{"format": "ta-amps.seed-pack.verbs.v1", "pack_id": "agent-config-supply-chain-scanner", "status": "proposal_only", "tasks": [
{"queue": "conformance-seed-packs", "kind": "verb.verify_gate", "effect_class": "write-internal", "priority": 50, "idempotency_key": "seedpack:agent-config-supply-chain-scanner:scan-repo-agent-configs:67965eef84ad8fa969acbf6c8c41cec70dfd2055d1ab4b82892410da2414bbae", "depends_on": [], "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:verb.verify_gate", "pack:agent-config-supply-chain-scanner", "template:scan-repo-agent-configs", "claimant:agent", "status:quarantined"], "brief": {"category_id": "verb.verify_gate", "contract": "ta-amps.seed-verb-template.v1", "pack": "agent-config-supply-chain-scanner", "pack_version": "0.1.0", "template_id": "agent-config-supply-chain-scanner.scan-repo-agent-configs", "title": "Inventory and scan repository agent, rule, and MCP files across five vectors", "plain_summary": "Run config_scanner scan on a local checkout to detect hidden Unicode, permission bypasses, lifecycle hooks, unapproved MCP servers, shadowing, and authority spoofing.", "outcome": "A checked supply-chain scan report with clean, review, or block verdict.", "claimant": "agent", "inputs": {"pinned": [{"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.scanner-checks", "version": 1, "value_sha256": "d20873f283e4f8845eff78621f18a7cf966bc3ffbb1701339efc920ecce5a812"}, {"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.guardrail.configs-are-executable-on-clone", "version": 1, "value_sha256": "19544b1ffaef2cfa03e2a6c63e767357c27591d09cd1f71950fc669fa0f3cf13"}, {"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.rules.five-supply-chain-vectors", "version": 1, "value_sha256": "76da0cbe11e64b523050008d09551fad9e776916485b63fb19f06a674c157dd1"}, {"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.tool.config-scanner", "version": 1, "value_sha256": "e459e6e0debb5138089291e1bf390b6cc1777b5f91439b62e8b0ff880d91811c"}], "slots": {"repo_checkout": null}, "params": {"output_store": "seedpack.agent-config-supply-chain-scanner.outputs"}}, "slot_specs": {"repo_checkout": {"category": "noun.public_source", "required": true, "many": false, "description": "Local checkout directory to inspect."}}, "param_specs": {"output_store": {"description": "Store for the produced nouns. The default is a placeholder; use the store your owner assigned.", "schema": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "required": true, "default": "seedpack.agent-config-supply-chain-scanner.outputs"}}, "input_schema": {"type": "object", "additionalProperties": false, "required": ["pinned", "slots", "params"], "properties": {"pinned": {"type": "array", "minItems": 4, "maxItems": 4, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "slots": {"type": "object", "additionalProperties": false, "required": ["repo_checkout"], "properties": {"repo_checkout": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}}, "params": {"type": "object", "additionalProperties": false, "required": ["output_store"], "properties": {"output_store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}}}}}, "output_contract": {"visibility_scope": "surface_only", "allowed_surfaces": [], "write_mode": "create_only", "store_param": "output_store", "key_rule": "agent-config-supply-chain-scanner.<role>.<task_id>[.<n>]", "expected_version": 0, "produces": [{"name": "scan_report", "template": {"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.template.config-scan-report", "version": 1, "value_sha256": "dd82544ea90b4f3373454c4157208ac48f4fc7e9bb9ca4b3d1fd9448bca7ea08"}, "max": 1}], "delivery": "Write produced nouns surface_only under your own authenticated surface, which is the requester's assigned surface, so the requester and that surface's reviewers can read them. Never use public_commons or allowlist other surfaces. Return every produced noun's pin in output.artifacts; add its value when the requester asks for inline delivery."}, "output_schema": {"type": "object", "additionalProperties": false, "required": ["outcome", "summary", "artifacts", "checks", "unknowns"], "properties": {"outcome": {"type": "string", "enum": ["configs_scanned", "no_change", "unknown", "blocked"]}, "summary": {"type": "string", "minLength": 1, "maxLength": 1200}, "artifacts": {"type": "array", "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["role", "ref"], "properties": {"role": {"type": "string", "minLength": 1, "maxLength": 64}, "ref": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "value": {"type": "object"}}}}, "checks": {"type": "array", "maxItems": 64, "items": {"type": "object", "additionalProperties": false, "required": ["id", "result"], "properties": {"id": {"type": "string", "minLength": 1, "maxLength": 80}, "result": {"type": "string", "enum": ["pass", "fail", "not_run"]}, "evidence": {"type": "string", "maxLength": 2000}}}}, "unknowns": {"type": "array", "maxItems": 32, "items": {"type": "object", "additionalProperties": false, "required": ["item", "reason"], "properties": {"item": {"type": "string", "minLength": 1, "maxLength": 300}, "reason": {"type": "string", "minLength": 1, "maxLength": 1000}, "would_resolve": {"type": "string", "maxLength": 1000}}}}, "no_change_reason": {"type": "string", "minLength": 1, "maxLength": 2000}, "blocked_question": {"type": "string", "minLength": 1, "maxLength": 1000}, "proposed_verbs": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["kind", "title", "outcome", "why", "priority"], "properties": {"kind": {"type": "string", "pattern": "^verb\\.[a-z_]+$"}, "template_id": {"type": "string", "minLength": 1, "maxLength": 160}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "outcome": {"type": "string", "minLength": 1, "maxLength": 600}, "why": {"type": "string", "minLength": 1, "maxLength": 600}, "input_pins": {"type": "array", "maxItems": 16, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "priority": {"type": "integer", "minimum": 1, "maximum": 3}}}}, "proposed_nouns": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["category", "role", "title", "why"], "properties": {"category": {"type": "string", "pattern": "^noun\\.[a-z_]+$"}, "role": {"type": "string", "minLength": 1, "maxLength": 64}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "why": {"type": "string", "minLength": 1, "maxLength": 600}}}}, "run_notes": {"type": "object", "additionalProperties": false, "properties": {"went_right": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "went_wrong": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "next_steps": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "ideas": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}}}}}, "permitted_outcomes": ["configs_scanned", "no_change", "unknown", "blocked"], "outcome_meanings": {"configs_scanned": "The declared nouns were produced and every deterministic acceptance check passed.", "no_change": "The evidence does not justify producing or changing anything. Say why.", "unknown": "The question could not be answered with the permitted inputs. List what is missing and what would resolve it.", "blocked": "A required input, permission or capability is missing. Ask one precise question."}, "outcome_requirements": {"configs_scanned": ["artifacts"], "no_change": ["no_change_reason"], "unknown": ["unknowns"], "blocked": ["blocked_question"]}, "acceptance_checks": [{"id": "matches-template", "check": "Scan report validates against template.config-scan-report.", "method": "deterministic"}, {"id": "checks-pass", "check": "Scan report passes scanner-checks.", "method": "deterministic"}], "creates": {"nouns": "The worker writes the nouns listed in output_contract.produces and returns their pins.", "verbs": "The worker proposes follow-up verbs in output.proposed_verbs, such as a breakdown into smaller verbs or a research follow-up, with the pins they need. Proposals are never enqueued by the worker; an authorized requester enqueues the ones worth doing."}, "guidance": {"required": ["Run python3 -m config_scanner scan on the local repository directory without executing any hooks or servers.", "Verify the output passes scanner-checks before returning.", "Return follow-up work the results justify as proposed_verbs and nouns worth creating later as proposed_nouns. Never enqueue them yourself; an authorized requester decides which to run."], "preferred": [], "suggested": [], "discovery_requested": false}, "required_capabilities": ["read permitted noun versions", "write candidate nouns in the requester's scope"], "bounds": {"max_attempts": 2, "max_elapsed_seconds": 1800}, "execution": {"reasoning": "deterministic_tools", "model_use": "none", "inference_allowance": "Existing authorized worker allowance only. This template grants no provider credit, spending authority or server inference.", "server_fallback": false, "maximum_automatically_enqueued_children": 0, "network": {"mode": "local_only", "detail": "Reads discovered config files as inert bytes inside the local checkout."}, "external_effects": "none"}, "review": {"required": "owning_policy", "self_approval_permitted": false, "publication_permitted": false, "admission_permitted": false}, "instantiation": {"status": "template", "fill_before_enqueue": ["repo_checkout"], "rule": "Replace each slot with exact NounRef pins, set the params, then recompute the idempotency key with scripts/build_packs.py --instantiate. Enqueue only with your own grants in a queue your owner assigned."}, "execution_report": {"optional": true, "purpose": "Lets later runs of this template be fingerprinted and compared. It is worker reported, not proof.", "template": {"version": 1, "harness": {"name": "replace-with-harness-name", "version": "replace-with-exact-version"}, "model": {"provider": "replace-with-provider-or-none", "name": "replace-with-exact-model-or-none"}, "summaries": {"problem": "One sentence: what this run was asked to resolve.", "input": "One sentence: which pinned inputs were read.", "solution": "One sentence: what was produced or why the outcome was no_change, unknown or blocked."}, "contract": {"input_schema": {"type": "object", "additionalProperties": false, "required": ["pinned", "slots", "params"], "properties": {"pinned": {"type": "array", "minItems": 4, "maxItems": 4, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "slots": {"type": "object", "additionalProperties": false, "required": ["repo_checkout"], "properties": {"repo_checkout": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}}, "params": {"type": "object", "additionalProperties": false, "required": ["output_store"], "properties": {"output_store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}}}}}, "output_schema": {"type": "object", "additionalProperties": false, "required": ["outcome", "summary", "artifacts", "checks", "unknowns"], "properties": {"outcome": {"type": "string", "enum": ["configs_scanned", "no_change", "unknown", "blocked"]}, "summary": {"type": "string", "minLength": 1, "maxLength": 1200}, "artifacts": {"type": "array", "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["role", "ref"], "properties": {"role": {"type": "string", "minLength": 1, "maxLength": 64}, "ref": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "value": {"type": "object"}}}}, "checks": {"type": "array", "maxItems": 64, "items": {"type": "object", "additionalProperties": false, "required": ["id", "result"], "properties": {"id": {"type": "string", "minLength": 1, "maxLength": 80}, "result": {"type": "string", "enum": ["pass", "fail", "not_run"]}, "evidence": {"type": "string", "maxLength": 2000}}}}, "unknowns": {"type": "array", "maxItems": 32, "items": {"type": "object", "additionalProperties": false, "required": ["item", "reason"], "properties": {"item": {"type": "string", "minLength": 1, "maxLength": 300}, "reason": {"type": "string", "minLength": 1, "maxLength": 1000}, "would_resolve": {"type": "string", "maxLength": 1000}}}}, "no_change_reason": {"type": "string", "minLength": 1, "maxLength": 2000}, "blocked_question": {"type": "string", "minLength": 1, "maxLength": 1000}, "proposed_verbs": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["kind", "title", "outcome", "why", "priority"], "properties": {"kind": {"type": "string", "pattern": "^verb\\.[a-z_]+$"}, "template_id": {"type": "string", "minLength": 1, "maxLength": 160}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "outcome": {"type": "string", "minLength": 1, "maxLength": 600}, "why": {"type": "string", "minLength": 1, "maxLength": 600}, "input_pins": {"type": "array", "maxItems": 16, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "priority": {"type": "integer", "minimum": 1, "maximum": 3}}}}, "proposed_nouns": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["category", "role", "title", "why"], "properties": {"category": {"type": "string", "pattern": "^noun\\.[a-z_]+$"}, "role": {"type": "string", "minLength": 1, "maxLength": 64}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "why": {"type": "string", "minLength": 1, "maxLength": 600}}}}, "run_notes": {"type": "object", "additionalProperties": false, "properties": {"went_right": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "went_wrong": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "next_steps": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "ideas": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}}}}}}, "blocks": [{"kind": "error", "text": ""}], "artifact_refs": [], "usage": {"source": "harness_metadata", "input_tokens": null, "output_tokens": null, "reason": "Template only. Replace with measured counters or keep null with a reason."}}, "fill_rules": ["Copy contract.input_schema and contract.output_schema unchanged, so every run of this template shares one shape fingerprint.", "Add context_hash, environment_hash and toolchain_hash as lowercase SHA-256 digests when known; all five contract fields together allow exact matching.", "Name the exact harness version, provider and model. Deterministic or human work records the model name as none.", "Put what went wrong in an error block and in output.run_notes.went_wrong. The version-1 report has no fields for what went right, next steps or ideas, so those go in output.run_notes.", "Leave token counts null with a reason unless the harness or provider measured them."], "run_notes_field": "output.run_notes", "shape_sha256": "b5439c6c1ce27c5658bb6f064b3d0759c367eca862b6f7ed0674cb474f89e2f9"}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": [{"relation": "requires_noun", "target_id": "seedpack.agent-config-supply-chain-scanner/agent-config-supply-chain-scanner.v0.1.0.scanner-checks", "target_category": "noun.benchmark_suite", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.agent-config-supply-chain-scanner/agent-config-supply-chain-scanner.v0.1.0.guardrail.configs-are-executable-on-clone", "target_category": "noun.skill_pack", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.agent-config-supply-chain-scanner/agent-config-supply-chain-scanner.v0.1.0.rules.five-supply-chain-vectors", "target_category": "noun.reflex_procedure", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.agent-config-supply-chain-scanner/agent-config-supply-chain-scanner.v0.1.0.tool.config-scanner", "target_category": "noun.code_node", "note": ""}, {"relation": "produces_noun", "target_id": "seedpack.agent-config-supply-chain-scanner/agent-config-supply-chain-scanner.v0.1.0.template.config-scan-report", "target_category": "noun.eval_run", "note": "output scan_report"}]}},
{"queue": "conformance-seed-packs", "kind": "verb.verify_gate", "effect_class": "write-internal", "priority": 50, "idempotency_key": "seedpack:agent-config-supply-chain-scanner:gate-self-editing-memory-diff:74569294cfad1294f71a528f3236a8dafb3b2ff02182f457fafbe866c62062f9", "depends_on": [], "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:verb.verify_gate", "pack:agent-config-supply-chain-scanner", "template:gate-self-editing-memory-diff", "claimant:agent", "status:quarantined"], "brief": {"category_id": "verb.verify_gate", "contract": "ta-amps.seed-verb-template.v1", "pack": "agent-config-supply-chain-scanner", "pack_version": "0.1.0", "template_id": "agent-config-supply-chain-scanner.gate-self-editing-memory-diff", "title": "Audit self-edited SOUL.md or persona memory diffs before persistence", "plain_summary": "Run config_scanner diff-memory on baseline and candidate persona memory text to block silent override directives, shell snippets, hidden Unicode, or new external URLs.", "outcome": "A memory diff receipt recording approved_for_auto_persist.", "claimant": "agent", "inputs": {"pinned": [{"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.guardrail.diff-gate-evolving-memory", "version": 1, "value_sha256": "58219b45f463fd30943a5db65a03efc744f131b6f162f27b5a76a1481e1700d2"}, {"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.rules.five-supply-chain-vectors", "version": 1, "value_sha256": "76da0cbe11e64b523050008d09551fad9e776916485b63fb19f06a674c157dd1"}, {"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.tool.config-scanner", "version": 1, "value_sha256": "e459e6e0debb5138089291e1bf390b6cc1777b5f91439b62e8b0ff880d91811c"}], "slots": {"memory_pair": null}, "params": {"output_store": "seedpack.agent-config-supply-chain-scanner.outputs"}}, "slot_specs": {"memory_pair": {"category": "noun.public_source", "required": true, "many": false, "description": "Local baseline and candidate persona memory files."}}, "param_specs": {"output_store": {"description": "Store for the produced nouns. The default is a placeholder; use the store your owner assigned.", "schema": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "required": true, "default": "seedpack.agent-config-supply-chain-scanner.outputs"}}, "input_schema": {"type": "object", "additionalProperties": false, "required": ["pinned", "slots", "params"], "properties": {"pinned": {"type": "array", "minItems": 3, "maxItems": 3, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "slots": {"type": "object", "additionalProperties": false, "required": ["memory_pair"], "properties": {"memory_pair": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}}, "params": {"type": "object", "additionalProperties": false, "required": ["output_store"], "properties": {"output_store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}}}}}, "output_contract": {"visibility_scope": "surface_only", "allowed_surfaces": [], "write_mode": "create_only", "store_param": "output_store", "key_rule": "agent-config-supply-chain-scanner.<role>.<task_id>[.<n>]", "expected_version": 0, "produces": [{"name": "diff_receipt", "template": {"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.template.memory-diff-receipt", "version": 1, "value_sha256": "8a27c93bd80e8475b3da56bfad002b75098b8f318fd242c637536f140e9ef693"}, "max": 1}], "delivery": "Write produced nouns surface_only under your own authenticated surface, which is the requester's assigned surface, so the requester and that surface's reviewers can read them. Never use public_commons or allowlist other surfaces. Return every produced noun's pin in output.artifacts; add its value when the requester asks for inline delivery."}, "output_schema": {"type": "object", "additionalProperties": false, "required": ["outcome", "summary", "artifacts", "checks", "unknowns"], "properties": {"outcome": {"type": "string", "enum": ["memory_diff_checked", "no_change", "unknown", "blocked"]}, "summary": {"type": "string", "minLength": 1, "maxLength": 1200}, "artifacts": {"type": "array", "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["role", "ref"], "properties": {"role": {"type": "string", "minLength": 1, "maxLength": 64}, "ref": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "value": {"type": "object"}}}}, "checks": {"type": "array", "maxItems": 64, "items": {"type": "object", "additionalProperties": false, "required": ["id", "result"], "properties": {"id": {"type": "string", "minLength": 1, "maxLength": 80}, "result": {"type": "string", "enum": ["pass", "fail", "not_run"]}, "evidence": {"type": "string", "maxLength": 2000}}}}, "unknowns": {"type": "array", "maxItems": 32, "items": {"type": "object", "additionalProperties": false, "required": ["item", "reason"], "properties": {"item": {"type": "string", "minLength": 1, "maxLength": 300}, "reason": {"type": "string", "minLength": 1, "maxLength": 1000}, "would_resolve": {"type": "string", "maxLength": 1000}}}}, "no_change_reason": {"type": "string", "minLength": 1, "maxLength": 2000}, "blocked_question": {"type": "string", "minLength": 1, "maxLength": 1000}, "proposed_verbs": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["kind", "title", "outcome", "why", "priority"], "properties": {"kind": {"type": "string", "pattern": "^verb\\.[a-z_]+$"}, "template_id": {"type": "string", "minLength": 1, "maxLength": 160}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "outcome": {"type": "string", "minLength": 1, "maxLength": 600}, "why": {"type": "string", "minLength": 1, "maxLength": 600}, "input_pins": {"type": "array", "maxItems": 16, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "priority": {"type": "integer", "minimum": 1, "maximum": 3}}}}, "proposed_nouns": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["category", "role", "title", "why"], "properties": {"category": {"type": "string", "pattern": "^noun\\.[a-z_]+$"}, "role": {"type": "string", "minLength": 1, "maxLength": 64}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "why": {"type": "string", "minLength": 1, "maxLength": 600}}}}, "run_notes": {"type": "object", "additionalProperties": false, "properties": {"went_right": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "went_wrong": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "next_steps": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "ideas": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}}}}}, "permitted_outcomes": ["memory_diff_checked", "no_change", "unknown", "blocked"], "outcome_meanings": {"memory_diff_checked": "The declared nouns were produced and every deterministic acceptance check passed.", "no_change": "The evidence does not justify producing or changing anything. Say why.", "unknown": "The question could not be answered with the permitted inputs. List what is missing and what would resolve it.", "blocked": "A required input, permission or capability is missing. Ask one precise question."}, "outcome_requirements": {"memory_diff_checked": ["artifacts"], "no_change": ["no_change_reason"], "unknown": ["unknowns"], "blocked": ["blocked_question"]}, "acceptance_checks": [{"id": "matches-template", "check": "Receipt validates against template.memory-diff-receipt.", "method": "deterministic"}, {"id": "digests-recorded", "check": "Both before_sha256 and after_sha256 are 64-hex digests.", "method": "deterministic"}], "creates": {"nouns": "The worker writes the nouns listed in output_contract.produces and returns their pins.", "verbs": "The worker proposes follow-up verbs in output.proposed_verbs, such as a breakdown into smaller verbs or a research follow-up, with the pins they need. Proposals are never enqueued by the worker; an authorized requester enqueues the ones worth doing."}, "guidance": {"required": ["Run python3 -m config_scanner diff-memory on the before and after files.", "Ensure approved_for_auto_persist is false whenever any risk vector appears in added lines.", "Return follow-up work the results justify as proposed_verbs and nouns worth creating later as proposed_nouns. Never enqueue them yourself; an authorized requester decides which to run."], "preferred": [], "suggested": [], "discovery_requested": false}, "required_capabilities": ["read permitted noun versions", "write candidate nouns in the requester's scope"], "bounds": {"max_attempts": 2, "max_elapsed_seconds": 1800}, "execution": {"reasoning": "deterministic_tools", "model_use": "none", "inference_allowance": "Existing authorized worker allowance only. This template grants no provider credit, spending authority or server inference.", "server_fallback": false, "maximum_automatically_enqueued_children": 0, "network": {"mode": "local_only", "detail": "Reads only the local baseline and candidate memory files."}, "external_effects": "none"}, "review": {"required": "owning_policy", "self_approval_permitted": false, "publication_permitted": false, "admission_permitted": false}, "instantiation": {"status": "template", "fill_before_enqueue": ["memory_pair"], "rule": "Replace each slot with exact NounRef pins, set the params, then recompute the idempotency key with scripts/build_packs.py --instantiate. Enqueue only with your own grants in a queue your owner assigned."}, "execution_report": {"optional": true, "purpose": "Lets later runs of this template be fingerprinted and compared. It is worker reported, not proof.", "template": {"version": 1, "harness": {"name": "replace-with-harness-name", "version": "replace-with-exact-version"}, "model": {"provider": "replace-with-provider-or-none", "name": "replace-with-exact-model-or-none"}, "summaries": {"problem": "One sentence: what this run was asked to resolve.", "input": "One sentence: which pinned inputs were read.", "solution": "One sentence: what was produced or why the outcome was no_change, unknown or blocked."}, "contract": {"input_schema": {"type": "object", "additionalProperties": false, "required": ["pinned", "slots", "params"], "properties": {"pinned": {"type": "array", "minItems": 3, "maxItems": 3, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "slots": {"type": "object", "additionalProperties": false, "required": ["memory_pair"], "properties": {"memory_pair": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}}, "params": {"type": "object", "additionalProperties": false, "required": ["output_store"], "properties": {"output_store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}}}}}, "output_schema": {"type": "object", "additionalProperties": false, "required": ["outcome", "summary", "artifacts", "checks", "unknowns"], "properties": {"outcome": {"type": "string", "enum": ["memory_diff_checked", "no_change", "unknown", "blocked"]}, "summary": {"type": "string", "minLength": 1, "maxLength": 1200}, "artifacts": {"type": "array", "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["role", "ref"], "properties": {"role": {"type": "string", "minLength": 1, "maxLength": 64}, "ref": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "value": {"type": "object"}}}}, "checks": {"type": "array", "maxItems": 64, "items": {"type": "object", "additionalProperties": false, "required": ["id", "result"], "properties": {"id": {"type": "string", "minLength": 1, "maxLength": 80}, "result": {"type": "string", "enum": ["pass", "fail", "not_run"]}, "evidence": {"type": "string", "maxLength": 2000}}}}, "unknowns": {"type": "array", "maxItems": 32, "items": {"type": "object", "additionalProperties": false, "required": ["item", "reason"], "properties": {"item": {"type": "string", "minLength": 1, "maxLength": 300}, "reason": {"type": "string", "minLength": 1, "maxLength": 1000}, "would_resolve": {"type": "string", "maxLength": 1000}}}}, "no_change_reason": {"type": "string", "minLength": 1, "maxLength": 2000}, "blocked_question": {"type": "string", "minLength": 1, "maxLength": 1000}, "proposed_verbs": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["kind", "title", "outcome", "why", "priority"], "properties": {"kind": {"type": "string", "pattern": "^verb\\.[a-z_]+$"}, "template_id": {"type": "string", "minLength": 1, "maxLength": 160}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "outcome": {"type": "string", "minLength": 1, "maxLength": 600}, "why": {"type": "string", "minLength": 1, "maxLength": 600}, "input_pins": {"type": "array", "maxItems": 16, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "priority": {"type": "integer", "minimum": 1, "maximum": 3}}}}, "proposed_nouns": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["category", "role", "title", "why"], "properties": {"category": {"type": "string", "pattern": "^noun\\.[a-z_]+$"}, "role": {"type": "string", "minLength": 1, "maxLength": 64}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "why": {"type": "string", "minLength": 1, "maxLength": 600}}}}, "run_notes": {"type": "object", "additionalProperties": false, "properties": {"went_right": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "went_wrong": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "next_steps": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "ideas": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}}}}}}, "blocks": [{"kind": "error", "text": ""}], "artifact_refs": [], "usage": {"source": "harness_metadata", "input_tokens": null, "output_tokens": null, "reason": "Template only. Replace with measured counters or keep null with a reason."}}, "fill_rules": ["Copy contract.input_schema and contract.output_schema unchanged, so every run of this template shares one shape fingerprint.", "Add context_hash, environment_hash and toolchain_hash as lowercase SHA-256 digests when known; all five contract fields together allow exact matching.", "Name the exact harness version, provider and model. Deterministic or human work records the model name as none.", "Put what went wrong in an error block and in output.run_notes.went_wrong. The version-1 report has no fields for what went right, next steps or ideas, so those go in output.run_notes.", "Leave token counts null with a reason unless the harness or provider measured them."], "run_notes_field": "output.run_notes", "shape_sha256": "854922750a5396e2b43099933c60d95d5067d814a5e7762d407b99fd41db69ac"}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": [{"relation": "requires_noun", "target_id": "seedpack.agent-config-supply-chain-scanner/agent-config-supply-chain-scanner.v0.1.0.guardrail.diff-gate-evolving-memory", "target_category": "noun.skill_pack", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.agent-config-supply-chain-scanner/agent-config-supply-chain-scanner.v0.1.0.rules.five-supply-chain-vectors", "target_category": "noun.reflex_procedure", "note": ""}, {"relation": "requires_noun", "target_id": "seedpack.agent-config-supply-chain-scanner/agent-config-supply-chain-scanner.v0.1.0.tool.config-scanner", "target_category": "noun.code_node", "note": ""}, {"relation": "produces_noun", "target_id": "seedpack.agent-config-supply-chain-scanner/agent-config-supply-chain-scanner.v0.1.0.template.memory-diff-receipt", "target_category": "noun.eval_run", "note": "output diff_receipt"}]}},
{"queue": "conformance-seed-packs", "kind": "verb.recover_fault", "effect_class": "write-internal", "priority": 50, "idempotency_key": "seedpack:agent-config-supply-chain-scanner:quarantine-supply-chain-finding:37ee6673f91a4118e5c670e79807daf873565e8b2ff6e464d36ff7bc48ba792a", "depends_on": [], "producer_surface": "surface:tessera", "visibility_scope": "surface_only", "allowed_surfaces": [], "target_cohorts": ["all"], "tags": ["category:verb.recover_fault", "pack:agent-config-supply-chain-scanner", "template:quarantine-supply-chain-finding", "claimant:agent", "status:quarantined"], "brief": {"category_id": "verb.recover_fault", "contract": "ta-amps.seed-verb-template.v1", "pack": "agent-config-supply-chain-scanner", "pack_version": "0.1.0", "template_id": "agent-config-supply-chain-scanner.quarantine-supply-chain-finding", "title": "Record a failure tombstone for a blocked repository config or memory diff", "plain_summary": "Convert a blocked supply-chain scan report into a reusable failure tombstone naming the inventory digest, vectors, and remediation requirement.", "outcome": "A quarantined supply-chain tombstone.", "claimant": "agent", "inputs": {"pinned": [{"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.guardrail.configs-are-executable-on-clone", "version": 1, "value_sha256": "19544b1ffaef2cfa03e2a6c63e767357c27591d09cd1f71950fc669fa0f3cf13"}], "slots": {"scan_report": null}, "params": {"output_store": "seedpack.agent-config-supply-chain-scanner.outputs"}}, "slot_specs": {"scan_report": {"category": "noun.eval_run", "required": true, "many": false, "description": "Pin of a blocked config scan report."}}, "param_specs": {"output_store": {"description": "Store for the produced nouns. The default is a placeholder; use the store your owner assigned.", "schema": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "required": true, "default": "seedpack.agent-config-supply-chain-scanner.outputs"}}, "input_schema": {"type": "object", "additionalProperties": false, "required": ["pinned", "slots", "params"], "properties": {"pinned": {"type": "array", "minItems": 1, "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "slots": {"type": "object", "additionalProperties": false, "required": ["scan_report"], "properties": {"scan_report": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}}, "params": {"type": "object", "additionalProperties": false, "required": ["output_store"], "properties": {"output_store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}}}}}, "output_contract": {"visibility_scope": "surface_only", "allowed_surfaces": [], "write_mode": "create_only", "store_param": "output_store", "key_rule": "agent-config-supply-chain-scanner.<role>.<task_id>[.<n>]", "expected_version": 0, "produces": [{"name": "tombstone", "template": {"store": "seedpack.agent-config-supply-chain-scanner", "key": "agent-config-supply-chain-scanner.v0.1.0.template.supply-chain-tombstone", "version": 1, "value_sha256": "14e76c957923e2393804cb9ba2f2d92bf971632931ca9d96a719fbbcefa75017"}, "max": 1}], "delivery": "Write produced nouns surface_only under your own authenticated surface, which is the requester's assigned surface, so the requester and that surface's reviewers can read them. Never use public_commons or allowlist other surfaces. Return every produced noun's pin in output.artifacts; add its value when the requester asks for inline delivery."}, "output_schema": {"type": "object", "additionalProperties": false, "required": ["outcome", "summary", "artifacts", "checks", "unknowns"], "properties": {"outcome": {"type": "string", "enum": ["finding_quarantined", "no_change", "unknown", "blocked"]}, "summary": {"type": "string", "minLength": 1, "maxLength": 1200}, "artifacts": {"type": "array", "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["role", "ref"], "properties": {"role": {"type": "string", "minLength": 1, "maxLength": 64}, "ref": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "value": {"type": "object"}}}}, "checks": {"type": "array", "maxItems": 64, "items": {"type": "object", "additionalProperties": false, "required": ["id", "result"], "properties": {"id": {"type": "string", "minLength": 1, "maxLength": 80}, "result": {"type": "string", "enum": ["pass", "fail", "not_run"]}, "evidence": {"type": "string", "maxLength": 2000}}}}, "unknowns": {"type": "array", "maxItems": 32, "items": {"type": "object", "additionalProperties": false, "required": ["item", "reason"], "properties": {"item": {"type": "string", "minLength": 1, "maxLength": 300}, "reason": {"type": "string", "minLength": 1, "maxLength": 1000}, "would_resolve": {"type": "string", "maxLength": 1000}}}}, "no_change_reason": {"type": "string", "minLength": 1, "maxLength": 2000}, "blocked_question": {"type": "string", "minLength": 1, "maxLength": 1000}, "proposed_verbs": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["kind", "title", "outcome", "why", "priority"], "properties": {"kind": {"type": "string", "pattern": "^verb\\.[a-z_]+$"}, "template_id": {"type": "string", "minLength": 1, "maxLength": 160}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "outcome": {"type": "string", "minLength": 1, "maxLength": 600}, "why": {"type": "string", "minLength": 1, "maxLength": 600}, "input_pins": {"type": "array", "maxItems": 16, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "priority": {"type": "integer", "minimum": 1, "maximum": 3}}}}, "proposed_nouns": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["category", "role", "title", "why"], "properties": {"category": {"type": "string", "pattern": "^noun\\.[a-z_]+$"}, "role": {"type": "string", "minLength": 1, "maxLength": 64}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "why": {"type": "string", "minLength": 1, "maxLength": 600}}}}, "run_notes": {"type": "object", "additionalProperties": false, "properties": {"went_right": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "went_wrong": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "next_steps": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "ideas": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}}}}}, "permitted_outcomes": ["finding_quarantined", "no_change", "unknown", "blocked"], "outcome_meanings": {"finding_quarantined": "The declared nouns were produced and every deterministic acceptance check passed.", "no_change": "The evidence does not justify producing or changing anything. Say why.", "unknown": "The question could not be answered with the permitted inputs. List what is missing and what would resolve it.", "blocked": "A required input, permission or capability is missing. Ask one precise question."}, "outcome_requirements": {"finding_quarantined": ["artifacts"], "no_change": ["no_change_reason"], "unknown": ["unknowns"], "blocked": ["blocked_question"]}, "acceptance_checks": [{"id": "matches-template", "check": "Tombstone validates against template.supply-chain-tombstone.", "method": "deterministic"}, {"id": "vectors-non-empty", "check": "blocked_vectors contains every unique vector from findings.", "method": "deterministic"}], "creates": {"nouns": "The worker writes the nouns listed in output_contract.produces and returns their pins.", "verbs": "The worker proposes follow-up verbs in output.proposed_verbs, such as a breakdown into smaller verbs or a research follow-up, with the pins they need. Proposals are never enqueued by the worker; an authorized requester enqueues the ones worth doing."}, "guidance": {"required": ["Verify the pinned scan_report has verdict 'block' and non-empty findings.", "Record inventory_sha256, unique blocked_vectors, and a concrete remediation_rule.", "Return follow-up work the results justify as proposed_verbs and nouns worth creating later as proposed_nouns. Never enqueue them yourself; an authorized requester decides which to run."], "preferred": [], "suggested": [], "discovery_requested": false}, "required_capabilities": ["read permitted noun versions", "write candidate nouns in the requester's scope"], "bounds": {"max_attempts": 2, "max_elapsed_seconds": 1800}, "execution": {"reasoning": "authorized_worker", "model_use": "worker_allowance", "inference_allowance": "Existing authorized worker allowance only. This template grants no provider credit, spending authority or server inference.", "server_fallback": false, "maximum_automatically_enqueued_children": 0, "network": {"mode": "none", "detail": "No network access."}, "external_effects": "none"}, "review": {"required": "owning_policy", "self_approval_permitted": false, "publication_permitted": false, "admission_permitted": false}, "instantiation": {"status": "template", "fill_before_enqueue": ["scan_report"], "rule": "Replace each slot with exact NounRef pins, set the params, then recompute the idempotency key with scripts/build_packs.py --instantiate. Enqueue only with your own grants in a queue your owner assigned."}, "execution_report": {"optional": true, "purpose": "Lets later runs of this template be fingerprinted and compared. It is worker reported, not proof.", "template": {"version": 1, "harness": {"name": "replace-with-harness-name", "version": "replace-with-exact-version"}, "model": {"provider": "replace-with-provider-or-none", "name": "replace-with-exact-model-or-none"}, "summaries": {"problem": "One sentence: what this run was asked to resolve.", "input": "One sentence: which pinned inputs were read.", "solution": "One sentence: what was produced or why the outcome was no_change, unknown or blocked."}, "contract": {"input_schema": {"type": "object", "additionalProperties": false, "required": ["pinned", "slots", "params"], "properties": {"pinned": {"type": "array", "minItems": 1, "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "slots": {"type": "object", "additionalProperties": false, "required": ["scan_report"], "properties": {"scan_report": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}}, "params": {"type": "object", "additionalProperties": false, "required": ["output_store"], "properties": {"output_store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}}}}}, "output_schema": {"type": "object", "additionalProperties": false, "required": ["outcome", "summary", "artifacts", "checks", "unknowns"], "properties": {"outcome": {"type": "string", "enum": ["finding_quarantined", "no_change", "unknown", "blocked"]}, "summary": {"type": "string", "minLength": 1, "maxLength": 1200}, "artifacts": {"type": "array", "maxItems": 1, "items": {"type": "object", "additionalProperties": false, "required": ["role", "ref"], "properties": {"role": {"type": "string", "minLength": 1, "maxLength": 64}, "ref": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}, "value": {"type": "object"}}}}, "checks": {"type": "array", "maxItems": 64, "items": {"type": "object", "additionalProperties": false, "required": ["id", "result"], "properties": {"id": {"type": "string", "minLength": 1, "maxLength": 80}, "result": {"type": "string", "enum": ["pass", "fail", "not_run"]}, "evidence": {"type": "string", "maxLength": 2000}}}}, "unknowns": {"type": "array", "maxItems": 32, "items": {"type": "object", "additionalProperties": false, "required": ["item", "reason"], "properties": {"item": {"type": "string", "minLength": 1, "maxLength": 300}, "reason": {"type": "string", "minLength": 1, "maxLength": 1000}, "would_resolve": {"type": "string", "maxLength": 1000}}}}, "no_change_reason": {"type": "string", "minLength": 1, "maxLength": 2000}, "blocked_question": {"type": "string", "minLength": 1, "maxLength": 1000}, "proposed_verbs": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["kind", "title", "outcome", "why", "priority"], "properties": {"kind": {"type": "string", "pattern": "^verb\\.[a-z_]+$"}, "template_id": {"type": "string", "minLength": 1, "maxLength": 160}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "outcome": {"type": "string", "minLength": 1, "maxLength": 600}, "why": {"type": "string", "minLength": 1, "maxLength": 600}, "input_pins": {"type": "array", "maxItems": 16, "items": {"type": "object", "additionalProperties": false, "required": ["store", "key", "version", "value_sha256"], "properties": {"store": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"}, "key": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]{0,255}$"}, "version": {"type": "integer", "minimum": 1}, "value_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}}}}, "priority": {"type": "integer", "minimum": 1, "maximum": 3}}}}, "proposed_nouns": {"type": "array", "maxItems": 10, "items": {"type": "object", "additionalProperties": false, "required": ["category", "role", "title", "why"], "properties": {"category": {"type": "string", "pattern": "^noun\\.[a-z_]+$"}, "role": {"type": "string", "minLength": 1, "maxLength": 64}, "title": {"type": "string", "minLength": 1, "maxLength": 160}, "why": {"type": "string", "minLength": 1, "maxLength": 600}}}}, "run_notes": {"type": "object", "additionalProperties": false, "properties": {"went_right": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "went_wrong": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "next_steps": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}, "ideas": {"type": "array", "maxItems": 8, "items": {"type": "string", "minLength": 1, "maxLength": 500}}}}}}}, "blocks": [{"kind": "error", "text": ""}], "artifact_refs": [], "usage": {"source": "harness_metadata", "input_tokens": null, "output_tokens": null, "reason": "Template only. Replace with measured counters or keep null with a reason."}}, "fill_rules": ["Copy contract.input_schema and contract.output_schema unchanged, so every run of this template shares one shape fingerprint.", "Add context_hash, environment_hash and toolchain_hash as lowercase SHA-256 digests when known; all five contract fields together allow exact matching.", "Name the exact harness version, provider and model. Deterministic or human work records the model name as none.", "Put what went wrong in an error block and in output.run_notes.went_wrong. The version-1 report has no fields for what went right, next steps or ideas, so those go in output.run_notes.", "Leave token counts null with a reason unless the harness or provider measured them."], "run_notes_field": "output.run_notes", "shape_sha256": "7e62a8e127bd61ac7e50a51aee50c9d93e3c2f902babd4934824764f47d092a0"}, "dimensions": {"determinism": 0.0, "evidence_grounding": 0.0, "token_efficiency": 0.0, "safety_compliance": 0.0, "verification_tier": "unverified"}, "dimension_basis": {"measured": false, "method": "unmeasured_floor", "reason": "Tessera requires these axes, so each is set to its lowest value and the tier is unverified. No quality is claimed. Replace them only with measured values and the evidence that produced them."}, "relations": [{"relation": "requires_noun", "target_id": "seedpack.agent-config-supply-chain-scanner/agent-config-supply-chain-scanner.v0.1.0.guardrail.configs-are-executable-on-clone", "target_category": "noun.skill_pack", "note": ""}, {"relation": "produces_noun", "target_id": "seedpack.agent-config-supply-chain-scanner/agent-config-supply-chain-scanner.v0.1.0.template.supply-chain-tombstone", "target_category": "noun.negative_tombstone", "note": "output tombstone"}], "follows_templates": ["agent-config-supply-chain-scanner.scan-repo-agent-configs"]}}
]}