witnora 0.18.10 → 0.18.11

package/dist/gateway.js

@@ -1,4 +1,4 @@
-import { createHash, createPrivateKey, createPublicKey, randomBytes } from "node:crypto";
+import { createHash, createPrivateKey, createPublicKey, randomBytes, randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
 import { closeSync, openSync } from "node:fs";
 import { access, chmod, mkdir, readFile, realpath, rename, rm, writeFile } from "node:fs/promises";
@@ -8,6 +8,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { loadConnection } from "./credentials.js";
 import { authorizeProjectConnection } from "./device-authorization.js";
 import { verifyHostedProbeCredential } from "./runtime-bootstrap.js";
+import { activateRealPathIntegrations } from "./real-path-activation.js";
 import { inspectIsolatedOutcomeProbe, observeInIsolatedOutcomeProbe } from "./probe-process.js";
 import { findAvailableRuntimeSandboxOrigin, LOCAL_SANDBOX_FIXTURE_CONTRACT_SHA256, startRuntimeSandboxFixture, } from "./runtime-sandbox-fixture.js";
 import { generateRuntimeSandboxKit, LOCAL_SANDBOX_ADAPTER_ID, LOCAL_SANDBOX_ADAPTER_VERSION, LOCAL_SANDBOX_PROBE_ID, } from "./runtime-sandbox-kit.js";
@@ -509,10 +510,6 @@ export async function runCustomerGateway(options) {
         throw new Error("The saved Gateway credential does not match gateway.json. Run gateway init again.");
     }
     const dataDirectory = resolve(directory, config.storageDirectory);
-    const workflowHarnessConfigPath = join(directory, "workflow-harness.json");
-    const workflowHarnessConfig = await exists(workflowHarnessConfigPath)
-        ? parseManagedWorkflowHarnessConfig(await readFile(workflowHarnessConfigPath, "utf8"))
-        : undefined;
     const keyRingPath = join(dataDirectory, "source-keys.json");
     const keyRing = await (await exists(keyRingPath)
         ? CustomerSourceKeyRing.open(keyRingPath)
@@ -534,16 +531,10 @@ export async function runCustomerGateway(options) {
                 FileActionCheckpointStore: (await durableWorker).FileActionCheckpointStore,
             })
             : undefined;
-        const workflowHarness = workflowHarnessConfig
-            ? await createConfiguredWorkflowHarness({
-                directory,
-                projectId: config.projectId,
-                server: config.server,
-                apiKey: connection.apiKey,
-                config: workflowHarnessConfig,
-                managed: await configManagedWorkflowHarnessImport(),
-            })
-            : undefined;
+        const assuranceController = await createContinuousAssuranceController({
+            repository: resolve(directory, "..", ".."), directory, projectId: config.projectId, server: config.server,
+            apiKey: connection.apiKey, config, sourceSigner: () => keyRing.activeSigner(),
+        });
         actionWorker?.start();
         const gateway = await startCustomerOwnedCollectorGateway({
             client: new RemoteCollectorClient({ baseUrl: connection.server, projectId: connection.projectId, apiKey: connection.apiKey }),
@@ -592,19 +583,17 @@ export async function runCustomerGateway(options) {
                             fixtureReady: false,
                         } } : {}),
                 } } : {}),
-            ...(workflowHarnessConfig?.schemaVersion === MANAGED_WORKFLOW_HARNESS_SCHEMA && workflowHarness
-                ? { assuranceHarness: { status: () => workflowHarness.status() } }
-                : {}),
+            assuranceHarness: { status: () => assuranceController.status() },
         });
-        workflowHarness?.start();
+        assuranceController.start();
         process.stdout.write(`Witnora customer-owned Gateway listening on ${gateway.baseUrl}\n`);
         process.stdout.write(config.runtimeWorker
             ? "Runtime worker: READY. Approved exact configured actions execute automatically, then use the separate read-only probe and Hosted signed receipt.\n"
             : "Evidence ceiling: RECORDED. No exact target adapter and separate outcome probe are configured, so runtime writes remain fail-closed.\n");
-        if (workflowHarness)
-            process.stdout.write("Managed Workflow Harness: CONFIGURED. Only authority-ready Replay and no-write Shadow evaluations will be sent to the pinned customer evaluator.\n");
+        if (await assuranceController.status())
+            process.stdout.write("Managed Workflow Harness: ACTIVE. Approved task changes are detected and revalidated automatically.\n");
         for (const signal of ["SIGINT", "SIGTERM"]) {
-            process.once(signal, () => void Promise.allSettled([gateway.close(), ...(workflowHarness ? [workflowHarness.close()] : []), ...(sandboxFixture ? [sandboxFixture.close()] : [])]).finally(() => process.exit(0)));
+            process.once(signal, () => void Promise.allSettled([gateway.close(), assuranceController.close(), ...(sandboxFixture ? [sandboxFixture.close()] : [])]).finally(() => process.exit(0)));
         }
     }
     catch (error) {
@@ -727,6 +716,210 @@ export async function createConfiguredWorkflowHarness(input) {
         tick,
     };
 }
+function configSignedChangeManifestImport() {
+    return import(new URL("./vendor/onegent-runtime/signed-change-manifest.js", import.meta.url).href);
+}
+/**
+ * Reconciles the existing approved-task, Real Path, Manifest, and Autopilot
+ * contracts from inside the already-running Gateway. No new service or durable
+ * orchestration state is introduced; local config remains the recoverable cache.
+ */
+export async function createContinuousAssuranceController(input) {
+    const request = input.fetch ?? fetch;
+    const managed = input.managed ?? await configManagedWorkflowHarnessImport();
+    let harness;
+    let harnessFingerprint;
+    let timer;
+    let reconciling = false;
+    let closing = false;
+    let lastReportedError;
+    const replaceHarness = async (config) => {
+        const fingerprint = createHash("sha256").update(JSON.stringify(config)).digest("hex");
+        if (harness && fingerprint === harnessFingerprint)
+            return;
+        const next = await createConfiguredWorkflowHarness({
+            directory: input.directory,
+            projectId: input.projectId,
+            server: input.server,
+            apiKey: input.apiKey,
+            config,
+            managed,
+            evaluatorKit: input.evaluatorKit,
+            fetch: request,
+        });
+        next.start();
+        const previous = harness;
+        harness = next;
+        harnessFingerprint = fingerprint;
+        await previous?.close();
+    };
+    const workflowHarnessPath = join(input.directory, "workflow-harness.json");
+    if (await exists(workflowHarnessPath)) {
+        try {
+            await replaceHarness(parseManagedWorkflowHarnessConfig(await readFile(workflowHarnessPath, "utf8")));
+        }
+        catch (error) {
+            lastReportedError = message(error);
+            process.stderr.write(`Existing Assurance Harness will be repaired in the background: ${lastReportedError}\n`);
+        }
+    }
+    const reconcile = async () => {
+        if (closing || reconciling)
+            return;
+        reconciling = true;
+        try {
+            const activation = await activateRealPathIntegrations({
+                repository: input.repository,
+                server: input.server,
+                projectId: input.projectId,
+                apiKey: input.apiKey,
+                fetch: request,
+            });
+            if (activation.state === "READY_TO_START") {
+                const configured = await activateManagedWorkflowHarness({
+                    repository: input.repository,
+                    modulePath: activation.modulePath,
+                    realPathActivations: activation.activations,
+                    previousGeneratedModuleSha256: activation.previousGeneratedModuleSha256,
+                });
+                await replaceHarness(configured.config);
+            }
+            await publishCurrentChangeManifests({ ...input, fetch: request }, harness ? await harness.status() : undefined);
+            lastReportedError = undefined;
+        }
+        catch (error) {
+            const current = message(error).slice(0, 500);
+            if (current !== lastReportedError)
+                process.stderr.write(`Continuous Assurance reconciliation is waiting safely: ${current}\n`);
+            lastReportedError = current;
+        }
+        finally {
+            reconciling = false;
+        }
+    };
+    return {
+        start() {
+            if (timer || closing)
+                return;
+            void reconcile();
+            timer = setInterval(() => void reconcile(), input.intervalMs ?? 15_000);
+            timer.unref?.();
+        },
+        reconcile,
+        status: () => harness?.status() ?? Promise.resolve(undefined),
+        async close() {
+            closing = true;
+            if (timer)
+                clearInterval(timer);
+            timer = undefined;
+            await harness?.close();
+            harness = undefined;
+        },
+    };
+}
+async function publishCurrentChangeManifests(input, heartbeat) {
+    const base = input.server.replace(/\/$/, "");
+    const [activationResponse, manifestResponse] = await Promise.all([
+        input.fetch(`${base}/v1/projects/${encodeURIComponent(input.projectId)}/nora/activation-plan`, { headers: { authorization: `Bearer ${input.apiKey}` }, redirect: "error", signal: AbortSignal.timeout(10_000) }),
+        input.fetch(`${base}/v1/projects/${encodeURIComponent(input.projectId)}/change-manifests`, { headers: { authorization: `Bearer ${input.apiKey}` }, redirect: "error", signal: AbortSignal.timeout(10_000) }),
+    ]);
+    if (!activationResponse.ok)
+        throw new Error(`Assurance activation plan returned HTTP ${activationResponse.status}.`);
+    if (!manifestResponse.ok)
+        throw new Error(`Signed Change Manifest collection returned HTTP ${manifestResponse.status}.`);
+    const activation = await boundedResponseJson(activationResponse, 512 * 1024);
+    const collection = await boundedResponseJson(manifestResponse, 512 * 1024);
+    const targets = Array.isArray(activation.targets) ? activation.targets.filter(validActivationTarget) : [];
+    const manifests = Array.isArray(collection.manifests) ? collection.manifests.filter(validChangeManifestRecord) : [];
+    if (!targets.length)
+        return;
+    const packageDigest = await optionalFileDigest(join(input.repository, "package.json"));
+    const discoveryDigest = await optionalFileDigest(join(input.repository, "witnora.discovery.json"));
+    const policyRevision = createHash("sha256").update(JSON.stringify({ privacyMode: input.config.privacyMode, coverage: input.config.coverage })).digest("hex");
+    const explicitModelDigest = process.env.WITNORA_MODEL_DIGEST?.trim();
+    const explicitPromptWorkflowDigest = process.env.WITNORA_PROMPT_WORKFLOW_DIGEST?.trim();
+    const runtime = input.config.runtimeWorker;
+    const components = {
+        ...(explicitModelDigest && /^[a-f0-9]{64}$/.test(explicitModelDigest) ? { modelDigest: explicitModelDigest } : {}),
+        ...(validSha256(explicitPromptWorkflowDigest) ? { promptWorkflowDigest: explicitPromptWorkflowDigest } : packageDigest ? { promptWorkflowDigest: packageDigest } : {}),
+        ...(discoveryDigest ? { toolManifestDigest: discoveryDigest } : {}),
+        policyRevision,
+        ...(heartbeat ? { evaluatorIdentity: { id: "witnora-managed-evaluator", version: "1", digestSha256: heartbeat.evaluatorContractSha256 } } : {}),
+        ...(runtime ? { adapterIdentity: { id: runtime.adapterId, version: runtime.adapterVersion, digestSha256: runtime.adapterModuleSha256 } } : {}),
+    };
+    const signed = input.signedChangeManifest ?? await configSignedChangeManifestImport();
+    const unique = new Map();
+    const exactBindings = heartbeat?.realPathActivations ?? [];
+    for (const target of targets) {
+        for (const environment of target.environments) {
+            if (!exactBindings.some((binding) => binding.agentId === target.agentId && binding.environment === environment))
+                continue;
+            unique.set(`${target.agentId}:${environment}`, { agentId: target.agentId, agentVersion: target.currentAgentVersion, environment });
+        }
+    }
+    for (const target of unique.values()) {
+        const previous = manifests.find((manifest) => manifest.agentId === target.agentId && manifest.environment === target.environment);
+        if (previous && previous.agentVersion === target.agentVersion && sameManifestComponents(previous, components))
+            continue;
+        const observedAt = new Date().toISOString();
+        const payload = {
+            schemaVersion: "witnora.signed_change_manifest.v0.1",
+            manifestId: `gateway-${randomUUID()}`,
+            projectId: input.projectId,
+            agentId: target.agentId,
+            agentVersion: target.agentVersion,
+            environment: target.environment,
+            observedAt,
+            ...components,
+            ...(previous?.manifestDigestSha256 ? { previousManifestDigest: previous.manifestDigestSha256 } : {}),
+        };
+        const envelope = signed.createSignedChangeManifestEnvelope(payload, input.sourceSigner());
+        await signed.uploadSignedChangeManifest({ baseUrl: base, projectId: input.projectId, apiKey: input.apiKey, envelope, fetch: input.fetch });
+    }
+}
+function validActivationTarget(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const target = value;
+    return typeof target.agentId === "string" && typeof target.currentAgentVersion === "string"
+        && Array.isArray(target.environments) && target.environments.every((environment) => environment === "sandbox" || environment === "staging" || environment === "production");
+}
+function validChangeManifestRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const manifest = value;
+    return typeof manifest.agentId === "string" && typeof manifest.agentVersion === "string"
+        && (manifest.environment === "sandbox" || manifest.environment === "staging" || manifest.environment === "production")
+        && typeof manifest.manifestDigestSha256 === "string";
+}
+function sameManifestComponents(previous, next) {
+    return previous.modelDigest === next.modelDigest && previous.promptWorkflowDigest === next.promptWorkflowDigest
+        && previous.toolManifestDigest === next.toolManifestDigest && previous.policyRevision === next.policyRevision
+        && JSON.stringify(previous.evaluatorIdentity) === JSON.stringify(next.evaluatorIdentity)
+        && JSON.stringify(previous.adapterIdentity) === JSON.stringify(next.adapterIdentity);
+}
+async function optionalFileDigest(path) {
+    try {
+        return createHash("sha256").update(await readFile(path)).digest("hex");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+function validSha256(value) {
+    return Boolean(value && /^[a-f0-9]{64}$/.test(value));
+}
+async function boundedResponseJson(response, maxBytes) {
+    const text = await response.text();
+    if (Buffer.byteLength(text) > maxBytes)
+        throw new Error("Hosted Assurance response exceeded its size limit.");
+    const value = JSON.parse(text);
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("Hosted Assurance response is invalid.");
+    return value;
+}
 async function startManagedLocalEvaluator(directory, config, evaluatorKit) {
     const repository = resolve(directory, "..", "..");
     const modulePath = resolve(repository, config.evaluatorModulePath);

package/dist/internal/control-client/collector-gateway.d.ts

@@ -48,7 +48,7 @@ export interface CustomerOwnedCollectorGatewayOptions {
         };
     };
     assuranceHarness?: {
-        status(): Promise<AssuranceHarnessHeartbeat>;
+        status(): Promise<AssuranceHarnessHeartbeat | undefined>;
     };
     runtimeBinding?: RuntimeReadinessBinding;
     onRepairRequested?: (request: {

package/dist/internal/control-client/collector-gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collector-gateway.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/collector-gateway.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,qBAAqB,EAGrB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjJ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClH,SAAS,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;QAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnP,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3G,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjI;AAED,MAAM,WAAW,oCAAoC;IACnD,MAAM,EAAE,wBAAwB,CAAC;IACjC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE;QACb,KAAK,CAAC,KAAK,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACxF,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,cAAc,CAAC,EAAE;YAAE,cAAc,EAAE,oBAAoB,CAAC;YAAC,OAAO,EAAE,uBAAuB,CAAC;YAAC,YAAY,EAAE,OAAO,CAAC;YAAC,WAAW,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAC3I,CAAC;IACF,gBAAgB,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAAA;KAAE,CAAC;IACpE,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5G;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,KAAK,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,MAAM,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,kDAAkD,CAAC;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,gBAAgB,CAAC,EAAE,yBAAyB,CAAC;IAC7C,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CAClK;AAkBD,wBAAsB,kCAAkC,CAAC,OAAO,EAAE,oCAAoC,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAiO9I"}
+{"version":3,"file":"collector-gateway.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/collector-gateway.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,qBAAqB,EAGrB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjJ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClH,SAAS,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;QAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnP,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3G,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjI;AAED,MAAM,WAAW,oCAAoC;IACnD,MAAM,EAAE,wBAAwB,CAAC;IACjC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE;QACb,KAAK,CAAC,KAAK,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACxF,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,cAAc,CAAC,EAAE;YAAE,cAAc,EAAE,oBAAoB,CAAC;YAAC,OAAO,EAAE,uBAAuB,CAAC;YAAC,YAAY,EAAE,OAAO,CAAC;YAAC,WAAW,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAC3I,CAAC;IACF,gBAAgB,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAAA;KAAE,CAAC;IAChF,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5G;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,KAAK,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,MAAM,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,kDAAkD,CAAC;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,gBAAgB,CAAC,EAAE,yBAAyB,CAAC;IAC7C,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CAClK;AAkBD,wBAAsB,kCAAkC,CAAC,OAAO,EAAE,oCAAoC,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAkO9I"}

package/dist/internal/control-client/collector-gateway.js

@@ -76,6 +76,7 @@ export async function startCustomerOwnedCollectorGateway(options) {
         return { delivered, reconciled, pending };
     };
     const status = async () => {
+        const assuranceHarness = options.assuranceHarness ? await options.assuranceHarness.status() : undefined;
         let pendingRecordCount = 0;
         let lastAckSequence;
         for (const journal of journals.values()) {
@@ -94,7 +95,7 @@ export async function startCustomerOwnedCollectorGateway(options) {
             lastRemoteSuccessAt,
             lastRemoteError,
             ...(options.actionWorker ? { actionWorker: await options.actionWorker.status() } : {}),
-            ...(options.assuranceHarness ? { assuranceHarness: await options.assuranceHarness.status() } : {}),
+            ...(assuranceHarness ? { assuranceHarness } : {}),
             ...(monitoringControlFor() ? { monitoring: monitoringControlFor() } : {}),
         };
     };

package/dist/real-path-activation.js

@@ -11,11 +11,25 @@ export async function activateRealPathIntegrations(options) {
     if (!response.ok)
         throw new Error(`Could not load approved real-path integrations (${response.status}).`);
     const body = await boundedJson(response);
-    const approved = Array.isArray(body.integrations) ? body.integrations.map(parsePlan).filter((plan) => plan.status === "READY_TO_ACTIVATE") : [];
+    const approved = Array.isArray(body.integrations) ? body.integrations.map(parsePlan).filter((plan) => plan.status === "READY_TO_ACTIVATE" || plan.status === "HARNESS_ACTIVE") : [];
     const plans = approved.filter((plan) => ["STRIPE_REFUND", "SHOPIFY_DISPUTE", "ZENDESK_TICKET", "SALESFORCE_RECORD", "HUBSPOT_CRM_RECORD", "POSTGRES_RECORD"].includes(plan.generated.providerPackId) && plan.environment === "sandbox" && plan.customerSummary.evaluationMode === "SHADOW");
     if (!plans.length)
         return { state: "NOT_CONFIGURED", created: false, activations: [], generatedFiles: [], rollback: async () => undefined };
     const environment = options.env ?? process.env;
+    const modulePath = join(repository, "witnora.assurance-harness.mjs");
+    const manifestPath = join(repository, ".witnora", "gateway", "real-path-activations.json");
+    const source = generatedProviderHarness(plans);
+    const moduleDigestSha256 = sha(source);
+    const current = await readFile(modulePath, "utf8").catch((error) => error.code === "ENOENT" ? undefined : Promise.reject(error));
+    const priorSource = await readFile(manifestPath, "utf8").catch((error) => error.code === "ENOENT" ? undefined : Promise.reject(error));
+    const prior = priorSource === undefined ? undefined : JSON.parse(priorSource);
+    const cachedActivations = prior?.projectId === options.projectId && prior.moduleDigestSha256 === moduleDigestSha256 && current === source
+        && Array.isArray(prior.activations) && sameActivationPlans(plans, prior.activations) ? structuredClone(prior.activations) : undefined;
+    if (cachedActivations) {
+        for (const plan of plans)
+            await persistProviderCredential(repository, plan, environment);
+        return { state: "READY_TO_START", created: false, modulePath: "witnora.assurance-harness.mjs", activations: cachedActivations, generatedFiles: [], previousGeneratedModuleSha256: moduleDigestSha256, rollback: async () => undefined };
+    }
     const activations = [];
     const scenarios = [];
     for (const plan of plans) {
@@ -25,15 +39,8 @@ export async function activateRealPathIntegrations(options) {
         activations.push({ integrationId: plan.id, integrationDigestSha256: plan.digestSha256, taskContractId: plan.taskContractId, taskContractDigestSha256: plan.taskContractDigestSha256, agentId: plan.subject.agentId, agentVersion: plan.subject.agentVersion, environment: plan.environment, providerPackId: plan.generated.providerPackId, providerContractDigestSha256: plan.generated.providerContractDigestSha256, actionPathIds: plan.generated.actionPathBindings.map((item) => item.actionPathId), acceptance });
         scenarios.push({ plan, value: [preflight.scenario] });
     }
-    const modulePath = join(repository, "witnora.assurance-harness.mjs");
-    const manifestPath = join(repository, ".witnora", "gateway", "real-path-activations.json");
-    const source = generatedProviderHarness(plans);
-    const moduleDigestSha256 = sha(source);
     let created = false;
     const generatedFiles = [];
-    const current = await readFile(modulePath, "utf8").catch((error) => error.code === "ENOENT" ? undefined : Promise.reject(error));
-    const priorSource = await readFile(manifestPath, "utf8").catch((error) => error.code === "ENOENT" ? undefined : Promise.reject(error));
-    const prior = priorSource === undefined ? undefined : JSON.parse(priorSource);
     const previousGeneratedModuleSha256 = current !== undefined && sha(current) === prior?.moduleDigestSha256 ? prior.moduleDigestSha256 : undefined;
     if (current === undefined) {
         await writeFile(modulePath, source, { encoding: "utf8", mode: 0o600, flag: "wx" });
@@ -253,16 +260,30 @@ async function persistProviderCredential(repository, plan, environment) {
         return;
     const name = providerCredentialEnvironmentName(plan.generated.providerPackId);
     const value = environment[name];
-    if (!value)
-        throw new Error(`${plan.generated.providerPackId} activation requires its read-only credential in the customer environment.`);
     const directory = join(repository, ".witnora", "provider-credentials");
     const target = join(directory, `${plan.id}.secret`);
-    const temporary = `${target}.${randomUUID()}.tmp`;
+    const current = await readFile(target, "utf8").catch((error) => error.code === "ENOENT" ? undefined : Promise.reject(error));
+    if (!value) {
+        if (current !== undefined)
+            return;
+        throw new Error(`${plan.generated.providerPackId} activation requires its read-only credential in the customer environment.`);
+    }
+    if (current === value)
+        return;
     await mkdir(directory, { recursive: true });
     await writeFile(join(directory, ".gitignore"), "*\n!.gitignore\n", { encoding: "utf8", mode: 0o600, flag: "wx" }).catch((error) => { if (error.code !== "EEXIST")
         throw error; });
-    await writeFile(temporary, value, { encoding: "utf8", mode: 0o600, flag: "wx" });
-    await rename(temporary, target);
+    await writeFile(target, value, { encoding: "utf8", mode: 0o600 });
+}
+function sameActivationPlans(plans, activations) {
+    if (plans.length !== activations.length)
+        return false;
+    return plans.every((plan) => activations.some((activation) => activation.integrationId === plan.id && activation.integrationDigestSha256 === plan.digestSha256
+        && activation.taskContractId === plan.taskContractId && activation.taskContractDigestSha256 === plan.taskContractDigestSha256
+        && activation.agentId === plan.subject.agentId && activation.agentVersion === plan.subject.agentVersion && activation.environment === plan.environment
+        && activation.providerPackId === plan.generated.providerPackId && activation.providerContractDigestSha256 === plan.generated.providerContractDigestSha256
+        && canonical([...activation.actionPathIds].sort()) === canonical(plan.generated.actionPathBindings.map((item) => item.actionPathId).sort())
+        && activation.acceptance?.kind === "READ_ONLY_PROVIDER_PREFLIGHT" && activation.acceptance.productionWrites === 0 && digest(activation.acceptance.observationDigestSha256)));
 }
 function providerCredentialEnvironmentName(packId) {
     if (packId === "STRIPE_REFUND")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.18.10",
+  "version": "0.18.11",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",