Promise<RemoteCollectorAck>;
+    heartbeat(input: {
+        collectorId: string;
+        signer: CustomerSourceSigner;
+        pendingRecordCount: number;
+        lastAckSequence?: number;
+    }): Promise<Record<string, unknown>>;
+    reconcile(runId: string, receipt: Record<string, unknown>): Promise<Record<string, unknown>>;
+    proposeAction(proposal: Record<string, unknown>, idempotencyKey: string): Promise<Record<string, unknown>>;
+    getAction(actionId: string): Promise<Record<string, unknown>>;
+    issueExecutionGrant(actionId: string, grant: Record<string, unknown>, idempotencyKey: string): Promise<Record<string, unknown>>;
+}
+export interface CustomerOwnedCollectorGatewayOptions {
+    client: RemoteCollectorTransport;
+    keyRing: CustomerSourceKeyRing;
+    gatewayToken: string;
+    storageDirectory: string;
+    collectorVersion?: string;
+    environment?: string;
+    host?: string;
+    port?: number;
+    flushIntervalMs?: number;
+    heartbeatIntervalMs?: number;
+    maxBodyBytes?: number;
+    actionWorker?: {
+        track(input: {
+            actionId: string;
+            proposal: Record<string, unknown>;
+        }): Promise<unknown>;
+        status(): Promise<Record<string, unknown>>;
+        close?(): void | Promise<void>;
+    };
+}
+export interface CustomerOwnedCollectorGateway {
+    baseUrl: string;
+    close(): Promise<void>;
+    flush(): Promise<{
+        delivered: number;
+        reconciled: number;
+        pending: number;
+    }>;
+    status(): Promise<CollectorGatewayStatus>;
+}
+export interface CollectorGatewayStatus {
+    schemaVersion: "agentcert.customer_collector_gateway_status.v0.2";
+    collectorId: string;
+    sourceKeyId: string;
+    runCount: number;
+    pendingRecordCount: number;
+    lastAckSequence?: number;
+    lastRemoteSuccessAt?: string;
+    lastRemoteError?: string;
+    actionWorker?: Record<string, unknown>;
+}
+export declare function startCustomerOwnedCollectorGateway(options: CustomerOwnedCollectorGatewayOptions): Promise<CustomerOwnedCollectorGateway>;
+//# sourceMappingURL=collector-gateway.d.ts.map

package/dist/internal/control-client/collector-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collector-gateway.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/collector-gateway.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,qBAAqB,EAGrB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjJ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClH,SAAS,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAChK,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3G,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjI;AAED,MAAM,WAAW,oCAAoC;IACnD,MAAM,EAAE,wBAAwB,CAAC;IACjC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE;QACb,KAAK,CAAC,KAAK,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACxF,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAChC,CAAC;CACH;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,KAAK,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,MAAM,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,kDAAkD,CAAC;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAUD,wBAAsB,kCAAkC,CAAC,OAAO,EAAE,oCAAoC,GAAG,OAAO,CAAC,6BAA6B,CAAC,CA0L9I"}