agentspm 0.1.1__tar.gz

agentspm-0.1.1/.env.example

@@ -0,0 +1,74 @@
+# agentspm environment template (FR-D5: tenant-agnostic by design).
+# Copy to .env and fill in values for YOUR tenant. The .env file is gitignored
+# and must never be committed. The values below are DOCUMENTED SYNTHETIC
+# placeholders (see scripts/identifier_scan.py) — never put real identifiers
+# into tracked files.
+
+# --- Entra ID collector (first IdP collector implementation) -----------------
+# Create a DEDICATED app registration for the collector (never reuse another
+# app), with READ-ONLY application permissions only:
+#   - Application.Read.All
+#   - DelegatedPermissionGrant.Read.All  (ONLY if consent grants are in scope)
+#   - Directory.Read.All is FORBIDDEN (would expose users/groups/devices)
+#   - no write scopes; tenant-wide admin consent documented
+# Credential: certificate preferred over client secret; expiry <= 180 days.
+AGENTSPM_TENANT_ID=11111111-1111-4111-8111-111111111111
+AGENTSPM_CLIENT_ID=22222222-2222-4222-8222-222222222222
+
+# Path to the client certificate used for OIDC client-credentials auth.
+# Keep key material outside the repository; *.pem/*.key files are commit-blocked.
+AGENTSPM_CLIENT_CERT_PATH=/path/to/collector-client-cert.pem
+
+# Client SECRET fallback (used only when no certificate path is configured;
+# the collector logs a WARN — certificate is the SEC-D3 preference):
+#AGENTSPM_CLIENT_SECRET=
+
+# URN organization segment used in generated asset ids
+# (agentspm:<type>:<org>:<name>); lowercase letters/digits/hyphens.
+AGENTSPM_ORG=contoso
+
+# --- gitrepo collector --------------------------------------------------------
+# READ-ONLY repository token: GitHub fine-grained/App token (contents: read)
+# or a GitLab token with the read_api scope; expiry <= 90 days.
+#AGENTSPM_GITREPO_TOKEN=
+
+# --- gateway collector --------------------------------------------------------
+# Client secret for the OIDC client-credentials flow (posture-reader scope).
+#AGENTSPM_GATEWAY_CLIENT_SECRET=
+
+# --- shared HTTP client (all collectors) --------------------------------------
+# Per-request timeout in seconds and the retry budget (429/5xx + backoff;
+# Retry-After is honored on throttling responses).
+#AGENTSPM_HTTP_TIMEOUT=30
+#AGENTSPM_HTTP_MAX_ATTEMPTS=4
+# Corporate CA bundle and egress proxy (standard HTTPS_PROXY/SSL_CERT_FILE
+# are honored as well via trust_env).
+#AGENTSPM_CA_BUNDLE=/etc/pki/tls/certs/corp-bundle.pem
+#AGENTSPM_HTTPS_PROXY=http://proxy.example.com:8080
+
+# --- Evidence store -----------------------------------------------------------
+# Local directory for raw snapshots and full (non-redacted) reports.
+# Keep it on an encrypted volume; it never leaves the host and is gitignored.
+AGENTSPM_EVIDENCE_STORE=./evidence-store
+
+# --- CLI pipeline ---------------------------------------------------------------
+# SQLite graph database written by `agentspm scan` (default: ./agentspm.sqlite).
+#AGENTSPM_DB=agentspm.sqlite
+# Deployment config path (default: ./agentspm.yaml, then the example config).
+#AGENTSPM_CONFIG=deploy/agentspm.example.yaml
+
+# OPA binary + sha256 pin: `agentspm evaluate` ALWAYS verifies the binary
+# against this pin and refuses to run an unpinned engine (INV-07).
+#AGENTSPM_OPA_PATH=/usr/local/bin/opa
+#AGENTSPM_OPA_SHA256=<sha256 of the pinned opa binary>
+# Policy pack override (default: ./policies/v0.1).
+#AGENTSPM_POLICIES_DIR=policies/v0.1
+
+# Pseudonymization key for redacted reports (default location:
+# <evidence store>/pseudonymization.key; generated on first use, mode 0600).
+# The alias->value mapping stays next to the key — evidence store only.
+#AGENTSPM_PSEUDO_KEY_PATH=./evidence-store/pseudonymization.key
+
+# age binary for `agentspm export` (ASSUM-08: system binary, no Python age
+# dependency; default /usr/bin/age, then PATH).
+#AGENTSPM_AGE_PATH=/usr/bin/age

agentspm-0.1.1/.githooks/pre-commit

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# agentspm pre-commit hook (SEC-D5) — active from the FIRST commit.
+# BLOCK: sensitive file names, secret patterns, real identifiers (NFR-D1).
+# WARN:  forbidden language patterns (pre-push and CI BLOCK them).
+# Install: scripts/setup-hooks.sh  (git config core.hooksPath .githooks)
+#
+# Note: the secret regexes are written in a self-non-matching form (e.g. a
+# character class instead of the final literal character) so that committing
+# this hook and the scan config does not trip the scan itself.
+set -euo pipefail
+
+mapfile -t STAGED < <(git diff --cached --name-only --diff-filter=ACM)
+if [ "${#STAGED[@]}" -eq 0 ]; then
+  exit 0
+fi
+
+fail=0
+
+# --- 1. sensitive file names (never commit these) ---------------------------
+for f in "${STAGED[@]}"; do
+  base=$(basename "$f")
+  case "$base" in
+    .env|.env.local|.env.production)
+      echo "BLOCK: sensitive file staged: $f (use .env.example)"; fail=1 ;;
+    *.pem|*.key|id_rsa|id_ed25519)
+      echo "BLOCK: key material staged: $f"; fail=1 ;;
+  esac
+done
+
+# --- 2. secret content scan (gitleaks-style) --------------------------------
+SECRET_PATTERNS=(
+  'AGE-SECRET-KEY-[0-9A-Z]'
+  'BEGIN[[:space:]]+[A-Z ]*PRIVATE[[:space:]]+KEY'
+  'gw-[A-Za-z0-9]{8,}'
+  'AKIA[0-9A-Z]{16}'
+  'ssh-rsa[[:space:]]+AAAA'
+  "(password|secret|api[_-]?key|token)[[:space:]]*=[[:space:]]*[\"'][^\"']{8,}"
+)
+for f in "${STAGED[@]}"; do
+  # Allowlist (Git Hook Strategy): fixtures carrying an explicit synthetic marker.
+  if [[ "$f" == tests/fixtures/* ]] && git show ":$f" 2>/dev/null | grep -q 'synthetic: true'; then
+    continue
+  fi
+  content=$(git show ":$f" 2>/dev/null) || continue
+  for pat in "${SECRET_PATTERNS[@]}"; do
+    if hits=$(printf '%s\n' "$content" | grep -I -n -E "$pat"); then
+      echo "BLOCK: secret-pattern match in $f:"
+      echo "$hits" | head -5
+      fail=1
+    fi
+  done
+done
+
+# --- 3. identifier scan on staged content (NFR-D1) — BLOCK ------------------
+if ! python3 scripts/identifier_scan.py --staged; then
+  echo "BLOCK: real identifiers must never enter git history (NFR-D1)."
+  fail=1
+fi
+
+# --- 4. language lint — WARN at commit (pre-push/CI BLOCK) ------------------
+if ! python3 scripts/language_lint.py --staged; then
+  echo "WARN: forbidden language patterns in staged files (pre-push will BLOCK)."
+fi
+
+if [ "$fail" -ne 0 ]; then
+  echo "pre-commit: BLOCKED. Fix the findings above; never bypass with --no-verify."
+fi
+exit "$fail"

agentspm-0.1.1/.githooks/pre-push

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# agentspm pre-push hook (SEC-D5).
+# BLOCK: forbidden language patterns, unignored dependency vulnerabilities
+#        (CRITICAL/HIGH policy — any unignored pip-audit finding blocks),
+#        policy lints (default-pass, unknown_if, anchors, CONTROLS.md drift)
+#        and the opa test suite when an opa binary is available.
+set -euo pipefail
+
+echo "[pre-push] language lint (BLOCK)"
+python3 scripts/language_lint.py
+
+echo "[pre-push] policy lints (BLOCK)"
+python3 scripts/default_pass_lint.py
+if [ -d policies ] && command -v uv >/dev/null 2>&1; then
+  uv run python scripts/unknown_if_lint.py
+  uv run python scripts/anchor_lint.py
+  uv run python scripts/generate_controls_md.py --check
+fi
+
+echo "[pre-push] opa test (policy pack, BLOCK when opa is available)"
+OPA_BIN="${OPA_BIN:-$HOME/.local/bin/opa}"
+if ! command -v "$OPA_BIN" >/dev/null 2>&1; then
+  OPA_BIN=$(command -v opa || true)
+fi
+if [ -n "$OPA_BIN" ] && [ -d policies/v0.1 ]; then
+  "$OPA_BIN" check --strict --capabilities policies/v0.1/capabilities.json \
+    policies/v0.1/rego/ policies/v0.1/tests/
+  "$OPA_BIN" test policies/v0.1/ --capabilities policies/v0.1/capabilities.json
+else
+  echo "WARN: opa not available; policy tests skipped locally (CI enforces them)."
+fi
+
+echo "[pre-push] dependency audit (pip-audit — unignored finding = BLOCK)"
+if command -v uv >/dev/null 2>&1; then
+  req=$(mktemp)
+  trap 'rm -f "$req"' EXIT
+  # Export nese cely uzamceny uzaver s hashi, takze `--no-deps` nize je zamer,
+  # ne zjednoduseni (detail v komentari u stejneho kroku v ci.yml).
+  uv export --locked --no-emit-project --format requirements.txt --quiet -o "$req"
+  # Allowlisted findings = documented false positives WITH expiry, kept in
+  # .vuln-scan-config.yaml (pre_push.dependency_audit.ignore).
+  ignore_args=()
+  while IFS= read -r vid; do
+    ignore_args+=(--ignore-vuln "$vid")
+  done < <(python3 - <<'PYEOF'
+import re
+from pathlib import Path
+
+cfg = Path(".vuln-scan-config.yaml")
+if cfg.exists():
+    for m in re.finditer(r"^\s*-\s*id:\s*([A-Za-z0-9-]+)", cfg.read_text(), re.M):
+        print(m.group(1))
+PYEOF
+)
+  if ! uv run pip-audit -r "$req" --no-deps --disable-pip "${ignore_args[@]}"; then
+    echo "BLOCK: pip-audit reported unignored vulnerabilities."
+    exit 1
+  fi
+else
+  echo "WARN: uv not available; dependency audit skipped locally (CI enforces it)."
+fi
+
+echo "[pre-push] OK"

agentspm-0.1.1/.github/workflows/ci.yml

@@ -0,0 +1,194 @@
+# agentspm CI — every gate is enforcing: NO continue-on-error anywhere.
+# Runs without any gateway checkout or network dependency on it (INV-09 / AK-13).
+name: ci
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+env:
+  # 1.21.2 -> 1.21.4 dne 27. 10. 2026: trivy nasel v pinnute binarce HIGH
+  # CVE-2026-111943 (crypto/x509 v go1.27.2, MITM pres nedouveryhodne
+  # intermediate certifikaty). 1.21.4 je postavena go1.27.3, tedy opravenou.
+  # Pin se nesnizuje — nizsi verze znamena vratit tu zranitelnost.
+  OPA_VERSION: "1.21.4"
+  OPA_SHA256: "2ab571f367f293bb19523b76f92f1945bbf245003392c7f392903f95c2b9b630"
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - run: uv sync --locked
+      - name: ruff
+        run: uv run ruff check .
+      - name: mypy (strict)
+        run: uv run mypy src/
+
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - run: uv sync --locked
+      - name: bandit (SAST, enforcing — MEDIUM+ blocks per .vuln-scan-config.yaml)
+        run: uv run bandit -c pyproject.toml -r src scripts --severity-level medium
+      - name: pip-audit (enforcing — exit code gates the job)
+        run: |
+          # `uv export` vypisuje CELOU uzamcenou tranzitivni mnozinu VCETNE hashu
+          # (dnes 1413 radku `--hash=`), takze `--no-deps` nize je spravne: soubor
+          # uz je kompletni uzaver a pip-audit nema co doresovat. pip-audit k tomu
+          # tiskne obecnou radu "users are encouraged to fully hash your pinned
+          # dependencies" -- ta se NA TENHLE pripad nevztahuje; neopravovat to
+          # odstranenim `--no-deps`, tim by se audit rozsiril o nezamcene verze.
+          uv export --locked --no-emit-project --format requirements.txt -o requirements-audit.txt
+          uv run pip-audit -r requirements-audit.txt --no-deps --disable-pip
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - run: uv sync --locked
+      - name: download OPA (pinned; policy findings tests shell out to it)
+        run: |
+          curl -sSfL -o /tmp/opa "https://openpolicyagent.org/downloads/v${OPA_VERSION}/opa_linux_amd64_static"
+          echo "${OPA_SHA256}  /tmp/opa" | sha256sum --check
+          chmod +x /tmp/opa
+      - name: pytest + coverage (OPA_BIN set so no policy test skips)
+        run: uv run pytest --cov=agentspm --cov-report=term-missing
+        env:
+          OPA_BIN: /tmp/opa
+
+  schema-validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - run: uv sync --locked
+      - name: validate schema examples against the v0.1 schema
+        run: uv run python scripts/validate_examples.py
+
+  opa:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: download OPA (pinned version + sha256)
+        run: |
+          curl -sSfL -o opa "https://openpolicyagent.org/downloads/v${OPA_VERSION}/opa_linux_amd64_static"
+          echo "${OPA_SHA256}  opa" | sha256sum --check
+          chmod +x opa
+      - name: opa check (strict, pinned capabilities — no network builtins)
+        run: >-
+          ./opa check --strict
+          --capabilities policies/v0.1/capabilities.json
+          policies/v0.1/rego/ policies/v0.1/tests/
+      - name: opa test (13 controls x 3 tri-state fixtures + adversarial)
+        run: ./opa test policies/v0.1/ -v --capabilities policies/v0.1/capabilities.json
+
+  # Offline/proxy install test (B10): the wheel must install into a clean venv
+  # with NO index access, from a wheelhouse prepared ahead of time — the
+  # bastion/air-gapped deployment path (docs/ARCHITECTURE.md).
+  offline-install:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - name: build the wheel
+        run: uv build
+      - name: prepare the offline wheelhouse (locked runtime deps, wheels only)
+        run: |
+          uv export --locked --no-emit-project --no-dev \
+            --format requirements.txt -o /tmp/requirements-runtime.txt
+          python3 -m pip download --only-binary :all: \
+            -r /tmp/requirements-runtime.txt -d /tmp/wheelhouse
+      - name: install into a clean venv with --no-index + smoke test
+        run: |
+          python3 -m venv /tmp/venv-offline
+          /tmp/venv-offline/bin/pip install --no-index \
+            --find-links /tmp/wheelhouse --find-links dist/ dist/agentspm-*.whl
+          /tmp/venv-offline/bin/agentspm --help
+
+  identifier-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # full history for the --history scan
+      - name: identifier scan — worktree (NFR-D1)
+        run: python3 scripts/identifier_scan.py
+      - name: identifier scan — full git history (all refs)
+        run: python3 scripts/identifier_scan.py --history
+
+  secret-scan:
+    # P1 zadal "gitleaks/trufflehog + identifier_scan.py --history", ale v CI byl
+    # jen ten druhy. Sken tajemstvi tedy existoval jako VETA v docs/RELEASE-GATE.md,
+    # ne jako brana -- a veta nikdy nespadne. Dolozeno merenim 18. 10. 2026: gitleaks
+    # nad celou historii hlasi 0 nalezu, takze tenhle job startuje ze zelene a od
+    # teto chvile to hlida, misto aby to nekdo rucne pripominal pred publikaci.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # cela historie, jinak sken kryje jen posledni commit
+      - name: gitleaks — full history (P1)
+        # Pripnuto na SHA, ne na tag: tag je pohybliva reference, a projekt, ktery
+        # pinuje OPA na sha256 a podepisuje artefakty, nema dovoz CI akce resit
+        # slabeji. SHA = tag v2.3.9.
+        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7
+        env:
+          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false"
+          GITLEAKS_ENABLE_SUMMARY: "true"
+
+  image-scan:
+    # P5 zada "pip-audit/trivy s exit-code != 0". pip-audit v jobu `security` je
+    # enforcing, ale image z Containerfile se do dneska nikde nestavel ani neskenoval.
+    # Proc to nestaci: v sesterskem projektu hlasil pip-audit 0 nalezu, zatimco sken
+    # IMAGE nasel 4 HIGH ve knihovnach vendorovanych uvnitr pipu. Audit deklarovanych
+    # zavislosti a sken vysledneho image jsou dve ruzne otazky.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: build image (Containerfile)
+        run: docker build -f Containerfile -t agentspm:ci .
+      - name: trivy — image, enforcing
+        # SHA = tag v0.36.0. Prvni pokus mel `@0.28.0`, coz NEEXISTUJE a job
+        # spadl na "unable to resolve action" -- tedy brana, ktera nemerila nic,
+        # jen hlasila cervenou ze spatneho duvodu. Verze akce patri overit, ne
+        # odhadnout.
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
+        with:
+          image-ref: agentspm:ci
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          exit-code: "1" # NIKDY 0: brana, ktera nemuze selhat, nehlida nic
+          format: table
+          # Explicitni cesta misto spolehani na default: kazda vyjimka MUSI
+          # byt v reviewovanem .trivyignore s duvodem a podminkou odstraneni.
+          trivyignores: .trivyignore
+
+  language-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: language lint (BLOCK outside docs/decisions/)
+        run: python3 scripts/language_lint.py
+
+  policy-lints:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - run: uv sync --locked
+      - name: default-pass lint (fail-open ban in rego)
+        run: python3 scripts/default_pass_lint.py
+      - name: unknown_if lint (every control declares unknown_if)
+        run: uv run python scripts/unknown_if_lint.py
+      - name: anchor lint (forbidden/required regulatory anchors per 05c)
+        run: uv run python scripts/anchor_lint.py
+      - name: CONTROLS.md is current (regenerate + diff = 0)
+        run: uv run python scripts/generate_controls_md.py --check

agentspm-0.1.1/.github/workflows/release.yml

@@ -0,0 +1,150 @@
+# agentspm release (B10) — MANUAL ONLY (workflow_dispatch).
+#
+# Produces: wheel + sdist, CycloneDX SBOM, SHA256SUMS, KEYLESS cosign
+# signatures (Sigstore bundles), and a GitHub Release.
+#
+# Signing is KEYLESS (P4 decision, 2026-11-11, maintainer): the job's GitHub
+# OIDC identity obtains a short-lived certificate from Fulcio and the
+# signature is recorded in the public Rekor transparency log. Consequences,
+# understood and accepted (docs/RELEASE-GATE.md P4):
+#   * there is NO private signing key — nothing to provision, leak or rotate;
+#   * every release is publicly visible in Rekor (repo + workflow identity);
+#     that is why the FIRST keyless run happens at publication time, not in
+#     the private phase (the earlier private-phase design was key-based with
+#     --tlog-upload=false for exactly this reason);
+#   * verification pins the WORKFLOW identity, not a public key:
+#       cosign verify-blob \
+#         --bundle <artifact>.sigstore.json \
+#         --certificate-identity-regexp \
+#           '^https://github.com/vojtahampl/agentspm/\.github/workflows/release\.yml@' \
+#         --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+#         <artifact>
+#     The .sigstore.json bundle carries the certificate + Rekor proof, so the
+#     verify step works OFFLINE (air-gapped consumers verify the downloaded
+#     bundle; SHA256SUMS remains as the key-free fallback).
+name: release
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag (e.g. v0.1.0 or v0.1.0-dev.1)"
+        required: true
+        type: string
+
+permissions:
+  contents: write # create the GitHub Release
+  id-token: write # keyless signing: the OIDC token IS the signing identity
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment: release # branch-restricted; keeps the manual gate (T-15)
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: refuse to release from a non-default branch
+        run: |
+          if [ "${GITHUB_REF_NAME}" != "main" ]; then
+            echo "releases are cut from main only (got ${GITHUB_REF_NAME})" >&2
+            exit 1
+          fi
+
+      - name: guard — tag must equal pyproject version (RR-10)
+        env:
+          TAG: ${{ inputs.tag }}
+        run: |
+          python3 - <<'EOF'
+          import os, pathlib, re, sys, tomllib
+
+          tag = os.environ["TAG"]
+          project = tomllib.loads(pathlib.Path("pyproject.toml").read_text())
+          version = project["project"]["version"]
+
+          # Tag convention vX.Y.Z[-dev.N]; pyproject is PEP 440 (X.Y.Z[.devN]).
+          normalized_tag = tag.removeprefix("v")
+          normalized_tag = re.sub(r"-dev\.?(\d+)$", r".dev\1", normalized_tag)
+          # bare "-dev" tags normalize to ".dev0", matching "0.1.0.dev0"
+          normalized_tag = re.sub(r"-dev$", r".dev0", normalized_tag)
+
+          if normalized_tag != version:
+              sys.exit(
+                  f"tag {tag!r} (normalized {normalized_tag!r}) does not match "
+                  f"pyproject version {version!r} — bump pyproject.toml first; "
+                  "one version, everywhere (RR-10)"
+              )
+          print(f"tag {tag} == pyproject {version}: OK")
+          EOF
+
+      - name: guard — CHANGELOG has an entry for this version
+        env:
+          TAG: ${{ inputs.tag }}
+        run: |
+          base="${TAG#v}"; base="${base%%-dev*}"
+          if ! grep -q "^## \[${base}\]" CHANGELOG.md; then
+            echo "CHANGELOG.md has no '## [${base}]' section — write the release notes first (RR-12)" >&2
+            exit 1
+          fi
+          echo "CHANGELOG entry for ${base}: OK"
+
+      - uses: astral-sh/setup-uv@v5
+      - run: uv sync --locked
+
+      - name: build wheel + sdist + SBOM + checksums
+        run: scripts/build_release.sh
+
+      - name: install smoke test — the exact artifact, offline, clean venv
+        run: |
+          uv export --locked --no-emit-project --no-dev \
+            --format requirements.txt -o /tmp/requirements-runtime.txt
+          python3 -m pip download --only-binary :all: \
+            -r /tmp/requirements-runtime.txt -d /tmp/wheelhouse
+          python3 -m venv /tmp/venv-release
+          /tmp/venv-release/bin/pip install --no-index \
+            --find-links /tmp/wheelhouse --find-links dist/ dist/agentspm-*.whl
+          /tmp/venv-release/bin/agentspm --help
+
+      - name: install cosign
+        uses: sigstore/cosign-installer@v3
+
+      - name: sign artifacts (keyless, Sigstore bundle per artifact)
+        run: |
+          for artifact in dist/*.whl dist/*.tar.gz dist/*.cdx.json dist/SHA256SUMS; do
+            cosign sign-blob --yes \
+              --bundle "${artifact}.sigstore.json" \
+              "${artifact}"
+          done
+
+      - name: verify what we just signed (the gate must be able to fail)
+        run: |
+          for artifact in dist/*.whl dist/*.tar.gz dist/*.cdx.json dist/SHA256SUMS; do
+            cosign verify-blob \
+              --bundle "${artifact}.sigstore.json" \
+              --certificate-identity-regexp \
+                '^https://github.com/vojtahampl/agentspm/\.github/workflows/release\.yml@' \
+              --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+              "${artifact}"
+          done
+
+      - name: create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ inputs.tag }}
+        run: |
+          gh release create "${TAG}" dist/* \
+            --target "${GITHUB_SHA}" \
+            --title "agentspm ${TAG}" \
+            --notes "wheel + sdist, CycloneDX SBOM, SHA256SUMS, keyless cosign signatures (.sigstore.json bundles — verification: docs/ARCHITECTURE.md, Verifying release artifacts). Generated over synthetic fixtures; see docs/LANGUAGE.md for the claims rule. Also on PyPI: pip install agentspm"
+
+      - name: publish to PyPI (Trusted Publishing — no token anywhere)
+        # The pending publisher on pypi.org is bound to exactly this workflow
+        # file + the `release` environment; the job's OIDC token is the whole
+        # credential. Only the installable artifacts go up — PyPI has no
+        # concept of SBOM/checksum sidecars, those live on the GitHub Release.
+        run: |
+          mkdir -p dist-pypi
+          cp dist/*.whl dist/*.tar.gz dist-pypi/
+          ls -l dist-pypi/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist-pypi/

agentspm-0.1.1/.gitignore

@@ -0,0 +1,32 @@
+# local env & secrets — never commit
+.env
+.env.*
+!.env.example
+
+# evidence store (raw snapshots, full reports) — never commit
+evidence-store/
+
+# python
+__pycache__/
+*.pyc
+.venv/
+dist/
+build/
+*.egg-info/
+
+# tooling caches & local reports
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+coverage.xml
+.vuln-scan-reports/
+requirements-audit.txt
+
+# local databases (the SQLite store is an evidence artifact, not source)
+*.sqlite
+*.sqlite3
+*.db
+
+# scan by-products (freshness marker written next to the database)
+*.freshness.json

agentspm-0.1.1/.trivyignore

@@ -0,0 +1,16 @@
+# Reviewed, TEMPORARY exceptions — each entry carries its reason and its
+# removal condition. An entry without either does not belong here.
+
+# CVE-2026-78661 — golang.org/x/net/html DoS, vendored inside the pinned OPA
+# binary (fix is in x/net v0.62.0).
+# Measured 2026-11-11: EVERY released OPA up to v1.22.3 (2026-11-10) still
+# vendors x/net v0.60.0 (`strings opa | grep x/net@`), so bumping the pin
+# cannot close this — there is nothing to bump to.
+# Impact in THIS deployment shape: OPA runs locally over the local policy
+# pack via `opa eval`; it parses no attacker-supplied HTML and listens on no
+# socket, so the DoS path has no entry point (SPM-INV-04 keeps collected
+# data out of policy inputs as instructions, and inputs are JSON, not HTML).
+# REMOVE when an OPA release vendors golang.org/x/net >= 0.62.0 — the OPA
+# pin bump then picks it up (pin lives in ci.yml + Containerfile, guarded by
+# tests/test_opa_pin_consistency.py).
+CVE-2026-78661

agentspm-0.1.1/.vuln-scan-config.yaml

@@ -0,0 +1,55 @@
+# Vulnerability & content scanning configuration — agentspm
+# Derived from the Agent Network template (templates/vuln-scan-config.yaml);
+# thresholds per 04-arch-security "Git Hook Strategy" (SEC-D5).
+#
+# Severity policy:
+#   pre-commit: secrets/identifiers -> BLOCK, language -> WARN
+#   pre-push:   CRITICAL/HIGH CVE -> BLOCK, MEDIUM -> WARN, LOW -> LOG
+#
+# Patterns are written in a self-non-matching form (character class instead of
+# the final literal) so the config itself passes the scan.
+
+pre_commit:
+  block_patterns:
+    secrets:
+      - 'AGE-SECRET-KEY-[0-9A-Z]'
+      - 'BEGIN[[:space:]]+[A-Z ]*PRIVATE[[:space:]]+KEY'
+      - 'gw-[A-Za-z0-9]{8,}'
+      - 'AKIA[0-9A-Z]{16}'
+      - 'ssh-rsa[[:space:]]+AAAA'
+      - '(password|secret|api[_-]?key|token)[[:space:]]*=[[:space:]]*["\x27][^"\x27]{8,}'
+    identifier_scan: scripts/identifier_scan.py   # NFR-D1, BLOCK
+    sensitive_files:
+      - '\.env$'          # .env.example is allowed
+      - '\.pem$'
+      - '\.key$'
+  warn_patterns:
+    language: scripts/language_lint.py            # WARN at commit, BLOCK at push/CI
+  allowlist:
+    - 'tests/fixtures/**'   # only with a `synthetic: true` marker inside the file
+
+pre_push:
+  dependency_audit:
+    tool: pip-audit
+    block_severity: [critical, high]
+    warn_severity: [medium]
+    ignore_severity: [low]
+    # pip-audit does not expose a severity for every advisory; the enforced
+    # policy is therefore a superset: ANY unignored finding blocks the push.
+    ignore: []
+    # ignore entries are documented false positives WITH expiry:
+    # - id: GHSA-xxxx-xxxx-xxxx
+    #   expires: 2027-01-31
+    #   reason: 'why this is a false positive here'
+  sast:
+    tool: bandit
+    block_severity: HIGH
+    warn_severity: MEDIUM
+    scan_paths: [src/, scripts/]
+    exclude_paths: [tests/]
+  opa_lints:            # active once policies/ exists (B4)
+    - scripts/default_pass_lint.py    # default-to-pass is forbidden
+    - scripts/unknown_if_lint.py      # every control declares unknown_if
+
+# Feedback from PenTest network (added by the Orchestrator after HANDOFF B)
+pentest_rules: []