witnora 0.9.3 → 0.10.0

package/README.md

@@ -99,6 +99,28 @@ npx witnora connect --server https://witnora.com --project your-project-id
 npx witnora push --evidence .witnora/latest/agentcert-evidence.json
 ```
 
+### Automatic agent and environment context
+
+`run --push`, `push`, and the generated workflow/coding/data adapter register
+the observed agent automatically. Witnora derives the stable identity and
+version from the command subject, the nearest `package.json`, and the current
+CI commit. It records one canonical environment for every run:
+
+- local, development, and test execution becomes `sandbox`;
+- pull-request and preview execution becomes `staging`;
+- tagged releases and recognized production hosts become `production`.
+
+This context is run evidence, not a project form the customer must keep in
+sync. A later run with the same Agent ID updates the observed version without
+overwriting reviewed permissions. Explicit `WITNORA_AGENT_ID`,
+`WITNORA_AGENT_VERSION`, and `WITNORA_ENVIRONMENT` values take precedence when
+a repository needs a stable identity that differs from its package metadata.
+Unsupported environment values fail closed instead of being guessed.
+
+Useful one-run overrides are `--agent-id`, `--agent-name`, `--agent-version`,
+`--agent-framework`, and `--environment`. Raw prompts, credentials, and tool
+arguments are not needed for this registration.
+
 Bind a release, pull-request, or nightly run to an issued continuous assurance
 case by declaring the exact reviewed scope:
 

package/dist/bundle.js

@@ -75,8 +75,30 @@ function evidenceStrengthFor(results) {
         level: weakest.level,
         claims: [...new Set(values.flatMap((value) => value.claims))],
         limitations: [...new Set(values.flatMap((value) => value.limitations))],
+        ...(() => {
+            const vectors = values.flatMap((value) => value.trustVector ? [value.trustVector] : []);
+            return vectors.length === values.length && vectors.length ? { trustVector: weakestTrustVector(vectors) } : {};
+        })(),
     };
 }
+function weakestTrustVector(vectors) {
+    const capture = weakest(vectors.map((item) => item.capture), ["self_reported", "collector_recorded", "boundary_observed"]);
+    const mediation = weakest(vectors.map((item) => item.mediation), ["none", "advisory", "enforced"]);
+    const completeness = weakest(vectors.map((item) => item.completeness), ["unknown", "partial", "target_reconciled"]);
+    const attestation = weakest(vectors.map((item) => item.attestation), ["unsigned", "source_signed", "platform_signed", "externally_witnessed"]);
+    const review = weakest(vectors.map((item) => item.review), ["none", "internal", "independent_external"]);
+    const outcome = vectors.some((item) => item.outcome === "contradicted")
+        ? "contradicted"
+        : vectors.some((item) => item.outcome === "unverified") ? "unverified" : "verified";
+    return {
+        schemaVersion: "witnora.evidence_trust_vector.v0.1",
+        capture, mediation, outcome, completeness, attestation, review,
+        limitations: [...new Set(vectors.flatMap((item) => item.limitations))],
+    };
+}
+function weakest(values, order) {
+    return values.reduce((left, right) => order.indexOf(left) <= order.indexOf(right) ? left : right);
+}
 function levelForScore(score, passed) {
     if (!passed) {
         return "No assurance decision";

package/dist/cli.js

@@ -28,6 +28,7 @@ import { runBrowserAdapterCommand } from "./browser-adapter.js";
 import { parseAgentTemplate, starterAdapter, starterGitHubActionWorkflow, starterInstructions, starterProfile, starterTripwireConfig, } from "./onboarding-templates.js";
 import { renderTrySummary, writeTryEvidence } from "./try.js";
 import { applyGuidedSetup } from "./guided-setup.js";
+import { resolveRuntimeContext } from "./runtime-context.js";
 process.on("uncaughtException", reportFatalError);
 process.on("unhandledRejection", reportFatalError);
 const command = process.argv[2] ?? "help";
@@ -535,6 +536,8 @@ else if (command === "schema") {
   witnora schema validate --schema assurance-report --file assurance-report.json
   witnora schema validate --schema assurance-delivery --file assurance-delivery.json
   witnora schema validate --schema evidence-signature --file .witnora/latest/agentcert-evidence.json.sig.json
+  witnora schema validate --schema assurance-wallet --file assurance-wallet.json
+  witnora schema validate --schema payment-token-reference --file payment-token-reference.json
 `);
     }
 }
@@ -665,6 +668,17 @@ async function pushHostedEvidence(bundle, bytes, fileName) {
         skippedCompanionArtifacts: companions?.skipped,
         assurance,
         verifyContinuousAssurance: Boolean(assurance && (healthOut || requireCurrent)),
+        runtimeContext: await resolveRuntimeContext({
+            subject: bundle.subject.name,
+            framework: readFlag("--agent-framework"),
+            env: {
+                ...process.env,
+                ...(readFlag("--agent-id") ? { WITNORA_AGENT_ID: readFlag("--agent-id") } : {}),
+                ...(readFlag("--agent-name") ? { WITNORA_AGENT_NAME: readFlag("--agent-name") } : {}),
+                ...(readFlag("--agent-version") ? { WITNORA_AGENT_VERSION: readFlag("--agent-version") } : {}),
+                ...(readFlag("--environment") ? { WITNORA_ENVIRONMENT: readFlag("--environment") } : {}),
+            },
+        }),
     });
     process.stdout.write(`Hosted run: ${result.runId}\nHosted evidence: ${result.evidenceId}\n`);
     if (companions) {

package/dist/command-help.js

@@ -59,6 +59,11 @@ Options:
   --project <id>         Hosted project ID
   --api-key <key>        Project API key (prefer WITNORA_API_KEY in CI)
   --external-id <id>     Idempotent hosted run ID
+  --agent-id <id>        Stable observed Agent identity (default: evidence subject)
+  --agent-name <name>    Human-readable observed Agent name
+  --agent-version <v>    Version override (default: package or CI commit)
+  --agent-framework <f>  Framework metadata override
+  --environment <env>    sandbox, staging, or production
   --assurance-case <id>  Issued assurance case to reconcile
   --assurance-scope <p>  Declared agent/model/prompt/tools/policy/suite scope JSON
   --assurance-trigger <t> auto, pull_request, release, or nightly (default: auto)

package/dist/control-plane.js

@@ -75,6 +75,15 @@ export async function pushEvidenceToControlPlane(options) {
                 subject: bundle.subject,
                 products: bundle.summary.products,
             },
+            ...(options.runtimeContext ? {
+                agent: {
+                    externalId: options.runtimeContext.agentId,
+                    name: options.runtimeContext.agentName,
+                    version: options.runtimeContext.agentVersion,
+                    framework: options.runtimeContext.framework,
+                },
+                environment: options.runtimeContext.environment,
+            } : {}),
             assurance: options.assurance,
         }),
     });

package/dist/onboarding-templates.js

@@ -32,10 +32,15 @@ export function starterAdapter(template, subject) {
     const eventType = template === "coding" ? "coding.change.proposed" : template === "workflow" ? "workflow.step.completed" : "data.query.completed";
     return `#!/usr/bin/env node
 import { randomBytes, randomUUID } from "node:crypto";
+import { readFile } from "node:fs/promises";
 
 const baseUrl = brandedRequired("BASE_URL").replace(/\\\/$/, "");
 const projectId = brandedRequired("PROJECT_ID");
 const apiKey = brandedRequired("API_KEY");
+const agentId = branded("AGENT_ID") ?? ${JSON.stringify(subject)};
+const agentName = branded("AGENT_NAME") ?? humanize(agentId);
+const agentVersion = await discoverAgentVersion();
+const environment = detectEnvironment();
 const now = new Date().toISOString();
 const traceId = randomBytes(16).toString("hex");
 const spanId = randomBytes(8).toString("hex");
@@ -44,10 +49,10 @@ const envelope = {
   envelopeId: randomUUID(),
   kind: "event",
   occurredAt: now,
-  source: { agentId: ${JSON.stringify(subject)}, agentVersion: process.env.AGENT_VERSION ?? "unversioned", framework: ${JSON.stringify(framework)}, adapter: "witnora-init-v0.2" },
-  run: { externalId: process.env.AGENT_RUN_ID ?? randomUUID(), kind: "custom" },
+  source: { agentId, agentName, agentVersion, framework: branded("AGENT_FRAMEWORK") ?? ${JSON.stringify(framework)}, adapter: "witnora-init-v0.3" },
+  run: { externalId: process.env.WITNORA_RUN_ID ?? process.env.AGENT_RUN_ID ?? randomUUID(), kind: "custom", environment: environment },
   trace: { traceId, spanId },
-  event: { type: ${JSON.stringify(eventType)}, actor: "agent", sequence: 0, attributes: { environment: process.env.AGENT_ENVIRONMENT ?? "development" } },
+  event: { type: ${JSON.stringify(eventType)}, actor: "agent", sequence: 0, attributes: { environment } },
 };
 const response = await fetch(\`\${baseUrl}/v1/projects/\${encodeURIComponent(projectId)}/envelopes\`, {
   method: "POST",
@@ -66,6 +71,44 @@ function brandedRequired(suffix) {
   if (!value) throw new Error(\`\${name} is required. Connect the Witnora CLI or set the hosted project variables. Legacy AGENTCERT_* names remain supported.\`);
   return value;
 }
+
+function branded(suffix) {
+  return process.env[\`WITNORA_\${suffix}\`] ?? process.env[\`AGENTCERT_\${suffix}\`];
+}
+
+function humanize(value) {
+  const unscoped = value.includes("/") ? value.slice(value.lastIndexOf("/") + 1) : value;
+  return unscoped.replace(/[-_.]+/g, " ").replace(/\\b\\w/g, (character) => character.toUpperCase()).trim();
+}
+
+async function discoverAgentVersion() {
+  const explicit = branded("AGENT_VERSION");
+  if (explicit) return explicit;
+  try {
+    const pkg = JSON.parse(await readFile(new URL("./package.json", import.meta.url), "utf8"));
+    if (typeof pkg.version === "string" && pkg.version.trim()) return pkg.version.trim();
+  } catch {}
+  const commit = process.env.GITHUB_SHA ?? process.env.RENDER_GIT_COMMIT ?? process.env.VERCEL_GIT_COMMIT_SHA;
+  return commit ? \`git-\${commit.slice(0, 12)}\` : "local";
+}
+
+function detectEnvironment() {
+  const explicit = branded("ENVIRONMENT") ?? process.env.VERCEL_ENV;
+  if (explicit) return normalizeEnvironment(explicit);
+  if (["pull_request", "pull_request_target"].includes(process.env.GITHUB_EVENT_NAME ?? "")) return "staging";
+  if (process.env.GITHUB_REF_TYPE === "tag") return "production";
+  if (process.env.RENDER_SERVICE_ID) return process.env.IS_PULL_REQUEST === "true" ? "staging" : "production";
+  if (process.env.NODE_ENV === "production") return "production";
+  return "sandbox";
+}
+
+function normalizeEnvironment(value) {
+  const normalized = value.trim().toLowerCase();
+  if (["sandbox", "development", "dev", "test", "local"].includes(normalized)) return "sandbox";
+  if (["staging", "stage", "preview", "pull_request", "pr"].includes(normalized)) return "staging";
+  if (["production", "prod", "live"].includes(normalized)) return "production";
+  throw new Error(\`Unsupported Witnora environment \${JSON.stringify(value)}. Use sandbox, staging, or production.\`);
+}
 `;
 }
 export function starterInstructions(template, subject) {

package/dist/runtime-context.js

@@ -0,0 +1,75 @@
+import { readFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+export async function resolveRuntimeContext(options) {
+    const env = options.env ?? process.env;
+    const cwd = resolve(options.cwd ?? process.cwd());
+    const packageMetadata = await nearestPackageMetadata(cwd);
+    const agentId = first(env.WITNORA_AGENT_ID, env.AGENTCERT_AGENT_ID, options.subject, packageMetadata?.name) ?? "witnora-agent";
+    const agentName = first(env.WITNORA_AGENT_NAME, env.AGENTCERT_AGENT_NAME) ?? humanizeIdentifier(agentId);
+    return {
+        agentId,
+        agentName,
+        agentVersion: first(env.WITNORA_AGENT_VERSION, env.AGENTCERT_AGENT_VERSION, packageMetadata?.version, commitVersion(env), "local"),
+        ...(first(env.WITNORA_AGENT_FRAMEWORK, env.AGENTCERT_AGENT_FRAMEWORK, options.framework)
+            ? { framework: first(env.WITNORA_AGENT_FRAMEWORK, env.AGENTCERT_AGENT_FRAMEWORK, options.framework) }
+            : {}),
+        environment: detectRuntimeEnvironment(env),
+    };
+}
+export function humanizeIdentifier(value) {
+    const unscoped = value.includes("/") ? value.slice(value.lastIndexOf("/") + 1) : value;
+    return unscoped.replace(/[-_.]+/g, " ").replace(/\b\w/g, (character) => character.toUpperCase()).trim();
+}
+export function detectRuntimeEnvironment(env) {
+    const explicit = first(env.WITNORA_ENVIRONMENT, env.AGENTCERT_ENVIRONMENT);
+    if (explicit)
+        return normalizeRuntimeEnvironment(explicit);
+    if (env.VERCEL_ENV)
+        return normalizeRuntimeEnvironment(env.VERCEL_ENV);
+    if (env.GITHUB_EVENT_NAME === "pull_request" || env.GITHUB_EVENT_NAME === "pull_request_target")
+        return "staging";
+    if (env.GITHUB_REF_TYPE === "tag")
+        return "production";
+    if (env.RENDER_SERVICE_ID)
+        return env.IS_PULL_REQUEST === "true" ? "staging" : "production";
+    if (env.NODE_ENV === "production")
+        return "production";
+    return "sandbox";
+}
+export function normalizeRuntimeEnvironment(value) {
+    const normalized = value.trim().toLowerCase();
+    if (["sandbox", "development", "dev", "test", "local"].includes(normalized))
+        return "sandbox";
+    if (["staging", "stage", "preview", "pull_request", "pr"].includes(normalized))
+        return "staging";
+    if (["production", "prod", "live"].includes(normalized))
+        return "production";
+    throw new Error(`Unsupported Witnora environment ${JSON.stringify(value)}. Use sandbox, staging, or production.`);
+}
+async function nearestPackageMetadata(start) {
+    let current = start;
+    while (true) {
+        try {
+            const value = JSON.parse(await readFile(join(current, "package.json"), "utf8"));
+            return { name: text(value.name), version: text(value.version) };
+        }
+        catch (error) {
+            if (error.code !== "ENOENT" && !(error instanceof SyntaxError))
+                throw error;
+        }
+        const parent = dirname(current);
+        if (parent === current)
+            return undefined;
+        current = parent;
+    }
+}
+function commitVersion(env) {
+    const sha = first(env.GITHUB_SHA, env.RENDER_GIT_COMMIT, env.VERCEL_GIT_COMMIT_SHA);
+    return sha ? `git-${sha.slice(0, 12)}` : undefined;
+}
+function first(...values) {
+    return values.find((value) => typeof value === "string" && value.trim().length > 0)?.trim();
+}
+function text(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}

package/dist/schema-validator.js

@@ -23,10 +23,12 @@ export function parseSchemaId(input) {
         value === "evolution-manifest" ||
         value === "permission-diff" ||
         value === "promotion-grant" ||
-        value === "promotion-receipt") {
+        value === "promotion-receipt" ||
+        value === "assurance-wallet" ||
+        value === "payment-token-reference") {
         return value;
     }
-    throw new Error(`Unsupported schema "${value}". Use evidence-bundle, result, corpus-record, failure-review, classifier-eval, monitor-snapshot, robustness-lab, release-gate, assurance-report, assurance-delivery, assurance-scope, evidence-signature, evidence-strength, action-mandate, trusted-action-record, trusted-run-receipt, agent-mutation, evolution-manifest, permission-diff, promotion-grant, or promotion-receipt.`);
+    throw new Error(`Unsupported schema "${value}". Use evidence-bundle, result, corpus-record, failure-review, classifier-eval, monitor-snapshot, robustness-lab, release-gate, assurance-report, assurance-delivery, assurance-scope, evidence-signature, evidence-strength, action-mandate, trusted-action-record, trusted-run-receipt, agent-mutation, evolution-manifest, permission-diff, promotion-grant, promotion-receipt, assurance-wallet, or payment-token-reference.`);
 }
 export function validateAgentCertSchema(schema, input) {
     const errors = [];
@@ -78,9 +80,100 @@ export function validateAgentCertSchema(schema, input) {
             validatePromotionGrant(value, errors);
         if (schema === "promotion-receipt")
             validatePromotionReceipt(value, errors);
+        if (schema === "assurance-wallet")
+            validateAssuranceWallet(value, errors);
+        if (schema === "payment-token-reference")
+            validatePaymentTokenReference(value, errors);
     }
     return { schema, valid: errors.length === 0, errors };
 }
+function validateAssuranceWallet(value, errors) {
+    requiredConst(value, "schemaVersion", "witnora.assurance_wallet.v0.1", errors);
+    for (const field of ["id", "projectId", "name", "ownerPrincipalId", "baseCurrency", "policyDigestSha256", "status", "createdBy", "createdAt", "updatedAt"])
+        requiredString(value, field, errors);
+    sha256Field(value, "policyDigestSha256", errors);
+    requiredEnum(value, "status", ["ACTIVE", "SUSPENDED", "REVOKED"], errors);
+    for (const field of ["createdAt", "updatedAt"])
+        validateTimestamp(value[field], field, errors);
+    const policy = recordValue(value.policy);
+    if (!policy) {
+        errors.push("policy must be an object.");
+        return;
+    }
+    requiredArray(policy, "allowedProviders", errors);
+    requiredArray(policy, "allowedEnvironments", errors);
+    requiredArray(policy, "allowedCurrencies", errors);
+    stringArray(policy.allowedProviders, "policy.allowedProviders", errors);
+    stringArray(policy.allowedEnvironments, "policy.allowedEnvironments", errors);
+    stringArray(policy.allowedCurrencies, "policy.allowedCurrencies", errors);
+    enumArray(policy.allowedProviders, "policy.allowedProviders", ["STRIPE", "CLOUDFLARE"], errors);
+    enumArray(policy.allowedEnvironments, "policy.allowedEnvironments", ["SANDBOX", "TEST"], errors);
+    currencyArray(policy.allowedCurrencies, "policy.allowedCurrencies", errors);
+    currencyField(value, "baseCurrency", errors);
+    if (Array.isArray(policy.allowedCurrencies) &&
+        (policy.allowedCurrencies.length !== 1 || policy.allowedCurrencies[0] !== value.baseCurrency)) {
+        errors.push("policy.allowedCurrencies must contain only baseCurrency in v0.1.");
+    }
+    requiredNumber(policy, "maxAmountPerAction", errors);
+    requiredNumber(policy, "maxAmountPerPeriod", errors);
+    requiredNumber(policy, "periodSeconds", errors);
+    positiveNumber(policy, "maxAmountPerAction", errors);
+    positiveNumber(policy, "maxAmountPerPeriod", errors);
+    positiveInteger(policy, "periodSeconds", errors);
+    requiredBoolean(policy, "mandateRequired", errors);
+    requiredBoolean(policy, "independentOutcomeRequired", errors);
+    if (policy.mandateRequired !== true)
+        errors.push("policy.mandateRequired must be true.");
+    if (policy.independentOutcomeRequired !== true)
+        errors.push("policy.independentOutcomeRequired must be true.");
+    requiredEnum(policy, "recurringPayments", ["DENY", "REQUIRE_APPROVAL"], errors);
+}
+function validatePaymentTokenReference(value, errors) {
+    requiredConst(value, "schemaVersion", "witnora.payment_token_reference.v0.1", errors);
+    for (const field of ["id", "projectId", "walletId", "providerAccountId", "tokenType", "tokenSha256", "audience", "currency", "expiresAt", "status", "createdBy", "createdAt", "updatedAt"])
+        requiredString(value, field, errors);
+    sha256Field(value, "tokenSha256", errors);
+    requiredNumber(value, "maxAmount", errors);
+    positiveNumber(value, "maxAmount", errors);
+    currencyField(value, "currency", errors);
+    requiredEnum(value, "provider", ["STRIPE", "CLOUDFLARE"], errors);
+    requiredEnum(value, "environment", ["SANDBOX", "TEST"], errors);
+    requiredEnum(value, "status", ["AVAILABLE", "BOUND", "CONSUMED", "EXPIRED", "REVOKED"], errors);
+    for (const field of ["expiresAt", "createdAt", "updatedAt"])
+        validateTimestamp(value[field], field, errors);
+}
+function enumArray(value, path, allowed, errors) {
+    if (!Array.isArray(value))
+        return;
+    for (const [index, item] of value.entries()) {
+        if (typeof item === "string" && !allowed.includes(item)) {
+            errors.push(`${path}[${index}] must be one of: ${allowed.join(", ")}.`);
+        }
+    }
+}
+function currencyArray(value, path, errors) {
+    if (!Array.isArray(value))
+        return;
+    for (const [index, item] of value.entries()) {
+        if (typeof item === "string" && !/^[A-Z]{3}$/.test(item)) {
+            errors.push(`${path}[${index}] must be a three-letter uppercase currency code.`);
+        }
+    }
+}
+function currencyField(input, key, errors) {
+    if (typeof input[key] === "string" && !/^[A-Z]{3}$/.test(input[key])) {
+        errors.push(`${key} must be a three-letter uppercase currency code.`);
+    }
+}
+function positiveNumber(input, key, errors) {
+    if (typeof input[key] === "number" && input[key] <= 0)
+        errors.push(`${key} must be greater than zero.`);
+}
+function positiveInteger(input, key, errors) {
+    if (typeof input[key] === "number" && (!Number.isInteger(input[key]) || input[key] <= 0)) {
+        errors.push(`${key} must be a positive integer.`);
+    }
+}
 function validateEvidenceBundle(value, errors) {
     requiredConst(value, "schemaName", "agentcert.evidence_bundle", errors);
     requiredConst(value, "schemaVersion", AGENTCERT_EVIDENCE_SCHEMA_VERSION, errors);
@@ -135,6 +228,21 @@ function validateEvidenceStrength(value, errors, prefix = "") {
     requiredArray(value, "limitations", errors);
     stringArray(value.claims, `${prefix}claims`, errors);
     stringArray(value.limitations, `${prefix}limitations`, errors);
+    const trust = recordValue(value.trustVector);
+    if (value.trustVector !== undefined && !trust)
+        errors.push(`${prefix}trustVector must be an object.`);
+    if (trust)
+        validateEvidenceTrustVector(trust, errors, `${prefix}trustVector.`);
+}
+function validateEvidenceTrustVector(value, errors, prefix) {
+    requiredConst(value, "schemaVersion", "witnora.evidence_trust_vector.v0.1", errors);
+    requiredEnumAt(value, "capture", ["self_reported", "collector_recorded", "boundary_observed"], `${prefix}capture`, errors);
+    requiredEnumAt(value, "mediation", ["none", "advisory", "enforced"], `${prefix}mediation`, errors);
+    requiredEnumAt(value, "outcome", ["unverified", "verified", "contradicted"], `${prefix}outcome`, errors);
+    requiredEnumAt(value, "completeness", ["unknown", "partial", "target_reconciled"], `${prefix}completeness`, errors);
+    requiredEnumAt(value, "attestation", ["unsigned", "source_signed", "platform_signed", "externally_witnessed"], `${prefix}attestation`, errors);
+    requiredEnumAt(value, "review", ["none", "internal", "independent_external"], `${prefix}review`, errors);
+    stringArray(value.limitations, `${prefix}limitations`, errors);
 }
 function validateActionMandate(value, errors) {
     requiredConst(value, "schemaVersion", "agentcert.action_mandate.v0.1", errors);
@@ -363,7 +471,9 @@ function validateAssuranceContinuity(input, errors) {
     }
 }
 function validateAssuranceScope(value, errors) {
-    requiredConst(value, "schemaVersion", "agentcert.assurance_scope.v0.1", errors);
+    if (value.schemaVersion !== "agentcert.assurance_scope.v0.1" && value.schemaVersion !== "agentcert.assurance_scope.v0.2") {
+        errors.push("schemaVersion must be agentcert.assurance_scope.v0.1 or agentcert.assurance_scope.v0.2.");
+    }
     for (const key of ["agent", "model", "prompt", "tools", "policy", "scenarioSuite"])
         requiredObject(value, key, errors);
     const agent = recordValue(value.agent);
@@ -394,6 +504,34 @@ function validateAssuranceScope(value, errors) {
         requiredStringAt(suite, "version", "scenarioSuite.version", errors);
         requiredSha256At(suite, "sha256", "scenarioSuite.sha256", errors);
     }
+    if (value.schemaVersion === "agentcert.assurance_scope.v0.2") {
+        for (const key of ["runtimeBoundary", "outcomeProbe", "evidenceTrust"])
+            requiredObject(value, key, errors);
+        const runtime = recordValue(value.runtimeBoundary);
+        const probe = recordValue(value.outcomeProbe);
+        const trust = recordValue(value.evidenceTrust);
+        if (runtime) {
+            requiredSha256At(runtime, "gatewayDigestSha256", "runtimeBoundary.gatewayDigestSha256", errors);
+            requiredSha256At(runtime, "adapterDigestSha256", "runtimeBoundary.adapterDigestSha256", errors);
+            requiredStringAt(runtime, "credentialBoundary", "runtimeBoundary.credentialBoundary", errors);
+            requiredSha256At(runtime, "networkBoundarySha256", "runtimeBoundary.networkBoundarySha256", errors);
+            requiredStringAt(runtime, "grantIssuer", "runtimeBoundary.grantIssuer", errors);
+        }
+        if (probe) {
+            requiredStringAt(probe, "profileId", "outcomeProbe.profileId", errors);
+            requiredStringAt(probe, "version", "outcomeProbe.version", errors);
+            requiredSha256At(probe, "digestSha256", "outcomeProbe.digestSha256", errors);
+            requiredStringAt(probe, "authoritativeSource", "outcomeProbe.authoritativeSource", errors);
+            requiredStringAt(probe, "readCredentialBoundary", "outcomeProbe.readCredentialBoundary", errors);
+        }
+        if (trust) {
+            requiredSha256At(trust, "collectorDigestSha256", "evidenceTrust.collectorDigestSha256", errors);
+            requiredStringAt(trust, "evidenceSchemaVersion", "evidenceTrust.evidenceSchemaVersion", errors);
+            requiredStringAt(trust, "signingKeyId", "evidenceTrust.signingKeyId", errors);
+            requiredSha256At(trust, "verifierDigestSha256", "evidenceTrust.verifierDigestSha256", errors);
+            requiredSha256At(trust, "retentionPolicySha256", "evidenceTrust.retentionPolicySha256", errors);
+        }
+    }
 }
 function requiredSha256At(value, key, path, errors) {
     if (typeof value[key] !== "string" || !/^[0-9a-f]{64}$/.test(value[key]))

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "witnora",
-  "version": "0.9.3",
-  "description": "Witnora evidence, assurance release gates, runtime records, and regression CI for autonomous AI systems.",
+  "version": "0.10.0",
+  "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "Apache-2.0",
   "homepage": "https://witnora.com/",