agentsuite

package module
v0.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 16, 2026 License: MIT Imports: 30 Imported by: 0

README

AgentSuite

AgentSuite is a portable, content-addressed definition of one or more related agents and the exact ToolProviders used to construct their runnable sandboxes. Suites are distributed as OCI artifacts and contain a closed graph of agent, ToolProvider, composition, and build-profile manifests.

This standalone Go module, github.com/agent-primitives/suite, provides:

  • public types for suites, agents, ToolProviders, callable Tools, compositions, build profiles, and optional runtime profiles;
  • media types and specification version constants;
  • strict JSON decoding with closed-field and duplicate-key enforcement;
  • JCS canonical encoding and digest calculation;
  • offline validation of extracted content and OCI image-layout directories;
  • optional agent evaluations with ordered cases;
  • closed JSON Schema 2020-12 documents in schema/.

The normative format and conformance requirements are defined in spec.md. Examples and conformance fixtures live in testdata/.

The documentation site renders the specification, schema downloads, conformance overview and Go usage from main.

Go package

Use Go 1.26.0 or newer. The module path ends in suite, but the Go package remains agentsuite; use an explicit import alias:

import agentsuite "github.com/agent-primitives/suite"

data, err := agentsuite.Marshal(suite)
if err != nil {
    return err
}

digest, err := agentsuite.Digest(data)

Unmarshal should be used for AgentSuite JSON rather than encoding/json directly when strict format enforcement is required.

ValidatePath validates either an extracted AgentSuite content directory or an OCI image-layout directory and returns a conformance report. Consumers that read loose manifests should use ValidateDirectory to validate extracted content explicitly, without OCI layout auto-detection.

The Go validator compiles evaluation regex assertions with regexp, whose accepted expression syntax is RE2. Validation does not execute evaluations, tools, models or agents, and does not attest runtime or sandbox conformance.

Builders, packers, registry transfer, sandbox-image construction, and builder-owned image metadata are implementation concerns and are not part of this package. Kaimahi's builder-owned sandbox-binding schema remains in its source repository.

Development and releases

See CONTRIBUTING.md for verification, cross-repository go.work development and release policy. Releases are root tags (vX.Y.Z) cut by the maintainers.

Repository extraction does not change schema IDs, media types, format versions, canonical bytes or digests. Go module versions and format versions are independent.

Project policies and provenance

Extracted with portable history from kaimahi-agents/kaimahi. Licensed under the MIT License. Copyright (c) Microsoft Corporation. See SECURITY.md for private vulnerability reporting and CODE_OF_CONDUCT.md for the Microsoft community policy.

Documentation

Overview

Package agentsuite defines and validates the draft AgentSuite artifact format.

It contains the portable data model, canonical JSON serialization, schemas, and offline conformance validation. Packing, registry transfer, sandbox construction, and builder-owned image metadata belong to implementations such as kmx.

Index

Constants

View Source 
const (
	DiffAdded               = "added"
	DiffRemoved             = "removed"
	DiffModified            = "modified"
	DiffReportSchemaVersion = "kmx.agentsuite.diff/v1"
)
View Source 
const (
	MediaTypeEvaluationEvidence = "application/vnd.agentsuite.eval.evidence.v1+json"
	EvidenceSchemaVersion       = "1.0.0"
	// EvidencePolicyID names text contains/notContains/RE2 semantics, all-known
	// assertion conjunction and the unknown veto, including non-critical checks.
	EvidencePolicyID      = "agentsuite-text-v1"
	EvidencePolicyVersion = "1.0.0"
	// EvidenceJudgePolicyID requires exactly two independent scores: both at or
	// above minScore pass, both below fail, and a split remains unknown.
	EvidenceJudgePolicyID      = "agentsuite-double-score-v1"
	EvidenceJudgePolicyVersion = "1.0.0"
)
View Source 
const (
	ExecutionHTTPV1       = "http-v1"
	AgentKitMountedConfig = "agentkit-v0-mounted-v1"
)
View Source 
const (
	SpecVersion = "1.0.0-draft"

	LayoutVersion = "1.0.0"

	MediaTypeArtifact                = "application/vnd.agentsuite.suite.v1"
	MediaTypeEmptyConfig             = "application/vnd.oci.empty.v1+json"
	MediaTypeContent                 = "application/vnd.agentsuite.content.v1.tar+gzip"
	MediaTypeSuite                   = "application/vnd.agentsuite.manifest.v1+json"
	MediaTypeAgent                   = "application/vnd.agentsuite.agent.v1+json"
	MediaTypePolicyV1                = "application/vnd.agentsuite.policy.v1+json"
	MediaTypePolicyV2                = "application/vnd.agentsuite.policy.v2+json"
	MediaTypeEvaluationIndex         = "application/vnd.agentsuite.eval.index.v1+json"
	MediaTypeEvaluationCase          = "application/vnd.agentsuite.eval.case.v1+json"
	MediaTypeToolProviderCatalog     = "application/vnd.agentsuite.tool.provider.catalog.v1+json"
	MediaTypeToolProvider            = "application/vnd.agentsuite.tool.provider.v1+json"
	MediaTypeToolProviderComposition = "application/vnd.agentsuite.tool.provider.composition.v1+json"
	MediaTypeComposition             = "application/vnd.agentsuite.composition.v1+json"
	MediaTypeBuildProfile            = "application/vnd.agentsuite.build.profile.v1+json"
	MediaTypeRuntimeProfile          = "application/vnd.agentsuite.runtime.profile.v1+json"
	MediaTypeInstructions            = "text/markdown; charset=utf-8"
	MediaTypeJSONSchema              = "application/schema+json"

	ExecutionSharedSandbox = "shared-sandbox"
)

Variables

This section is empty.

Functions

func DescriptorSizeAndDigestMatch 

func DescriptorSizeAndDigestMatch(data []byte, descriptor Descriptor) bool

DescriptorSizeAndDigestMatch performs the cheap length and raw-byte digest comparison against descriptor, without canonicalizing data at all. It lets a caller reject a size/digest-mismatched document before investing in full JSON parsing (strict decoding, canonicalization, or reflection-based field checks). It does not confirm that data is itself stored in canonical form; callers that parse data after this check still need MatchesCanonicalDescriptor to enforce that invariant.

func Digest 

func Digest(data []byte) (string, error)

Digest returns the SHA-256 digest of the JCS representation of data.

func IsValidDigest 

func IsValidDigest(value string) bool

IsValidDigest reports whether value is a canonical AgentSuite SHA-256 digest.

func Marshal 

func Marshal(value any) ([]byte, error)

Marshal serializes value as JSON Canonicalization Scheme (JCS) JSON.

func MatchesCanonicalDescriptor 

func MatchesCanonicalDescriptor(data []byte, descriptor Descriptor) bool

MatchesCanonicalDescriptor reports whether data is itself stored as its own RFC 8785 JCS canonical bytes, and whether descriptor's digest and size describe that same canonical representation. A descriptor binding canonical identity is satisfied only when the stored bytes are already canonical: differently formatted (for example pretty-printed) but semantically equivalent JSON is rejected, since a consumer must be able to load the referenced bytes directly without re-canonicalizing them first. Callers outside this package (for example builders that re-read pinned child manifests) should use this instead of re-deriving digest/size checks by hand, so every consumer enforces the same stored-byte identity rule.

func Unmarshal 

func Unmarshal(data []byte, out any) error

Unmarshal decodes one strict AgentSuite JSON document.

It rejects duplicate or unknown fields, invalid UTF-8, lossy JCS number representations, trailing values, and documents exceeding the format's declared implementation limits.

func ValidateExecutionContract added in v0.3.0 

func ValidateExecutionContract(c ExecutionContract) error

func ValidateImageReference 

func ValidateImageReference(value string) error

ValidateImageReference requires a registry-qualified, sha256-digested image reference with a valid registry authority.

Types

type AffectedAgent 

type AffectedAgent struct {
	ID      string   `json:"id"`
	Reasons []string `json:"reasons"`
}

type Agent 

type Agent struct {
	SchemaVersion string                    `json:"schemaVersion"`
	MediaType     string                    `json:"mediaType"`
	ID            string                    `json:"id"`
	Description   string                    `json:"description,omitempty"`
	Instructions  FileRef                   `json:"instructions"`
	Model         ModelRequirement          `json:"model"`
	ToolProviders []ToolProviderRequirement `json:"toolProviders,omitempty"`
	Invokes       []AgentInvoke             `json:"invokes,omitempty"`
	Evals         []FileRef                 `json:"evals,omitempty"`
	Policy        *FileRef                  `json:"policy,omitempty"`
	Extensions    []Extension               `json:"extensions,omitempty"`
}

type AgentInvoke 

type AgentInvoke struct {
	Agent         string `json:"agent"`
	MaxConcurrent int    `json:"maxConcurrent,omitempty"`
	MaxDepth      int    `json:"maxDepth,omitempty"`
}

type AgentPlatform 

type AgentPlatform struct {
	ID        string     `json:"id"`
	Platforms []Platform `json:"platforms"`
}

type BrokeredCredential 

type BrokeredCredential struct {
	Resolution string `json:"resolution"`
	BindingRef string `json:"bindingRef"`
}

BrokeredCredential declares that credential resolution and injection for a delegated-user authorization requirement are brokered entirely by the runtime. It never contains a credential value.

type BuildProfile 

type BuildProfile struct {
	Execution     *ExecutionContract `json:"execution,omitempty"`
	SchemaVersion string             `json:"schemaVersion"`
	MediaType     string             `json:"mediaType"`
	ID            string             `json:"id"`
	RuntimeBase   []PlatformImage    `json:"runtimeBase"`
	Harness       []PlatformImage    `json:"harness"`
	SourceEpoch   int64              `json:"sourceEpoch"`
}

func (*BuildProfile) UnmarshalJSON added in v0.3.0 

func (p *BuildProfile) UnmarshalJSON(data []byte) error

UnmarshalJSON rejects a null execution property; a pointer decoder would otherwise treat it as omission without invoking the contract's decoder.

type Composition 

type Composition struct {
	RuntimeProfile string                 `json:"runtimeProfile,omitempty"`
	SchemaVersion  string                 `json:"schemaVersion"`
	MediaType      string                 `json:"mediaType"`
	Agent          string                 `json:"agent"`
	Platform       Platform               `json:"platform"`
	BuildProfile   string                 `json:"buildProfile"`
	ToolProviders  []ResolvedToolProvider `json:"toolProviders"`
}

func (*Composition) UnmarshalJSON added in v0.4.0 

func (c *Composition) UnmarshalJSON(data []byte) error

type CompositionRef 

type CompositionRef struct {
	RuntimeProfile string     `json:"runtimeProfile,omitempty"`
	Agent          string     `json:"agent"`
	Platform       Platform   `json:"platform"`
	Path           string     `json:"path"`
	Descriptor     Descriptor `json:"descriptor"`
}

func (*CompositionRef) UnmarshalJSON added in v0.4.0 

func (c *CompositionRef) UnmarshalJSON(data []byte) error

type CompositionSelection 

type CompositionSelection struct {
	RuntimeProfile string   `json:"runtimeProfile,omitempty"`
	Agent          string   `json:"agent"`
	Platform       Platform `json:"platform"`
	BuildProfile   string   `json:"buildProfile"`
	Digest         string   `json:"digest"`
}

type DelegatedAuthorization 

type DelegatedAuthorization struct {
	Service    string             `json:"service"`
	Scope      string             `json:"scope"`
	Credential BrokeredCredential `json:"credential"`
}

DelegatedAuthorization declares that a Tool requires delegated-user authorization before it may be called. It never contains a credential value, consent state, token lifecycle state, or a deployment-specific Connection identifier; the deployment/runtime resolves the requirement to a verified requester and a live user-owned connection.

type Descriptor 

type Descriptor struct {
	MediaType   string            `json:"mediaType"`
	Digest      string            `json:"digest"`
	Size        int64             `json:"size"`
	Annotations map[string]string `json:"annotations,omitempty"`
}

Descriptor is an OCI-compatible content descriptor: a named, nested property on a suite-local reference that carries the referenced content's media type, digest, and size, plus optional descriptive annotations. Outer selector fields (such as id, version, agent, platform, and path) stay on the enclosing reference; Descriptor only describes the referenced bytes.

func (*Descriptor) UnmarshalJSON 

func (d *Descriptor) UnmarshalJSON(data []byte) error

UnmarshalJSON requires mediaType, digest, and size to be present in the document. A present size of zero is a legitimate empty-content descriptor; an omitted size is rejected. Both would otherwise decode to the same Go zero value, so presence is checked explicitly against the raw fields before the normal typed decode. It also rejects any object key outside the closed descriptor shape, and rejects an explicit JSON null for mediaType, digest, size, or a present annotations key, which would otherwise silently decode to the same Go zero values as legitimate values (notably null size and size: 0 both decode to 0).

type DiffIdentity 

type DiffIdentity struct {
	Suite          string `json:"suite"`
	SourceType     string `json:"sourceType"`
	ContentDigest  string `json:"contentDigest"`
	ArtifactDigest string `json:"artifactDigest,omitempty"`
}

type DiffLimitError 

type DiffLimitError struct {
	Resource string
	Limit    int
}

func (*DiffLimitError) Error 

func (e *DiffLimitError) Error() string

type DiffReport 

type DiffReport struct {
	SchemaVersion  string          `json:"schemaVersion"`
	Before         DiffIdentity    `json:"before"`
	After          DiffIdentity    `json:"after"`
	Summary        DiffSummary     `json:"summary"`
	Changes        []RecordChange  `json:"changes"`
	AffectedAgents []AffectedAgent `json:"affectedAgents"`
}

func DiffPaths 

func DiffPaths(beforePath, afterPath string) (DiffReport, error)

DiffPaths compares two conformant extracted AgentSuites or local OCI layouts.

func (DiffReport) HasChanges 

func (r DiffReport) HasChanges() bool

type DiffSummary 

type DiffSummary struct {
	Added          int `json:"added"`
	Removed        int `json:"removed"`
	Modified       int `json:"modified"`
	FieldsChanged  int `json:"fieldsChanged"`
	AgentsAffected int `json:"agentsAffected"`
}

type EnvironmentName 

type EnvironmentName struct {
	Name     string `json:"name"`
	Required bool   `json:"required,omitempty"`
	Secret   bool   `json:"secret,omitempty"`
	Delivery string `json:"delivery,omitempty"`
}

type EvaluationAssertion 

type EvaluationAssertion struct {
	ID           string `json:"id"`
	Type         string `json:"type"`
	Critical     *bool  `json:"critical,omitempty"`
	Value        string `json:"value,omitempty"`
	Pattern      string `json:"pattern,omitempty"`
	Tool         string `json:"tool,omitempty"`
	Rubric       string `json:"rubric,omitempty"`
	MinScore     *int   `json:"minScore,omitempty"`
	JudgeModel   string `json:"judgeModel,omitempty"`
	JudgeVersion string `json:"judgeVersion,omitempty"`
}

type EvaluationCase 

type EvaluationCase struct {
	SchemaVersion string                `json:"schemaVersion"`
	MediaType     string                `json:"mediaType"`
	ID            string                `json:"id"`
	Input         string                `json:"input"`
	Runs          *int                  `json:"runs,omitempty"`
	MinPasses     *int                  `json:"minPasses,omitempty"`
	Assertions    []EvaluationAssertion `json:"assertions"`
}

type EvaluationEvidence added in v0.2.0 

type EvaluationEvidence struct {
	SchemaVersion string               `json:"schemaVersion"`
	MediaType     string               `json:"mediaType"`
	Subject       EvidenceSubject      `json:"subject"`
	Execution     EvidenceExecution    `json:"execution"`
	Evaluation    EvidenceEvaluation   `json:"evaluation"`
	Evaluator     EvidenceEvaluator    `json:"evaluator"`
	Results       []EvidenceCaseResult `json:"results"`
}

EvaluationEvidence is an unsigned, payload-free claim about one evaluation. Decoding validates the closed wire shape, not execution or a full pass. VerifyEvaluation additionally checks independently supplied expectations and the local OCI artifact. No prompts, answers or arbitrary metadata belong here.

func (*EvaluationEvidence) UnmarshalJSON added in v0.2.0 

func (e *EvaluationEvidence) UnmarshalJSON(data []byte) error

UnmarshalJSON adds required-presence checks to the package's existing strict JSON decoder. This is a fixed evidence shape, not an extensible schema engine.

type EvaluationIndex 

type EvaluationIndex struct {
	SchemaVersion string           `json:"schemaVersion"`
	MediaType     string           `json:"mediaType"`
	Agent         string           `json:"agent"`
	Cases         []FileRef        `json:"cases"`
	Limits        EvaluationLimits `json:"limits"`
}

type EvaluationLimits 

type EvaluationLimits struct {
	MaxCases     int `json:"maxCases"`
	MaxCaseBytes int `json:"maxCaseBytes"`
}

type EvidenceAssertionResult added in v0.2.0 

type EvidenceAssertionResult struct {
	ID      string               `json:"id"`
	Type    string               `json:"type"`
	Outcome string               `json:"outcome"`
	Judge   *EvidenceJudgeResult `json:"judge,omitempty"`
}

type EvidenceCaseRef added in v0.2.0 

type EvidenceCaseRef struct {
	ID         string             `json:"id"`
	Path       string             `json:"path"`
	Descriptor EvidenceDescriptor `json:"descriptor"`
	Runs       int                `json:"runs"`
	MinPasses  int                `json:"minPasses"`
}

type EvidenceCaseResult added in v0.2.0 

type EvidenceCaseResult struct {
	ID      string              `json:"id"`
	Outcome string              `json:"outcome"`
	Runs    []EvidenceRunResult `json:"runs"`
}

type EvidenceDescriptor added in v0.2.0 

type EvidenceDescriptor struct {
	MediaType string `json:"mediaType"`
	Digest    string `json:"digest"`
	Size      int64  `json:"size"`
}

EvidenceDescriptor deliberately excludes OCI annotations and remote locations. The manifest descriptor hashes raw bytes; index/case descriptors use JCS.

type EvidenceEvaluation added in v0.2.0 

type EvidenceEvaluation struct {
	Index EvidenceFileRef   `json:"index"`
	Cases []EvidenceCaseRef `json:"cases"`
}

type EvidenceEvaluator added in v0.2.0 

type EvidenceEvaluator struct {
	Identity    EvidenceEvaluatorIdentity `json:"identity"`
	StartedAt   string                    `json:"startedAt"`
	CompletedAt string                    `json:"completedAt"`
}

type EvidenceEvaluatorIdentity added in v0.2.0 

type EvidenceEvaluatorIdentity struct {
	ID      string         `json:"id"`
	Version string         `json:"version"`
	Policy  EvidencePolicy `json:"policy"`
}

type EvidenceExecution added in v0.2.0 

type EvidenceExecution struct {
	Runtime             EvidenceImplementation `json:"runtime"`
	Model               EvidenceModel          `json:"model"`
	Harness             EvidenceImplementation `json:"harness"`
	Renderer            EvidenceImplementation `json:"renderer"`
	Profile             EvidenceImplementation `json:"profile"`
	ConfigurationDigest string                 `json:"configurationDigest"`
}

EvidenceExecution distinguishes runtime/harness implementations, model inference settings and the renderer/execution profile. Configuration digests must hash documented non-secret projections, never credentials or endpoints.

type EvidenceFileRef added in v0.2.0 

type EvidenceFileRef struct {
	Path       string             `json:"path"`
	Descriptor EvidenceDescriptor `json:"descriptor"`
}

type EvidenceImplementation added in v0.2.0 

type EvidenceImplementation struct {
	ID      string `json:"id"`
	Version string `json:"version"`
	Digest  string `json:"digest"`
}

type EvidenceJudgeConfiguration added in v0.2.0 

type EvidenceJudgeConfiguration struct {
	Model   string         `json:"model"`
	Version string         `json:"version"`
	Policy  EvidencePolicy `json:"policy"`
}

EvidenceJudgeConfiguration names authored model/version requirements and an independently accepted judge policy and non-secret configuration projection.

type EvidenceJudgeResult added in v0.2.0 

type EvidenceJudgeResult struct {
	Configuration  EvidenceJudgeConfiguration `json:"configuration"`
	ObservedModels []string                   `json:"observedModels"`
	Scores         []int                      `json:"scores"`
	MinScore       int                        `json:"minScore"`
}

EvidenceJudgeResult keeps authored configuration distinct from declared observed response model identities. Neither identity is attested. Each observed model must exactly equal model or model + "-" + version. Scores and observedModels are either both empty (unavailable) or both length two. Producers must initialize empty slices rather than leave them nil: JSON null is malformed; non-null empty arrays represent an unavailable observation.

type EvidenceModel added in v0.2.0 

type EvidenceModel struct {
	Protocol            string `json:"protocol"`
	ID                  string `json:"id"`
	ConfigurationDigest string `json:"configurationDigest"`
}

type EvidencePlatform added in v0.2.0 

type EvidencePlatform struct {
	OS           string `json:"os"`
	Architecture string `json:"architecture"`
	Variant      string `json:"variant"`
}

type EvidencePolicy added in v0.2.0 

type EvidencePolicy struct {
	ID                  string `json:"id"`
	Version             string `json:"version"`
	ConfigurationDigest string `json:"configurationDigest"`
}

type EvidenceRefusal added in v0.2.0 

type EvidenceRefusal struct{ Code string }

EvidenceRefusal exposes a stable code without untrusted text or wrapped causes. Codes: missing, malformed, unsupported, limit, artifact, subject, coverage, policy, unknown, not-passing.

func (*EvidenceRefusal) Error added in v0.2.0 

func (e *EvidenceRefusal) Error() string

type EvidenceRunResult added in v0.2.0 

type EvidenceRunResult struct {
	Number     int                       `json:"number"`
	Status     string                    `json:"status"`
	Outcome    string                    `json:"outcome"`
	Assertions []EvidenceAssertionResult `json:"assertions"`
}

type EvidenceSubject added in v0.2.0 

type EvidenceSubject struct {
	Manifest           EvidenceDescriptor `json:"manifest"`
	MemberID           string             `json:"memberID"`
	MemberDigest       string             `json:"memberDigest"`
	CompositionDigest  string             `json:"compositionDigest"`
	BuildProfileDigest string             `json:"buildProfileDigest"`
	Platform           EvidencePlatform   `json:"platform"`
}

type ExecutionContract added in v0.3.0 

type ExecutionContract struct {
	Configuration string           `json:"configuration,omitempty"`
	Kind          string           `json:"kind"`
	Protocol      string           `json:"protocol"`
	Port          int              `json:"port"`
	HealthPath    string           `json:"healthPath"`
	Inputs        []ExecutionInput `json:"inputs"`
}

ExecutionContract is an experimental declaration of a built image's interface. The configuration name selects exact semantics, not arbitrary process overrides. It does not select a member runtime or require an image for native execution.

func (ExecutionContract) MarshalJSON added in v0.3.0 

func (c ExecutionContract) MarshalJSON() ([]byte, error)

MarshalJSON encodes nil Inputs as the required empty array without changing c.

func (*ExecutionContract) UnmarshalJSON added in v0.3.0 

func (c *ExecutionContract) UnmarshalJSON(data []byte) error

UnmarshalJSON preserves required-field presence before decoding zero values.

type ExecutionInput added in v0.3.0 

type ExecutionInput struct {
	Name        string `json:"name"`
	Environment string `json:"environment"`
	Secret      bool   `json:"secret"`
}

func (*ExecutionInput) UnmarshalJSON added in v0.3.0 

func (input *ExecutionInput) UnmarshalJSON(data []byte) error

UnmarshalJSON requires an explicit secret classification, including false.

type ExpectedEvaluation added in v0.2.0 

type ExpectedEvaluation struct {
	Subject   EvidenceSubject              `json:"subject"`
	Execution EvidenceExecution            `json:"execution"`
	Evaluator EvidenceEvaluatorIdentity    `json:"evaluator"`
	Judges    []EvidenceJudgeConfiguration `json:"judges"`
}

ExpectedEvaluation must be resolved independently, never copied from claims. All subject/execution/evaluator fields are required; Judges is an explicit allowlist of complete configurations, empty only when no judge is accepted. Evaluation times are deliberately not caller expectations.

type Extension 

type Extension struct {
	Name     string `json:"name"`
	Critical bool   `json:"critical"`
	Digest   string `json:"digest,omitempty"`
}

type FieldChange 

type FieldChange struct {
	Path   string          `json:"path"`
	Before json.RawMessage `json:"before,omitempty"`
	After  json.RawMessage `json:"after,omitempty"`
}

type FileRef 

type FileRef struct {
	Path       string     `json:"path"`
	Descriptor Descriptor `json:"descriptor"`
}

type InferenceRequirements added in v0.3.0 

type InferenceRequirements struct {
	API           string `json:"api"`
	ContextTokens int    `json:"contextTokens"`
	OutputTokens  int    `json:"outputTokens"`
	Streaming     bool   `json:"streaming"`
	ToolCalling   bool   `json:"toolCalling"`
}

InferenceRequirements describes the model API needed by an agent, not a particular model deployment. Token limits refer to total context and output.

func (InferenceRequirements) Match added in v0.3.0 

func (r InferenceRequirements) Match(available InferenceRequirements) error

Match uses explicitly declared connection capabilities. It does not infer token limits from /models or claim that operator declarations are verified.

func (*InferenceRequirements) UnmarshalJSON added in v0.3.0 

func (r *InferenceRequirements) UnmarshalJSON(data []byte) error

UnmarshalJSON requires explicit capability booleans even when they are false.

func (InferenceRequirements) Validate added in v0.3.0 

func (r InferenceRequirements) Validate() error

type InventoryEntry 

type InventoryEntry struct {
	Path       string `json:"path"`
	Type       string `json:"type"`
	Mode       uint32 `json:"mode"`
	UID        int    `json:"uid"`
	GID        int    `json:"gid"`
	Size       int64  `json:"size,omitempty"`
	Digest     string `json:"digest,omitempty"`
	LinkTarget string `json:"linkTarget,omitempty"`
	Component  string `json:"component,omitempty"`
}

type ManifestRef 

type ManifestRef struct {
	ID         string     `json:"id"`
	Version    string     `json:"version,omitempty"`
	Path       string     `json:"path"`
	Descriptor Descriptor `json:"descriptor"`
}

type ModelRequirement 

type ModelRequirement struct {
	Protocol     string                 `json:"protocol"`
	Model        string                 `json:"model,omitempty"`
	Capabilities *InferenceRequirements `json:"capabilities,omitempty"`
	EndpointEnv  string                 `json:"endpointEnv,omitempty"`
	SecretRefs   []string               `json:"secretRefs,omitempty"`
}

func (*ModelRequirement) UnmarshalJSON added in v0.3.0 

func (m *ModelRequirement) UnmarshalJSON(data []byte) error

UnmarshalJSON checks property presence before optional zero values can erase the model schema's exclusive selection and deployment-binding restrictions.

type NetworkAccess 

type NetworkAccess struct {
	Scheme string `json:"scheme"`
	Host   string `json:"host"`
	Port   int    `json:"port"`
}

type Platform 

type Platform struct {
	OS           string `json:"os"`
	Architecture string `json:"architecture"`
	Variant      string `json:"variant,omitempty"`
}

func (Platform) String 

func (p Platform) String() string

type PlatformImage 

type PlatformImage struct {
	Platform Platform   `json:"platform"`
	ImageRef string     `json:"imageRef"`
	Image    Descriptor `json:"image"`
}

type RecordChange 

type RecordChange struct {
	Type         string        `json:"type"`
	Kind         string        `json:"kind"`
	ID           string        `json:"id"`
	BeforeDigest string        `json:"beforeDigest,omitempty"`
	AfterDigest  string        `json:"afterDigest,omitempty"`
	Fields       []FieldChange `json:"fields"`
}

type RemoteHeader 

type RemoteHeader struct {
	Name      string       `json:"name"`
	SecretRef SecretKeyRef `json:"secretRef"`
}

type RemoteNetworkRequirement 

type RemoteNetworkRequirement struct {
	DestinationRef string `json:"destinationRef"`
}

type RemoteTimeouts 

type RemoteTimeouts struct {
	ConnectMilliseconds int `json:"connectMilliseconds"`
	RequestMilliseconds int `json:"requestMilliseconds"`
}

type RemoteToolProvider 

type RemoteToolProvider struct {
	Transport    string                     `json:"transport"`
	EndpointRef  string                     `json:"endpointRef"`
	Headers      []RemoteHeader             `json:"headers,omitempty"`
	Network      []RemoteNetworkRequirement `json:"network"`
	Timeouts     RemoteTimeouts             `json:"timeouts"`
	Cancellation string                     `json:"cancellation"`
	Connection   string                     `json:"connection"`
}

type Report 

type Report struct {
	Name                     string                 `json:"name"`
	Agents                   int                    `json:"agents"`
	ToolProviders            int                    `json:"toolProviders"`
	ToolProviderCompositions int                    `json:"toolProviderCompositions"`
	Compositions             int                    `json:"compositions"`
	Capabilities             []string               `json:"capabilities"`
	AgentPlatforms           []AgentPlatform        `json:"agentPlatforms"`
	CompositionSelections    []CompositionSelection `json:"compositionSelections"`
}

func ValidateDirectory 

func ValidateDirectory(root string) (*Report, error)

ValidateDirectory validates extracted AgentSuite content without OCI layout auto-detection. Consumers of loose manifests must validate this same view.

func ValidatePath 

func ValidatePath(value string) (*Report, error)

ValidatePath validates either an extracted AgentSuite content directory or an OCI image-layout directory containing one AgentSuite artifact.

type ResolvedToolProvider 

type ResolvedToolProvider struct {
	ID             string `json:"id"`
	Version        string `json:"version"`
	ManifestDigest string `json:"manifestDigest"`
	VariantDigest  string `json:"variantDigest,omitempty"`
	ExecutionMode  string `json:"executionMode"`
}

type RuntimeProfile added in v0.4.0 

type RuntimeProfile struct {
	SchemaVersion    string                 `json:"schemaVersion"`
	MediaType        string                 `json:"mediaType"`
	ID               string                 `json:"id"`
	Runtime          EvidenceImplementation `json:"runtime"`
	Harness          EvidenceImplementation `json:"harness"`
	Renderer         EvidenceImplementation `json:"renderer"`
	ConfigurationABI string                 `json:"configurationABI"`
	ImageRequired    bool                   `json:"imageRequired"`
}

RuntimeProfile pins execution requirements without overriding member content. ConfigurationABI is an opaque consumer-owned identifier, not a portable implementation catalog. Validation declares consistency, not runtime support.

func (*RuntimeProfile) UnmarshalJSON added in v0.4.0 

func (p *RuntimeProfile) UnmarshalJSON(data []byte) error

type RuntimeRequirement 

type RuntimeRequirement struct {
	ABI           string   `json:"abi"`
	ABIVersion    string   `json:"abiVersion,omitempty"`
	CPUBaseline   string   `json:"cpuBaseline"`
	RequiredPaths []string `json:"requiredBasePaths,omitempty"`
}

type SecretKeyRef 

type SecretKeyRef struct {
	Name string `json:"name"`
	Key  string `json:"key"`
}

type Suite 

type Suite struct {
	SchemaVersion            string                       `json:"schemaVersion"`
	MediaType                string                       `json:"mediaType"`
	Name                     string                       `json:"name"`
	Agents                   []ManifestRef                `json:"agents"`
	ToolProviderCatalog      ManifestRef                  `json:"toolProviderCatalog"`
	ToolProviderCompositions []ToolProviderCompositionRef `json:"toolProviderCompositions,omitempty"`
	Compositions             []CompositionRef             `json:"compositions"`
	BuildProfiles            []ManifestRef                `json:"buildProfiles"`
	RuntimeProfiles          []ManifestRef                `json:"runtimeProfiles,omitempty"`
	Capabilities             []string                     `json:"capabilities,omitempty"`
	Extensions               []Extension                  `json:"extensions,omitempty"`
}

func (*Suite) UnmarshalJSON added in v0.4.0 

func (s *Suite) UnmarshalJSON(data []byte) error

type Tool 

type Tool struct {
	Name                   string                  `json:"name"`
	Description            string                  `json:"description,omitempty"`
	InputSchema            FileRef                 `json:"inputSchema"`
	OutputSchema           *FileRef                `json:"outputSchema,omitempty"`
	Effects                []string                `json:"effects,omitempty"`
	Effect                 string                  `json:"effect,omitempty"`
	Approval               string                  `json:"approval,omitempty"`
	DelegatedAuthorization *DelegatedAuthorization `json:"delegatedAuthorization,omitempty"`
}

Tool is one model-callable function exposed by a ToolProvider.

type ToolProvider 

type ToolProvider struct {
	SchemaVersion string                `json:"schemaVersion"`
	MediaType     string                `json:"mediaType"`
	ID            string                `json:"id"`
	Version       string                `json:"version"`
	Retained      *bool                 `json:"retained,omitempty"`
	Protocol      string                `json:"protocol"`
	Revision      string                `json:"revision"`
	Tools         []Tool                `json:"tools"`
	Variants      []ToolProviderVariant `json:"variants,omitempty"`
	Remote        *RemoteToolProvider   `json:"remote,omitempty"`
	Extensions    []Extension           `json:"extensions,omitempty"`
}

ToolProvider is a versioned contract and its bundled or remote implementations. The abstraction is protocol-neutral; the declared protocol contributes to identity.

type ToolProviderCatalog 

type ToolProviderCatalog struct {
	SchemaVersion string        `json:"schemaVersion"`
	MediaType     string        `json:"mediaType"`
	ToolProviders []ManifestRef `json:"toolProviders"`
}

type ToolProviderComposition 

type ToolProviderComposition struct {
	SchemaVersion  string   `json:"schemaVersion"`
	MediaType      string   `json:"mediaType"`
	ID             string   `json:"id"`
	Version        string   `json:"version"`
	ManifestDigest string   `json:"manifestDigest"`
	Platform       Platform `json:"platform"`
	VariantDigest  string   `json:"variantDigest"`
	BuildProfile   string   `json:"buildProfile"`
}

type ToolProviderCompositionRef 

type ToolProviderCompositionRef struct {
	ID         string     `json:"id"`
	Version    string     `json:"version"`
	Platform   Platform   `json:"platform"`
	Path       string     `json:"path"`
	Descriptor Descriptor `json:"descriptor"`
}

type ToolProviderDependency 

type ToolProviderDependency struct {
	ID            string `json:"id"`
	Version       string `json:"version"`
	VariantDigest string `json:"variantDigest"`
}

type ToolProviderRequirement 

type ToolProviderRequirement struct {
	ID            string `json:"id"`
	Version       string `json:"version"`
	ExecutionMode string `json:"executionMode"`
}

type ToolProviderVariant 

type ToolProviderVariant struct {
	Platform      Platform                 `json:"platform"`
	VariantDigest string                   `json:"variantDigest"`
	InstallRoot   string                   `json:"installRoot"`
	Relocatable   bool                     `json:"relocatable,omitempty"`
	PayloadRoot   string                   `json:"payloadRoot"`
	Entrypoint    string                   `json:"entrypoint"`
	Arguments     []string                 `json:"arguments,omitempty"`
	SearchPath    []string                 `json:"searchPath,omitempty"`
	Environment   []EnvironmentName        `json:"environment,omitempty"`
	WritablePaths []string                 `json:"writablePaths,omitempty"`
	Network       []NetworkAccess          `json:"network,omitempty"`
	Runtime       RuntimeRequirement       `json:"runtime"`
	Files         []InventoryEntry         `json:"files"`
	Dependencies  []ToolProviderDependency `json:"dependencies,omitempty"`
	SBOM          *Descriptor              `json:"sbom,omitempty"`
	Provenance    *Descriptor              `json:"provenance,omitempty"`
}

type VerifiedEvaluation added in v0.2.0 

type VerifiedEvaluation struct {
	Subject     EvidenceSubject `json:"subject"`
	Cases       int             `json:"cases"`
	Runs        int             `json:"runs"`
	CompletedAt string          `json:"completedAt"`
	Unsigned    bool            `json:"unsigned"`
}

VerifiedEvaluation summarizes consistency, not authenticity, truth, freshness or deployment readiness. It contains no raw unverified evidence inputs.

func VerifyEvaluation added in v0.2.0 

func VerifyEvaluation(layoutPath string, expected ExpectedEvaluation, evidenceReader io.Reader) (*VerifiedEvaluation, error)

VerifyEvaluation checks one unsigned evidence document against independently resolved expectations and a genuine local OCI layout. It performs no network access or execution. A successful result proves only internal consistency of claims: it does not authenticate the evaluator, observations, or clock. Reader, path, JSON and authored-content errors are never included in refusals.

Source Files

View all Source files

Directories

Path Synopsis
internal
jsoncodec

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.