Documentation
¶
Overview ¶
Package launch is the one-command porcelain entry point for AgentProvenance.
agentprov launch -- claude # or codex, or any agent command
It orchestrates the existing plumbing into a single zero-friction run: create a run scope, start the read-only dashboard, inject a per-run hooks overlay into the agent (Claude Code today) without touching the user's settings, start the kernel sensor when the host can (else degrade honestly), exec the agent in a dedicated cgroup, and on exit fold every source into one signed, verifiable evidence graph and print a one-line verdict.
The design principle is honest degradation: the evidence level is two independent axes -- application side (transcript/hooks vs record-only) and system side (kernel telemetry vs none) -- printed up front so the operator always knows what this particular run can and cannot prove.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func PrintPreflight ¶
func PrintPreflight(w io.Writer, r PreflightReport)
PrintPreflight renders the same readiness checks used by `agentprov doctor`. Warn/skip states are not fatal: launch is intentionally degradation-friendly.
Types ¶
type Check ¶
type Check struct {
Name string `json:"name"`
Status CheckStatus `json:"status"`
Detail string `json:"detail"`
Fix string `json:"fix,omitempty"`
}
Check is one launch prerequisite or degradation check.
type CheckStatus ¶
type CheckStatus string
CheckStatus is the operator-facing state of one launch preflight check.
const ( CheckPass CheckStatus = "pass" CheckWarn CheckStatus = "warn" CheckFail CheckStatus = "fail" CheckSkip CheckStatus = "skip" )
type Options ¶
type Options struct {
DataDir string // AgentProvenance data dir (root --data-dir)
Command []string // the agent argv, e.g. ["claude", "-p", "..."]
Workdir string // agent working directory; "" = current dir
Dashboard bool // serve the read-only dashboard and keep it live after exit
DashboardAddr string // dashboard listen address (host:port); falls back to ephemeral if busy
Sensor string // "auto" (Linux + capable) or "off"
SignKeyPath string // optional hex ed25519 private key; when set, the sealed bundle is signed
FileDiff bool // capture the working-tree file diff (off by default; expensive in big repos)
SelfExe string // absolute path to this agentprov binary (for the sensor subprocess + hook commands)
Stdout io.Writer
Stderr io.Writer
}
Options configures a launch run.
type PreflightReport ¶
type PreflightReport struct {
Command []string `json:"command,omitempty"`
SelfExe string `json:"self_exe,omitempty"`
DashboardAddr string `json:"dashboard_addr,omitempty"`
SensorMode string `json:"sensor_mode,omitempty"`
Checks []Check `json:"checks"`
}
PreflightReport is the structured launch readiness report.
func Preflight ¶
func Preflight(opts Options) PreflightReport
Preflight inspects whether launch can observe the requested command before it starts long-lived children. It is intentionally side-effect-light: the only filesystem probe creates and removes a temporary cgroup leaf when Linux cgroup v2 appears writable, matching the operation record will need later.
func (PreflightReport) HasFailures ¶
func (r PreflightReport) HasFailures() bool
type Report ¶
type Report struct {
RunID string `json:"run_id"`
ExitCode int `json:"exit_code"`
Status string `json:"status"`
AppTier string `json:"app_tier"`
AppDetail string `json:"app_detail,omitempty"`
SysTier string `json:"sys_tier"`
SysDegradeReason string `json:"sys_degrade_reason,omitempty"`
Events int `json:"events"`
HighRisk int `json:"high_risk"`
Signals int `json:"signals"`
Verdict string `json:"verdict"`
BundlePath string `json:"bundle_path,omitempty"`
Signed bool `json:"signed"`
AttestationPath string `json:"attestation_path,omitempty"`
DashboardURL string `json:"dashboard_url,omitempty"`
HooksIngested int `json:"hooks_ingested"`
IntentMismatches int `json:"intent_mismatches"`
IntentCoverageGaps int `json:"intent_coverage_gaps"`
TranscriptTurns int `json:"transcript_turns"`
}
Report is the machine-readable outcome of a launch run.
Source Files