artifact

package
v0.7.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 21, 2026 License: MIT Imports: 27 Imported by: 0

Documentation

Overview

Package artifact implements shared AgentSuite content loading, graph validation, evidence verification, semantic diff and experimental flow checks. These coupled algorithms retain private validated state behind public facades.

Index

Constants

View Source 
const (
	DiffAdded               = "added"
	DiffRemoved             = "removed"
	DiffModified            = "modified"
	DiffReportSchemaVersion = "kmx.agentsuite.diff/v1"
)
View Source 
const (
	MediaTypeEvaluationEvidence = "application/vnd.agentsuite.eval.evidence.v1+json"
	EvidenceSchemaVersion       = "1.0.0"
	// EvidencePolicyID names text contains/notContains/RE2 semantics, all-known
	// assertion conjunction and the unknown veto, including non-critical checks.
	EvidencePolicyID      = "agentsuite-text-v1"
	EvidencePolicyVersion = "1.0.0"
	// EvidenceJudgePolicyID requires exactly two independent scores: both at or
	// above minScore pass, both below fail, and a split remains unknown.
	EvidenceJudgePolicyID      = "agentsuite-double-score-v1"
	EvidenceJudgePolicyVersion = "1.0.0"
)
View Source 
const (
	FlowVersionV1Alpha1   = "kmx.flow/v1alpha1"
	FlowExtensionV1Alpha1 = "kmx.flow.v1alpha1"
	FlowPathV1Alpha1      = "coordination/flow.json"
)
View Source 
const (
	// Deprecated: use core.ExecutionSharedSandbox.
	ExecutionSharedSandbox = core.ExecutionSharedSandbox
	// Deprecated: use core.LayoutVersion.
	LayoutVersion = core.LayoutVersion
	// Deprecated: use core.MediaTypeAgent.
	MediaTypeAgent = core.MediaTypeAgent
	// Deprecated: use core.MediaTypeArtifact.
	MediaTypeArtifact = core.MediaTypeArtifact
	// Deprecated: use core.MediaTypeBuildProfile.
	MediaTypeBuildProfile = core.MediaTypeBuildProfile
	// Deprecated: use core.MediaTypeComposition.
	MediaTypeComposition = core.MediaTypeComposition
	// Deprecated: use core.MediaTypeContent.
	MediaTypeContent = core.MediaTypeContent
	// Deprecated: use core.MediaTypeEmptyConfig.
	MediaTypeEmptyConfig = core.MediaTypeEmptyConfig
	// Deprecated: use core.MediaTypeEvaluationCase.
	MediaTypeEvaluationCase = core.MediaTypeEvaluationCase
	// Deprecated: use core.MediaTypeEvaluationIndex.
	MediaTypeEvaluationIndex = core.MediaTypeEvaluationIndex
	// Deprecated: use core.MediaTypeInstructions.
	MediaTypeInstructions = core.MediaTypeInstructions
	// Deprecated: use core.MediaTypeJSONSchema.
	MediaTypeJSONSchema = core.MediaTypeJSONSchema
	// Deprecated: use core.MediaTypePolicyV1.
	MediaTypePolicyV1 = core.MediaTypePolicyV1
	// Deprecated: use core.MediaTypePolicyV2.
	MediaTypePolicyV2 = core.MediaTypePolicyV2
	// Deprecated: use core.MediaTypeRuntimeProfile.
	MediaTypeRuntimeProfile = core.MediaTypeRuntimeProfile
	// Deprecated: use core.MediaTypeSuite.
	MediaTypeSuite = core.MediaTypeSuite
	// Deprecated: use core.MediaTypeToolProvider.
	MediaTypeToolProvider = core.MediaTypeToolProvider
	// Deprecated: use core.MediaTypeToolProviderCatalog.
	MediaTypeToolProviderCatalog = core.MediaTypeToolProviderCatalog
	// Deprecated: use core.MediaTypeToolProviderComposition.
	MediaTypeToolProviderComposition = core.MediaTypeToolProviderComposition
	// Deprecated: use core.SpecVersion.
	SpecVersion = core.SpecVersion
)
View Source 
const AgentKitMountedConfig = core.AgentKitMountedConfig

Deprecated: use core.AgentKitMountedConfig.

View Source 
const ExecutionHTTPV1 = core.ExecutionHTTPV1

Deprecated: use core.ExecutionHTTPV1.

Variables

This section is empty.

Functions

func DescriptorSizeAndDigestMatch deprecated 

func DescriptorSizeAndDigestMatch(data []byte, descriptor Descriptor) bool

DescriptorSizeAndDigestMatch performs the cheap length and raw-byte digest comparison against descriptor, without canonicalizing data at all. It lets a caller reject a size/digest-mismatched document before investing in full JSON parsing (strict decoding, canonicalization, or reflection-based field checks). It does not confirm that data is itself stored in canonical form; callers that parse data after this check still need MatchesCanonicalDescriptor to enforce that invariant.

Deprecated: use core.DescriptorSizeAndDigestMatch.

func Digest deprecated 

func Digest(data []byte) (string, error)

Digest returns the SHA-256 digest of the JCS representation of data.

Deprecated: use core.Digest.

func IsValidDigest deprecated 

func IsValidDigest(value string) bool

IsValidDigest reports whether value is a canonical AgentSuite SHA-256 digest.

Deprecated: use core.IsValidDigest.

func Marshal deprecated 

func Marshal(value any) ([]byte, error)

Marshal serializes value as JSON Canonicalization Scheme (JCS) JSON.

Deprecated: use core.Marshal.

func MatchesCanonicalDescriptor deprecated 

func MatchesCanonicalDescriptor(data []byte, descriptor Descriptor) bool

MatchesCanonicalDescriptor reports whether data is itself stored as its own RFC 8785 JCS canonical bytes, and whether descriptor's digest and size describe that same canonical representation. A descriptor binding canonical identity is satisfied only when the stored bytes are already canonical: differently formatted (for example pretty-printed) but semantically equivalent JSON is rejected, since a consumer must be able to load the referenced bytes directly without re-canonicalizing them first. Callers outside this package (for example builders that re-read pinned child manifests) should use this instead of re-deriving digest/size checks by hand, so every consumer enforces the same stored-byte identity rule.

Deprecated: use core.MatchesCanonicalDescriptor.

func Unmarshal deprecated 

func Unmarshal(data []byte, out any) error

Unmarshal decodes one strict AgentSuite JSON document.

It rejects duplicate or unknown fields, invalid UTF-8, lossy JCS number representations, trailing values, and documents exceeding the format's declared implementation limits.

Deprecated: use core.Unmarshal.

func ValidateExecutionContract deprecated 

func ValidateExecutionContract(c ExecutionContract) error

ValidateExecutionContract checks a portable execution declaration.

Deprecated: use core.ValidateExecutionContract.

func ValidateImageReference deprecated 

func ValidateImageReference(value string) error

ValidateImageReference checks a registry-qualified, sha256-digested image reference.

Deprecated: use core.ValidateImageReference.

Types

type AffectedAgent 

type AffectedAgent struct {
	ID      string   `json:"id"`
	Reasons []string `json:"reasons"`
}

type Agent deprecated 

type Agent = core.Agent

Agent is the portable core definition.

Deprecated: use core.Agent.

type AgentInvoke deprecated 

type AgentInvoke = core.AgentInvoke

AgentInvoke is the portable core definition.

Deprecated: use core.AgentInvoke.

type AgentPlatform deprecated 

type AgentPlatform = core.AgentPlatform

AgentPlatform is the portable core definition.

Deprecated: use core.AgentPlatform.

type BrokeredCredential deprecated 

type BrokeredCredential = core.BrokeredCredential

BrokeredCredential is the portable core definition.

Deprecated: use core.BrokeredCredential.

type BuildProfile deprecated 

type BuildProfile = core.BuildProfile

BuildProfile is the portable core definition.

Deprecated: use core.BuildProfile.

type Composition deprecated 

type Composition = core.Composition

Composition is the portable core definition.

Deprecated: use core.Composition.

type CompositionRef deprecated 

type CompositionRef = core.CompositionRef

CompositionRef is the portable core definition.

Deprecated: use core.CompositionRef.

type CompositionSelection deprecated 

type CompositionSelection = core.CompositionSelection

CompositionSelection is the portable core definition.

Deprecated: use core.CompositionSelection.

type DelegatedAuthorization deprecated 

type DelegatedAuthorization = core.DelegatedAuthorization

DelegatedAuthorization is the portable core definition.

Deprecated: use core.DelegatedAuthorization.

type Descriptor deprecated 

type Descriptor = core.Descriptor

Descriptor is the portable core definition.

Deprecated: use core.Descriptor.

type DiffIdentity 

type DiffIdentity struct {
	Suite          string `json:"suite"`
	SourceType     string `json:"sourceType"`
	ContentDigest  string `json:"contentDigest"`
	ArtifactDigest string `json:"artifactDigest,omitempty"`
}

type DiffLimitError 

type DiffLimitError struct {
	Resource string
	Limit    int
}

func (*DiffLimitError) Error 

func (e *DiffLimitError) Error() string

type DiffReport 

type DiffReport struct {
	SchemaVersion  string          `json:"schemaVersion"`
	Before         DiffIdentity    `json:"before"`
	After          DiffIdentity    `json:"after"`
	Summary        DiffSummary     `json:"summary"`
	Changes        []RecordChange  `json:"changes"`
	AffectedAgents []AffectedAgent `json:"affectedAgents"`
}

func DiffPaths 

func DiffPaths(beforePath, afterPath string) (DiffReport, error)

DiffPaths compares two conformant extracted AgentSuites or local OCI layouts.

func (DiffReport) HasChanges 

func (r DiffReport) HasChanges() bool

type DiffSummary 

type DiffSummary struct {
	Added          int `json:"added"`
	Removed        int `json:"removed"`
	Modified       int `json:"modified"`
	FieldsChanged  int `json:"fieldsChanged"`
	AgentsAffected int `json:"agentsAffected"`
}

type EnvironmentName deprecated 

type EnvironmentName = core.EnvironmentName

EnvironmentName is the portable core definition.

Deprecated: use core.EnvironmentName.

type EvaluationAssertion deprecated 

type EvaluationAssertion = core.EvaluationAssertion

EvaluationAssertion is the portable core definition.

Deprecated: use core.EvaluationAssertion.

type EvaluationCase deprecated 

type EvaluationCase = core.EvaluationCase

EvaluationCase is the portable core definition.

Deprecated: use core.EvaluationCase.

type EvaluationEvidence 

type EvaluationEvidence struct {
	SchemaVersion string               `json:"schemaVersion"`
	MediaType     string               `json:"mediaType"`
	Subject       EvidenceSubject      `json:"subject"`
	Execution     EvidenceExecution    `json:"execution"`
	Evaluation    EvidenceEvaluation   `json:"evaluation"`
	Evaluator     EvidenceEvaluator    `json:"evaluator"`
	Results       []EvidenceCaseResult `json:"results"`
}

EvaluationEvidence is an unsigned, payload-free claim about one evaluation. Decoding validates the closed wire shape, not execution or a full pass. VerifyEvaluation additionally checks independently supplied expectations and the local OCI artifact. No prompts, answers or arbitrary metadata belong here.

func (*EvaluationEvidence) UnmarshalJSON 

func (e *EvaluationEvidence) UnmarshalJSON(data []byte) error

UnmarshalJSON adds required-presence checks to the package's existing strict JSON decoder. This is a fixed evidence shape, not an extensible schema engine.

type EvaluationIndex deprecated 

type EvaluationIndex = core.EvaluationIndex

EvaluationIndex is the portable core definition.

Deprecated: use core.EvaluationIndex.

type EvaluationLimits deprecated 

type EvaluationLimits = core.EvaluationLimits

EvaluationLimits is the portable core definition.

Deprecated: use core.EvaluationLimits.

type EvidenceAssertionResult 

type EvidenceAssertionResult struct {
	ID      string               `json:"id"`
	Type    string               `json:"type"`
	Outcome string               `json:"outcome"`
	Judge   *EvidenceJudgeResult `json:"judge,omitempty"`
}

type EvidenceCaseRef 

type EvidenceCaseRef struct {
	ID         string             `json:"id"`
	Path       string             `json:"path"`
	Descriptor EvidenceDescriptor `json:"descriptor"`
	Runs       int                `json:"runs"`
	MinPasses  int                `json:"minPasses"`
}

type EvidenceCaseResult 

type EvidenceCaseResult struct {
	ID      string              `json:"id"`
	Outcome string              `json:"outcome"`
	Runs    []EvidenceRunResult `json:"runs"`
}

type EvidenceDescriptor 

type EvidenceDescriptor struct {
	MediaType string `json:"mediaType"`
	Digest    string `json:"digest"`
	Size      int64  `json:"size"`
}

EvidenceDescriptor deliberately excludes OCI annotations and remote locations. The manifest descriptor hashes raw bytes; index/case descriptors use JCS.

type EvidenceEvaluation 

type EvidenceEvaluation struct {
	Index EvidenceFileRef   `json:"index"`
	Cases []EvidenceCaseRef `json:"cases"`
}

type EvidenceEvaluator 

type EvidenceEvaluator struct {
	Identity    EvidenceEvaluatorIdentity `json:"identity"`
	StartedAt   string                    `json:"startedAt"`
	CompletedAt string                    `json:"completedAt"`
}

type EvidenceEvaluatorIdentity 

type EvidenceEvaluatorIdentity struct {
	ID      string         `json:"id"`
	Version string         `json:"version"`
	Policy  EvidencePolicy `json:"policy"`
}

type EvidenceExecution 

type EvidenceExecution struct {
	Runtime             EvidenceImplementation `json:"runtime"`
	Model               EvidenceModel          `json:"model"`
	Harness             EvidenceImplementation `json:"harness"`
	Renderer            EvidenceImplementation `json:"renderer"`
	Profile             EvidenceImplementation `json:"profile"`
	ConfigurationDigest string                 `json:"configurationDigest"`
}

EvidenceExecution distinguishes runtime/harness implementations, model inference settings and the renderer/execution profile. Configuration digests must hash documented non-secret projections, never credentials or endpoints.

type EvidenceFileRef 

type EvidenceFileRef struct {
	Path       string             `json:"path"`
	Descriptor EvidenceDescriptor `json:"descriptor"`
}

type EvidenceImplementation deprecated 

type EvidenceImplementation = core.EvidenceImplementation

EvidenceImplementation is the portable implementation identity.

Deprecated: use core.EvidenceImplementation.

type EvidenceJudgeConfiguration 

type EvidenceJudgeConfiguration struct {
	Model   string         `json:"model"`
	Version string         `json:"version"`
	Policy  EvidencePolicy `json:"policy"`
}

EvidenceJudgeConfiguration names authored model/version requirements and an independently accepted judge policy and non-secret configuration projection.

type EvidenceJudgeResult 

type EvidenceJudgeResult struct {
	Configuration  EvidenceJudgeConfiguration `json:"configuration"`
	ObservedModels []string                   `json:"observedModels"`
	Scores         []int                      `json:"scores"`
	MinScore       int                        `json:"minScore"`
}

EvidenceJudgeResult keeps authored configuration distinct from declared observed response model identities. Neither identity is attested. Each observed model must exactly equal model or model + "-" + version. Scores and observedModels are either both empty (unavailable) or both length two. Producers must initialize empty slices rather than leave them nil: JSON null is malformed; non-null empty arrays represent an unavailable observation.

type EvidenceModel 

type EvidenceModel struct {
	Protocol            string `json:"protocol"`
	ID                  string `json:"id"`
	ConfigurationDigest string `json:"configurationDigest"`
}

type EvidencePlatform 

type EvidencePlatform struct {
	OS           string `json:"os"`
	Architecture string `json:"architecture"`
	Variant      string `json:"variant"`
}

type EvidencePolicy 

type EvidencePolicy struct {
	ID                  string `json:"id"`
	Version             string `json:"version"`
	ConfigurationDigest string `json:"configurationDigest"`
}

type EvidenceRefusal 

type EvidenceRefusal struct{ Code string }

EvidenceRefusal exposes a stable code without untrusted text or wrapped causes. Codes: missing, malformed, unsupported, limit, artifact, subject, coverage, policy, unknown, not-passing.

func (*EvidenceRefusal) Error 

func (e *EvidenceRefusal) Error() string

type EvidenceRunResult 

type EvidenceRunResult struct {
	Number     int                       `json:"number"`
	Status     string                    `json:"status"`
	Outcome    string                    `json:"outcome"`
	Assertions []EvidenceAssertionResult `json:"assertions"`
}

type EvidenceSubject 

type EvidenceSubject struct {
	Manifest           EvidenceDescriptor `json:"manifest"`
	MemberID           string             `json:"memberID"`
	MemberDigest       string             `json:"memberDigest"`
	CompositionDigest  string             `json:"compositionDigest"`
	BuildProfileDigest string             `json:"buildProfileDigest"`
	Platform           EvidencePlatform   `json:"platform"`
}

type ExecutionContract deprecated 

type ExecutionContract = core.ExecutionContract

ExecutionContract is the portable core definition.

Deprecated: use core.ExecutionContract.

type ExecutionInput deprecated 

type ExecutionInput = core.ExecutionInput

ExecutionInput is the portable core definition.

Deprecated: use core.ExecutionInput.

type ExpectedEvaluation 

type ExpectedEvaluation struct {
	Subject   EvidenceSubject              `json:"subject"`
	Execution EvidenceExecution            `json:"execution"`
	Evaluator EvidenceEvaluatorIdentity    `json:"evaluator"`
	Judges    []EvidenceJudgeConfiguration `json:"judges"`
}

ExpectedEvaluation must be resolved independently, never copied from claims. All subject/execution/evaluator fields are required; Judges is an explicit allowlist of complete configurations, empty only when no judge is accepted. Evaluation times are deliberately not caller expectations.

type Extension deprecated 

type Extension = core.Extension

Extension is the portable core definition.

Deprecated: use core.Extension.

type FieldChange 

type FieldChange struct {
	Path   string          `json:"path"`
	Before json.RawMessage `json:"before,omitempty"`
	After  json.RawMessage `json:"after,omitempty"`
}

type FileRef deprecated 

type FileRef = core.FileRef

FileRef is the portable core definition.

Deprecated: use core.FileRef.

type FlowAssertionV1Alpha1 

type FlowAssertionV1Alpha1 struct {
	Step  string              `json:"step"`
	Check EvaluationAssertion `json:"check"`
}

type FlowCaseV1Alpha1 

type FlowCaseV1Alpha1 struct {
	ID         string                  `json:"id"`
	Input      string                  `json:"input"`
	Runs       *int                    `json:"runs,omitempty"`
	MinPasses  *int                    `json:"minPasses,omitempty"`
	Assertions []FlowAssertionV1Alpha1 `json:"assertions"`
}

type FlowEdgeRequirementV1Alpha1 

type FlowEdgeRequirementV1Alpha1 struct {
	From     string `json:"from"`
	To       string `json:"to"`
	Approval string `json:"approval"`
}

type FlowInputV1Alpha1 

type FlowInputV1Alpha1 struct {
	Source  string `json:"source"`
	Context string `json:"context,omitempty"`
}

type FlowStepV1Alpha1 

type FlowStepV1Alpha1 struct {
	ID       string            `json:"id"`
	Member   string            `json:"member"`
	Input    FlowInputV1Alpha1 `json:"input"`
	Approval string            `json:"approval,omitempty"`
}

type FlowV1Alpha1 

type FlowV1Alpha1 struct {
	SchemaVersion    string                        `json:"schemaVersion"`
	ID               string                        `json:"id"`
	Mode             string                        `json:"mode"`
	Entry            string                        `json:"entry"`
	EdgeRequirements []FlowEdgeRequirementV1Alpha1 `json:"edgeRequirements"`
	Steps            []FlowStepV1Alpha1            `json:"steps"`
	Cases            []FlowCaseV1Alpha1            `json:"cases"`
}

FlowV1Alpha1 is the closed experimental serial-flow payload. It carries no graph validation authority; membership and invokes references need the graph.

type FlowV1Alpha1Graph 

type FlowV1Alpha1Graph struct {
	// contains filtered or unexported fields
}

FlowV1Alpha1Graph is an explicitly selected experimental graph. Validation establishes stored definitions, not execution, approval or a whole-suite pass. Its accessors return caller-owned copies of the verified inventory.

func ValidateDirectoryFlowV1Alpha1 

func ValidateDirectoryFlowV1Alpha1(root string) (*FlowV1Alpha1Graph, error)

ValidateDirectoryFlowV1Alpha1 validates an extracted flow graph without OCI auto-detection, preserving the ordinary directory loader's safety boundary.

func ValidatePathFlowV1Alpha1 

func ValidatePathFlowV1Alpha1(path string) (*FlowV1Alpha1Graph, error)

ValidatePathFlowV1Alpha1 selects only the kmx.flow.v1alpha1 contract on an extracted directory or OCI layout. It never retries the default reader or rewrites the original artifact to remove a required extension.

func (*FlowV1Alpha1Graph) Flow 

func (g *FlowV1Alpha1Graph) Flow() FlowV1Alpha1

Flow returns copied definitions, including pointer-valued run policies.

func (*FlowV1Alpha1Graph) FlowDigest 

func (g *FlowV1Alpha1Graph) FlowDigest() string

FlowDigest is the digest bound by the original suite's critical selector.

func (*FlowV1Alpha1Graph) Report 

func (g *FlowV1Alpha1Graph) Report() Report

Report returns the ordinary core inventory, not runtime readiness.

type InferenceRequirements deprecated 

type InferenceRequirements = core.InferenceRequirements

InferenceRequirements is the portable core definition.

Deprecated: use core.InferenceRequirements.

type InventoryEntry deprecated 

type InventoryEntry = core.InventoryEntry

InventoryEntry is the portable core definition.

Deprecated: use core.InventoryEntry.

type ManifestRef deprecated 

type ManifestRef = core.ManifestRef

ManifestRef is the portable core definition.

Deprecated: use core.ManifestRef.

type ModelRequirement deprecated 

type ModelRequirement = core.ModelRequirement

ModelRequirement is the portable core definition.

Deprecated: use core.ModelRequirement.

type NetworkAccess deprecated 

type NetworkAccess = core.NetworkAccess

NetworkAccess is the portable core definition.

Deprecated: use core.NetworkAccess.

type Platform deprecated 

type Platform = core.Platform

Platform is the portable core definition.

Deprecated: use core.Platform.

type PlatformImage deprecated 

type PlatformImage = core.PlatformImage

PlatformImage is the portable core definition.

Deprecated: use core.PlatformImage.

type RecordChange 

type RecordChange struct {
	Type         string        `json:"type"`
	Kind         string        `json:"kind"`
	ID           string        `json:"id"`
	BeforeDigest string        `json:"beforeDigest,omitempty"`
	AfterDigest  string        `json:"afterDigest,omitempty"`
	Fields       []FieldChange `json:"fields"`
}

type RemoteHeader deprecated 

type RemoteHeader = core.RemoteHeader

RemoteHeader is the portable core definition.

Deprecated: use core.RemoteHeader.

type RemoteNetworkRequirement deprecated 

type RemoteNetworkRequirement = core.RemoteNetworkRequirement

RemoteNetworkRequirement is the portable core definition.

Deprecated: use core.RemoteNetworkRequirement.

type RemoteTimeouts deprecated 

type RemoteTimeouts = core.RemoteTimeouts

RemoteTimeouts is the portable core definition.

Deprecated: use core.RemoteTimeouts.

type RemoteToolProvider deprecated 

type RemoteToolProvider = core.RemoteToolProvider

RemoteToolProvider is the portable core definition.

Deprecated: use core.RemoteToolProvider.

type Report deprecated 

type Report = core.Report

Report is the portable core definition.

Deprecated: use core.Report.

func ValidateDirectory 

func ValidateDirectory(root string) (*Report, error)

ValidateDirectory validates extracted AgentSuite content without OCI layout auto-detection. Consumers of loose manifests must validate this same view.

func ValidatePath 

func ValidatePath(value string) (*Report, error)

ValidatePath validates either an extracted AgentSuite content directory or an OCI image-layout directory containing one AgentSuite artifact.

type ResolvedToolProvider deprecated 

type ResolvedToolProvider = core.ResolvedToolProvider

ResolvedToolProvider is the portable core definition.

Deprecated: use core.ResolvedToolProvider.

type RuntimeProfile deprecated 

type RuntimeProfile = core.RuntimeProfile

RuntimeProfile is the portable core definition.

Deprecated: use core.RuntimeProfile.

type RuntimeRequirement deprecated 

type RuntimeRequirement = core.RuntimeRequirement

RuntimeRequirement is the portable core definition.

Deprecated: use core.RuntimeRequirement.

type SecretKeyRef deprecated 

type SecretKeyRef = core.SecretKeyRef

SecretKeyRef is the portable core definition.

Deprecated: use core.SecretKeyRef.

type Suite deprecated 

type Suite = core.Suite

Suite is the portable core definition.

Deprecated: use core.Suite.

type Tool deprecated 

type Tool = core.Tool

Tool is the portable core definition.

Deprecated: use core.Tool.

type ToolProvider deprecated 

type ToolProvider = core.ToolProvider

ToolProvider is the portable core definition.

Deprecated: use core.ToolProvider.

type ToolProviderCatalog deprecated 

type ToolProviderCatalog = core.ToolProviderCatalog

ToolProviderCatalog is the portable core definition.

Deprecated: use core.ToolProviderCatalog.

type ToolProviderComposition deprecated 

type ToolProviderComposition = core.ToolProviderComposition

ToolProviderComposition is the portable core definition.

Deprecated: use core.ToolProviderComposition.

type ToolProviderCompositionRef deprecated 

type ToolProviderCompositionRef = core.ToolProviderCompositionRef

ToolProviderCompositionRef is the portable core definition.

Deprecated: use core.ToolProviderCompositionRef.

type ToolProviderDependency deprecated 

type ToolProviderDependency = core.ToolProviderDependency

ToolProviderDependency is the portable core definition.

Deprecated: use core.ToolProviderDependency.

type ToolProviderRequirement deprecated 

type ToolProviderRequirement = core.ToolProviderRequirement

ToolProviderRequirement is the portable core definition.

Deprecated: use core.ToolProviderRequirement.

type ToolProviderVariant deprecated 

type ToolProviderVariant = core.ToolProviderVariant

ToolProviderVariant is the portable core definition.

Deprecated: use core.ToolProviderVariant.

type VerifiedEvaluation 

type VerifiedEvaluation struct {
	Subject     EvidenceSubject `json:"subject"`
	Cases       int             `json:"cases"`
	Runs        int             `json:"runs"`
	CompletedAt string          `json:"completedAt"`
	Unsigned    bool            `json:"unsigned"`
}

VerifiedEvaluation summarizes consistency, not authenticity, truth, freshness or deployment readiness. It contains no raw unverified evidence inputs.

func VerifyEvaluation 

func VerifyEvaluation(layoutPath string, expected ExpectedEvaluation, evidenceReader io.Reader) (*VerifiedEvaluation, error)

VerifyEvaluation checks one unsigned evidence document against independently resolved expectations and a genuine local OCI layout. It performs no network access or execution. A successful result proves only internal consistency of claims: it does not authenticate the evaluator, observations, or clock. Reader, path, JSON and authored-content errors are never included in refusals.

func VerifyEvaluationFlowV1Alpha1 

func VerifyEvaluationFlowV1Alpha1(layout string, expected ExpectedEvaluation, evidence io.Reader) (*VerifiedEvaluation, error)

VerifyEvaluationFlowV1Alpha1 checks unchanged evidence-v1 claims for one member against an original OCI artifact under the explicit critical-flow contract. It does not verify whole-flow results, runtime support or approval. Expectations must be independently resolved; destination bindings belong in the caller's non-secret execution-configuration projection. Like the default verifier, it establishes unsigned consistency, never evaluator authenticity.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.