witnora 0.9.0 → 0.9.2

package/dist/schema-validator.js

@@ -18,10 +18,15 @@ export function parseSchemaId(input) {
         value === "evidence-strength" ||
         value === "action-mandate" ||
         value === "trusted-action-record" ||
-        value === "trusted-run-receipt") {
+        value === "trusted-run-receipt" ||
+        value === "agent-mutation" ||
+        value === "evolution-manifest" ||
+        value === "permission-diff" ||
+        value === "promotion-grant" ||
+        value === "promotion-receipt") {
         return value;
     }
-    throw new Error(`Unsupported schema "${value}". Use evidence-bundle, result, corpus-record, failure-review, classifier-eval, monitor-snapshot, robustness-lab, release-gate, assurance-report, assurance-delivery, assurance-scope, evidence-signature, evidence-strength, action-mandate, trusted-action-record, or trusted-run-receipt.`);
+    throw new Error(`Unsupported schema "${value}". Use evidence-bundle, result, corpus-record, failure-review, classifier-eval, monitor-snapshot, robustness-lab, release-gate, assurance-report, assurance-delivery, assurance-scope, evidence-signature, evidence-strength, action-mandate, trusted-action-record, trusted-run-receipt, agent-mutation, evolution-manifest, permission-diff, promotion-grant, or promotion-receipt.`);
 }
 export function validateAgentCertSchema(schema, input) {
     const errors = [];
@@ -63,6 +68,16 @@ export function validateAgentCertSchema(schema, input) {
             validateTrustedActionRecord(value, errors);
         if (schema === "trusted-run-receipt")
             validateTrustedRunReceipt(value, errors);
+        if (schema === "agent-mutation")
+            validateAgentMutation(value, errors);
+        if (schema === "evolution-manifest")
+            validateEvolutionManifest(value, errors);
+        if (schema === "permission-diff")
+            validatePermissionDiff(value, errors);
+        if (schema === "promotion-grant")
+            validatePromotionGrant(value, errors);
+        if (schema === "promotion-receipt")
+            validatePromotionReceipt(value, errors);
     }
     return { schema, valid: errors.length === 0, errors };
 }
@@ -388,6 +403,97 @@ function optionalSha256At(value, key, path, errors) {
     if (value[key] !== undefined && (typeof value[key] !== "string" || !/^[0-9a-f]{64}$/.test(value[key])))
         errors.push(`${path} must be a lowercase SHA-256 digest.`);
 }
+function validateAgentMutation(value, errors) {
+    requiredConst(value, "schemaVersion", "witnora.agent_mutation.v0.1", errors);
+    for (const key of ["id", "projectId", "assuranceCaseId", "lineageId", "manifestSha256", "createdBy", "createdAt", "updatedAt"])
+        requiredString(value, key, errors);
+    requiredSha256At(value, "manifestSha256", "manifestSha256", errors);
+    requiredEnum(value, "status", ["REVIEW_REQUIRED", "GRANT_ISSUED", "GRANT_CLAIMED", "DEPLOYMENT_VERIFIED", "REJECTED"], errors);
+    const manifest = recordValue(value.manifest);
+    if (!manifest)
+        errors.push("manifest must be an object.");
+    else
+        validateEvolutionManifest(manifest, errors);
+    const permissionDiff = recordValue(value.permissionDiff);
+    if (!permissionDiff)
+        errors.push("permissionDiff must be an object.");
+    else
+        validatePermissionDiff(permissionDiff, errors);
+    validateTimestamp(value.createdAt, "createdAt", errors);
+    validateTimestamp(value.updatedAt, "updatedAt", errors);
+}
+function validateEvolutionManifest(value, errors) {
+    requiredConst(value, "schemaVersion", "witnora.evolution_manifest.v0.1", errors);
+    for (const key of ["mutationId", "lineageId", "assuranceCaseId", "createdAt"])
+        requiredString(value, key, errors);
+    for (const key of ["parent", "candidate", "changes", "buildProvenance", "capabilities", "target"])
+        requiredObject(value, key, errors);
+    for (const key of ["dataSources"])
+        requiredArray(value, key, errors);
+    for (const key of ["parent", "candidate"]) {
+        const artifact = recordValue(value[key]);
+        if (artifact) {
+            requiredStringAt(artifact, "id", `${key}.id`, errors);
+            requiredStringAt(artifact, "version", `${key}.version`, errors);
+            requiredSha256At(artifact, "digestSha256", `${key}.digestSha256`, errors);
+        }
+    }
+    const changes = recordValue(value.changes);
+    if (changes) {
+        const entries = ["code", "prompt", "model", "tools", "policy"].filter((key) => changes[key] !== undefined);
+        if (entries.length === 0)
+            errors.push("changes must declare at least one changed component.");
+        for (const key of entries) {
+            const change = recordValue(changes[key]);
+            if (!change)
+                errors.push(`changes.${key} must be an object.`);
+            else {
+                requiredSha256At(change, "afterSha256", `changes.${key}.afterSha256`, errors);
+                optionalSha256At(change, "beforeSha256", `changes.${key}.beforeSha256`, errors);
+                requiredStringAt(change, "summary", `changes.${key}.summary`, errors);
+            }
+        }
+    }
+    const capabilities = recordValue(value.capabilities);
+    if (capabilities) {
+        stringArray(capabilities.parent, "capabilities.parent", errors);
+        stringArray(capabilities.requested, "capabilities.requested", errors);
+    }
+    validateTimestamp(value.createdAt, "createdAt", errors);
+}
+function validatePermissionDiff(value, errors) {
+    requiredConst(value, "schemaVersion", "witnora.permission_inheritance_diff.v0.1", errors);
+    for (const key of ["inherited", "removed", "additions", "approvedAdditions", "deniedAdditions"]) {
+        requiredArray(value, key, errors);
+        stringArray(value[key], key, errors);
+    }
+    requiredConst(value, "defaultDecision", "DENY_NEW_CAPABILITIES", errors);
+}
+function validatePromotionGrant(value, errors) {
+    requiredConst(value, "schemaVersion", "witnora.promotion_grant.v0.1", errors);
+    for (const key of ["grantId", "projectId", "mutationId", "lineageId", "manifestSha256", "approvedBy", "rationale", "issuedAt", "notBefore", "expiresAt", "nonce"])
+        requiredString(value, key, errors);
+    requiredSha256At(value, "manifestSha256", "manifestSha256", errors);
+    for (const key of ["candidateArtifact", "target"])
+        requiredObject(value, key, errors);
+    requiredArray(value, "permittedCapabilities", errors);
+    stringArray(value.permittedCapabilities, "permittedCapabilities", errors);
+    if (value.maxUses !== 1)
+        errors.push("maxUses must equal 1.");
+    for (const key of ["issuedAt", "notBefore", "expiresAt"])
+        validateTimestamp(value[key], key, errors);
+}
+function validatePromotionReceipt(value, errors) {
+    requiredConst(value, "schemaVersion", "witnora.promotion_receipt.v0.1", errors);
+    for (const key of ["receiptId", "projectId", "mutationId", "grantId", "lineageId", "manifestSha256", "expectedArtifactDigestSha256", "observedArtifactDigestSha256", "deploymentUri", "verifiedAt"])
+        requiredString(value, key, errors);
+    for (const key of ["manifestSha256", "expectedArtifactDigestSha256", "observedArtifactDigestSha256"])
+        requiredSha256At(value, key, key, errors);
+    requiredEnum(value, "outcome", ["PROMOTED", "DIGEST_MISMATCH"], errors);
+    for (const key of ["observer", "continuousAssurance"])
+        requiredObject(value, key, errors);
+    validateTimestamp(value.verifiedAt, "verifiedAt", errors);
+}
 function validateFailureReview(value, errors) {
     requiredConst(value, "schemaVersion", "1", errors);
     requiredConst(value, "kind", "agentcert.failure_review", errors);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "Witnora evidence, assurance release gates, runtime records, and regression CI for autonomous AI systems.",
   "type": "module",
   "license": "Apache-2.0",
@@ -13,6 +13,10 @@
   "bugs": {
     "url": "https://github.com/Kakarottoooo/agentcert/issues"
   },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
   "keywords": [
     "agent",
     "browser-agent",