Retracted: v0.4.0 was tagged during pre-release development, before the public version
line started at v0.1.0. v0.4.1 exists only to publish this retraction.
Documentation
¶
Overview ¶
Package evidence runs explicitly authorized verification commands in private commit snapshots. This isolates checkout state, not malicious code: execution is not an OS sandbox.
Index ¶
- func CandidateArtifacts(p *planning.Plan) []string
- func CandidateDeclaration(p planning.Plan, argv []string, cwd string) (bool, error)
- func MatchesCandidateCommand(p planning.Plan, argv []string, cwd string) bool
- func RepositoryIdentity(ctx context.Context, root string) (string, error)
- func Validate(r Record, root, revision string, p planning.Plan, criterion string, ...) error
- func ValidateCandidate(r Record, root string, c CandidateCheckpoint, p planning.Plan, ...) error
- type CandidateBinding
- type CandidateCheckpoint
- type CandidateObservation
- type CandidateRun
- type Record
- type SourceState
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CandidateArtifacts ¶
CandidateArtifacts enumerates only exact declared JUnit output paths. It does not exempt tracked inputs or arbitrary directories from source validation.
func CandidateDeclaration ¶
func MatchesCandidateCommand ¶
func RepositoryIdentity ¶
RepositoryIdentity is shared by every clone and worktree of a repository (its root commits), so evidence recorded in an agent's worktree verifies in the main checkout. Directories without Git history fall back to their path.
func Validate ¶
func Validate(r Record, root, revision string, p planning.Plan, criterion string, command []string) error
Validate binds a stored record to its exact plan, commit, command and criterion. The checksum detects accidental edits; it is not authentication against a malicious database writer.
func ValidateCandidate ¶
func ValidateCandidate(r Record, root string, c CandidateCheckpoint, p planning.Plan, criterion string, argv []string) error
ValidateCandidate prevents branch records and observations of mutated source from satisfying candidate criteria. Approval is a local declaration, not auth.
Types ¶
type CandidateBinding ¶
type CandidateBinding struct {
Checkpoint CandidateCheckpoint `json:"checkpoint"`
SourceBefore string `json:"source_before"`
SourceAfter string `json:"source_after"`
SourceUnchanged bool `json:"source_unchanged"`
ConfigDigest string `json:"config_digest"`
ReviewDigest string `json:"review_digest"`
}
type CandidateCheckpoint ¶
type CandidateObservation ¶
type CandidateObservation struct {
Status model.Status `json:"status"`
ExitCode int `json:"exit_code"`
TestsRun int `json:"tests_run"`
TestsFailed int `json:"tests_failed"`
TestsSkipped int `json:"tests_skipped"`
Harness string `json:"harness,omitempty"`
OutputDigest string `json:"output_digest"`
FailedCases []string `json:"failed_cases,omitempty"`
Locations []model.Provenance `json:"locations,omitempty"`
}
CandidateObservation uses the same harness recognition, output bounds, private environment and process timeout policy as plan-declared tests. Raw output is deliberately absent; only source locations and identifier-shaped unittest case names are retained for agent repair guidance.
func ObserveCandidate ¶
func ObserveCandidate(ctx context.Context, dir string, argv []string, timeout time.Duration) (CandidateObservation, error)
ObserveCandidate requires explicit caller authorization and an already isolated candidate. It never consumes preexisting branch evidence.
func ObserveCandidateAt ¶
func ObserveCandidateAt(ctx context.Context, root, cwd string, argv []string, timeout time.Duration) (CandidateObservation, error)
ObserveCandidateAt executes only inside a validated candidate subdirectory.
type CandidateRun ¶
type CandidateRun struct {
Record Record `json:"record"`
Observation CandidateObservation `json:"observation"`
}
func RunCandidate ¶
func RunCandidate(ctx context.Context, root string, c CandidateCheckpoint, p planning.Plan, argv []string, cwd string, timeout time.Duration) (CandidateRun, error)
RunCandidate runs exact reviewed plan declarations exclusively inside an already private candidate. Host dependency links are deliberately unsupported.
type Record ¶
type Record struct {
CWD string `json:"cwd,omitempty"`
Candidate *CandidateBinding `json:"candidate,omitempty"`
SchemaVersion string `json:"schema_version"`
ID string `json:"id"`
Repository string `json:"repository"`
Revision string `json:"revision"`
PlanDigest string `json:"plan_digest"`
Command []string `json:"command"`
Criteria []string `json:"criteria"`
TestsRun int `json:"tests_run"`
TestsFailed int `json:"tests_failed,omitempty"`
TestsSkipped int `json:"tests_skipped,omitempty"`
Harness string `json:"harness,omitempty"`
Env []string `json:"env,omitempty"`
Phase string `json:"phase,omitempty"`
ExitCode int `json:"exit_code"`
Status model.Status `json:"status"`
StartedAt string `json:"started_at"`
FinishedAt string `json:"finished_at"`
OutputDigest string `json:"output_digest"`
IntegrityDigest string `json:"integrity_digest"`
// OutputTail is shown to the operator but never persisted or digested.
OutputTail string `json:"-"`
}
func InvalidateCandidateRecord ¶
InvalidateCandidateRecord revokes eligibility after a later suite command mutates the shared source state. Its checksum remains inspectable metadata.
type SourceState ¶
func InspectCandidateSource ¶
func InspectCandidateSource(ctx context.Context, root string, c CandidateCheckpoint, artifacts []string) (SourceState, error)
InspectCandidateSource compares every tracked byte against immutable objects and walks untracked inputs without truncated Git listings. Generated/cache directories and explicitly declared fresh JUnit artifacts are excluded only from NEW input detection; tracked files are always checked, including caches.
Source Files