witnora 0.18.10 → 0.18.12

package/dist/gateway.js

@@ -1,4 +1,4 @@
-import { createHash, createPrivateKey, createPublicKey, randomBytes } from "node:crypto";
+import { createHash, createPrivateKey, createPublicKey, randomBytes, randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
 import { closeSync, openSync } from "node:fs";
 import { access, chmod, mkdir, readFile, realpath, rename, rm, writeFile } from "node:fs/promises";
@@ -8,6 +8,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { loadConnection } from "./credentials.js";
 import { authorizeProjectConnection } from "./device-authorization.js";
 import { verifyHostedProbeCredential } from "./runtime-bootstrap.js";
+import { activateRealPathIntegrations } from "./real-path-activation.js";
 import { inspectIsolatedOutcomeProbe, observeInIsolatedOutcomeProbe } from "./probe-process.js";
 import { findAvailableRuntimeSandboxOrigin, LOCAL_SANDBOX_FIXTURE_CONTRACT_SHA256, startRuntimeSandboxFixture, } from "./runtime-sandbox-fixture.js";
 import { generateRuntimeSandboxKit, LOCAL_SANDBOX_ADAPTER_ID, LOCAL_SANDBOX_ADAPTER_VERSION, LOCAL_SANDBOX_PROBE_ID, } from "./runtime-sandbox-kit.js";
@@ -60,6 +61,7 @@ export async function initializeCustomerGateway(options) {
         port: gatewayPort(process.env.WITNORA_GATEWAY_PORT, 8787),
         storageDirectory: "data",
         privacyMode: "metadata_only",
+        ...(options.agentIdentity ? { agentIdentity: options.agentIdentity } : {}),
         coverage: runtimeKit
             ? { recorded: "configured", enforced: "configured", outcomeVerified: "configured" }
             : { recorded: "configured", enforced: "not_configured", outcomeVerified: "not_configured" },
@@ -135,14 +137,20 @@ export async function upgradeCustomerGatewayRuntime(options) {
     if (current.projectId !== options.authorization.projectId || current.server !== options.authorization.server)
         throw new Error("Existing Gateway project/server binding does not match this authorized Runtime upgrade.");
     const generatedClient = clientRaw === gatewayClient(current)
-        || (!current.runtimeWorker && clientRaw === recordedGatewayClient(current));
+        || (!current.runtimeWorker && (clientRaw === recordedGatewayClient(current)
+            || clientRaw === recordedGatewayClient({ ...current, agentIdentity: undefined })));
     if (!generatedClient || readmeRaw !== gatewayReadme(current))
         throw new Error("Existing Gateway files differ from the Witnora-generated version; refusing to overwrite them.");
     if (current.runtimeWorker && current.runtimeWorker.adapterId !== LOCAL_SANDBOX_ADAPTER_ID) {
         throw new Error("Existing Gateway already has a different Runtime worker; preserve it and reconfigure in Advanced mode.");
     }
     const runtimeKit = await prepareRuntimeSandboxKit(options.runtimeReferences, options.authorization, options.configHome, options.fetch ?? fetch, directory);
-    const next = { ...current, coverage: { recorded: "configured", enforced: "configured", outcomeVerified: "configured" }, runtimeWorker: runtimeKit.config };
+    const next = {
+        ...current,
+        ...(options.agentIdentity ? { agentIdentity: options.agentIdentity } : {}),
+        coverage: { recorded: "configured", enforced: "configured", outcomeVerified: "configured" },
+        runtimeWorker: runtimeKit.config,
+    };
     next.runtimeWorker.configDigestSha256 = gatewayConfigDigest(next);
     const replacingGeneratedRuntime = current.runtimeWorker?.adapterId === LOCAL_SANDBOX_ADAPTER_ID;
     if (replacingGeneratedRuntime) {
@@ -154,7 +162,8 @@ export async function upgradeCustomerGatewayRuntime(options) {
             || createHash("sha256").update(probeBytes).digest("hex") !== current.runtimeWorker.probeModuleSha256) {
             throw new Error("Existing generated Runtime modules were modified; refusing to overwrite them.");
         }
-        if (sameRuntimeGeneration(current.runtimeWorker, next.runtimeWorker)) {
+        if (sameRuntimeGeneration(current.runtimeWorker, next.runtimeWorker)
+            && JSON.stringify(current.agentIdentity) === JSON.stringify(next.agentIdentity)) {
             return { config: current, generatedFiles: [], changed: false, rollback: async () => undefined };
         }
     }
@@ -509,10 +518,6 @@ export async function runCustomerGateway(options) {
         throw new Error("The saved Gateway credential does not match gateway.json. Run gateway init again.");
     }
     const dataDirectory = resolve(directory, config.storageDirectory);
-    const workflowHarnessConfigPath = join(directory, "workflow-harness.json");
-    const workflowHarnessConfig = await exists(workflowHarnessConfigPath)
-        ? parseManagedWorkflowHarnessConfig(await readFile(workflowHarnessConfigPath, "utf8"))
-        : undefined;
     const keyRingPath = join(dataDirectory, "source-keys.json");
     const keyRing = await (await exists(keyRingPath)
         ? CustomerSourceKeyRing.open(keyRingPath)
@@ -534,16 +539,10 @@ export async function runCustomerGateway(options) {
                 FileActionCheckpointStore: (await durableWorker).FileActionCheckpointStore,
             })
             : undefined;
-        const workflowHarness = workflowHarnessConfig
-            ? await createConfiguredWorkflowHarness({
-                directory,
-                projectId: config.projectId,
-                server: config.server,
-                apiKey: connection.apiKey,
-                config: workflowHarnessConfig,
-                managed: await configManagedWorkflowHarnessImport(),
-            })
-            : undefined;
+        const assuranceController = await createContinuousAssuranceController({
+            repository: resolve(directory, "..", ".."), directory, projectId: config.projectId, server: config.server,
+            apiKey: connection.apiKey, config, sourceSigner: () => keyRing.activeSigner(),
+        });
         actionWorker?.start();
         const gateway = await startCustomerOwnedCollectorGateway({
             client: new RemoteCollectorClient({ baseUrl: connection.server, projectId: connection.projectId, apiKey: connection.apiKey }),
@@ -592,19 +591,17 @@ export async function runCustomerGateway(options) {
                             fixtureReady: false,
                         } } : {}),
                 } } : {}),
-            ...(workflowHarnessConfig?.schemaVersion === MANAGED_WORKFLOW_HARNESS_SCHEMA && workflowHarness
-                ? { assuranceHarness: { status: () => workflowHarness.status() } }
-                : {}),
+            assuranceHarness: { status: () => assuranceController.status() },
         });
-        workflowHarness?.start();
+        assuranceController.start();
         process.stdout.write(`Witnora customer-owned Gateway listening on ${gateway.baseUrl}\n`);
         process.stdout.write(config.runtimeWorker
             ? "Runtime worker: READY. Approved exact configured actions execute automatically, then use the separate read-only probe and Hosted signed receipt.\n"
             : "Evidence ceiling: RECORDED. No exact target adapter and separate outcome probe are configured, so runtime writes remain fail-closed.\n");
-        if (workflowHarness)
-            process.stdout.write("Managed Workflow Harness: CONFIGURED. Only authority-ready Replay and no-write Shadow evaluations will be sent to the pinned customer evaluator.\n");
+        if (await assuranceController.status())
+            process.stdout.write("Managed Workflow Harness: ACTIVE. Approved task changes are detected and revalidated automatically.\n");
         for (const signal of ["SIGINT", "SIGTERM"]) {
-            process.once(signal, () => void Promise.allSettled([gateway.close(), ...(workflowHarness ? [workflowHarness.close()] : []), ...(sandboxFixture ? [sandboxFixture.close()] : [])]).finally(() => process.exit(0)));
+            process.once(signal, () => void Promise.allSettled([gateway.close(), assuranceController.close(), ...(sandboxFixture ? [sandboxFixture.close()] : [])]).finally(() => process.exit(0)));
         }
     }
     catch (error) {
@@ -727,6 +724,210 @@ export async function createConfiguredWorkflowHarness(input) {
         tick,
     };
 }
+function configSignedChangeManifestImport() {
+    return import(new URL("./vendor/onegent-runtime/signed-change-manifest.js", import.meta.url).href);
+}
+/**
+ * Reconciles the existing approved-task, Real Path, Manifest, and Autopilot
+ * contracts from inside the already-running Gateway. No new service or durable
+ * orchestration state is introduced; local config remains the recoverable cache.
+ */
+export async function createContinuousAssuranceController(input) {
+    const request = input.fetch ?? fetch;
+    const managed = input.managed ?? await configManagedWorkflowHarnessImport();
+    let harness;
+    let harnessFingerprint;
+    let timer;
+    let reconciling = false;
+    let closing = false;
+    let lastReportedError;
+    const replaceHarness = async (config) => {
+        const fingerprint = createHash("sha256").update(JSON.stringify(config)).digest("hex");
+        if (harness && fingerprint === harnessFingerprint)
+            return;
+        const next = await createConfiguredWorkflowHarness({
+            directory: input.directory,
+            projectId: input.projectId,
+            server: input.server,
+            apiKey: input.apiKey,
+            config,
+            managed,
+            evaluatorKit: input.evaluatorKit,
+            fetch: request,
+        });
+        next.start();
+        const previous = harness;
+        harness = next;
+        harnessFingerprint = fingerprint;
+        await previous?.close();
+    };
+    const workflowHarnessPath = join(input.directory, "workflow-harness.json");
+    if (await exists(workflowHarnessPath)) {
+        try {
+            await replaceHarness(parseManagedWorkflowHarnessConfig(await readFile(workflowHarnessPath, "utf8")));
+        }
+        catch (error) {
+            lastReportedError = message(error);
+            process.stderr.write(`Existing Assurance Harness will be repaired in the background: ${lastReportedError}\n`);
+        }
+    }
+    const reconcile = async () => {
+        if (closing || reconciling)
+            return;
+        reconciling = true;
+        try {
+            const activation = await activateRealPathIntegrations({
+                repository: input.repository,
+                server: input.server,
+                projectId: input.projectId,
+                apiKey: input.apiKey,
+                fetch: request,
+            });
+            if (activation.state === "READY_TO_START") {
+                const configured = await activateManagedWorkflowHarness({
+                    repository: input.repository,
+                    modulePath: activation.modulePath,
+                    realPathActivations: activation.activations,
+                    previousGeneratedModuleSha256: activation.previousGeneratedModuleSha256,
+                });
+                await replaceHarness(configured.config);
+            }
+            await publishCurrentChangeManifests({ ...input, fetch: request }, harness ? await harness.status() : undefined);
+            lastReportedError = undefined;
+        }
+        catch (error) {
+            const current = message(error).slice(0, 500);
+            if (current !== lastReportedError)
+                process.stderr.write(`Continuous Assurance reconciliation is waiting safely: ${current}\n`);
+            lastReportedError = current;
+        }
+        finally {
+            reconciling = false;
+        }
+    };
+    return {
+        start() {
+            if (timer || closing)
+                return;
+            void reconcile();
+            timer = setInterval(() => void reconcile(), input.intervalMs ?? 15_000);
+            timer.unref?.();
+        },
+        reconcile,
+        status: () => harness?.status() ?? Promise.resolve(undefined),
+        async close() {
+            closing = true;
+            if (timer)
+                clearInterval(timer);
+            timer = undefined;
+            await harness?.close();
+            harness = undefined;
+        },
+    };
+}
+async function publishCurrentChangeManifests(input, heartbeat) {
+    const base = input.server.replace(/\/$/, "");
+    const [activationResponse, manifestResponse] = await Promise.all([
+        input.fetch(`${base}/v1/projects/${encodeURIComponent(input.projectId)}/nora/activation-plan`, { headers: { authorization: `Bearer ${input.apiKey}` }, redirect: "error", signal: AbortSignal.timeout(10_000) }),
+        input.fetch(`${base}/v1/projects/${encodeURIComponent(input.projectId)}/change-manifests`, { headers: { authorization: `Bearer ${input.apiKey}` }, redirect: "error", signal: AbortSignal.timeout(10_000) }),
+    ]);
+    if (!activationResponse.ok)
+        throw new Error(`Assurance activation plan returned HTTP ${activationResponse.status}.`);
+    if (!manifestResponse.ok)
+        throw new Error(`Signed Change Manifest collection returned HTTP ${manifestResponse.status}.`);
+    const activation = await boundedResponseJson(activationResponse, 512 * 1024);
+    const collection = await boundedResponseJson(manifestResponse, 512 * 1024);
+    const targets = Array.isArray(activation.targets) ? activation.targets.filter(validActivationTarget) : [];
+    const manifests = Array.isArray(collection.manifests) ? collection.manifests.filter(validChangeManifestRecord) : [];
+    if (!targets.length)
+        return;
+    const packageDigest = await optionalFileDigest(join(input.repository, "package.json"));
+    const discoveryDigest = await optionalFileDigest(join(input.repository, "witnora.discovery.json"));
+    const policyRevision = createHash("sha256").update(JSON.stringify({ privacyMode: input.config.privacyMode, coverage: input.config.coverage })).digest("hex");
+    const explicitModelDigest = process.env.WITNORA_MODEL_DIGEST?.trim();
+    const explicitPromptWorkflowDigest = process.env.WITNORA_PROMPT_WORKFLOW_DIGEST?.trim();
+    const runtime = input.config.runtimeWorker;
+    const components = {
+        ...(explicitModelDigest && /^[a-f0-9]{64}$/.test(explicitModelDigest) ? { modelDigest: explicitModelDigest } : {}),
+        ...(validSha256(explicitPromptWorkflowDigest) ? { promptWorkflowDigest: explicitPromptWorkflowDigest } : packageDigest ? { promptWorkflowDigest: packageDigest } : {}),
+        ...(discoveryDigest ? { toolManifestDigest: discoveryDigest } : {}),
+        policyRevision,
+        ...(heartbeat ? { evaluatorIdentity: { id: "witnora-managed-evaluator", version: "1", digestSha256: heartbeat.evaluatorContractSha256 } } : {}),
+        ...(runtime ? { adapterIdentity: { id: runtime.adapterId, version: runtime.adapterVersion, digestSha256: runtime.adapterModuleSha256 } } : {}),
+    };
+    const signed = input.signedChangeManifest ?? await configSignedChangeManifestImport();
+    const unique = new Map();
+    const exactBindings = heartbeat?.realPathActivations ?? [];
+    for (const target of targets) {
+        for (const environment of target.environments) {
+            if (!exactBindings.some((binding) => binding.agentId === target.agentId && binding.environment === environment))
+                continue;
+            unique.set(`${target.agentId}:${environment}`, { agentId: target.agentId, agentVersion: target.currentAgentVersion, environment });
+        }
+    }
+    for (const target of unique.values()) {
+        const previous = manifests.find((manifest) => manifest.agentId === target.agentId && manifest.environment === target.environment);
+        if (previous && previous.agentVersion === target.agentVersion && sameManifestComponents(previous, components))
+            continue;
+        const observedAt = new Date().toISOString();
+        const payload = {
+            schemaVersion: "witnora.signed_change_manifest.v0.1",
+            manifestId: `gateway-${randomUUID()}`,
+            projectId: input.projectId,
+            agentId: target.agentId,
+            agentVersion: target.agentVersion,
+            environment: target.environment,
+            observedAt,
+            ...components,
+            ...(previous?.manifestDigestSha256 ? { previousManifestDigest: previous.manifestDigestSha256 } : {}),
+        };
+        const envelope = signed.createSignedChangeManifestEnvelope(payload, input.sourceSigner());
+        await signed.uploadSignedChangeManifest({ baseUrl: base, projectId: input.projectId, apiKey: input.apiKey, envelope, fetch: input.fetch });
+    }
+}
+function validActivationTarget(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const target = value;
+    return typeof target.agentId === "string" && typeof target.currentAgentVersion === "string"
+        && Array.isArray(target.environments) && target.environments.every((environment) => environment === "sandbox" || environment === "staging" || environment === "production");
+}
+function validChangeManifestRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const manifest = value;
+    return typeof manifest.agentId === "string" && typeof manifest.agentVersion === "string"
+        && (manifest.environment === "sandbox" || manifest.environment === "staging" || manifest.environment === "production")
+        && typeof manifest.manifestDigestSha256 === "string";
+}
+function sameManifestComponents(previous, next) {
+    return previous.modelDigest === next.modelDigest && previous.promptWorkflowDigest === next.promptWorkflowDigest
+        && previous.toolManifestDigest === next.toolManifestDigest && previous.policyRevision === next.policyRevision
+        && JSON.stringify(previous.evaluatorIdentity) === JSON.stringify(next.evaluatorIdentity)
+        && JSON.stringify(previous.adapterIdentity) === JSON.stringify(next.adapterIdentity);
+}
+async function optionalFileDigest(path) {
+    try {
+        return createHash("sha256").update(await readFile(path)).digest("hex");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+function validSha256(value) {
+    return Boolean(value && /^[a-f0-9]{64}$/.test(value));
+}
+async function boundedResponseJson(response, maxBytes) {
+    const text = await response.text();
+    if (Buffer.byteLength(text) > maxBytes)
+        throw new Error("Hosted Assurance response exceeded its size limit.");
+    const value = JSON.parse(text);
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("Hosted Assurance response is invalid.");
+    return value;
+}
 async function startManagedLocalEvaluator(directory, config, evaluatorKit) {
     const repository = resolve(directory, "..", "..");
     const modulePath = resolve(repository, config.evaluatorModulePath);
@@ -1165,6 +1366,8 @@ function parseConfig(raw) {
     }
     if (value.privacyMode !== "metadata_only")
         throw new Error("Gateway privacyMode must remain metadata_only.");
+    if (value.agentIdentity)
+        validateGatewayAgentIdentity(value.agentIdentity);
     if (!value.host || !Number.isSafeInteger(value.port) || Number(value.port) < 1 || Number(value.port) > 65_535)
         throw new Error("Gateway host and port are invalid.");
     if (value.runtimeWorker)
@@ -1175,6 +1378,13 @@ function parseConfig(raw) {
     }
     return config;
 }
+function validateGatewayAgentIdentity(value) {
+    for (const [key, item] of Object.entries(value)) {
+        if (typeof item !== "string" || item.trim().length === 0 || item.length > 200) {
+            throw new Error(`Gateway agentIdentity.${key} must be a non-empty string no longer than 200 characters.`);
+        }
+    }
+}
 export function parseManagedWorkflowHarnessConfig(raw) {
     const value = JSON.parse(raw);
     const workflowIds = value.workflowIds;
@@ -1459,7 +1669,11 @@ async function ed25519PublicKeyPem(handle) {
     return createPublicKey(key).export({ type: "spki", format: "pem" }).toString();
 }
 function recordedGatewayClient(config) {
-    return `import { readFile } from "node:fs/promises";\n\nconst baseUrl = "http://${config.host}:${config.port}";\nlet gatewayToken;\n\nasync function token() {\n  if (gatewayToken) return gatewayToken;\n  const secrets = JSON.parse(await readFile(new URL("./secrets.json", import.meta.url), "utf8"));\n  if (typeof secrets.gatewayToken !== "string" || secrets.gatewayToken.length < 32) {\n    throw new Error("Witnora local Gateway token is missing or invalid.");\n  }\n  gatewayToken = secrets.gatewayToken;\n  return gatewayToken;\n}\n\nasync function post(runId, operation, body) {\n  if (!/^[A-Za-z0-9._:-]+$/.test(runId)) throw new Error("Witnora runId contains unsupported characters.");\n  const response = await fetch(\`\${baseUrl}/v1/runs/\${encodeURIComponent(runId)}/\${operation}\`, {\n    method: "POST",\n    headers: { authorization: \`Bearer \${await token()}\`, "content-type": "application/json" },\n    body: JSON.stringify(body),\n  });\n  const result = await response.json().catch(() => ({}));\n  if (!response.ok) throw new Error(result.error ?? \`Witnora Gateway returned HTTP \${response.status}.\`);\n  return result;\n}\n\nexport const witnoraGateway = {\n  start(runId, metadata = {}) {\n    return post(runId, "start", { payload: metadata, idempotencyKey: "run-start" });\n  },\n  event(runId, type, metadata = {}, idempotencyKey = \`\${type}-\${crypto.randomUUID()}\`) {\n    return post(runId, "events", { type, payload: metadata, idempotencyKey });\n  },\n  complete(runId, metadata = {}) {\n    return post(runId, "complete", {\n      payload: metadata,\n      evidenceStrength: {\n        schemaVersion: "agentcert.evidence_strength.v0.1",\n        level: "recorded",\n        claims: [],\n        limitations: ["No write-credential mediation or independent outcome probe is configured."],\n      },\n      idempotencyKey: "run-complete",\n    });\n  },\n};\n`;
+    const defaultAgent = config.agentIdentity ? JSON.stringify(config.agentIdentity) : undefined;
+    const startPayload = defaultAgent
+        ? `const payload = { ...metadata, agent: metadata.agent ?? ${defaultAgent} };\n    return post(runId, "start", { payload, idempotencyKey: "run-start" });`
+        : `return post(runId, "start", { payload: metadata, idempotencyKey: "run-start" });`;
+    return `import { readFile } from "node:fs/promises";\n\nconst baseUrl = "http://${config.host}:${config.port}";\nlet gatewayToken;\n\nasync function token() {\n  if (gatewayToken) return gatewayToken;\n  const secrets = JSON.parse(await readFile(new URL("./secrets.json", import.meta.url), "utf8"));\n  if (typeof secrets.gatewayToken !== "string" || secrets.gatewayToken.length < 32) {\n    throw new Error("Witnora local Gateway token is missing or invalid.");\n  }\n  gatewayToken = secrets.gatewayToken;\n  return gatewayToken;\n}\n\nasync function post(runId, operation, body) {\n  if (!/^[A-Za-z0-9._:-]+$/.test(runId)) throw new Error("Witnora runId contains unsupported characters.");\n  const response = await fetch(\`\${baseUrl}/v1/runs/\${encodeURIComponent(runId)}/\${operation}\`, {\n    method: "POST",\n    headers: { authorization: \`Bearer \${await token()}\`, "content-type": "application/json" },\n    body: JSON.stringify(body),\n  });\n  const result = await response.json().catch(() => ({}));\n  if (!response.ok) throw new Error(result.error ?? \`Witnora Gateway returned HTTP \${response.status}.\`);\n  return result;\n}\n\nexport const witnoraGateway = {\n  start(runId, metadata = {}) {\n    ${startPayload}\n  },\n  event(runId, type, metadata = {}, idempotencyKey = \`\${type}-\${crypto.randomUUID()}\`) {\n    return post(runId, "events", { type, payload: metadata, idempotencyKey });\n  },\n  complete(runId, metadata = {}) {\n    return post(runId, "complete", {\n      payload: metadata,\n      evidenceStrength: {\n        schemaVersion: "agentcert.evidence_strength.v0.1",\n        level: "recorded",\n        claims: [],\n        limitations: ["No write-credential mediation or independent outcome probe is configured."],\n      },\n      idempotencyKey: "run-complete",\n    });\n  },\n};\n`;
 }
 async function writeExclusive(path, content, force, mode) {
     if (!force && await exists(path))

package/dist/internal/control-client/collector-gateway.d.ts

@@ -48,7 +48,7 @@ export interface CustomerOwnedCollectorGatewayOptions {
         };
     };
     assuranceHarness?: {
-        status(): Promise<AssuranceHarnessHeartbeat>;
+        status(): Promise<AssuranceHarnessHeartbeat | undefined>;
     };
     runtimeBinding?: RuntimeReadinessBinding;
     onRepairRequested?: (request: {

package/dist/internal/control-client/collector-gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collector-gateway.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/collector-gateway.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,qBAAqB,EAGrB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjJ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClH,SAAS,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;QAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnP,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3G,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjI;AAED,MAAM,WAAW,oCAAoC;IACnD,MAAM,EAAE,wBAAwB,CAAC;IACjC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE;QACb,KAAK,CAAC,KAAK,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACxF,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,cAAc,CAAC,EAAE;YAAE,cAAc,EAAE,oBAAoB,CAAC;YAAC,OAAO,EAAE,uBAAuB,CAAC;YAAC,YAAY,EAAE,OAAO,CAAC;YAAC,WAAW,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAC3I,CAAC;IACF,gBAAgB,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAAA;KAAE,CAAC;IACpE,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5G;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,KAAK,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,MAAM,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,kDAAkD,CAAC;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,gBAAgB,CAAC,EAAE,yBAAyB,CAAC;IAC7C,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CAClK;AAkBD,wBAAsB,kCAAkC,CAAC,OAAO,EAAE,oCAAoC,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAiO9I"}
+{"version":3,"file":"collector-gateway.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/collector-gateway.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,qBAAqB,EAGrB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjJ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClH,SAAS,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;QAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnP,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3G,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjI;AAED,MAAM,WAAW,oCAAoC;IACnD,MAAM,EAAE,wBAAwB,CAAC;IACjC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE;QACb,KAAK,CAAC,KAAK,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACxF,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,cAAc,CAAC,EAAE;YAAE,cAAc,EAAE,oBAAoB,CAAC;YAAC,OAAO,EAAE,uBAAuB,CAAC;YAAC,YAAY,EAAE,OAAO,CAAC;YAAC,WAAW,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAC3I,CAAC;IACF,gBAAgB,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAAA;KAAE,CAAC;IAChF,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5G;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,KAAK,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,MAAM,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,kDAAkD,CAAC;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,gBAAgB,CAAC,EAAE,yBAAyB,CAAC;IAC7C,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CAClK;AAkBD,wBAAsB,kCAAkC,CAAC,OAAO,EAAE,oCAAoC,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAkO9I"}

package/dist/internal/control-client/collector-gateway.js

@@ -76,6 +76,7 @@ export async function startCustomerOwnedCollectorGateway(options) {
         return { delivered, reconciled, pending };
     };
     const status = async () => {
+        const assuranceHarness = options.assuranceHarness ? await options.assuranceHarness.status() : undefined;
         let pendingRecordCount = 0;
         let lastAckSequence;
         for (const journal of journals.values()) {
@@ -94,7 +95,7 @@ export async function startCustomerOwnedCollectorGateway(options) {
             lastRemoteSuccessAt,
             lastRemoteError,
             ...(options.actionWorker ? { actionWorker: await options.actionWorker.status() } : {}),
-            ...(options.assuranceHarness ? { assuranceHarness: await options.assuranceHarness.status() } : {}),
+            ...(assuranceHarness ? { assuranceHarness } : {}),
             ...(monitoringControlFor() ? { monitoring: monitoringControlFor() } : {}),
         };
     };

package/dist/onboard.js

@@ -19,6 +19,12 @@ export async function runOnboard(options) {
     const server = normalizeServer(options.server ?? DEFAULT_WITNORA_SERVER);
     const repositoryPath = resolve(options.repository ?? process.cwd());
     const repository = await inspectRepository(repositoryPath, options.template);
+    const agentIdentity = {
+        externalId: repository.name,
+        name: humanizeAgentName(repository.name),
+        version: repository.version,
+        framework: frameworkForTemplate(repository.template),
+    };
     const connectionName = options.name ?? repository.slug;
     const token = await authorizeProjectConnection({
         projectId: options.projectId,
@@ -95,6 +101,24 @@ export async function runOnboard(options) {
     };
     let assuranceHarnessChanged = false;
     let continuousService;
+    const prepareRuntime = async (operation) => {
+        const delays = [250, 500, 1_000, 2_000, 4_000, 8_000];
+        let lastError;
+        for (let attempt = 0; attempt <= delays.length; attempt += 1) {
+            try {
+                return await operation();
+            }
+            catch (error) {
+                if (!(error instanceof RuntimeSetupNotReadyError))
+                    throw error;
+                lastError = error;
+                if (attempt === delays.length)
+                    break;
+                await (options.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds))))(delays[attempt]);
+            }
+        }
+        throw lastError;
+    };
     await reportInstall(requestFetch, server, token.projectId, token.apiKey, setupPlan.id, { status: "installing", attemptId });
     try {
         generatedFiles.push(...await generateRepositoryConfig(repositoryPath, repository.template, repository.name));
@@ -137,11 +161,12 @@ export async function runOnboard(options) {
         if (gatewayState.status === "absent") {
             let gateway;
             try {
-                gateway = await initializeCustomerGateway({
+                gateway = await prepareRuntime(() => initializeCustomerGateway({
                     projectId: token.projectId, server, repository: repositoryPath, authorization: token,
                     runtimeReferences: localRuntime.references,
+                    agentIdentity,
                     fetch: requestFetch, configHome: options.configHome, output,
-                });
+                }));
             }
             catch (error) {
                 if (!(error instanceof RuntimeSetupNotReadyError) || !localRuntime.references)
@@ -157,7 +182,7 @@ export async function runOnboard(options) {
                 await saveConnection(binding.connectionName, { server, projectId: token.projectId, apiKey: token.apiKey }, { configHome: options.configHome });
                 if (localRuntime.references) {
                     try {
-                        runtimeUpgrade = await upgradeCustomerGatewayRuntime({ repository: repositoryPath, authorization: token, runtimeReferences: localRuntime.references, configHome: options.configHome, fetch: requestFetch });
+                        runtimeUpgrade = await prepareRuntime(() => upgradeCustomerGatewayRuntime({ repository: repositoryPath, authorization: token, runtimeReferences: localRuntime.references, agentIdentity, configHome: options.configHome, fetch: requestFetch }));
                         if (runtimeUpgrade.changed) {
                             const stopped = await gatewayLifecycle.stop({ repository: repositoryPath, configHome: options.configHome, fetch: requestFetch });
                             if (stopped.state !== "STOPPED" || stopped.healthy)
@@ -187,11 +212,12 @@ export async function runOnboard(options) {
                 await assertGatewayStopped(requestFetch, binding.host, binding.port, binding.projectId, token.projectId);
                 gatewayMigration = await archiveGateway(gatewayState.directory, repositoryPath, binding.projectId);
                 output(`\nExisting Gateway belongs to project ${binding.projectId}; archived it at ${gatewayMigration.archiveDirectory}.\n`);
-                const gateway = await initializeCustomerGateway({
+                const gateway = await prepareRuntime(() => initializeCustomerGateway({
                     projectId: token.projectId, server, repository: repositoryPath, authorization: token,
                     runtimeReferences: localRuntime.references,
+                    agentIdentity,
                     fetch: requestFetch, configHome: options.configHome, output,
-                });
+                }));
                 generatedFiles.push(...gateway.generatedFiles);
             }
         }
@@ -252,7 +278,7 @@ export async function runOnboard(options) {
             : { state: "RECORDED_ONLY", checkedAt: new Date().toISOString(), limitations: [runtimeLimitation ?? "The local sandbox Runtime worker has not established exact adapter, probe, source-key, identity, mandate, and readiness bindings."] };
         await reportInstall(requestFetch, server, token.projectId, token.apiKey, setupPlan.id, {
             status: "verified", attemptId, generatedFiles: relativeGeneratedFiles(repositoryPath, generatedFiles), runtimeReadiness,
-            connectedAgent: { externalId: repository.name, name: humanizeAgentName(repository.name), version: repository.version, framework: frameworkForTemplate(repository.template) },
+            connectedAgent: agentIdentity,
             ...(runtimeBinding ? { runtimeBinding } : {}),
         });
         output(`\nWitnora Setup Autopilot completed for ${repository.name}.\n`);

package/dist/real-path-activation.js

@@ -11,11 +11,25 @@ export async function activateRealPathIntegrations(options) {
     if (!response.ok)
         throw new Error(`Could not load approved real-path integrations (${response.status}).`);
     const body = await boundedJson(response);
-    const approved = Array.isArray(body.integrations) ? body.integrations.map(parsePlan).filter((plan) => plan.status === "READY_TO_ACTIVATE") : [];
+    const approved = Array.isArray(body.integrations) ? body.integrations.map(parsePlan).filter((plan) => plan.status === "READY_TO_ACTIVATE" || plan.status === "HARNESS_ACTIVE") : [];
     const plans = approved.filter((plan) => ["STRIPE_REFUND", "SHOPIFY_DISPUTE", "ZENDESK_TICKET", "SALESFORCE_RECORD", "HUBSPOT_CRM_RECORD", "POSTGRES_RECORD"].includes(plan.generated.providerPackId) && plan.environment === "sandbox" && plan.customerSummary.evaluationMode === "SHADOW");
     if (!plans.length)
         return { state: "NOT_CONFIGURED", created: false, activations: [], generatedFiles: [], rollback: async () => undefined };
     const environment = options.env ?? process.env;
+    const modulePath = join(repository, "witnora.assurance-harness.mjs");
+    const manifestPath = join(repository, ".witnora", "gateway", "real-path-activations.json");
+    const source = generatedProviderHarness(plans);
+    const moduleDigestSha256 = sha(source);
+    const current = await readFile(modulePath, "utf8").catch((error) => error.code === "ENOENT" ? undefined : Promise.reject(error));
+    const priorSource = await readFile(manifestPath, "utf8").catch((error) => error.code === "ENOENT" ? undefined : Promise.reject(error));
+    const prior = priorSource === undefined ? undefined : JSON.parse(priorSource);
+    const cachedActivations = prior?.projectId === options.projectId && prior.moduleDigestSha256 === moduleDigestSha256 && current === source
+        && Array.isArray(prior.activations) && sameActivationPlans(plans, prior.activations) ? structuredClone(prior.activations) : undefined;
+    if (cachedActivations) {
+        for (const plan of plans)
+            await persistProviderCredential(repository, plan, environment);
+        return { state: "READY_TO_START", created: false, modulePath: "witnora.assurance-harness.mjs", activations: cachedActivations, generatedFiles: [], previousGeneratedModuleSha256: moduleDigestSha256, rollback: async () => undefined };
+    }
     const activations = [];
     const scenarios = [];
     for (const plan of plans) {
@@ -25,15 +39,8 @@ export async function activateRealPathIntegrations(options) {
         activations.push({ integrationId: plan.id, integrationDigestSha256: plan.digestSha256, taskContractId: plan.taskContractId, taskContractDigestSha256: plan.taskContractDigestSha256, agentId: plan.subject.agentId, agentVersion: plan.subject.agentVersion, environment: plan.environment, providerPackId: plan.generated.providerPackId, providerContractDigestSha256: plan.generated.providerContractDigestSha256, actionPathIds: plan.generated.actionPathBindings.map((item) => item.actionPathId), acceptance });
         scenarios.push({ plan, value: [preflight.scenario] });
     }
-    const modulePath = join(repository, "witnora.assurance-harness.mjs");
-    const manifestPath = join(repository, ".witnora", "gateway", "real-path-activations.json");
-    const source = generatedProviderHarness(plans);
-    const moduleDigestSha256 = sha(source);
     let created = false;
     const generatedFiles = [];
-    const current = await readFile(modulePath, "utf8").catch((error) => error.code === "ENOENT" ? undefined : Promise.reject(error));
-    const priorSource = await readFile(manifestPath, "utf8").catch((error) => error.code === "ENOENT" ? undefined : Promise.reject(error));
-    const prior = priorSource === undefined ? undefined : JSON.parse(priorSource);
     const previousGeneratedModuleSha256 = current !== undefined && sha(current) === prior?.moduleDigestSha256 ? prior.moduleDigestSha256 : undefined;
     if (current === undefined) {
         await writeFile(modulePath, source, { encoding: "utf8", mode: 0o600, flag: "wx" });
@@ -253,16 +260,30 @@ async function persistProviderCredential(repository, plan, environment) {
         return;
     const name = providerCredentialEnvironmentName(plan.generated.providerPackId);
     const value = environment[name];
-    if (!value)
-        throw new Error(`${plan.generated.providerPackId} activation requires its read-only credential in the customer environment.`);
     const directory = join(repository, ".witnora", "provider-credentials");
     const target = join(directory, `${plan.id}.secret`);
-    const temporary = `${target}.${randomUUID()}.tmp`;
+    const current = await readFile(target, "utf8").catch((error) => error.code === "ENOENT" ? undefined : Promise.reject(error));
+    if (!value) {
+        if (current !== undefined)
+            return;
+        throw new Error(`${plan.generated.providerPackId} activation requires its read-only credential in the customer environment.`);
+    }
+    if (current === value)
+        return;
     await mkdir(directory, { recursive: true });
     await writeFile(join(directory, ".gitignore"), "*\n!.gitignore\n", { encoding: "utf8", mode: 0o600, flag: "wx" }).catch((error) => { if (error.code !== "EEXIST")
         throw error; });
-    await writeFile(temporary, value, { encoding: "utf8", mode: 0o600, flag: "wx" });
-    await rename(temporary, target);
+    await writeFile(target, value, { encoding: "utf8", mode: 0o600 });
+}
+function sameActivationPlans(plans, activations) {
+    if (plans.length !== activations.length)
+        return false;
+    return plans.every((plan) => activations.some((activation) => activation.integrationId === plan.id && activation.integrationDigestSha256 === plan.digestSha256
+        && activation.taskContractId === plan.taskContractId && activation.taskContractDigestSha256 === plan.taskContractDigestSha256
+        && activation.agentId === plan.subject.agentId && activation.agentVersion === plan.subject.agentVersion && activation.environment === plan.environment
+        && activation.providerPackId === plan.generated.providerPackId && activation.providerContractDigestSha256 === plan.generated.providerContractDigestSha256
+        && canonical([...activation.actionPathIds].sort()) === canonical(plan.generated.actionPathBindings.map((item) => item.actionPathId).sort())
+        && activation.acceptance?.kind === "READ_ONLY_PROVIDER_PREFLIGHT" && activation.acceptance.productionWrites === 0 && digest(activation.acceptance.observationDigestSha256)));
 }
 function providerCredentialEnvironmentName(packId) {
     if (packId === "STRIPE_REFUND")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.18.10",
+  "version": "0.18.12",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",