witnora 0.18.16 → 0.19.0

package/README.md

@@ -66,6 +66,30 @@ npx witnora@latest gateway restart
 npx witnora@latest gateway stop
 ```
 
+When the approved setup contains exactly one sandbox Task/action path, the same
+onboarding command also writes `.witnora/gateway/HTTP_ACTION.md`. The Agent can
+then call one ordinary HTTP endpoint instead of importing the generated client:
+
+```http
+POST http://127.0.0.1:8787/v1/http-actions/cancel-order
+Authorization: Bearer <action-scoped token>
+Idempotency-Key: <stable external request id>
+Content-Type: application/json
+
+{
+  "resourceId": "order-42",
+  "status": "CANCELLED"
+}
+```
+
+The response is a Hosted Action in `PENDING_APPROVAL`, not a premature success
+claim. The existing approval, idempotent Runtime worker, separate read-only
+Probe, Receipt, and Runtime Watch continue on the same path. The action token is
+separate from the full Gateway token and stays in ignored customer-owned data.
+For a cloud Agent, the customer exposes only this path through its HTTPS ingress
+or private network. This generated endpoint is limited to the current sandbox
+Task/action path; it does not create a production Provider or broader authority.
+
 Initialization writes a reusable `.witnora/gateway/client.mjs`. Import its
 `witnoraGateway.start`, `event`, and `complete` methods at one existing sandbox
 workflow boundary. The generated README contains the exact code and privacy

package/dist/gateway.js

@@ -1,4 +1,4 @@
-import { createHash, createPrivateKey, createPublicKey, randomBytes, randomUUID } from "node:crypto";
+import { createHash, createPrivateKey, createPublicKey, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { spawn } from "node:child_process";
 import { closeSync, openSync } from "node:fs";
 import { access, chmod, mkdir, readFile, realpath, rename, rm, writeFile } from "node:fs/promises";
@@ -214,15 +214,21 @@ export async function ensureCustomerGatewayPortAvailable(options) {
     const configPath = join(directory, "gateway.json");
     const clientPath = join(directory, "client.mjs");
     const readmePath = join(directory, "README.md");
+    const httpActionPath = join(directory, "http-action.json");
+    const httpActionGuidePath = join(directory, "HTTP_ACTION.md");
     const [configRaw, clientRaw, readmeRaw] = await Promise.all([
         readFile(configPath, "utf8"), readFile(clientPath, "utf8"), readFile(readmePath, "utf8"),
     ]);
     const current = parseConfig(configRaw);
+    const httpActionRaw = await readFile(httpActionPath, "utf8").catch((error) => error.code === "ENOENT" ? undefined : Promise.reject(error));
+    const httpAction = httpActionRaw ? parseCustomerHttpActionConfig(httpActionRaw) : undefined;
+    const httpActionGuideRaw = httpAction ? await readFile(httpActionGuidePath, "utf8") : undefined;
     const health = await localCollector(current.host, current.port, options.fetch ?? fetch);
     if (health === current.collectorId || (!health && await canListen(current.host, current.port))) {
         return { changed: false, port: current.port };
     }
-    if (clientRaw !== gatewayClient(current) || readmeRaw !== gatewayReadme(current)) {
+    if (clientRaw !== gatewayClient(current) || readmeRaw !== gatewayReadme(current)
+        || (httpAction && httpActionGuideRaw !== customerHttpActionGuide(current, httpAction))) {
         throw new Error(`Gateway port ${current.port} is occupied, and generated Gateway files were modified; refusing to rewrite customer files.`);
     }
     const excluded = new Set([current.port]);
@@ -238,10 +244,13 @@ export async function ensureCustomerGatewayPortAvailable(options) {
         await atomicWrite(configPath, `${JSON.stringify(next, null, 2)}\n`, 0o644);
         await atomicWrite(clientPath, gatewayClient(next), 0o644);
         await atomicWrite(readmePath, gatewayReadme(next), 0o644);
+        if (httpAction)
+            await atomicWrite(httpActionGuidePath, customerHttpActionGuide(next, httpAction), 0o644);
     }
     catch (error) {
         await Promise.all([
             atomicWrite(configPath, configRaw, 0o644), atomicWrite(clientPath, clientRaw, 0o644), atomicWrite(readmePath, readmeRaw, 0o644),
+            ...(httpActionGuideRaw ? [atomicWrite(httpActionGuidePath, httpActionGuideRaw, 0o644)] : []),
         ]).catch(() => undefined);
         throw error;
     }
@@ -477,6 +486,20 @@ export async function doctorCustomerGateway(options) {
                 checks.push({ id: "runtime_configuration", status: "FAIL", message: message(error) });
             }
         }
+        if (await exists(join(directory, "http-action.json"))) {
+            try {
+                const configured = await loadConfiguredCustomerHttpAction(directory, config);
+                if (!configured)
+                    throw new Error("HTTP Action configuration disappeared during validation.");
+                checks.push({ id: "http_action", status: "PASS", message: `POST ${configured.action.path} is bound to the exact sandbox Task/action path with a separate action-scoped token.` });
+            }
+            catch (error) {
+                checks.push({ id: "http_action", status: "FAIL", message: message(error) });
+            }
+        }
+        else {
+            checks.push({ id: "http_action", status: "WARN", message: "No exact single sandbox Task/action path is available for the simple HTTP Action endpoint." });
+        }
         try {
             const health = await gatewayHealth(`http://${config.host}:${config.port}`, options.fetch ?? fetch, config.runtimeWorker);
             if (!health)
@@ -516,6 +539,7 @@ export async function runCustomerGateway(options) {
     const directory = resolve(options.repository ?? process.cwd(), options.dir ?? ".witnora/gateway");
     const config = parseConfig(await readFile(join(directory, "gateway.json"), "utf8"));
     const secrets = parseSecrets(await readFile(join(directory, "secrets.json"), "utf8"));
+    const httpAction = await loadConfiguredCustomerHttpAction(directory, config);
     const connection = await loadConnection(config.connectionName, { configHome: options.configHome });
     if (!connection || connection.projectId !== config.projectId || connection.server !== config.server) {
         throw new Error("The saved Gateway credential does not match gateway.json. Run gateway init again.");
@@ -595,6 +619,7 @@ export async function runCustomerGateway(options) {
                         } } : {}),
                 } } : {}),
             assuranceHarness: { status: () => assuranceController.status() },
+            ...(httpAction ? { httpActionIngress: createCustomerHttpActionIngress(config, httpAction.action, httpAction.token) } : {}),
         });
         assuranceController.start();
         process.stdout.write(`Witnora customer-owned Gateway listening on ${gateway.baseUrl}\n`);
@@ -603,6 +628,8 @@ export async function runCustomerGateway(options) {
             : "Evidence ceiling: RECORDED. No exact target adapter and separate outcome probe are configured, so runtime writes remain fail-closed.\n");
         if (await assuranceController.status())
             process.stdout.write("Managed Workflow Harness: ACTIVE. Approved task changes are detected and revalidated automatically.\n");
+        if (httpAction)
+            process.stdout.write(`HTTP Action: READY at ${gateway.baseUrl}${httpAction.action.path} (sandbox Task/action path only).\n`);
         for (const signal of ["SIGINT", "SIGTERM"]) {
             process.once(signal, () => void Promise.allSettled([gateway.close(), assuranceController.close(), ...(sandboxFixture ? [sandboxFixture.close()] : [])]).finally(() => process.exit(0)));
         }
@@ -1411,6 +1438,202 @@ export function renderGatewayDoctor(result) {
 export function isGatewayDoctorReady(result) {
     return result.overall === "READY_TO_RECORD" || result.overall === "READY_FOR_RUNTIME";
 }
+async function loadConfiguredCustomerHttpAction(directory, gateway) {
+    const configPath = join(directory, "http-action.json");
+    let action;
+    try {
+        action = parseCustomerHttpActionConfig(await readFile(configPath, "utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+    if (gateway.runtimeWorker?.adapterId !== LOCAL_SANDBOX_ADAPTER_ID)
+        throw new Error("HTTP Action is configured without the generated localhost sandbox Runtime.");
+    const harness = parseManagedWorkflowHarnessConfig(await readFile(join(directory, "workflow-harness.json"), "utf8"));
+    const expected = harness.schemaVersion === MANAGED_WORKFLOW_HARNESS_SCHEMA
+        ? createCustomerHttpActionConfig(harness.realPathActivations ?? [])
+        : undefined;
+    if (!expected || JSON.stringify(expected) !== JSON.stringify(action)) {
+        throw new Error("HTTP Action binding does not match the active exact sandbox Task/action path.");
+    }
+    const token = (await readFile(customerHttpActionTokenPath(directory, action.id), "utf8")).trim();
+    if (token.length < 32)
+        throw new Error("Customer HTTP Action token is missing or invalid.");
+    return { action, token };
+}
+export function createCustomerHttpActionConfig(activations) {
+    if (activations.length !== 1)
+        return undefined;
+    const activation = activations[0];
+    if (activation.environment !== "sandbox" || activation.actionPathIds.length !== 1)
+        return undefined;
+    const actionPathId = activation.actionPathIds[0];
+    const config = {
+        schemaVersion: "witnora.customer_http_action.v0.1",
+        id: actionPathId,
+        method: "POST",
+        path: `/v1/http-actions/${actionPathId}`,
+        environment: "sandbox",
+        integrationId: activation.integrationId,
+        integrationDigestSha256: activation.integrationDigestSha256,
+        taskContractId: activation.taskContractId,
+        taskContractDigestSha256: activation.taskContractDigestSha256,
+        actionPathId,
+        agentId: activation.agentId,
+        agentVersion: activation.agentVersion,
+        defaultStatus: "SUBMITTED",
+    };
+    validateCustomerHttpActionConfig(config);
+    return config;
+}
+export async function configureCustomerHttpAction(options) {
+    const directory = resolve(options.repository ?? process.cwd(), options.dir ?? ".witnora/gateway");
+    const gateway = parseConfig(await readFile(join(directory, "gateway.json"), "utf8"));
+    const action = createCustomerHttpActionConfig(options.activations);
+    if (!action || gateway.runtimeWorker?.adapterId !== LOCAL_SANDBOX_ADAPTER_ID) {
+        const configPath = join(directory, "http-action.json");
+        if (!await exists(configPath))
+            return { state: "NOT_CONFIGURED", changed: false, generatedFiles: [], rollback: async () => undefined };
+        const currentRaw = await readFile(configPath, "utf8");
+        const current = parseCustomerHttpActionConfig(currentRaw);
+        const guidePath = join(directory, "HTTP_ACTION.md");
+        const guideRaw = await readFile(guidePath, "utf8");
+        if (guideRaw !== customerHttpActionGuide(gateway, current)) {
+            throw new Error("Existing HTTP Action files are customer-modified; refusing to disable them automatically.");
+        }
+        await Promise.all([rm(configPath, { force: true }), rm(guidePath, { force: true })]);
+        return {
+            state: "NOT_CONFIGURED",
+            changed: true,
+            generatedFiles: [],
+            rollback: async () => {
+                await Promise.all([
+                    writeFile(configPath, currentRaw, { encoding: "utf8", mode: 0o644 }),
+                    writeFile(guidePath, guideRaw, { encoding: "utf8", mode: 0o644 }),
+                ]);
+            },
+        };
+    }
+    const configPath = join(directory, "http-action.json");
+    const guidePath = join(directory, "HTTP_ACTION.md");
+    const tokenPath = customerHttpActionTokenPath(directory, action.id);
+    const serialized = `${JSON.stringify(action, null, 2)}\n`;
+    const guide = customerHttpActionGuide(gateway, action);
+    const created = [];
+    const rollback = async () => {
+        for (const path of [...created].reverse())
+            await rm(path, { force: true }).catch(() => undefined);
+    };
+    try {
+        if (await exists(configPath)) {
+            const current = await readFile(configPath, "utf8");
+            parseCustomerHttpActionConfig(current);
+            if (current !== serialized)
+                throw new Error("Existing http-action.json differs from the exact generated sandbox Task/action binding; refusing to overwrite it.");
+        }
+        else {
+            await writeExclusive(configPath, serialized, false, 0o644);
+            created.push(configPath);
+        }
+        if (await exists(guidePath)) {
+            if (await readFile(guidePath, "utf8") !== guide)
+                throw new Error("Existing HTTP_ACTION.md differs from the generated integration guide; refusing to overwrite it.");
+        }
+        else {
+            await writeExclusive(guidePath, guide, false, 0o644);
+            created.push(guidePath);
+        }
+        if (!await exists(tokenPath)) {
+            await writeExclusive(tokenPath, `${randomBytes(32).toString("base64url")}\n`, false, 0o600);
+            created.push(tokenPath);
+        }
+        else {
+            const token = (await readFile(tokenPath, "utf8")).trim();
+            if (token.length < 32)
+                throw new Error("Existing customer HTTP Action token is invalid.");
+        }
+    }
+    catch (error) {
+        await rollback();
+        throw error;
+    }
+    return { state: "READY", changed: created.length > 0, action, generatedFiles: created, rollback };
+}
+export function parseCustomerHttpActionConfig(raw) {
+    const value = JSON.parse(raw);
+    validateCustomerHttpActionConfig(value);
+    return value;
+}
+export function createCustomerHttpActionIngress(config, action, token) {
+    const runtime = config.runtimeWorker;
+    if (!action || runtime?.adapterId !== LOCAL_SANDBOX_ADAPTER_ID || !runtime.mandateId || !runtime.sandboxPrincipalId || !runtime.sandboxOrigin) {
+        throw new Error("Customer HTTP Action requires one generated localhost sandbox Runtime binding.");
+    }
+    if (typeof token !== "string" || token.length < 32)
+        throw new Error("Customer HTTP Action token must contain at least 32 characters.");
+    const agentBuildId = `witnora-http-action:${action.id}@1.0.0`;
+    const agentBuildDigest = createHash("sha256").update(agentBuildId).digest("hex");
+    return {
+        async resolve({ actionId, authorization, idempotencyKey, body, reject }) {
+            const suppliedToken = authorization?.replace(/^Bearer\s+/i, "") ?? "";
+            if (!secretEquals(suppliedToken, token))
+                reject(401, "HTTP Action authentication failed.");
+            if (actionId !== action.id)
+                reject(404, "HTTP Action was not found.");
+            const externalId = typeof idempotencyKey === "string" && /^[A-Za-z0-9._:-]{1,160}$/.test(idempotencyKey)
+                ? idempotencyKey
+                : reject(400, "Idempotency-Key is required and must use URL-safe identifier characters.");
+            const unexpected = Object.keys(body).filter((field) => field !== "resourceId" && field !== "status");
+            if (unexpected.length > 0)
+                reject(400, `HTTP Action body contains unsupported field(s): ${unexpected.join(", ")}.`);
+            const resourceId = typeof body.resourceId === "string" && /^[A-Za-z0-9._:-]{1,160}$/.test(body.resourceId)
+                ? body.resourceId
+                : reject(400, "resourceId is required and must use URL-safe identifier characters.");
+            const status = body.status === undefined
+                ? action.defaultStatus
+                : typeof body.status === "string" && /^[A-Za-z0-9._:-]{1,100}$/.test(body.status)
+                    ? body.status
+                    : reject(400, "status must use URL-safe identifier characters.");
+            const approvedParameters = { resourceId, status };
+            return {
+                idempotencyKey: externalId,
+                proposal: {
+                    externalId,
+                    agentId: action.agentId,
+                    principal: { id: runtime.sandboxPrincipalId, version: "sandbox-v1" },
+                    actionType: "UPDATE",
+                    targetSystem: "WitnoraLocalSandbox",
+                    requestedPermissions: [],
+                    sensitive: true,
+                    expectedState: approvedParameters,
+                    businessTaskBinding: {
+                        taskContractId: action.taskContractId,
+                        taskContractDigestSha256: action.taskContractDigestSha256,
+                        actionPathId: action.actionPathId,
+                        environment: "sandbox",
+                        realPathIntegrationId: action.integrationId,
+                        realPathIntegrationDigestSha256: action.integrationDigestSha256,
+                    },
+                    mandateId: runtime.mandateId,
+                    requireMandate: true,
+                    executionIntent: {
+                        adapterId: LOCAL_SANDBOX_ADAPTER_ID,
+                        adapterVersionConstraint: `^${LOCAL_SANDBOX_ADAPTER_VERSION}`,
+                        allowedOrigins: [runtime.sandboxOrigin],
+                        approvedParameters,
+                        outcomePredicate: { type: "state_subset", expected: approvedParameters },
+                        agentBuildId,
+                        agentBuildDigest,
+                        allowedOperation: "UPDATE",
+                        allowedResource: `mock-state/${resourceId}`,
+                    },
+                },
+            };
+        },
+    };
+}
 function parseConfig(raw) {
     const value = JSON.parse(raw);
     if (value.schemaVersion !== CONFIG_SCHEMA || !value.projectId || !value.server || !value.connectionName || !value.collectorId) {
@@ -1430,6 +1653,16 @@ function parseConfig(raw) {
     }
     return config;
 }
+function validateCustomerHttpActionConfig(value) {
+    if (value.schemaVersion !== "witnora.customer_http_action.v0.1" || value.method !== "POST" || value.environment !== "sandbox"
+        || !/^[A-Za-z0-9._:-]{1,160}$/.test(value.id) || value.path !== `/v1/http-actions/${value.id}`
+        || !/^[A-Za-z0-9._:-]{1,200}$/.test(value.integrationId) || !validDigest(value.integrationDigestSha256)
+        || !/^[A-Za-z0-9._:-]{1,200}$/.test(value.taskContractId) || !validDigest(value.taskContractDigestSha256)
+        || value.actionPathId !== value.id || !/^[A-Za-z0-9._:-]{1,200}$/.test(value.agentId)
+        || typeof value.agentVersion !== "string" || !value.agentVersion || !/^[A-Za-z0-9._:-]{1,100}$/.test(value.defaultStatus)) {
+        throw new Error("http-action.json must bind one exact sandbox Task/action path.");
+    }
+}
 function validateGatewayAgentIdentity(value) {
     for (const [key, item] of Object.entries(value)) {
         if (typeof item !== "string" || item.trim().length === 0 || item.length > 200) {
@@ -1652,6 +1885,42 @@ function gatewayReadme(config) {
         : "This reference process creates source-signed, durable **RECORDED** evidence. It does not claim complete mediation. **ENFORCED** requires the target write credential to be removed from the Agent and placed behind a controlled execution adapter. **OUTCOME VERIFIED** requires a separate read-only credential and independent probe.";
     return `# Witnora customer-owned Gateway\n\nThis directory configures a metadata-only Gateway for project \`${config.projectId}\`. The Setup Autopilot starts it in the background after browser authorization.\n\n## Operations\n\n\`\`\`bash\nnpx witnora@latest gateway status\nnpx witnora@latest gateway logs\nnpx witnora@latest gateway restart\nnpx witnora@latest gateway stop\n\`\`\`\n\n\`gateway run\` remains available as a foreground debugging command. In the Agent repository, import the generated client at one meaningful sandbox workflow boundary:\n\n\`\`\`js\nimport { randomUUID } from "node:crypto";\nimport { witnoraGateway } from "./.witnora/gateway/client.mjs";\n\nconst runId = randomUUID();\nawait witnoraGateway.start(runId, { workflow: "sandbox-workflow" });\ntry {\n  // Run the existing customer workflow here. Do not add raw inputs or outputs.\n  await witnoraGateway.event(runId, "workflow.step.completed", { step: "meaningful-boundary" });\n  await witnoraGateway.complete(runId, { status: "completed" });\n} catch (error) {\n  await witnoraGateway.event(runId, "workflow.failed", { errorType: error?.name ?? "Error" });\n  await witnoraGateway.complete(runId, { status: "failed" });\n  throw error;\n}\n\`\`\`\n\nThe generated client reads only the local ignored Gateway token and sends metadata to \`http://${config.host}:${config.port}\`. The Hosted API key and source-signing key stay in the Gateway process. Do not commit \`secrets.json\`, \`data/\`, or \`runtime/\`.\n\n${assuranceBoundary}\n`;
 }
+function customerHttpActionTokenPath(directory, actionId) {
+    return join(directory, "data", "http-actions", `${actionId}.token`);
+}
+function customerHttpActionGuide(gateway, action) {
+    const endpoint = `http://${gateway.host}:${gateway.port}${action.path}`;
+    return [
+        "# Witnora HTTP Action — sandbox",
+        "",
+        `This is the smallest integration surface for the exact \`${action.actionPathId}\` sandbox Task/action path. The Agent sends one ordinary HTTP request; Witnora holds it for authorization, executes it idempotently inside the customer-owned Gateway, verifies the result through the separate read-only Probe, and preserves the Receipt.`,
+        "",
+        "## Request",
+        "",
+        "```http",
+        `POST ${endpoint}`,
+        "Authorization: Bearer <action-scoped token>",
+        "Idempotency-Key: <stable external request id>",
+        "Content-Type: application/json",
+        "",
+        "{",
+        '  "resourceId": "order-42",',
+        '  "status": "CANCELLED"',
+        "}",
+        "```",
+        "",
+        `The action-scoped token is stored locally at \`data/http-actions/${action.id}.token\`. Put that value in the calling Agent platform's secret store; never put the Gateway token in the Agent platform.`,
+        "",
+        "## Expected response",
+        "",
+        "The first response is the Hosted Action in `PENDING_APPROVAL`. It is not a claim that the business outcome already happened. After the exact action is approved, the existing Runtime worker performs at most one authorized write, the independent Probe reads the resulting sandbox state, and Witnora creates the Receipt. Reusing the same `Idempotency-Key` with the same body returns the same Action; changing the body under that key fails closed.",
+        "",
+        "Only `resourceId` and `status` are accepted. This endpoint covers the current sandbox Task/action path only. It does not add a production Provider, broader permissions, navigation, or a higher evidence grade.",
+        "",
+        "For a cloud-hosted Agent, expose only this action path through the customer's authenticated HTTPS ingress or private network. Do not expose the full Gateway API or `gatewayToken`.",
+        "",
+    ].join("\n");
+}
 function gatewayConfigDigest(config) {
     const runtimeWorker = config.runtimeWorker ? { ...config.runtimeWorker, configDigestSha256: undefined } : undefined;
     return createHash("sha256").update(JSON.stringify(canonical({ ...config, runtimeWorker }))).digest("hex");
@@ -1672,6 +1941,11 @@ function activeWindow(validFrom, expiresAt, now) {
     return Number.isFinite(starts) && Number.isFinite(expires) && starts <= now && expires > now;
 }
 function validDigest(value) { return /^[a-f0-9]{64}$/.test(value); }
+function secretEquals(leftValue, rightValue) {
+    const left = Buffer.from(leftValue);
+    const right = Buffer.from(rightValue);
+    return left.length === right.length && timingSafeEqual(left, right);
+}
 function localSandboxOrigin(value) {
     try {
         if (!value)

package/dist/internal/control-client/collector-gateway.d.ts

@@ -20,6 +20,18 @@ export interface RemoteCollectorTransport {
     getAction(actionId: string): Promise<Record<string, unknown>>;
     issueExecutionGrant(actionId: string, grant: Record<string, unknown>, idempotencyKey: string): Promise<Record<string, unknown>>;
 }
+export interface CustomerHttpActionIngress {
+    resolve(input: {
+        actionId: string;
+        authorization?: string;
+        idempotencyKey?: string;
+        body: Record<string, unknown>;
+        reject(status: number, message: string): never;
+    }): Promise<{
+        proposal: Record<string, unknown>;
+        idempotencyKey: string;
+    }>;
+}
 export interface CustomerOwnedCollectorGatewayOptions {
     client: RemoteCollectorTransport;
     keyRing: CustomerSourceKeyRing;
@@ -55,6 +67,7 @@ export interface CustomerOwnedCollectorGatewayOptions {
         requestId: string;
         action: "RESTART_AND_VERIFY";
     }) => void | Promise<void>;
+    httpActionIngress?: CustomerHttpActionIngress;
 }
 export interface CustomerOwnedCollectorGateway {
     baseUrl: string;

package/dist/internal/control-client/collector-gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collector-gateway.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/collector-gateway.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,qBAAqB,EAGrB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjJ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClH,SAAS,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;QAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnP,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3G,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjI;AAED,MAAM,WAAW,oCAAoC;IACnD,MAAM,EAAE,wBAAwB,CAAC;IACjC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE;QACb,KAAK,CAAC,KAAK,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACxF,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,cAAc,CAAC,EAAE;YAAE,cAAc,EAAE,oBAAoB,CAAC;YAAC,OAAO,EAAE,uBAAuB,CAAC;YAAC,YAAY,EAAE,OAAO,CAAC;YAAC,WAAW,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAC3I,CAAC;IACF,gBAAgB,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAAA;KAAE,CAAC;IAChF,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5G;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,KAAK,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,MAAM,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,kDAAkD,CAAC;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,gBAAgB,CAAC,EAAE,yBAAyB,CAAC;IAC7C,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CAClK;AAkBD,wBAAsB,kCAAkC,CAAC,OAAO,EAAE,oCAAoC,GAAG,OAAO,CAAC,6BAA6B,CAAC,CA0O9I"}
+{"version":3,"file":"collector-gateway.d.ts","sourceRoot":"","sources":["../../../../agentcert-sdk/src/collector-gateway.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,qBAAqB,EAGrB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjJ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClH,SAAS,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;QAAC,gBAAgB,CAAC,EAAE,yBAAyB,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnP,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3G,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjI;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,KAAK,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;KAChD,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5E;AAED,MAAM,WAAW,oCAAoC;IACnD,MAAM,EAAE,wBAAwB,CAAC;IACjC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE;QACb,KAAK,CAAC,KAAK,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACxF,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,cAAc,CAAC,EAAE;YAAE,cAAc,EAAE,oBAAoB,CAAC;YAAC,OAAO,EAAE,uBAAuB,CAAC;YAAC,YAAY,EAAE,OAAO,CAAC;YAAC,WAAW,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;KAC3I,CAAC;IACF,gBAAgB,CAAC,EAAE;QAAE,MAAM,IAAI,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAAA;KAAE,CAAC;IAChF,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3G,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;CAC/C;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,KAAK,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,MAAM,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,kDAAkD,CAAC;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,gBAAgB,CAAC,EAAE,yBAAyB,CAAC;IAC7C,UAAU,CAAC,EAAE;QAAE,KAAK,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CAClK;AAkBD,wBAAsB,kCAAkC,CAAC,OAAO,EAAE,oCAAoC,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAiQ9I"}

package/dist/internal/control-client/collector-gateway.js

@@ -100,38 +100,58 @@ export async function startCustomerOwnedCollectorGateway(options) {
         };
     };
     let sendHeartbeat = async () => { };
+    const proposeHostedAction = async (proposal, idempotencyKey) => {
+        const proposalEnvironment = typeof proposal.environment === "string" ? proposal.environment : undefined;
+        if (monitoringControlFor(proposalEnvironment)?.state === "PAUSED") {
+            throw new GatewayRequestError(409, "Monitoring is paused for this Agent. Reconnect it in Witnora before proposing a new action.");
+        }
+        const hostedProposal = runtimeBinding ? { ...proposal, localRuntimeBinding: runtimeBinding } : proposal;
+        const propose = () => options.client.proposeAction(hostedProposal, idempotencyKey);
+        let action;
+        try {
+            action = await propose();
+        }
+        catch (error) {
+            if (!(error instanceof RemoteCollectorApiError) || error.code !== "local_sandbox_binding_stale" || !runtimeBinding)
+                throw error;
+            await sendHeartbeat();
+            action = await propose();
+        }
+        if (options.actionWorker && action.externalId === proposal.externalId) {
+            await options.actionWorker.track({ actionId: identifier(action.id, "actionId"), proposal });
+        }
+        return action;
+    };
     const server = createServer(async (request, response) => {
         try {
             const url = new URL(request.url ?? "/", "http://127.0.0.1");
             if (request.method === "GET" && url.pathname === "/healthz")
                 return json(response, 200, await status());
+            const httpActionRoute = url.pathname.match(/^\/v1\/http-actions\/([A-Za-z0-9._:-]+)$/);
+            if (request.method === "POST" && httpActionRoute) {
+                if (!options.httpActionIngress)
+                    return json(response, 404, { error: "not found" });
+                const idempotencyHeader = request.headers["idempotency-key"];
+                const resolved = await options.httpActionIngress.resolve({
+                    actionId: identifier(httpActionRoute[1], "actionId"),
+                    authorization: request.headers.authorization,
+                    idempotencyKey: typeof idempotencyHeader === "string" ? idempotencyHeader : undefined,
+                    body: await readJson(request, options.maxBodyBytes ?? 1_048_576),
+                    reject(status, messageText) {
+                        const safeStatus = Number.isInteger(status) && status >= 400 && status <= 499 ? status : 500;
+                        throw new GatewayRequestError(safeStatus, safeStatus === status ? messageText : "HTTP Action ingress rejected the request with an invalid status.");
+                    },
+                });
+                return json(response, 202, await proposeHostedAction(object(resolved.proposal), identifier(resolved.idempotencyKey, "idempotencyKey")));
+            }
             authenticate(request, options.gatewayToken);
             if (request.method === "POST" && url.pathname === "/v1/flush")
                 return json(response, 200, await flush());
             if (request.method === "POST" && url.pathname === "/v1/actions") {
                 const body = await readJson(request, options.maxBodyBytes ?? 1_048_576);
                 const proposal = object(body.proposal);
-                const proposalEnvironment = typeof proposal.environment === "string" ? proposal.environment : undefined;
-                if (monitoringControlFor(proposalEnvironment)?.state === "PAUSED") {
-                    throw new GatewayRequestError(409, "Monitoring is paused for this Agent. Reconnect it in Witnora before proposing a new action.");
-                }
-                const hostedProposal = runtimeBinding ? { ...proposal, localRuntimeBinding: runtimeBinding } : proposal;
                 const idempotencyKey = identifier(body.idempotencyKey, "idempotencyKey");
-                const propose = () => options.client.proposeAction(hostedProposal, idempotencyKey);
-                let action;
-                try {
-                    action = await propose();
-                }
-                catch (error) {
-                    if (!(error instanceof RemoteCollectorApiError) || error.code !== "local_sandbox_binding_stale" || !runtimeBinding)
-                        throw error;
-                    await sendHeartbeat();
-                    action = await propose();
-                }
-                if (options.actionWorker && action.externalId === proposal.externalId) {
-                    await options.actionWorker.track({ actionId: identifier(action.id, "actionId"), proposal });
-                }
-                return json(response, 202, action);
+                return json(response, 202, await proposeHostedAction(proposal, idempotencyKey));
             }
             const actionRoute = url.pathname.match(/^\/v1\/actions\/([A-Za-z0-9._:-]+)$/);
             if (request.method === "GET" && actionRoute) {

package/dist/onboard.js

@@ -8,7 +8,7 @@ import { verifyControlPlaneConnection } from "./control-plane.js";
 import { inferPrivateCapabilities, runPrivateCapabilityDiscovery } from "./private-discovery.js";
 import { parseAgentTemplate, starterAdapter, starterProfile, starterTripwireConfig } from "./onboarding-templates.js";
 import { writeTryEvidence } from "./try.js";
-import { doctorCustomerGateway, activateManagedWorkflowHarness, ensureCustomerGatewayPortAvailable, initializeCustomerGateway, inspectLocalRuntimeBinding, inspectCustomerGatewayFiles, startManagedCustomerGateway, statusManagedCustomerGateway, stopManagedCustomerGateway, upgradeCustomerGatewayRuntime, RuntimeSetupNotReadyError, } from "./gateway.js";
+import { doctorCustomerGateway, activateManagedWorkflowHarness, configureCustomerHttpAction, ensureCustomerGatewayPortAvailable, initializeCustomerGateway, inspectLocalRuntimeBinding, inspectCustomerGatewayFiles, startManagedCustomerGateway, statusManagedCustomerGateway, stopManagedCustomerGateway, upgradeCustomerGatewayRuntime, RuntimeSetupNotReadyError, } from "./gateway.js";
 import { discoverRuntimeReferences, planRuntimeSandboxModules } from "./runtime-sandbox-kit.js";
 import { automaticRuntimeReferencesUsable, bootstrapLocalRuntime, verifyAutomaticRuntimeProbe } from "./runtime-bootstrap.js";
 import { activateRealPathIntegrations } from "./real-path-activation.js";
@@ -113,6 +113,7 @@ export async function runOnboard(options) {
         limitation: "No approved customer Harness module is bound to this Agent repository.",
     };
     let assuranceHarnessChanged = false;
+    let httpActionSetup;
     let continuousService;
     const prepareRuntime = async (operation) => {
         const delays = [250, 500, 1_000, 2_000, 4_000, 8_000];
@@ -251,7 +252,11 @@ export async function runOnboard(options) {
                 throw error;
             assuranceHarnessReadiness = { state: "WAITING_FOR_CUSTOMER_HARNESS", limitation: detail };
         }
-        if (assuranceHarnessChanged && gatewayState.status !== "absent") {
+        if (assuranceHarnessReadiness.state === "ACTIVE") {
+            httpActionSetup = await configureCustomerHttpAction({ repository: repositoryPath, activations: realPathActivation.activations });
+            generatedFiles.push(...httpActionSetup.generatedFiles);
+        }
+        if ((assuranceHarnessChanged || httpActionSetup?.changed) && gatewayState.status !== "absent") {
             const stopped = await stopGatewayOwners();
             if (stopped.state !== "STOPPED" && stopped.state !== "STALE")
                 throw new Error("The prior managed Gateway process did not stop before Assurance Harness activation.");
@@ -308,17 +313,28 @@ export async function runOnboard(options) {
         output(assuranceHarnessReadiness.state === "ACTIVE"
             ? `Assurance Harness: ACTIVE. Nora can dispatch authority-ready Replay and no-write Shadow evaluations without manual Workflow IDs, evaluator origins, credentials, or contract digests.${realPathActivation.activations.length ? ` ${realPathActivation.activations.length} exact Stripe test-mode real-path binding(s) passed read-only preflight.` : ""}\n`
             : `Assurance Harness: WAITING_FOR_CUSTOMER_HARNESS. ${assuranceHarnessReadiness.limitation}\n`);
+        if (httpActionSetup?.state === "READY" && httpActionSetup.action) {
+            output(`HTTP Action: READY. POST ${managedGateway.baseUrl}${httpActionSetup.action.path}; copy the action-scoped token and request example from .witnora/gateway/HTTP_ACTION.md.\n`);
+        }
         output("Connected. Nora is monitoring this Agent. Run it normally whenever it is ready; the first source-signed activity will appear automatically without blocking setup.\n");
         return { projectId: token.projectId, connectionName: token.connectionName, credentialsPath, template: repository.template,
             repositoryKind: repository.kind, generatedFiles, receiptPath, discovery, setupPlanId: setupPlan.id,
             gatewayDirectory: join(repositoryPath, ".witnora", "gateway"), gatewayArchiveDirectory: gatewayMigration?.archiveDirectory,
-            gateway: managedGateway, runtimeReadiness, assuranceHarnessReadiness, continuousService };
+            gateway: managedGateway, runtimeReadiness, assuranceHarnessReadiness, continuousService,
+            ...(httpActionSetup?.state === "READY" && httpActionSetup.action ? { httpAction: {
+                    state: "READY",
+                    method: "POST",
+                    path: httpActionSetup.action.path,
+                    guidePath: join(repositoryPath, ".witnora", "gateway", "HTTP_ACTION.md"),
+                } } : {}),
+        };
     }
     catch (error) {
         const diagnosis = error instanceof Error ? error.message : String(error);
         if (managedGateway?.started) {
             await stopGatewayOwners().catch(() => undefined);
         }
+        await httpActionSetup?.rollback().catch(() => undefined);
         await realPathActivation?.rollback().catch(() => undefined);
         await rollbackGeneratedFiles(generatedFiles);
         await runtimeUpgrade?.rollback().catch(() => undefined);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.18.16",
+  "version": "0.19.0",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",