witnora 0.13.7 → 0.13.9

package/dist/vendor/onegent-runtime/managed-workflow-harness.js

@@ -0,0 +1,269 @@
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { uploadTaskEvaluationReport } from "./task-evaluation-hosted.js";
+export function createManagedWorkflowHostedClient(options) {
+    const baseUrl = required(options.baseUrl, "baseUrl").replace(/\/$/, "");
+    const projectId = required(options.projectId, "projectId");
+    const apiKey = required(options.apiKey, "apiKey");
+    const requestFetch = options.fetch ?? fetch;
+    const projectUrl = `${baseUrl}/v1/projects/${encodeURIComponent(projectId)}`;
+    const workflowIds = options.workflowIds?.map((id) => required(id, "workflowIds[]"));
+    if (workflowIds && (!workflowIds.length || workflowIds.length > 100 || new Set(workflowIds).size !== workflowIds.length)) {
+        throw new Error("Managed Workflow Harness workflowIds must contain 1 to 100 unique ids.");
+    }
+    return {
+        listActiveWorkflows: async () => {
+            const items = workflowIds
+                ? await Promise.all(workflowIds.map((id) => hostedJson(requestFetch, `${projectUrl}/business-workflows/${encodeURIComponent(id)}`, apiKey)))
+                : await (async () => {
+                    const value = await hostedJson(requestFetch, `${projectUrl}/business-workflows`, apiKey);
+                    if (!Array.isArray(value.businessWorkflows))
+                        throw new Error("Witnora returned an invalid Business Workflow list.");
+                    if (value.businessWorkflows.length >= 100)
+                        throw new Error("Business Workflow listing reached its bounded limit; configure exact workflowIds before scheduling.");
+                    return value.businessWorkflows;
+                })();
+            return items.map((item) => ({
+                id: required(String(item.id ?? ""), "workflow.id"),
+                digestSha256: digest(String(item.digestSha256 ?? ""), "workflow.digestSha256"),
+                status: item.status === "RETIRED" ? "RETIRED" : item.status === "ACTIVE" ? "ACTIVE" : invalidStatus(),
+            }));
+        },
+        getExecutionPlan: async (workflowId) => await hostedJson(requestFetch, `${projectUrl}/business-workflows/${encodeURIComponent(required(workflowId, "workflowId"))}/execution-plan`, apiKey),
+        getTask: async (taskContractId) => await hostedJson(requestFetch, `${projectUrl}/business-tasks/${encodeURIComponent(required(taskContractId, "taskContractId"))}`, apiKey),
+        upload: async (report, input) => await uploadTaskEvaluationReport(report, {
+            baseUrl,
+            projectId,
+            apiKey,
+            externalId: input.externalId,
+            fetch: requestFetch,
+        }),
+    };
+}
+export class MemoryWorkflowEvaluationCheckpointStore {
+    #reports = new Map();
+    async load(key) {
+        const report = this.#reports.get(key);
+        return report ? structuredClone(report) : undefined;
+    }
+    async save(key, report) {
+        this.#reports.set(key, structuredClone(report));
+    }
+    async complete(key) {
+        this.#reports.delete(key);
+    }
+}
+export class FileWorkflowEvaluationCheckpointStore {
+    directory;
+    constructor(directory) {
+        this.directory = directory;
+        if (!directory.trim())
+            throw new Error("Workflow checkpoint directory is required.");
+    }
+    async load(key) {
+        try {
+            return JSON.parse(await readFile(this.path(key), "utf8"));
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw error;
+        }
+    }
+    async save(key, report) {
+        await mkdir(this.directory, { recursive: true });
+        const target = this.path(key);
+        const temporary = `${target}.${randomUUID()}.tmp`;
+        await writeFile(temporary, `${JSON.stringify(report)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        await rename(temporary, target);
+    }
+    async complete(key) {
+        await rm(this.path(key), { force: true });
+    }
+    path(key) {
+        return join(this.directory, `${createHash("sha256").update(key).digest("hex")}.json`);
+    }
+}
+export class ManagedBusinessWorkflowHarness {
+    #client;
+    #checkpoints;
+    #evaluate;
+    #maxConcurrency;
+    #activeTick;
+    constructor(options) {
+        this.#client = options.client;
+        this.#checkpoints = options.checkpoints;
+        this.#evaluate = options.evaluate;
+        this.#maxConcurrency = options.maxConcurrency ?? 4;
+        if (!Number.isSafeInteger(this.#maxConcurrency) || this.#maxConcurrency < 1 || this.#maxConcurrency > 16) {
+            throw new Error("Managed Workflow Harness maxConcurrency must be between 1 and 16.");
+        }
+    }
+    tick() {
+        if (this.#activeTick)
+            return this.#activeTick;
+        this.#activeTick = this.runTick().finally(() => { this.#activeTick = undefined; });
+        return this.#activeTick;
+    }
+    async runTick() {
+        const workflows = (await this.#client.listActiveWorkflows()).filter((workflow) => workflow.status === "ACTIVE");
+        let evaluationsCompleted = 0;
+        let evaluationsFailed = 0;
+        const limitations = [];
+        for (const workflow of workflows) {
+            const seen = new Set();
+            for (let wave = 0; wave < 100; wave += 1) {
+                const plan = await this.#client.getExecutionPlan(workflow.id);
+                validatePlan(plan, workflow);
+                if (plan.recordsTruncated) {
+                    limitations.push(`Workflow ${workflow.id} was not scheduled because its authoritative Run inspection was truncated.`);
+                    break;
+                }
+                const ready = plan.readyEvaluations.filter((evaluation) => !seen.has(checkpointKey(plan, evaluation)));
+                if (!ready.length)
+                    break;
+                const results = await mapLimit(ready, this.#maxConcurrency, async (evaluation) => {
+                    const key = checkpointKey(plan, evaluation);
+                    seen.add(key);
+                    try {
+                        const task = await this.#client.getTask(evaluation.taskContractId);
+                        validateTask(task, evaluation);
+                        let report = await this.#checkpoints.load(key);
+                        if (!report) {
+                            report = await this.#evaluate({ task: structuredClone(task), evaluation: structuredClone(evaluation) });
+                            validateReport(report, task, evaluation);
+                            await this.#checkpoints.save(key, report);
+                        }
+                        else {
+                            validateReport(report, task, evaluation);
+                        }
+                        await this.#client.upload(report, { externalId: externalId(plan, evaluation) });
+                        await this.#checkpoints.complete(key);
+                        return true;
+                    }
+                    catch {
+                        limitations.push(`Workflow ${workflow.id} evaluation ${evaluation.nodeId}:${evaluation.mode} failed closed; no dependent evaluation was scheduled.`);
+                        return false;
+                    }
+                });
+                evaluationsCompleted += results.filter(Boolean).length;
+                evaluationsFailed += results.filter((value) => !value).length;
+                if (results.some((value) => !value))
+                    break;
+            }
+        }
+        return { workflowsInspected: workflows.length, evaluationsCompleted, evaluationsFailed, limitations };
+    }
+}
+function validatePlan(plan, workflow) {
+    if (plan.schemaVersion !== "witnora.business_workflow_execution_plan.v0.1"
+        || plan.workflow.id !== workflow.id
+        || plan.workflow.digestSha256 !== workflow.digestSha256
+        || plan.workflow.status !== "ACTIVE"
+        || plan.safety.productionWrites !== 0
+        || plan.safety.aggregateAssuranceClaim !== false
+        || plan.safety.customerHarnessRequired !== true) {
+        throw new Error("Managed Workflow Harness rejected a mismatched or unsafe execution plan.");
+    }
+    if (plan.readyEvaluations.length > 200)
+        throw new Error("Managed Workflow Harness rejected an oversized execution plan.");
+    const nodeStatus = new Map(plan.nodes.map((node) => [node.id, node.status]));
+    const seen = new Set();
+    for (const evaluation of plan.readyEvaluations) {
+        const key = `${evaluation.nodeId}:${evaluation.mode}`;
+        if (seen.has(key)
+            || nodeStatus.get(evaluation.nodeId) !== "READY"
+            || (evaluation.mode !== "REPLAY" && evaluation.mode !== "SHADOW")
+            || !evaluation.taskContractId
+            || !evaluation.taskKey
+            || !evaluation.agentId
+            || !evaluation.agentVersion
+            || !/^[a-f0-9]{64}$/.test(evaluation.taskContractDigestSha256)) {
+            throw new Error("Managed Workflow Harness rejected an invalid ready evaluation.");
+        }
+        seen.add(key);
+    }
+}
+function validateTask(task, evaluation) {
+    if (task.id !== evaluation.taskContractId
+        || task.digestSha256 !== evaluation.taskContractDigestSha256
+        || task.taskKey !== evaluation.taskKey
+        || task.subject.agentId !== evaluation.agentId
+        || task.subject.agentVersion !== evaluation.agentVersion) {
+        throw new Error("Managed Workflow Harness rejected a Business Task that did not match the execution plan.");
+    }
+}
+function validateReport(report, task, evaluation) {
+    if (report.schemaVersion !== "witnora.task_evaluation.v0.1"
+        || report.mode !== evaluation.mode
+        || report.task.id !== task.id
+        || report.task.digestSha256 !== task.digestSha256
+        || report.task.subject.agentId !== task.subject.agentId
+        || report.task.subject.agentVersion !== task.subject.agentVersion
+        || report.summary.productionWrites !== 0
+        || (report.mode === "REPLAY" && report.classification !== "REPLAY_SANDBOX_ONLY")
+        || (report.mode === "SHADOW" && report.classification !== "SHADOW_NO_WRITE")) {
+        throw new Error("Managed Workflow Harness rejected a mismatched or unsafe evaluation report.");
+    }
+    exactKeys(report, ["schemaVersion", "mode", "classification", "generatedAt", "task", "verdict", "summary", "scenarios", "limitations"], "report");
+    exactKeys(report.task, ["id", "digestSha256", "taskKey", "version", "subject", "scenarioSuite"], "report.task");
+    exactKeys(report.task.subject, ["agentId", "agentVersion"], "report.task.subject");
+    exactKeys(report.task.scenarioSuite, ["id", "version", "sha256"], "report.task.scenarioSuite");
+    exactKeys(report.summary, ["scenarios", "matched", "changed", "blocked", "sandboxActions", "productionWrites"], "report.summary");
+    if (!Array.isArray(report.scenarios) || !Array.isArray(report.limitations) || report.limitations.some((value) => typeof value !== "string")) {
+        throw new Error("Managed Workflow Harness rejected a non-structured evaluation report.");
+    }
+    for (const scenario of report.scenarios) {
+        exactKeys(scenario, ["id", "source", "inputDigestSha256", "matched", "blocked", "sandboxActionCount", "criteria", "differences"], "report.scenarios[]");
+        if (!/^[a-f0-9]{64}$/.test(scenario.inputDigestSha256) || !Array.isArray(scenario.criteria) || !Array.isArray(scenario.differences)
+            || scenario.differences.some((value) => typeof value !== "string"))
+            throw new Error("Managed Workflow Harness rejected invalid scenario metadata.");
+        for (const criterion of scenario.criteria)
+            exactKeys(criterion, ["id", "status", "evaluator"], "report.scenarios[].criteria[]");
+    }
+}
+function exactKeys(value, allowed, name) {
+    const allowedKeys = new Set(allowed);
+    if (Object.keys(value).some((key) => !allowedKeys.has(key)))
+        throw new Error(`Managed Workflow Harness rejected unexpected ${name} data.`);
+}
+function checkpointKey(plan, evaluation) {
+    return `${plan.projectId}:${plan.workflow.id}:${plan.workflow.digestSha256}:${evaluation.nodeId}:${evaluation.taskContractDigestSha256}:${evaluation.mode}`;
+}
+function externalId(plan, evaluation) {
+    return `workflow:${plan.workflow.id}:${plan.workflow.digestSha256.slice(0, 16)}:${evaluation.nodeId}:${evaluation.mode.toLowerCase()}`;
+}
+async function mapLimit(items, limit, execute) {
+    const results = new Array(items.length);
+    let cursor = 0;
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, async () => {
+        while (cursor < items.length) {
+            const index = cursor++;
+            results[index] = await execute(items[index]);
+        }
+    }));
+    return results;
+}
+async function hostedJson(requestFetch, url, apiKey) {
+    const response = await requestFetch(url, { headers: { authorization: `Bearer ${apiKey}` }, redirect: "error" });
+    const value = await response.json().catch(() => ({}));
+    if (!response.ok)
+        throw new Error(typeof value.error === "string" ? value.error : `Witnora Control Plane request failed (${response.status}).`);
+    return value;
+}
+function required(value, name) {
+    const normalized = value.trim();
+    if (!normalized)
+        throw new Error(`Managed Workflow Harness ${name} is required.`);
+    return normalized;
+}
+function digest(value, name) {
+    const normalized = value.trim().toLowerCase();
+    if (!/^[a-f0-9]{64}$/.test(normalized))
+        throw new Error(`Managed Workflow Harness ${name} must be a SHA-256 digest.`);
+    return normalized;
+}
+function invalidStatus() {
+    throw new Error("Witnora returned an invalid Business Workflow status.");
+}

package/dist/vendor/onegent-runtime/task-evaluation-hosted.d.ts

@@ -0,0 +1,83 @@
+import type { TaskEvaluationReport } from "./task-evaluation.js";
+export interface TaskEvaluationHostedOptions {
+    baseUrl: string;
+    projectId: string;
+    apiKey: string;
+    externalId?: string;
+    fetch?: typeof fetch;
+}
+export interface TaskEvaluationHostedResult {
+    run: Record<string, unknown>;
+    evidence: Record<string, unknown>;
+    completion: Record<string, unknown>;
+}
+export declare function uploadTaskEvaluationReport(report: TaskEvaluationReport, options: TaskEvaluationHostedOptions): Promise<TaskEvaluationHostedResult>;
+export declare function createTaskEvaluationEvidenceBundle(report: TaskEvaluationReport, runId: string, reportDigestSha256?: string): {
+    schemaName: string;
+    schemaVersion: string;
+    schemaSemver: string;
+    kind: string;
+    runId: string;
+    generatedAt: string;
+    subject: {
+        name: string;
+        type: string;
+    };
+    verdict: {
+        passed: boolean;
+        score: number;
+        level: "REPLAY_SANDBOX_ONLY" | "SHADOW_NO_WRITE";
+    };
+    summary: {
+        products: string[];
+        criticalEvidence: number;
+        highEvidence: number;
+        totalEvidence: number;
+    };
+    results: {
+        schemaVersion: string;
+        product: string;
+        runId: string;
+        timestamp: string;
+        phase: string;
+        score: number;
+        passed: boolean;
+        summary: string;
+        artifacts: {};
+        evidence: {
+            id: string;
+            kind: string;
+            severity: string;
+            message: string;
+            source: string;
+            metadata: {
+                report: TaskEvaluationReport;
+                reportSha256: string;
+            };
+        }[];
+    }[];
+    evidence: {
+        id: string;
+        kind: string;
+        severity: string;
+        message: string;
+        source: string;
+        metadata: {
+            reportSha256: string;
+            taskContractId: string;
+            classification: "REPLAY_SANDBOX_ONLY" | "SHADOW_NO_WRITE";
+        };
+    }[];
+    artifacts: {};
+    artifactManifest: {
+        schemaVersion: string;
+        entries: never[];
+    };
+    standards: {
+        id: string;
+        name: string;
+        status: string;
+        note: string;
+    }[];
+};
+//# sourceMappingURL=task-evaluation-hosted.d.ts.map

package/dist/vendor/onegent-runtime/task-evaluation-hosted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-evaluation-hosted.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/task-evaluation-hosted.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,oBAAoB,EAC5B,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,0BAA0B,CAAC,CAyDrC;AAED,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+B1H"}

package/dist/vendor/onegent-runtime/task-evaluation-hosted.js

@@ -0,0 +1,108 @@
+import { createHash } from "node:crypto";
+export async function uploadTaskEvaluationReport(report, options) {
+    const baseUrl = required(options.baseUrl, "baseUrl").replace(/\/$/, "");
+    const projectId = required(options.projectId, "projectId");
+    const apiKey = required(options.apiKey, "apiKey");
+    const requestFetch = options.fetch ?? fetch;
+    const projectUrl = `${baseUrl}/v1/projects/${encodeURIComponent(projectId)}`;
+    const reportBytes = Buffer.from(`${JSON.stringify(report)}\n`, "utf8");
+    const reportDigestSha256 = createHash("sha256").update(reportBytes).digest("hex");
+    const operationId = `task-evaluation-${reportDigestSha256.slice(0, 32)}`;
+    const externalId = options.externalId?.trim() || `${report.mode.toLowerCase()}:${report.task.taskKey}:${report.task.version}:${reportDigestSha256.slice(0, 16)}`;
+    const run = await jsonRequest(requestFetch, `${projectUrl}/runs`, apiKey, {
+        method: "POST",
+        headers: { "idempotency-key": `${operationId}:run` },
+        body: JSON.stringify({
+            externalId,
+            kind: "custom",
+            agentId: report.task.subject.agentId,
+            schemaVersion: report.schemaVersion,
+            startedAt: report.generatedAt,
+            metadata: { taskEvaluation: {
+                    taskContractId: report.task.id,
+                    taskContractDigestSha256: report.task.digestSha256,
+                    scenarioSuiteSha256: report.task.scenarioSuite.sha256,
+                    reportDigestSha256,
+                    mode: report.mode,
+                    writesBlocked: true,
+                    rawInputsRetainedByCustomer: true,
+                } },
+        }),
+    });
+    if (typeof run.id !== "string" || !run.id)
+        throw new Error("Witnora Control Plane returned a task evaluation Run without an id.");
+    const bundle = createTaskEvaluationEvidenceBundle(report, run.id, reportDigestSha256);
+    const bundleBytes = Buffer.from(`${JSON.stringify(bundle, null, 2)}\n`, "utf8");
+    const query = new URLSearchParams({
+        fileName: `business-task-${report.mode.toLowerCase()}-evidence.json`,
+        kind: "evidence_bundle",
+        schemaVersion: "agentcert.evidence.v0.1",
+        runId: run.id,
+    });
+    const evidence = await jsonRequest(requestFetch, `${projectUrl}/evidence?${query}`, apiKey, {
+        method: "POST",
+        headers: { "content-type": "application/json", "idempotency-key": `${operationId}:evidence` },
+        body: new Uint8Array(bundleBytes).buffer,
+    });
+    const passed = report.verdict === "PASSED" || report.verdict === "MATCHED";
+    const completion = await jsonRequest(requestFetch, `${projectUrl}/runs/${encodeURIComponent(run.id)}/complete`, apiKey, {
+        method: "POST",
+        headers: { "idempotency-key": `${operationId}:complete` },
+        body: JSON.stringify({
+            status: passed ? "passed" : "manual_review",
+            score: report.summary.scenarios ? report.summary.matched / report.summary.scenarios : 0,
+            summary: `${report.mode} evaluated ${report.summary.scenarios} declared scenario${report.summary.scenarios === 1 ? "" : "s"}; ${report.summary.changed} changed and ${report.summary.blocked} blocked.`,
+            metadata: { evidenceId: evidence.id, evidenceSha256: evidence.sha256, taskEvaluationReportSha256: reportDigestSha256 },
+        }),
+    });
+    return { run, evidence, completion };
+}
+export function createTaskEvaluationEvidenceBundle(report, runId, reportDigestSha256) {
+    const digest = reportDigestSha256 ?? createHash("sha256").update(`${JSON.stringify(report)}\n`).digest("hex");
+    const passed = report.verdict === "PASSED" || report.verdict === "MATCHED";
+    return {
+        schemaName: "agentcert.evidence_bundle",
+        schemaVersion: "agentcert.evidence.v0.1",
+        schemaSemver: "0.1.0",
+        kind: "agentcert.evidence_bundle",
+        runId,
+        generatedAt: report.generatedAt,
+        subject: { name: `${report.task.taskKey} v${report.task.version}`, type: "application" },
+        verdict: { passed, score: passed ? 100 : 0, level: report.classification },
+        summary: { products: ["onegent-runtime"], criticalEvidence: report.summary.blocked, highEvidence: report.summary.changed, totalEvidence: report.summary.scenarios },
+        results: [{
+                schemaVersion: "1", product: "onegent-runtime", runId, timestamp: report.generatedAt, phase: "pre-release",
+                score: passed ? 100 : 0, passed,
+                summary: `${report.mode} comparison for the declared Business Task Contract.`, artifacts: {},
+                evidence: [{
+                        id: `task-evaluation:${digest.slice(0, 16)}`, kind: "task_evaluation", severity: passed ? "info" : "high",
+                        message: `${report.mode} ${report.verdict.toLowerCase()} for ${report.summary.scenarios} declared scenario${report.summary.scenarios === 1 ? "" : "s"}.`,
+                        source: "onegent-runtime", metadata: { report: structuredClone(report), reportSha256: digest },
+                    }],
+            }],
+        evidence: [{
+                id: `task-evaluation:${digest.slice(0, 16)}`, kind: "task_evaluation", severity: passed ? "info" : "high",
+                message: `${report.mode} ${report.verdict.toLowerCase()} for the declared Business Task Contract.`, source: "onegent-runtime",
+                metadata: { reportSha256: digest, taskContractId: report.task.id, classification: report.classification },
+            }],
+        artifacts: {}, artifactManifest: { schemaVersion: "agentcert.artifact_manifest.v0.1", entries: [] },
+        standards: [{ id: "witnora-business-task", name: "Witnora Business Task Contract", status: "mapped", note: report.limitations.join(" ") }],
+    };
+}
+async function jsonRequest(requestFetch, url, apiKey, init) {
+    const headers = new Headers(init.headers);
+    headers.set("authorization", `Bearer ${apiKey}`);
+    if (typeof init.body === "string")
+        headers.set("content-type", "application/json");
+    const response = await requestFetch(url, { ...init, headers, redirect: "error" });
+    const value = await response.json().catch(() => ({}));
+    if (!response.ok)
+        throw new Error(typeof value.error === "string" ? value.error : `Witnora Control Plane request failed (${response.status}).`);
+    return value;
+}
+function required(value, name) {
+    const normalized = value.trim();
+    if (!normalized)
+        throw new Error(`Task evaluation hosted upload ${name} is required.`);
+    return normalized;
+}

package/dist/vendor/onegent-runtime/task-evaluation.d.ts

@@ -0,0 +1,123 @@
+import type { SandboxCertificationHarness } from "./sandbox-harness.js";
+import type { CreateActionIntentInput } from "./types.js";
+export declare const TASK_EVALUATION_SCHEMA_VERSION: "witnora.task_evaluation.v0.1";
+export interface TaskEvaluationContract {
+    id: string;
+    digestSha256: string;
+    taskKey: string;
+    version: number;
+    subject: {
+        agentId: string;
+        agentVersion: string;
+    };
+    scenarioSuite: {
+        id: string;
+        version: string;
+        sha256: string;
+    };
+    actionPaths: Array<{
+        id: string;
+        actionType: "SUBMIT" | "PAY" | "SEND" | "UPDATE";
+        targetSystem: string;
+        requiredPermissions: string[];
+        customerDecision?: "ALLOW" | "REQUIRE_APPROVAL" | "DENY";
+    }>;
+    successCriteria: Array<{
+        id: string;
+        evaluator: "DETERMINISTIC" | "READ_ONLY_PROBE";
+        predicateDigestSha256: string;
+    }>;
+}
+export interface TaskEvaluationIntent {
+    pathId: string;
+    parametersDigestSha256: string;
+    action?: CreateActionIntentInput;
+}
+export interface TaskEvaluationScenario {
+    id: string;
+    source: "HISTORICAL" | "FIXTURE" | "LIVE_SHADOW";
+    sanitized: boolean;
+    input: unknown;
+    inputDigestSha256: string;
+    baseline: {
+        resultDigestSha256: string;
+        actionIntents: Array<Omit<TaskEvaluationIntent, "action">>;
+    };
+}
+export interface TaskCandidateEvaluation {
+    resultDigestSha256: string;
+    actionIntents: TaskEvaluationIntent[];
+    criteria: Array<{
+        id: string;
+        passed: boolean;
+    }>;
+}
+export interface ShadowCandidateEvaluation {
+    resultDigestSha256: string;
+    criteria: Array<{
+        id: string;
+        passed: boolean;
+    }>;
+}
+export interface TaskEvaluationReport {
+    schemaVersion: typeof TASK_EVALUATION_SCHEMA_VERSION;
+    mode: "REPLAY" | "SHADOW";
+    classification: "REPLAY_SANDBOX_ONLY" | "SHADOW_NO_WRITE";
+    generatedAt: string;
+    task: {
+        id: string;
+        digestSha256: string;
+        taskKey: string;
+        version: number;
+        subject: TaskEvaluationContract["subject"];
+        scenarioSuite: TaskEvaluationContract["scenarioSuite"];
+    };
+    verdict: "PASSED" | "MATCHED" | "CHANGED" | "BLOCKED";
+    summary: {
+        scenarios: number;
+        matched: number;
+        changed: number;
+        blocked: number;
+        sandboxActions: number;
+        productionWrites: 0;
+    };
+    scenarios: Array<{
+        id: string;
+        source: TaskEvaluationScenario["source"];
+        inputDigestSha256: string;
+        matched: boolean;
+        blocked: boolean;
+        sandboxActionCount: number;
+        criteria: Array<{
+            id: string;
+            status: "PASSED" | "FAILED" | "NOT_OBSERVED";
+            evaluator: "DETERMINISTIC" | "READ_ONLY_PROBE";
+        }>;
+        differences: string[];
+    }>;
+    limitations: string[];
+}
+export declare function runReplayEvaluation(options: {
+    task: TaskEvaluationContract;
+    harness: SandboxCertificationHarness;
+    tenantId: string;
+    scenarios: TaskEvaluationScenario[];
+    evaluateCandidate: (scenario: {
+        id: string;
+        source: TaskEvaluationScenario["source"];
+        input: unknown;
+    }) => Promise<TaskCandidateEvaluation>;
+    now?: () => Date;
+}): Promise<TaskEvaluationReport>;
+export declare function runShadowEvaluation(options: {
+    task: TaskEvaluationContract;
+    observations: TaskEvaluationScenario[];
+    evaluateCandidate: (context: {
+        id: string;
+        source: "LIVE_SHADOW";
+        input: unknown;
+        propose: (intent: Omit<TaskEvaluationIntent, "action">) => void;
+    }) => Promise<ShadowCandidateEvaluation>;
+    now?: () => Date;
+}): Promise<TaskEvaluationReport>;
+//# sourceMappingURL=task-evaluation.d.ts.map

package/dist/vendor/onegent-runtime/task-evaluation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-evaluation.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/task-evaluation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,eAAO,MAAM,8BAA8B,EAAG,8BAAuC,CAAC;AAEtF,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,aAAa,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,WAAW,EAAE,KAAK,CAAC;QACjB,EAAE,EAAE,MAAM,CAAC;QACX,UAAU,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;QACjD,YAAY,EAAE,MAAM,CAAC;QACrB,mBAAmB,EAAE,MAAM,EAAE,CAAC;QAC9B,gBAAgB,CAAC,EAAE,OAAO,GAAG,kBAAkB,GAAG,MAAM,CAAC;KAC1D,CAAC,CAAC;IACH,eAAe,EAAE,KAAK,CAAC;QACrB,EAAE,EAAE,MAAM,CAAC;QACX,SAAS,EAAE,eAAe,GAAG,iBAAiB,CAAC;QAC/C,qBAAqB,EAAE,MAAM,CAAC;KAC/B,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,MAAM,CAAC,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,aAAa,CAAC;IACjD,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE;QACR,kBAAkB,EAAE,MAAM,CAAC;QAC3B,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC;KAC5D,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,oBAAoB,EAAE,CAAC;IACtC,QAAQ,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,yBAAyB;IACxC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,OAAO,8BAA8B,CAAC;IACrD,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC1B,cAAc,EAAE,qBAAqB,GAAG,iBAAiB,CAAC;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC3C,aAAa,EAAE,sBAAsB,CAAC,eAAe,CAAC,CAAC;KACxD,CAAC;IACF,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IACtD,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,EAAE,CAAC,CAAC;KACrB,CAAC;IACF,SAAS,EAAE,KAAK,CAAC;QACf,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACzC,iBAAiB,EAAE,MAAM,CAAC;QAC1B,OAAO,EAAE,OAAO,CAAC;QACjB,OAAO,EAAE,OAAO,CAAC;QACjB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,QAAQ,EAAE,KAAK,CAAC;YACd,EAAE,EAAE,MAAM,CAAC;YACX,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,cAAc,CAAC;YAC7C,SAAS,EAAE,eAAe,GAAG,iBAAiB,CAAC;SAChD,CAAC,CAAC;QACH,WAAW,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC,CAAC;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE;IACjD,IAAI,EAAE,sBAAsB,CAAC;IAC7B,OAAO,EAAE,2BAA2B,CAAC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,sBAAsB,EAAE,CAAC;IACpC,iBAAiB,EAAE,CAAC,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC5I,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoDhC;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE;IACjD,IAAI,EAAE,sBAAsB,CAAC;IAC7B,YAAY,EAAE,sBAAsB,EAAE,CAAC;IACvC,iBAAiB,EAAE,CAAC,OAAO,EAAE;QAC3B,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,aAAa,CAAC;QACtB,KAAK,EAAE,OAAO,CAAC;QACf,OAAO,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,KAAK,IAAI,CAAC;KACjE,KAAK,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgDhC"}