witnora 0.9.3 → 0.10.2

package/dist/offline-verifier.js

@@ -0,0 +1,375 @@
+import { createHash, createPublicKey, verify } from "node:crypto";
+import { compileAssuranceContract, parseContractDurationMs, validateAssuranceContract } from "./assurance-contract.js";
+import { canonicalJson, sha256Canonical } from "./canonical.js";
+import { validatePrivacyManifest, validatePrivacyTransformAgainstManifest } from "./privacy-manifest.js";
+import { evaluateOutcome, predicateMatches } from "./outcome-evaluator.js";
+export const VERIFIABLE_EVIDENCE_PACKET_VERSION = "witnora.verifiable_evidence_packet.v0.1";
+export function sourceSignedValue(packet) {
+    return { packetId: packet.packetId, privacy: packet.privacy.transformed, action: packet.action, precondition: packet.precondition, resourceScopeProof: packet.resourceScopeProof, policy: packet.policy, approval: packet.approval, events: packet.events, outcome: packet.outcome };
+}
+export function serverAttestedValue(packet) {
+    return {
+        packetId: packet.packetId,
+        contractDigest: packet.compiledContract.sourceContractDigest,
+        privacyManifestDigest: packet.privacy.transformed.privacyManifestDigest,
+        privacyTransformDigest: sha256Canonical(packet.privacy.transformed),
+        actionDigest: packet.action.digest,
+        preconditionDigest: sha256Canonical(packet.precondition),
+        resourceScopeProofDigest: sha256Canonical(packet.resourceScopeProof),
+        grant: packet.grant,
+        sourceDigest: sha256Canonical(sourceSignedValue(packet)),
+        outcomeDigest: sha256Canonical(packet.outcome),
+        artifactManifestDigest: sha256Canonical(packet.artifacts.map(({ contentBase64: _content, ...entry }) => entry)),
+        evidenceStrength: packet.evidenceStrength,
+    };
+}
+export function resourceScopeProofSignedValue(packet) {
+    const { signature: _signature, ...proof } = packet.resourceScopeProof;
+    return { packetId: packet.packetId, actionDigest: packet.action.digest, ...proof };
+}
+export function outcomeProbeSignedValue(packet) {
+    const { probeSignature: _signature, ...outcome } = packet.outcome;
+    return { packetId: packet.packetId, actionDigest: packet.action.digest, outcome };
+}
+export function preconditionProbeSignedValue(packet) {
+    const { probeSignature: _signature, ...precondition } = packet.precondition;
+    return { packetId: packet.packetId, actionDigest: packet.action.digest, precondition };
+}
+export function verifyEvidencePacket(input, now = new Date(), trustBundle) {
+    const steps = [];
+    const shapeError = validatePacketShape(input);
+    if (shapeError)
+        return report(undefined, [fail("PACKET_INVALID", shapeError)], now);
+    const packet = input;
+    const trustRoleReuse = trustBundle ? duplicateTrustRoleKey(trustBundle) : undefined;
+    if (trustRoleReuse)
+        steps.push(fail("TRUST_KEY_ROLE_REUSE", trustRoleReuse));
+    if (packet.schemaVersion !== VERIFIABLE_EVIDENCE_PACKET_VERSION)
+        steps.push(fail("SCHEMA_UNSUPPORTED", `Expected ${VERIFIABLE_EVIDENCE_PACKET_VERSION}.`));
+    else
+        steps.push(pass("SCHEMA_VALID", "Evidence packet schema version is supported."));
+    let contractValid = false;
+    try {
+        const contract = validateAssuranceContract(packet.contract);
+        const expected = compileAssuranceContract(contract);
+        contractValid = expected.sourceContractDigest === packet.compiledContract?.sourceContractDigest
+            && sha256Canonical(expected) === sha256Canonical(packet.compiledContract);
+        steps.push(contractValid ? pass("CONTRACT_COMPILED_MATCH", "Contract and deterministic compiler output match.") : fail("CONTRACT_DIGEST_MISMATCH", "Compiled contract does not match the source contract."));
+    }
+    catch (error) {
+        steps.push(fail("CONTRACT_INVALID", error instanceof Error ? error.message : String(error)));
+    }
+    let privacyValid = false;
+    try {
+        const manifest = validatePrivacyManifest(packet.privacy?.manifest);
+        const transformErrors = validatePrivacyTransformAgainstManifest(manifest, packet.privacy?.transformed);
+        privacyValid = transformErrors.length === 0;
+        steps.push(privacyValid
+            ? pass("PRIVACY_MANIFEST_MATCH", "Every disclosed, committed, and omitted path matches the signed deny-by-default Privacy Manifest.")
+            : fail("PRIVACY_MANIFEST_MISMATCH", transformErrors.join(" ")));
+    }
+    catch (error) {
+        steps.push(fail("PRIVACY_MANIFEST_INVALID", error instanceof Error ? error.message : String(error)));
+    }
+    const actionDigest = sha256Canonical(packet.action?.canonical);
+    const bindings = [packet.action?.digest, packet.policy?.actionDigest, packet.approval?.actionDigest, packet.grant?.actionDigest];
+    steps.push(bindings.every((value) => value === actionDigest)
+        ? pass("ACTION_BINDING_VALID", "Policy, approval, and grant bind the exact canonical action digest.")
+        : fail("ACTION_BINDING_MISMATCH", "Policy, approval, or grant binds a different action digest."));
+    const privacyBindingsValid = privacyValid
+        && packet.privacy.transformed.commitments.resourceId?.digest === packet.action.canonical.resourceCommitment
+        && packet.privacy.transformed.commitments.actionParameters?.digest === packet.action.canonical.parameterCommitment;
+    steps.push(privacyBindingsValid
+        ? pass("PRIVACY_COMMITMENT_BINDING_VALID", "Canonical action commitments match the tenant-keyed privacy transform.")
+        : fail("PRIVACY_COMMITMENT_BINDING_MISMATCH", "Canonical action resource or parameters do not match the privacy commitments."));
+    const canonicalAction = packet.action?.canonical ?? {};
+    const actionScopeValid = canonicalAction.agentRef === `agent:${packet.contract?.subject?.agentId}`
+        && canonicalAction.environment === packet.contract?.subject?.environment
+        && canonicalAction.capability === packet.contract?.capability?.id
+        && canonicalAction.action === packet.contract?.capability?.action
+        && canonicalAction.contractDigest === packet.compiledContract?.sourceContractDigest
+        && canonicalAction.policyRef === packet.contract?.authority?.policyRef
+        && canonicalAction.mandateRef === packet.contract?.authority?.mandateRef;
+    steps.push(actionScopeValid ? pass("ACTION_SCOPE_VALID", "Canonical action matches the declared Agent, environment, capability, Contract, Policy, and Mandate.") : fail("ACTION_SCOPE_MISMATCH", "Canonical action is outside the declared Contract scope."));
+    const requiredDecision = packet.contract.authority.approval.required ? "REQUIRE_APPROVAL" : "ALLOW";
+    const policyValid = packet.policy.decision === requiredDecision && packet.policy.policyRef === packet.contract.authority.policyRef;
+    steps.push(policyValid
+        ? pass("POLICY_DECISION_VALID", `Policy decision ${requiredDecision} matches the Contract authority requirement.`)
+        : fail("POLICY_DECISION_MISMATCH", `Expected policy decision ${requiredDecision} for the declared Contract.`));
+    const executionEvent = packet.events.find((event) => event.type === "witnora.action.executed");
+    const dispatchAt = executionEvent ? Date.parse(executionEvent.occurredAt) : Number.NaN;
+    const scopeProofBound = packet.resourceScopeProof.decision === "ALLOW"
+        && packet.resourceScopeProof.contractScopeDigest === sha256Canonical(packet.contract.authority.resourceScope)
+        && packet.resourceScopeProof.resourceCommitment === canonicalAction.resourceCommitment
+        && Date.parse(packet.resourceScopeProof.evaluatedAt) <= dispatchAt;
+    steps.push(scopeProofBound
+        ? pass("RESOURCE_SCOPE_PROOF_BOUND", "A policy evaluator allowed the committed resource under the exact Contract scope.")
+        : fail("RESOURCE_SCOPE_PROOF_INVALID", "Resource scope proof is denied, malformed, or bound to a different resource or Contract scope."));
+    const approvalContextValid = packet.approval?.approved
+        && packet.approval.tenantRef === canonicalAction.tenantRef
+        && packet.approval.agentRef === canonicalAction.agentRef
+        && packet.approval.environment === canonicalAction.environment
+        && packet.approval.contractDigest === canonicalAction.contractDigest
+        && packet.approval.policyRef === canonicalAction.policyRef
+        && packet.approval.resourceCommitment === canonicalAction.resourceCommitment
+        && Number.isFinite(dispatchAt)
+        && dispatchAt <= Date.parse(packet.approval.expiresAt);
+    steps.push(approvalContextValid ? pass("APPROVAL_CONTEXT_VALID", "Approval binds the exact tenant, Agent, environment, Contract, Policy, resource, and expiry.") : fail("APPROVAL_CONTEXT_MISMATCH", "Approval context is incomplete, expired, or differs from the canonical action."));
+    const grantContextValid = packet.grant?.tenantRef === canonicalAction.tenantRef
+        && packet.grant?.agentRef === canonicalAction.agentRef
+        && packet.grant?.environment === canonicalAction.environment
+        && packet.grant?.policyRef === canonicalAction.policyRef
+        && packet.grant?.mandateRef === canonicalAction.mandateRef
+        && packet.grant?.resourceCommitment === canonicalAction.resourceCommitment;
+    steps.push(grantContextValid ? pass("GRANT_CONTEXT_VALID", "Execution Grant binds the exact authorization context.") : fail("GRANT_CONTEXT_MISMATCH", "Execution Grant context differs from the approved canonical action."));
+    const grantIssuedAt = Date.parse(packet.grant.issuedAt);
+    const grantExpiresAt = Date.parse(packet.grant.expiresAt);
+    const grantRevokedAt = packet.grant.revokedAt ? Date.parse(packet.grant.revokedAt) : undefined;
+    const grantWindow = Number.isFinite(dispatchAt)
+        && Number.isFinite(grantIssuedAt)
+        && Number.isFinite(grantExpiresAt)
+        && grantIssuedAt <= dispatchAt
+        && dispatchAt <= grantExpiresAt
+        && (grantRevokedAt === undefined || (Number.isFinite(grantRevokedAt) && dispatchAt < grantRevokedAt));
+    const singleUse = packet.grant?.maxUses === 1 && packet.grant?.consumedCount === 1;
+    steps.push(grantWindow && singleUse
+        ? pass("GRANT_SINGLE_USE_VALID", "Grant is unrevoked, unexpired, and consumed exactly once.")
+        : fail("GRANT_INVALID", "Grant is expired, revoked, malformed, unconsumed, or reused."));
+    if (contractValid && packet.grant?.contractDigest !== packet.compiledContract.sourceContractDigest)
+        steps.push(fail("GRANT_CONTRACT_MISMATCH", "Grant binds a different contract digest."));
+    else
+        steps.push(pass("GRANT_CONTRACT_MATCH", "Grant binds the compiled contract digest."));
+    const eventStep = verifyEventChain(packet.events);
+    steps.push(eventStep);
+    const artifactStep = verifyArtifacts(packet.artifacts);
+    steps.push(artifactStep);
+    const trustContext = {
+        tenantRef: String(canonicalAction.tenantRef), projectRef: String(canonicalAction.projectRef),
+        environment: String(canonicalAction.environment), at: dispatchAt,
+    };
+    const sourceStep = verifySignedValue(sourceSignedValue(packet), packet.sourceSignature, trustBundle, "SOURCE_SIGNATURE", "source", trustContext);
+    steps.push(sourceStep);
+    const serverStep = verifySignedValue(serverAttestedValue(packet), packet.serverAttestation, trustBundle, "SERVER_ATTESTATION", "server_attestor", trustContext);
+    steps.push(serverStep);
+    const preconditionProbeStep = verifySignedValue(preconditionProbeSignedValue(packet), packet.precondition?.probeSignature, trustBundle, "PRECONDITION_PROBE_SIGNATURE", "outcome_probe", trustContext);
+    steps.push(preconditionProbeStep);
+    const probeStep = verifySignedValue(outcomeProbeSignedValue(packet), packet.outcome?.probeSignature, trustBundle, "OUTCOME_PROBE_SIGNATURE", "outcome_probe", trustContext);
+    steps.push(probeStep);
+    const scopeStep = verifySignedValue(resourceScopeProofSignedValue(packet), packet.resourceScopeProof.signature, trustBundle, "RESOURCE_SCOPE_SIGNATURE", "resource_scope_evaluator", trustContext);
+    steps.push(scopeStep);
+    const eventualMs = contractValid ? parseContractDurationMs(packet.contract.effect.eventuallyWithin) : undefined;
+    const preconditionEvent = packet.events.find((event) => event.type === "witnora.precondition.observed");
+    const preconditionEventAt = preconditionEvent ? Date.parse(preconditionEvent.occurredAt) : Number.NaN;
+    const preconditionObservedAt = Date.parse(packet.precondition?.observedAt);
+    const preconditionFreshness = packet.precondition?.dataFreshnessMs;
+    const preconditionTimingValid = eventualMs !== undefined
+        && Number.isFinite(preconditionObservedAt)
+        && preconditionObservedAt === preconditionEventAt
+        && preconditionObservedAt <= dispatchAt
+        && dispatchAt - preconditionObservedAt <= eventualMs
+        && Number.isFinite(preconditionFreshness)
+        && preconditionFreshness >= 0
+        && preconditionFreshness <= eventualMs;
+    const preconditionsSatisfied = contractValid
+        && packet.precondition?.status === "SATISFIED"
+        && packet.precondition?.probeRef === packet.contract.observation.probeRef
+        && packet.precondition?.independentReadPath === true
+        && preconditionTimingValid
+        && packet.contract.preconditions.every((predicate) => predicateMatches(packet.precondition.normalizedObservation, predicate));
+    const preconditionStep = preconditionsSatisfied
+        ? pass("PRECONDITIONS_INDEPENDENTLY_VERIFIED", "A separately signed, fresh pre-execution read satisfies every declared Contract precondition.")
+        : fail("PRECONDITIONS_NOT_VERIFIED", "The signed pre-execution observation is missing, stale, out of order, or does not satisfy the declared preconditions.");
+    steps.push(preconditionStep);
+    const outcomeObservedAt = Date.parse(packet.outcome?.observedAt ?? "");
+    const outcomeEvent = packet.events.find((event) => event.type === "witnora.outcome.observed");
+    const outcomeEventAt = outcomeEvent ? Date.parse(outcomeEvent.occurredAt) : Number.NaN;
+    const runCompletedAt = Date.parse(packet.events.at(-1)?.occurredAt ?? "");
+    const firstSatisfiedAt = packet.outcome?.firstSatisfiedAt ? Date.parse(packet.outcome.firstSatisfiedAt) : outcomeObservedAt;
+    const stableForMs = contractValid && packet.contract.effect.stableFor ? parseContractDurationMs(packet.contract.effect.stableFor) : 0;
+    const outcomeTimingValid = eventualMs !== undefined
+        && Number.isFinite(outcomeObservedAt)
+        && outcomeObservedAt === outcomeEventAt
+        && outcomeObservedAt <= runCompletedAt
+        && Number.isFinite(firstSatisfiedAt)
+        && outcomeObservedAt >= dispatchAt
+        && firstSatisfiedAt >= dispatchAt
+        && firstSatisfiedAt - dispatchAt <= eventualMs
+        && outcomeObservedAt - firstSatisfiedAt >= (stableForMs ?? Number.POSITIVE_INFINITY)
+        && Number.isFinite(packet.outcome?.dataFreshnessMs)
+        && Number(packet.outcome.dataFreshnessMs) >= 0
+        && Number(packet.outcome.dataFreshnessMs) <= eventualMs;
+    const outcomeTimingStep = outcomeTimingValid
+        ? pass("OUTCOME_TIMING_VALID", "The signed observation meets chronology, eventual, stability, and data-freshness requirements.")
+        : fail("OUTCOME_TIMING_INVALID", "The signed observation is stale, out of order, outside eventuallyWithin, or shorter than stableFor.");
+    steps.push(outcomeTimingStep);
+    const outcomeEvaluation = contractValid ? evaluateOutcome(packet.contract.effect, packet.outcome?.normalizedObservation, {
+        observationFailed: packet.outcome?.status === "OBSERVATION_FAILED",
+        timedOut: packet.outcome?.status === "TIMED_OUT",
+        stale: packet.outcome?.status === "STALE_OBSERVATION" || !outcomeTimingValid,
+        targetAuditReconciled: packet.outcome?.targetAuditReconciled,
+        targetAuditConflict: packet.outcome?.targetAuditConflict,
+    }) : undefined;
+    const outcomeBound = packet.outcome?.expectedDigest === sha256Canonical(packet.contract?.effect)
+        && packet.outcome?.probeRef === packet.contract?.observation?.probeRef
+        && packet.outcome?.status === outcomeEvaluation?.status;
+    const outcomeStep = outcomeBound && outcomeEvaluation?.status === "VERIFIED" && packet.outcome.independentReadPath
+        ? pass("OUTCOME_INDEPENDENTLY_VERIFIED", "A separately signed read path satisfies the declared must and must_not predicates and reconciles target audit state.")
+        : outcomeEvaluation && ["INDETERMINATE", "OBSERVATION_FAILED", "TIMED_OUT", "STALE_OBSERVATION"].includes(outcomeEvaluation.status)
+            ? { code: "OUTCOME_UNVERIFIABLE", status: "UNVERIFIABLE", message: `Independent outcome is ${outcomeEvaluation.status}; success is not inferred.` }
+            : fail("OUTCOME_NOT_VERIFIED", "The signed observation, declared predicate, target audit, or claimed outcome status does not agree.");
+    steps.push(outcomeStep);
+    const claimed = packet.evidenceStrength;
+    const recordedPrerequisites = [eventStep, sourceStep];
+    const enforcedPrerequisites = [eventStep, sourceStep, serverStep, scopeStep, preconditionProbeStep, preconditionStep];
+    const outcomePrerequisites = [eventStep, sourceStep, serverStep, scopeStep, preconditionProbeStep, preconditionStep, probeStep, outcomeTimingStep, outcomeStep];
+    const unavailable = [...recordedPrerequisites, ...enforcedPrerequisites, ...outcomePrerequisites].some((step) => step.status === "UNVERIFIABLE");
+    const recordedProven = recordedPrerequisites.every((step) => step.status === "PASS");
+    const enforcedProven = enforcedPrerequisites.every((step) => step.status === "PASS")
+        && steps.filter((step) => ["PRIVACY_MANIFEST_MATCH", "ACTION_BINDING_VALID", "PRIVACY_COMMITMENT_BINDING_VALID", "ACTION_SCOPE_VALID", "POLICY_DECISION_VALID", "RESOURCE_SCOPE_PROOF_BOUND", "APPROVAL_CONTEXT_VALID", "GRANT_CONTEXT_VALID", "GRANT_SINGLE_USE_VALID", "GRANT_CONTRACT_MATCH", "PRECONDITIONS_INDEPENDENTLY_VERIFIED"].includes(step.code)).every((step) => step.status === "PASS");
+    const outcomeProven = enforcedProven && outcomePrerequisites.every((step) => step.status === "PASS");
+    const overclaimed = (claimed.recorded && !recordedProven)
+        || (claimed.enforced && (!claimed.recorded || !enforcedProven))
+        || (claimed.outcomeVerified && (!claimed.enforced || !outcomeProven))
+        || claimed.independentlyReviewed;
+    steps.push(overclaimed
+        ? unavailable && !claimed.independentlyReviewed
+            ? { code: "EVIDENCE_STRENGTH_UNVERIFIABLE", status: "UNVERIFIABLE", message: "Caller trust is insufficient to establish the claimed evidence strength." }
+            : fail("EVIDENCE_STRENGTH_OVERCLAIM", "Evidence strength claims a level not established by the packet, or claims independent review without a reviewer attestation.")
+        : pass("EVIDENCE_STRENGTH_CONSISTENT", "Evidence strength does not exceed verified facts."));
+    return report(packet.packetId, steps, now);
+}
+export function renderOfflineVerification(report) {
+    return [
+        `Witnora offline verification: ${report.overall}`,
+        `Packet: ${report.packetId ?? "unknown"}`,
+        "Network used: no",
+        ...report.steps.map((step) => `${step.status.padEnd(12)} ${step.code}: ${step.message}`),
+    ].join("\n") + "\n";
+}
+function verifyEventChain(events) {
+    if (!Array.isArray(events) || events.length < 2)
+        return fail("EVENT_CHAIN_INCOMPLETE", "At least run start and run end events are required.");
+    let previousHash = null;
+    let previousTime = -Infinity;
+    for (let index = 0; index < events.length; index += 1) {
+        const event = events[index];
+        if (event.sequence !== index + 1)
+            return fail("EVENT_SEQUENCE_GAP", `Expected sequence ${index + 1}, received ${event.sequence}.`);
+        if (event.previousHash !== previousHash)
+            return fail("EVENT_PREVIOUS_HASH_MISMATCH", `Event ${event.sequence} does not reference the previous event.`);
+        const occurredAt = Date.parse(event.occurredAt);
+        if (!Number.isFinite(occurredAt) || occurredAt < previousTime)
+            return fail("EVENT_TIME_INVALID", `Event ${event.sequence} has an invalid or non-monotonic timestamp.`);
+        const eventHash = sha256Canonical({ sequence: event.sequence, type: event.type, occurredAt: event.occurredAt, previousHash: event.previousHash, payloadDigest: event.payloadDigest });
+        if (eventHash !== event.eventHash)
+            return fail("EVENT_HASH_MISMATCH", `Event ${event.sequence} hash is invalid.`);
+        previousHash = event.eventHash;
+        previousTime = occurredAt;
+    }
+    if (events[0].type !== "witnora.run.started" || events.at(-1)?.type !== "witnora.run.completed")
+        return fail("EVENT_SEMANTIC_ORDER_INVALID", "Event chain must begin with run.started and end with run.completed.");
+    const positions = ["witnora.precondition.observed", "witnora.policy.evaluated", "witnora.approval.recorded", "witnora.grant.consumed", "witnora.action.executed", "witnora.outcome.observed"].map((type) => events.findIndex((event) => event.type === type));
+    if (positions.some((position) => position < 0) || positions.some((position, index) => index > 0 && position <= positions[index - 1]))
+        return fail("EVENT_SEMANTIC_ORDER_INVALID", "Precondition, policy, approval, grant, execution, and outcome events are missing or out of order.");
+    return pass("EVENT_CHAIN_VALID", `${events.length} ordered events form a complete hash chain.`);
+}
+function verifyArtifacts(artifacts) {
+    if (!Array.isArray(artifacts) || !artifacts.length)
+        return { code: "ARTIFACTS_ABSENT", status: "PARTIAL", message: "No artifact bytes are embedded for offline verification." };
+    for (const artifact of artifacts) {
+        const bytes = Buffer.from(artifact.contentBase64, "base64");
+        if (bytes.byteLength !== artifact.size || createHash("sha256").update(bytes).digest("hex") !== artifact.sha256)
+            return fail("ARTIFACT_MISMATCH", `Artifact ${artifact.path} does not match its size or raw-byte SHA-256 digest.`);
+    }
+    return pass("ARTIFACTS_VALID", `${artifacts.length} artifact entries match embedded bytes.`);
+}
+function verifySignedValue(value, signature, trustBundle, prefix, usage, context) {
+    if (!signature || signature.algorithm !== "Ed25519")
+        return fail(`${prefix}_MISSING`, "Required Ed25519 signature is missing.");
+    const digest = sha256Canonical(value);
+    if (digest !== signature.valueDigest)
+        return fail(`${prefix}_DIGEST_MISMATCH`, "Signed value digest does not match the packet.");
+    const trustedKey = trustBundle?.schemaVersion === "witnora.verification_trust_bundle.v0.1" ? trustBundle.keys[signature.keyId] : undefined;
+    if (!trustedKey)
+        return { code: `${prefix}_UNTRUSTED_KEY`, status: "UNVERIFIABLE", message: `${signature.keyId} is not present in the caller-supplied trust bundle.` };
+    if (trustedKey.usage !== usage)
+        return fail(`${prefix}_KEY_USAGE_MISMATCH`, `Trusted key usage ${trustedKey.usage} cannot satisfy ${usage}.`);
+    if ((trustedKey.tenantRef && trustedKey.tenantRef !== context.tenantRef)
+        || (trustedKey.projectRef && trustedKey.projectRef !== context.projectRef)
+        || (trustedKey.environment && trustedKey.environment !== context.environment))
+        return fail(`${prefix}_TRUST_DOMAIN_MISMATCH`, "Trusted key is outside the packet tenant, project, or environment trust domain.");
+    const notBefore = trustedKey.notBefore ? Date.parse(trustedKey.notBefore) : -Infinity;
+    const notAfter = trustedKey.notAfter ? Date.parse(trustedKey.notAfter) : Infinity;
+    const revokedAt = trustedKey.revokedAt ? Date.parse(trustedKey.revokedAt) : Infinity;
+    if (!Number.isFinite(context.at) || Number.isNaN(notBefore) || Number.isNaN(notAfter) || Number.isNaN(revokedAt)
+        || context.at < notBefore || context.at >= notAfter || context.at >= revokedAt)
+        return fail(`${prefix}_TRUST_KEY_INACTIVE`, "Trusted key is not active at the execution time.");
+    if (signature.publicKeyPem && signature.publicKeyPem !== trustedKey.publicKeyPem)
+        return fail(`${prefix}_EMBEDDED_KEY_MISMATCH`, "Embedded key differs from the trusted key.");
+    try {
+        const valid = verify(null, Buffer.from(canonicalJson(value)), createPublicKey(trustedKey.publicKeyPem), Buffer.from(signature.signature, "base64"));
+        return valid ? pass(`${prefix}_VALID`, `${signature.keyId} signature is valid.`) : fail(`${prefix}_INVALID`, `${signature.keyId} signature is invalid.`);
+    }
+    catch (error) {
+        return fail(`${prefix}_INVALID_KEY`, error instanceof Error ? error.message : String(error));
+    }
+}
+function report(packetId, steps, now) {
+    const overall = steps.some((step) => step.status === "FAIL") ? "FAIL"
+        : steps.some((step) => step.status === "UNVERIFIABLE") ? "UNVERIFIABLE"
+            : steps.some((step) => step.status === "PARTIAL") ? "PARTIAL" : "PASS";
+    return { schemaVersion: "witnora.offline_verification_report.v0.1", overall, packetId, verifiedAt: now.toISOString(), networkUsed: false, steps };
+}
+function validatePacketShape(input) {
+    if (!input || typeof input !== "object" || Array.isArray(input))
+        return "Packet must be an object.";
+    const packet = input;
+    const required = ["schemaVersion", "packetId", "issuedAt", "contract", "compiledContract", "privacy", "action", "precondition", "resourceScopeProof", "policy", "approval", "grant", "events", "outcome", "artifacts", "evidenceStrength", "sourceSignature", "serverAttestation"];
+    for (const key of required)
+        if (!(key in packet))
+            return `Packet is missing required field ${key}.`;
+    const objects = ["contract", "compiledContract", "privacy", "action", "precondition", "resourceScopeProof", "policy", "approval", "grant", "outcome", "evidenceStrength", "sourceSignature", "serverAttestation"];
+    for (const key of objects)
+        if (!isRecord(packet[key]))
+            return `Packet field ${key} must be an object.`;
+    if (!Array.isArray(packet.events))
+        return "Packet field events must be an array.";
+    if (!Array.isArray(packet.artifacts))
+        return "Packet field artifacts must be an array.";
+    const privacy = packet.privacy;
+    const action = packet.action;
+    const precondition = packet.precondition;
+    const outcome = packet.outcome;
+    if (!isRecord(privacy.manifest) || !isRecord(privacy.transformed))
+        return "Packet privacy manifest and transform must be objects.";
+    if (!isRecord(privacy.transformed.commitments))
+        return "Packet privacy commitments must be an object.";
+    if (!isRecord(action.canonical))
+        return "Packet canonical action must be an object.";
+    if (!isRecord(precondition.normalizedObservation) || !isRecord(precondition.probeSignature))
+        return "Packet precondition observation and probe signature must be objects.";
+    if (!isRecord(packet.resourceScopeProof.signature))
+        return "Packet resource scope proof signature must be an object.";
+    if (!isRecord(outcome.normalizedObservation) || !isRecord(outcome.probeSignature))
+        return "Packet outcome observation and probe signature must be objects.";
+    return undefined;
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function duplicateTrustRoleKey(bundle) {
+    if (bundle.schemaVersion !== "witnora.verification_trust_bundle.v0.1")
+        return "Trust bundle schema version is unsupported.";
+    const usageByKey = new Map();
+    for (const [keyId, entry] of Object.entries(bundle.keys)) {
+        if (!entry || typeof entry.publicKeyPem !== "string")
+            return `Trust entry ${keyId} is malformed.`;
+        const prior = usageByKey.get(entry.publicKeyPem);
+        if (prior && prior !== entry.usage)
+            return `The same public key is registered for both ${prior} and ${entry.usage}; evidence roles require distinct key material.`;
+        usageByKey.set(entry.publicKeyPem, entry.usage);
+    }
+    return undefined;
+}
+function pass(code, message) { return { code, status: "PASS", message }; }
+function fail(code, message) { return { code, status: "FAIL", message }; }

package/dist/onboard.js

@@ -0,0 +1,132 @@
+import { createHash, randomBytes } from "node:crypto";
+import { spawn } from "node:child_process";
+import { access, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
+import { DEFAULT_WITNORA_SERVER, saveConnection } from "./credentials.js";
+import { verifyControlPlaneConnection } from "./control-plane.js";
+import { parseAgentTemplate, starterAdapter, starterProfile, starterTripwireConfig } from "./onboarding-templates.js";
+import { writeTryEvidence } from "./try.js";
+export async function runOnboard(options) {
+    const requestFetch = options.fetch ?? fetch;
+    const sleep = options.sleep ?? ((milliseconds) => new Promise((resolveWait) => setTimeout(resolveWait, milliseconds)));
+    const output = options.output ?? ((message) => process.stdout.write(message));
+    const server = normalizeServer(options.server ?? DEFAULT_WITNORA_SERVER);
+    const repositoryPath = resolve(options.repository ?? process.cwd());
+    const repository = await inspectRepository(repositoryPath, options.template);
+    const connectionName = options.name ?? repository.slug;
+    const codeVerifier = randomBytes(48).toString("base64url");
+    const codeChallengeSha256 = createHash("sha256").update(codeVerifier).digest("hex");
+    const device = await jsonRequest(requestFetch, `${server}/v1/onboarding/device-authorizations`, {
+        method: "POST", headers: { "content-type": "application/json" },
+        body: JSON.stringify({ projectId: options.projectId, connectionName, codeChallengeSha256 }),
+    });
+    output(`Authorize Witnora in your browser:\n  ${device.verificationUriComplete}\nCode: ${device.userCode}\n`);
+    await (options.openBrowser ?? openSystemBrowser)(device.verificationUriComplete);
+    const token = await waitForToken(requestFetch, server, device, codeVerifier, sleep, options.timeoutMs ?? device.expiresIn * 1_000);
+    const credentialsPath = await saveConnection(token.connectionName, { server, projectId: token.projectId, apiKey: token.apiKey }, { configHome: options.configHome });
+    await verifyControlPlaneConnection({ baseUrl: server, projectId: token.projectId, apiKey: token.apiKey, fetch: requestFetch });
+    const generatedFiles = await generateRepositoryConfig(repositoryPath, repository.template, repository.name);
+    const selfTest = await writeTryEvidence({
+        template: repository.template,
+        subject: `witnora-onboarding-${repository.slug}`,
+        outDir: join(repositoryPath, ".witnora", "onboarding", "self-test"),
+    });
+    const bundleBytes = Buffer.from(`${JSON.stringify(selfTest.bundle, null, 2)}\n`);
+    const receipt = await jsonRequest(requestFetch, `${server}/v1/projects/${encodeURIComponent(token.projectId)}/onboarding/self-test`, {
+        method: "POST", headers: { authorization: `Bearer ${token.apiKey}`, "content-type": "application/json" },
+        body: JSON.stringify({
+            template: repository.template,
+            repository: { kind: repository.kind, name: repository.name, fingerprintSha256: repository.fingerprintSha256 },
+            bundleSha256: createHash("sha256").update(bundleBytes).digest("hex"),
+        }),
+    });
+    const receiptPath = join(repositoryPath, ".witnora", "onboarding", "receipt.json");
+    await mkdir(dirname(receiptPath), { recursive: true });
+    await writeFile(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`);
+    output(`\nConnected ${repository.name} to Witnora.\n`);
+    output(`Project: ${token.projectId}\nTemplate: ${repository.template} (${repository.kind})\n`);
+    output(`Credentials: ${credentialsPath}\nSelf-test receipt: ${receiptPath}\n`);
+    output("The synthetic self-test verified the local evidence path. It did not create a run, evidence object, release decision, or CURRENT assurance.\n");
+    return { projectId: token.projectId, connectionName: token.connectionName, credentialsPath, template: repository.template,
+        repositoryKind: repository.kind, generatedFiles, receiptPath };
+}
+async function waitForToken(requestFetch, server, device, codeVerifier, sleep, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        const response = await requestFetch(`${server}/v1/onboarding/device-authorizations/token`, {
+            method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ deviceCode: device.deviceCode, codeVerifier }),
+        });
+        const body = await response.json().catch(() => ({}));
+        if (response.ok)
+            return body;
+        if (response.status !== 428 || body.code !== "authorization_pending")
+            throw new Error(String(body.error ?? `Device authorization failed with HTTP ${response.status}.`));
+        await sleep(Math.max(1, device.interval) * 1_000);
+    }
+    throw new Error("Device authorization timed out. Run witnora onboard again to create a new one-time request.");
+}
+async function inspectRepository(repositoryPath, explicitTemplate) {
+    const entries = await readdir(repositoryPath, { withFileTypes: true });
+    const names = entries.map((entry) => entry.name).sort();
+    const packageJson = await optionalJson(join(repositoryPath, "package.json"));
+    const packageText = JSON.stringify(packageJson ?? {}).toLowerCase();
+    const filesText = names.join(" ").toLowerCase();
+    const kind = packageJson ? "node" : names.includes("pyproject.toml") || names.includes("requirements.txt") ? "python" : names.includes(".git") ? "git" : "generic";
+    const detected = explicitTemplate ?? (/browser-use|playwright|stagehand|puppeteer/.test(packageText) ? "browser"
+        : /modelcontextprotocol|mcp/.test(packageText + filesText) ? "mcp"
+            : /sql|pandas|duckdb|prisma/.test(packageText) ? "data"
+                : /codex|aider|coding-agent/.test(packageText + filesText) ? "coding" : "workflow");
+    const template = parseAgentTemplate(detected);
+    const rawName = typeof packageJson?.name === "string" ? packageJson.name : basename(repositoryPath);
+    const name = rawName.replace(/^@[^/]+\//, "") || "agent-repository";
+    const slug = (name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "agent-repository").slice(0, 64);
+    const fingerprintSha256 = createHash("sha256").update(JSON.stringify({ kind, name, files: names.filter((value) => !value.startsWith(".")).slice(0, 200) })).digest("hex");
+    return { kind, name, slug, template, fingerprintSha256 };
+}
+async function generateRepositoryConfig(repositoryPath, template, subject) {
+    const files = new Map();
+    files.set("witnora.config.json", `${JSON.stringify(starterProfile(template, subject), null, 2)}\n`);
+    if (template === "browser")
+        files.set("tripwire.yml", starterTripwireConfig(subject));
+    if (template === "coding" || template === "workflow" || template === "data")
+        files.set("witnora.adapter.mjs", starterAdapter(template, subject));
+    const written = [];
+    for (const [relativePath, content] of files) {
+        const target = join(repositoryPath, relativePath);
+        if (await exists(target))
+            continue;
+        await mkdir(dirname(target), { recursive: true });
+        await writeFile(target, content);
+        written.push(target);
+    }
+    return written;
+}
+async function jsonRequest(requestFetch, url, init) {
+    const response = await requestFetch(url, init);
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok)
+        throw new Error(String(body.error ?? `${init.method ?? "GET"} ${url} failed with HTTP ${response.status}.`));
+    return body;
+}
+async function openSystemBrowser(url) {
+    const command = process.platform === "win32" ? "cmd" : process.platform === "darwin" ? "open" : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+    const child = spawn(command, args, { detached: true, stdio: "ignore", windowsHide: true });
+    child.unref();
+}
+async function optionalJson(path) {
+    try {
+        return JSON.parse(await readFile(path, "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+}
+async function exists(path) { try {
+    await access(path);
+    return true;
+}
+catch {
+    return false;
+} }
+function normalizeServer(value) { return new URL(value).toString().replace(/\/$/, ""); }

package/dist/onboarding-templates.js

@@ -32,10 +32,15 @@ export function starterAdapter(template, subject) {
     const eventType = template === "coding" ? "coding.change.proposed" : template === "workflow" ? "workflow.step.completed" : "data.query.completed";
     return `#!/usr/bin/env node
 import { randomBytes, randomUUID } from "node:crypto";
+import { readFile } from "node:fs/promises";
 
 const baseUrl = brandedRequired("BASE_URL").replace(/\\\/$/, "");
 const projectId = brandedRequired("PROJECT_ID");
 const apiKey = brandedRequired("API_KEY");
+const agentId = branded("AGENT_ID") ?? ${JSON.stringify(subject)};
+const agentName = branded("AGENT_NAME") ?? humanize(agentId);
+const agentVersion = await discoverAgentVersion();
+const environment = detectEnvironment();
 const now = new Date().toISOString();
 const traceId = randomBytes(16).toString("hex");
 const spanId = randomBytes(8).toString("hex");
@@ -44,10 +49,10 @@ const envelope = {
   envelopeId: randomUUID(),
   kind: "event",
   occurredAt: now,
-  source: { agentId: ${JSON.stringify(subject)}, agentVersion: process.env.AGENT_VERSION ?? "unversioned", framework: ${JSON.stringify(framework)}, adapter: "witnora-init-v0.2" },
-  run: { externalId: process.env.AGENT_RUN_ID ?? randomUUID(), kind: "custom" },
+  source: { agentId, agentName, agentVersion, framework: branded("AGENT_FRAMEWORK") ?? ${JSON.stringify(framework)}, adapter: "witnora-init-v0.3" },
+  run: { externalId: process.env.WITNORA_RUN_ID ?? process.env.AGENT_RUN_ID ?? randomUUID(), kind: "custom", environment: environment },
   trace: { traceId, spanId },
-  event: { type: ${JSON.stringify(eventType)}, actor: "agent", sequence: 0, attributes: { environment: process.env.AGENT_ENVIRONMENT ?? "development" } },
+  event: { type: ${JSON.stringify(eventType)}, actor: "agent", sequence: 0, attributes: { environment } },
 };
 const response = await fetch(\`\${baseUrl}/v1/projects/\${encodeURIComponent(projectId)}/envelopes\`, {
   method: "POST",
@@ -66,6 +71,44 @@ function brandedRequired(suffix) {
   if (!value) throw new Error(\`\${name} is required. Connect the Witnora CLI or set the hosted project variables. Legacy AGENTCERT_* names remain supported.\`);
   return value;
 }
+
+function branded(suffix) {
+  return process.env[\`WITNORA_\${suffix}\`] ?? process.env[\`AGENTCERT_\${suffix}\`];
+}
+
+function humanize(value) {
+  const unscoped = value.includes("/") ? value.slice(value.lastIndexOf("/") + 1) : value;
+  return unscoped.replace(/[-_.]+/g, " ").replace(/\\b\\w/g, (character) => character.toUpperCase()).trim();
+}
+
+async function discoverAgentVersion() {
+  const explicit = branded("AGENT_VERSION");
+  if (explicit) return explicit;
+  try {
+    const pkg = JSON.parse(await readFile(new URL("./package.json", import.meta.url), "utf8"));
+    if (typeof pkg.version === "string" && pkg.version.trim()) return pkg.version.trim();
+  } catch {}
+  const commit = process.env.GITHUB_SHA ?? process.env.RENDER_GIT_COMMIT ?? process.env.VERCEL_GIT_COMMIT_SHA;
+  return commit ? \`git-\${commit.slice(0, 12)}\` : "local";
+}
+
+function detectEnvironment() {
+  const explicit = branded("ENVIRONMENT") ?? process.env.VERCEL_ENV;
+  if (explicit) return normalizeEnvironment(explicit);
+  if (["pull_request", "pull_request_target"].includes(process.env.GITHUB_EVENT_NAME ?? "")) return "staging";
+  if (process.env.GITHUB_REF_TYPE === "tag") return "production";
+  if (process.env.RENDER_SERVICE_ID) return process.env.IS_PULL_REQUEST === "true" ? "staging" : "production";
+  if (process.env.NODE_ENV === "production") return "production";
+  return "sandbox";
+}
+
+function normalizeEnvironment(value) {
+  const normalized = value.trim().toLowerCase();
+  if (["sandbox", "development", "dev", "test", "local"].includes(normalized)) return "sandbox";
+  if (["staging", "stage", "preview", "pull_request", "pr"].includes(normalized)) return "staging";
+  if (["production", "prod", "live"].includes(normalized)) return "production";
+  throw new Error(\`Unsupported Witnora environment \${JSON.stringify(value)}. Use sandbox, staging, or production.\`);
+}
 `;
 }
 export function starterInstructions(template, subject) {
@@ -74,13 +117,13 @@ export function starterInstructions(template, subject) {
 Next:
   1. Edit tripwire.yml so startUrl and agent.command/agent.args match your app and browser agent.
   2. Run in CI with Kakarottoooo/agentcert/actions/tripwire@v0, or re-run init with --github-action.
-  3. Run: npx --package agentcert@latest witnora run --tripwire .tripwire/latest/tripwire-result.json --subject ${JSON.stringify(subject)} --fail-on-verdict
+  3. Run: npx witnora@latest run --tripwire .tripwire/latest/tripwire-result.json --subject ${JSON.stringify(subject)} --fail-on-verdict
 `;
     if (template === "mcp")
         return `
 Next:
   1. Run MCPBench and write its JSON result to .mcpbench/latest/results.json.
-  2. Run: npx --package agentcert@latest witnora run --mcpbench .mcpbench/latest/results.json --subject ${JSON.stringify(subject)} --fail-on-verdict
+  2. Run: npx witnora@latest run --mcpbench .mcpbench/latest/results.json --subject ${JSON.stringify(subject)} --fail-on-verdict
 `;
     return `
 Next:
@@ -151,7 +194,7 @@ jobs:
           out: .tripwire/latest
           fail-under: "0.8"
           subject: ${JSON.stringify(subject)}
-          agentcert-out: .agentcert/latest
+          agentcert-out: .witnora/latest
           fail-on-verdict: "true"
           release-gate: "true"
 `;