diff --git a/.agent-guard/context-digest-policy.yaml b/.agent-guard/context-digest-policy.yaml index a57df49..a5f573f 100644 --- a/.agent-guard/context-digest-policy.yaml +++ b/.agent-guard/context-digest-policy.yaml @@ -20,4 +20,4 @@ checks: sha256: "c63d5d58c5b17db80e09fef8b9c8f3c11a9c02c628c1c3ff8add9d924f7d0c34" - id: workflow_policy path: .agent-guard/workflow-policy.yaml - sha256: "7e0473e34a798977de6d0081141171f028e8b7f81bbaa3e5b8acc0a963bcdffe" + sha256: "8e2a2423f51a7695ec9f7fe2d19a4e0b6ec409a8a5f1b5c5c7797b56838975ae" diff --git a/.agent-guard/workflow-policy.yaml b/.agent-guard/workflow-policy.yaml index e0a4a64..9b7c8bf 100644 --- a/.agent-guard/workflow-policy.yaml +++ b/.agent-guard/workflow-policy.yaml @@ -74,13 +74,18 @@ workflow_checks: --mcp-policy .agent-guard/mcp-policy.yaml --digest-policy .agent-guard/context-digest-policy.yaml --format json - --output .agent-guard/evidence/agent-guard-evidence-report.json + --output .agent-guard/evidence/agent-guard-report.json - id: conformance_self command: >- python -m agent_guard.cli conformance check --root . - --evidence .agent-guard/evidence/agent-guard-evidence-report.json + --evidence .agent-guard/evidence/agent-guard-report.json --profile recommended - id: evidence_pack_manifest_self command: >- python -m agent_guard.cli evidence-pack manifest --root . - --report .agent-guard/evidence/agent-guard-evidence-report.json + --report .agent-guard/evidence/agent-guard-report.json + - id: evidence_bundle_consumer_self + command: >- + python -I -m agent_guard.consumer + --evidence-dir .agent-guard/evidence + .agent-guard/evidence/agent-guard-report.json diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 52f5497..fc499c0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -247,31 +247,34 @@ jobs: --mcp-policy .agent-guard/mcp-policy.yaml \ --digest-policy .agent-guard/context-digest-policy.yaml \ --format json \ - --output .agent-guard/evidence/agent-guard-evidence-report.json + --output .agent-guard/evidence/agent-guard-report.json python -m agent_guard.cli render-report \ --root . \ - --input .agent-guard/evidence/agent-guard-evidence-report.json \ + --input .agent-guard/evidence/agent-guard-report.json \ --format markdown \ - --output .agent-guard/evidence/agent-guard-evidence-report.md + --output .agent-guard/evidence/agent-guard-report.md python -m agent_guard.cli render-report \ --root . \ - --input .agent-guard/evidence/agent-guard-evidence-report.json \ + --input .agent-guard/evidence/agent-guard-report.json \ --format sarif \ --output .agent-guard/evidence/agent-guard-results.sarif python -m agent_guard.cli conformance check \ --root . \ - --evidence .agent-guard/evidence/agent-guard-evidence-report.json \ + --evidence .agent-guard/evidence/agent-guard-report.json \ --profile recommended \ --json python -m agent_guard.cli evidence-pack manifest \ --root . \ - --report .agent-guard/evidence/agent-guard-evidence-report.json \ - --artifact .agent-guard/evidence/agent-guard-evidence-report.json \ + --report .agent-guard/evidence/agent-guard-report.json \ + --artifact .agent-guard/evidence/agent-guard-report.json \ --json python -m agent_guard.cli render-report \ --root . \ - --input .agent-guard/evidence/agent-guard-evidence-report.json \ + --input .agent-guard/evidence/agent-guard-report.json \ --format github-annotations + python -I -m agent_guard.consumer \ + --evidence-dir .agent-guard/evidence \ + .agent-guard/evidence/agent-guard-report.json - name: Upload self-dogfood evidence report if: matrix.python-version == '3.12' uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 diff --git a/CHANGELOG.md b/CHANGELOG.md index 92381d8..54d97f7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,21 @@ Why: keep static guard releases auditable while the package is still alpha. ## Unreleased +- Defined a bounded demand-validation window through 2026-09-20 and froze + feature releases pending an explicit maintainer decision after the 2026-09-21 + review. Marketplace publication remains separately prohibited without + explicit authorization. +- Locked the release build toolchain, pinned copyable GitHub Action examples to + the immutable v0.3.4 release commit, and documented the post-release pin + refresh contract. +- Simplified reviewed bootstrap and monorepo onboarding, added explicit Python + interpreter checks, and tightened guidance for copying public-safe evidence. +- Hardened the documented PyPI provenance flow with isolated temporary + downloads, request timeouts, exact artifact checks, redirect-final HTTPS host + validation, exclusive file creation, and cleanup on success or failure. +- Aligned self-dogfood CI with the canonical public evidence filenames and + required fail-closed bundle validation before artifact upload. + ## 0.3.4 - 2026-08-01 - Preserved top-level standalone compatibility for the public API, content, and diff --git a/docs/evidence-samples/agent-guard-report.json b/docs/evidence-samples/agent-guard-report.json index 46db7f9..8374bb8 100644 --- a/docs/evidence-samples/agent-guard-report.json +++ b/docs/evidence-samples/agent-guard-report.json @@ -1 +1 @@ -{"api": {"checked_count": 249, "finding_count": 0, "findings": [], "policy": {"path": "examples/architecture_policy.yaml"}, "status": "ok"}, "command": "report", "conformance": {"checked_count": 17, "finding_count": 0, "findings": [], "mcp_config_checked_count": 0, "profile": "recommended", "required_artifact_roles": [], "required_gates": ["context", "surface_inventory", "path", "content", "mcp_config", "workflow", "policy_spec_drift"], "required_policy_files": [".agent-guard/context-policy.yaml", ".agent-guard/path-policy.yaml", ".agent-guard/content-policy.yaml", ".agent-guard/mcp-policy.yaml", ".agent-guard/workflow-policy.yaml"], "required_report_sections": [], "required_surfaces": ["agent_context", "policy_file", "workflow_file", "workflow_reference"], "schema_version": "agent-guard.conformance.v1", "status": "ok"}, "content": {"checked_count": 40, "finding_count": 0, "findings": [], "mode": "registered", "policy": {"path": ".agent-guard/content-policy.yaml"}, "scan_dir": ".", "status": "ok"}, "context_lock": {"checked_count": 1, "covered": [{"check_id": "root_agents_md", "kind": "agents_md", "path": "AGENTS.md", "status": "covered"}], "covered_count": 1, "finding_count": 0, "findings": [], "policy": {"path": ".agent-guard/context-digest-policy.yaml"}, "status": "ok"}, "digest": {"checked_count": 6, "finding_count": 0, "findings": [], "policy": {"path": ".agent-guard/context-digest-policy.yaml"}, "status": "ok"}, "evidence_coverage": {"enabled_count": 10, "failing_count": 0, "gate_count": 10, "gates": [{"checked_count": 1, "finding_count": 0, "gate": "context", "policy": {"path": ".agent-guard/context-policy.yaml"}, "status": "ok"}, {"checked_count": 142, "finding_count": 0, "gate": "surface_inventory", "policy": {"path": ".agent-guard/context-policy.yaml"}, "status": "ok"}, {"checked_count": 737, "finding_count": 0, "gate": "path", "policy": {"path": ".agent-guard/path-policy.yaml"}, "status": "ok"}, {"checked_count": 40, "finding_count": 0, "gate": "content", "policy": {"path": ".agent-guard/content-policy.yaml"}, "status": "ok"}, {"checked_count": 249, "finding_count": 0, "gate": "api", "policy": {"path": "examples/architecture_policy.yaml"}, "status": "ok"}, {"checked_count": 0, "finding_count": 0, "gate": "mcp_config", "policy": {"path": ".agent-guard/mcp-policy.yaml"}, "status": "ok"}, {"checked_count": 1, "finding_count": 0, "gate": "context_lock", "policy": {"path": ".agent-guard/context-digest-policy.yaml"}, "status": "ok"}, {"checked_count": 6, "finding_count": 0, "gate": "digest", "policy": {"path": ".agent-guard/context-digest-policy.yaml"}, "status": "ok"}, {"checked_count": 24, "finding_count": 0, "gate": "workflow", "policy": {"path": ".agent-guard/workflow-policy.yaml"}, "status": "ok"}, {"checked_count": 45, "finding_count": 0, "gate": "policy_spec_drift", "status": "ok"}], "missing_count": 0, "schema_version": "agent-guard.evidence_coverage.v1"}, "evidence_pack_manifest": {"artifacts": [{"path": "docs/evidence-samples/agent-guard-report.json", "role": "report"}], "conformance": {"finding_count": 0, "profile": "recommended", "schema_version": "agent-guard.conformance.v1", "status": "ok"}, "gates": [{"finding_count": 0, "gate": "context", "status": "ok"}, {"finding_count": 0, "gate": "surface_inventory", "status": "ok"}, {"finding_count": 0, "gate": "path", "status": "ok"}, {"finding_count": 0, "gate": "content", "status": "ok"}, {"finding_count": 0, "gate": "api", "status": "ok"}, {"finding_count": 0, "gate": "mcp_config", "status": "ok"}, {"finding_count": 0, "gate": "context_lock", "status": "ok"}, {"finding_count": 0, "gate": "digest", "status": "ok"}, {"finding_count": 0, "gate": "workflow", "status": "ok"}, {"finding_count": 0, "gate": "policy_spec_drift", "status": "ok"}], "report": {"finding_count": 0, "format": "json", "schema_version": "agent-guard.report_evidence.v1", "scope": "context+path+content+api+mcp+digest+workflow+drift", "status": "ok"}, "sanitized": true, "schema_version": "agent-guard.evidence_pack_manifest.v1", "summary": {"enabled_gate_count": 10, "failing_gate_count": 0, "gate_count": 10, "missing_gate_count": 0, "surface_count": 142}, "tool": {"name": "agent-guard", "version": "0.3.4"}}, "exit_code": 0, "finding_count": 0, "findings": [], "inventory": {"context_files": [{"evidence": [{"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:14:approval_boundary_mention", "line": 14, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:15:approval_boundary_mention", "line": 15, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:28:approval_boundary_mention", "line": 28, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:30:approval_boundary_mention", "line": 30, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:32:approval_boundary_mention", "line": 32, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:49:approval_boundary_mention", "line": 49, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:50:approval_boundary_mention", "line": 50, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:51:approval_boundary_mention", "line": 51, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:52:approval_boundary_mention", "line": 52, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:53:approval_boundary_mention", "line": 53, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:54:approval_boundary_mention", "line": 54, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:55:approval_boundary_mention", "line": 55, "rule_id": "approval_boundary_mention"}, {"category": "destructive_action_boundary", "evidence_id": "destructive_action_boundary:AGENTS.md:31:destructive_action_boundary_mention", "line": 31, "rule_id": "destructive_action_boundary_mention"}, {"category": "destructive_action_boundary", "evidence_id": "destructive_action_boundary:AGENTS.md:38:destructive_action_boundary_mention", "line": 38, "rule_id": "destructive_action_boundary_mention"}, {"category": "local_verification", "evidence_id": "local_verification:AGENTS.md:9:local_verification_mention", "line": 9, "rule_id": "local_verification_mention"}, {"category": "local_verification", "evidence_id": "local_verification:AGENTS.md:23:local_verification_mention", "line": 23, "rule_id": "local_verification_mention"}, {"category": "local_verification", "evidence_id": "local_verification:AGENTS.md:40:local_verification_mention", "line": 40, "rule_id": "local_verification_mention"}, {"category": "local_verification", "evidence_id": "local_verification:AGENTS.md:41:local_verification_mention", "line": 41, "rule_id": "local_verification_mention"}, {"category": "local_verification", "evidence_id": "local_verification:AGENTS.md:46:local_verification_mention", "line": 46, "rule_id": "local_verification_mention"}, {"category": "network_boundary", "evidence_id": "network_boundary:AGENTS.md:32:network_boundary_mention", "line": 32, "rule_id": "network_boundary_mention"}, {"category": "secret_handling", "evidence_id": "secret_handling:AGENTS.md:22:secret_handling_mention", "line": 22, "rule_id": "secret_handling_mention"}, {"category": "secret_handling", "evidence_id": "secret_handling:AGENTS.md:36:secret_handling_mention", "line": 36, "rule_id": "secret_handling_mention"}, {"category": "secret_handling", "evidence_id": "secret_handling:AGENTS.md:37:secret_handling_mention", "line": 37, "rule_id": "secret_handling_mention"}, {"category": "tool_permission_boundary", "evidence_id": "tool_permission_boundary:AGENTS.md:32:tool_permission_boundary_mention", "line": 32, "rule_id": "tool_permission_boundary_mention"}], "kind": "agents_md", "line_count": 56, "path": "AGENTS.md", "read_status": "scanned", "size_bytes": 3176}], "permission_boundaries": [{"category": "approval_boundary", "evidence_ids": ["approval_boundary:AGENTS.md:14:approval_boundary_mention", "approval_boundary:AGENTS.md:15:approval_boundary_mention", "approval_boundary:AGENTS.md:28:approval_boundary_mention", "approval_boundary:AGENTS.md:30:approval_boundary_mention", "approval_boundary:AGENTS.md:32:approval_boundary_mention", "approval_boundary:AGENTS.md:49:approval_boundary_mention", "approval_boundary:AGENTS.md:50:approval_boundary_mention", "approval_boundary:AGENTS.md:51:approval_boundary_mention", "approval_boundary:AGENTS.md:52:approval_boundary_mention", "approval_boundary:AGENTS.md:53:approval_boundary_mention", "approval_boundary:AGENTS.md:54:approval_boundary_mention", "approval_boundary:AGENTS.md:55:approval_boundary_mention"], "status": "present"}, {"category": "tool_permission_boundary", "evidence_ids": ["tool_permission_boundary:AGENTS.md:32:tool_permission_boundary_mention"], "status": "present"}, {"category": "network_boundary", "evidence_ids": ["network_boundary:AGENTS.md:32:network_boundary_mention"], "status": "present"}, {"category": "secret_handling", "evidence_ids": ["secret_handling:AGENTS.md:22:secret_handling_mention", "secret_handling:AGENTS.md:36:secret_handling_mention", "secret_handling:AGENTS.md:37:secret_handling_mention"], "status": "present"}, {"category": "destructive_action_boundary", "evidence_ids": ["destructive_action_boundary:AGENTS.md:31:destructive_action_boundary_mention", "destructive_action_boundary:AGENTS.md:38:destructive_action_boundary_mention"], "status": "present"}, {"category": "local_verification", "evidence_ids": ["local_verification:AGENTS.md:23:local_verification_mention", "local_verification:AGENTS.md:40:local_verification_mention", "local_verification:AGENTS.md:41:local_verification_mention", "local_verification:AGENTS.md:46:local_verification_mention", "local_verification:AGENTS.md:9:local_verification_mention"], "status": "present"}], "schema_version": "agent-guard.context_inventory.v1"}, "mcp_config": {"checked_count": 0, "finding_count": 0, "findings": [], "policy": {"fail_on_parse_error": true, "forbidden_risky_patterns": ["broad_authorization_scope", "filesystem_root_reference", "inline_authorization_value", "inline_env_value", "instruction_like_description", "latest_package", "secret_shaped_inline_value", "unpinned_package", "unsafe_url_scheme"], "path": ".agent-guard/mcp-policy.yaml"}, "status": "ok", "surfaces": []}, "path": {"checked_count": 737, "finding_count": 0, "findings": [], "policy": {"path": ".agent-guard/path-policy.yaml"}, "status": "ok"}, "policy": {"path": ".agent-guard/context-policy.yaml"}, "policy_spec_drift": {"checked_count": 45, "finding_count": 0, "findings": [], "profile": "recommended", "schema_version": "agent-guard.policy_spec_drift.v2", "status": "ok"}, "report": {"format": "json", "sanitized": true, "schema_version": "agent-guard.report_evidence.v1", "scope": "context+path+content+api+mcp+digest+workflow+drift"}, "scanned_files": 1, "scanner": "context", "schema_version": "agent-guard.result.v1", "status": "ok", "summary": {"api_checked_count": 249, "api_finding_count": 0, "conformance_checked_count": 17, "conformance_finding_count": 0, "content_checked_count": 40, "content_finding_count": 0, "context_file_count": 1, "context_lock_checked_count": 1, "context_lock_covered_count": 1, "context_lock_finding_count": 0, "coverage_enabled_count": 10, "coverage_failing_count": 0, "coverage_missing_count": 0, "digest_checked_count": 6, "digest_finding_count": 0, "drift_checked_count": 45, "drift_finding_count": 0, "evidence_count": 24, "finding_count": 0, "mcp_config_checked_count": 0, "mcp_config_finding_count": 0, "path_checked_count": 737, "path_finding_count": 0, "scanned_count": 1, "scanned_unit": "files", "surface_count": 142, "workflow_checked_count": 24, "workflow_finding_count": 0}, "surface_inventory": {"schema_version": "agent-guard.agent_surface_inventory.v2", "summary": {"by_surface": {"agent_context": 1, "documented_guard_command": 98, "evidence_artifact": 1, "evidence_artifact_reference": 7, "policy_file": 6, "workflow_file": 3, "workflow_reference": 26}, "surface_count": 142}, "surfaces": [{"kind": "content_policy", "path": ".agent-guard/content-policy.yaml", "size_bytes": 2007, "status": "present", "surface": "policy_file"}, {"kind": "digest_policy", "path": ".agent-guard/context-digest-policy.yaml", "size_bytes": 1040, "status": "present", "surface": "policy_file"}, {"kind": "context_policy", "path": ".agent-guard/context-policy.yaml", "size_bytes": 1410, "status": "present", "surface": "policy_file"}, {"kind": "agent_guard_policy", "path": ".agent-guard/mcp-policy.yaml", "size_bytes": 535, "status": "present", "surface": "policy_file"}, {"kind": "path_policy", "path": ".agent-guard/path-policy.yaml", "size_bytes": 1453, "status": "present", "surface": "policy_file"}, {"kind": "workflow_policy", "path": ".agent-guard/workflow-policy.yaml", "size_bytes": 3853, "status": "present", "surface": "policy_file"}, {"artifact_path": "$report", "command": {"command": "", "scanner": "report"}, "job_id": "windows-cli-smoke", "kind": "agent_guard_output", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 5, "surface": "evidence_artifact_reference"}, {"artifact_path": ".agent-guard/evidence/agent-guard-evidence-report.json", "command": {"command": "", "scanner": "report"}, "job_id": "test", "kind": "agent_guard_output", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "evidence_artifact_reference"}, {"artifact_path": ".agent-guard/evidence/agent-guard-evidence-report.md", "command": {"command": "", "scanner": "render-report"}, "job_id": "test", "kind": "agent_guard_output", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "evidence_artifact_reference"}, {"artifact_path": ".agent-guard/evidence/agent-guard-results.sarif", "command": {"command": "", "scanner": "render-report"}, "job_id": "test", "kind": "agent_guard_output", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "evidence_artifact_reference"}, {"artifact_path": ".agent-guard/evidence", "job_id": "test", "kind": "github_artifact", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 10, "surface": "evidence_artifact_reference"}, {"kind": "github_actions", "path": ".github/workflows/ci.yml", "status": "scanned", "surface": "workflow_file"}, {"command": {"command": "", "scanner": "report"}, "job_id": "windows-cli-smoke", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 5, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "content"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "context"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "lock", "scanner": "context"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "digest"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "path"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "digest"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "mcp"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "workflow"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "path"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "context"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "lock", "scanner": "context"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "lock", "scanner": "context"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "digest"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "digest"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "content"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "mcp"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "workflow"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "inventory", "scanner": "surface"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "drift"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "", "scanner": "report"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "", "scanner": "render-report"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "", "scanner": "render-report"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "conformance"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "manifest", "scanner": "evidence-pack"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "", "scanner": "render-report"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"artifact_path": "release-notes.md", "job_id": "prepare-github-release", "kind": "github_artifact", "path": ".github/workflows/github-release.yml", "status": "referenced", "step_index": 10, "surface": "evidence_artifact_reference"}, {"kind": "github_actions", "path": ".github/workflows/github-release.yml", "status": "scanned", "surface": "workflow_file"}, {"artifact_path": "dist", "job_id": "build", "kind": "github_artifact", "path": ".github/workflows/release.yml", "status": "referenced", "step_index": 12, "surface": "evidence_artifact_reference"}, {"kind": "github_actions", "path": ".github/workflows/release.yml", "status": "scanned", "surface": "workflow_file"}, {"kind": "agents_md", "line_count": 56, "path": "AGENTS.md", "size_bytes": 3176, "status": "scanned", "surface": "agent_context"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 68, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 83, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 85, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 87, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 258, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "path"}, "kind": "documentation_recipe", "line": 259, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "content"}, "kind": "documentation_recipe", "line": 260, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "api"}, "kind": "documentation_recipe", "line": 266, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "content"}, "kind": "documentation_recipe", "line": 267, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 268, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "surface"}, "kind": "documentation_recipe", "line": 269, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "path"}, "kind": "documentation_recipe", "line": 270, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "digest"}, "kind": "documentation_recipe", "line": 271, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "workflow"}, "kind": "documentation_recipe", "line": 272, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "drift"}, "kind": "documentation_recipe", "line": 273, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "path"}, "kind": "documentation_recipe", "line": 320, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 321, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "content"}, "kind": "documentation_recipe", "line": 322, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "mcp"}, "kind": "documentation_recipe", "line": 323, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "workflow"}, "kind": "documentation_recipe", "line": 324, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "surface"}, "kind": "documentation_recipe", "line": 325, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "drift"}, "kind": "documentation_recipe", "line": 326, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 327, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "conformance"}, "kind": "documentation_recipe", "line": 328, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "manifest", "scanner": "evidence-pack"}, "kind": "documentation_recipe", "line": 329, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 344, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 345, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "digest"}, "kind": "documentation_recipe", "line": 346, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "delta", "scanner": "surface"}, "kind": "documentation_recipe", "line": 365, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "context"}, "kind": "documentation_recipe", "line": 509, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 510, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 545, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 546, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 547, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 548, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 549, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 550, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 551, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 552, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 553, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 554, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 555, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 556, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 986, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 988, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "digest"}, "kind": "documentation_recipe", "line": 990, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 1001, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "api"}, "kind": "documentation_recipe", "line": 1002, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "content"}, "kind": "documentation_recipe", "line": 1003, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 1004, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "context"}, "kind": "documentation_recipe", "line": 1005, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 1006, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "mcp"}, "kind": "documentation_recipe", "line": 1007, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "surface"}, "kind": "documentation_recipe", "line": 1008, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 1009, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 1010, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "path"}, "kind": "documentation_recipe", "line": 1011, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "digest"}, "kind": "documentation_recipe", "line": 1012, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "workflow"}, "kind": "documentation_recipe", "line": 1013, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "drift"}, "kind": "documentation_recipe", "line": 1014, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "delta", "scanner": "surface"}, "kind": "documentation_recipe", "line": 1015, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 1016, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 124, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 125, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "context"}, "kind": "documentation_recipe", "line": 126, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "surface"}, "kind": "documentation_recipe", "line": 127, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 128, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 129, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "mcp"}, "kind": "documentation_recipe", "line": 130, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "drift"}, "kind": "documentation_recipe", "line": 131, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 132, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 133, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 134, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "conformance"}, "kind": "documentation_recipe", "line": 135, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "manifest", "scanner": "evidence-pack"}, "kind": "documentation_recipe", "line": 136, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 144, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "manifest", "scanner": "evidence-pack"}, "kind": "documentation_recipe", "line": 152, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"kind": "committed_evidence_sample", "path": "docs/evidence-samples/agent-guard-report.json", "size_bytes": 40522, "status": "present", "surface": "evidence_artifact"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 227, "path": "docs/github-actions-evidence.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 228, "path": "docs/github-actions-evidence.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 16, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 34, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 36, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 38, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 172, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "conformance"}, "kind": "documentation_recipe", "line": 179, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 200, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "context"}, "kind": "documentation_recipe", "line": 201, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "mcp"}, "kind": "documentation_recipe", "line": 202, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "surface"}, "kind": "documentation_recipe", "line": 203, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 220, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 221, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "workflow"}, "kind": "documentation_recipe", "line": 232, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "mcp"}, "kind": "documentation_recipe", "line": 233, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "drift"}, "kind": "documentation_recipe", "line": 234, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 235, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 236, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "conformance"}, "kind": "documentation_recipe", "line": 261, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "manifest", "scanner": "evidence-pack"}, "kind": "documentation_recipe", "line": 265, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}]}, "tool": {"name": "agent-guard", "version": "0.3.4"}, "workflow": {"checked_count": 24, "finding_count": 0, "findings": [], "policy": {"path": ".agent-guard/workflow-policy.yaml"}, "status": "ok"}} +{"api": {"checked_count": 249, "finding_count": 0, "findings": [], "policy": {"path": "examples/architecture_policy.yaml"}, "status": "ok"}, "command": "report", "conformance": {"checked_count": 17, "finding_count": 0, "findings": [], "mcp_config_checked_count": 0, "profile": "recommended", "required_artifact_roles": [], "required_gates": ["context", "surface_inventory", "path", "content", "mcp_config", "workflow", "policy_spec_drift"], "required_policy_files": [".agent-guard/context-policy.yaml", ".agent-guard/path-policy.yaml", ".agent-guard/content-policy.yaml", ".agent-guard/mcp-policy.yaml", ".agent-guard/workflow-policy.yaml"], "required_report_sections": [], "required_surfaces": ["agent_context", "policy_file", "workflow_file", "workflow_reference"], "schema_version": "agent-guard.conformance.v1", "status": "ok"}, "content": {"checked_count": 40, "finding_count": 0, "findings": [], "mode": "registered", "policy": {"path": ".agent-guard/content-policy.yaml"}, "scan_dir": ".", "status": "ok"}, "context_lock": {"checked_count": 1, "covered": [{"check_id": "root_agents_md", "kind": "agents_md", "path": "AGENTS.md", "status": "covered"}], "covered_count": 1, "finding_count": 0, "findings": [], "policy": {"path": ".agent-guard/context-digest-policy.yaml"}, "status": "ok"}, "digest": {"checked_count": 6, "finding_count": 0, "findings": [], "policy": {"path": ".agent-guard/context-digest-policy.yaml"}, "status": "ok"}, "evidence_coverage": {"enabled_count": 10, "failing_count": 0, "gate_count": 10, "gates": [{"checked_count": 1, "finding_count": 0, "gate": "context", "policy": {"path": ".agent-guard/context-policy.yaml"}, "status": "ok"}, {"checked_count": 142, "finding_count": 0, "gate": "surface_inventory", "policy": {"path": ".agent-guard/context-policy.yaml"}, "status": "ok"}, {"checked_count": 737, "finding_count": 0, "gate": "path", "policy": {"path": ".agent-guard/path-policy.yaml"}, "status": "ok"}, {"checked_count": 40, "finding_count": 0, "gate": "content", "policy": {"path": ".agent-guard/content-policy.yaml"}, "status": "ok"}, {"checked_count": 249, "finding_count": 0, "gate": "api", "policy": {"path": "examples/architecture_policy.yaml"}, "status": "ok"}, {"checked_count": 0, "finding_count": 0, "gate": "mcp_config", "policy": {"path": ".agent-guard/mcp-policy.yaml"}, "status": "ok"}, {"checked_count": 1, "finding_count": 0, "gate": "context_lock", "policy": {"path": ".agent-guard/context-digest-policy.yaml"}, "status": "ok"}, {"checked_count": 6, "finding_count": 0, "gate": "digest", "policy": {"path": ".agent-guard/context-digest-policy.yaml"}, "status": "ok"}, {"checked_count": 25, "finding_count": 0, "gate": "workflow", "policy": {"path": ".agent-guard/workflow-policy.yaml"}, "status": "ok"}, {"checked_count": 46, "finding_count": 0, "gate": "policy_spec_drift", "status": "ok"}], "missing_count": 0, "schema_version": "agent-guard.evidence_coverage.v1"}, "evidence_pack_manifest": {"artifacts": [{"path": "docs/evidence-samples/agent-guard-report.json", "role": "report"}], "conformance": {"finding_count": 0, "profile": "recommended", "schema_version": "agent-guard.conformance.v1", "status": "ok"}, "gates": [{"finding_count": 0, "gate": "context", "status": "ok"}, {"finding_count": 0, "gate": "surface_inventory", "status": "ok"}, {"finding_count": 0, "gate": "path", "status": "ok"}, {"finding_count": 0, "gate": "content", "status": "ok"}, {"finding_count": 0, "gate": "api", "status": "ok"}, {"finding_count": 0, "gate": "mcp_config", "status": "ok"}, {"finding_count": 0, "gate": "context_lock", "status": "ok"}, {"finding_count": 0, "gate": "digest", "status": "ok"}, {"finding_count": 0, "gate": "workflow", "status": "ok"}, {"finding_count": 0, "gate": "policy_spec_drift", "status": "ok"}], "report": {"finding_count": 0, "format": "json", "schema_version": "agent-guard.report_evidence.v1", "scope": "context+path+content+api+mcp+digest+workflow+drift", "status": "ok"}, "sanitized": true, "schema_version": "agent-guard.evidence_pack_manifest.v1", "summary": {"enabled_gate_count": 10, "failing_gate_count": 0, "gate_count": 10, "missing_gate_count": 0, "surface_count": 142}, "tool": {"name": "agent-guard", "version": "0.3.4"}}, "exit_code": 0, "finding_count": 0, "findings": [], "inventory": {"context_files": [{"evidence": [{"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:14:approval_boundary_mention", "line": 14, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:15:approval_boundary_mention", "line": 15, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:28:approval_boundary_mention", "line": 28, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:30:approval_boundary_mention", "line": 30, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:32:approval_boundary_mention", "line": 32, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:49:approval_boundary_mention", "line": 49, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:50:approval_boundary_mention", "line": 50, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:51:approval_boundary_mention", "line": 51, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:52:approval_boundary_mention", "line": 52, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:53:approval_boundary_mention", "line": 53, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:54:approval_boundary_mention", "line": 54, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:55:approval_boundary_mention", "line": 55, "rule_id": "approval_boundary_mention"}, {"category": "destructive_action_boundary", "evidence_id": "destructive_action_boundary:AGENTS.md:31:destructive_action_boundary_mention", "line": 31, "rule_id": "destructive_action_boundary_mention"}, {"category": "destructive_action_boundary", "evidence_id": "destructive_action_boundary:AGENTS.md:38:destructive_action_boundary_mention", "line": 38, "rule_id": "destructive_action_boundary_mention"}, {"category": "local_verification", "evidence_id": "local_verification:AGENTS.md:9:local_verification_mention", "line": 9, "rule_id": "local_verification_mention"}, {"category": "local_verification", "evidence_id": "local_verification:AGENTS.md:23:local_verification_mention", "line": 23, "rule_id": "local_verification_mention"}, {"category": "local_verification", "evidence_id": "local_verification:AGENTS.md:40:local_verification_mention", "line": 40, "rule_id": "local_verification_mention"}, {"category": "local_verification", "evidence_id": "local_verification:AGENTS.md:41:local_verification_mention", "line": 41, "rule_id": "local_verification_mention"}, {"category": "local_verification", "evidence_id": "local_verification:AGENTS.md:46:local_verification_mention", "line": 46, "rule_id": "local_verification_mention"}, {"category": "network_boundary", "evidence_id": "network_boundary:AGENTS.md:32:network_boundary_mention", "line": 32, "rule_id": "network_boundary_mention"}, {"category": "secret_handling", "evidence_id": "secret_handling:AGENTS.md:22:secret_handling_mention", "line": 22, "rule_id": "secret_handling_mention"}, {"category": "secret_handling", "evidence_id": "secret_handling:AGENTS.md:36:secret_handling_mention", "line": 36, "rule_id": "secret_handling_mention"}, {"category": "secret_handling", "evidence_id": "secret_handling:AGENTS.md:37:secret_handling_mention", "line": 37, "rule_id": "secret_handling_mention"}, {"category": "tool_permission_boundary", "evidence_id": "tool_permission_boundary:AGENTS.md:32:tool_permission_boundary_mention", "line": 32, "rule_id": "tool_permission_boundary_mention"}], "kind": "agents_md", "line_count": 56, "path": "AGENTS.md", "read_status": "scanned", "size_bytes": 3176}], "permission_boundaries": [{"category": "approval_boundary", "evidence_ids": ["approval_boundary:AGENTS.md:14:approval_boundary_mention", "approval_boundary:AGENTS.md:15:approval_boundary_mention", "approval_boundary:AGENTS.md:28:approval_boundary_mention", "approval_boundary:AGENTS.md:30:approval_boundary_mention", "approval_boundary:AGENTS.md:32:approval_boundary_mention", "approval_boundary:AGENTS.md:49:approval_boundary_mention", "approval_boundary:AGENTS.md:50:approval_boundary_mention", "approval_boundary:AGENTS.md:51:approval_boundary_mention", "approval_boundary:AGENTS.md:52:approval_boundary_mention", "approval_boundary:AGENTS.md:53:approval_boundary_mention", "approval_boundary:AGENTS.md:54:approval_boundary_mention", "approval_boundary:AGENTS.md:55:approval_boundary_mention"], "status": "present"}, {"category": "tool_permission_boundary", "evidence_ids": ["tool_permission_boundary:AGENTS.md:32:tool_permission_boundary_mention"], "status": "present"}, {"category": "network_boundary", "evidence_ids": ["network_boundary:AGENTS.md:32:network_boundary_mention"], "status": "present"}, {"category": "secret_handling", "evidence_ids": ["secret_handling:AGENTS.md:22:secret_handling_mention", "secret_handling:AGENTS.md:36:secret_handling_mention", "secret_handling:AGENTS.md:37:secret_handling_mention"], "status": "present"}, {"category": "destructive_action_boundary", "evidence_ids": ["destructive_action_boundary:AGENTS.md:31:destructive_action_boundary_mention", "destructive_action_boundary:AGENTS.md:38:destructive_action_boundary_mention"], "status": "present"}, {"category": "local_verification", "evidence_ids": ["local_verification:AGENTS.md:23:local_verification_mention", "local_verification:AGENTS.md:40:local_verification_mention", "local_verification:AGENTS.md:41:local_verification_mention", "local_verification:AGENTS.md:46:local_verification_mention", "local_verification:AGENTS.md:9:local_verification_mention"], "status": "present"}], "schema_version": "agent-guard.context_inventory.v1"}, "mcp_config": {"checked_count": 0, "finding_count": 0, "findings": [], "policy": {"fail_on_parse_error": true, "forbidden_risky_patterns": ["broad_authorization_scope", "filesystem_root_reference", "inline_authorization_value", "inline_env_value", "instruction_like_description", "latest_package", "secret_shaped_inline_value", "unpinned_package", "unsafe_url_scheme"], "path": ".agent-guard/mcp-policy.yaml"}, "status": "ok", "surfaces": []}, "path": {"checked_count": 737, "finding_count": 0, "findings": [], "policy": {"path": ".agent-guard/path-policy.yaml"}, "status": "ok"}, "policy": {"path": ".agent-guard/context-policy.yaml"}, "policy_spec_drift": {"checked_count": 46, "finding_count": 0, "findings": [], "profile": "recommended", "schema_version": "agent-guard.policy_spec_drift.v2", "status": "ok"}, "report": {"format": "json", "sanitized": true, "schema_version": "agent-guard.report_evidence.v1", "scope": "context+path+content+api+mcp+digest+workflow+drift"}, "scanned_files": 1, "scanner": "context", "schema_version": "agent-guard.result.v1", "status": "ok", "summary": {"api_checked_count": 249, "api_finding_count": 0, "conformance_checked_count": 17, "conformance_finding_count": 0, "content_checked_count": 40, "content_finding_count": 0, "context_file_count": 1, "context_lock_checked_count": 1, "context_lock_covered_count": 1, "context_lock_finding_count": 0, "coverage_enabled_count": 10, "coverage_failing_count": 0, "coverage_missing_count": 0, "digest_checked_count": 6, "digest_finding_count": 0, "drift_checked_count": 46, "drift_finding_count": 0, "evidence_count": 24, "finding_count": 0, "mcp_config_checked_count": 0, "mcp_config_finding_count": 0, "path_checked_count": 737, "path_finding_count": 0, "scanned_count": 1, "scanned_unit": "files", "surface_count": 142, "workflow_checked_count": 25, "workflow_finding_count": 0}, "surface_inventory": {"schema_version": "agent-guard.agent_surface_inventory.v2", "summary": {"by_surface": {"agent_context": 1, "documented_guard_command": 98, "evidence_artifact": 1, "evidence_artifact_reference": 7, "policy_file": 6, "workflow_file": 3, "workflow_reference": 26}, "surface_count": 142}, "surfaces": [{"kind": "content_policy", "path": ".agent-guard/content-policy.yaml", "size_bytes": 2007, "status": "present", "surface": "policy_file"}, {"kind": "digest_policy", "path": ".agent-guard/context-digest-policy.yaml", "size_bytes": 1040, "status": "present", "surface": "policy_file"}, {"kind": "context_policy", "path": ".agent-guard/context-policy.yaml", "size_bytes": 1410, "status": "present", "surface": "policy_file"}, {"kind": "agent_guard_policy", "path": ".agent-guard/mcp-policy.yaml", "size_bytes": 535, "status": "present", "surface": "policy_file"}, {"kind": "path_policy", "path": ".agent-guard/path-policy.yaml", "size_bytes": 1453, "status": "present", "surface": "policy_file"}, {"kind": "workflow_policy", "path": ".agent-guard/workflow-policy.yaml", "size_bytes": 4035, "status": "present", "surface": "policy_file"}, {"artifact_path": "$report", "command": {"command": "", "scanner": "report"}, "job_id": "windows-cli-smoke", "kind": "agent_guard_output", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 5, "surface": "evidence_artifact_reference"}, {"artifact_path": ".agent-guard/evidence/agent-guard-report.json", "command": {"command": "", "scanner": "report"}, "job_id": "test", "kind": "agent_guard_output", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "evidence_artifact_reference"}, {"artifact_path": ".agent-guard/evidence/agent-guard-report.md", "command": {"command": "", "scanner": "render-report"}, "job_id": "test", "kind": "agent_guard_output", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "evidence_artifact_reference"}, {"artifact_path": ".agent-guard/evidence/agent-guard-results.sarif", "command": {"command": "", "scanner": "render-report"}, "job_id": "test", "kind": "agent_guard_output", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "evidence_artifact_reference"}, {"artifact_path": ".agent-guard/evidence", "job_id": "test", "kind": "github_artifact", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 10, "surface": "evidence_artifact_reference"}, {"kind": "github_actions", "path": ".github/workflows/ci.yml", "status": "scanned", "surface": "workflow_file"}, {"command": {"command": "", "scanner": "report"}, "job_id": "windows-cli-smoke", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 5, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "content"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "context"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "lock", "scanner": "context"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "digest"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "path"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "digest"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "mcp"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "workflow"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "path"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "context"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "lock", "scanner": "context"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "lock", "scanner": "context"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "digest"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "digest"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "content"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "mcp"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "workflow"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "inventory", "scanner": "surface"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "drift"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "", "scanner": "report"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "", "scanner": "render-report"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "", "scanner": "render-report"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "conformance"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "manifest", "scanner": "evidence-pack"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "", "scanner": "render-report"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"artifact_path": "release-notes.md", "job_id": "prepare-github-release", "kind": "github_artifact", "path": ".github/workflows/github-release.yml", "status": "referenced", "step_index": 10, "surface": "evidence_artifact_reference"}, {"kind": "github_actions", "path": ".github/workflows/github-release.yml", "status": "scanned", "surface": "workflow_file"}, {"artifact_path": "dist", "job_id": "build", "kind": "github_artifact", "path": ".github/workflows/release.yml", "status": "referenced", "step_index": 12, "surface": "evidence_artifact_reference"}, {"kind": "github_actions", "path": ".github/workflows/release.yml", "status": "scanned", "surface": "workflow_file"}, {"kind": "agents_md", "line_count": 56, "path": "AGENTS.md", "size_bytes": 3176, "status": "scanned", "surface": "agent_context"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 68, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 83, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 85, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 87, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 258, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "path"}, "kind": "documentation_recipe", "line": 259, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "content"}, "kind": "documentation_recipe", "line": 260, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "api"}, "kind": "documentation_recipe", "line": 266, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "content"}, "kind": "documentation_recipe", "line": 267, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 268, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "surface"}, "kind": "documentation_recipe", "line": 269, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "path"}, "kind": "documentation_recipe", "line": 270, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "digest"}, "kind": "documentation_recipe", "line": 271, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "workflow"}, "kind": "documentation_recipe", "line": 272, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "drift"}, "kind": "documentation_recipe", "line": 273, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "path"}, "kind": "documentation_recipe", "line": 320, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 321, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "content"}, "kind": "documentation_recipe", "line": 322, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "mcp"}, "kind": "documentation_recipe", "line": 323, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "workflow"}, "kind": "documentation_recipe", "line": 324, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "surface"}, "kind": "documentation_recipe", "line": 325, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "drift"}, "kind": "documentation_recipe", "line": 326, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 327, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "conformance"}, "kind": "documentation_recipe", "line": 328, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "manifest", "scanner": "evidence-pack"}, "kind": "documentation_recipe", "line": 329, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 344, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 345, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "digest"}, "kind": "documentation_recipe", "line": 346, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "delta", "scanner": "surface"}, "kind": "documentation_recipe", "line": 365, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "context"}, "kind": "documentation_recipe", "line": 509, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 510, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 545, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 546, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 547, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 548, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 549, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 550, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 551, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 552, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 553, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 554, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 555, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 556, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 986, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 988, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "digest"}, "kind": "documentation_recipe", "line": 990, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 1001, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "api"}, "kind": "documentation_recipe", "line": 1002, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "content"}, "kind": "documentation_recipe", "line": 1003, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 1004, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "context"}, "kind": "documentation_recipe", "line": 1005, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 1006, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "mcp"}, "kind": "documentation_recipe", "line": 1007, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "surface"}, "kind": "documentation_recipe", "line": 1008, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 1009, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 1010, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "path"}, "kind": "documentation_recipe", "line": 1011, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "digest"}, "kind": "documentation_recipe", "line": 1012, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "workflow"}, "kind": "documentation_recipe", "line": 1013, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "drift"}, "kind": "documentation_recipe", "line": 1014, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "delta", "scanner": "surface"}, "kind": "documentation_recipe", "line": 1015, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 1016, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 124, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 125, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "context"}, "kind": "documentation_recipe", "line": 126, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "surface"}, "kind": "documentation_recipe", "line": 127, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 128, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 129, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "mcp"}, "kind": "documentation_recipe", "line": 130, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "drift"}, "kind": "documentation_recipe", "line": 131, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 132, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 133, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 134, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "conformance"}, "kind": "documentation_recipe", "line": 135, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "manifest", "scanner": "evidence-pack"}, "kind": "documentation_recipe", "line": 136, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 144, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "manifest", "scanner": "evidence-pack"}, "kind": "documentation_recipe", "line": 152, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"kind": "committed_evidence_sample", "path": "docs/evidence-samples/agent-guard-report.json", "size_bytes": 40504, "status": "present", "surface": "evidence_artifact"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 227, "path": "docs/github-actions-evidence.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 228, "path": "docs/github-actions-evidence.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 16, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 34, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 36, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 38, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 172, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "conformance"}, "kind": "documentation_recipe", "line": 179, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 200, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "context"}, "kind": "documentation_recipe", "line": 201, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "mcp"}, "kind": "documentation_recipe", "line": 202, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "surface"}, "kind": "documentation_recipe", "line": 203, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 220, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 221, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "workflow"}, "kind": "documentation_recipe", "line": 232, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "mcp"}, "kind": "documentation_recipe", "line": 233, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "drift"}, "kind": "documentation_recipe", "line": 234, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 235, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 236, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "conformance"}, "kind": "documentation_recipe", "line": 261, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "manifest", "scanner": "evidence-pack"}, "kind": "documentation_recipe", "line": 265, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}]}, "tool": {"name": "agent-guard", "version": "0.3.4"}, "workflow": {"checked_count": 25, "finding_count": 0, "findings": [], "policy": {"path": ".agent-guard/workflow-policy.yaml"}, "status": "ok"}} diff --git a/tests/test_contract_stability.py b/tests/test_contract_stability.py index 5f1b9f4..a21a85c 100644 --- a/tests/test_contract_stability.py +++ b/tests/test_contract_stability.py @@ -154,7 +154,15 @@ def test_changelog_records_latest_release_entry() -> None: "## 0.3.1 - 2026-07-17", "## 0.3.0 - 2026-07-17", ] - assert normalized_unreleased == "" + assert normalized_unreleased == " ".join( + [ + "- Defined a bounded demand-validation window through 2026-09-20 and froze feature releases pending an explicit maintainer decision after the 2026-09-21 review. Marketplace publication remains separately prohibited without explicit authorization.", + "- Locked the release build toolchain, pinned copyable GitHub Action examples to the immutable v0.3.4 release commit, and documented the post-release pin refresh contract.", + "- Simplified reviewed bootstrap and monorepo onboarding, added explicit Python interpreter checks, and tightened guidance for copying public-safe evidence.", + "- Hardened the documented PyPI provenance flow with isolated temporary downloads, request timeouts, exact artifact checks, redirect-final HTTPS host validation, exclusive file creation, and cleanup on success or failure.", + "- Aligned self-dogfood CI with the canonical public evidence filenames and required fail-closed bundle validation before artifact upload.", + ] + ) assert "Bound API, content, and path policy inputs and scan work" in normalized_latest assert "bounded packaged public-bundle consumer mode" in normalized_latest assert "fresh runner-temporary staging" in normalized_latest diff --git a/tests/test_self_dogfood_contract.py b/tests/test_self_dogfood_contract.py index 7278620..8c575a8 100644 --- a/tests/test_self_dogfood_contract.py +++ b/tests/test_self_dogfood_contract.py @@ -89,5 +89,5 @@ def test_self_dogfood_guard_policies_are_present_and_clean() -> None: root=REPO_ROOT, policy=load_workflow_policy(SELF_WORKFLOW_POLICY), ) - assert workflow_checked == 24 + assert workflow_checked == 25 assert workflow_findings == [] diff --git a/tests/test_workflow_release_contract.py b/tests/test_workflow_release_contract.py index 774eeb4..99c87b2 100644 --- a/tests/test_workflow_release_contract.py +++ b/tests/test_workflow_release_contract.py @@ -586,11 +586,23 @@ def test_ci_self_dogfood_renders_from_single_json_report() -> None: if "python -m agent_guard.cli report " in line ] assert report_lines == [ - "python -m agent_guard.cli report --root . --context-policy .agent-guard/context-policy.yaml --evidence-preset recommended --api-policy examples/architecture_policy.yaml --mcp-policy .agent-guard/mcp-policy.yaml --digest-policy .agent-guard/context-digest-policy.yaml --format json --output .agent-guard/evidence/agent-guard-evidence-report.json" + "python -m agent_guard.cli report --root . --context-policy .agent-guard/context-policy.yaml --evidence-preset recommended --api-policy examples/architecture_policy.yaml --mcp-policy .agent-guard/mcp-policy.yaml --digest-policy .agent-guard/context-digest-policy.yaml --format json --output .agent-guard/evidence/agent-guard-report.json" ] assert ( - "python -m agent_guard.cli render-report --root . --input .agent-guard/evidence/agent-guard-evidence-report.json " - "--format markdown --output .agent-guard/evidence/agent-guard-evidence-report.md" + "python -m agent_guard.cli conformance check --root . " + "--evidence .agent-guard/evidence/agent-guard-report.json " + "--profile recommended --json" + in normalized_self_dogfood + ) + assert ( + "python -m agent_guard.cli evidence-pack manifest --root . " + "--report .agent-guard/evidence/agent-guard-report.json " + "--artifact .agent-guard/evidence/agent-guard-report.json --json" + in normalized_self_dogfood + ) + assert ( + "python -m agent_guard.cli render-report --root . --input .agent-guard/evidence/agent-guard-report.json " + "--format markdown --output .agent-guard/evidence/agent-guard-report.md" in normalized_self_dogfood ) assert ( @@ -598,15 +610,25 @@ def test_ci_self_dogfood_renders_from_single_json_report() -> None: in normalized_self_dogfood ) assert ( - "python -m agent_guard.cli render-report --root . --input .agent-guard/evidence/agent-guard-evidence-report.json " + "python -m agent_guard.cli render-report --root . --input .agent-guard/evidence/agent-guard-report.json " "--format sarif --output .agent-guard/evidence/agent-guard-results.sarif" in normalized_self_dogfood ) assert ( - "python -m agent_guard.cli render-report --root . --input .agent-guard/evidence/agent-guard-evidence-report.json " + "python -m agent_guard.cli render-report --root . --input .agent-guard/evidence/agent-guard-report.json " "--format github-annotations" in normalized_self_dogfood ) + consumer_command = ( + "python -I -m agent_guard.consumer --evidence-dir .agent-guard/evidence " + ".agent-guard/evidence/agent-guard-report.json" + ) + assert consumer_command in normalized_self_dogfood + assert ".agent-guard/evidence/agent-guard-evidence-report.json" not in normalized_self_dogfood + assert ".agent-guard/evidence/agent-guard-evidence-report.md" not in normalized_self_dogfood + assert normalized_self_dogfood.index(consumer_command) < normalized_self_dogfood.index( + "uses: actions/upload-artifact@" + ) def test_ci_action_smoke_replays_fail_closed_consumer_contract() -> None: