feat(schema): Critical Extension Gate + LockedArtifact DAG tracking

schemas/agentbom/agentbom.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://wasmagent.dev/schemas/agentbom/v0.1.schema.json",
   "title": "AgentBOM",
-  "description": "Agent Bill of Materials v0.1 \u2014 shipped specification schema",
+  "description": "Agent Bill of Materials v0.1 — shipped specification schema",
   "type": "object",
   "required": [
     "agentbom_version",
@@ -198,7 +198,14 @@
         "granted_scopes": {
           "type": "array",
           "items": {
-            "type": "string"
+            "type": "string",
+            "pattern": "^[a-z0-9.-]+:[a-zA-Z0-9.*_/-]+$",
+            "examples": [
+              "network.egress:registry.npmjs.org",
+              "network.egress:*.github.com",
+              "filesystem.write:/tmp/workspace",
+              "tool.call:bash"
+            ]
           },
           "description": "All granted permission scopes"
         },
@@ -398,7 +405,7 @@
     },
     "workflow_layer": {
       "type": "array",
-      "description": "Action pathway definitions \u2014 workflows, pipelines, and decision sequences that define how the agent executes tasks",
+      "description": "Action pathway definitions — workflows, pipelines, and decision sequences that define how the agent executes tasks",
       "items": {
         "type": "object",
         "required": [
@@ -478,7 +485,7 @@
     "agent_collaboration": {
       "type": "object",
       "additionalProperties": false,
-      "description": "Multi-agent collaboration topology \u2014 peer agents, delegation boundaries, and shared resource access patterns",
+      "description": "Multi-agent collaboration topology — peer agents, delegation boundaries, and shared resource access patterns",
       "properties": {
         "peer_agents": {
           "type": "array",
@@ -639,7 +646,7 @@
     "distribution": {
       "type": "object",
       "additionalProperties": false,
-      "description": "Artifact lifecycle management \u2014 registry location, publication metadata, deprecation, and supersession",
+      "description": "Artifact lifecycle management — registry location, publication metadata, deprecation, and supersession",
       "properties": {
         "registry_uri": {
           "type": "string",
@@ -700,6 +707,46 @@
           "description": "Attestation timestamp in ISO 8601 format"
         }
       }
+    },
+    "extensions": {
+      "type": "object",
+      "description": "CRD-like extension mechanism. An extension with critical=true MUST cause the consumer to abort if the namespace is unrecognised, preventing silent security downgrades.",
+      "patternProperties": {
+        "^[a-z0-9.-]+$": {
+          "type": "object",
+          "required": [
+            "critical"
+          ],
+          "properties": {
+            "critical": {
+              "type": "boolean",
+              "default": false,
+              "description": "If true and the namespace is unrecognised, the consumer MUST abort execution."
+            },
+            "config": {
+              "type": "object",
+              "description": "Extension-specific configuration payload."
+            }
+          },
+          "additionalProperties": false
+        }
+      },
+      "examples": [
+        {
+          "wasmagent.audit": {
+            "critical": true,
+            "config": {
+              "require_trust_passport": true
+            }
+          },
+          "ui.theme.hint": {
+            "critical": false,
+            "config": {
+              "primary_color": "#3b82f6"
+            }
+          }
+        }
+      ]
     }
   }
 }

schemas/index.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "protocol": "AEP",
-  "description": "Registry of canonical WasmAgent protocol schemas \u2014 the single source of truth for every cross-repository contract. Downstream repos consume via @wasmagent/protocol (npm) and wasmagent-protocol (PyPI). Covers: AEP, compliance, AgentBOM, MCP Posture, Trust Passport.",
+  "description": "Registry of canonical WasmAgent protocol schemas — the single source of truth for every cross-repository contract. Downstream repos consume via @wasmagent/protocol (npm) and wasmagent-protocol (PyPI). Covers: AEP, compliance, AgentBOM, MCP Posture, Trust Passport.",
   "canonical_host": "https://wasmagent.dev/schemas/",
   "schemas": [
     {
@@ -21,7 +21,7 @@
         "wasmagent-train-replay",
         "open-agent-audit"
       ],
-      "summary": "Runtime action evidence and run provenance record \u2014 the core Agent Evidence Protocol contract."
+      "summary": "Runtime action evidence and run provenance record — the core Agent Evidence Protocol contract. Includes LockedArtifact DAG artifact tracking (run_artifacts)."
     },
     {
       "id": "evidence-envelope",
@@ -39,7 +39,7 @@
         "trace-pipeline",
         "open-agent-audit"
       ],
-      "summary": "Shared envelope base for all AEP evidence records \u2014 schema_version, trace_id, created_at_ms, and optional signature."
+      "summary": "Shared envelope base for all AEP evidence records — schema_version, trace_id, created_at_ms, and optional signature."
     },
     {
       "id": "constraint-ir",
@@ -55,7 +55,7 @@
         "wasmagent-js",
         "trace-pipeline"
       ],
-      "summary": "Typed, repairable, prioritised constraint \u2014 superset of @wasmagent/core Criterion."
+      "summary": "Typed, repairable, prioritised constraint — superset of @wasmagent/core Criterion."
     },
     {
       "id": "constraint-violation",
@@ -142,7 +142,7 @@
       "title": "AgentBOM",
       "path": "schemas/agentbom/agentbom.schema.json",
       "canonical_id": "https://wasmagent.dev/schemas/agentbom/v0.1.schema.json",
-      "version": "agentbom/v0.1",
+      "version": "agentbom/v0.2",
       "stability": "evolving",
       "owners": [
         "agent-trust-infra"
@@ -151,7 +151,7 @@
         "agent-trust-infra",
         "open-agent-audit"
       ],
-      "summary": "Agent Bill of Materials \u2014 machine-readable agent identity, capabilities, and trust metadata."
+      "summary": "Agent Bill of Materials — machine-readable agent identity, capabilities, trust metadata, critical extension gate, and permission namespace scopes."
     },
     {
       "id": "mcp-posture",
@@ -167,7 +167,7 @@
         "agent-trust-infra",
         "open-agent-audit"
       ],
-      "summary": "MCP Posture \u2014 tool surface, permission grants, and risk signals for MCP servers."
+      "summary": "MCP Posture — tool surface, permission grants, and risk signals for MCP servers."
     },
     {
       "id": "trust-passport",
@@ -183,7 +183,7 @@
         "agent-trust-infra",
         "open-agent-audit"
       ],
-      "summary": "Trust Passport \u2014 signed, expiring, verifiable trust-state artifact for AI agents."
+      "summary": "Trust Passport — signed, expiring, verifiable trust-state artifact for AI agents."
     }
   ]
 }

tests/fixtures/invalid/aep-record/completed-artifact-missing-lock.json

@@ -0,0 +1,12 @@
+{
+  "schema_version": "aep/v0.3",
+  "run_id": "run-002",
+  "created_at_ms": 1700000000000,
+  "run_artifacts": [
+    {
+      "artifact_id": "art-pr-99",
+      "class": "pr",
+      "state": "completed"
+    }
+  ]
+}

tests/fixtures/invalid/agentbom/bad-permission-scope.json

@@ -0,0 +1,16 @@
+{
+  "agentbom_version": "0.1",
+  "identity": {
+    "agent_id": "a1",
+    "agent_name": "Test",
+    "generated_at": "2026-01-01T00:00:00Z"
+  },
+  "attestation": {
+    "generator": "test-tool"
+  },
+  "permission_layer": {
+    "granted_scopes": [
+      "*"
+    ]
+  }
+}

tests/fixtures/invalid/agentbom/extension-missing-critical.json

@@ -0,0 +1,18 @@
+{
+  "agentbom_version": "0.1",
+  "identity": {
+    "agent_id": "a1",
+    "agent_name": "Test",
+    "generated_at": "2026-01-01T00:00:00Z"
+  },
+  "attestation": {
+    "generator": "test-tool"
+  },
+  "extensions": {
+    "wasmagent.audit": {
+      "config": {
+        "require_trust_passport": true
+      }
+    }
+  }
+}

tests/fixtures/valid/aep-record/with-locked-artifacts.json

@@ -0,0 +1,29 @@
+{
+  "schema_version": "aep/v0.3",
+  "run_id": "run-001",
+  "created_at_ms": 1700000000000,
+  "run_artifacts": [
+    {
+      "artifact_id": "art-pr-42",
+      "class": "pr",
+      "state": "completed",
+      "output_hash": "sha256:abc123",
+      "output_uri": "https://github.com/WasmAgent/wasmagent/pull/42"
+    },
+    {
+      "artifact_id": "art-test-report",
+      "class": "test-report",
+      "state": "completed",
+      "depends_on": [
+        "art-pr-42"
+      ],
+      "output_hash": "sha256:def456",
+      "output_uri": "https://ci.example.com/reports/run-001"
+    },
+    {
+      "artifact_id": "art-draft",
+      "class": "file",
+      "state": "generating"
+    }
+  ]
+}

tests/fixtures/valid/agentbom/with-extension-gate.json

@@ -0,0 +1,32 @@
+{
+  "agentbom_version": "0.1",
+  "identity": {
+    "agent_id": "a1",
+    "agent_name": "Test",
+    "generated_at": "2026-01-01T00:00:00Z"
+  },
+  "attestation": {
+    "generator": "test-tool"
+  },
+  "extensions": {
+    "wasmagent.audit": {
+      "critical": true,
+      "config": {
+        "require_trust_passport": true
+      }
+    },
+    "ui.theme.hint": {
+      "critical": false,
+      "config": {
+        "primary_color": "#3b82f6"
+      }
+    }
+  },
+  "permission_layer": {
+    "granted_scopes": [
+      "network.egress:registry.npmjs.org",
+      "filesystem.write:/tmp/workspace",
+      "tool.call:bash"
+    ]
+  }
+}