From 02b472b627ab5ae032cf9f0e76c404638d28e660 Mon Sep 17 00:00:00 2001
From: Mikhail <misha_mst@mail.ru>
Date: Sat, 22 Aug 2026 12:01:16 +0300
Subject: [PATCH] Add agent artifact attestation

---
 contracts/artifact/types.go                   | 19 +++++++++++++++
 dev/ACTIVE_TASK.json                          |  4 ++--
 ...DEV-000118-agent-artifact-attestation.json | 23 +++++++++++++++++++
 tests/agent_execution/attestation_test.go     | 18 +++++++++++++++
 4 files changed, 62 insertions(+), 2 deletions(-)
 create mode 100644 dev/tasks/DEV-000118-agent-artifact-attestation.json
 create mode 100644 tests/agent_execution/attestation_test.go

diff --git a/contracts/artifact/types.go b/contracts/artifact/types.go
index a70b06c..825216f 100644
--- a/contracts/artifact/types.go
+++ b/contracts/artifact/types.go
@@ -2,4 +2,23 @@ package artifact
 
 import "git.cin.su/m/Assistant/platform/ids"
 
+import "errors"
+
 type ArtifactID ids.ID
+
+type AgentArtifactAttestation struct {
+	ArtifactID          ArtifactID
+	ProducerRunID       string
+	SourceRevision      string
+	WorktreeID          string
+	ContentDigest       string
+	TestEvidenceRef     string
+	CreatedAtUnixMillis int64
+}
+
+func (a AgentArtifactAttestation) Validate() error {
+	if a.ArtifactID == "" || a.ProducerRunID == "" || a.SourceRevision == "" || a.WorktreeID == "" || a.ContentDigest == "" || a.TestEvidenceRef == "" || a.CreatedAtUnixMillis < 1 {
+		return errors.New("agent artifact attestation is incomplete")
+	}
+	return nil
+}
diff --git a/dev/ACTIVE_TASK.json b/dev/ACTIVE_TASK.json
index a51ac48..c00a6fa 100644
--- a/dev/ACTIVE_TASK.json
+++ b/dev/ACTIVE_TASK.json
@@ -1,5 +1,5 @@
 {
-  "task_file": "dev/tasks/DEV-000117-agent-callback-envelope.json",
-  "task_id": "DEV-000117",
+  "task_file": "dev/tasks/DEV-000118-agent-artifact-attestation.json",
+  "task_id": "DEV-000118",
   "task_revision": 1
 }
diff --git a/dev/tasks/DEV-000118-agent-artifact-attestation.json b/dev/tasks/DEV-000118-agent-artifact-attestation.json
new file mode 100644
index 0000000..cd26f21
--- /dev/null
+++ b/dev/tasks/DEV-000118-agent-artifact-attestation.json
@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000118",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "a6eb4ab",
+  "risk_tier": "E",
+  "intent": "Add typed artifact attestation for agent-produced evidence with digest, source/worktree, producer run and test provenance.",
+  "requirement_ids": ["WP-301", "Artifact attestation", "Independent evidence refs"],
+  "allowed_change_scope": {"modules": ["artifact-agent-evidence"], "paths": ["contracts/artifact/**", "tests/agent_execution/**", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000118-agent-artifact-attestation.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "database/**", "migrations/**", "deploy/**", "security/**", "cmd/**", "runtime/**", "adapters/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["ADR-0017 Artifact ownership", "ADR-0020 agent evidence attestation", "Existing AgentRun identity"], "may_change": ["Artifact agent attestation contract"]},
+  "semantic_owner": "artifact-agent-evidence",
+  "canonical_state": [],
+  "state_transitions": ["agent output -> attested artifact evidence", "missing provenance -> non-attested result"],
+  "side_effects_and_privileges": ["Pure validation; no filesystem access, merge, deployment, credential access or external mutation"],
+  "persistence_and_migrations": ["No schema or migration changes"],
+  "failure_retry_restart": ["Attestation is immutable; changed digest/source requires a new attestation"],
+  "assumptions": ["Artifact storage computes or verifies digest later", "Producer run and source revision are durable refs", "Verifier remains distinct from producer"],
+  "acceptance_scenarios": ["Complete attestation validates", "Missing digest/source/worktree/test evidence rejects", "Attestation binds to one producer run", "Changed artifact requires a new attestation"],
+  "required_tests": ["go test ./...", "go vet ./...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl/independent", "git diff --check", "artifact attestation tests"],
+  "terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_CONFLICT"]
+}
diff --git a/tests/agent_execution/attestation_test.go b/tests/agent_execution/attestation_test.go
new file mode 100644
index 0000000..f764b85
--- /dev/null
+++ b/tests/agent_execution/attestation_test.go
@@ -0,0 +1,18 @@
+package agent_execution_test
+
+import (
+	"testing"
+
+	"git.cin.su/m/Assistant/contracts/artifact"
+)
+
+func TestAgentArtifactAttestationRequiresProvenance(t *testing.T) {
+	attestation := artifact.AgentArtifactAttestation{ArtifactID: "artifact-1", ProducerRunID: "run-1", SourceRevision: "commit-1", WorktreeID: "worktree-1", ContentDigest: "sha256:artifact", TestEvidenceRef: "tests:1", CreatedAtUnixMillis: 10}
+	if err := attestation.Validate(); err != nil {
+		t.Fatal(err)
+	}
+	attestation.ContentDigest = ""
+	if err := attestation.Validate(); err == nil {
+		t.Fatal("expected missing digest rejection")
+	}
+}