darwin-agentic-cloud 3.0.1__tar.gz → 3.0.3__tar.gz

{darwin_agentic_cloud-3.0.1 → darwin_agentic_cloud-3.0.3}/.gitignore

@@ -100,3 +100,10 @@ logs/
 # DAC-specific
 attestations/
 .dac-state/
+
+# macOS Finder duplicate artifacts
+* 2.md
+* 2.sh
+* 2.lock
+*\ 2/
+README.v2.0.0.md.bak

{darwin_agentic_cloud-3.0.1 → darwin_agentic_cloud-3.0.3}/CHANGELOG.md

@@ -7,6 +7,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.0.3] — 2026-05-28
+
+### Added
+
+- CLI integration tests for `darwin run` (`tests/cli/test_run.py`). 15 new tests
+  covering argument parsing (no-args error, help output, documented flags),
+  workload resolution (file path vs inline code, nonexistent-file fallback),
+  flag handling (--substrate, --cost-cap, --timeout, --memory, --language),
+  output formats (--save writes valid JSON, --json emits parseable output), and
+  smoke regression for the file-exists-and-inline-code happy paths. Tests use
+  `typer.testing.CliRunner` with the underlying `darwin.run()` mocked so they
+  run without Docker or AWS credentials.
+- New `tests/cli/` directory + `__init__.py` for future per-verb CLI test files.
+
+### Internal
+
+- Test suite total: 388 → 403 passing.
+
+## [3.0.2] — 2026-05-28
+
+### Added
+
+- First-run welcome banner. When a user runs any `darwin` command for the first
+  time after install, an ASCII brand banner prints with the tagline, motto, three
+  starter commands, and links to demo, repo, and docs. Shown once per install
+  via a marker file at `~/.darwin/welcomed`. Suppressed in non-interactive shells
+  (pipes, scripts, CI) and when `DARWIN_SUPPRESS_WELCOME=1` is set.
+- `darwin welcome` command to re-trigger the banner on demand.
+
+### Internal
+
+- New `render_welcome()` and `print_welcome()` functions in
+  `darwin/agenticcloud/ui.py`, reusing the existing `BANNER`, `BRAND_GREEN`,
+  `BRAND_AMBER`, and `BRAND_DIM` brand tokens for visual continuity with the
+  attestation cert panel.
+
 ## [3.0.1] — 2026-05-27
 
 ### Fixed

{darwin_agentic_cloud-3.0.1 → darwin_agentic_cloud-3.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: darwin-agentic-cloud
-Version: 3.0.1
+Version: 3.0.3
 Summary: Darwin — adaptive software systems. Includes darwin.agenticcloud, the verifiable agentic cloud. Open-source compute for AI agents with cryptographically signed attestations.
 Project-URL: Homepage, https://github.com/vje013/darwin-agentic-cloud
 Project-URL: Repository, https://github.com/vje013/darwin-agentic-cloud
@@ -275,7 +275,7 @@ Description-Content-Type: text/markdown
 [![Python: 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 [![Schema: v0.2](https://img.shields.io/badge/schema-v0.2-FFB86C.svg)](https://darwin-agentic-cloud.fly.dev/.well-known/schemas/attestation/v0.2)
 
-> **Verifiable compute for AI agents.** Every workload signed. Every cost capped. Every routing decision auditable. Open verification, paid signing.
+> **Verifiable compute for AI agents.** Every workload signed. Every cost capped. Every routing decision auditable. Open source, verified, free compute.
 
 **Install:** `pip install darwin-agentic-cloud`
 
@@ -285,6 +285,11 @@ Description-Content-Type: text/markdown
 
 **v0.2 Schema:** https://darwin-agentic-cloud.fly.dev/.well-known/schemas/attestation/v0.2
 
+---
+## Darwin's Mission
+
+Increase AI adoption by increasing AI safety.
+
 ---
 
 ## The question agents can't answer today

{darwin_agentic_cloud-3.0.1 → darwin_agentic_cloud-3.0.3}/README.md

@@ -6,7 +6,7 @@
 [![Python: 3.11+](https://img.shields.io/badge/python-3.11+-blue.svg)](https://www.python.org/downloads/)
 [![Schema: v0.2](https://img.shields.io/badge/schema-v0.2-FFB86C.svg)](https://darwin-agentic-cloud.fly.dev/.well-known/schemas/attestation/v0.2)
 
-> **Verifiable compute for AI agents.** Every workload signed. Every cost capped. Every routing decision auditable. Open verification, paid signing.
+> **Verifiable compute for AI agents.** Every workload signed. Every cost capped. Every routing decision auditable. Open source, verified, free compute.
 
 **Install:** `pip install darwin-agentic-cloud`
 
@@ -16,6 +16,11 @@
 
 **v0.2 Schema:** https://darwin-agentic-cloud.fly.dev/.well-known/schemas/attestation/v0.2
 
+---
+## Darwin's Mission
+
+Increase AI adoption by increasing AI safety.
+
 ---
 
 ## The question agents can't answer today

darwin_agentic_cloud-3.0.3/att.json

@@ -0,0 +1,51 @@
+{
+  "attestation_id": "att_1a83a636569e4e93",
+  "schema": "darwin.cloud/agenticcloud/attestation/v0.2",
+  "issued_at": "2026-05-29T01:10:03Z",
+  "workload_spec_hash": "4fa10188f2faa0d07f25cb38df5492424b7f154d874e02463216ea827ae1748a",
+  "execution_result": {
+    "output_hash": "67ecdb031db5e6529d6edd8d25eb20dd443162fd8b3fdf4b121dbfc82e7906be",
+    "substrate": {
+      "id": "local-docker-v0",
+      "version": "0.1.0",
+      "identity_signature": "c/zmytDvWNdHsirKXs6LYyuT0CyEEhuStDb+CbzxVfsIzU/lgCVGphYNYzE/s0/GKxoRthL4PHfbnJGgoe2XAQ==",
+      "identity_signer_type": "darwin-class-key",
+      "identity_signer_key_id": "dac-class-local-docker-v0-ca698355dcb631e3",
+      "evidence_schema_id": "darwin.cloud/evidence/local-docker/v1",
+      "evidence": {
+        "container_status": "ok",
+        "exit_code": 0,
+        "stdout_hash": "67ecdb031db5e6529d6edd8d25eb20dd443162fd8b3fdf4b121dbfc82e7906be",
+        "stderr_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+        "wall_time_sec": 0.11720395088195801
+      },
+      "extensions": {},
+      "tee_required": false
+    },
+    "cost_usd": 1.172e-05,
+    "stdout": "hello from a real attestation\n",
+    "stderr": ""
+  },
+  "value_added_service": {
+    "identity_signing": {
+      "schema_compliant": true,
+      "keylist_url": "https://darwin-agentic-cloud.fly.dev/.well-known/substrate-keys.json"
+    },
+    "cost_cap_enforcement": {
+      "cap_usd": 0.1,
+      "estimated_usd_max": 0.003,
+      "actual_usd": 1.172e-05,
+      "within_cap": true,
+      "headroom_usd": 0.09998828
+    },
+    "routing_decision": {
+      "policy": "pick_by_cost",
+      "chosen_substrate_id": "local-docker-v0",
+      "chosen_reason": "lowest_estimated_cost ($0.003000)",
+      "candidates_considered": 1,
+      "rejected_substrates": []
+    }
+  },
+  "signer_key_id": "dac-local-d1bf7cad25875cee",
+  "signature": "cyIS5v4zUkyIAyfISoBAYBZifIRQdAYX2ZU1o8KOSf/NGg/hC80lRqblFNCXRouETqeXL8A35UqJVx+2C8w+Bg=="
+}

{darwin_agentic_cloud-3.0.1 → darwin_agentic_cloud-3.0.3}/darwin/__init__.py

@@ -5,7 +5,7 @@ A family of modules:
     (more to come)
 """
 
-__version__ = "3.0.1"
+__version__ = "3.0.3"
 __author__ = "Vladimir J Edouard"
 __license__ = "Apache-2.0"
 

{darwin_agentic_cloud-3.0.1 → darwin_agentic_cloud-3.0.3}/darwin/agenticcloud/cli.py

@@ -14,6 +14,8 @@ Examples:
 from __future__ import annotations
 
 import json
+import os
+import sys
 from datetime import UTC
 from pathlib import Path
 from typing import Annotated
@@ -35,6 +37,63 @@ app = typer.Typer(
     no_args_is_help=True,
     add_completion=False,
 )
+
+
+# -------------------------------------------------------------------
+# First-run welcome
+# -------------------------------------------------------------------
+
+_WELCOME_MARKER = Path.home() / ".darwin" / "welcomed"
+
+
+def _show_welcome_if_first_run() -> None:
+    """Print the welcome banner exactly once per user install.
+
+    Suppressed in non-interactive shells, when piped, or when the user
+    sets DARWIN_SUPPRESS_WELCOME=1. The marker file at
+    ~/.darwin/welcomed records that the user has been welcomed.
+    """
+    try:
+        if not sys.stdout.isatty():
+            return
+        if os.environ.get("DARWIN_SUPPRESS_WELCOME"):
+            return
+        if _WELCOME_MARKER.exists():
+            return
+
+        from darwin import __version__ as _v
+        from darwin.agenticcloud.ui import print_welcome
+
+        print_welcome(Console(), version=_v)
+
+        _WELCOME_MARKER.parent.mkdir(parents=True, exist_ok=True)
+        _WELCOME_MARKER.touch()
+    except Exception:
+        # Welcome banner must never block real commands. If anything
+        # goes wrong here (terminal weirdness, IO error, etc.), swallow
+        # silently and proceed with the user's command.
+        pass
+
+
+@app.callback()
+def _root(ctx: typer.Context) -> None:
+    """Darwin Agentic Cloud — verifiable compute for AI agents."""
+    # The `welcome` command renders the banner itself; skip the
+    # auto-trigger here to avoid double-rendering.
+    if ctx.invoked_subcommand == "welcome":
+        return
+    _show_welcome_if_first_run()
+
+
+@app.command()
+def welcome() -> None:
+    """Show the Darwin welcome banner."""
+    from darwin import __version__ as _v
+    from darwin.agenticcloud.ui import print_welcome
+
+    print_welcome(Console(), version=_v)
+
+
 keys_app = typer.Typer(help="Manage signing keys.", no_args_is_help=True)
 attest_app = typer.Typer(help="Work with attestations.", no_args_is_help=True)
 history_app = typer.Typer(help="Query attestation history.", no_args_is_help=True)

{darwin_agentic_cloud-3.0.1 → darwin_agentic_cloud-3.0.3}/darwin/agenticcloud/ui.py

@@ -91,6 +91,103 @@ def print_banner(
     console.print()
 
 
+# -------------------------------------------------------------------
+# First-run welcome
+# -------------------------------------------------------------------
+
+
+def render_welcome(
+    version: str,
+    demo_url: str = "https://darwin-agentic-cloud.fly.dev/demo",
+    repo_url: str = "https://github.com/vje013/darwin-agentic-cloud",
+    docs_url: str = "https://darwin-agentic-cloud.fly.dev/docs",
+) -> Group:
+    """First-run welcome: ASCII banner + tagline + 3 commands + links.
+
+    Visually distinct from `render_banner()` (which prints version/signer
+    metadata for repeat users). Designed to orient a new user in their
+    first 30 seconds with the tool.
+    """
+    parts: list = []
+
+    parts.append(Text(BANNER, style=f"bold {BRAND_GREEN}"))
+    parts.append(Text(""))
+
+    motto = Text()
+    motto.append("  ")
+    motto.append("✦", style=f"bold {BRAND_AMBER}")
+    motto.append("  SECURITAS · STABILITAS · SIGNUM  ", style=BRAND_GREEN)
+    motto.append("✦", style=f"bold {BRAND_AMBER}")
+    parts.append(motto)
+    parts.append(Text(""))
+
+    parts.append(Text("  Verifiable and free compute for AI agents.", style=f"bold {BRAND_GREEN}"))
+    parts.append(
+        Text("  Cryptographically signed execution attestations.", style=f"bold {BRAND_GREEN}")
+    )
+    parts.append(Text("  MCP-native.", style=f"bold {BRAND_GREEN}"))
+    parts.append(Text(""))
+
+    parts.append(Text("  " + "─" * 59, style=BRAND_DIM))
+    parts.append(Text(""))
+
+    parts.append(Text("  Try it in 3 commands:", style=f"bold {BRAND_GREEN}"))
+    parts.append(Text(""))
+
+    cmd1 = Text("    1.  ", style=f"bold {BRAND_GREEN}")
+    cmd1.append("darwin list", style=f"bold {BRAND_GREEN}")
+    parts.append(cmd1)
+    parts.append(
+        Text("        See which compute substrates are available right now.", style=BRAND_GREEN)
+    )
+    parts.append(Text(""))
+
+    cmd2 = Text("    2.  ", style=f"bold {BRAND_GREEN}")
+    cmd2.append("echo 'print(\"hello\")' > hello.py", style=BRAND_GREEN)
+    parts.append(cmd2)
+    parts.append(Text("        darwin run hello.py --save att.json", style=f"bold {BRAND_GREEN}"))
+    parts.append(Text("        Execute a workload, get a signed attestation.", style=BRAND_GREEN))
+    parts.append(Text(""))
+
+    cmd3 = Text("    3.  ", style=f"bold {BRAND_GREEN}")
+    cmd3.append("darwin verify att.json", style=f"bold {BRAND_GREEN}")
+    parts.append(cmd3)
+    parts.append(
+        Text("        Cryptographically verify the attestation against", style=BRAND_GREEN)
+    )
+    parts.append(Text("        the public keylist.", style=BRAND_GREEN))
+    parts.append(Text(""))
+
+    parts.append(Text("  " + "─" * 59, style=BRAND_DIM))
+    parts.append(Text(""))
+
+    link_demo = Text("  Live demo:  ", style=BRAND_GREEN)
+    link_demo.append(demo_url, style=f"underline {BRAND_GREEN}")
+    parts.append(link_demo)
+
+    link_repo = Text("  GitHub:     ", style=BRAND_GREEN)
+    link_repo.append(repo_url, style=f"underline {BRAND_GREEN}")
+    parts.append(link_repo)
+
+    link_docs = Text("  Docs:       ", style=BRAND_GREEN)
+    link_docs.append(docs_url, style=f"underline {BRAND_GREEN}")
+    parts.append(link_docs)
+
+    parts.append(Text(""))
+
+    parts.append(Text("  This message shown once per install.", style=BRAND_DIM))
+    parts.append(Text("  Run `darwin welcome` to see it again.", style=BRAND_DIM))
+
+    return Group(*parts)
+
+
+def print_welcome(console: Console, version: str) -> None:
+    """Convenience: print the welcome with appropriate vertical spacing."""
+    console.print()
+    console.print(render_welcome(version=version))
+    console.print()
+
+
 # -------------------------------------------------------------------
 # Matrix boot sequence
 # -------------------------------------------------------------------

darwin_agentic_cloud-3.0.3/hello.py

@@ -0,0 +1 @@
+print("hello from a real attestation")

{darwin_agentic_cloud-3.0.1 → darwin_agentic_cloud-3.0.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "darwin-agentic-cloud"
-version = "3.0.1"
+version = "3.0.3"
 description = "Darwin — adaptive software systems. Includes darwin.agenticcloud, the verifiable agentic cloud. Open-source compute for AI agents with cryptographically signed attestations."
 readme = "README.md"
 requires-python = ">=3.11"

darwin_agentic_cloud-3.0.3/tests/cli/test_run.py

@@ -0,0 +1,314 @@
+"""CLI integration tests for `darwin run`.
+
+These tests exercise the Typer wrapper around `darwin.run()`. The
+underlying `Runtime` is mocked so tests don't require a working Docker
+daemon or AWS credentials. The point is to validate the CLI surface:
+argument parsing, file resolution, flag handling, output formatting,
+exit codes, and error messages.
+
+See tests/runtime/test_runtime_v02.py for the underlying Runtime API
+tests.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+from unittest.mock import patch
+
+import pytest
+from typer.testing import CliRunner
+
+from darwin.agenticcloud.cli import app
+
+# ---------------------------------------------------------------------------
+# Fixtures
+# ---------------------------------------------------------------------------
+
+
+_ANSI_RE = re.compile(r"\x1b\[[0-9;]*[a-zA-Z]")
+
+
+def _strip_ansi(s):
+    return _ANSI_RE.sub("", s)
+
+
+@pytest.fixture
+def runner() -> CliRunner:
+    """Typer CLI runner that captures stdout and stderr."""
+    return CliRunner()
+
+
+_ANSI_RE = re.compile(r"\x1b\[[0-9;]*[a-zA-Z]")
+
+
+def _strip_ansi(s):
+    return _ANSI_RE.sub("", s)
+
+
+@pytest.fixture
+def fake_attestation() -> dict:
+    """A minimal v0.2-shaped attestation that the CLI can render."""
+    return {
+        "schema": "darwin.cloud/agenticcloud/attestation/v0.2",
+        "attestation_id": "test-attestation-id-0001",
+        "issued_at": "2026-05-29T01:00:00Z",
+        "workload_spec_hash": "sha256:" + "a" * 64,
+        "execution_result": {
+            "status": "ok",
+            "stdout": "hello\n",
+            "output_hash": "sha256:" + "b" * 64,
+            "cost_usd": 0.000012,
+            "substrate": {
+                "id": "local-docker-v0",
+                "version": "0.1.0",
+                "evidence_schema_id": "darwin.cloud/evidence/local-docker/v1",
+                "identity_signer_type": "darwin-class-key",
+                "identity_signer_key_id": "dac-class-local-docker-v0-test",
+                "identity_signature": "test-signature-b64",
+                "evidence": {
+                    "container_status": "ok",
+                    "exit_code": 0,
+                    "wall_time_sec": 0.1,
+                    "stdout_hash": "sha256:" + "b" * 64,
+                    "stderr_hash": "sha256:" + "e" * 64,
+                },
+            },
+            "preflight_estimate": {"cost_usd_max": 0.0001},
+        },
+        "value_added_service": {
+            "identity_signing": {
+                "schema_compliant": True,
+                "keylist_url": "https://example/keys.json",
+            },
+            "cost_cap_enforcement": {
+                "cap_usd": 0.10,
+                "estimated_usd_max": 0.0001,
+                "actual_usd": 0.000012,
+                "within_cap": True,
+                "headroom_usd": 0.099988,
+            },
+            "routing_decision": {
+                "policy": "pick_by_cost",
+                "chosen_substrate_id": "local-docker-v0",
+                "chosen_reason": "lowest_estimated_cost ($0.0001)",
+                "candidates_considered": 1,
+                "rejected_substrates": [],
+            },
+        },
+        "signer_key_id": "dac-local-test-operator",
+        "signature": "test-outer-signature-b64",
+    }
+
+
+_ANSI_RE = re.compile(r"\x1b\[[0-9;]*[a-zA-Z]")
+
+
+def _strip_ansi(s):
+    return _ANSI_RE.sub("", s)
+
+
+@pytest.fixture
+def mocked_run(fake_attestation):
+    """Patch the underlying `darwin.run` to return our fake attestation.
+
+    Returns the patch object so individual tests can inspect call args
+    or override the return value if they need to test failure paths.
+    """
+    with patch("darwin.run") as mock:
+        mock.return_value = fake_attestation
+        yield mock
+
+
+_ANSI_RE = re.compile(r"\x1b\[[0-9;]*[a-zA-Z]")
+
+
+def _strip_ansi(s):
+    return _ANSI_RE.sub("", s)
+
+
+@pytest.fixture
+def hello_py(tmp_path: Path) -> Path:
+    """A real `hello.py` file in a tmp directory."""
+    p = tmp_path / "hello.py"
+    p.write_text('print("hello")\n')
+    return p
+
+
+# ---------------------------------------------------------------------------
+# Argument parsing
+# ---------------------------------------------------------------------------
+
+
+class TestArgumentParsing:
+    """The CLI surface: argument and flag handling."""
+
+    def test_run_with_no_args_exits_nonzero(self, runner: CliRunner):
+        """`darwin run` with no workload arg should error cleanly."""
+        result = runner.invoke(app, ["run"])
+        assert result.exit_code != 0
+        # Typer/Click writes the "Missing argument" message to stdout
+        # in their styled error panel; accept either stream.
+        combined = _strip_ansi(result.stdout + (result.stderr or ""))
+        assert "Missing argument" in combined or "WORKLOAD" in combined
+
+    def test_run_help_exits_zero(self, runner: CliRunner):
+        """`darwin run --help` always succeeds and prints usage."""
+        result = runner.invoke(app, ["run", "--help"])
+        assert result.exit_code == 0
+        assert "WORKLOAD" in _strip_ansi(result.stdout)
+        assert "--substrate" in _strip_ansi(result.stdout)
+        assert "--cost-cap" in _strip_ansi(result.stdout)
+
+    def test_run_help_lists_all_documented_flags(self, runner: CliRunner):
+        """All public flags appear in help output."""
+        result = runner.invoke(app, ["run", "--help"])
+        for flag in [
+            "--substrate",
+            "--language",
+            "--cost-cap",
+            "--timeout",
+            "--memory",
+            "--save",
+            "--json",
+        ]:
+            assert flag in _strip_ansi(result.stdout), f"flag {flag} missing from help"
+
+
+# ---------------------------------------------------------------------------
+# File vs inline workload resolution
+# ---------------------------------------------------------------------------
+
+
+class TestWorkloadResolution:
+    """The CLI's "is this arg a file or a code string" heuristic."""
+
+    def test_run_with_existing_file_reads_contents(
+        self, runner: CliRunner, mocked_run, hello_py: Path
+    ):
+        """When the workload arg is an existing file path, its contents are executed."""
+        result = runner.invoke(app, ["run", str(hello_py)])
+        assert result.exit_code == 0, result.stdout
+        # Verify the underlying call was made with the FILE CONTENTS, not the filename.
+        call_args = mocked_run.call_args
+        code_arg = call_args.kwargs.get("code") or (call_args.args[0] if call_args.args else None)
+        assert code_arg is not None
+        assert 'print("hello")' in code_arg
+        assert code_arg != str(hello_py), "CLI should read file contents, not pass the filename"
+
+    def test_run_with_inline_code_passes_string_directly(self, runner: CliRunner, mocked_run):
+        """When the workload arg isn't a file, it's treated as inline code."""
+        result = runner.invoke(app, ["run", 'print("inline")'])
+        assert result.exit_code == 0, result.stdout
+        call_args = mocked_run.call_args
+        code_arg = call_args.kwargs.get("code") or (call_args.args[0] if call_args.args else None)
+        assert code_arg == 'print("inline")'
+
+    def test_run_with_nonexistent_file_treats_as_inline(
+        self, runner: CliRunner, mocked_run, tmp_path: Path
+    ):
+        """A workload arg that LOOKS like a file path but doesn't exist falls back to inline."""
+        nonexistent = tmp_path / "does_not_exist.py"
+        runner.invoke(app, ["run", str(nonexistent)])
+        # CLI doesn't crash — it passes the string to the substrate, which will likely
+        # fail to execute. We check the CLI plumbing, not the substrate outcome.
+        # The important guarantee: we don't crash with FileNotFoundError on the CLI side.
+        call_args = mocked_run.call_args
+        if call_args is not None:
+            code_arg = call_args.kwargs.get("code") or (
+                call_args.args[0] if call_args.args else None
+            )
+            assert code_arg == str(nonexistent)
+
+
+# ---------------------------------------------------------------------------
+# Flag handling
+# ---------------------------------------------------------------------------
+
+
+class TestFlagHandling:
+    """Every flag exposed by `darwin run` is wired correctly."""
+
+    def test_substrate_flag_is_passed_through(self, runner: CliRunner, mocked_run, hello_py: Path):
+        result = runner.invoke(app, ["run", str(hello_py), "--substrate", "local-docker-v0"])
+        assert result.exit_code == 0, result.stdout
+        kwargs = mocked_run.call_args.kwargs
+        assert kwargs.get("substrate") == "local-docker-v0"
+
+    def test_cost_cap_flag_is_passed_through(self, runner: CliRunner, mocked_run, hello_py: Path):
+        result = runner.invoke(app, ["run", str(hello_py), "--cost-cap", "0.5"])
+        assert result.exit_code == 0, result.stdout
+        kwargs = mocked_run.call_args.kwargs
+        assert kwargs.get("cost_cap") == 0.5
+
+    def test_timeout_flag_is_passed_through(self, runner: CliRunner, mocked_run, hello_py: Path):
+        result = runner.invoke(app, ["run", str(hello_py), "--timeout", "60"])
+        assert result.exit_code == 0, result.stdout
+        kwargs = mocked_run.call_args.kwargs
+        assert kwargs.get("timeout") == 60
+
+    def test_memory_flag_is_passed_through(self, runner: CliRunner, mocked_run, hello_py: Path):
+        result = runner.invoke(app, ["run", str(hello_py), "--memory", "1024"])
+        assert result.exit_code == 0, result.stdout
+        kwargs = mocked_run.call_args.kwargs
+        assert kwargs.get("memory_mb") == 1024
+
+    def test_language_flag_is_passed_through(self, runner: CliRunner, mocked_run, hello_py: Path):
+        result = runner.invoke(app, ["run", str(hello_py), "--language", "node"])
+        assert result.exit_code == 0, result.stdout
+        kwargs = mocked_run.call_args.kwargs
+        assert kwargs.get("language") == "node"
+
+
+# ---------------------------------------------------------------------------
+# Output formats
+# ---------------------------------------------------------------------------
+
+
+class TestOutputFormats:
+    """The CLI's --save and --json flags produce correct artifacts."""
+
+    def test_save_flag_writes_attestation_to_disk(
+        self, runner: CliRunner, mocked_run, hello_py: Path, tmp_path: Path
+    ):
+        out_path = tmp_path / "att.json"
+        result = runner.invoke(app, ["run", str(hello_py), "--save", str(out_path)])
+        assert result.exit_code == 0, result.stdout
+        assert out_path.exists(), "—save target file was not created"
+        # The saved file must be valid JSON
+        saved = json.loads(out_path.read_text())
+        assert saved.get("attestation_id") == "test-attestation-id-0001"
+        assert saved.get("schema") == "darwin.cloud/agenticcloud/attestation/v0.2"
+
+    def test_json_flag_emits_parseable_json_only(
+        self, runner: CliRunner, mocked_run, hello_py: Path
+    ):
+        result = runner.invoke(app, ["run", str(hello_py), "--json"])
+        assert result.exit_code == 0, result.stdout
+        # In --json mode, stdout should be pure JSON (parseable)
+        parsed = json.loads(result.stdout)
+        assert parsed.get("attestation_id") == "test-attestation-id-0001"
+
+
+# ---------------------------------------------------------------------------
+# Smoke / regression
+# ---------------------------------------------------------------------------
+
+
+class TestSmoke:
+    """Basic invocation paths that have failed in production before."""
+
+    def test_run_with_file_does_not_raise(self, runner: CliRunner, mocked_run, hello_py: Path):
+        """Regression: `darwin run hello.py` from a directory where hello.py exists must complete."""
+        result = runner.invoke(app, ["run", str(hello_py)])
+        assert result.exception is None or result.exit_code == 0, (
+            f"unexpected exception: {result.exception!r}\nstdout: {result.stdout}"
+        )
+
+    def test_run_with_inline_code_does_not_raise(self, runner: CliRunner, mocked_run):
+        """Regression: `darwin run 'print(...)'` must complete."""
+        result = runner.invoke(app, ["run", 'print("ok")'])
+        assert result.exception is None or result.exit_code == 0, (
+            f"unexpected exception: {result.exception!r}\nstdout: {result.stdout}"
+        )