witnora 0.13.7 → 0.13.8

package/dist/cli.js

@@ -39,7 +39,7 @@ import { runOnboard } from "./onboard.js";
 import { inspectRepository } from "./onboard.js";
 import { renderReleaseEvaluation, runReleaseEvaluation } from "./release-evaluation.js";
 import { runPrivateCapabilityDiscovery } from "./private-discovery.js";
-import { doctorCustomerGateway, initializeCustomerGateway, isGatewayDoctorReady, readManagedCustomerGatewayLogs, renderGatewayDoctor, renderManagedGatewayStatus, restartManagedCustomerGateway, runCustomerGateway, startManagedCustomerGateway, statusManagedCustomerGateway, stopManagedCustomerGateway, } from "./gateway.js";
+import { configureManagedWorkflowHarness, doctorCustomerGateway, initializeCustomerGateway, isGatewayDoctorReady, readManagedCustomerGatewayLogs, renderGatewayDoctor, renderManagedGatewayStatus, restartManagedCustomerGateway, runCustomerGateway, startManagedCustomerGateway, statusManagedCustomerGateway, stopManagedCustomerGateway, } from "./gateway.js";
 import { verifyEvidencePacketV02 } from "./evidence-v02.js";
 process.on("uncaughtException", reportFatalError);
 process.on("unhandledRejection", reportFatalError);
@@ -231,8 +231,25 @@ else if (command === "gateway") {
     else if (action === "run") {
         await runCustomerGateway({ repository: readFlag("--repo") ?? process.cwd(), dir: readFlag("--dir") });
     }
+    else if (action === "workflow-harness") {
+        const workflowIds = process.argv.flatMap((argument, index) => argument === "--workflow" && process.argv[index + 1] ? [process.argv[index + 1]] : []);
+        const evaluatorOrigin = readFlag("--evaluator-origin");
+        const evaluatorCredentialHandle = readFlag("--evaluator-credential-handle");
+        const evaluatorContractSha256 = readFlag("--evaluator-contract-sha256");
+        if (!workflowIds.length || !evaluatorOrigin || !evaluatorCredentialHandle || !evaluatorContractSha256) {
+            throw new Error("Use witnora gateway workflow-harness --workflow <id> --evaluator-origin http://127.0.0.1:<port>/ --evaluator-credential-handle file://... --evaluator-contract-sha256 <sha256>.");
+        }
+        const result = await configureManagedWorkflowHarness({
+            repository: readFlag("--repo") ?? process.cwd(), dir: readFlag("--dir"), workflowIds,
+            evaluatorOrigin, evaluatorCredentialHandle, evaluatorContractSha256,
+            pollIntervalMs: readFlag("--poll-ms") ? Number(readFlag("--poll-ms")) : undefined,
+            maxConcurrency: readFlag("--max-concurrency") ? Number(readFlag("--max-concurrency")) : undefined,
+            force: readBoolFlag("--force"),
+        });
+        process.stdout.write(`Configured the Managed Workflow Harness for ${result.config.workflowIds.length} exact Workflow Contract(s).\nConfig: ${result.path}\nRestart the managed Gateway to activate it.\n`);
+    }
     else {
-        throw new Error("Use witnora gateway init|doctor|start|status|logs|restart|stop|run.");
+        throw new Error("Use witnora gateway init|doctor|start|status|logs|restart|stop|run|workflow-harness.");
     }
 }
 else if (command === "discover") {

package/dist/command-help.js

@@ -65,6 +65,8 @@ Options:
   witnora gateway restart
   witnora gateway stop
   witnora gateway run
+  witnora gateway workflow-harness --workflow <id> --evaluator-origin http://127.0.0.1:<port>/ \\
+    --evaluator-credential-handle file://... --evaluator-contract-sha256 <sha256>
 
 Initializes and manages a customer-owned, metadata-only collector beside the Agent.
 The browser approval issues a collector-scoped credential; no API key is copied into
@@ -86,6 +88,12 @@ Options:
   --force                 Replace an existing reviewed local setup
   --json                  JSON status output
   --lines <count>         Number of recent log lines (default: 100)
+  --workflow <id>         Exact active Workflow Contract (repeatable)
+  --evaluator-origin      Literal-loopback customer evaluator origin
+  --evaluator-credential-handle  Opaque file:// bearer credential reference
+  --evaluator-contract-sha256    Pinned evaluator contract digest
+  --poll-ms <milliseconds>       Workflow plan interval (1000-60000)
+  --max-concurrency <count>      Bounded ready evaluations (1-16)
 `;
     if (command === "design-partner")
         return `Usage:

package/dist/gateway.js

@@ -13,6 +13,7 @@ import { generateRuntimeSandboxKit, LOCAL_SANDBOX_ADAPTER_ID, LOCAL_SANDBOX_ADAP
 const CONFIG_SCHEMA = "witnora.customer_gateway_setup.v0.1";
 const SECRETS_SCHEMA = "witnora.customer_gateway_local_secrets.v0.1";
 const RUNTIME_SCHEMA = "witnora.managed_gateway_runtime.v0.1";
+const WORKFLOW_HARNESS_SCHEMA = "witnora.managed_workflow_harness.v0.1";
 export async function initializeCustomerGateway(options) {
     const repository = resolve(options.repository ?? process.cwd());
     const outDir = resolve(repository, options.outDir ?? ".witnora/gateway");
@@ -468,6 +469,10 @@ export async function runCustomerGateway(options) {
         throw new Error("The saved Gateway credential does not match gateway.json. Run gateway init again.");
     }
     const dataDirectory = resolve(directory, config.storageDirectory);
+    const workflowHarnessConfigPath = join(directory, "workflow-harness.json");
+    const workflowHarnessConfig = await exists(workflowHarnessConfigPath)
+        ? parseManagedWorkflowHarnessConfig(await readFile(workflowHarnessConfigPath, "utf8"))
+        : undefined;
     const keyRingPath = join(dataDirectory, "source-keys.json");
     const keyRing = await (await exists(keyRingPath)
         ? CustomerSourceKeyRing.open(keyRingPath)
@@ -489,6 +494,16 @@ export async function runCustomerGateway(options) {
                 FileActionCheckpointStore: (await durableWorker).FileActionCheckpointStore,
             })
             : undefined;
+        const workflowHarness = workflowHarnessConfig
+            ? await createConfiguredWorkflowHarness({
+                directory,
+                projectId: config.projectId,
+                server: config.server,
+                apiKey: connection.apiKey,
+                config: workflowHarnessConfig,
+                managed: await configManagedWorkflowHarnessImport(),
+            })
+            : undefined;
         actionWorker?.start();
         const gateway = await startCustomerOwnedCollectorGateway({
             client: new RemoteCollectorClient({ baseUrl: connection.server, projectId: connection.projectId, apiKey: connection.apiKey }),
@@ -533,12 +548,15 @@ export async function runCustomerGateway(options) {
                         } } : {}),
                 } } : {}),
         });
+        workflowHarness?.start();
         process.stdout.write(`Witnora customer-owned Gateway listening on ${gateway.baseUrl}\n`);
         process.stdout.write(config.runtimeWorker
             ? "Runtime worker: READY. Approved exact configured actions execute automatically, then use the separate read-only probe and Hosted signed receipt.\n"
             : "Evidence ceiling: RECORDED. No exact target adapter and separate outcome probe are configured, so runtime writes remain fail-closed.\n");
+        if (workflowHarness)
+            process.stdout.write("Managed Workflow Harness: CONFIGURED. Only authority-ready Replay and no-write Shadow evaluations will be sent to the pinned customer evaluator.\n");
         for (const signal of ["SIGINT", "SIGTERM"]) {
-            process.once(signal, () => void Promise.allSettled([gateway.close(), ...(sandboxFixture ? [sandboxFixture.close()] : [])]).finally(() => process.exit(0)));
+            process.once(signal, () => void Promise.allSettled([gateway.close(), ...(workflowHarness ? [workflowHarness.close()] : []), ...(sandboxFixture ? [sandboxFixture.close()] : [])]).finally(() => process.exit(0)));
         }
     }
     catch (error) {
@@ -546,6 +564,75 @@ export async function runCustomerGateway(options) {
         throw error;
     }
 }
+function configManagedWorkflowHarnessImport() {
+    return import(new URL("./vendor/onegent-runtime/managed-workflow-harness.js", import.meta.url).href);
+}
+export async function createConfiguredWorkflowHarness(input) {
+    const requestFetch = input.fetch ?? fetch;
+    const credential = await readSecretProviderHandle(input.config.evaluatorCredentialHandle);
+    const health = await requestFetch(`${input.config.evaluatorOrigin}/healthz`, {
+        headers: { authorization: `Bearer ${credential}` },
+        redirect: "error",
+        signal: AbortSignal.timeout(2_000),
+    });
+    const healthBody = await health.json().catch(() => ({}));
+    if (!health.ok
+        || healthBody.schemaVersion !== "witnora.business_task_evaluator.v0.1"
+        || healthBody.contractSha256 !== input.config.evaluatorContractSha256) {
+        throw new Error("Managed Workflow evaluator health did not match its pinned local contract.");
+    }
+    const hosted = input.managed.createManagedWorkflowHostedClient({
+        baseUrl: input.server,
+        projectId: input.projectId,
+        apiKey: input.apiKey,
+        workflowIds: input.config.workflowIds,
+        fetch: requestFetch,
+    });
+    const worker = new input.managed.ManagedBusinessWorkflowHarness({
+        client: hosted,
+        checkpoints: new input.managed.FileWorkflowEvaluationCheckpointStore(join(input.directory, "data", "workflow-evaluations")),
+        maxConcurrency: input.config.maxConcurrency,
+        evaluate: async ({ task, evaluation }) => {
+            const response = await requestFetch(`${input.config.evaluatorOrigin}/v1/evaluate`, {
+                method: "POST",
+                headers: { authorization: `Bearer ${credential}`, "content-type": "application/json" },
+                body: JSON.stringify({ schemaVersion: "witnora.business_task_evaluation_request.v0.1", task, evaluation }),
+                redirect: "error",
+                signal: AbortSignal.timeout(120_000),
+            });
+            const body = await response.json().catch(() => ({}));
+            if (!response.ok || !body.report || typeof body.report !== "object" || Array.isArray(body.report)) {
+                throw new Error(`Managed Workflow evaluator failed (${response.status}).`);
+            }
+            return body.report;
+        },
+    });
+    let timer;
+    let closing = false;
+    const tick = async () => {
+        const result = await worker.tick();
+        if ((result.evaluationsFailed ?? 0) > 0) {
+            process.stderr.write(`Managed Workflow Harness stopped ${result.evaluationsFailed} evaluation(s) fail-closed. ${result.limitations?.[0] ?? "Inspect the customer evaluator and retry."}\n`);
+        }
+        return result;
+    };
+    return {
+        start() {
+            if (timer || closing)
+                return;
+            void tick().catch((error) => process.stderr.write(`Managed Workflow Harness tick failed: ${error instanceof Error ? error.message : "unknown error"}\n`));
+            timer = setInterval(() => void tick().catch((error) => process.stderr.write(`Managed Workflow Harness tick failed: ${error instanceof Error ? error.message : "unknown error"}\n`)), input.config.pollIntervalMs ?? 5_000);
+            timer.unref?.();
+        },
+        async close() {
+            closing = true;
+            if (timer)
+                clearInterval(timer);
+            timer = undefined;
+        },
+        tick,
+    };
+}
 async function runtimeSandboxFixtureReady(config) {
     try {
         if (config.adapterId !== LOCAL_SANDBOX_ADAPTER_ID || !config.sandboxOrigin || !config.probeTargetCredentialHandle || !config.fixtureContractSha256)
@@ -936,6 +1023,63 @@ function parseConfig(raw) {
     }
     return config;
 }
+export function parseManagedWorkflowHarnessConfig(raw) {
+    const value = JSON.parse(raw);
+    if (value.schemaVersion !== WORKFLOW_HARNESS_SCHEMA
+        || value.enabled !== true
+        || !literalLoopbackOrigin(value.evaluatorOrigin)
+        || !credentialHandle(value.evaluatorCredentialHandle ?? "")
+        || !validDigest(value.evaluatorContractSha256 ?? "")
+        || !Array.isArray(value.workflowIds)
+        || !value.workflowIds.length
+        || value.workflowIds.length > 100
+        || new Set(value.workflowIds).size !== value.workflowIds.length
+        || value.workflowIds.some((id) => typeof id !== "string" || !/^[A-Za-z0-9._:-]{1,200}$/.test(id))) {
+        throw new Error("workflow-harness.json requires an enabled, digest-pinned literal-loopback evaluator and a local credential handle.");
+    }
+    if (value.pollIntervalMs !== undefined && (!Number.isInteger(value.pollIntervalMs) || value.pollIntervalMs < 1_000 || value.pollIntervalMs > 60_000)) {
+        throw new Error("workflow-harness.json pollIntervalMs must be between 1000 and 60000.");
+    }
+    if (value.maxConcurrency !== undefined && (!Number.isInteger(value.maxConcurrency) || value.maxConcurrency < 1 || value.maxConcurrency > 16)) {
+        throw new Error("workflow-harness.json maxConcurrency must be between 1 and 16.");
+    }
+    return value;
+}
+export async function configureManagedWorkflowHarness(options) {
+    const directory = resolve(options.repository ?? process.cwd(), options.dir ?? ".witnora/gateway");
+    if (!await exists(join(directory, "gateway.json")))
+        throw new Error("Initialize the customer-owned Gateway before configuring its Workflow Harness.");
+    const config = parseManagedWorkflowHarnessConfig(JSON.stringify({
+        schemaVersion: WORKFLOW_HARNESS_SCHEMA,
+        enabled: true,
+        evaluatorOrigin: options.evaluatorOrigin,
+        evaluatorCredentialHandle: options.evaluatorCredentialHandle,
+        evaluatorContractSha256: options.evaluatorContractSha256,
+        workflowIds: options.workflowIds,
+        ...(options.pollIntervalMs === undefined ? {} : { pollIntervalMs: options.pollIntervalMs }),
+        ...(options.maxConcurrency === undefined ? {} : { maxConcurrency: options.maxConcurrency }),
+    }));
+    const path = join(directory, "workflow-harness.json");
+    await writeExclusive(path, `${JSON.stringify(config, null, 2)}\n`, options.force ?? false, 0o600);
+    return { path, config };
+}
+function literalLoopbackOrigin(value) {
+    if (typeof value !== "string")
+        return false;
+    try {
+        const url = new URL(value);
+        return url.protocol === "http:"
+            && (url.hostname === "127.0.0.1" || url.hostname === "[::1]")
+            && url.username === ""
+            && url.password === ""
+            && url.pathname === "/"
+            && url.search === ""
+            && url.hash === "";
+    }
+    catch {
+        return false;
+    }
+}
 function validateRuntimeWorkerConfig(value) {
     if (value.enabled !== true || !value.adapterModulePath || !/^[a-f0-9]{64}$/.test(value.adapterModuleSha256)
         || !value.probeModulePath || !/^[a-f0-9]{64}$/.test(value.probeModuleSha256)

package/dist/vendor/onegent-runtime/managed-workflow-harness.d.ts

@@ -0,0 +1,92 @@
+import type { TaskEvaluationContract, TaskEvaluationReport } from "./task-evaluation.js";
+export type ManagedWorkflowEvaluationMode = "REPLAY" | "SHADOW";
+export interface ManagedWorkflowExecutionPlan {
+    schemaVersion: "witnora.business_workflow_execution_plan.v0.1";
+    projectId: string;
+    generatedAt: string;
+    workflow: {
+        id: string;
+        digestSha256: string;
+        status: "ACTIVE" | "RETIRED";
+    };
+    nodes: Array<{
+        id: string;
+        status: "BLOCKED" | "READY" | "RUNNING" | "NEEDS_DECISION" | "COMPLETED";
+    }>;
+    readyEvaluations: ManagedWorkflowReadyEvaluation[];
+    recordsTruncated: boolean;
+    safety: {
+        productionWrites: 0;
+        aggregateAssuranceClaim: false;
+        customerHarnessRequired: true;
+    };
+    limitations: string[];
+}
+export interface ManagedWorkflowReadyEvaluation {
+    nodeId: string;
+    taskContractId: string;
+    taskContractDigestSha256: string;
+    taskKey: string;
+    agentId: string;
+    agentVersion: string;
+    mode: ManagedWorkflowEvaluationMode;
+}
+export interface ManagedWorkflowHostedClient {
+    listActiveWorkflows(): Promise<Array<{
+        id: string;
+        digestSha256: string;
+        status: "ACTIVE" | "RETIRED";
+    }>>;
+    getExecutionPlan(workflowId: string): Promise<ManagedWorkflowExecutionPlan>;
+    getTask(taskContractId: string): Promise<TaskEvaluationContract>;
+    upload(report: TaskEvaluationReport, input: {
+        externalId: string;
+    }): Promise<unknown>;
+}
+export declare function createManagedWorkflowHostedClient(options: {
+    baseUrl: string;
+    projectId: string;
+    apiKey: string;
+    workflowIds?: string[];
+    fetch?: typeof fetch;
+}): ManagedWorkflowHostedClient;
+export interface WorkflowEvaluationCheckpointStore {
+    load(key: string): Promise<TaskEvaluationReport | undefined>;
+    save(key: string, report: TaskEvaluationReport): Promise<void>;
+    complete(key: string): Promise<void>;
+}
+export declare class MemoryWorkflowEvaluationCheckpointStore implements WorkflowEvaluationCheckpointStore {
+    #private;
+    load(key: string): Promise<TaskEvaluationReport | undefined>;
+    save(key: string, report: TaskEvaluationReport): Promise<void>;
+    complete(key: string): Promise<void>;
+}
+export declare class FileWorkflowEvaluationCheckpointStore implements WorkflowEvaluationCheckpointStore {
+    private readonly directory;
+    constructor(directory: string);
+    load(key: string): Promise<TaskEvaluationReport | undefined>;
+    save(key: string, report: TaskEvaluationReport): Promise<void>;
+    complete(key: string): Promise<void>;
+    private path;
+}
+export interface ManagedBusinessWorkflowHarnessResult {
+    workflowsInspected: number;
+    evaluationsCompleted: number;
+    evaluationsFailed: number;
+    limitations: string[];
+}
+export declare class ManagedBusinessWorkflowHarness {
+    #private;
+    constructor(options: {
+        client: ManagedWorkflowHostedClient;
+        checkpoints: WorkflowEvaluationCheckpointStore;
+        evaluate: (input: {
+            task: TaskEvaluationContract;
+            evaluation: ManagedWorkflowReadyEvaluation;
+        }) => Promise<TaskEvaluationReport>;
+        maxConcurrency?: number;
+    });
+    tick(): Promise<ManagedBusinessWorkflowHarnessResult>;
+    private runTick;
+}
+//# sourceMappingURL=managed-workflow-harness.d.ts.map

package/dist/vendor/onegent-runtime/managed-workflow-harness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-workflow-harness.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/managed-workflow-harness.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAGzF,MAAM,MAAM,6BAA6B,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhE,MAAM,WAAW,4BAA4B;IAC3C,aAAa,EAAE,+CAA+C,CAAC;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAA;KAAE,CAAC;IAC7E,KAAK,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,gBAAgB,GAAG,WAAW,CAAA;KAAE,CAAC,CAAC;IACvG,gBAAgB,EAAE,8BAA8B,EAAE,CAAC;IACnD,gBAAgB,EAAE,OAAO,CAAC;IAC1B,MAAM,EAAE;QAAE,gBAAgB,EAAE,CAAC,CAAC;QAAC,uBAAuB,EAAE,KAAK,CAAC;QAAC,uBAAuB,EAAE,IAAI,CAAA;KAAE,CAAC;IAC/F,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,wBAAwB,EAAE,MAAM,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,6BAA6B,CAAC;CACrC;AAED,MAAM,WAAW,2BAA2B;IAC1C,mBAAmB,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAA;KAAE,CAAC,CAAC,CAAC;IAC1G,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC5E,OAAO,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,MAAM,CAAC,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvF;AAED,wBAAgB,iCAAiC,CAAC,OAAO,EAAE;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB,GAAG,2BAA2B,CA4C9B;AAED,MAAM,WAAW,iCAAiC;IAChD,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AAED,qBAAa,uCAAwC,YAAW,iCAAiC;;IAGzF,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAK5D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9D,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG3C;AAED,qBAAa,qCAAsC,YAAW,iCAAiC;IACjF,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM;IAIxC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAS5D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ9D,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1C,OAAO,CAAC,IAAI;CAGb;AAED,MAAM,WAAW,oCAAoC;IACnD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,qBAAa,8BAA8B;;gBAO7B,OAAO,EAAE;QACnB,MAAM,EAAE,2BAA2B,CAAC;QACpC,WAAW,EAAE,iCAAiC,CAAC;QAC/C,QAAQ,EAAE,CAAC,KAAK,EAAE;YAAE,IAAI,EAAE,sBAAsB,CAAC;YAAC,UAAU,EAAE,8BAA8B,CAAA;SAAE,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACjI,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB;IAUD,IAAI,IAAI,OAAO,CAAC,oCAAoC,CAAC;YAMvC,OAAO;CA6CtB"}

package/dist/vendor/onegent-runtime/managed-workflow-harness.js

@@ -0,0 +1,269 @@
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { uploadTaskEvaluationReport } from "./task-evaluation-hosted.js";
+export function createManagedWorkflowHostedClient(options) {
+    const baseUrl = required(options.baseUrl, "baseUrl").replace(/\/$/, "");
+    const projectId = required(options.projectId, "projectId");
+    const apiKey = required(options.apiKey, "apiKey");
+    const requestFetch = options.fetch ?? fetch;
+    const projectUrl = `${baseUrl}/v1/projects/${encodeURIComponent(projectId)}`;
+    const workflowIds = options.workflowIds?.map((id) => required(id, "workflowIds[]"));
+    if (workflowIds && (!workflowIds.length || workflowIds.length > 100 || new Set(workflowIds).size !== workflowIds.length)) {
+        throw new Error("Managed Workflow Harness workflowIds must contain 1 to 100 unique ids.");
+    }
+    return {
+        listActiveWorkflows: async () => {
+            const items = workflowIds
+                ? await Promise.all(workflowIds.map((id) => hostedJson(requestFetch, `${projectUrl}/business-workflows/${encodeURIComponent(id)}`, apiKey)))
+                : await (async () => {
+                    const value = await hostedJson(requestFetch, `${projectUrl}/business-workflows`, apiKey);
+                    if (!Array.isArray(value.businessWorkflows))
+                        throw new Error("Witnora returned an invalid Business Workflow list.");
+                    if (value.businessWorkflows.length >= 100)
+                        throw new Error("Business Workflow listing reached its bounded limit; configure exact workflowIds before scheduling.");
+                    return value.businessWorkflows;
+                })();
+            return items.map((item) => ({
+                id: required(String(item.id ?? ""), "workflow.id"),
+                digestSha256: digest(String(item.digestSha256 ?? ""), "workflow.digestSha256"),
+                status: item.status === "RETIRED" ? "RETIRED" : item.status === "ACTIVE" ? "ACTIVE" : invalidStatus(),
+            }));
+        },
+        getExecutionPlan: async (workflowId) => await hostedJson(requestFetch, `${projectUrl}/business-workflows/${encodeURIComponent(required(workflowId, "workflowId"))}/execution-plan`, apiKey),
+        getTask: async (taskContractId) => await hostedJson(requestFetch, `${projectUrl}/business-tasks/${encodeURIComponent(required(taskContractId, "taskContractId"))}`, apiKey),
+        upload: async (report, input) => await uploadTaskEvaluationReport(report, {
+            baseUrl,
+            projectId,
+            apiKey,
+            externalId: input.externalId,
+            fetch: requestFetch,
+        }),
+    };
+}
+export class MemoryWorkflowEvaluationCheckpointStore {
+    #reports = new Map();
+    async load(key) {
+        const report = this.#reports.get(key);
+        return report ? structuredClone(report) : undefined;
+    }
+    async save(key, report) {
+        this.#reports.set(key, structuredClone(report));
+    }
+    async complete(key) {
+        this.#reports.delete(key);
+    }
+}
+export class FileWorkflowEvaluationCheckpointStore {
+    directory;
+    constructor(directory) {
+        this.directory = directory;
+        if (!directory.trim())
+            throw new Error("Workflow checkpoint directory is required.");
+    }
+    async load(key) {
+        try {
+            return JSON.parse(await readFile(this.path(key), "utf8"));
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw error;
+        }
+    }
+    async save(key, report) {
+        await mkdir(this.directory, { recursive: true });
+        const target = this.path(key);
+        const temporary = `${target}.${randomUUID()}.tmp`;
+        await writeFile(temporary, `${JSON.stringify(report)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        await rename(temporary, target);
+    }
+    async complete(key) {
+        await rm(this.path(key), { force: true });
+    }
+    path(key) {
+        return join(this.directory, `${createHash("sha256").update(key).digest("hex")}.json`);
+    }
+}
+export class ManagedBusinessWorkflowHarness {
+    #client;
+    #checkpoints;
+    #evaluate;
+    #maxConcurrency;
+    #activeTick;
+    constructor(options) {
+        this.#client = options.client;
+        this.#checkpoints = options.checkpoints;
+        this.#evaluate = options.evaluate;
+        this.#maxConcurrency = options.maxConcurrency ?? 4;
+        if (!Number.isSafeInteger(this.#maxConcurrency) || this.#maxConcurrency < 1 || this.#maxConcurrency > 16) {
+            throw new Error("Managed Workflow Harness maxConcurrency must be between 1 and 16.");
+        }
+    }
+    tick() {
+        if (this.#activeTick)
+            return this.#activeTick;
+        this.#activeTick = this.runTick().finally(() => { this.#activeTick = undefined; });
+        return this.#activeTick;
+    }
+    async runTick() {
+        const workflows = (await this.#client.listActiveWorkflows()).filter((workflow) => workflow.status === "ACTIVE");
+        let evaluationsCompleted = 0;
+        let evaluationsFailed = 0;
+        const limitations = [];
+        for (const workflow of workflows) {
+            const seen = new Set();
+            for (let wave = 0; wave < 100; wave += 1) {
+                const plan = await this.#client.getExecutionPlan(workflow.id);
+                validatePlan(plan, workflow);
+                if (plan.recordsTruncated) {
+                    limitations.push(`Workflow ${workflow.id} was not scheduled because its authoritative Run inspection was truncated.`);
+                    break;
+                }
+                const ready = plan.readyEvaluations.filter((evaluation) => !seen.has(checkpointKey(plan, evaluation)));
+                if (!ready.length)
+                    break;
+                const results = await mapLimit(ready, this.#maxConcurrency, async (evaluation) => {
+                    const key = checkpointKey(plan, evaluation);
+                    seen.add(key);
+                    try {
+                        const task = await this.#client.getTask(evaluation.taskContractId);
+                        validateTask(task, evaluation);
+                        let report = await this.#checkpoints.load(key);
+                        if (!report) {
+                            report = await this.#evaluate({ task: structuredClone(task), evaluation: structuredClone(evaluation) });
+                            validateReport(report, task, evaluation);
+                            await this.#checkpoints.save(key, report);
+                        }
+                        else {
+                            validateReport(report, task, evaluation);
+                        }
+                        await this.#client.upload(report, { externalId: externalId(plan, evaluation) });
+                        await this.#checkpoints.complete(key);
+                        return true;
+                    }
+                    catch {
+                        limitations.push(`Workflow ${workflow.id} evaluation ${evaluation.nodeId}:${evaluation.mode} failed closed; no dependent evaluation was scheduled.`);
+                        return false;
+                    }
+                });
+                evaluationsCompleted += results.filter(Boolean).length;
+                evaluationsFailed += results.filter((value) => !value).length;
+                if (results.some((value) => !value))
+                    break;
+            }
+        }
+        return { workflowsInspected: workflows.length, evaluationsCompleted, evaluationsFailed, limitations };
+    }
+}
+function validatePlan(plan, workflow) {
+    if (plan.schemaVersion !== "witnora.business_workflow_execution_plan.v0.1"
+        || plan.workflow.id !== workflow.id
+        || plan.workflow.digestSha256 !== workflow.digestSha256
+        || plan.workflow.status !== "ACTIVE"
+        || plan.safety.productionWrites !== 0
+        || plan.safety.aggregateAssuranceClaim !== false
+        || plan.safety.customerHarnessRequired !== true) {
+        throw new Error("Managed Workflow Harness rejected a mismatched or unsafe execution plan.");
+    }
+    if (plan.readyEvaluations.length > 200)
+        throw new Error("Managed Workflow Harness rejected an oversized execution plan.");
+    const nodeStatus = new Map(plan.nodes.map((node) => [node.id, node.status]));
+    const seen = new Set();
+    for (const evaluation of plan.readyEvaluations) {
+        const key = `${evaluation.nodeId}:${evaluation.mode}`;
+        if (seen.has(key)
+            || nodeStatus.get(evaluation.nodeId) !== "READY"
+            || (evaluation.mode !== "REPLAY" && evaluation.mode !== "SHADOW")
+            || !evaluation.taskContractId
+            || !evaluation.taskKey
+            || !evaluation.agentId
+            || !evaluation.agentVersion
+            || !/^[a-f0-9]{64}$/.test(evaluation.taskContractDigestSha256)) {
+            throw new Error("Managed Workflow Harness rejected an invalid ready evaluation.");
+        }
+        seen.add(key);
+    }
+}
+function validateTask(task, evaluation) {
+    if (task.id !== evaluation.taskContractId
+        || task.digestSha256 !== evaluation.taskContractDigestSha256
+        || task.taskKey !== evaluation.taskKey
+        || task.subject.agentId !== evaluation.agentId
+        || task.subject.agentVersion !== evaluation.agentVersion) {
+        throw new Error("Managed Workflow Harness rejected a Business Task that did not match the execution plan.");
+    }
+}
+function validateReport(report, task, evaluation) {
+    if (report.schemaVersion !== "witnora.task_evaluation.v0.1"
+        || report.mode !== evaluation.mode
+        || report.task.id !== task.id
+        || report.task.digestSha256 !== task.digestSha256
+        || report.task.subject.agentId !== task.subject.agentId
+        || report.task.subject.agentVersion !== task.subject.agentVersion
+        || report.summary.productionWrites !== 0
+        || (report.mode === "REPLAY" && report.classification !== "REPLAY_SANDBOX_ONLY")
+        || (report.mode === "SHADOW" && report.classification !== "SHADOW_NO_WRITE")) {
+        throw new Error("Managed Workflow Harness rejected a mismatched or unsafe evaluation report.");
+    }
+    exactKeys(report, ["schemaVersion", "mode", "classification", "generatedAt", "task", "verdict", "summary", "scenarios", "limitations"], "report");
+    exactKeys(report.task, ["id", "digestSha256", "taskKey", "version", "subject", "scenarioSuite"], "report.task");
+    exactKeys(report.task.subject, ["agentId", "agentVersion"], "report.task.subject");
+    exactKeys(report.task.scenarioSuite, ["id", "version", "sha256"], "report.task.scenarioSuite");
+    exactKeys(report.summary, ["scenarios", "matched", "changed", "blocked", "sandboxActions", "productionWrites"], "report.summary");
+    if (!Array.isArray(report.scenarios) || !Array.isArray(report.limitations) || report.limitations.some((value) => typeof value !== "string")) {
+        throw new Error("Managed Workflow Harness rejected a non-structured evaluation report.");
+    }
+    for (const scenario of report.scenarios) {
+        exactKeys(scenario, ["id", "source", "inputDigestSha256", "matched", "blocked", "sandboxActionCount", "criteria", "differences"], "report.scenarios[]");
+        if (!/^[a-f0-9]{64}$/.test(scenario.inputDigestSha256) || !Array.isArray(scenario.criteria) || !Array.isArray(scenario.differences)
+            || scenario.differences.some((value) => typeof value !== "string"))
+            throw new Error("Managed Workflow Harness rejected invalid scenario metadata.");
+        for (const criterion of scenario.criteria)
+            exactKeys(criterion, ["id", "status", "evaluator"], "report.scenarios[].criteria[]");
+    }
+}
+function exactKeys(value, allowed, name) {
+    const allowedKeys = new Set(allowed);
+    if (Object.keys(value).some((key) => !allowedKeys.has(key)))
+        throw new Error(`Managed Workflow Harness rejected unexpected ${name} data.`);
+}
+function checkpointKey(plan, evaluation) {
+    return `${plan.projectId}:${plan.workflow.id}:${plan.workflow.digestSha256}:${evaluation.nodeId}:${evaluation.taskContractDigestSha256}:${evaluation.mode}`;
+}
+function externalId(plan, evaluation) {
+    return `workflow:${plan.workflow.id}:${plan.workflow.digestSha256.slice(0, 16)}:${evaluation.nodeId}:${evaluation.mode.toLowerCase()}`;
+}
+async function mapLimit(items, limit, execute) {
+    const results = new Array(items.length);
+    let cursor = 0;
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, async () => {
+        while (cursor < items.length) {
+            const index = cursor++;
+            results[index] = await execute(items[index]);
+        }
+    }));
+    return results;
+}
+async function hostedJson(requestFetch, url, apiKey) {
+    const response = await requestFetch(url, { headers: { authorization: `Bearer ${apiKey}` }, redirect: "error" });
+    const value = await response.json().catch(() => ({}));
+    if (!response.ok)
+        throw new Error(typeof value.error === "string" ? value.error : `Witnora Control Plane request failed (${response.status}).`);
+    return value;
+}
+function required(value, name) {
+    const normalized = value.trim();
+    if (!normalized)
+        throw new Error(`Managed Workflow Harness ${name} is required.`);
+    return normalized;
+}
+function digest(value, name) {
+    const normalized = value.trim().toLowerCase();
+    if (!/^[a-f0-9]{64}$/.test(normalized))
+        throw new Error(`Managed Workflow Harness ${name} must be a SHA-256 digest.`);
+    return normalized;
+}
+function invalidStatus() {
+    throw new Error("Witnora returned an invalid Business Workflow status.");
+}

package/dist/vendor/onegent-runtime/task-evaluation-hosted.d.ts

@@ -0,0 +1,83 @@
+import type { TaskEvaluationReport } from "./task-evaluation.js";
+export interface TaskEvaluationHostedOptions {
+    baseUrl: string;
+    projectId: string;
+    apiKey: string;
+    externalId?: string;
+    fetch?: typeof fetch;
+}
+export interface TaskEvaluationHostedResult {
+    run: Record<string, unknown>;
+    evidence: Record<string, unknown>;
+    completion: Record<string, unknown>;
+}
+export declare function uploadTaskEvaluationReport(report: TaskEvaluationReport, options: TaskEvaluationHostedOptions): Promise<TaskEvaluationHostedResult>;
+export declare function createTaskEvaluationEvidenceBundle(report: TaskEvaluationReport, runId: string, reportDigestSha256?: string): {
+    schemaName: string;
+    schemaVersion: string;
+    schemaSemver: string;
+    kind: string;
+    runId: string;
+    generatedAt: string;
+    subject: {
+        name: string;
+        type: string;
+    };
+    verdict: {
+        passed: boolean;
+        score: number;
+        level: "REPLAY_SANDBOX_ONLY" | "SHADOW_NO_WRITE";
+    };
+    summary: {
+        products: string[];
+        criticalEvidence: number;
+        highEvidence: number;
+        totalEvidence: number;
+    };
+    results: {
+        schemaVersion: string;
+        product: string;
+        runId: string;
+        timestamp: string;
+        phase: string;
+        score: number;
+        passed: boolean;
+        summary: string;
+        artifacts: {};
+        evidence: {
+            id: string;
+            kind: string;
+            severity: string;
+            message: string;
+            source: string;
+            metadata: {
+                report: TaskEvaluationReport;
+                reportSha256: string;
+            };
+        }[];
+    }[];
+    evidence: {
+        id: string;
+        kind: string;
+        severity: string;
+        message: string;
+        source: string;
+        metadata: {
+            reportSha256: string;
+            taskContractId: string;
+            classification: "REPLAY_SANDBOX_ONLY" | "SHADOW_NO_WRITE";
+        };
+    }[];
+    artifacts: {};
+    artifactManifest: {
+        schemaVersion: string;
+        entries: never[];
+    };
+    standards: {
+        id: string;
+        name: string;
+        status: string;
+        note: string;
+    }[];
+};
+//# sourceMappingURL=task-evaluation-hosted.d.ts.map

package/dist/vendor/onegent-runtime/task-evaluation-hosted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-evaluation-hosted.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/task-evaluation-hosted.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,oBAAoB,EAC5B,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,0BAA0B,CAAC,CAyDrC;AAED,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+B1H"}

package/dist/vendor/onegent-runtime/task-evaluation-hosted.js

@@ -0,0 +1,108 @@
+import { createHash } from "node:crypto";
+export async function uploadTaskEvaluationReport(report, options) {
+    const baseUrl = required(options.baseUrl, "baseUrl").replace(/\/$/, "");
+    const projectId = required(options.projectId, "projectId");
+    const apiKey = required(options.apiKey, "apiKey");
+    const requestFetch = options.fetch ?? fetch;
+    const projectUrl = `${baseUrl}/v1/projects/${encodeURIComponent(projectId)}`;
+    const reportBytes = Buffer.from(`${JSON.stringify(report)}\n`, "utf8");
+    const reportDigestSha256 = createHash("sha256").update(reportBytes).digest("hex");
+    const operationId = `task-evaluation-${reportDigestSha256.slice(0, 32)}`;
+    const externalId = options.externalId?.trim() || `${report.mode.toLowerCase()}:${report.task.taskKey}:${report.task.version}:${reportDigestSha256.slice(0, 16)}`;
+    const run = await jsonRequest(requestFetch, `${projectUrl}/runs`, apiKey, {
+        method: "POST",
+        headers: { "idempotency-key": `${operationId}:run` },
+        body: JSON.stringify({
+            externalId,
+            kind: "custom",
+            agentId: report.task.subject.agentId,
+            schemaVersion: report.schemaVersion,
+            startedAt: report.generatedAt,
+            metadata: { taskEvaluation: {
+                    taskContractId: report.task.id,
+                    taskContractDigestSha256: report.task.digestSha256,
+                    scenarioSuiteSha256: report.task.scenarioSuite.sha256,
+                    reportDigestSha256,
+                    mode: report.mode,
+                    writesBlocked: true,
+                    rawInputsRetainedByCustomer: true,
+                } },
+        }),
+    });
+    if (typeof run.id !== "string" || !run.id)
+        throw new Error("Witnora Control Plane returned a task evaluation Run without an id.");
+    const bundle = createTaskEvaluationEvidenceBundle(report, run.id, reportDigestSha256);
+    const bundleBytes = Buffer.from(`${JSON.stringify(bundle, null, 2)}\n`, "utf8");
+    const query = new URLSearchParams({
+        fileName: `business-task-${report.mode.toLowerCase()}-evidence.json`,
+        kind: "evidence_bundle",
+        schemaVersion: "agentcert.evidence.v0.1",
+        runId: run.id,
+    });
+    const evidence = await jsonRequest(requestFetch, `${projectUrl}/evidence?${query}`, apiKey, {
+        method: "POST",
+        headers: { "content-type": "application/json", "idempotency-key": `${operationId}:evidence` },
+        body: new Uint8Array(bundleBytes).buffer,
+    });
+    const passed = report.verdict === "PASSED" || report.verdict === "MATCHED";
+    const completion = await jsonRequest(requestFetch, `${projectUrl}/runs/${encodeURIComponent(run.id)}/complete`, apiKey, {
+        method: "POST",
+        headers: { "idempotency-key": `${operationId}:complete` },
+        body: JSON.stringify({
+            status: passed ? "passed" : "manual_review",
+            score: report.summary.scenarios ? report.summary.matched / report.summary.scenarios : 0,
+            summary: `${report.mode} evaluated ${report.summary.scenarios} declared scenario${report.summary.scenarios === 1 ? "" : "s"}; ${report.summary.changed} changed and ${report.summary.blocked} blocked.`,
+            metadata: { evidenceId: evidence.id, evidenceSha256: evidence.sha256, taskEvaluationReportSha256: reportDigestSha256 },
+        }),
+    });
+    return { run, evidence, completion };
+}
+export function createTaskEvaluationEvidenceBundle(report, runId, reportDigestSha256) {
+    const digest = reportDigestSha256 ?? createHash("sha256").update(`${JSON.stringify(report)}\n`).digest("hex");
+    const passed = report.verdict === "PASSED" || report.verdict === "MATCHED";
+    return {
+        schemaName: "agentcert.evidence_bundle",
+        schemaVersion: "agentcert.evidence.v0.1",
+        schemaSemver: "0.1.0",
+        kind: "agentcert.evidence_bundle",
+        runId,
+        generatedAt: report.generatedAt,
+        subject: { name: `${report.task.taskKey} v${report.task.version}`, type: "application" },
+        verdict: { passed, score: passed ? 100 : 0, level: report.classification },
+        summary: { products: ["onegent-runtime"], criticalEvidence: report.summary.blocked, highEvidence: report.summary.changed, totalEvidence: report.summary.scenarios },
+        results: [{
+                schemaVersion: "1", product: "onegent-runtime", runId, timestamp: report.generatedAt, phase: "pre-release",
+                score: passed ? 100 : 0, passed,
+                summary: `${report.mode} comparison for the declared Business Task Contract.`, artifacts: {},
+                evidence: [{
+                        id: `task-evaluation:${digest.slice(0, 16)}`, kind: "task_evaluation", severity: passed ? "info" : "high",
+                        message: `${report.mode} ${report.verdict.toLowerCase()} for ${report.summary.scenarios} declared scenario${report.summary.scenarios === 1 ? "" : "s"}.`,
+                        source: "onegent-runtime", metadata: { report: structuredClone(report), reportSha256: digest },
+                    }],
+            }],
+        evidence: [{
+                id: `task-evaluation:${digest.slice(0, 16)}`, kind: "task_evaluation", severity: passed ? "info" : "high",
+                message: `${report.mode} ${report.verdict.toLowerCase()} for the declared Business Task Contract.`, source: "onegent-runtime",
+                metadata: { reportSha256: digest, taskContractId: report.task.id, classification: report.classification },
+            }],
+        artifacts: {}, artifactManifest: { schemaVersion: "agentcert.artifact_manifest.v0.1", entries: [] },
+        standards: [{ id: "witnora-business-task", name: "Witnora Business Task Contract", status: "mapped", note: report.limitations.join(" ") }],
+    };
+}
+async function jsonRequest(requestFetch, url, apiKey, init) {
+    const headers = new Headers(init.headers);
+    headers.set("authorization", `Bearer ${apiKey}`);
+    if (typeof init.body === "string")
+        headers.set("content-type", "application/json");
+    const response = await requestFetch(url, { ...init, headers, redirect: "error" });
+    const value = await response.json().catch(() => ({}));
+    if (!response.ok)
+        throw new Error(typeof value.error === "string" ? value.error : `Witnora Control Plane request failed (${response.status}).`);
+    return value;
+}
+function required(value, name) {
+    const normalized = value.trim();
+    if (!normalized)
+        throw new Error(`Task evaluation hosted upload ${name} is required.`);
+    return normalized;
+}

package/dist/vendor/onegent-runtime/task-evaluation.d.ts

@@ -0,0 +1,123 @@
+import type { SandboxCertificationHarness } from "./sandbox-harness.js";
+import type { CreateActionIntentInput } from "./types.js";
+export declare const TASK_EVALUATION_SCHEMA_VERSION: "witnora.task_evaluation.v0.1";
+export interface TaskEvaluationContract {
+    id: string;
+    digestSha256: string;
+    taskKey: string;
+    version: number;
+    subject: {
+        agentId: string;
+        agentVersion: string;
+    };
+    scenarioSuite: {
+        id: string;
+        version: string;
+        sha256: string;
+    };
+    actionPaths: Array<{
+        id: string;
+        actionType: "SUBMIT" | "PAY" | "SEND" | "UPDATE";
+        targetSystem: string;
+        requiredPermissions: string[];
+        customerDecision?: "ALLOW" | "REQUIRE_APPROVAL" | "DENY";
+    }>;
+    successCriteria: Array<{
+        id: string;
+        evaluator: "DETERMINISTIC" | "READ_ONLY_PROBE";
+        predicateDigestSha256: string;
+    }>;
+}
+export interface TaskEvaluationIntent {
+    pathId: string;
+    parametersDigestSha256: string;
+    action?: CreateActionIntentInput;
+}
+export interface TaskEvaluationScenario {
+    id: string;
+    source: "HISTORICAL" | "FIXTURE" | "LIVE_SHADOW";
+    sanitized: boolean;
+    input: unknown;
+    inputDigestSha256: string;
+    baseline: {
+        resultDigestSha256: string;
+        actionIntents: Array<Omit<TaskEvaluationIntent, "action">>;
+    };
+}
+export interface TaskCandidateEvaluation {
+    resultDigestSha256: string;
+    actionIntents: TaskEvaluationIntent[];
+    criteria: Array<{
+        id: string;
+        passed: boolean;
+    }>;
+}
+export interface ShadowCandidateEvaluation {
+    resultDigestSha256: string;
+    criteria: Array<{
+        id: string;
+        passed: boolean;
+    }>;
+}
+export interface TaskEvaluationReport {
+    schemaVersion: typeof TASK_EVALUATION_SCHEMA_VERSION;
+    mode: "REPLAY" | "SHADOW";
+    classification: "REPLAY_SANDBOX_ONLY" | "SHADOW_NO_WRITE";
+    generatedAt: string;
+    task: {
+        id: string;
+        digestSha256: string;
+        taskKey: string;
+        version: number;
+        subject: TaskEvaluationContract["subject"];
+        scenarioSuite: TaskEvaluationContract["scenarioSuite"];
+    };
+    verdict: "PASSED" | "MATCHED" | "CHANGED" | "BLOCKED";
+    summary: {
+        scenarios: number;
+        matched: number;
+        changed: number;
+        blocked: number;
+        sandboxActions: number;
+        productionWrites: 0;
+    };
+    scenarios: Array<{
+        id: string;
+        source: TaskEvaluationScenario["source"];
+        inputDigestSha256: string;
+        matched: boolean;
+        blocked: boolean;
+        sandboxActionCount: number;
+        criteria: Array<{
+            id: string;
+            status: "PASSED" | "FAILED" | "NOT_OBSERVED";
+            evaluator: "DETERMINISTIC" | "READ_ONLY_PROBE";
+        }>;
+        differences: string[];
+    }>;
+    limitations: string[];
+}
+export declare function runReplayEvaluation(options: {
+    task: TaskEvaluationContract;
+    harness: SandboxCertificationHarness;
+    tenantId: string;
+    scenarios: TaskEvaluationScenario[];
+    evaluateCandidate: (scenario: {
+        id: string;
+        source: TaskEvaluationScenario["source"];
+        input: unknown;
+    }) => Promise<TaskCandidateEvaluation>;
+    now?: () => Date;
+}): Promise<TaskEvaluationReport>;
+export declare function runShadowEvaluation(options: {
+    task: TaskEvaluationContract;
+    observations: TaskEvaluationScenario[];
+    evaluateCandidate: (context: {
+        id: string;
+        source: "LIVE_SHADOW";
+        input: unknown;
+        propose: (intent: Omit<TaskEvaluationIntent, "action">) => void;
+    }) => Promise<ShadowCandidateEvaluation>;
+    now?: () => Date;
+}): Promise<TaskEvaluationReport>;
+//# sourceMappingURL=task-evaluation.d.ts.map

package/dist/vendor/onegent-runtime/task-evaluation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-evaluation.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/task-evaluation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,eAAO,MAAM,8BAA8B,EAAG,8BAAuC,CAAC;AAEtF,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,aAAa,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,WAAW,EAAE,KAAK,CAAC;QACjB,EAAE,EAAE,MAAM,CAAC;QACX,UAAU,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;QACjD,YAAY,EAAE,MAAM,CAAC;QACrB,mBAAmB,EAAE,MAAM,EAAE,CAAC;QAC9B,gBAAgB,CAAC,EAAE,OAAO,GAAG,kBAAkB,GAAG,MAAM,CAAC;KAC1D,CAAC,CAAC;IACH,eAAe,EAAE,KAAK,CAAC;QACrB,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,eAAe,GAAG,iBAAiB,CAAC;QAC/C,qBAAqB,EAAE,MAAM,CAAC;KAC/B,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,MAAM,CAAC,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,aAAa,CAAC;IACjD,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE;QACR,kBAAkB,EAAE,MAAM,CAAC;QAC3B,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC;KAC5D,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,oBAAoB,EAAE,CAAC;IACtC,QAAQ,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,yBAAyB;IACxC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,OAAO,8BAA8B,CAAC;IACrD,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC1B,cAAc,EAAE,qBAAqB,GAAG,iBAAiB,CAAC;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC3C,aAAa,EAAE,sBAAsB,CAAC,eAAe,CAAC,CAAC;KACxD,CAAC;IACF,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IACtD,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,EAAE,CAAC,CAAC;KACrB,CAAC;IACF,SAAS,EAAE,KAAK,CAAC;QACf,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACzC,iBAAiB,EAAE,MAAM,CAAC;QAC1B,OAAO,EAAE,OAAO,CAAC;QACjB,OAAO,EAAE,OAAO,CAAC;QACjB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,QAAQ,EAAE,KAAK,CAAC;YACd,EAAE,EAAE,MAAM,CAAC;YACX,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,cAAc,CAAC;YAC7C,SAAS,EAAE,eAAe,GAAG,iBAAiB,CAAC;SAChD,CAAC,CAAC;QACH,WAAW,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC,CAAC;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE;IACjD,IAAI,EAAE,sBAAsB,CAAC;IAC7B,OAAO,EAAE,2BAA2B,CAAC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,sBAAsB,EAAE,CAAC;IACpC,iBAAiB,EAAE,CAAC,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC5I,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoDhC;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE;IACjD,IAAI,EAAE,sBAAsB,CAAC;IAC7B,YAAY,EAAE,sBAAsB,EAAE,CAAC;IACvC,iBAAiB,EAAE,CAAC,OAAO,EAAE;QAC3B,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,aAAa,CAAC;QACtB,KAAK,EAAE,OAAO,CAAC;QACf,OAAO,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,KAAK,IAAI,CAAC;KACjE,KAAK,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgDhC"}

package/dist/vendor/onegent-runtime/task-evaluation.js

@@ -0,0 +1,206 @@
+export const TASK_EVALUATION_SCHEMA_VERSION = "witnora.task_evaluation.v0.1";
+export async function runReplayEvaluation(options) {
+    validateTask(options.task);
+    validateScenarios(options.scenarios, false);
+    const now = options.now ?? (() => new Date());
+    const run = await options.harness.startRun({ tenantId: options.tenantId });
+    const results = [];
+    for (const scenario of options.scenarios) {
+        await options.harness.resetTenant(options.tenantId);
+        const candidate = await options.evaluateCandidate({ id: scenario.id, source: scenario.source, input: scenario.input });
+        validateCandidate(candidate, options.task);
+        const differences = compareCandidate(scenario, candidate);
+        let blocked = false;
+        let sandboxActionCount = 0;
+        for (const intent of candidate.actionIntents) {
+            const path = options.task.actionPaths.find((item) => item.id === intent.pathId);
+            if (!path || !intent.action || !actionMatchesPath(intent.action, path)) {
+                blocked = true;
+                differences.push(`Action path ${intent.pathId} was not bound to the approved sandbox contract.`);
+                continue;
+            }
+            const execution = await run.executeAction(intent.action, {
+                approval: { approved: true, reviewerId: `business-task:${options.task.id}`, comment: "Approved synthetic Replay path from the customer Business Task Contract." },
+                rollbackAfterVerification: true,
+                rollbackReason: "Replay restores the synthetic tenant after each observed action.",
+            });
+            if (execution.status !== "verified" && execution.status !== "rolled_back") {
+                blocked = true;
+                differences.push(`Sandbox action ${intent.pathId} was ${execution.status}${execution.rejectionCode ? ` (${execution.rejectionCode})` : ""}.`);
+            }
+            else {
+                sandboxActionCount += 1;
+            }
+        }
+        const criteria = options.task.successCriteria.map((criterion) => ({
+            id: criterion.id,
+            evaluator: criterion.evaluator,
+            status: candidate.criteria.find((item) => item.id === criterion.id)?.passed === true ? "PASSED" : "FAILED",
+        }));
+        if (criteria.some((item) => item.status !== "PASSED"))
+            differences.push("One or more declared success criteria did not pass.");
+        const matched = !blocked && differences.length === 0;
+        results.push({
+            id: scenario.id,
+            source: scenario.source,
+            inputDigestSha256: scenario.inputDigestSha256,
+            matched,
+            blocked,
+            sandboxActionCount,
+            criteria,
+            differences: [...new Set(differences)],
+        });
+    }
+    run.complete();
+    return report("REPLAY", "REPLAY_SANDBOX_ONLY", options.task, results, now());
+}
+export async function runShadowEvaluation(options) {
+    validateTask(options.task);
+    validateScenarios(options.observations, true);
+    const now = options.now ?? (() => new Date());
+    const results = [];
+    for (const observation of options.observations) {
+        const proposals = [];
+        const candidate = await options.evaluateCandidate({
+            id: observation.id,
+            source: "LIVE_SHADOW",
+            input: observation.input,
+            propose: (intent) => {
+                digest(intent.parametersDigestSha256, `candidate action ${intent.pathId} digest`);
+                if (!options.task.actionPaths.some((path) => path.id === intent.pathId)) {
+                    throw new Error(`Candidate proposed undeclared action path ${intent.pathId}.`);
+                }
+                proposals.push(structuredClone(intent));
+            },
+        });
+        validateShadowCandidate(candidate, options.task);
+        const candidateForComparison = {
+            resultDigestSha256: candidate.resultDigestSha256,
+            actionIntents: proposals,
+            criteria: candidate.criteria,
+        };
+        const differences = compareCandidate(observation, candidateForComparison);
+        const criteria = options.task.successCriteria.map((criterion) => ({
+            id: criterion.id,
+            evaluator: criterion.evaluator,
+            status: criterion.evaluator === "READ_ONLY_PROBE"
+                ? "NOT_OBSERVED"
+                : candidate.criteria.find((item) => item.id === criterion.id)?.passed === true
+                    ? "PASSED"
+                    : "FAILED",
+        }));
+        if (criteria.some((item) => item.status === "FAILED"))
+            differences.push("One or more deterministic success criteria did not pass.");
+        results.push({
+            id: observation.id,
+            source: observation.source,
+            inputDigestSha256: observation.inputDigestSha256,
+            matched: differences.length === 0,
+            blocked: false,
+            sandboxActionCount: 0,
+            criteria,
+            differences: [...new Set(differences)],
+        });
+    }
+    return report("SHADOW", "SHADOW_NO_WRITE", options.task, results, now());
+}
+function report(mode, classification, task, scenarios, generatedAt) {
+    const blocked = scenarios.filter((item) => item.blocked).length;
+    const matched = scenarios.filter((item) => item.matched).length;
+    const changed = scenarios.length - matched - blocked;
+    return {
+        schemaVersion: TASK_EVALUATION_SCHEMA_VERSION,
+        mode,
+        classification,
+        generatedAt: generatedAt.toISOString(),
+        task: {
+            id: task.id,
+            digestSha256: task.digestSha256,
+            taskKey: task.taskKey,
+            version: task.version,
+            subject: structuredClone(task.subject),
+            scenarioSuite: structuredClone(task.scenarioSuite),
+        },
+        verdict: blocked ? "BLOCKED" : changed ? "CHANGED" : mode === "SHADOW" ? "MATCHED" : "PASSED",
+        summary: {
+            scenarios: scenarios.length,
+            matched,
+            changed,
+            blocked,
+            sandboxActions: scenarios.reduce((sum, item) => sum + item.sandboxActionCount, 0),
+            productionWrites: 0,
+        },
+        scenarios,
+        limitations: mode === "REPLAY"
+            ? [
+                "Replay covers only the declared scenarios and network-denied synthetic or sanitized sandbox paths.",
+                "Replay results do not establish production enforcement, production outcome verification, or future Agent reliability.",
+            ]
+            : [
+                "Shadow compares candidate decisions against observed inputs while candidate writes remain blocked.",
+                "Shadow results do not establish that the candidate produced a real production outcome.",
+            ],
+    };
+}
+function compareCandidate(scenario, candidate) {
+    const differences = [];
+    if (candidate.resultDigestSha256 !== scenario.baseline.resultDigestSha256)
+        differences.push("Candidate result digest differs from the baseline.");
+    const expected = scenario.baseline.actionIntents.map(intentFingerprint).sort();
+    const observed = candidate.actionIntents.map(intentFingerprint).sort();
+    if (JSON.stringify(expected) !== JSON.stringify(observed))
+        differences.push("Candidate action intents differ from the baseline.");
+    return differences;
+}
+function intentFingerprint(intent) {
+    return `${intent.pathId}:${intent.parametersDigestSha256}`;
+}
+function actionMatchesPath(action, path) {
+    const permissions = [...new Set(action.requestedPermissions ?? [])].sort();
+    return path.customerDecision !== "DENY"
+        && action.environment !== "production"
+        && !action.targetUrl
+        && action.actionType === path.actionType
+        && action.targetSystem === path.targetSystem
+        && JSON.stringify(permissions) === JSON.stringify([...new Set(path.requiredPermissions)].sort());
+}
+function validateTask(task) {
+    digest(task.digestSha256, "task.digestSha256");
+    digest(task.scenarioSuite.sha256, "task.scenarioSuite.sha256");
+    if (!task.actionPaths.length || !task.successCriteria.length)
+        throw new Error("Task evaluation requires action paths and success criteria.");
+    for (const criterion of task.successCriteria)
+        digest(criterion.predicateDigestSha256, `criterion ${criterion.id}`);
+}
+function validateScenarios(scenarios, shadow) {
+    if (!scenarios.length || scenarios.length > 500)
+        throw new Error("Task evaluation requires 1 to 500 scenarios.");
+    for (const scenario of scenarios) {
+        if (!shadow && scenario.source === "LIVE_SHADOW")
+            throw new Error("Replay cannot consume a LIVE_SHADOW scenario.");
+        if (shadow && scenario.source !== "LIVE_SHADOW")
+            throw new Error("Shadow requires LIVE_SHADOW observations.");
+        if (scenario.sanitized !== true)
+            throw new Error(`Scenario ${scenario.id} must be explicitly sanitized.`);
+        digest(scenario.inputDigestSha256, `scenario ${scenario.id} input digest`);
+        digest(scenario.baseline.resultDigestSha256, `scenario ${scenario.id} baseline result digest`);
+        scenario.baseline.actionIntents.forEach((intent) => digest(intent.parametersDigestSha256, `scenario ${scenario.id} baseline action digest`));
+    }
+}
+function validateShadowCandidate(candidate, task) {
+    digest(candidate.resultDigestSha256, "candidate result digest");
+    const criterionIds = new Set(task.successCriteria.map((item) => item.id));
+    if (candidate.criteria.some((item) => !criterionIds.has(item.id)))
+        throw new Error("Candidate returned an undeclared success criterion.");
+}
+function validateCandidate(candidate, task) {
+    digest(candidate.resultDigestSha256, "candidate result digest");
+    candidate.actionIntents.forEach((intent) => digest(intent.parametersDigestSha256, `candidate action ${intent.pathId} digest`));
+    const criterionIds = new Set(task.successCriteria.map((item) => item.id));
+    if (candidate.criteria.some((item) => !criterionIds.has(item.id)))
+        throw new Error("Candidate returned an undeclared success criterion.");
+}
+function digest(value, name) {
+    if (!/^[a-f0-9]{64}$/.test(value))
+        throw new Error(`${name} must be a lowercase SHA-256 digest.`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.13.7",
+  "version": "0.13.8",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "Apache-2.0",