Skip to content

feat: add guarded AgentMesh Assay proof-pack replay#47

Draft
Haserjian wants to merge 2 commits into
mainfrom
feat/agentmesh-assay-proof-pack
Draft

feat: add guarded AgentMesh Assay proof-pack replay#47
Haserjian wants to merge 2 commits into
mainfrom
feat/agentmesh-assay-proof-pack

Conversation

@Haserjian
Copy link
Copy Markdown
Owner

Summary

Adds the first AgentMesh -> Assay proof-pack adapter path and hardens the Assay commit hook boundary.

  • replaces raw Assay hook command execution with preset-only structured argv and shell=False
  • emits Guardian-style decision receipts for allowed and denied Assay hook invocations
  • adds an Assay-native AgentMesh proof-pack builder plus replay script packaged into the Assay proof pack
  • adds PR-only CI coverage for AgentMesh proof-pack build, assay verify-pack, and replay
  • adds a CONFTEST-style shell boundary check so shell=True stays confined to developer-local gitbridge.run_tests

Verification

CONFIRMED locally:

  • git diff --cached --check
  • PYTHONPATH=src python3 -m pytest tests/test_shell_boundaries.py tests/test_commit.py tests/test_assay_pack.py -q -> 28 passed
  • PYTHONPATH=src python3 -m pytest -q -> 1 failed, 383 passed, 1 skipped
  • Base-parity check on origin/main for the same failing test confirmed it is pre-existing: tests/test_provenance_export.py::TestAssayCrossValidation::test_no_duplicate_receipt_ids
  • PYTHONPATH=src python3 -m pytest -q -k 'not test_no_duplicate_receipt_ids' -> 383 passed, 1 skipped, 1 deselected

Review Scope

The only full-suite failure observed is confirmed on origin/main and is not introduced by this branch. This PR scope is the Assay hook command boundary, Guardian decision receipt emission, AgentMesh proof-pack assembly, and replay verification.

Claim Boundary

This demonstrates AgentMesh episode replay through Assay proof-pack artifacts and records Guardian decisions for the Assay hook path. It does not claim all AgentMesh tool/process execution paths are policy-confined yet.

AgentMesh-Episode: ep_019deb31f904cc6e4fac2b20
AgentMesh-KeyID: mesh_7476bf5e5df66abc
AgentMesh-Witness: sha256:e0c2326626ad737e62ffd3cf152710ce9c27c5da4729aa454f0454e1842f505b
AgentMesh-Sig: MNSf_FJMDUWOUWJpY3vodv8B7P2DRzCWTkulKzYydr7I4xaZ0CBnlHXyAUziFZEzFDnPW0ZuH5-YvUsWttaCAQ==
AgentMesh-Witness-Encoding: gzip+base64url
AgentMesh-Witness-Chunk-Count: 4
AgentMesh-Witness-Chunk: H4sIAPaT9mkC_0VSy47bMAz8F127CagHRclAL-0e2gJtD02BthdDDyo21omD2Hlhsf9eOYttjyJnhjOknkXY8n5u-ywakcbM1zZMU7i1h5CexIPgQz_V6mufDy1InzlqWTyYlCybEpKKCiq09ANPbRpP-1k0Ur4VujB1lTt1QaFtCloq5HXy
AgentMesh-Witness-Chunk: Thpghz4jR9QYCZ0mhTIDcPFWKlJgo8suSmcBsURLnOqcQ5hTd5dtz3yMYe53__VdQhdD8VJDLMGRRImoioYQDEHCrI1PytVmokjOkCPOjCATa52Y_un3uZ3mEAeu2mgYs9cmWV0oaWmBrJfFIbtkiy9kMSOwr-QpdbwLi7GpH_fLTi_cnuXS
AgentMesh-Witness-Chunk: 6bd7PormWYRhOx77uVtsc1aIcmE-8e11yzuuyciQjQXr3GJtiPfcpzj0qa24CtKb7e_Pj0O8fNGStsdv7XdeXdXHzePPH-GXOX-4fb39-XSl09hd3ouXB1GXxDXP7lC5CpRdAa5AbwAaaRs0ay29IvmuvmG55TyOw1uI6e55-SWLs8qHtV-D
AgentMesh-Witness-Chunk: eHn5C9oGbxY8AgAA
Signed-off-by: Timothy Haserjian <220407938+Haserjian@users.noreply.github.com>
@Haserjian Haserjian force-pushed the feat/agentmesh-assay-proof-pack branch from d1368ad to e8cbd05 Compare May 3, 2026 00:18
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 3, 2026

AgentMesh Lineage Check

Lineage coverage: 1/1 commits (100%)
Witness coverage: 1/1 commits (100%)

Metric Value
Commits in PR 1
With episode trailer 1
Lineage coverage 100%
Unique episodes 1
Files changed 11
Witness trailers present 1
Witness signatures verified 1
Witness coverage 100%
Commit Details
SHA Message Episode
e8cbd05 feat: add guarded AgentMesh Assay proof-pack replay ep_019deb31f904cc6e4fac2b20
Witness Verification Details
SHA Witness Status
e8cbd05 VERIFIED

Checked by agentmesh-action | What is lineage coverage?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant