aac-cli 0.2.10__tar.gz → 0.2.12__tar.gz

{aac_cli-0.2.10/aac_cli.egg-info → aac_cli-0.2.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aac-cli
-Version: 0.2.10
+Version: 0.2.12
 Summary: The aac platform CLI — headless operator interface to the AAC control plane (tenant registration, chain audit).
 Author: Agent Authority Cloud Project
 License-Expression: Apache-2.0
@@ -28,9 +28,9 @@ Dynamic: license-file
 # aac-cli — the `aac` command
 
 `aac` is the command-line tool for tenants of Agent Authority Cloud (AAC).
-AAC lets an organisation's AI agents and services prove, on every request,
-which tenant they belong to and what they were authorised to do. A
-**tenant** is one organisation registered with AAC. Each of its workloads
+AAC lets an organization's AI agents and services prove, on every request,
+which tenant they belong to and what they were authorized to do. A
+**tenant** is one organization registered with AAC. Each of its workloads
 runs beside an AAC sidecar that signs outgoing requests and verifies
 incoming ones against public trust material the tenant publishes.
 
@@ -46,8 +46,8 @@ The `aac` command is how a tenant's operator does everything that is not
 done by the sidecar itself: register the tenant, sign in, manage keys,
 workloads and domains, and prepare a runnable local workload. Everything
 works from a terminal or a script; there is no web console to click
-through. Output is JSON by default, and every command that reports a
-result also offers `--output table`.
+through. Output is JSON by default. Commands that support table output offer
+`--output table`; `aac sso describe` returns JSON only.
 
 Two kinds of tenant use the same tool:
 
@@ -69,7 +69,8 @@ pip install aac-cli
 aac --version
 ```
 
-Python 3.11 to 3.14 is supported. Release checks test all four versions.
+Supported platforms are macOS, Linux and Linux Docker containers. Python 3.11
+to 3.14 is supported. Release checks test all four versions.
 
 > **Mind the name.** `pip install aac` installs an unrelated project that
 > happens to share the acronym. The AAC package is **`aac-cli`**; the
@@ -756,7 +757,7 @@ stored value.
 
 `tenant_id` is managed for you. Profile commands display it but never ask
 for it; only `aac tenant register`, `aac init` and `aac sso login` write it.
-It is your organisation's identifier in the federation, allocated by AAC at
+It is your organization's identifier in the federation, allocated by AAC at
 registration in the form `tnt-<uuid>`, and it never changes.
 A binding makes that tenant the profile's stored default; it does not grant
 membership or configure an identity provider. Successful sign-in to an existing
@@ -857,8 +858,16 @@ aac sso logout --profile stage
 A developer tenant signs in with `--idp github` or `--idp google`; if you
 need another sign-in provider, contact support@cascadeauth.com. An
 enterprise tenant signs in through its Microsoft Entra ID connection, named
-by the connection's exact URL with `--idp-url`; when several connections
-are registered, the error message lists the exact commands to choose one.
+by the connection's exact URL with `--idp-url`. With neither flag, the
+tenant's own connections take precedence over the shared developer sign-ins;
+when several remain, a terminal shows a numbered list to choose from and then
+prints the flag that skips the prompt next time, while a script (no terminal)
+gets exit 3 and one copy-ready command per connection. The list marks which
+connection the cached session was last obtained through; it never shows
+which connections have members. A developer tenant admits only the provider
+and account it was registered with: when the AAC STS does not accept a shared
+sign-in, the CLI reminds you of that rule and lists any other shared sign-ins. GitHub connections accept the device flow
+only: `--flow pkce` with a GitHub connection stops locally with exit 3.
 
 Sessions last **4 hours by default**. Your administrator may configure a
 different lifetime for the deployment or connection. You can run
@@ -868,12 +877,20 @@ with the four-hour default, signing in at 09:00 gives an expiry of 13:00;
 signing in successfully again at 12:00 gives the new session an expiry of 16:00.
 Use `aac sso whoami --profile NAME --output table` to check the current
 expiration. If the session expires, sign in again; no refresh token is issued.
+A command that needs a session stops locally with exit 3 when none is cached,
+before anything is sent, and prints the `aac sso login` command for the same
+profile and endpoints; commands that also accept a bootstrap token name that
+alternative.
 
 Sign-in uses the device flow by default, so the browser can be on another
-machine and headless hosts work. Google connections use a loopback flow
-instead, because Google's device flow is scope-restricted; `--flow`
-overrides the choice. `whoami` and `logout` work offline and never contact
-AAC.
+machine and headless hosts work. On a terminal with a browser at hand
+(macOS, a desktop session, or `BROWSER` set), the device flow also offers to
+open the sign-in page for you: press Enter to open it in your browser, or copy
+the printed link and code into a browser yourself; `--no-browser` turns the
+offer off, and a script (no terminal) or a headless host never sees it. Google
+connections use a loopback flow instead, because Google's device flow is
+scope-restricted; `--flow` overrides the choice. `whoami` and `logout` work
+offline and never contact AAC.
 
 ## Output and exit codes
 
@@ -921,17 +938,28 @@ a callback gives up after 300 seconds with exit `3`. HTTP timeouts remain exit
 If AAC asks you to slow down, the command shows the interval to wait. The
 CLI never replays a change on its own; wait and rerun deliberately.
 
+The commands that can present a ceremony token (`aac tenant register`,
+`reissue-api-key`, `assign-hosted-domain`, `reactivate-hosted-domain`,
+`bind-trust-domain`, `list-trust-domains`, `revoke-trust-domain`,
+`rotate-admin-key`, `aac sso register-idp`, `enroll-idp-recovery-key` and
+`approve-idp-repair`) and `aac sso login` report a failure by HTTP status and
+AAC error code only, never the server's message or response body, because
+either can echo the credential the request carried; their transport failures
+show the error class and the operating system's reason, not the library's
+text. Other commands still print the server's message with the status and
+code.
+
 ## Enterprise tenants
 
 Enterprise tenants are registered through an onboarding ceremony: AAC
 operations opens a registration window and hands the tenant operator a
 bootstrap token, which the commands below read from `--bootstrap-token` or
-the `AAC_BOOTSTRAP_TOKEN` environment variable. The token authorises only
+the `AAC_BOOTSTRAP_TOKEN` environment variable. The token authorizes only
 the onboarding steps shown with it; every other administration command runs
 under a signed-in session.
 
 For enterprise sign-in, AAC supports Microsoft Entra ID (also known as
-Azure Active Directory or Azure AD). If your organisation needs another
+Azure Active Directory or Azure AD). If your organization needs another
 identity provider, contact support@cascadeauth.com.
 
 ### Register the tenant

{aac_cli-0.2.10 → aac_cli-0.2.12}/README.md

@@ -1,9 +1,9 @@
 # aac-cli — the `aac` command
 
 `aac` is the command-line tool for tenants of Agent Authority Cloud (AAC).
-AAC lets an organisation's AI agents and services prove, on every request,
-which tenant they belong to and what they were authorised to do. A
-**tenant** is one organisation registered with AAC. Each of its workloads
+AAC lets an organization's AI agents and services prove, on every request,
+which tenant they belong to and what they were authorized to do. A
+**tenant** is one organization registered with AAC. Each of its workloads
 runs beside an AAC sidecar that signs outgoing requests and verifies
 incoming ones against public trust material the tenant publishes.
 
@@ -19,8 +19,8 @@ The `aac` command is how a tenant's operator does everything that is not
 done by the sidecar itself: register the tenant, sign in, manage keys,
 workloads and domains, and prepare a runnable local workload. Everything
 works from a terminal or a script; there is no web console to click
-through. Output is JSON by default, and every command that reports a
-result also offers `--output table`.
+through. Output is JSON by default. Commands that support table output offer
+`--output table`; `aac sso describe` returns JSON only.
 
 Two kinds of tenant use the same tool:
 
@@ -42,7 +42,8 @@ pip install aac-cli
 aac --version
 ```
 
-Python 3.11 to 3.14 is supported. Release checks test all four versions.
+Supported platforms are macOS, Linux and Linux Docker containers. Python 3.11
+to 3.14 is supported. Release checks test all four versions.
 
 > **Mind the name.** `pip install aac` installs an unrelated project that
 > happens to share the acronym. The AAC package is **`aac-cli`**; the
@@ -729,7 +730,7 @@ stored value.
 
 `tenant_id` is managed for you. Profile commands display it but never ask
 for it; only `aac tenant register`, `aac init` and `aac sso login` write it.
-It is your organisation's identifier in the federation, allocated by AAC at
+It is your organization's identifier in the federation, allocated by AAC at
 registration in the form `tnt-<uuid>`, and it never changes.
 A binding makes that tenant the profile's stored default; it does not grant
 membership or configure an identity provider. Successful sign-in to an existing
@@ -830,8 +831,16 @@ aac sso logout --profile stage
 A developer tenant signs in with `--idp github` or `--idp google`; if you
 need another sign-in provider, contact support@cascadeauth.com. An
 enterprise tenant signs in through its Microsoft Entra ID connection, named
-by the connection's exact URL with `--idp-url`; when several connections
-are registered, the error message lists the exact commands to choose one.
+by the connection's exact URL with `--idp-url`. With neither flag, the
+tenant's own connections take precedence over the shared developer sign-ins;
+when several remain, a terminal shows a numbered list to choose from and then
+prints the flag that skips the prompt next time, while a script (no terminal)
+gets exit 3 and one copy-ready command per connection. The list marks which
+connection the cached session was last obtained through; it never shows
+which connections have members. A developer tenant admits only the provider
+and account it was registered with: when the AAC STS does not accept a shared
+sign-in, the CLI reminds you of that rule and lists any other shared sign-ins. GitHub connections accept the device flow
+only: `--flow pkce` with a GitHub connection stops locally with exit 3.
 
 Sessions last **4 hours by default**. Your administrator may configure a
 different lifetime for the deployment or connection. You can run
@@ -841,12 +850,20 @@ with the four-hour default, signing in at 09:00 gives an expiry of 13:00;
 signing in successfully again at 12:00 gives the new session an expiry of 16:00.
 Use `aac sso whoami --profile NAME --output table` to check the current
 expiration. If the session expires, sign in again; no refresh token is issued.
+A command that needs a session stops locally with exit 3 when none is cached,
+before anything is sent, and prints the `aac sso login` command for the same
+profile and endpoints; commands that also accept a bootstrap token name that
+alternative.
 
 Sign-in uses the device flow by default, so the browser can be on another
-machine and headless hosts work. Google connections use a loopback flow
-instead, because Google's device flow is scope-restricted; `--flow`
-overrides the choice. `whoami` and `logout` work offline and never contact
-AAC.
+machine and headless hosts work. On a terminal with a browser at hand
+(macOS, a desktop session, or `BROWSER` set), the device flow also offers to
+open the sign-in page for you: press Enter to open it in your browser, or copy
+the printed link and code into a browser yourself; `--no-browser` turns the
+offer off, and a script (no terminal) or a headless host never sees it. Google
+connections use a loopback flow instead, because Google's device flow is
+scope-restricted; `--flow` overrides the choice. `whoami` and `logout` work
+offline and never contact AAC.
 
 ## Output and exit codes
 
@@ -894,17 +911,28 @@ a callback gives up after 300 seconds with exit `3`. HTTP timeouts remain exit
 If AAC asks you to slow down, the command shows the interval to wait. The
 CLI never replays a change on its own; wait and rerun deliberately.
 
+The commands that can present a ceremony token (`aac tenant register`,
+`reissue-api-key`, `assign-hosted-domain`, `reactivate-hosted-domain`,
+`bind-trust-domain`, `list-trust-domains`, `revoke-trust-domain`,
+`rotate-admin-key`, `aac sso register-idp`, `enroll-idp-recovery-key` and
+`approve-idp-repair`) and `aac sso login` report a failure by HTTP status and
+AAC error code only, never the server's message or response body, because
+either can echo the credential the request carried; their transport failures
+show the error class and the operating system's reason, not the library's
+text. Other commands still print the server's message with the status and
+code.
+
 ## Enterprise tenants
 
 Enterprise tenants are registered through an onboarding ceremony: AAC
 operations opens a registration window and hands the tenant operator a
 bootstrap token, which the commands below read from `--bootstrap-token` or
-the `AAC_BOOTSTRAP_TOKEN` environment variable. The token authorises only
+the `AAC_BOOTSTRAP_TOKEN` environment variable. The token authorizes only
 the onboarding steps shown with it; every other administration command runs
 under a signed-in session.
 
 For enterprise sign-in, AAC supports Microsoft Entra ID (also known as
-Azure Active Directory or Azure AD). If your organisation needs another
+Azure Active Directory or Azure AD). If your organization needs another
 identity provider, contact support@cascadeauth.com.
 
 ### Register the tenant

{aac_cli-0.2.10 → aac_cli-0.2.12}/aac_cli/__init__.py

@@ -10,4 +10,4 @@ entrypoint (`aac_cli.cli:entrypoint`).
 # test in bin/tests/test_cli_version_parity.py. A literal keeps the
 # shipped code free of import-time metadata lookups (and their
 # not-installed failure mode).
-__version__ = "0.2.10"
+__version__ = "0.2.12"

{aac_cli-0.2.10 → aac_cli-0.2.12}/aac_cli/_aeg/cli.py

@@ -204,15 +204,18 @@ def _render(args, events, query: Query, sources: list[SourceInput]) -> int:
     if args.output.resolve() in {path.resolve() for path in protected}:
         raise InputError("--output must not overwrite an evidence input")
     visual = build_visual_aeg(graph)
-    visual.provenance = summarize_sources(sources, selected, central_status=central_status)
+    visual.provenance = summarize_sources(
+        sources, selected, central_status=central_status, evidence_complete=graph.evidence_complete
+    )
     with tempfile.TemporaryDirectory(prefix="aac-aeg-") as directory:
         rendered = write_html_aeg(visual, root, out_dir=Path(directory))
         args.output.parent.mkdir(parents=True, exist_ok=True)
         args.output.write_text(rendered.read_text(encoding="utf-8"), encoding="utf-8")
     for diagnostic in diagnostics:
         print(diagnostic, file=sys.stderr)
+    coverage = "" if graph.evidence_complete else "; partial evidence"
     print(
-        f"AEG written to {args.output} ({len(graph.tokens)} observed/referenced tokens; partial evidence)",
+        f"AEG written to {args.output} ({len(graph.tokens)} observed/referenced tokens{coverage})",
         file=sys.stderr,
     )
     return 4 if query_failed else 0

{aac_cli-0.2.10 → aac_cli-0.2.12}/aac_cli/_aeg/data/renderer-source.json

@@ -1,20 +1,20 @@
 {
-  "content_sha256": "6e8bcd00bd94c415e04af65deb527be4d1581a6a5396d74c95708d6dda97fca4",
+  "content_sha256": "f45099fcfa1d1ceca5f31244dfa526ea096094ced6cfc7faf27cc1babe482163",
   "files": {
     "__init__.py": "80d80a1ba35353d271cddf02532801c60b57f5ec06fb268ae823747742ce8979",
-    "cli.py": "98aa2b0c528fefb5f1f90a16584a6fbda1f075ebfcf61605f52948cdb940a1af",
+    "cli.py": "a180a171b4d1f819fd96d0821394eee19b45fafddddbd50c74778af6ac3d5fb0",
     "data/action-taken-v1.json": "d863343afe7f314646a73cf063480a7e650f93857d2ed5ec3a7b1f9838671fdf",
     "data/predicates-v1.json": "35e83a29feada10e8cfbef7009245146a9717d4f4fd58d74124e0ec91ae922c8",
-    "from_sidecar.py": "6ac023f6925a13e94e0fee762656a02ca98981f2add194b052e9014ca48e2219",
-    "inputs.py": "ebf1ca77957d29d59683348f6916bac3c21e2037f087f26ff7c7242d75edc77c",
-    "model.py": "b631dcd7af587dcc89c18e1058bc81fb1043f04250a0d6ea585f9c595fd75cfc",
+    "from_sidecar.py": "8671c3e0efe9bfe9ecf9be057b70e245ca8d0d645b6bad8819f6fb1b882e255e",
+    "inputs.py": "047a6b7dd788e04c49e10f090de9336ed3870e754b547c469371369d27b55b8b",
+    "model.py": "715d0e92c3aafd9e0a194a74b4df7354bd24d1bf815767d590cf245da3d60018",
     "narrative.py": "8ac4b12add84cc8be907cff5f25e58731ab1144888aec8d376e286de461a6179",
-    "provenance.py": "d310e13bfd45cb16edcc72e7b2bc28c916e3ff45208e2b44240e589f0ec0558d",
+    "provenance.py": "3f611a8c129a2856e2cf76561bde29dc1884719083dfdddea72810e026946b90",
     "schemas.py": "c47e0138fb8bfeaf1db1725a00d4a37ff4a136a9e8f5907356b1006f301a9ded",
     "temporal.py": "b69081e9280d578dc1261a276da3178e979a02efaf1137f720b4520ed543a36d",
     "theme.py": "ded47be13f5c591da95a1bb91ee1b665c1570c929d842bdaa1a41325d0b40caa",
     "timeline_source.py": "dc875458d69c6135b3ffe0db9c35e511da603b5d52409f780f3e1b74dc464520",
-    "visualizer.py": "5eb7b863652c51a4a5751bcd8ae735b688e6e3e61089f0c158473ebb52ae6655"
+    "visualizer.py": "3213a1cbfe901f320c687b5eafcc09bed46bd2270c6cd427a7f74472c80a3bfe"
   },
   "legal": {
     "LICENSE": "0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594",

{aac_cli-0.2.10 → aac_cli-0.2.12}/aac_cli/_aeg/from_sidecar.py

@@ -463,6 +463,9 @@ def _translate_mint(
         "tenant_id": sidecar_event.get("tenant_id"),
         "presenter_spiffe_id": sidecar_event.get("actor_spiffe_id"),
         "originator_human_id_hash": None,
+        # The sidecar records the sign-in issuer, never the person's identity;
+        # the originator node shows it when no identity hash is available.
+        "originator_issuer": sidecar_event.get("originator_issuer"),
         # T0 has no parent and no parent_token_ids_list (not a composite).
     }
     t0_event = UnifiedEvent(
@@ -624,6 +627,7 @@ def _translate_composite_mint(
         "parent_root_token_ids": sidecar_event.get("parent_root_token_ids") or [],
         "parent_tenant_ids": sidecar_event.get("parent_tenant_ids") or [],
         "originator_human_id_hash": sidecar_event.get("originator_human_id_hash"),
+        "originator_issuer": sidecar_event.get("originator_issuer"),
         "task_ref": sidecar_event.get("task_ref"),
     }
     t_comp_0_event = UnifiedEvent(

{aac_cli-0.2.10 → aac_cli-0.2.12}/aac_cli/_aeg/inputs.py

@@ -100,6 +100,7 @@ def _sidecar_types(row: dict, label: str) -> None:
         "agent_decision_action",
         "destination",
         "terminal_attestation_verification",
+        "originator_issuer",
     ):
         if row.get(key) is not None and not isinstance(row[key], str):
             raise InputError(f"{label}: {key} must be a string or null")
@@ -232,6 +233,7 @@ def read_trace(body, source: str) -> tuple[str, list[UnifiedEvent]]:
             "terminal_attestation_verification",
             "destination",
             "agent_decision_action",
+            "originator_issuer",
         ):
             if raw.get(key) is not None and not isinstance(raw[key], str):
                 raise InputError(f"{label}: {key} must be a string or null")

{aac_cli-0.2.10 → aac_cli-0.2.12}/aac_cli/_aeg/model.py

@@ -215,6 +215,11 @@ class TerminalNode:
     action_payload: dict = field(default_factory=dict)
     action_taken_by_spiffe_id: str | None = None
     action_taken_timestamp: str | None = None
+    # True only when an action record's actor is the workload the audience
+    # names (exact match, or a match of the audience pattern). Any other
+    # token-correlated action stays an observation and never proves that the
+    # addressed recipient acted.
+    recipient_acted: bool = False
     # Canonical associations observed for this leaf and exact receiver workload.
     # A trust-domain match, another token, or a wildcard is not such evidence.
     observed_tenant_ids: tuple[str, ...] = ()
@@ -274,6 +279,21 @@ class TokenRelationGraph:
     # become unknown. Receiving/reporting observations cannot supply this map.
     creator_tenant_claims: dict[str, tuple[str, ...]] = field(default_factory=dict)
 
+    @property
+    def evidence_complete(self) -> bool:
+        """True when the supplied records leave no structural gap.
+
+        Every referenced token was observed (no placeholder stands in for a
+        token only named by another), and each recipient's own records show
+        its action. A complete set is still a set of supplied observations,
+        not independently verified business truth.
+        """
+        if not self.tokens or not self.terminals:
+            return False
+        if any(token.placeholder for token in self.tokens.values()):
+            return False
+        return all(terminal.recipient_acted for terminal in self.terminals)
+
 
 # ---------------------------------------------------------------------------
 # Extraction — events → TokenRelationGraph
@@ -729,14 +749,49 @@ def _extract_originators(
         if e.source.startswith(TENANT_SOURCE_PREFIX) and e.event_type == "human_authenticated"
     }
 
-    out: list[OriginatorNode] = []
+    # Every observation of the same root (local sidecar record, central
+    # metadata, a second file) describes ONE originator. Merge them per root so
+    # the canvas label and the details are built from the same facts: a SIEM
+    # match on any observed hash wins, otherwise the first issuer any
+    # observation carries.
+    by_root: dict[str, list[UnifiedEvent]] = {}
     for mint in mint_root_events:
-        h_hash = mint.raw_event.get("originator_human_id_hash") or ""
-        root_tid = mint.root_token_id
-        token = tokens.get(mint.token_id)
-        tenant_id = token.tenant_id if token else (mint.raw_event.get("tenant_id") or "")
+        by_root.setdefault(mint.root_token_id, []).append(mint)
+
+    out: list[OriginatorNode] = []
+    for root_tid, observations in by_root.items():
+        h_hash = next(
+            (
+                str(o.raw_event.get("originator_human_id_hash"))
+                for o in observations
+                if o.raw_event.get("originator_human_id_hash")
+            ),
+            "",
+        )
+        issuer = next(
+            (
+                o.raw_event.get("originator_issuer")
+                for o in observations
+                if isinstance(o.raw_event.get("originator_issuer"), str)
+                and o.raw_event.get("originator_issuer")
+            ),
+            None,
+        )
+        token = next((tokens[o.token_id] for o in observations if o.token_id in tokens), None)
+        tenant_id = (
+            token.tenant_id
+            if token
+            else next(
+                (
+                    str(o.raw_event.get("tenant_id"))
+                    for o in observations
+                    if o.raw_event.get("tenant_id")
+                ),
+                "",
+            )
+        )
         # Optional enrichment from tenant SIEM.
-        siem = siem_human_events.get(h_hash)
+        siem = siem_human_events.get(h_hash) if h_hash else None
         if siem:
             raw = siem.raw_event
             out.append(
@@ -757,6 +812,9 @@ def _extract_originators(
                     human_id_hash=h_hash,
                     root_token_id=root_tid,
                     tenant_id=tenant_id,
+                    # The sidecar's mint record names the sign-in issuer even
+                    # when no identity hash reaches these records.
+                    human_iss=issuer,
                 )
             )
     return out
@@ -812,6 +870,35 @@ def _extract_auth_summary(
 # ---------------------------------------------------------------------------
 
 
+# The AAC audience grammar (AAC Design, "SPIFFE-ID pattern matching for
+# audience"), as the verifier implements it: a concrete SPIFFE ID, or a trailing
+# `/*` that stands for exactly one non-empty path segment. Trust domains match
+# exactly; a SPIFFE ID itself never contains a wildcard.
+_AUDIENCE_PATTERN = re.compile(r"^spiffe://[A-Za-z0-9.\-_]+(?:/[^/*]+)*(?:/\*)?$")
+_CONCRETE_SPIFFE_ID = re.compile(r"^spiffe://[A-Za-z0-9.\-_]+(?:/[^/*]+)+$")
+
+
+def _actor_matches_audience(actor: object, audience: str) -> bool:
+    """Whether an action's actor is the workload the audience constraint names.
+
+    Only a concrete SPIFFE ID can be the addressed recipient, and only under
+    the audience grammar above. Anything else (an opaque identity, a pattern
+    used as an actor, an unsupported audience shape) is kept as an observation
+    without claiming a match. A shared token or tenant never counts.
+    """
+    if not isinstance(actor, str) or not _CONCRETE_SPIFFE_ID.fullmatch(actor):
+        return False
+    if any(character.isspace() for character in actor) or not _AUDIENCE_PATTERN.fullmatch(audience):
+        return False
+    if audience.endswith("/*"):
+        prefix = audience[:-2]
+        if not actor.startswith(prefix + "/"):
+            return False
+        tail = actor[len(prefix) + 1 :]
+        return bool(tail) and "/" not in tail
+    return actor == audience
+
+
 def _extract_terminals(
     events: list[UnifiedEvent],
     tokens: dict[str, TokenNode],
@@ -882,6 +969,9 @@ def _extract_terminals(
             action_by_token.get(tid, []),
             key=lambda e: (e.timestamp_iso, json.dumps(e.raw_event, sort_keys=True)),
         )
+        recipient_acted = any(
+            _actor_matches_audience(e.raw_event.get("actor_spiffe_id"), audience) for e in actions
+        )
         if actions:
             action = actions[0]
             raw: dict = (
@@ -911,6 +1001,7 @@ def _extract_terminals(
                     # alias is needed.
                     action_taken_by_spiffe_id=raw.get("actor_spiffe_id"),
                     action_taken_timestamp=action.timestamp_iso,
+                    recipient_acted=recipient_acted,
                 )
             )
         else:

{aac_cli-0.2.10 → aac_cli-0.2.12}/aac_cli/_aeg/provenance.py

@@ -50,10 +50,16 @@ class SourceSummary:
 class Provenance:
     sources: tuple[SourceSummary, ...]
     central_status: str
+    # Structural completeness of the supplied records (TokenRelationGraph.evidence_complete).
+    evidence_complete: bool = False
 
 
 def summarize_sources(
-    sources: list[SourceInput], selected: list[UnifiedEvent], *, central_status: str
+    sources: list[SourceInput],
+    selected: list[UnifiedEvent],
+    *,
+    central_status: str,
+    evidence_complete: bool = False,
 ) -> Provenance:
     # Selection retains the original event objects. Track membership by identity,
     # not by a filename, timestamp or caller-controlled event field that could
@@ -81,7 +87,7 @@ def summarize_sources(
                 times[-1] if times else None,
             )
         )
-    return Provenance(tuple(summaries), central_status)
+    return Provenance(tuple(summaries), central_status, evidence_complete)
 
 
 def source_panel(provenance: Provenance | None, diagnostics: list[str]) -> str:
@@ -143,11 +149,21 @@ def source_panel(provenance: Provenance | None, diagnostics: list[str]) -> str:
             "observations for hosted data, not unique business actions. Timestamp spans describe "
             "available records, not execution start/end or continuous coverage.</p>"
         )
+    if provenance and provenance.evidence_complete:
+        coverage = (
+            "<li>Every referenced token was observed and each recipient's own records show its "
+            "action. Records are supplied, correlated observations, not independently verified "
+            "business truth.</li>"
+        )
+    else:
+        coverage = (
+            "<li>Partial evidence: only supplied, correlated observations are shown. Missing "
+            "records do not establish success or failure.</li>"
+        )
     parts.append(
-        "<h2>Limitations for these inputs</h2><ul><li>Partial evidence: only supplied, "
-        "correlated observations are shown. Missing records do not establish success or failure.</li>"
-        "<li>An intended recipient is named by an audience constraint; that constraint alone "
-        "does not prove delivery or completion. Mint/transport success does not prove a business result.</li>"
+        "<h2>Limitations for these inputs</h2><ul>" + coverage + "<li>A recipient is named by an "
+        'audience constraint ("addressed to"); that constraint alone does not prove delivery or '
+        "completion. Mint/transport success does not prove a business result.</li>"
     )
     if "Control-plane trace data" in used:
         parts.append(