witnora 0.8.1 → 0.9.0

package/dist/bundle.js

@@ -0,0 +1,100 @@
+import { AGENTCERT_EVIDENCE_SCHEMA_SEMVER, AGENTCERT_EVIDENCE_SCHEMA_VERSION } from "./types.js";
+export function buildEvidenceBundle(results, subjectName, subjectType = "agent") {
+    const evidence = results.flatMap((result) => result.evidence);
+    const score = results.length === 0 ? 0 : Math.round(results.reduce((sum, result) => sum + result.score, 0) / results.length);
+    const passed = results.length > 0 && results.every((result) => result.passed);
+    const artifacts = {};
+    for (const result of results) {
+        for (const [name, path] of Object.entries(result.artifacts)) {
+            if (path) {
+                artifacts[`${result.product}.${name}`] = path;
+            }
+        }
+    }
+    return {
+        schemaName: "agentcert.evidence_bundle",
+        schemaVersion: AGENTCERT_EVIDENCE_SCHEMA_VERSION,
+        schemaSemver: AGENTCERT_EVIDENCE_SCHEMA_SEMVER,
+        kind: "agentcert.evidence_bundle",
+        runId: `agentcert_${Date.now()}`,
+        generatedAt: new Date().toISOString(),
+        subject: {
+            name: subjectName,
+            type: parseSubjectType(subjectType),
+        },
+        verdict: {
+            passed,
+            score,
+            level: levelForScore(score, passed),
+        },
+        summary: {
+            products: [...new Set(results.map((result) => result.product))],
+            criticalEvidence: evidence.filter((item) => item.severity === "critical").length,
+            highEvidence: evidence.filter((item) => item.severity === "high").length,
+            totalEvidence: evidence.length,
+        },
+        results,
+        evidence,
+        artifacts,
+        evidenceStrength: evidenceStrengthFor(results),
+        standards: [
+            {
+                id: "aiuc-1",
+                name: "AIUC-1 agent security, safety, and reliability",
+                status: "mapped",
+                note: "Witnora evidence can support preparation for independent AIUC-1-style reviews; it is not an official certification.",
+            },
+            {
+                id: "nist-ai-agent-standards",
+                name: "NIST AI Agent Standards Initiative",
+                status: "mapped",
+                note: "Witnora evidence aligns with secure, interoperable, auditable agent deployment goals.",
+            },
+            {
+                id: "owasp-agentic-ai",
+                name: "OWASP Agentic AI threats and mitigations",
+                status: "mapped",
+                note: "Witnora scenarios cover prompt injection, tool misuse, excessive agency, and runtime action governance.",
+            },
+        ],
+    };
+}
+const STRENGTH_ORDER = ["reported", "recorded", "enforced", "outcome_verified", "independently_reviewed"];
+function evidenceStrengthFor(results) {
+    const values = results.map((result) => result.evidenceStrength ?? {
+        schemaVersion: "agentcert.evidence_strength.v0.1",
+        level: "reported",
+        claims: ["A producer supplied a result for this run."],
+        limitations: ["The result does not contain a source-signed action record."],
+    });
+    const weakest = values.length
+        ? values.reduce((left, right) => STRENGTH_ORDER.indexOf(left.level) <= STRENGTH_ORDER.indexOf(right.level) ? left : right)
+        : { schemaVersion: "agentcert.evidence_strength.v0.1", level: "reported", claims: [], limitations: ["The bundle contains no results."] };
+    return {
+        schemaVersion: "agentcert.evidence_strength.v0.1",
+        level: weakest.level,
+        claims: [...new Set(values.flatMap((value) => value.claims))],
+        limitations: [...new Set(values.flatMap((value) => value.limitations))],
+    };
+}
+function levelForScore(score, passed) {
+    if (!passed) {
+        return "No assurance decision";
+    }
+    if (score >= 95) {
+        return "Strong evidence";
+    }
+    if (score >= 85) {
+        return "Substantial evidence";
+    }
+    if (score >= 70) {
+        return "Limited evidence";
+    }
+    return "Needs review";
+}
+function parseSubjectType(value) {
+    if (value === "agent" || value === "mcp-server" || value === "tool" || value === "application") {
+        return value;
+    }
+    return "unknown";
+}