From 8c340ee9d8e6d7444dc97debbe761d06e6dd7ee8 Mon Sep 17 00:00:00 2001 From: yui-stingray Date: Thu, 13 Aug 2026 13:50:35 +0900 Subject: [PATCH] chore(release): prepare 0.3.5 --- CHANGELOG.md | 4 ++ README.md | 20 +++---- docs/evidence-consumer-contracts.md | 4 +- docs/evidence-samples/agent-guard-report.json | 2 +- docs/quickstart-existing-repo.md | 6 +- pyproject.toml | 2 +- src/agent_guard/__init__.py | 2 +- tests/test_contract_stability.py | 59 +++++++++++-------- tests/test_workflow_release_contract.py | 6 +- 9 files changed, 58 insertions(+), 47 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c35b4e7..81fe208 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,10 @@ Why: keep static guard releases auditable while the package is still alpha. ## Unreleased +## 0.3.5 - 2026-08-13 + +- The published 0.3.4 context scanner can be made unavailable by adversarial + repository-controlled regex, and this patch bounds that matching. - Isolated repository-controlled context-policy regular-expression matching behind the existing bounded scanner worker and added fixed pattern-count and pattern-length limits. Timeout and limit failures remain deterministic, diff --git a/README.md b/README.md index fda5e7f..4e6d430 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ > Deterministic static evidence for repositories maintained with coding agents. -**Status**: `0.3.4` alpha. Vendor-neutral, static-only, Python 3.11.4+, with one +**Status**: `0.3.5` alpha. Vendor-neutral, static-only, Python 3.11.4+, with one runtime dependency (`PyYAML`). Coding agents can change more than application code. They can also change the @@ -65,7 +65,7 @@ If `uv` is available, preview the current alpha without a persistent install or target-repository writes: ```bash -uvx --python 3.12 --from yui-agent-guard==0.3.4 agent-guard init --root . --print +uvx --python 3.12 --from yui-agent-guard==0.3.5 agent-guard init --root . --print ``` This pinned command may populate caches outside the repository, but it does not @@ -79,7 +79,7 @@ starter files, and generate the recommended sanitized evidence. The scanned repository can use any runtime: ```bash -python -m pip install yui-agent-guard==0.3.4 +python -m pip install yui-agent-guard==0.3.5 agent-guard init --root . --print # Review the proposed policies and workflow before the write step. agent-guard init --root . --write @@ -278,7 +278,7 @@ JSON output uses a shared result envelope across scanners: ```json { "schema_version": "agent-guard.result.v1", - "tool": {"name": "agent-guard", "version": "0.3.4"}, + "tool": {"name": "agent-guard", "version": "0.3.5"}, "scanner": "context", "status": "ok", "exit_code": 0, @@ -418,7 +418,7 @@ than a single scanner: # .pre-commit-config.yaml repos: - repo: https://github.com/yui-stingray/agent-guard - rev: v0.3.4 + rev: v0.3.5 hooks: - id: agent-guard-context - id: agent-guard-path @@ -1073,7 +1073,7 @@ import urllib.request from pathlib import Path from urllib.parse import urlparse -version = "0.3.4" +version = "0.3.5" target = Path(sys.argv[1]) request_timeout_seconds = 20 metadata_url = f"https://pypi.org/pypi/yui-agent-guard/{version}/json" @@ -1126,14 +1126,14 @@ for filename in sorted(expected): with (target / filename).open("xb") as destination: shutil.copyfileobj(response, destination) PY -gh attestation verify "$verify_dir/yui_agent_guard-0.3.4-py3-none-any.whl" \ +gh attestation verify "$verify_dir/yui_agent_guard-0.3.5-py3-none-any.whl" \ --repo yui-stingray/agent-guard \ --signer-workflow yui-stingray/agent-guard/.github/workflows/release.yml \ - --source-ref refs/tags/v0.3.4 -gh attestation verify "$verify_dir/yui_agent_guard-0.3.4.tar.gz" \ + --source-ref refs/tags/v0.3.5 +gh attestation verify "$verify_dir/yui_agent_guard-0.3.5.tar.gz" \ --repo yui-stingray/agent-guard \ --signer-workflow yui-stingray/agent-guard/.github/workflows/release.yml \ - --source-ref refs/tags/v0.3.4 + --source-ref refs/tags/v0.3.5 ) ``` diff --git a/docs/evidence-consumer-contracts.md b/docs/evidence-consumer-contracts.md index 209dd2c..b289b4f 100644 --- a/docs/evidence-consumer-contracts.md +++ b/docs/evidence-consumer-contracts.md @@ -36,7 +36,7 @@ jobs: - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.12" - - run: python -m pip install yui-agent-guard==0.3.4 + - run: python -m pip install yui-agent-guard==0.3.5 - name: Consume sanitized evidence run: sh examples/evidence_contracts_ci.sh consume ``` @@ -156,7 +156,7 @@ jobs: - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.12" - - run: python -m pip install yui-agent-guard==0.3.4 + - run: python -m pip install yui-agent-guard==0.3.5 - name: Strict release gate run: sh examples/evidence_contracts_ci.sh strict-release ``` diff --git a/docs/evidence-samples/agent-guard-report.json b/docs/evidence-samples/agent-guard-report.json index 0bb63ed..6c00f7f 100644 --- a/docs/evidence-samples/agent-guard-report.json +++ b/docs/evidence-samples/agent-guard-report.json @@ -1 +1 @@ -{"api": {"checked_count": 251, "finding_count": 0, "findings": [], "policy": {"path": "examples/architecture_policy.yaml"}, "status": "ok"}, "command": "report", "conformance": {"checked_count": 17, "finding_count": 0, "findings": [], "mcp_config_checked_count": 0, "profile": "recommended", "required_artifact_roles": [], "required_gates": ["context", "surface_inventory", "path", "content", "mcp_config", "workflow", "policy_spec_drift"], "required_policy_files": [".agent-guard/context-policy.yaml", ".agent-guard/path-policy.yaml", ".agent-guard/content-policy.yaml", ".agent-guard/mcp-policy.yaml", ".agent-guard/workflow-policy.yaml"], "required_report_sections": [], "required_surfaces": ["agent_context", "policy_file", "workflow_file", "workflow_reference"], "schema_version": "agent-guard.conformance.v1", "status": "ok"}, "content": {"checked_count": 40, "finding_count": 0, "findings": [], "mode": "registered", "policy": {"path": ".agent-guard/content-policy.yaml"}, "scan_dir": ".", "status": "ok"}, "context_lock": {"checked_count": 1, "covered": [{"check_id": "root_agents_md", "kind": "agents_md", "path": "AGENTS.md", "status": "covered"}], "covered_count": 1, "finding_count": 0, "findings": [], "policy": {"path": ".agent-guard/context-digest-policy.yaml"}, "status": "ok"}, "digest": {"checked_count": 6, "finding_count": 0, "findings": [], "policy": {"path": ".agent-guard/context-digest-policy.yaml"}, "status": "ok"}, "evidence_coverage": {"enabled_count": 10, "failing_count": 0, "gate_count": 10, "gates": [{"checked_count": 1, "finding_count": 0, "gate": "context", "policy": {"path": ".agent-guard/context-policy.yaml"}, "status": "ok"}, {"checked_count": 142, "finding_count": 0, "gate": "surface_inventory", "policy": {"path": ".agent-guard/context-policy.yaml"}, "status": "ok"}, {"checked_count": 739, "finding_count": 0, "gate": "path", "policy": {"path": ".agent-guard/path-policy.yaml"}, "status": "ok"}, {"checked_count": 40, "finding_count": 0, "gate": "content", "policy": {"path": ".agent-guard/content-policy.yaml"}, "status": "ok"}, {"checked_count": 251, "finding_count": 0, "gate": "api", "policy": {"path": "examples/architecture_policy.yaml"}, "status": "ok"}, {"checked_count": 0, "finding_count": 0, "gate": "mcp_config", "policy": {"path": ".agent-guard/mcp-policy.yaml"}, "status": "ok"}, {"checked_count": 1, "finding_count": 0, "gate": "context_lock", "policy": {"path": ".agent-guard/context-digest-policy.yaml"}, "status": "ok"}, {"checked_count": 6, "finding_count": 0, "gate": "digest", "policy": {"path": ".agent-guard/context-digest-policy.yaml"}, "status": "ok"}, {"checked_count": 25, "finding_count": 0, "gate": "workflow", "policy": {"path": ".agent-guard/workflow-policy.yaml"}, "status": "ok"}, {"checked_count": 46, "finding_count": 0, "gate": "policy_spec_drift", "status": "ok"}], "missing_count": 0, "schema_version": "agent-guard.evidence_coverage.v1"}, "evidence_pack_manifest": {"artifacts": [{"path": "docs/evidence-samples/agent-guard-report.json", "role": "report"}], "conformance": {"finding_count": 0, "profile": "recommended", "schema_version": "agent-guard.conformance.v1", "status": "ok"}, "gates": [{"finding_count": 0, "gate": "context", "status": "ok"}, {"finding_count": 0, "gate": "surface_inventory", "status": "ok"}, {"finding_count": 0, "gate": "path", "status": "ok"}, {"finding_count": 0, "gate": "content", "status": "ok"}, {"finding_count": 0, "gate": "api", "status": "ok"}, {"finding_count": 0, "gate": "mcp_config", "status": "ok"}, {"finding_count": 0, "gate": "context_lock", "status": "ok"}, {"finding_count": 0, "gate": "digest", "status": "ok"}, {"finding_count": 0, "gate": "workflow", "status": "ok"}, {"finding_count": 0, "gate": "policy_spec_drift", "status": "ok"}], "report": {"finding_count": 0, "format": "json", "schema_version": "agent-guard.report_evidence.v1", "scope": "context+path+content+api+mcp+digest+workflow+drift", "status": "ok"}, "sanitized": true, "schema_version": "agent-guard.evidence_pack_manifest.v1", "summary": {"enabled_gate_count": 10, "failing_gate_count": 0, "gate_count": 10, "missing_gate_count": 0, "surface_count": 142}, "tool": {"name": "agent-guard", "version": "0.3.4"}}, "exit_code": 0, "finding_count": 0, "findings": [], "inventory": {"context_files": [{"evidence": [{"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:14:approval_boundary_mention", "line": 14, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:15:approval_boundary_mention", "line": 15, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:28:approval_boundary_mention", "line": 28, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:30:approval_boundary_mention", "line": 30, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:32:approval_boundary_mention", "line": 32, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:49:approval_boundary_mention", "line": 49, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:50:approval_boundary_mention", "line": 50, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:51:approval_boundary_mention", "line": 51, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:52:approval_boundary_mention", "line": 52, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:53:approval_boundary_mention", "line": 53, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:54:approval_boundary_mention", "line": 54, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:55:approval_boundary_mention", "line": 55, "rule_id": "approval_boundary_mention"}, {"category": "destructive_action_boundary", "evidence_id": "destructive_action_boundary:AGENTS.md:31:destructive_action_boundary_mention", "line": 31, "rule_id": "destructive_action_boundary_mention"}, {"category": "destructive_action_boundary", "evidence_id": "destructive_action_boundary:AGENTS.md:38:destructive_action_boundary_mention", "line": 38, "rule_id": "destructive_action_boundary_mention"}, {"category": "local_verification", "evidence_id": "local_verification:AGENTS.md:9:local_verification_mention", "line": 9, "rule_id": "local_verification_mention"}, {"category": "local_verification", "evidence_id": "local_verification:AGENTS.md:23:local_verification_mention", "line": 23, "rule_id": "local_verification_mention"}, {"category": "local_verification", "evidence_id": "local_verification:AGENTS.md:40:local_verification_mention", "line": 40, "rule_id": "local_verification_mention"}, {"category": "local_verification", "evidence_id": "local_verification:AGENTS.md:41:local_verification_mention", "line": 41, "rule_id": "local_verification_mention"}, {"category": "local_verification", "evidence_id": "local_verification:AGENTS.md:46:local_verification_mention", "line": 46, "rule_id": "local_verification_mention"}, {"category": "network_boundary", "evidence_id": "network_boundary:AGENTS.md:32:network_boundary_mention", "line": 32, "rule_id": "network_boundary_mention"}, {"category": "secret_handling", "evidence_id": "secret_handling:AGENTS.md:22:secret_handling_mention", "line": 22, "rule_id": "secret_handling_mention"}, {"category": "secret_handling", "evidence_id": "secret_handling:AGENTS.md:36:secret_handling_mention", "line": 36, "rule_id": "secret_handling_mention"}, {"category": "secret_handling", "evidence_id": "secret_handling:AGENTS.md:37:secret_handling_mention", "line": 37, "rule_id": "secret_handling_mention"}, {"category": "tool_permission_boundary", "evidence_id": "tool_permission_boundary:AGENTS.md:32:tool_permission_boundary_mention", "line": 32, "rule_id": "tool_permission_boundary_mention"}], "kind": "agents_md", "line_count": 56, "path": "AGENTS.md", "read_status": "scanned", "size_bytes": 3176}], "permission_boundaries": [{"category": "approval_boundary", "evidence_ids": ["approval_boundary:AGENTS.md:14:approval_boundary_mention", "approval_boundary:AGENTS.md:15:approval_boundary_mention", "approval_boundary:AGENTS.md:28:approval_boundary_mention", "approval_boundary:AGENTS.md:30:approval_boundary_mention", "approval_boundary:AGENTS.md:32:approval_boundary_mention", "approval_boundary:AGENTS.md:49:approval_boundary_mention", "approval_boundary:AGENTS.md:50:approval_boundary_mention", "approval_boundary:AGENTS.md:51:approval_boundary_mention", "approval_boundary:AGENTS.md:52:approval_boundary_mention", "approval_boundary:AGENTS.md:53:approval_boundary_mention", "approval_boundary:AGENTS.md:54:approval_boundary_mention", "approval_boundary:AGENTS.md:55:approval_boundary_mention"], "status": "present"}, {"category": "tool_permission_boundary", "evidence_ids": ["tool_permission_boundary:AGENTS.md:32:tool_permission_boundary_mention"], "status": "present"}, {"category": "network_boundary", "evidence_ids": ["network_boundary:AGENTS.md:32:network_boundary_mention"], "status": "present"}, {"category": "secret_handling", "evidence_ids": ["secret_handling:AGENTS.md:22:secret_handling_mention", "secret_handling:AGENTS.md:36:secret_handling_mention", "secret_handling:AGENTS.md:37:secret_handling_mention"], "status": "present"}, {"category": "destructive_action_boundary", "evidence_ids": ["destructive_action_boundary:AGENTS.md:31:destructive_action_boundary_mention", "destructive_action_boundary:AGENTS.md:38:destructive_action_boundary_mention"], "status": "present"}, {"category": "local_verification", "evidence_ids": ["local_verification:AGENTS.md:23:local_verification_mention", "local_verification:AGENTS.md:40:local_verification_mention", "local_verification:AGENTS.md:41:local_verification_mention", "local_verification:AGENTS.md:46:local_verification_mention", "local_verification:AGENTS.md:9:local_verification_mention"], "status": "present"}], "schema_version": "agent-guard.context_inventory.v1"}, "mcp_config": {"checked_count": 0, "finding_count": 0, "findings": [], "policy": {"fail_on_parse_error": true, "forbidden_risky_patterns": ["broad_authorization_scope", "filesystem_root_reference", "inline_authorization_value", "inline_env_value", "instruction_like_description", "latest_package", "secret_shaped_inline_value", "unpinned_package", "unsafe_url_scheme"], "path": ".agent-guard/mcp-policy.yaml"}, "status": "ok", "surfaces": []}, "path": {"checked_count": 739, "finding_count": 0, "findings": [], "policy": {"path": ".agent-guard/path-policy.yaml"}, "status": "ok"}, "policy": {"path": ".agent-guard/context-policy.yaml"}, "policy_spec_drift": {"checked_count": 46, "finding_count": 0, "findings": [], "profile": "recommended", "schema_version": "agent-guard.policy_spec_drift.v2", "status": "ok"}, "report": {"format": "json", "sanitized": true, "schema_version": "agent-guard.report_evidence.v1", "scope": "context+path+content+api+mcp+digest+workflow+drift"}, "scanned_files": 1, "scanner": "context", "schema_version": "agent-guard.result.v1", "status": "ok", "summary": {"api_checked_count": 251, "api_finding_count": 0, "conformance_checked_count": 17, "conformance_finding_count": 0, "content_checked_count": 40, "content_finding_count": 0, "context_file_count": 1, "context_lock_checked_count": 1, "context_lock_covered_count": 1, "context_lock_finding_count": 0, "coverage_enabled_count": 10, "coverage_failing_count": 0, "coverage_missing_count": 0, "digest_checked_count": 6, "digest_finding_count": 0, "drift_checked_count": 46, "drift_finding_count": 0, "evidence_count": 24, "finding_count": 0, "mcp_config_checked_count": 0, "mcp_config_finding_count": 0, "path_checked_count": 739, "path_finding_count": 0, "scanned_count": 1, "scanned_unit": "files", "surface_count": 142, "workflow_checked_count": 25, "workflow_finding_count": 0}, "surface_inventory": {"schema_version": "agent-guard.agent_surface_inventory.v2", "summary": {"by_surface": {"agent_context": 1, "documented_guard_command": 98, "evidence_artifact": 1, "evidence_artifact_reference": 7, "policy_file": 6, "workflow_file": 3, "workflow_reference": 26}, "surface_count": 142}, "surfaces": [{"kind": "content_policy", "path": ".agent-guard/content-policy.yaml", "size_bytes": 2007, "status": "present", "surface": "policy_file"}, {"kind": "digest_policy", "path": ".agent-guard/context-digest-policy.yaml", "size_bytes": 1040, "status": "present", "surface": "policy_file"}, {"kind": "context_policy", "path": ".agent-guard/context-policy.yaml", "size_bytes": 1410, "status": "present", "surface": "policy_file"}, {"kind": "agent_guard_policy", "path": ".agent-guard/mcp-policy.yaml", "size_bytes": 535, "status": "present", "surface": "policy_file"}, {"kind": "path_policy", "path": ".agent-guard/path-policy.yaml", "size_bytes": 1453, "status": "present", "surface": "policy_file"}, {"kind": "workflow_policy", "path": ".agent-guard/workflow-policy.yaml", "size_bytes": 4035, "status": "present", "surface": "policy_file"}, {"artifact_path": "$report", "command": {"command": "", "scanner": "report"}, "job_id": "windows-cli-smoke", "kind": "agent_guard_output", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 5, "surface": "evidence_artifact_reference"}, {"artifact_path": ".agent-guard/evidence/agent-guard-report.json", "command": {"command": "", "scanner": "report"}, "job_id": "test", "kind": "agent_guard_output", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "evidence_artifact_reference"}, {"artifact_path": ".agent-guard/evidence/agent-guard-report.md", "command": {"command": "", "scanner": "render-report"}, "job_id": "test", "kind": "agent_guard_output", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "evidence_artifact_reference"}, {"artifact_path": ".agent-guard/evidence/agent-guard-results.sarif", "command": {"command": "", "scanner": "render-report"}, "job_id": "test", "kind": "agent_guard_output", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "evidence_artifact_reference"}, {"artifact_path": ".agent-guard/evidence", "job_id": "test", "kind": "github_artifact", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 10, "surface": "evidence_artifact_reference"}, {"kind": "github_actions", "path": ".github/workflows/ci.yml", "status": "scanned", "surface": "workflow_file"}, {"command": {"command": "", "scanner": "report"}, "job_id": "windows-cli-smoke", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 5, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "content"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "context"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "lock", "scanner": "context"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "digest"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "path"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "digest"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "mcp"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "workflow"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "path"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "context"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "lock", "scanner": "context"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "lock", "scanner": "context"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "digest"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "digest"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "content"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "mcp"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "workflow"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "inventory", "scanner": "surface"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "drift"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "", "scanner": "report"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "", "scanner": "render-report"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "", "scanner": "render-report"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "conformance"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "manifest", "scanner": "evidence-pack"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "", "scanner": "render-report"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"artifact_path": "release-notes.md", "job_id": "prepare-github-release", "kind": "github_artifact", "path": ".github/workflows/github-release.yml", "status": "referenced", "step_index": 10, "surface": "evidence_artifact_reference"}, {"kind": "github_actions", "path": ".github/workflows/github-release.yml", "status": "scanned", "surface": "workflow_file"}, {"artifact_path": "dist", "job_id": "build", "kind": "github_artifact", "path": ".github/workflows/release.yml", "status": "referenced", "step_index": 12, "surface": "evidence_artifact_reference"}, {"kind": "github_actions", "path": ".github/workflows/release.yml", "status": "scanned", "surface": "workflow_file"}, {"kind": "agents_md", "line_count": 56, "path": "AGENTS.md", "size_bytes": 3176, "status": "scanned", "surface": "agent_context"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 68, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 83, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 85, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 87, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 258, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "path"}, "kind": "documentation_recipe", "line": 259, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "content"}, "kind": "documentation_recipe", "line": 260, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "api"}, "kind": "documentation_recipe", "line": 266, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "content"}, "kind": "documentation_recipe", "line": 267, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 268, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "surface"}, "kind": "documentation_recipe", "line": 269, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "path"}, "kind": "documentation_recipe", "line": 270, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "digest"}, "kind": "documentation_recipe", "line": 271, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "workflow"}, "kind": "documentation_recipe", "line": 272, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "drift"}, "kind": "documentation_recipe", "line": 273, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "path"}, "kind": "documentation_recipe", "line": 320, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 321, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "content"}, "kind": "documentation_recipe", "line": 322, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "mcp"}, "kind": "documentation_recipe", "line": 323, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "workflow"}, "kind": "documentation_recipe", "line": 324, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "surface"}, "kind": "documentation_recipe", "line": 325, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "drift"}, "kind": "documentation_recipe", "line": 326, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 327, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "conformance"}, "kind": "documentation_recipe", "line": 328, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "manifest", "scanner": "evidence-pack"}, "kind": "documentation_recipe", "line": 329, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 344, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 345, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "digest"}, "kind": "documentation_recipe", "line": 346, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "delta", "scanner": "surface"}, "kind": "documentation_recipe", "line": 367, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "context"}, "kind": "documentation_recipe", "line": 511, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 512, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 547, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 548, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 549, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 550, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 551, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 552, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 553, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 554, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 555, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 556, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 557, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 558, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 991, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 993, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "digest"}, "kind": "documentation_recipe", "line": 995, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 1006, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "api"}, "kind": "documentation_recipe", "line": 1007, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "content"}, "kind": "documentation_recipe", "line": 1008, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 1009, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "context"}, "kind": "documentation_recipe", "line": 1010, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 1011, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "mcp"}, "kind": "documentation_recipe", "line": 1012, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "surface"}, "kind": "documentation_recipe", "line": 1013, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 1014, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 1015, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "path"}, "kind": "documentation_recipe", "line": 1016, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "digest"}, "kind": "documentation_recipe", "line": 1017, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "workflow"}, "kind": "documentation_recipe", "line": 1018, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "drift"}, "kind": "documentation_recipe", "line": 1019, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "delta", "scanner": "surface"}, "kind": "documentation_recipe", "line": 1020, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 1021, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 124, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 125, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "context"}, "kind": "documentation_recipe", "line": 126, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "surface"}, "kind": "documentation_recipe", "line": 127, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 128, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 129, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "mcp"}, "kind": "documentation_recipe", "line": 130, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "drift"}, "kind": "documentation_recipe", "line": 131, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 132, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 133, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 134, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "conformance"}, "kind": "documentation_recipe", "line": 135, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "manifest", "scanner": "evidence-pack"}, "kind": "documentation_recipe", "line": 136, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 144, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "manifest", "scanner": "evidence-pack"}, "kind": "documentation_recipe", "line": 153, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"kind": "committed_evidence_sample", "path": "docs/evidence-samples/agent-guard-report.json", "size_bytes": 40504, "status": "present", "surface": "evidence_artifact"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 227, "path": "docs/github-actions-evidence.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 228, "path": "docs/github-actions-evidence.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 16, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 34, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 36, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 38, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 172, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "conformance"}, "kind": "documentation_recipe", "line": 179, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 200, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "context"}, "kind": "documentation_recipe", "line": 201, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "mcp"}, "kind": "documentation_recipe", "line": 202, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "surface"}, "kind": "documentation_recipe", "line": 203, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 220, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 221, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "workflow"}, "kind": "documentation_recipe", "line": 232, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "mcp"}, "kind": "documentation_recipe", "line": 233, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "drift"}, "kind": "documentation_recipe", "line": 234, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 235, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 236, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "conformance"}, "kind": "documentation_recipe", "line": 261, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "manifest", "scanner": "evidence-pack"}, "kind": "documentation_recipe", "line": 265, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}]}, "tool": {"name": "agent-guard", "version": "0.3.4"}, "workflow": {"checked_count": 25, "finding_count": 0, "findings": [], "policy": {"path": ".agent-guard/workflow-policy.yaml"}, "status": "ok"}} +{"api": {"checked_count": 251, "finding_count": 0, "findings": [], "policy": {"path": "examples/architecture_policy.yaml"}, "status": "ok"}, "command": "report", "conformance": {"checked_count": 17, "finding_count": 0, "findings": [], "mcp_config_checked_count": 0, "profile": "recommended", "required_artifact_roles": [], "required_gates": ["context", "surface_inventory", "path", "content", "mcp_config", "workflow", "policy_spec_drift"], "required_policy_files": [".agent-guard/context-policy.yaml", ".agent-guard/path-policy.yaml", ".agent-guard/content-policy.yaml", ".agent-guard/mcp-policy.yaml", ".agent-guard/workflow-policy.yaml"], "required_report_sections": [], "required_surfaces": ["agent_context", "policy_file", "workflow_file", "workflow_reference"], "schema_version": "agent-guard.conformance.v1", "status": "ok"}, "content": {"checked_count": 40, "finding_count": 0, "findings": [], "mode": "registered", "policy": {"path": ".agent-guard/content-policy.yaml"}, "scan_dir": ".", "status": "ok"}, "context_lock": {"checked_count": 1, "covered": [{"check_id": "root_agents_md", "kind": "agents_md", "path": "AGENTS.md", "status": "covered"}], "covered_count": 1, "finding_count": 0, "findings": [], "policy": {"path": ".agent-guard/context-digest-policy.yaml"}, "status": "ok"}, "digest": {"checked_count": 6, "finding_count": 0, "findings": [], "policy": {"path": ".agent-guard/context-digest-policy.yaml"}, "status": "ok"}, "evidence_coverage": {"enabled_count": 10, "failing_count": 0, "gate_count": 10, "gates": [{"checked_count": 1, "finding_count": 0, "gate": "context", "policy": {"path": ".agent-guard/context-policy.yaml"}, "status": "ok"}, {"checked_count": 142, "finding_count": 0, "gate": "surface_inventory", "policy": {"path": ".agent-guard/context-policy.yaml"}, "status": "ok"}, {"checked_count": 739, "finding_count": 0, "gate": "path", "policy": {"path": ".agent-guard/path-policy.yaml"}, "status": "ok"}, {"checked_count": 40, "finding_count": 0, "gate": "content", "policy": {"path": ".agent-guard/content-policy.yaml"}, "status": "ok"}, {"checked_count": 251, "finding_count": 0, "gate": "api", "policy": {"path": "examples/architecture_policy.yaml"}, "status": "ok"}, {"checked_count": 0, "finding_count": 0, "gate": "mcp_config", "policy": {"path": ".agent-guard/mcp-policy.yaml"}, "status": "ok"}, {"checked_count": 1, "finding_count": 0, "gate": "context_lock", "policy": {"path": ".agent-guard/context-digest-policy.yaml"}, "status": "ok"}, {"checked_count": 6, "finding_count": 0, "gate": "digest", "policy": {"path": ".agent-guard/context-digest-policy.yaml"}, "status": "ok"}, {"checked_count": 25, "finding_count": 0, "gate": "workflow", "policy": {"path": ".agent-guard/workflow-policy.yaml"}, "status": "ok"}, {"checked_count": 46, "finding_count": 0, "gate": "policy_spec_drift", "status": "ok"}], "missing_count": 0, "schema_version": "agent-guard.evidence_coverage.v1"}, "evidence_pack_manifest": {"artifacts": [{"path": "docs/evidence-samples/agent-guard-report.json", "role": "report"}], "conformance": {"finding_count": 0, "profile": "recommended", "schema_version": "agent-guard.conformance.v1", "status": "ok"}, "gates": [{"finding_count": 0, "gate": "context", "status": "ok"}, {"finding_count": 0, "gate": "surface_inventory", "status": "ok"}, {"finding_count": 0, "gate": "path", "status": "ok"}, {"finding_count": 0, "gate": "content", "status": "ok"}, {"finding_count": 0, "gate": "api", "status": "ok"}, {"finding_count": 0, "gate": "mcp_config", "status": "ok"}, {"finding_count": 0, "gate": "context_lock", "status": "ok"}, {"finding_count": 0, "gate": "digest", "status": "ok"}, {"finding_count": 0, "gate": "workflow", "status": "ok"}, {"finding_count": 0, "gate": "policy_spec_drift", "status": "ok"}], "report": {"finding_count": 0, "format": "json", "schema_version": "agent-guard.report_evidence.v1", "scope": "context+path+content+api+mcp+digest+workflow+drift", "status": "ok"}, "sanitized": true, "schema_version": "agent-guard.evidence_pack_manifest.v1", "summary": {"enabled_gate_count": 10, "failing_gate_count": 0, "gate_count": 10, "missing_gate_count": 0, "surface_count": 142}, "tool": {"name": "agent-guard", "version": "0.3.5"}}, "exit_code": 0, "finding_count": 0, "findings": [], "inventory": {"context_files": [{"evidence": [{"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:14:approval_boundary_mention", "line": 14, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:15:approval_boundary_mention", "line": 15, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:28:approval_boundary_mention", "line": 28, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:30:approval_boundary_mention", "line": 30, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:32:approval_boundary_mention", "line": 32, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:49:approval_boundary_mention", "line": 49, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:50:approval_boundary_mention", "line": 50, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:51:approval_boundary_mention", "line": 51, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:52:approval_boundary_mention", "line": 52, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:53:approval_boundary_mention", "line": 53, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:54:approval_boundary_mention", "line": 54, "rule_id": "approval_boundary_mention"}, {"category": "approval_boundary", "evidence_id": "approval_boundary:AGENTS.md:55:approval_boundary_mention", "line": 55, "rule_id": "approval_boundary_mention"}, {"category": "destructive_action_boundary", "evidence_id": "destructive_action_boundary:AGENTS.md:31:destructive_action_boundary_mention", "line": 31, "rule_id": "destructive_action_boundary_mention"}, {"category": "destructive_action_boundary", "evidence_id": "destructive_action_boundary:AGENTS.md:38:destructive_action_boundary_mention", "line": 38, "rule_id": "destructive_action_boundary_mention"}, {"category": "local_verification", "evidence_id": "local_verification:AGENTS.md:9:local_verification_mention", "line": 9, "rule_id": "local_verification_mention"}, {"category": "local_verification", "evidence_id": "local_verification:AGENTS.md:23:local_verification_mention", "line": 23, "rule_id": "local_verification_mention"}, {"category": "local_verification", "evidence_id": "local_verification:AGENTS.md:40:local_verification_mention", "line": 40, "rule_id": "local_verification_mention"}, {"category": "local_verification", "evidence_id": "local_verification:AGENTS.md:41:local_verification_mention", "line": 41, "rule_id": "local_verification_mention"}, {"category": "local_verification", "evidence_id": "local_verification:AGENTS.md:46:local_verification_mention", "line": 46, "rule_id": "local_verification_mention"}, {"category": "network_boundary", "evidence_id": "network_boundary:AGENTS.md:32:network_boundary_mention", "line": 32, "rule_id": "network_boundary_mention"}, {"category": "secret_handling", "evidence_id": "secret_handling:AGENTS.md:22:secret_handling_mention", "line": 22, "rule_id": "secret_handling_mention"}, {"category": "secret_handling", "evidence_id": "secret_handling:AGENTS.md:36:secret_handling_mention", "line": 36, "rule_id": "secret_handling_mention"}, {"category": "secret_handling", "evidence_id": "secret_handling:AGENTS.md:37:secret_handling_mention", "line": 37, "rule_id": "secret_handling_mention"}, {"category": "tool_permission_boundary", "evidence_id": "tool_permission_boundary:AGENTS.md:32:tool_permission_boundary_mention", "line": 32, "rule_id": "tool_permission_boundary_mention"}], "kind": "agents_md", "line_count": 56, "path": "AGENTS.md", "read_status": "scanned", "size_bytes": 3176}], "permission_boundaries": [{"category": "approval_boundary", "evidence_ids": ["approval_boundary:AGENTS.md:14:approval_boundary_mention", "approval_boundary:AGENTS.md:15:approval_boundary_mention", "approval_boundary:AGENTS.md:28:approval_boundary_mention", "approval_boundary:AGENTS.md:30:approval_boundary_mention", "approval_boundary:AGENTS.md:32:approval_boundary_mention", "approval_boundary:AGENTS.md:49:approval_boundary_mention", "approval_boundary:AGENTS.md:50:approval_boundary_mention", "approval_boundary:AGENTS.md:51:approval_boundary_mention", "approval_boundary:AGENTS.md:52:approval_boundary_mention", "approval_boundary:AGENTS.md:53:approval_boundary_mention", "approval_boundary:AGENTS.md:54:approval_boundary_mention", "approval_boundary:AGENTS.md:55:approval_boundary_mention"], "status": "present"}, {"category": "tool_permission_boundary", "evidence_ids": ["tool_permission_boundary:AGENTS.md:32:tool_permission_boundary_mention"], "status": "present"}, {"category": "network_boundary", "evidence_ids": ["network_boundary:AGENTS.md:32:network_boundary_mention"], "status": "present"}, {"category": "secret_handling", "evidence_ids": ["secret_handling:AGENTS.md:22:secret_handling_mention", "secret_handling:AGENTS.md:36:secret_handling_mention", "secret_handling:AGENTS.md:37:secret_handling_mention"], "status": "present"}, {"category": "destructive_action_boundary", "evidence_ids": ["destructive_action_boundary:AGENTS.md:31:destructive_action_boundary_mention", "destructive_action_boundary:AGENTS.md:38:destructive_action_boundary_mention"], "status": "present"}, {"category": "local_verification", "evidence_ids": ["local_verification:AGENTS.md:23:local_verification_mention", "local_verification:AGENTS.md:40:local_verification_mention", "local_verification:AGENTS.md:41:local_verification_mention", "local_verification:AGENTS.md:46:local_verification_mention", "local_verification:AGENTS.md:9:local_verification_mention"], "status": "present"}], "schema_version": "agent-guard.context_inventory.v1"}, "mcp_config": {"checked_count": 0, "finding_count": 0, "findings": [], "policy": {"fail_on_parse_error": true, "forbidden_risky_patterns": ["broad_authorization_scope", "filesystem_root_reference", "inline_authorization_value", "inline_env_value", "instruction_like_description", "latest_package", "secret_shaped_inline_value", "unpinned_package", "unsafe_url_scheme"], "path": ".agent-guard/mcp-policy.yaml"}, "status": "ok", "surfaces": []}, "path": {"checked_count": 739, "finding_count": 0, "findings": [], "policy": {"path": ".agent-guard/path-policy.yaml"}, "status": "ok"}, "policy": {"path": ".agent-guard/context-policy.yaml"}, "policy_spec_drift": {"checked_count": 46, "finding_count": 0, "findings": [], "profile": "recommended", "schema_version": "agent-guard.policy_spec_drift.v2", "status": "ok"}, "report": {"format": "json", "sanitized": true, "schema_version": "agent-guard.report_evidence.v1", "scope": "context+path+content+api+mcp+digest+workflow+drift"}, "scanned_files": 1, "scanner": "context", "schema_version": "agent-guard.result.v1", "status": "ok", "summary": {"api_checked_count": 251, "api_finding_count": 0, "conformance_checked_count": 17, "conformance_finding_count": 0, "content_checked_count": 40, "content_finding_count": 0, "context_file_count": 1, "context_lock_checked_count": 1, "context_lock_covered_count": 1, "context_lock_finding_count": 0, "coverage_enabled_count": 10, "coverage_failing_count": 0, "coverage_missing_count": 0, "digest_checked_count": 6, "digest_finding_count": 0, "drift_checked_count": 46, "drift_finding_count": 0, "evidence_count": 24, "finding_count": 0, "mcp_config_checked_count": 0, "mcp_config_finding_count": 0, "path_checked_count": 739, "path_finding_count": 0, "scanned_count": 1, "scanned_unit": "files", "surface_count": 142, "workflow_checked_count": 25, "workflow_finding_count": 0}, "surface_inventory": {"schema_version": "agent-guard.agent_surface_inventory.v2", "summary": {"by_surface": {"agent_context": 1, "documented_guard_command": 98, "evidence_artifact": 1, "evidence_artifact_reference": 7, "policy_file": 6, "workflow_file": 3, "workflow_reference": 26}, "surface_count": 142}, "surfaces": [{"kind": "content_policy", "path": ".agent-guard/content-policy.yaml", "size_bytes": 2007, "status": "present", "surface": "policy_file"}, {"kind": "digest_policy", "path": ".agent-guard/context-digest-policy.yaml", "size_bytes": 1040, "status": "present", "surface": "policy_file"}, {"kind": "context_policy", "path": ".agent-guard/context-policy.yaml", "size_bytes": 1410, "status": "present", "surface": "policy_file"}, {"kind": "agent_guard_policy", "path": ".agent-guard/mcp-policy.yaml", "size_bytes": 535, "status": "present", "surface": "policy_file"}, {"kind": "path_policy", "path": ".agent-guard/path-policy.yaml", "size_bytes": 1453, "status": "present", "surface": "policy_file"}, {"kind": "workflow_policy", "path": ".agent-guard/workflow-policy.yaml", "size_bytes": 4035, "status": "present", "surface": "policy_file"}, {"artifact_path": "$report", "command": {"command": "", "scanner": "report"}, "job_id": "windows-cli-smoke", "kind": "agent_guard_output", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 5, "surface": "evidence_artifact_reference"}, {"artifact_path": ".agent-guard/evidence/agent-guard-report.json", "command": {"command": "", "scanner": "report"}, "job_id": "test", "kind": "agent_guard_output", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "evidence_artifact_reference"}, {"artifact_path": ".agent-guard/evidence/agent-guard-report.md", "command": {"command": "", "scanner": "render-report"}, "job_id": "test", "kind": "agent_guard_output", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "evidence_artifact_reference"}, {"artifact_path": ".agent-guard/evidence/agent-guard-results.sarif", "command": {"command": "", "scanner": "render-report"}, "job_id": "test", "kind": "agent_guard_output", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "evidence_artifact_reference"}, {"artifact_path": ".agent-guard/evidence", "job_id": "test", "kind": "github_artifact", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 10, "surface": "evidence_artifact_reference"}, {"kind": "github_actions", "path": ".github/workflows/ci.yml", "status": "scanned", "surface": "workflow_file"}, {"command": {"command": "", "scanner": "report"}, "job_id": "windows-cli-smoke", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 5, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "content"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "context"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "lock", "scanner": "context"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "digest"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "path"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "digest"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "mcp"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "workflow"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 8, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "path"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "context"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "lock", "scanner": "context"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "lock", "scanner": "context"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "digest"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "digest"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "content"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "mcp"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "workflow"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "inventory", "scanner": "surface"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "drift"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "", "scanner": "report"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "", "scanner": "render-report"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "", "scanner": "render-report"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "check", "scanner": "conformance"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "manifest", "scanner": "evidence-pack"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"command": {"command": "", "scanner": "render-report"}, "job_id": "test", "kind": "agent_guard_command", "path": ".github/workflows/ci.yml", "status": "referenced", "step_index": 9, "surface": "workflow_reference"}, {"artifact_path": "release-notes.md", "job_id": "prepare-github-release", "kind": "github_artifact", "path": ".github/workflows/github-release.yml", "status": "referenced", "step_index": 10, "surface": "evidence_artifact_reference"}, {"kind": "github_actions", "path": ".github/workflows/github-release.yml", "status": "scanned", "surface": "workflow_file"}, {"artifact_path": "dist", "job_id": "build", "kind": "github_artifact", "path": ".github/workflows/release.yml", "status": "referenced", "step_index": 12, "surface": "evidence_artifact_reference"}, {"kind": "github_actions", "path": ".github/workflows/release.yml", "status": "scanned", "surface": "workflow_file"}, {"kind": "agents_md", "line_count": 56, "path": "AGENTS.md", "size_bytes": 3176, "status": "scanned", "surface": "agent_context"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 68, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 83, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 85, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 87, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 258, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "path"}, "kind": "documentation_recipe", "line": 259, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "content"}, "kind": "documentation_recipe", "line": 260, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "api"}, "kind": "documentation_recipe", "line": 266, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "content"}, "kind": "documentation_recipe", "line": 267, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 268, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "surface"}, "kind": "documentation_recipe", "line": 269, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "path"}, "kind": "documentation_recipe", "line": 270, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "digest"}, "kind": "documentation_recipe", "line": 271, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "workflow"}, "kind": "documentation_recipe", "line": 272, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "drift"}, "kind": "documentation_recipe", "line": 273, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "path"}, "kind": "documentation_recipe", "line": 320, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 321, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "content"}, "kind": "documentation_recipe", "line": 322, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "mcp"}, "kind": "documentation_recipe", "line": 323, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "workflow"}, "kind": "documentation_recipe", "line": 324, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "surface"}, "kind": "documentation_recipe", "line": 325, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "drift"}, "kind": "documentation_recipe", "line": 326, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 327, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "conformance"}, "kind": "documentation_recipe", "line": 328, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "manifest", "scanner": "evidence-pack"}, "kind": "documentation_recipe", "line": 329, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 344, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 345, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "digest"}, "kind": "documentation_recipe", "line": 346, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "delta", "scanner": "surface"}, "kind": "documentation_recipe", "line": 367, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "context"}, "kind": "documentation_recipe", "line": 511, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 512, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 547, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 548, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 549, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 550, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 551, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 552, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 553, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 554, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 555, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 556, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 557, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 558, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 991, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 993, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "digest"}, "kind": "documentation_recipe", "line": 995, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 1006, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "api"}, "kind": "documentation_recipe", "line": 1007, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "content"}, "kind": "documentation_recipe", "line": 1008, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 1009, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "context"}, "kind": "documentation_recipe", "line": 1010, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 1011, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "mcp"}, "kind": "documentation_recipe", "line": 1012, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "surface"}, "kind": "documentation_recipe", "line": 1013, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 1014, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 1015, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "path"}, "kind": "documentation_recipe", "line": 1016, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "digest"}, "kind": "documentation_recipe", "line": 1017, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "workflow"}, "kind": "documentation_recipe", "line": 1018, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "drift"}, "kind": "documentation_recipe", "line": 1019, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "delta", "scanner": "surface"}, "kind": "documentation_recipe", "line": 1020, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 1021, "path": "README.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 124, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 125, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "context"}, "kind": "documentation_recipe", "line": 126, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "surface"}, "kind": "documentation_recipe", "line": 127, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 128, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 129, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "mcp"}, "kind": "documentation_recipe", "line": 130, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "drift"}, "kind": "documentation_recipe", "line": 131, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 132, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 133, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 134, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "conformance"}, "kind": "documentation_recipe", "line": 135, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "manifest", "scanner": "evidence-pack"}, "kind": "documentation_recipe", "line": 136, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 144, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "manifest", "scanner": "evidence-pack"}, "kind": "documentation_recipe", "line": 153, "path": "docs/evidence-contracts.md", "status": "documented", "surface": "documented_guard_command"}, {"kind": "committed_evidence_sample", "path": "docs/evidence-samples/agent-guard-report.json", "size_bytes": 40504, "status": "present", "surface": "evidence_artifact"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 227, "path": "docs/github-actions-evidence.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 228, "path": "docs/github-actions-evidence.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 16, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 34, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "init"}, "kind": "documentation_recipe", "line": 36, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 38, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 172, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "conformance"}, "kind": "documentation_recipe", "line": 179, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "context"}, "kind": "documentation_recipe", "line": 200, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "context"}, "kind": "documentation_recipe", "line": 201, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "mcp"}, "kind": "documentation_recipe", "line": 202, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "inventory", "scanner": "surface"}, "kind": "documentation_recipe", "line": 203, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 220, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "lock", "scanner": "context"}, "kind": "documentation_recipe", "line": 221, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "workflow"}, "kind": "documentation_recipe", "line": 232, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "mcp"}, "kind": "documentation_recipe", "line": 233, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "drift"}, "kind": "documentation_recipe", "line": 234, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "report"}, "kind": "documentation_recipe", "line": 235, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "", "scanner": "render-report"}, "kind": "documentation_recipe", "line": 236, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "check", "scanner": "conformance"}, "kind": "documentation_recipe", "line": 261, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}, {"command": {"command": "manifest", "scanner": "evidence-pack"}, "kind": "documentation_recipe", "line": 265, "path": "docs/quickstart-existing-repo.md", "status": "documented", "surface": "documented_guard_command"}]}, "tool": {"name": "agent-guard", "version": "0.3.5"}, "workflow": {"checked_count": 25, "finding_count": 0, "findings": [], "policy": {"path": ".agent-guard/workflow-policy.yaml"}, "status": "ok"}} diff --git a/docs/quickstart-existing-repo.md b/docs/quickstart-existing-repo.md index 56f0cc7..d486e88 100644 --- a/docs/quickstart-existing-repo.md +++ b/docs/quickstart-existing-repo.md @@ -13,7 +13,7 @@ If `uv` is available, preview the starter plan without installing a persistent tool or changing the repository: ```console -uvx --python 3.12 --from yui-agent-guard==0.3.4 agent-guard init --root . --print +uvx --python 3.12 --from yui-agent-guard==0.3.5 agent-guard init --root . --print ``` This pinned `uvx` path is for evaluation and human review without a persistent @@ -30,7 +30,7 @@ recommended conformance and its evidence-pack manifest: python3 -c 'import sys; sys.exit(0 if sys.version_info >= (3, 11, 4) else "agent-guard requires Python 3.11.4+")' && \ python3 -m venv .venv && \ . .venv/bin/activate && \ - python -m pip install yui-agent-guard==0.3.4 + python -m pip install yui-agent-guard==0.3.5 agent-guard init --root . --print # Review the proposed starter policies and workflow before writing them. agent-guard init --root . --write @@ -57,7 +57,7 @@ reviewed write, and sanitized report sequence is: ```powershell py -3.12 -m venv .venv -.\.venv\Scripts\python.exe -m pip install yui-agent-guard==0.3.4 +.\.venv\Scripts\python.exe -m pip install yui-agent-guard==0.3.5 .\.venv\Scripts\agent-guard.exe init --root . --print # Review the proposed starter policies and workflow before writing them. .\.venv\Scripts\agent-guard.exe init --root . --write diff --git a/pyproject.toml b/pyproject.toml index 8a9f552..db01609 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -8,7 +8,7 @@ build-backend = "hatchling.build" [project] name = "yui-agent-guard" -version = "0.3.4" +version = "0.3.5" description = "Static repository guardrails for agent-touched codebases." readme = "README.md" requires-python = ">=3.11.4" diff --git a/src/agent_guard/__init__.py b/src/agent_guard/__init__.py index 91df298..31bd525 100644 --- a/src/agent_guard/__init__.py +++ b/src/agent_guard/__init__.py @@ -32,4 +32,4 @@ "WorkflowGuardFinding", ] -__version__ = "0.3.4" +__version__ = "0.3.5" diff --git a/tests/test_contract_stability.py b/tests/test_contract_stability.py index 1966670..3513581 100644 --- a/tests/test_contract_stability.py +++ b/tests/test_contract_stability.py @@ -126,36 +126,43 @@ def test_changelog_records_latest_release_entry() -> None: changelog = CHANGELOG.read_text(encoding="utf-8") headings = [line for line in changelog.splitlines() if line.startswith("## ")] unreleased = changelog.split("## Unreleased", maxsplit=1)[1].split( + "## 0.3.5 - 2026-08-13", maxsplit=1 + )[0] + latest_release = changelog.split("## 0.3.5 - 2026-08-13", maxsplit=1)[1].split( "## 0.3.4 - 2026-08-01", maxsplit=1 )[0] - latest_release = changelog.split("## 0.3.4 - 2026-08-01", maxsplit=1)[1].split( + previous_release = changelog.split("## 0.3.4 - 2026-08-01", maxsplit=1)[1].split( "## 0.3.3 - 2026-07-27", maxsplit=1 )[0] - previous_release = changelog.split("## 0.3.3 - 2026-07-27", maxsplit=1)[1].split( + earlier_release = changelog.split("## 0.3.3 - 2026-07-27", maxsplit=1)[1].split( "## 0.3.2 - 2026-07-19", maxsplit=1 )[0] - earlier_release = changelog.split("## 0.3.2 - 2026-07-19", maxsplit=1)[1].split( + older_release = changelog.split("## 0.3.2 - 2026-07-19", maxsplit=1)[1].split( "## 0.3.1 - 2026-07-17", maxsplit=1 )[0] - older_release = changelog.split("## 0.3.1 - 2026-07-17", maxsplit=1)[1].split( + oldest_release = changelog.split("## 0.3.1 - 2026-07-17", maxsplit=1)[1].split( "## 0.3.0 - 2026-07-17", maxsplit=1 )[0] normalized_latest = " ".join(latest_release.split()) normalized_previous = " ".join(previous_release.split()) normalized_earlier = " ".join(earlier_release.split()) normalized_older = " ".join(older_release.split()) + normalized_oldest = " ".join(oldest_release.split()) normalized_unreleased = " ".join(unreleased.split()) - assert headings[:6] == [ + assert headings[:7] == [ "## Unreleased", + "## 0.3.5 - 2026-08-13", "## 0.3.4 - 2026-08-01", "## 0.3.3 - 2026-07-27", "## 0.3.2 - 2026-07-19", "## 0.3.1 - 2026-07-17", "## 0.3.0 - 2026-07-17", ] - assert normalized_unreleased == " ".join( + assert normalized_unreleased == "" + assert normalized_latest == " ".join( [ + "- The published 0.3.4 context scanner can be made unavailable by adversarial repository-controlled regex, and this patch bounds that matching.", "- Isolated repository-controlled context-policy regular-expression matching behind the existing bounded scanner worker and added fixed pattern-count and pattern-length limits. Timeout and limit failures remain deterministic, sanitized configuration errors; no raw pattern or context text is emitted.", "- Content-bound optional `agent-policy` audit-event references with a canonical-JSON, profile-bound, public-safe digest. Producers now require a reviewed repo-local event file and explicit profile, while consumers require the separately supplied event and reject missing, malformed, or replaced content. The event body remains outside the fixed seven-file public bundle.", "- Defined a bounded demand-validation window through 2026-09-20 and froze feature releases pending an explicit maintainer decision after the 2026-09-21 review. Marketplace publication remains separately prohibited without explicit authorization.", @@ -165,26 +172,26 @@ def test_changelog_records_latest_release_entry() -> None: "- Aligned self-dogfood CI with the canonical public evidence filenames and required fail-closed bundle validation before artifact upload.", ] ) - assert "Bound API, content, and path policy inputs and scan work" in normalized_latest - assert "bounded packaged public-bundle consumer mode" in normalized_latest - assert "fresh runner-temporary staging" in normalized_latest - assert "bounded P0 public-artifact hygiene patch" in normalized_previous - assert "standalone evidence-pack command recursively sanitizes" in normalized_previous - assert "recognized HTTP(S)- or file-scheme artifact inputs" in normalized_previous - assert "mixed-case URLs" in normalized_previous - assert "mapping-key collisions fail closed" in normalized_previous - assert "explicit repository-root commands" in normalized_previous - assert "Released ahead of the default batch" in normalized_earlier - assert "repository-root containment fixes" in normalized_earlier - assert "Agent-Guard Bench fail closed on guard runner errors" in normalized_earlier - assert "top-level `--version` command" in normalized_earlier - assert "write-capable GitHub Release job" in normalized_earlier - assert "credentials in its working copy" in normalized_earlier - assert "dedicated least-privilege job" in normalized_earlier - assert "Hardened the packaged evidence consumer" in normalized_older - assert "AWS access-key-ID-shaped" in normalized_older - assert "lower-bound token" in normalized_older - assert "WSL-mounted Windows user paths" in normalized_older + assert "Bound API, content, and path policy inputs and scan work" in normalized_previous + assert "bounded packaged public-bundle consumer mode" in normalized_previous + assert "fresh runner-temporary staging" in normalized_previous + assert "bounded P0 public-artifact hygiene patch" in normalized_earlier + assert "standalone evidence-pack command recursively sanitizes" in normalized_earlier + assert "recognized HTTP(S)- or file-scheme artifact inputs" in normalized_earlier + assert "mixed-case URLs" in normalized_earlier + assert "mapping-key collisions fail closed" in normalized_earlier + assert "explicit repository-root commands" in normalized_earlier + assert "Released ahead of the default batch" in normalized_older + assert "repository-root containment fixes" in normalized_older + assert "Agent-Guard Bench fail closed on guard runner errors" in normalized_older + assert "top-level `--version` command" in normalized_older + assert "write-capable GitHub Release job" in normalized_older + assert "credentials in its working copy" in normalized_older + assert "dedicated least-privilege job" in normalized_older + assert "Hardened the packaged evidence consumer" in normalized_oldest + assert "AWS access-key-ID-shaped" in normalized_oldest + assert "lower-bound token" in normalized_oldest + assert "WSL-mounted Windows user paths" in normalized_oldest assert "minimum supported Python version from 3.11 to 3.11.4" in changelog assert "surface delta --base-ref " in changelog assert "Recursively sanitized standalone Surface Inventory output" in changelog diff --git a/tests/test_workflow_release_contract.py b/tests/test_workflow_release_contract.py index 99c87b2..74c9c8b 100644 --- a/tests/test_workflow_release_contract.py +++ b/tests/test_workflow_release_contract.py @@ -856,11 +856,11 @@ def test_release_workflow_attests_built_distributions() -> None: assert "trap 'rm -rf -- \"$verify_dir\"' EXIT" in readme assert 'python - "$verify_dir"' in readme assert ( - 'gh attestation verify "$verify_dir/yui_agent_guard-0.3.4-py3-none-any.whl"' + 'gh attestation verify "$verify_dir/yui_agent_guard-0.3.5-py3-none-any.whl"' in readme ) - assert 'gh attestation verify "$verify_dir/yui_agent_guard-0.3.4.tar.gz"' in readme - assert "--source-ref refs/tags/v0.3.4\n)\n```" in readme + assert 'gh attestation verify "$verify_dir/yui_agent_guard-0.3.5.tar.gz"' in readme + assert "--source-ref refs/tags/v0.3.5\n)\n```" in readme assert "https://pypi.org/pypi/yui-agent-guard/" in readme assert 'f"yui_agent_guard-{version}-py3-none-any.whl": "bdist_wheel"' in readme assert 'f"yui_agent_guard-{version}.tar.gz": "sdist"' in readme