witnora 0.9.3 → 0.10.2

package/dist/cli.js

@@ -28,6 +28,15 @@ import { runBrowserAdapterCommand } from "./browser-adapter.js";
 import { parseAgentTemplate, starterAdapter, starterGitHubActionWorkflow, starterInstructions, starterProfile, starterTripwireConfig, } from "./onboarding-templates.js";
 import { renderTrySummary, writeTryEvidence } from "./try.js";
 import { applyGuidedSetup } from "./guided-setup.js";
+import { resolveRuntimeContext } from "./runtime-context.js";
+import { compileAssuranceContract, diffAssuranceContracts, exampleAssuranceContract, readAssuranceContract, renderContractExplanation, } from "./assurance-contract.js";
+import { examplePrivacyManifest, inspectPrivacy } from "./privacy-manifest.js";
+import { renderOfflineVerification, verifyEvidencePacket } from "./offline-verifier.js";
+import { runAssuranceLoopDemo } from "./assurance-loop-demo.js";
+import { importGenericEval, renderGenericEvalReport } from "./generic-eval.js";
+import { runDesignPartnerCommand } from "./design-partner-v02.js";
+import { runOnboard } from "./onboard.js";
+import { verifyEvidencePacketV02 } from "./evidence-v02.js";
 process.on("uncaughtException", reportFatalError);
 process.on("unhandledRejection", reportFatalError);
 const command = process.argv[2] ?? "help";
@@ -37,6 +46,115 @@ const commandHelp = process.argv.some((argument) => argument === "--help" || arg
 if (commandHelp) {
     process.stdout.write(commandHelp);
 }
+else if (command === "contract") {
+    const action = process.argv[3] ?? "help";
+    if (action === "init") {
+        const out = resolve(readFlag("--out") ?? "witnora.assurance-contract.json");
+        await writeStarterFile(out, `${JSON.stringify(exampleAssuranceContract(), null, 2)}\n`, readBoolFlag("--force"));
+        process.stdout.write(`Wrote ${out}\n`);
+    }
+    else if (action === "validate" || action === "explain") {
+        const path = readFlag("--contract") ?? process.argv[4];
+        if (!path)
+            throw new Error("A contract path is required.");
+        process.stdout.write(renderContractExplanation(await readAssuranceContract(path)));
+    }
+    else if (action === "compile") {
+        const path = readFlag("--contract") ?? process.argv[4];
+        if (!path)
+            throw new Error("A contract path is required.");
+        const out = resolve(readFlag("--out") ?? ".witnora/contract/compiled-contract.json");
+        await mkdir(dirname(out), { recursive: true });
+        await writeFile(out, `${JSON.stringify(compileAssuranceContract(await readAssuranceContract(path)), null, 2)}\n`);
+        process.stdout.write(`Wrote deterministic compiler output ${out}\n`);
+    }
+    else if (action === "diff") {
+        const previous = readFlag("--from");
+        const next = readFlag("--to");
+        if (!previous || !next)
+            throw new Error("Contract diff requires --from <contract> and --to <contract>.");
+        process.stdout.write(`${JSON.stringify(diffAssuranceContracts(await readAssuranceContract(previous), await readAssuranceContract(next)), null, 2)}\n`);
+    }
+    else {
+        throw new Error("Use witnora contract init|validate|compile|diff|explain.");
+    }
+}
+else if (command === "privacy") {
+    const action = process.argv[3] ?? "help";
+    if (action === "init") {
+        const out = resolve(readFlag("--out") ?? "witnora.privacy-manifest.json");
+        await writeStarterFile(out, `${JSON.stringify(examplePrivacyManifest(), null, 2)}\n`, readBoolFlag("--force"));
+        process.stdout.write(`Wrote ${out}\n`);
+    }
+    else if (action === "inspect") {
+        const path = readFlag("--manifest") ?? process.argv[4];
+        if (!path)
+            throw new Error("A Privacy Manifest path is required.");
+        process.stdout.write(inspectPrivacy(await readJson(path)));
+    }
+    else {
+        throw new Error("Use witnora privacy init|inspect.");
+    }
+}
+else if (command === "design-partner") {
+    await runDesignPartnerCommand(process.argv.slice(3));
+}
+else if (command === "verify") {
+    const path = readFlag("--offline") ?? readFlag("--packet") ?? process.argv[3];
+    if (!path || path.startsWith("--"))
+        throw new Error("Use witnora verify --offline <packet.json>.");
+    const trustPath = readFlag("--trust");
+    const packet = await readJson(path);
+    if (packet.protocolVersion === "witnora.verifiable_evidence_packet.v0.2") {
+        const revocationPath = readFlag("--revocation-journal");
+        if (!trustPath || !revocationPath)
+            throw new Error("Evidence v0.2 requires --trust <pinned-root.json> and --revocation-journal <latest.json>.");
+        const report = verifyEvidencePacketV02(packet, await readJson(trustPath), new Date(), await readJson(revocationPath));
+        process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+        if (report.overall !== "PASS")
+            process.exitCode = 1;
+    }
+    else {
+        const report = verifyEvidencePacket(packet, new Date(), trustPath ? await readJson(trustPath) : undefined);
+        process.stdout.write(readBoolFlag("--json") ? `${JSON.stringify(report, null, 2)}\n` : renderOfflineVerification(report));
+        if (report.overall !== "PASS")
+            process.exitCode = 1;
+    }
+}
+else if (command === "demo") {
+    if (process.argv[3] !== "assurance-loop")
+        throw new Error("Use witnora demo assurance-loop.");
+    const attack = (readFlag("--attack") ?? "none");
+    if (!["none", "parameter-substitution", "replay", "false-success", "event-tamper"].includes(attack))
+        throw new Error("Unsupported --attack value.");
+    const outcome = await runAssuranceLoopDemo({ outDir: readFlag("--out") ?? ".witnora/assurance-loop", attack });
+    process.stdout.write(renderOfflineVerification(outcome.report));
+    process.stdout.write(`Evidence packet: ${outcome.packetPath}\nTrust bundle: ${outcome.trustBundlePath}\nVerification report: ${outcome.reportPath}\nRevalidation diff: ${outcome.revalidationPath}\n`);
+    if (outcome.report.overall !== "PASS")
+        process.exitCode = 1;
+}
+else if (command === "import") {
+    if (readFlag("--format") !== "generic-eval")
+        throw new Error("Use witnora import --format generic-eval <result.json>.");
+    const path = process.argv.find((argument, index) => index >= 3 && !argument.startsWith("--") && process.argv[index - 1] !== "--format" && process.argv[index - 1] !== "--out");
+    if (!path)
+        throw new Error("A generic eval result path is required.");
+    const report = await importGenericEval(path, readBoolFlag("--dry-run") ? undefined : readFlag("--out") ?? ".witnora/import/generic-eval-report.json");
+    process.stdout.write(readBoolFlag("--json") ? `${JSON.stringify(report, null, 2)}\n` : renderGenericEvalReport(report));
+}
+else if (command === "onboard") {
+    const projectId = readFlag("--project") ?? brandedEnvironment("PROJECT_ID");
+    if (!projectId)
+        throw new Error("--project <project-id> is required.");
+    await runOnboard({
+        projectId,
+        server: readFlag("--server") ?? brandedEnvironment("BASE_URL") ?? DEFAULT_WITNORA_SERVER,
+        name: readFlag("--name"),
+        repository: readFlag("--repo") ?? process.cwd(),
+        template: readFlag("--template") ? parseAgentTemplate(readFlag("--template")) : undefined,
+        openBrowser: readBoolFlag("--no-browser") ? async () => { } : undefined,
+    });
+}
 else if (command === "try") {
     const template = parseAgentTemplate(readFlag("--template") ?? "workflow");
     const subject = readFlag("--subject") ?? `witnora-sample-${template}`;
@@ -535,6 +653,8 @@ else if (command === "schema") {
   witnora schema validate --schema assurance-report --file assurance-report.json
   witnora schema validate --schema assurance-delivery --file assurance-delivery.json
   witnora schema validate --schema evidence-signature --file .witnora/latest/agentcert-evidence.json.sig.json
+  witnora schema validate --schema assurance-wallet --file assurance-wallet.json
+  witnora schema validate --schema payment-token-reference --file payment-token-reference.json
 `);
     }
 }
@@ -596,6 +716,7 @@ else if (command === "conformance") {
 }
 else {
     process.stdout.write(`Usage:
+  witnora onboard --project <project-id>
   witnora try --template workflow [--push]
   witnora init --subject my-browser-agent
   witnora connect --server https://witnora.com --project <project-id>
@@ -665,6 +786,17 @@ async function pushHostedEvidence(bundle, bytes, fileName) {
         skippedCompanionArtifacts: companions?.skipped,
         assurance,
         verifyContinuousAssurance: Boolean(assurance && (healthOut || requireCurrent)),
+        runtimeContext: await resolveRuntimeContext({
+            subject: bundle.subject.name,
+            framework: readFlag("--agent-framework"),
+            env: {
+                ...process.env,
+                ...(readFlag("--agent-id") ? { WITNORA_AGENT_ID: readFlag("--agent-id") } : {}),
+                ...(readFlag("--agent-name") ? { WITNORA_AGENT_NAME: readFlag("--agent-name") } : {}),
+                ...(readFlag("--agent-version") ? { WITNORA_AGENT_VERSION: readFlag("--agent-version") } : {}),
+                ...(readFlag("--environment") ? { WITNORA_ENVIRONMENT: readFlag("--environment") } : {}),
+            },
+        }),
     });
     process.stdout.write(`Hosted run: ${result.runId}\nHosted evidence: ${result.evidenceId}\n`);
     if (companions) {

package/dist/command-help.js

@@ -1,6 +1,82 @@
 export function renderCommandHelp(command) {
     if (command === "sandbox" || command === "browser-adapter")
         return undefined;
+    if (command === "onboard")
+        return `Usage:
+  witnora onboard --project <project-id>
+  witnora onboard --project <project-id> --template <browser|coding|mcp|workflow|data>
+
+Opens one browser authorization, saves a restricted project credential, detects the repository,
+writes missing starter files, and records an isolated synthetic self-test receipt. The self-test
+does not create assurance evidence or establish CURRENT status.
+
+Options:
+  --server <url>          Hosted server (default: https://witnora.com)
+  --project <id>          Project to authorize (required)
+  --name <name>           Saved connection name (default: repository name)
+  --repo <directory>      Repository to configure (default: current directory)
+  --template <type>       Override automatic repository detection
+  --no-browser            Print the approval URL without opening it
+`;
+    if (command === "design-partner")
+        return `Usage:
+  witnora design-partner init github-pr-merge [--out .witnora/design-partner]
+  witnora design-partner doctor [--dir .witnora/design-partner]
+  witnora design-partner privacy inspect
+  witnora design-partner trust inspect
+  witnora design-partner trust revoke-probe [--effective-at <timestamp>] [--retroactive]
+  witnora design-partner trust rotate-probe
+  witnora design-partner dry-run
+  witnora design-partner run-acceptance
+  witnora design-partner prepare-live-github --repository owner/sandbox-repo --pull-request 1
+  witnora design-partner verify-offline --packet <packet.json> --root <pinned-root.json> [--revocation-journal <latest.json>]
+
+The v0.2 acceptance path is emulator-only. The optional live GitHub command is a
+read-only preflight and cannot mutate or produce acceptance evidence for a repository.
+`;
+    if (command === "contract")
+        return `Usage:
+  witnora contract init [--out witnora.assurance-contract.json]
+  witnora contract validate <contract.json>
+  witnora contract compile <contract.json> [--out compiled-contract.json]
+  witnora contract diff --from previous.json --to next.json
+  witnora contract explain <contract.json>
+
+Contracts are strict JSON (also valid YAML 1.2). Unknown fields are rejected.
+`;
+    if (command === "privacy")
+        return `Usage:
+  witnora privacy init [--out witnora.privacy-manifest.json]
+  witnora privacy inspect <manifest.json>
+
+The manifest defaults to deny and classifies fields as local_only, disclose, or commit_only.
+`;
+    if (command === "verify")
+        return `Usage:
+  witnora verify --offline <witnora-evidence-packet.json> --trust <trust-bundle.json>
+  witnora verify --offline <packet.json> --trust <trust-bundle.json> --json
+
+Performs deterministic local verification without network access. Keys embedded in a packet
+are never trust anchors; missing caller-supplied trust returns UNVERIFIABLE.
+`;
+    if (command === "demo")
+        return `Usage:
+  witnora demo assurance-loop [--out .witnora/assurance-loop]
+  witnora demo assurance-loop --attack <parameter-substitution|replay|false-success|event-tamper>
+
+Runs a generic local high-risk action through contract, policy, approval, single-use grant,
+controlled execution, independent observation, signed evidence, and offline verification.
+No external system or credential is used.
+`;
+    if (command === "import")
+        return `Usage:
+  witnora import --format generic-eval <result.json> [--out .witnora/import/generic-eval-report.json]
+  witnora import --format generic-eval <result.json> --dry-run
+
+Normalizes framework-independent evaluation results and reports apparent success,
+independently verified success, Assurance Gap, explicit denominators, and exclusions.
+Imported results are unreviewed and never establish CURRENT assurance.
+`;
     if (command === "setup")
         return `Usage:
   witnora setup apply --plan witnora-setup-plan.json --repo .
@@ -59,6 +135,11 @@ Options:
   --project <id>         Hosted project ID
   --api-key <key>        Project API key (prefer WITNORA_API_KEY in CI)
   --external-id <id>     Idempotent hosted run ID
+  --agent-id <id>        Stable observed Agent identity (default: evidence subject)
+  --agent-name <name>    Human-readable observed Agent name
+  --agent-version <v>    Version override (default: package or CI commit)
+  --agent-framework <f>  Framework metadata override
+  --environment <env>    sandbox, staging, or production
   --assurance-case <id>  Issued assurance case to reconcile
   --assurance-scope <p>  Declared agent/model/prompt/tools/policy/suite scope JSON
   --assurance-trigger <t> auto, pull_request, release, or nightly (default: auto)

package/dist/control-plane.js

@@ -30,13 +30,13 @@ export async function verifyControlPlaneConnection(options) {
     }
     catch (error) {
         if (error instanceof ControlPlaneRequestError && error.status === 401) {
-            throw new Error("AgentCert API key was rejected. Create a new project API key and try again.");
+            throw new Error("Witnora API key was rejected. Run `witnora onboard --project <project-id>` again or replace the revoked key.");
         }
         if (error instanceof ControlPlaneRequestError && error.status === 403) {
-            throw new Error(`AgentCert API key cannot access project ${options.projectId}. Check the project ID and key scope.`);
+            throw new Error(`Witnora API key cannot access project ${options.projectId}. Check the project ID and key scope.`);
         }
         if (error instanceof ControlPlaneRequestError && error.status === 404) {
-            throw new Error(`AgentCert project ${options.projectId} was not found.`);
+            throw new Error(`Witnora project ${options.projectId} was not found.`);
         }
         throw error;
     }
@@ -75,6 +75,15 @@ export async function pushEvidenceToControlPlane(options) {
                 subject: bundle.subject,
                 products: bundle.summary.products,
             },
+            ...(options.runtimeContext ? {
+                agent: {
+                    externalId: options.runtimeContext.agentId,
+                    name: options.runtimeContext.agentName,
+                    version: options.runtimeContext.agentVersion,
+                    framework: options.runtimeContext.framework,
+                },
+                environment: options.runtimeContext.environment,
+            } : {}),
             assurance: options.assurance,
         }),
     });

package/dist/credentials.js

@@ -46,7 +46,7 @@ export async function resolveConnection(options = {}) {
     };
     const missing = Object.entries(candidate).filter(([, value]) => !value).map(([key]) => key);
     if (missing.length > 0) {
-        throw new Error(`Hosted connection is incomplete (${missing.join(", ")} missing). Run \`witnora connect\` or set WITNORA_BASE_URL, WITNORA_PROJECT_ID, and WITNORA_API_KEY. Legacy AGENTCERT_* variables remain supported.`);
+        throw new Error(`Hosted connection is incomplete (${missing.join(", ")} missing). Run \`witnora onboard --project <project-id>\` or set WITNORA_BASE_URL, WITNORA_PROJECT_ID, and WITNORA_API_KEY. Legacy AGENTCERT_* variables remain supported.`);
     }
     return validateConnection(candidate);
 }