witnora 0.13.5 → 0.13.7

package/dist/cli.js

@@ -39,7 +39,7 @@ import { runOnboard } from "./onboard.js";
 import { inspectRepository } from "./onboard.js";
 import { renderReleaseEvaluation, runReleaseEvaluation } from "./release-evaluation.js";
 import { runPrivateCapabilityDiscovery } from "./private-discovery.js";
-import { doctorCustomerGateway, initializeCustomerGateway, readManagedCustomerGatewayLogs, renderGatewayDoctor, renderManagedGatewayStatus, restartManagedCustomerGateway, runCustomerGateway, startManagedCustomerGateway, statusManagedCustomerGateway, stopManagedCustomerGateway, } from "./gateway.js";
+import { doctorCustomerGateway, initializeCustomerGateway, isGatewayDoctorReady, readManagedCustomerGatewayLogs, renderGatewayDoctor, renderManagedGatewayStatus, restartManagedCustomerGateway, runCustomerGateway, startManagedCustomerGateway, statusManagedCustomerGateway, stopManagedCustomerGateway, } from "./gateway.js";
 import { verifyEvidencePacketV02 } from "./evidence-v02.js";
 process.on("uncaughtException", reportFatalError);
 process.on("unhandledRejection", reportFatalError);
@@ -201,7 +201,7 @@ else if (command === "gateway") {
     else if (action === "doctor") {
         const result = await doctorCustomerGateway({ repository: readFlag("--repo") ?? process.cwd(), dir: readFlag("--dir") });
         process.stdout.write(readBoolFlag("--json") ? `${JSON.stringify(result, null, 2)}\n` : renderGatewayDoctor(result));
-        if (result.overall !== "READY_TO_RECORD")
+        if (!isGatewayDoctorReady(result))
             process.exitCode = 1;
     }
     else if (action === "start") {

package/dist/gateway.js

@@ -131,7 +131,9 @@ export async function upgradeCustomerGatewayRuntime(options) {
     const current = parseConfig(configRaw);
     if (current.projectId !== options.authorization.projectId || current.server !== options.authorization.server)
         throw new Error("Existing Gateway project/server binding does not match this authorized Runtime upgrade.");
-    if (clientRaw !== gatewayClient(current) || readmeRaw !== gatewayReadme(current))
+    const generatedClient = clientRaw === gatewayClient(current)
+        || (!current.runtimeWorker && clientRaw === recordedGatewayClient(current));
+    if (!generatedClient || readmeRaw !== gatewayReadme(current))
         throw new Error("Existing Gateway files differ from the Witnora-generated version; refusing to overwrite them.");
     if (current.runtimeWorker && current.runtimeWorker.adapterId !== LOCAL_SANDBOX_ADAPTER_ID) {
         throw new Error("Existing Gateway already has a different Runtime worker; preserve it and reconfigure in Advanced mode.");
@@ -632,7 +634,7 @@ export async function createConfiguredRuntimeActionWorker(input) {
     const runtime = await adapterModule.createWitnoraRuntimeAdapter(adapterContext);
     await inspectIsolatedOutcomeProbe(isolatedProbeConfig);
     if (runtime.id !== workerConfig.adapterId || runtime.version !== workerConfig.adapterVersion || runtime.reconcileReadOnly !== true
-        || typeof runtime.prepareClaim !== "function" || typeof runtime.execute !== "function" || typeof runtime.reconcile !== "function") {
+        || typeof runtime.prepareClaim !== "function" || typeof runtime.execute !== "function" || typeof runtime.reconcile !== "function" || typeof runtime.submitEvidence !== "function") {
         throw new Error("Runtime adapter does not match the exact configured id/version or read-only reconciliation contract.");
     }
     if (workerConfig.adapterId === LOCAL_SANDBOX_ADAPTER_ID && JSON.stringify(runtime.capabilities) !== JSON.stringify({
@@ -656,7 +658,7 @@ export async function createConfiguredRuntimeActionWorker(input) {
             listActionReceipts: async (actionId) => (await primary(`actions/${encodeURIComponent(actionId)}/receipts`)).receipts ?? [],
             claimExecutionGrant: (executionGrantId, claim, idempotencyKey) => claimHostedExecutionGrant(input.connection, requestFetch, executionGrantId, claim, idempotencyKey),
         },
-        runtime: { reconcileReadOnly: true, prepareClaim: runtime.prepareClaim, execute: runtime.execute, reconcile: runtime.reconcile },
+        runtime: { reconcileReadOnly: true, prepareClaim: runtime.prepareClaim, execute: runtime.execute, reconcile: runtime.reconcile, submitEvidence: runtime.submitEvidence },
         probe: {
             id: workerConfig.probeId,
             credentialHandle: workerConfig.probeTargetCredentialHandle,
@@ -914,6 +916,9 @@ export function renderGatewayDoctor(result) {
         "",
     ].join("\n");
 }
+export function isGatewayDoctorReady(result) {
+    return result.overall === "READY_TO_RECORD" || result.overall === "READY_FOR_RUNTIME";
+}
 function parseConfig(raw) {
     const value = JSON.parse(raw);
     if (value.schemaVersion !== CONFIG_SCHEMA || !value.projectId || !value.server || !value.connectionName || !value.collectorId) {

package/dist/internal/control-client/durable-action-worker.d.ts

@@ -1,4 +1,4 @@
-export type DurableActionPhase = "TRACKED" | "WAITING_APPROVAL" | "DENIED" | "EXPIRED" | "BLOCKED" | "GRANT_ISSUED" | "EXECUTION_STARTED" | "UNKNOWN_RESULT" | "EXECUTED" | "PROBED" | "COMPLETED";
+export type DurableActionPhase = "TRACKED" | "WAITING_APPROVAL" | "DENIED" | "EXPIRED" | "BLOCKED" | "GRANT_ISSUED" | "EXECUTION_STARTED" | "UNKNOWN_RESULT" | "EXECUTED" | "PROBED" | "EVIDENCE_SUBMITTED" | "COMPLETED";
 export interface DurableWorkerProposal {
     externalId: string;
     actionType: string;
@@ -25,6 +25,9 @@ export interface DurableWorkerAction {
     targetSystem: string;
     expectedState?: Record<string, unknown>;
     approvalExpiresAt?: string;
+    verificationSuccess?: boolean;
+    receiptId?: string;
+    receiptSignatureCount?: number;
     assuranceContext?: {
         executionIntent?: {
             adapterId: string;
@@ -118,6 +121,8 @@ export interface DurableApprovedActionWorkerOptions {
         verifyAction(actionId: string, input: Record<string, unknown>, idempotencyKey: string): Promise<{
             status: string;
             verificationSuccess?: boolean;
+            receiptId?: string;
+            receiptSignatureCount?: number;
         }>;
         listActionReceipts(actionId: string): Promise<Array<{
             id: string;
@@ -147,6 +152,14 @@ export interface DurableApprovedActionWorkerOptions {
             proposal: DurableWorkerProposal;
             grant: DurableWorkerGrant;
         }): Promise<DurableWorkerExecutionResult | undefined>;
+        submitEvidence(input: {
+            action: DurableWorkerAction;
+            proposal: DurableWorkerProposal;
+            grant: DurableWorkerGrant;
+            hostedReservation: DurableWorkerHostedReservation;
+            execution: DurableWorkerExecutionResult;
+            observation: DurableWorkerObservation;
+        }): Promise<void>;
     };
     probe: {
         id: string;

package/dist/internal/control-client/durable-action-worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"durable-action-worker.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/durable-action-worker.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,kBAAkB,GAClB,QAAQ,GACR,SAAS,GACT,SAAS,GACT,cAAc,GACd,mBAAmB,GACnB,gBAAgB,GAChB,UAAU,GACV,QAAQ,GACR,WAAW,CAAC;AAEhB,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,eAAe,EAAE;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,wBAAwB,EAAE,MAAM,CAAC;QACjC,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,gBAAgB,EAAE,MAAM,CAAC;QACzB,eAAe,EAAE,MAAM,CAAC;QACxB,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1C,YAAY,EAAE,MAAM,CAAC;QACrB,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,kBAAkB,GAAG,eAAe,GAAG,UAAU,GAAG,MAAM,CAAC;IACzI,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE;YACrC,SAAS,EAAE,MAAM,CAAC;YAClB,wBAAwB,EAAE,MAAM,CAAC;YACjC,cAAc,EAAE,MAAM,EAAE,CAAC;YACzB,gBAAgB,EAAE,MAAM,CAAC;YACzB,eAAe,EAAE,MAAM,CAAC;YACxB,wBAAwB,EAAE,MAAM,CAAC;YACjC,sBAAsB,EAAE,MAAM,CAAC;YAC/B,YAAY,EAAE,MAAM,CAAC;YACrB,gBAAgB,EAAE,MAAM,CAAC;SAC1B,CAAA;KAAE,CAAC;IACJ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACrE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,4BAA4B;IAC3C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,8BAA8B;IAC7C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,iBAAiB,EAAE,YAAY,GAAG,WAAW,GAAG,kBAAkB,GAAG,SAAS,GAAG,gBAAgB,GAAG,0BAA0B,CAAC;IAC/H,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,wCAAwC,CAAC;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,SAAS,CAAC,EAAE,4BAA4B,CAAC;IACzC,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,8BAA8B,CAAC;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAAC;IACrE,IAAI,CAAC,UAAU,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IAC3C,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACvH;AAED,qBAAa,yBAA0B,YAAW,qBAAqB;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,SAAS,EAAE,MAAM;IAEvB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC;IAQpE,IAAI,CAAC,UAAU,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAYxD,IAAI,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAQ1C,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAmB3H,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,SAAS;CAIlB;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,qBAAqB,EAAE,MAAM,CAAC;QAC9B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,KAAK,EAAE,qBAAqB,CAAC;IAC7B,MAAM,EAAE;QACN,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC1D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC3H,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QACnJ,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE;gBAAE,YAAY,CAAC,EAAE,OAAO,EAAE,CAAA;aAAE,CAAA;SAAE,CAAC,CAAC,CAAC;QAC7G,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;YAAE,QAAQ,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;KACvI,CAAC;IACF,OAAO,EAAE;QACP,iBAAiB,EAAE,IAAI,CAAC;QACxB,YAAY,CAAC,KAAK,EAAE;YAAE,MAAM,EAAE,mBAAmB,CAAC;YAAC,QAAQ,EAAE,qBAAqB,CAAC;YAAC,KAAK,EAAE,kBAAkB,CAAA;SAAE,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;QAC1J,OAAO,CAAC,KAAK,EAAE;YAAE,MAAM,EAAE,mBAAmB,CAAC;YAAC,QAAQ,EAAE,qBAAqB,CAAC;YAAC,KAAK,EAAE,kBAAkB,CAAC;YAAC,iBAAiB,EAAE,8BAA8B,CAAA;SAAE,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;QACtM,SAAS,CAAC,KAAK,EAAE;YAAE,MAAM,EAAE,mBAAmB,CAAC;YAAC,QAAQ,EAAE,qBAAqB,CAAC;YAAC,KAAK,EAAE,kBAAkB,CAAA;SAAE,GAAG,OAAO,CAAC,4BAA4B,GAAG,SAAS,CAAC,CAAC;KAClK,CAAC;IACF,KAAK,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,IAAI,CAAC;QACf,OAAO,CAAC,KAAK,EAAE;YAAE,MAAM,EAAE,mBAAmB,CAAC;YAAC,QAAQ,EAAE,qBAAqB,CAAC;YAAC,KAAK,EAAE,kBAAkB,CAAC;YAAC,SAAS,EAAE,4BAA4B,CAAA;SAAE,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;KACzL,CAAC;IACF,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,2CAA2C,CAAC;IAC3D,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,2BAA2B;IAQ1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAPpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuD;IAC9E,OAAO,CAAC,KAAK,CAAC,CAAiC;IAC/C,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;gBAEZ,OAAO,EAAE,kCAAkC;IAUlE,KAAK,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,qBAAqB,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAgB3G,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAOxD,KAAK,IAAI,IAAI;IAcb,IAAI,IAAI,IAAI;IAEN,MAAM,IAAI,OAAO,CAAC,yBAAyB,CAAC;YAapC,QAAQ;YA8GR,OAAO;CAMtB;AA2DD,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAY3F"}
+{"version":3,"file":"durable-action-worker.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/durable-action-worker.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,kBAAkB,GAClB,QAAQ,GACR,SAAS,GACT,SAAS,GACT,cAAc,GACd,mBAAmB,GACnB,gBAAgB,GAChB,UAAU,GACV,QAAQ,GACR,oBAAoB,GACpB,WAAW,CAAC;AAEhB,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,eAAe,EAAE;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,wBAAwB,EAAE,MAAM,CAAC;QACjC,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,gBAAgB,EAAE,MAAM,CAAC;QACzB,eAAe,EAAE,MAAM,CAAC;QACxB,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5C,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1C,YAAY,EAAE,MAAM,CAAC;QACrB,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,kBAAkB,GAAG,eAAe,GAAG,UAAU,GAAG,MAAM,CAAC;IACzI,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE;YACrC,SAAS,EAAE,MAAM,CAAC;YAClB,wBAAwB,EAAE,MAAM,CAAC;YACjC,cAAc,EAAE,MAAM,EAAE,CAAC;YACzB,gBAAgB,EAAE,MAAM,CAAC;YACzB,eAAe,EAAE,MAAM,CAAC;YACxB,wBAAwB,EAAE,MAAM,CAAC;YACjC,sBAAsB,EAAE,MAAM,CAAC;YAC/B,YAAY,EAAE,MAAM,CAAC;YACrB,gBAAgB,EAAE,MAAM,CAAC;SAC1B,CAAA;KAAE,CAAC;IACJ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACrE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,4BAA4B;IAC3C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,8BAA8B;IAC7C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,iBAAiB,EAAE,YAAY,GAAG,WAAW,GAAG,kBAAkB,GAAG,SAAS,GAAG,gBAAgB,GAAG,0BAA0B,CAAC;IAC/H,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,wCAAwC,CAAC;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,SAAS,CAAC,EAAE,4BAA4B,CAAC;IACzC,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,8BAA8B,CAAC;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAAC;IACrE,IAAI,CAAC,UAAU,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;IAC3C,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACvH;AAED,qBAAa,yBAA0B,YAAW,qBAAqB;IACrE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,SAAS,EAAE,MAAM;IAEvB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC;IAQpE,IAAI,CAAC,UAAU,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAYxD,IAAI,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAQ1C,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAmB3H,OAAO,CAAC,IAAI;IAIZ,OAAO,CAAC,SAAS;CAIlB;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,qBAAqB,EAAE,MAAM,CAAC;QAC9B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,KAAK,EAAE,qBAAqB,CAAC;IAC7B,MAAM,EAAE;QACN,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC1D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC3H,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACvM,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE;gBAAE,YAAY,CAAC,EAAE,OAAO,EAAE,CAAA;aAAE,CAAA;SAAE,CAAC,CAAC,CAAC;QAC7G,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;YAAE,QAAQ,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;KACvI,CAAC;IACF,OAAO,EAAE;QACP,iBAAiB,EAAE,IAAI,CAAC;QACxB,YAAY,CAAC,KAAK,EAAE;YAAE,MAAM,EAAE,mBAAmB,CAAC;YAAC,QAAQ,EAAE,qBAAqB,CAAC;YAAC,KAAK,EAAE,kBAAkB,CAAA;SAAE,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;QAC1J,OAAO,CAAC,KAAK,EAAE;YAAE,MAAM,EAAE,mBAAmB,CAAC;YAAC,QAAQ,EAAE,qBAAqB,CAAC;YAAC,KAAK,EAAE,kBAAkB,CAAC;YAAC,iBAAiB,EAAE,8BAA8B,CAAA;SAAE,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;QACtM,SAAS,CAAC,KAAK,EAAE;YAAE,MAAM,EAAE,mBAAmB,CAAC;YAAC,QAAQ,EAAE,qBAAqB,CAAC;YAAC,KAAK,EAAE,kBAAkB,CAAA;SAAE,GAAG,OAAO,CAAC,4BAA4B,GAAG,SAAS,CAAC,CAAC;QACjK,cAAc,CAAC,KAAK,EAAE;YAAE,MAAM,EAAE,mBAAmB,CAAC;YAAC,QAAQ,EAAE,qBAAqB,CAAC;YAAC,KAAK,EAAE,kBAAkB,CAAC;YAAC,iBAAiB,EAAE,8BAA8B,CAAC;YAAC,SAAS,EAAE,4BAA4B,CAAC;YAAC,WAAW,EAAE,wBAAwB,CAAA;SAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACtQ,CAAC;IACF,KAAK,EAAE;QACL,EAAE,EAAE,MAAM,CAAC;QACX,gBAAgB,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,IAAI,CAAC;QACf,OAAO,CAAC,KAAK,EAAE;YAAE,MAAM,EAAE,mBAAmB,CAAC;YAAC,QAAQ,EAAE,qBAAqB,CAAC;YAAC,KAAK,EAAE,kBAAkB,CAAC;YAAC,SAAS,EAAE,4BAA4B,CAAA;SAAE,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;KACzL,CAAC;IACF,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,2CAA2C,CAAC;IAC3D,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,2BAA2B;IAQ1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAPpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuD;IAC9E,OAAO,CAAC,KAAK,CAAC,CAAiC;IAC/C,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;gBAEZ,OAAO,EAAE,kCAAkC;IAUlE,KAAK,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,qBAAqB,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAgB3G,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAOxD,KAAK,IAAI,IAAI;IAcb,IAAI,IAAI,IAAI;IAEN,MAAM,IAAI,OAAO,CAAC,yBAAyB,CAAC;YAapC,QAAQ;YAgIR,OAAO;CAMtB;AA2DD,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAY3F"}

package/dist/internal/control-client/durable-action-worker.js

@@ -160,6 +160,9 @@ export class DurableApprovedActionWorker {
         if (!exactActionMatches(action, actionId, checkpoint.proposal, this.options.config.adapterId, this.options.config.adapterVersion)) {
             return this.persist(checkpoint, "BLOCKED", { limitation: "Hosted action no longer matches the exact locally configured action, adapter, or build binding." });
         }
+        if (action.status === "VERIFIED" && action.verificationSuccess === true && action.receiptId && (action.receiptSignatureCount ?? 0) > 0) {
+            return this.persist(checkpoint, "COMPLETED", { receiptId: action.receiptId, limitation: undefined });
+        }
         if ((checkpoint.phase === "EXECUTION_STARTED" || checkpoint.phase === "UNKNOWN_RESULT") && checkpoint.grant) {
             if (!exactGrantMatches(checkpoint.grant, actionId, checkpoint.proposal, this.options.config.runtimeIdentityId)) {
                 return this.persist(checkpoint, "BLOCKED", { limitation: "Hosted grant does not match the exact approved local action binding." });
@@ -261,6 +264,19 @@ export class DurableApprovedActionWorker {
                 throw new Error("Outcome observation did not come from the exact configured probe.");
             checkpoint = await this.persist(checkpoint, "PROBED", { observation });
         }
+        if (checkpoint.phase !== "EVIDENCE_SUBMITTED") {
+            if (!checkpoint.hostedReservation)
+                throw new Error("Durable execution evidence requires the bound Hosted reservation.");
+            await this.options.runtime.submitEvidence({
+                action,
+                proposal: checkpoint.proposal,
+                grant,
+                hostedReservation: checkpoint.hostedReservation,
+                execution: checkpoint.execution,
+                observation: checkpoint.observation,
+            });
+            checkpoint = await this.persist(checkpoint, "EVIDENCE_SUBMITTED");
+        }
         const verified = await this.options.hosted.verifyAction(actionId, {
             ...checkpoint.observation,
             executionGrantId: grant.id,
@@ -268,6 +284,9 @@ export class DurableApprovedActionWorker {
         }, `durable-worker:verify:${actionId}:${checkpoint.execution.executionSessionId}`);
         if (verified.status !== "VERIFIED" || verified.verificationSuccess !== true)
             throw new Error("Hosted outcome verification did not establish the expected result.");
+        if (verified.receiptId && (verified.receiptSignatureCount ?? 0) > 0) {
+            return this.persist(checkpoint, "COMPLETED", { receiptId: verified.receiptId });
+        }
         const receipts = await this.options.hosted.listActionReceipts(actionId);
         const signed = receipts.find((item) => Array.isArray(item.receipt?.signatureSet) && item.receipt.signatureSet.length > 0);
         if (!signed)

package/dist/runtime-sandbox-kit.js

@@ -221,9 +221,230 @@ export function createWitnoraRuntimeAdapter(context) {
       await persistExecution(context.storageDirectory, action.id, execution);
       return execution;
     },
+    async submitEvidence({ action, proposal, grant, hostedReservation, execution, observation }) {
+      const audit = await readCommittedAudit(reconcileCredential.handle, action.id, execution.executionSessionId);
+      const bundle = await loadOrCreateEvidenceBundle({
+        storageDirectory: context.storageDirectory,
+        action,
+        proposal,
+        grant,
+        hostedReservation,
+        execution,
+        observation,
+        audit,
+        runtime,
+        adapterId: context.adapterId,
+        adapterVersion: context.adapterVersion,
+        signingKeyHandle: signingKey.handle,
+        writeCredentialHandle: writeCredential.handle,
+      });
+      await context.hosted.request("execution-attempts/" + encodeURIComponent(execution.executionSessionId) + "/phase", {
+        method: "POST",
+        body: { executionSessionId: execution.executionSessionId, runtimeClaim: hostedReservation.claim, phase: "RECONCILED_SUCCESS", targetOperationId: execution.targetOperationId },
+      });
+      await context.hosted.request("execution-sessions/" + encodeURIComponent(execution.executionSessionId) + "/evidence", { method: "POST", body: bundle });
+    },
+  };
+}
+
+async function readCommittedAudit(handle, actionId, executionSessionId) {
+  const credential = await readSecretHandle(handle);
+  const response = await fetch("${sandboxOrigin}/audit/actions/" + encodeURIComponent(actionId) + "/sessions/" + encodeURIComponent(executionSessionId), { redirect: "error", headers: { "x-sandbox-audit-credential": credential } });
+  const audit = await response.json().catch(() => ({}));
+  if (!response.ok || audit.phase !== "COMMITTED" || audit.actionId !== actionId || audit.executionSessionId !== executionSessionId || typeof audit.transactionId !== "string") throw new Error("sandbox_evidence_audit_invalid");
+  return audit;
+}
+
+async function loadOrCreateEvidenceBundle(input) {
+  const path = join(input.storageDirectory, "evidence-bundles", safeId(input.action.id) + ".json");
+  try { return JSON.parse(await readFile(path, "utf8")); }
+  catch (error) { if (error?.code !== "ENOENT") throw error; }
+  const bundle = await createEvidenceBundle(input);
+  await mkdir(dirname(path), { recursive: true });
+  const temporary = path + "." + randomUUID() + ".tmp";
+  await writeFile(temporary, JSON.stringify(bundle) + "\\n", { mode: 0o600 });
+  await rename(temporary, path);
+  return bundle;
+}
+
+async function createEvidenceBundle(input) {
+  const grant = exactObject(input.grant?.grant, "grant");
+  const grantPayload = exactObject(grant.payload, "grant.payload");
+  const runtimeClaim = exactObject(input.hostedReservation.claim, "runtimeClaim");
+  const claimedAt = String(exactObject(runtimeClaim.payload, "runtimeClaim.payload").claimedAt);
+  const completedAt = new Date().toISOString();
+  const privateKeyPem = await readSecretHandle(input.signingKeyHandle);
+  const signRuntime = (payload) => {
+    const payloadSha256 = sha256(canonicalJson(payload));
+    return { payload, payloadSha256, signature: { algorithm: "Ed25519", keyId: input.runtime.keyId, signature: sign(null, Buffer.from(payloadSha256, "hex"), createPrivateKey(privateKeyPem)).toString("base64url") } };
+  };
+  const credentialLeaseId = randomUUID();
+  const eventChainGenesisHash = sha256(canonicalJson({ executionSessionId: input.execution.executionSessionId, executionGrantDigest: grant.payloadSha256, runtimeIdentityId: input.runtime.id }));
+  const executionSession = signRuntime({
+    protocolVersion: "agentcert.browser_enforcement.v0.2",
+    objectType: "ExecutionSessionAttestation",
+    signatureContext: "onegent.execution-session.v0.2",
+    executionSessionId: input.execution.executionSessionId,
+    executionGrantId: input.grant.id,
+    executionGrantDigest: grant.payloadSha256,
+    actionId: input.action.id,
+    actionIntentDigest: grantPayload.actionIntentDigest,
+    runtimeIdentityId: input.runtime.id,
+    runtimeKeyId: input.runtime.keyId,
+    adapterId: input.adapterId,
+    adapterVersion: input.adapterVersion,
+    browserContextIdDigest: sha256("durable-action:" + input.execution.executionSessionId),
+    credentialLeaseId,
+    credentialIsolationMode: "RUNTIME_INJECTED_CREDENTIAL",
+    targetAudience: grantPayload.targetAudience,
+    allowedOrigins: grantPayload.allowedOrigins,
+    startedAt: claimedAt,
+    sessionExpiresAt: grantPayload.expiresAt,
+    eventChainGenesisHash,
+  });
+  const events = [];
+  let previousEventHash = eventChainGenesisHash;
+  const append = (eventType, redactedPayload = {}) => {
+    const payload = {
+      protocolVersion: "agentcert.browser_enforcement.v0.2",
+      objectType: "ExecutionEvent",
+      signatureContext: "onegent.execution-event.v0.2",
+      eventId: randomUUID(),
+      actionId: input.action.id,
+      executionSessionId: input.execution.executionSessionId,
+      sequence: events.length + 1,
+      previousEventHash,
+      eventType,
+      sourceIdentityId: input.runtime.id,
+      sourceTimestamp: completedAt,
+      receivedTimestamp: completedAt,
+      payloadDigest: sha256(canonicalJson(redactedPayload)),
+      redactedPayload,
+    };
+    const signed = signRuntime(payload);
+    previousEventHash = signed.payloadSha256;
+    events.push(signed);
+  };
+  append("EXECUTION_GRANT_VERIFIED", { executionGrantDigest: grant.payloadSha256 });
+  append("EXECUTION_GRANT_CLAIMED", { executionGrantId: input.grant.id, claimDigest: runtimeClaim.payloadSha256 });
+  append("EXECUTION_SESSION_STARTED", { executionSessionDigest: executionSession.payloadSha256 });
+  append("CREDENTIAL_LEASE_ACTIVATED", { credentialLeaseId, isolationMode: "RUNTIME_INJECTED_CREDENTIAL" });
+  append("BROWSER_CONTEXT_CREATED", { browserContextIdDigest: executionSession.payload.browserContextIdDigest });
+  append("TARGET_NAVIGATION", { targetAudience: grantPayload.targetAudience, origin: grantPayload.allowedOrigins[0] });
+  append("AUTHORIZED_ACTION_PREPARED", { operation: grantPayload.allowedOperation, resource: grantPayload.allowedResource });
+  append("FINAL_PARAMETERS_VERIFIED", { parametersDigest: grantPayload.parametersDigest });
+  append("HIGH_RISK_SUBMISSION_STARTED", { actionId: input.action.id });
+  append("HIGH_RISK_SUBMISSION_COMPLETED", { targetSystem: input.action.targetSystem });
+  append("TARGET_RESPONSE_OBSERVED", { observedStateDigest: sha256(canonicalJson(input.execution.observedState ?? {})) });
+  append("OUTCOME_PROBE_STARTED", { probe: input.observation.observationSource });
+  append("OUTCOME_OBSERVED", { source: input.observation.observationSource, observedStateDigest: sha256(canonicalJson(input.observation.observedState)) });
+  append("CREDENTIAL_LEASE_REVOKED", { credentialLeaseId, revokedAt: completedAt, status: "REVOKED" });
+  const expectedState = input.action.expectedState ?? input.proposal.expectedState ?? {};
+  const outcomeResult = subsetMatches(expectedState, input.observation.observedState) ? "SATISFIED" : "NOT_SATISFIED";
+  const outcomeAttestation = signRuntime({
+    protocolVersion: "agentcert.browser_enforcement.v0.2",
+    objectType: "OutcomeAttestation",
+    signatureContext: "onegent.outcome-attestation.v0.2",
+    outcomeAttestationId: randomUUID(),
+    actionId: input.action.id,
+    executionSessionId: input.execution.executionSessionId,
+    executionGrantId: input.grant.id,
+    predicateId: "expected_state_subset",
+    predicateVersion: "1",
+    predicateDigest: grantPayload.outcomePredicateDigest,
+    expectedStateDigest: sha256(canonicalJson(expectedState)),
+    observedStateDigest: sha256(canonicalJson(input.observation.observedState)),
+    result: outcomeResult,
+    observationMethod: input.observation.observationMethod,
+    observationIndependence: "SEPARATE_READ_ONLY_PROBE",
+    observationSource: input.observation.observationSource,
+    sourceEvidenceDigest: sha256(canonicalJson(input.observation)),
+    evidenceReferences: ["target-audit:" + input.audit.transactionId],
+    collectorIdentityId: input.runtime.id,
+    collectorKeyId: input.runtime.keyId,
+    collectedAt: completedAt,
+    confidence: input.observation.confidence ?? 1,
+    limitations: ["The generated probe reads a separate localhost read credential; it is not an Independent Review."],
+  });
+  append("EXECUTION_SESSION_COMPLETED", { outcomeAttestationDigest: outcomeAttestation.payloadSha256 });
+  const credentialReferenceDigest = sha256(input.writeCredentialHandle);
+  const targetEvent = {
+    targetEventId: input.audit.transactionId,
+    actionId: input.action.id,
+    executionSessionId: input.execution.executionSessionId,
+    occurredAt: input.audit.at ?? completedAt,
+    operation: grantPayload.allowedOperation,
+    resource: grantPayload.allowedResource,
+    parametersDigest: grantPayload.parametersDigest,
+    credentialReferenceDigest,
+  };
+  const reconciliationReport = signRuntime({
+    protocolVersion: "agentcert.browser_enforcement.v0.2",
+    objectType: "ReconciliationReport",
+    signatureContext: "onegent.reconciliation-report.v0.2",
+    reconciliationReportId: randomUUID(),
+    tenantId: grantPayload.tenantId,
+    actionId: input.action.id,
+    executionSessionId: input.execution.executionSessionId,
+    targetSystem: grantPayload.targetAudience,
+    accountOrCredentialReferenceDigest: credentialReferenceDigest,
+    reconciliationWindowStart: claimedAt,
+    reconciliationWindowEnd: completedAt,
+    expectedActionIds: [input.action.id],
+    observedTargetEvents: [targetEvent],
+    matchedEvents: [input.audit.transactionId],
+    unmatchedTargetEvents: [],
+    unmatchedReceipts: [],
+    duplicateMatches: [],
+    result: "PASSED",
+    limitations: ["Reconciliation covers the dedicated localhost sandbox credential and this action only."],
+    collectorIdentityId: input.runtime.id,
+    collectedAt: completedAt,
+  });
+  const eventCheckpoint = signRuntime({
+    protocolVersion: "agentcert.browser_enforcement.v0.2",
+    objectType: "EventChainCheckpoint",
+    signatureContext: "onegent.event-checkpoint.v0.2",
+    actionId: input.action.id,
+    executionSessionId: input.execution.executionSessionId,
+    eventCount: events.length,
+    firstEventHash: events[0].payloadSha256,
+    finalEventHash: events.at(-1).payloadSha256,
+    completedAt,
+  });
+  return {
+    protocolVersion: "agentcert.browser_enforcement.v0.2",
+    executionGrant: grant,
+    grantStatus: "CONSUMED",
+    runtimeClaim,
+    executionSession,
+    credentialLease: {
+      credentialLeaseId,
+      tenantId: grantPayload.tenantId,
+      actionId: input.action.id,
+      executionSessionId: input.execution.executionSessionId,
+      providerType: "CUSTOMER_SECRET_PROVIDER",
+      providerReference: "opaque:" + credentialReferenceDigest,
+      targetAudience: grantPayload.targetAudience,
+      scopeDigest: sha256(canonicalJson({ allowedOrigins: grantPayload.allowedOrigins, operation: grantPayload.allowedOperation, resource: grantPayload.allowedResource })),
+      isolationMode: "RUNTIME_INJECTED_CREDENTIAL",
+      issuedAt: claimedAt,
+      expiresAt: grantPayload.expiresAt,
+      status: "REVOKED",
+      revokedAt: completedAt,
+    },
+    events,
+    eventCheckpoint,
+    outcomeAttestation,
+    reconciliationReport,
+    finalParametersDigest: grantPayload.parametersDigest,
+    detectedBypass: false,
+    execution: { method: "LOCAL_ADAPTER", status: "COMPLETED", targetSystem: input.action.targetSystem, observedState: input.execution.observedState },
   };
 }
 
+function subsetMatches(expected, observed) { return Object.entries(expected).every(([key, value]) => canonicalJson(observed[key]) === canonicalJson(value)); }
+
 function localhostTarget(proposal) {
   if (proposal?.targetSystem !== "WitnoraLocalSandbox") throw new Error("sandbox_target_system_invalid");
   const origins = proposal?.executionIntent?.allowedOrigins;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.13.5",
+  "version": "0.13.7",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "Apache-2.0",