feat: add verifiable execution passports

.github/workflows/ci.yml

@@ -39,7 +39,13 @@ jobs:
           node-version: ${{ matrix.node }}
           cache: npm
       - run: npm ci
-      - run: npm run check
+      - name: Run quality and publishable-history audit
+        run: npm run check
+        env:
+          # pull_request checks run on a synthetic GitHub merge commit. Audit the
+          # real publishable head history while all build/test steps still run
+          # against the synthetic merge result.
+          AGENTIC_STRATA_AUDIT_HISTORY_REF: ${{ github.event.pull_request.head.sha || '' }}
       - run: npm run demo
       - run: node dist/cli.js validate examples/application.manifest.yaml
       - run: node dist/cli.js conformance examples/generic-change/run.bundle.json --profile enterprise

README.md

@@ -37,7 +37,8 @@ Logical strata may share one process. The rule is a dependency and responsibilit
 - A composite cache fingerprint that requires both semantic and operational equivalence: policy, capability set, authoritative context, tenant, privacy, constraints, and outcome are all bound.
 - An RFC 8785 JSON Canonicalization Scheme implementation with cross-language golden vectors, strict duplicate-member rejection at the JSON boundary, and a hash-linked receipt chain with tamper and missing-evidence detection.
 - Runtime conformance checks for rooted authority, causal evidence, actual budget consumption, exact-action idempotency, approval, read-back or compensation, predeclared criterion evidence bindings, layer direction, and model/authority separation.
-- Mapping-only adapter documents for AG-UI, A2A, MCP, OpenTelemetry GenAI, CloudEvents, and an external policy engine.
+- An [Execution Passport](docs/spec/attestations/execution-passport/v1/README.md) that binds one run bundle, its complete conformance report, and one externally validated OASF record in a strict in-toto Statement without embedding those documents.
+- Mapping-only adapter documents for AG-UI, A2A, MCP, OpenTelemetry GenAI, CloudEvents, an external policy engine, OASF, and content-free execution-placement evidence.
 - A neutral prepare/commit/read-back demo with exact-action approval and duplicate suppression.
 
 ## Quick start
@@ -60,6 +61,19 @@ node dist/cli.js replay examples/generic-change/run.bundle.json
 node dist/cli.js explain examples/generic-change/run.bundle.json --profile enterprise
 ```
 
+After producing a report, bind it to a real OASF record that has been validated by its owning ecosystem:
+
+```bash
+node dist/cli.js passport .tmp/demo/run.bundle.json \
+  --report .tmp/demo/conformance-report.json \
+  --oasf-record /path/to/validated-oasf-record.json \
+  --oasf-media-type "$OASF_MEDIA_TYPE" \
+  --output .tmp/demo/execution-passport.json
+node dist/cli.js validate .tmp/demo/execution-passport.json
+```
+
+The output file contains exact RFC 8785 Statement bytes suitable for an external DSSE/Sigstore adapter. Repeat `--execution-evidence` only with strict `ExecutionEvidenceBinding` documents containing descriptors and digests, never provider output.
+
 All commands accept JSON; `validate` and `lint` also accept YAML. Build once with `npm run build` before invoking the repository-local CLI. Input documents are bounded to 16 MiB, JSON member names must be unique, and YAML alias expansion is limited.
 
 ## Profiles
@@ -85,6 +99,7 @@ This makes it complementary to:
 - [MCP](https://modelcontextprotocol.io/specification/2025-11-25) for tools and context;
 - [OpenTelemetry GenAI](https://github.com/open-telemetry/semantic-conventions-genai) for operational telemetry;
 - [CloudEvents](https://github.com/cloudevents/spec) for event interchange;
+- [in-toto Statement v1](https://github.com/in-toto/attestation/tree/main/spec/v1) for the Execution Passport envelope;
 - [Open Agent Spec](https://github.com/oracle/agent-spec) and [OSSA](https://openstandardagents.org/specification/) for portable pre-runtime definitions.
 
 Pattern and source-layout scanners can discover whether a project appears to use architectural conventions. AgenticStrata instead evaluates a declared manifest together with runtime receipts and artifacts. These are different, compatible jobs.
@@ -98,6 +113,9 @@ Read [Architecture](docs/architecture.md), [Contracts and conformance](docs/cont
 - Prepared actions, observed results, and compensation results use distinct attested evidence roles. Each evidence-required acceptance criterion predeclares the exact capability, action digest, and role it accepts; reusing pre-effect or unrelated evidence fails conformance.
 - Run status and conformance status are separate: a failed run can still have an intact, conformant evidence record, but it is never explained as a completed outcome.
 - Reports bind the evaluator name, package version, semantic revision, selected rule set, and effective profile configuration. The evaluator digest identifies the declared implementation revision; it is not a code signature.
+- An unsigned Execution Passport proves deterministic integrity and cross-artifact binding only. Authenticity requires an externally verified DSSE envelope or equivalent trusted channel, and consumers must make that requirement explicit so removing a signature cannot silently downgrade policy.
+- The OASF subject digest proves which opaque record was bound; it does not prove that the record is semantically valid OASF. Validate it before passport creation with the specification owner’s tooling.
+- Execution-placement evidence enters the predicate only as strict descriptors with no payload or `content` field. Descriptor metadata must come from a trusted producer and be redacted or pseudonymized when sensitive; its optional stable URI may be omitted. Full provider result objects are outside the Passport contract.
 - A safe fingerprint binds the declared canonical intent. It does not prove that an upstream intent normalizer chose the correct meaning.
 - Adapter documents are integration contracts, not bundled protocol SDKs or policy engines.
 - The current release is an alpha contract surface. Version consumers explicitly before production adoption.

adapters/oasf.mapping.yaml

@@ -0,0 +1,12 @@
+contractType: AdapterMapping
+apiVersion: agenticstrata.dev/v1
+mappingId: adapter/oasf
+protocol: oasf
+protocolVersion: externally-validated
+direction: inbound
+contractBindings:
+  - strataContract: ExecutionPassport
+    protocolObject: OASF agent record ResourceDescriptor
+    notes: The external record remains opaque; only its canonical digest, media type, and optional bounded stable HTTPS or URN reference enter the ordered subject tuple.
+lossPolicy: explicit-loss
+extensionPoint: true

adapters/stagefabric.mapping.yaml

@@ -0,0 +1,15 @@
+contractType: AdapterMapping
+apiVersion: agenticstrata.dev/v1
+mappingId: adapter/stagefabric
+protocol: stagefabric
+protocolVersion: configurable
+direction: inbound
+contractBindings:
+  - strataContract: ExecutionEvidenceBinding
+    protocolObject: ExecutionPlacementEvidence ResourceDescriptor
+    notes: Only role, producer, disclosure mode, resource name, canonical digest, media type, and an optional bounded stable HTTPS or URN reference are admitted; metadata must be trusted and redacted or pseudonymized when sensitive.
+  - strataContract: ExecutionPassport
+    protocolObject: predicate executionEvidence entry
+    notes: No payload or content field is admitted; the full provider result remains outside the mapping.
+lossPolicy: explicit-loss
+extensionPoint: true

docs/adr/0004-execution-passport.md

@@ -0,0 +1,28 @@
+# ADR 0004: Execution Passport as a strict external attestation statement
+
+Status: accepted
+
+## Context
+
+A portable run lineage needs to bind the runtime bundle, the assessment actually performed over it, and the external agent record without copying those documents into another proprietary envelope. It must also preserve failed and incomplete state honestly, avoid carrying provider payloads, and allow deployments to add authenticity without coupling the contract core to one signing service.
+
+## Decision
+
+AgenticStrata defines Execution Passport v1 as a strict in-toto Statement. Its predicate URI is the project-controlled, versioned documentation path:
+
+`https://github.com/aantenore/AgenticStrata/tree/main/docs/spec/attestations/execution-passport/v1`
+
+The Statement has exactly three ordered subjects: `RunBundle`, complete `ConformanceReport`, and one opaque OASF record. Each uses a strict `ResourceDescriptor` with no payload or `content` field and at most one bounded stable HTTPS or URN reference. The predicate records run and conformance status separately and accepts optional execution-placement evidence only as descriptor bindings whose metadata remains subject to producer trust and redaction policy.
+
+The core verifies schema, seals, ordered unique check-to-rule binding, derived conformance status, artifact bindings, receipt integrity, run identity, terminal status, report-after-evidence chronology, and issuance ordering before emission. OASF semantic validation remains external. Passport creation follows conformance evaluation and is not itself a conformance prerequisite.
+
+The core emits RFC 8785 canonical Statement bytes but performs no signing. DSSE/Sigstore or another signature mechanism is an external adapter and consumer-policy concern.
+
+## Consequences
+
+- Consumers can reproduce every subject digest without importing a provider SDK.
+- A failed or incomplete run can carry honest lineage without being described as successful.
+- The execution-evidence contract has no payload or `content` field and does not accept a full provider result; descriptor metadata still requires trust, redaction, or pseudonymization.
+- The OASF digest proves which bytes were bound, not that they satisfy OASF semantics.
+- Unsigned Statements provide integrity and binding only. Authenticity, signer policy, transparency, revocation, and trusted time require external verification.
+- Consumers that require authentication must reject bare Statements rather than silently accepting them after signature removal.

docs/architecture.md

@@ -33,6 +33,7 @@ The `lint` command validates the complete set, canonical ordinal, unique declara
 - Runtime payloads are externalized as artifacts and bound by attestations.
 - Decisions expose concise summaries, selected and rejected options, and evidence references; private model reasoning is not a contract.
 - Distributed mode requires node attribution on every receipt.
+- An Execution Passport projects completed, failed, or incomplete run state into a strict in-toto Statement while keeping the run bundle, report, OASF record, and provider evidence out of the Statement body.
 
 ### Lifecycle & Conformance
 
@@ -69,6 +70,18 @@ sequenceDiagram
     Control-->>User: outcome + explanation + conformance
 ```
 
+## Execution Passport boundary
+
+Passport creation is a deterministic packaging step after conformance evaluation, not another conformance rule. The builder verifies the bundle and report schemas, report and evaluator seals, the ordered unique check-to-rule binding and derived status, exact bundle and manifest bindings, receipt-chain integrity, run identity, terminal state, report-after-evidence chronology, and issuance ordering. It then emits exactly three ordered subjects:
+
+1. the canonical `RunBundle` digest;
+2. the canonical digest of the complete `ConformanceReport`, including its own `digest` field;
+3. the canonical digest of one opaque, externally validated OASF record.
+
+Optional execution-placement evidence is already reduced by its producer to a `ResourceDescriptor` with no payload or `content` field. AgenticStrata admits only the descriptor, producer identity, fixed role, and `content-free` disclosure marker; descriptor metadata must be trusted and redacted or pseudonymized when sensitive, and its URI may be omitted. It never consumes a provider’s full execution result through this boundary.
+
+The core emits an unsigned Statement. A replaceable external adapter may wrap its exact RFC 8785 bytes in DSSE and use Sigstore or another trust system. Signature verification, signer identity, transparency-log policy, and trusted time remain consumer-owned controls.
+
 ## Safe semantic caching
 
 Two utterances may normalize to the same canonical intent, but a cached answer is admitted only when operational context is also equivalent. The cache key binds:

docs/contracts-and-conformance.md

@@ -11,6 +11,7 @@
 | Capability | `CapabilityContract` | Defines risk, effect, schemas, scopes, and side-effect lifecycle. |
 | Evidence | `DecisionEvidence`, `RuntimeArtifact`, `ArtifactAttestation`, `TraceEvent` | Reconstructs what was selected, applied, observed, and attested. |
 | Assessment | `ConformanceReport` | Records profile checks and evidence-backed pass/fail status. |
+| Attestation exchange | `ExecutionPassport`, `ExecutionEvidenceBinding`, `ResourceDescriptor` | Binds a run, assessment, external agent record, and content-free placement evidence without embedding payloads. |
 | Integration | `AdapterMapping` | Describes protocol projection and explicit information loss. |
 
 All integrity-bearing records use deterministic SHA-256 digests over [RFC 8785 JSON Canonicalization Scheme](https://www.rfc-editor.org/rfc/rfc8785.html) output. AgenticStrata uses the maintained `canonicalize` implementation referenced by the RFC and tests standard key-ordering and number vectors. Inputs must be I-JSON values; the file boundary rejects duplicate JSON member names before the parsed value can enter the contract runtime. Digest verification proves that a record matches its bytes and references; issuer authenticity requires an external signature or trusted append-only store.
@@ -41,6 +42,18 @@ The core profile checks:
 
 Every report binds the run bundle, selected rule list, effective merged profile configuration, and evaluator identity by digest. Evaluator identity contains the package version plus an explicitly versioned conformance revision. This makes the assessment reproducible, prevents a custom profile from silently downgrading a built-in name, and exposes which evaluator semantics produced the result. The evaluator digest binds declared release metadata; authenticity and executable-byte attestation remain deployment concerns.
 
+## Execution Passport invariants
+
+The [v1 specification](spec/attestations/execution-passport/v1/README.md) is an in-toto Statement with one project-owned predicate URI. Its subject tuple has fixed order and length: run bundle, complete conformance report, external OASF record. Each subject is a strict `ResourceDescriptor` containing only a name, one SHA-256 digest, a media type, and an optional bounded stable HTTPS or URN reference. The report subject uses `digestValue(report)`, not `report.digest`: the former binds the complete serialized report, while the latter seals the report content before its own digest field is added.
+
+The predicate records `runStatus` and `conformanceStatus` separately. Creation does not require either status to be successful, so an incomplete or failed run can be bound honestly. It does require unambiguous run identity, a valid receipt chain, a sealed report and evaluator identity, ordered unique check identifiers bound by `rulesDigest`, status derived from those checks, matching bundle and manifest digests, report/receipt status agreement, report generation no earlier than any included observed evidence, and issuance no earlier than report generation.
+
+OASF input is accepted only as an opaque I-JSON object and canonicalized for its subject digest. AgenticStrata deliberately does not carry an OASF schema and therefore does not claim semantic validity. A caller must validate the record externally and provide the owner-declared media type.
+
+`executionEvidence` accepts only strict bindings with no payload or `content` field. The producer computes and publishes the evidence artifact digest; AgenticStrata carries its descriptor but never receives the full provider result through the CLI. Descriptor metadata must be trusted and redacted or pseudonymized when sensitive, and the URI may be omitted.
+
+The Passport is created after assessment and is not required by a conformance rule. Making it a prerequisite of the report it contains would create a circular dependency.
+
 ## Evidence, not file detection
 
 A conformance run consumes a `RunBundle`. It does not infer architecture from directory names, imports, or keywords. This avoids declaring success simply because a project contains a policy file or telemetry package. Conversely, a source scanner remains useful before runtime evidence exists; its result should be treated as a discovery signal rather than runtime proof.

docs/interoperability.md

@@ -10,9 +10,23 @@ AgenticStrata owns application-level runtime invariants. It deliberately leaves
 | OpenTelemetry GenAI | Spans, decision summaries, conformance status | Private reasoning and sensitive payloads stay out of telemetry. |
 | CloudEvents | Receipt and artifact references | Correlation, tenant, privacy, and digest bindings survive transport. |
 | Policy engine | Grant, approval, attenuation query | The external enforcement point remains authoritative. |
+| OASF | Opaque agent-record subject descriptor | AgenticStrata binds canonical bytes but delegates semantic validation and media-type ownership. |
+| in-toto / DSSE | Execution Passport Statement and optional external envelope | The core owns deterministic binding; signing, identity, transparency, and trusted time stay outside it. |
+| Execution-placement provider | Content-free evidence descriptor | No payload or `content` field is admitted; descriptor metadata remains subject to producer trust, redaction, and pseudonymization policy. |
 
 Adapter YAML files are declarative mappings with an explicit `lossPolicy`. They contain no vendor SDK and can be replaced without changing the core contract registry.
 
+## Attestation exchange
+
+The Execution Passport uses the project-controlled predicate namespace documented at [`docs/spec/attestations/execution-passport/v1`](spec/attestations/execution-passport/v1/README.md). The core writes exact RFC 8785 Statement bytes. A deployment may pass those bytes to an external DSSE/Sigstore adapter using payload type `application/vnd.in-toto+json`; no signing key, certificate flow, or Sigstore dependency enters AgenticStrata.
+
+Consumers choose one of two explicit policies:
+
+- **unsigned allowed**: verify schema, canonical digests, report binding, and local transport trust; this establishes integrity and association, not signer authenticity;
+- **authenticated required**: reject a bare Statement and require successful external envelope, signer-identity, and trust-material verification.
+
+There is no implicit fallback from the second policy to the first. This prevents signature removal from becoming a silent trust downgrade.
+
 ## Agent and flow specifications
 
 Portable agent specifications answer questions such as “what is this agent, which tools may it request, and how is a flow assembled?” AgenticStrata answers “what did this application run actually request, authorize, change, verify, and prove?”