agent-lifecycle-kit 2.2.0__tar.gz → 2.4.0__tar.gz

{agent_lifecycle_kit-2.2.0/src/agent_lifecycle_kit.egg-info → agent_lifecycle_kit-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-lifecycle-kit
-Version: 2.2.0
+Version: 2.4.0
 Summary: Provider-neutral lifecycle control layer that helps coding agents plan, execute, validate, and prove software tasks to completion.
 Author: Agent Lifecycle Kit contributors
 License: Apache-2.0
@@ -43,7 +43,7 @@ ALK provides a verifiable finish for external-agent work with proportionate cont
 ## Quick start
 Start with [install ALK and make the first run](docs/guides/install-and-first-run.md).
 
-It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.2.0`, and common `agent-lifecycle version` errors.
+It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.4.0`, and common `agent-lifecycle version` errors.
 
 For a quick start, run:
 
@@ -68,7 +68,7 @@ agent-lifecycle start --adapter <adapter-id> --file task.md
 - The boundaries of [planning-only launch](docs/reference/planning-only-launch.md) and [frozen-task launch through a verified profile](docs/reference/qualified-host-launch.md) are documented in the reference. Shipped planning profiles remain candidates with safe failure until the corresponding profile is verified.
 - The [system architecture](docs/architecture/system-architecture.md) page explains how the project is organized, and [project comparison](docs/reference/project-comparison.md) shows how it differs from similar tools.
 - Multiple-agent boundaries, workflow configuration, model choice, prompts, timeouts and retries are described in [workflow customization and execution controls](docs/reference/workflow-customization.md).
-- Create a local project profile with `agent-lifecycle project profile init`; see [project workflow profile](docs/reference/project-workflow-profile.md). Explain the selected profile, plan constraints and adapter capability lineage with [effective configuration](docs/reference/effective-configuration.md), [structured result qualification](docs/reference/structured-result-qualification.md) and [adapter action evidence](docs/reference/adapter-action-evidence.md). Add optional project-owned architecture and dependency evidence with [external verification checks](docs/reference/external-verification-checks.md), or track bounded terminology with [project domain language](docs/reference/project-domain-language.md).
+- Create a local project profile with `agent-lifecycle project profile init`; see [project workflow profile](docs/reference/project-workflow-profile.md). Explain the selected profile, plan constraints and adapter capability lineage with [effective configuration](docs/reference/effective-configuration.md), [structured result qualification](docs/reference/structured-result-qualification.md) and [adapter action evidence](docs/reference/adapter-action-evidence.md). Add optional project-owned architecture and dependency evidence with [external verification checks](docs/reference/external-verification-checks.md), track bounded terminology with [project domain language](docs/reference/project-domain-language.md), coordinate several runs with the read-only [multi-run attention view](docs/reference/multi-run-attention-view.md), or use the optional [security analysis profile](docs/reference/security-analysis-profile.md) for untrusted findings and independently verified remediation.
 - For long sessions, use [context checkpoints and compaction recovery](docs/reference/context-checkpoints.md). They preserve a bounded local continuation package without changing plan authority.
 ## What it gives you
 - A finish-oriented lifecycle: plan, execute, review, and prove the result.
@@ -195,7 +195,7 @@ Adapter installation and support-level details live in [Adapter install](docs/ad
 
 - Start: [English documentation](docs/README.md), [Русская документация](docs/ru/README.md), [Install](docs/guides/install-and-first-run.md), [Quickstart](docs/guides/quickstart.md), [Beginner and advanced workflows](docs/guides/beginner-and-advanced-workflows.md), [Commands by task](docs/guides/commands-by-task.md), [Research workflow](docs/guides/research-workflow.md), [Lifecycle task scenarios](docs/guides/lifecycle-cookbook.md), and [Code review workflows](docs/guides/code-review-workflows.md).
 - Planning and adapters: [Issue to specification drafts](docs/guides/issue-to-spec.md), [Adapter install](docs/adapters/install.md), and [Adapter support matrix](docs/adapters/support-matrix.md).
-- Reference: [System architecture](docs/architecture/system-architecture.md), [workflow customization and execution controls](docs/reference/workflow-customization.md), [execution strategy](docs/reference/execution-strategy.md), [CLI reference](docs/reference/cli.md), [External verification checks](docs/reference/external-verification-checks.md), [Project domain language](docs/reference/project-domain-language.md), [Plan verification](docs/reference/plan-verification.md), [Research evidence](docs/reference/research-evidence.md), [Public locators and redaction](docs/reference/public-locators-and-redaction.md), [Finding-to-check adoption](docs/reference/finding-check-adoption.md), [Source of truth](docs/reference/source-of-truth.md), [Managed lifecycle runner](docs/reference/managed-lifecycle-runner.md), [Managed adapter sessions](docs/reference/managed-adapter-sessions.md), [Portable Agent Plugins](docs/reference/agent-plugins.md), [Plugin publication](docs/reference/plugin-publication.md), [Implementation audit](docs/reference/implementation-audit.md), [Plan completeness](docs/reference/plan-completeness.md), [Public contracts](docs/reference/public-contracts.md), and [Readiness diagnostics](docs/reference/readiness-diagnostics.md).
+- Reference: [System architecture](docs/architecture/system-architecture.md), [workflow customization and execution controls](docs/reference/workflow-customization.md), [execution strategy](docs/reference/execution-strategy.md), [CLI reference](docs/reference/cli.md), [External verification checks](docs/reference/external-verification-checks.md), [Project domain language](docs/reference/project-domain-language.md), [Multi-run attention view](docs/reference/multi-run-attention-view.md), [Plan verification](docs/reference/plan-verification.md), [Research evidence](docs/reference/research-evidence.md), [Public locators and redaction](docs/reference/public-locators-and-redaction.md), [Finding-to-check adoption](docs/reference/finding-check-adoption.md), [Source of truth](docs/reference/source-of-truth.md), [Managed lifecycle runner](docs/reference/managed-lifecycle-runner.md), [Managed adapter sessions](docs/reference/managed-adapter-sessions.md), [Portable Agent Plugins](docs/reference/agent-plugins.md), [Plugin publication](docs/reference/plugin-publication.md), [Implementation audit](docs/reference/implementation-audit.md), [Plan completeness](docs/reference/plan-completeness.md), [Public contracts](docs/reference/public-contracts.md), and [Readiness diagnostics](docs/reference/readiness-diagnostics.md).
 - Quality and resources: [Reference-task evaluation](docs/reference/reference-task-evaluation.md), [model routing](docs/reference/model-routing.md), [quality-cost learning](docs/reference/quality-cost-learning.md), [performance and resource budgets](docs/reference/performance-and-resource-budgets.md), [lifecycle cost accounting](docs/reference/lifecycle-cost.md), [host-local token accounting](docs/reference/host-local-token-accounting.md), [process execution observability](docs/reference/process-execution-observability.md), [Usage export](docs/reference/usage-export.md), and [Evidence integrity](docs/reference/evidence-integrity.md).
 - Profiles and operations: [Project workflow presets](docs/reference/workflow-presets.md), [Project workflow profile](docs/reference/project-workflow-profile.md), [Read-only status views](docs/reference/read-only-status-view.md), [Adapter progress bridge](docs/reference/automatic-progress-bridge.md), [Sandbox boundaries](docs/reference/sandbox-boundaries.md), [Import mappers](docs/reference/import-mappers.md), [Episode retrieval](docs/reference/episode-retrieval.md), [Runner migration](docs/guides/runner-migration-2.md), [Runner recovery records](docs/reference/runner-recovery.md), [Cross-check profile](docs/reference/cross-check-profile.md), [Review Mesh](docs/reference/review-mesh.md), [Risk-bound independent verification](docs/reference/risk-bound-independent-verification.md), [Bug Forensics profile](docs/reference/bug-forensics.md), and [Bug Forensics context budget](docs/reference/bug-forensics-context-budget.md).
 - Release assets: [Task templates](templates/tasks/README.md), [Neutrality scanning](docs/reference/neutrality.md), and [Release security](docs/security/release-security.md).

{agent_lifecycle_kit-2.2.0 → agent_lifecycle_kit-2.4.0}/README.md

@@ -21,7 +21,7 @@ ALK provides a verifiable finish for external-agent work with proportionate cont
 ## Quick start
 Start with [install ALK and make the first run](docs/guides/install-and-first-run.md).
 
-It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.2.0`, and common `agent-lifecycle version` errors.
+It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.4.0`, and common `agent-lifecycle version` errors.
 
 For a quick start, run:
 
@@ -46,7 +46,7 @@ agent-lifecycle start --adapter <adapter-id> --file task.md
 - The boundaries of [planning-only launch](docs/reference/planning-only-launch.md) and [frozen-task launch through a verified profile](docs/reference/qualified-host-launch.md) are documented in the reference. Shipped planning profiles remain candidates with safe failure until the corresponding profile is verified.
 - The [system architecture](docs/architecture/system-architecture.md) page explains how the project is organized, and [project comparison](docs/reference/project-comparison.md) shows how it differs from similar tools.
 - Multiple-agent boundaries, workflow configuration, model choice, prompts, timeouts and retries are described in [workflow customization and execution controls](docs/reference/workflow-customization.md).
-- Create a local project profile with `agent-lifecycle project profile init`; see [project workflow profile](docs/reference/project-workflow-profile.md). Explain the selected profile, plan constraints and adapter capability lineage with [effective configuration](docs/reference/effective-configuration.md), [structured result qualification](docs/reference/structured-result-qualification.md) and [adapter action evidence](docs/reference/adapter-action-evidence.md). Add optional project-owned architecture and dependency evidence with [external verification checks](docs/reference/external-verification-checks.md), or track bounded terminology with [project domain language](docs/reference/project-domain-language.md).
+- Create a local project profile with `agent-lifecycle project profile init`; see [project workflow profile](docs/reference/project-workflow-profile.md). Explain the selected profile, plan constraints and adapter capability lineage with [effective configuration](docs/reference/effective-configuration.md), [structured result qualification](docs/reference/structured-result-qualification.md) and [adapter action evidence](docs/reference/adapter-action-evidence.md). Add optional project-owned architecture and dependency evidence with [external verification checks](docs/reference/external-verification-checks.md), track bounded terminology with [project domain language](docs/reference/project-domain-language.md), coordinate several runs with the read-only [multi-run attention view](docs/reference/multi-run-attention-view.md), or use the optional [security analysis profile](docs/reference/security-analysis-profile.md) for untrusted findings and independently verified remediation.
 - For long sessions, use [context checkpoints and compaction recovery](docs/reference/context-checkpoints.md). They preserve a bounded local continuation package without changing plan authority.
 ## What it gives you
 - A finish-oriented lifecycle: plan, execute, review, and prove the result.
@@ -173,7 +173,7 @@ Adapter installation and support-level details live in [Adapter install](docs/ad
 
 - Start: [English documentation](docs/README.md), [Русская документация](docs/ru/README.md), [Install](docs/guides/install-and-first-run.md), [Quickstart](docs/guides/quickstart.md), [Beginner and advanced workflows](docs/guides/beginner-and-advanced-workflows.md), [Commands by task](docs/guides/commands-by-task.md), [Research workflow](docs/guides/research-workflow.md), [Lifecycle task scenarios](docs/guides/lifecycle-cookbook.md), and [Code review workflows](docs/guides/code-review-workflows.md).
 - Planning and adapters: [Issue to specification drafts](docs/guides/issue-to-spec.md), [Adapter install](docs/adapters/install.md), and [Adapter support matrix](docs/adapters/support-matrix.md).
-- Reference: [System architecture](docs/architecture/system-architecture.md), [workflow customization and execution controls](docs/reference/workflow-customization.md), [execution strategy](docs/reference/execution-strategy.md), [CLI reference](docs/reference/cli.md), [External verification checks](docs/reference/external-verification-checks.md), [Project domain language](docs/reference/project-domain-language.md), [Plan verification](docs/reference/plan-verification.md), [Research evidence](docs/reference/research-evidence.md), [Public locators and redaction](docs/reference/public-locators-and-redaction.md), [Finding-to-check adoption](docs/reference/finding-check-adoption.md), [Source of truth](docs/reference/source-of-truth.md), [Managed lifecycle runner](docs/reference/managed-lifecycle-runner.md), [Managed adapter sessions](docs/reference/managed-adapter-sessions.md), [Portable Agent Plugins](docs/reference/agent-plugins.md), [Plugin publication](docs/reference/plugin-publication.md), [Implementation audit](docs/reference/implementation-audit.md), [Plan completeness](docs/reference/plan-completeness.md), [Public contracts](docs/reference/public-contracts.md), and [Readiness diagnostics](docs/reference/readiness-diagnostics.md).
+- Reference: [System architecture](docs/architecture/system-architecture.md), [workflow customization and execution controls](docs/reference/workflow-customization.md), [execution strategy](docs/reference/execution-strategy.md), [CLI reference](docs/reference/cli.md), [External verification checks](docs/reference/external-verification-checks.md), [Project domain language](docs/reference/project-domain-language.md), [Multi-run attention view](docs/reference/multi-run-attention-view.md), [Plan verification](docs/reference/plan-verification.md), [Research evidence](docs/reference/research-evidence.md), [Public locators and redaction](docs/reference/public-locators-and-redaction.md), [Finding-to-check adoption](docs/reference/finding-check-adoption.md), [Source of truth](docs/reference/source-of-truth.md), [Managed lifecycle runner](docs/reference/managed-lifecycle-runner.md), [Managed adapter sessions](docs/reference/managed-adapter-sessions.md), [Portable Agent Plugins](docs/reference/agent-plugins.md), [Plugin publication](docs/reference/plugin-publication.md), [Implementation audit](docs/reference/implementation-audit.md), [Plan completeness](docs/reference/plan-completeness.md), [Public contracts](docs/reference/public-contracts.md), and [Readiness diagnostics](docs/reference/readiness-diagnostics.md).
 - Quality and resources: [Reference-task evaluation](docs/reference/reference-task-evaluation.md), [model routing](docs/reference/model-routing.md), [quality-cost learning](docs/reference/quality-cost-learning.md), [performance and resource budgets](docs/reference/performance-and-resource-budgets.md), [lifecycle cost accounting](docs/reference/lifecycle-cost.md), [host-local token accounting](docs/reference/host-local-token-accounting.md), [process execution observability](docs/reference/process-execution-observability.md), [Usage export](docs/reference/usage-export.md), and [Evidence integrity](docs/reference/evidence-integrity.md).
 - Profiles and operations: [Project workflow presets](docs/reference/workflow-presets.md), [Project workflow profile](docs/reference/project-workflow-profile.md), [Read-only status views](docs/reference/read-only-status-view.md), [Adapter progress bridge](docs/reference/automatic-progress-bridge.md), [Sandbox boundaries](docs/reference/sandbox-boundaries.md), [Import mappers](docs/reference/import-mappers.md), [Episode retrieval](docs/reference/episode-retrieval.md), [Runner migration](docs/guides/runner-migration-2.md), [Runner recovery records](docs/reference/runner-recovery.md), [Cross-check profile](docs/reference/cross-check-profile.md), [Review Mesh](docs/reference/review-mesh.md), [Risk-bound independent verification](docs/reference/risk-bound-independent-verification.md), [Bug Forensics profile](docs/reference/bug-forensics.md), and [Bug Forensics context budget](docs/reference/bug-forensics-context-budget.md).
 - Release assets: [Task templates](templates/tasks/README.md), [Neutrality scanning](docs/reference/neutrality.md), and [Release security](docs/security/release-security.md).

{agent_lifecycle_kit-2.2.0 → agent_lifecycle_kit-2.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agent-lifecycle-kit"
-version = "2.2.0"
+version = "2.4.0"
 description = "Provider-neutral lifecycle control layer that helps coding agents plan, execute, validate, and prove software tasks to completion."
 readme = "README.md"
 requires-python = ">=3.11,<3.15"

{agent_lifecycle_kit-2.2.0 → agent_lifecycle_kit-2.4.0}/src/agent_lifecycle/_version.py

@@ -1,3 +1,3 @@
 """Package version."""
 
-__version__ = "2.2.0"
+__version__ = "2.4.0"

{agent_lifecycle_kit-2.2.0 → agent_lifecycle_kit-2.4.0}/src/agent_lifecycle/audit/__init__.py

@@ -44,6 +44,12 @@ from agent_lifecycle.audit.review_verdict import (
     require_review_verdict_pass,
     validate_review_verdict,
 )
+from agent_lifecycle.audit.security_analysis import (
+    build_security_analysis_audit,
+    build_security_verification_assignment,
+    validate_security_analysis_audit,
+    validate_security_verification_assignment,
+)
 
 __all__ = [
     "build_bug_forensics_audit",
@@ -58,6 +64,8 @@ __all__ = [
     "build_proof_integrity_receipt",
     "build_receipt_hash_chain",
     "build_root_cause_evidence",
+    "build_security_analysis_audit",
+    "build_security_verification_assignment",
     "compact_review_routing",
     "finding_identity_fields",
     "require_bug_forensics_audit_pass",
@@ -78,4 +86,6 @@ __all__ = [
     "validate_receipt_hash_chain",
     "validate_review_verdict",
     "validate_root_cause_evidence",
+    "validate_security_analysis_audit",
+    "validate_security_verification_assignment",
 ]

{agent_lifecycle_kit-2.2.0 → agent_lifecycle_kit-2.4.0}/src/agent_lifecycle/audit/ownership.py

@@ -53,6 +53,18 @@ def report_has_category(report: dict[str, Any], categories: set[str]) -> bool:
     return any(entry.get("category") in categories for entry in report.get("entries", []))
 
 
+def declared_ownership_paths(manifest: dict[str, Any]) -> list[str]:
+    """Return literal workstream ownership paths for read-only projections."""
+
+    classifiers = _classifiers(manifest, None)
+    paths = {
+        path
+        for roots in classifiers["workstreams"].values()
+        for path in roots
+    }
+    return sorted(paths)
+
+
 def _classifiers(manifest: dict[str, Any], manifest_path: Path | None) -> dict[str, Any]:
     package_value = manifest.get("package")
     package = package_value if isinstance(package_value, dict) else {}

agent_lifecycle_kit-2.4.0/src/agent_lifecycle/audit/security_analysis.py

@@ -0,0 +1,15 @@
+"""Compatibility exports for security-analysis verification evidence."""
+
+from agent_lifecycle.quality.security_analysis import (
+    build_security_analysis_audit,
+    build_security_verification_assignment,
+    validate_security_analysis_audit,
+    validate_security_verification_assignment,
+)
+
+__all__ = [
+    "build_security_analysis_audit",
+    "build_security_verification_assignment",
+    "validate_security_analysis_audit",
+    "validate_security_verification_assignment",
+]

{agent_lifecycle_kit-2.2.0 → agent_lifecycle_kit-2.4.0}/src/agent_lifecycle/cli/dispatch_contracts.py

@@ -37,6 +37,7 @@ from agent_lifecycle.imports import (
     validate_import_result,
     validate_skill_improvement_proposal,
 )
+from agent_lifecycle.imports.security_findings import import_security_findings, validate_security_finding_import
 from agent_lifecycle.planning import (
     build_task_template_library,
     require_task_template_validation_pass,
@@ -52,6 +53,10 @@ from agent_lifecycle.quality import (
     validate_bug_forensics_recipe_library,
     validate_quality_pack,
 )
+from agent_lifecycle.quality.security_analysis import (
+    build_security_analysis_profile,
+    validate_security_finding,
+)
 from agent_lifecycle.review_mesh import (
     build_quorum_from_synthesis,
     build_review_mesh_assignment_packet,
@@ -142,6 +147,17 @@ def _dispatch_evidence(args: argparse.Namespace) -> dict[str, Any]:
 
 
 def _dispatch_import(args: argparse.Namespace) -> dict[str, Any]:
+    if args.import_command in {"security-findings", "security"}:
+        payload = import_security_findings(
+            Path(args.source),
+            source_revision=args.source_revision,
+            expected_source_revision=args.expected_source_revision,
+            source_lineage_digest=args.source_lineage_digest,
+            max_input_bytes=args.max_input_bytes,
+        )
+        if args.out:
+            write_json_create(Path(args.out), payload)
+        return payload
     if args.import_command == "profile-list":
         payload = external_dialect_registry()
         if args.out:
@@ -222,6 +238,24 @@ def _planning_import_profile(
 
 
 def _dispatch_quality(args: argparse.Namespace) -> dict[str, Any]:
+    if args.quality_command in {"security-profile", "security-analysis-profile"}:
+        payload = build_security_analysis_profile()
+        if args.out:
+            write_json_create(Path(args.out), payload)
+        return payload
+    if args.quality_command in {"security-finding-check", "security-analysis-check"}:
+        candidate = read_json_object(Path(args.candidate), label="security finding import")
+        if candidate.get("schemaVersion") == "agent-security-finding-import.v1":
+            payload = validate_security_finding_import(
+                candidate, expected_source_revision=args.expected_source_revision
+            )
+        else:
+            payload = validate_security_finding(
+                candidate, expected_source_revision=args.expected_source_revision
+            )
+        if args.out:
+            write_json_create(Path(args.out), payload)
+        return payload
     if args.quality_command == "pack-check":
         manifest = (
             read_json_object(Path(args.manifest), label="quality pack")

{agent_lifecycle_kit-2.2.0 → agent_lifecycle_kit-2.4.0}/src/agent_lifecycle/cli/dispatch_observability.py

@@ -3,9 +3,11 @@
 from __future__ import annotations
 
 import argparse
+from datetime import UTC, datetime
 from pathlib import Path
 from typing import Any
 
+from agent_lifecycle.cli.dispatch_metrics import _dispatch_execution_report
 from agent_lifecycle.context import check_context, load_context_profile, render_context
 from agent_lifecycle.context.checkpoint_store import (
     restore_context_checkpoint,
@@ -33,6 +35,7 @@ from agent_lifecycle.host_protocol.thread_bridge import (
     prepare_thread_request,
     validate_thread_exchange,
 )
+from agent_lifecycle.imports.security_findings import import_security_findings
 from agent_lifecycle.metrics import (
     build_lifecycle_cost_summary,
     build_lifecycle_recommendation_summary,
@@ -54,7 +57,6 @@ from agent_lifecycle.metrics.audit_optimization import (
     validate_audit_optimization_report,
 )
 from agent_lifecycle.metrics.audit_samples import build_audit_samples
-from agent_lifecycle.cli.dispatch_metrics import _dispatch_execution_report
 from agent_lifecycle.model_routing import (
     resolve_model_route,
     validate_host_model_profile,
@@ -66,10 +68,12 @@ from agent_lifecycle.policy.proposals import (
     build_optimization_proposal,
     require_optimization_proposal_pass,
 )
+from agent_lifecycle.quality.security_analysis import build_security_analysis_profile
 from agent_lifecycle.reporting import (
     build_change_summary_receipt,
     build_lifecycle_progress_view,
     build_lifecycle_progress_watch,
+    build_multi_run_attention_view,
     build_progress_bridge_receipt,
     build_status_view,
     build_workflow_event_feed,
@@ -127,7 +131,8 @@ def _dispatch_thread(args: argparse.Namespace) -> dict[str, Any]:
                 "thread request and receipt lineage validation failed",
                 {"validation": validation},
             )
-        limits = request.get("limits") if isinstance(request.get("limits"), dict) else {}
+        raw_limits = request.get("limits")
+        limits: dict[str, Any] = raw_limits if isinstance(raw_limits, dict) else {}
         imported = prepare_thread_context_import(
             operation_id=request["operationId"],
             source_receipt_digest=receipt["receiptDigest"],
@@ -148,6 +153,31 @@ def _dispatch_thread(args: argparse.Namespace) -> dict[str, Any]:
 
 
 def _dispatch_report(args: argparse.Namespace) -> dict[str, Any] | str:
+    if args.report_command == "security-analysis":
+        findings = []
+        imports = []
+        for item in args.finding:
+            imported = import_security_findings(
+                Path(item),
+                source_revision=args.source_revision,
+                expected_source_revision=args.expected_source_revision,
+            )
+            imports.append(imported)
+            findings.extend(imported.get("findings", []))
+        payload = {
+            "schemaVersion": "agent-security-analysis-report.v1",
+            "status": "PASS" if all(item.get("status") == "PASS" for item in imports) else "FAIL",
+            "profile": build_security_analysis_profile() if args.profile else None,
+            "imports": imports,
+            "findings": findings,
+            "trusted": False,
+            "authorityClaimed": False,
+            "productionPromotionClaimed": False,
+        }
+        payload["reportDigest"] = canonical_digest(payload)
+        if args.out:
+            write_json_create(Path(args.out), payload)
+        return payload
     if args.report_command == "status-view":
         payload = build_status_view(
             project_root=Path(args.project_root),
@@ -181,6 +211,18 @@ def _dispatch_report(args: argparse.Namespace) -> dict[str, Any] | str:
         if args.out:
             write_json_create(Path(args.out), payload)
         return payload
+    if args.report_command in {"multi-run", "attention"}:
+        payload = build_multi_run_attention_view(
+            project_root=Path(args.project_root),
+            run_roots=[Path(item) for item in args.run_root],
+            max_runs=args.max_runs,
+            max_bytes_per_run=args.max_bytes_per_run,
+            stale_after_seconds=args.stale_after_seconds,
+            now=_parse_report_time(args.now),
+        )
+        if args.out:
+            write_json_create(Path(args.out), payload)
+        return payload
     if args.report_command == "progress":
         if args.watch:
             payload = build_lifecycle_progress_watch(
@@ -215,6 +257,18 @@ def _dispatch_report(args: argparse.Namespace) -> dict[str, Any] | str:
     raise LifecycleError("command-not-implemented", "report command is not implemented")
 
 
+def _parse_report_time(value: str | None) -> datetime | None:
+    if value is None:
+        return None
+    try:
+        parsed = datetime.fromisoformat(value.replace("Z", "+00:00"))
+    except ValueError as exc:
+        raise LifecycleError("multi-run-invalid-time", "--now must be an ISO-8601 timestamp") from exc
+    if parsed.tzinfo is None:
+        return parsed.replace(tzinfo=UTC)
+    return parsed.astimezone(UTC)
+
+
 def _dispatch_context(args: argparse.Namespace) -> dict[str, Any]:
     if args.context_command == "profile-check":
         return load_context_profile(Path(args.profile))
@@ -328,7 +382,10 @@ def _dispatch_context_checkpoint(args: argparse.Namespace) -> dict[str, Any]:
 def _require_checkpoint_output_root(root: Path) -> None:
     resolved = root.resolve()
     if ".alk" not in resolved.parts or not resolved.name == "checkpoints":
-        raise LifecycleError("context-checkpoint-output-root-invalid", "checkpoint output must remain in a .alk/context/checkpoints directory")
+        raise LifecycleError(
+            "context-checkpoint-output-root-invalid",
+            "checkpoint output must remain in a .alk/context/checkpoints directory",
+        )
 
 
 def _dispatch_goal(args: argparse.Namespace) -> dict[str, Any] | str:
@@ -383,12 +440,20 @@ def _dispatch_model(args: argparse.Namespace) -> dict[str, Any]:
         return validate_model_routing_profile(profile)
     if args.model_command == "route":
         routing_profile = read_json_object(Path(args.profile), label="model routing profile")
-        host_profile = read_json_object(Path(args.host_profile), label="host model profile") if args.host_profile else None
+        host_profile = (
+            read_json_object(Path(args.host_profile), label="host model profile")
+            if args.host_profile
+            else None
+        )
         request = read_json_object(Path(args.request), label="model route request")
         return resolve_model_route(request, routing_profile, host_profile=host_profile)
     if args.model_command == "usage-check":
         receipt = read_json_object(Path(args.receipt), label="model usage receipt")
-        decision = read_json_object(Path(args.route_decision), label="model route decision") if args.route_decision else None
+        decision = (
+            read_json_object(Path(args.route_decision), label="model route decision")
+            if args.route_decision
+            else None
+        )
         targets = read_json_object(Path(args.budget_targets), label="budget targets") if args.budget_targets else None
         result = validate_usage_receipt(receipt, budget_targets=targets, route_decision=decision)
         if result["status"] == "FAIL":
@@ -401,7 +466,7 @@ def _dispatch_model(args: argparse.Namespace) -> dict[str, Any]:
     raise LifecycleError("command-not-implemented", "model command is not implemented")
 
 
-def _dispatch_metrics(args: argparse.Namespace) -> dict[str, Any]:
+def _dispatch_metrics(args: argparse.Namespace) -> dict[str, Any] | str:
     if args.metrics_command == "cost-check":
         report = read_json_object(Path(args.receipt), label="lifecycle cost report")
         return require_lifecycle_cost_pass(validate_lifecycle_cost_report(report))
@@ -505,32 +570,15 @@ def _dispatch_metrics(args: argparse.Namespace) -> dict[str, Any]:
         write_json_create(Path(args.out), payload)
         return payload
     if args.metrics_command == "audit-report":
-        samples = _read_audit_samples(args.sample)
-        candidates = _read_json_items(args.candidate_profile, label="candidate profile")
-        references = _read_json_items(args.reference_task, label="reference task")
-        holdouts = _read_json_items(args.holdout_task, label="holdout task")
-        current = read_json_object(Path(args.current_profile), label="current optimization profile") if args.current_profile else None
-        report = build_audit_optimization_report(
-            samples,
-            candidate_profiles=candidates,
-            reference_tasks=references,
-            holdout_tasks=holdouts,
-            task_shape=args.task_shape,
-            quality_floor=args.quality_floor,
-            current_profile=current,
-        )
-        validation = validate_audit_optimization_report(report)
-        if validation["status"] != "PASS":
-            raise LifecycleError("audit-optimization-report-invalid", "audit optimization report validation failed", {"validation": validation})
-        write_json_create(Path(args.out), report)
-        if args.terminal:
-            return render_audit_optimization_terminal(report)
-        return report
+        return _dispatch_audit_report(args)
     if args.metrics_command == "audit-proposal":
         report = read_json_object(Path(args.report), label="audit optimization report")
-        recommendation = report.get("recommendation") if isinstance(report.get("recommendation"), dict) else {}
+        raw_recommendation = report.get("recommendation")
+        proposal_recommendation: dict[str, Any] = (
+            raw_recommendation if isinstance(raw_recommendation, dict) else {}
+        )
         proposal = build_optimization_proposal(
-            recommendation,
+            proposal_recommendation,
             approved=args.approved,
             target_kind=args.target_kind,
             target_revision=args.target_revision,
@@ -545,11 +593,44 @@ def _dispatch_metrics(args: argparse.Namespace) -> dict[str, Any]:
     raise LifecycleError("command-not-implemented", "metrics command is not implemented")
 
 
+def _dispatch_audit_report(args: argparse.Namespace) -> dict[str, Any] | str:
+    samples = _read_audit_samples(args.sample)
+    candidates = _read_json_items(args.candidate_profile, label="candidate profile")
+    references = _read_json_items(args.reference_task, label="reference task")
+    holdouts = _read_json_items(args.holdout_task, label="holdout task")
+    current = (
+        read_json_object(Path(args.current_profile), label="current optimization profile")
+        if args.current_profile
+        else None
+    )
+    report = build_audit_optimization_report(
+        samples,
+        candidate_profiles=candidates,
+        reference_tasks=references,
+        holdout_tasks=holdouts,
+        task_shape=args.task_shape,
+        quality_floor=args.quality_floor,
+        current_profile=current,
+    )
+    validation = validate_audit_optimization_report(report)
+    if validation["status"] != "PASS":
+        raise LifecycleError(
+            "audit-optimization-report-invalid",
+            "audit optimization report validation failed",
+            {"validation": validation},
+        )
+    write_json_create(Path(args.out), report)
+    if args.terminal:
+        return render_audit_optimization_terminal(report)
+    return report
+
+
 def _read_audit_samples(paths: list[str]) -> list[dict[str, Any]]:
     samples: list[dict[str, Any]] = []
     for item in paths:
         payload = read_json_object(Path(item), label="audit sample")
-        rows = payload.get("samples") if isinstance(payload.get("samples"), list) else [payload]
+        raw_samples = payload.get("samples")
+        rows = raw_samples if isinstance(raw_samples, list) else [payload]
         samples.extend(row for row in rows if isinstance(row, dict))
     return samples
 
@@ -558,7 +639,8 @@ def _read_json_items(paths: list[str], *, label: str) -> list[dict[str, Any]]:
     items: list[dict[str, Any]] = []
     for item in paths:
         payload = read_json_object(Path(item), label=label)
-        rows = payload if isinstance(payload, list) else payload.get("items") if isinstance(payload.get("items"), list) else [payload]
+        raw_items = payload.get("items")
+        rows = raw_items if isinstance(raw_items, list) else [payload]
         items.extend(row for row in rows if isinstance(row, dict))
     return items
 

{agent_lifecycle_kit-2.2.0 → agent_lifecycle_kit-2.4.0}/src/agent_lifecycle/cli/observability_parsers.py

@@ -17,6 +17,14 @@ def _add_report_parser(subparsers: argparse._SubParsersAction[argparse.ArgumentP
     event_feed = report_sub.add_parser("event-feed")
     event_feed.add_argument("--state", required=True)
     event_feed.add_argument("--out")
+    multi_run = report_sub.add_parser("multi-run", aliases=["attention"])
+    multi_run.add_argument("--project-root", default=".")
+    multi_run.add_argument("--run-root", "--run", dest="run_root", action="append", default=[])
+    multi_run.add_argument("--max-runs", type=int, default=32)
+    multi_run.add_argument("--max-bytes-per-run", type=int, default=1_048_576)
+    multi_run.add_argument("--stale-after-seconds", type=int, default=86_400)
+    multi_run.add_argument("--now")
+    multi_run.add_argument("--out")
     progress = report_sub.add_parser("progress")
     progress.add_argument("--state", required=True)
     progress.add_argument("--usage-receipt", action="append", default=[])
@@ -57,3 +65,9 @@ def _add_report_parser(subparsers: argparse._SubParsersAction[argparse.ArgumentP
     change_summary.add_argument("--staged", action="store_true")
     change_summary.add_argument("--path", action="append", default=[])
     change_summary.add_argument("--out")
+    security = report_sub.add_parser("security-analysis")
+    security.add_argument("--finding", action="append", default=[])
+    security.add_argument("--source-revision")
+    security.add_argument("--expected-source-revision")
+    security.add_argument("--profile", action="store_true")
+    security.add_argument("--out")

{agent_lifecycle_kit-2.2.0 → agent_lifecycle_kit-2.4.0}/src/agent_lifecycle/cli/parsers.py

@@ -235,6 +235,13 @@ def _add_import_parser(subparsers: argparse._SubParsersAction[argparse.ArgumentP
     external_check.add_argument("--candidate", required=True)
     proposal_check = import_sub.add_parser("proposal-check")
     proposal_check.add_argument("--proposal", required=True)
+    security_import = import_sub.add_parser("security-findings", aliases=["security"])
+    security_import.add_argument("--source", required=True)
+    security_import.add_argument("--source-revision")
+    security_import.add_argument("--expected-source-revision")
+    security_import.add_argument("--source-lineage-digest")
+    security_import.add_argument("--max-input-bytes", type=int, default=4 * 1024 * 1024)
+    security_import.add_argument("--out")
 
 
 def _add_quality_parser(subparsers: argparse._SubParsersAction[argparse.ArgumentParser]) -> None:
@@ -271,6 +278,12 @@ def _add_quality_parser(subparsers: argparse._SubParsersAction[argparse.Argument
     external_check.add_argument("--operation-id", required=True)
     external_check.add_argument("--blocking-required", action="store_true")
     external_check.add_argument("--out")
+    security_profile = quality_sub.add_parser("security-profile", aliases=["security-analysis-profile"])
+    security_profile.add_argument("--out")
+    security_check = quality_sub.add_parser("security-finding-check", aliases=["security-analysis-check"])
+    security_check.add_argument("--candidate", required=True)
+    security_check.add_argument("--expected-source-revision")
+    security_check.add_argument("--out")
 
 
 def _add_review_mesh_parser(subparsers: argparse._SubParsersAction[argparse.ArgumentParser]) -> None: