1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
use clap::{Parser, Subcommand};
pub mod baseline;
pub mod bundle;
pub mod common;
pub mod coverage;
pub mod evidence;
pub mod import;
pub mod mcp;
pub mod policy;
pub mod project_otel;
pub mod replay;
pub mod run;
pub mod runtime;
pub mod sim;
pub mod trust_basis;
pub mod trust_card;
pub use baseline::*;
pub use bundle::*;
pub use common::*;
pub use coverage::*;
pub use evidence::*;
pub use import::*;
pub use mcp::*;
pub use policy::*;
pub use project_otel::*;
pub use replay::*;
pub use run::*;
pub use runtime::*;
pub use sim::*;
pub use trust_basis::*;
pub use trust_card::*;
#[derive(Parser)]
#[command(
name = "assay",
version,
about = "CI-native evidence and trust compiler for agent runtime governance"
)]
pub struct Cli {
#[command(subcommand)]
pub cmd: Command,
}
#[derive(Subcommand)]
pub enum Command {
/// Run an evaluation suite and write run artifacts
Run(RunArgs),
/// Run the CI gate and emit CI report artifacts
Ci(CiArgs),
/// Create starter Assay config and trace fixtures
Init(InitArgs),
/// Manage quarantined or flaky tests
Quarantine(QuarantineArgs),
/// Inspect or transform trace inputs
Trace(TraceArgs),
/// Calibrate thresholds from previous run artifacts
Calibrate(CalibrateArgs),
/// Record or compare score baselines
Baseline(BaselineArgs),
/// Validate config and trace files without a full run
Validate(ValidateArgs),
/// Diagnose local setup, config, and trace health
Doctor(DoctorArgs),
/// Watch config/policy/trace files and rerun on changes
Watch(WatchArgs),
/// Import external artifacts into Assay-compatible data
Import(ImportArgs),
/// Migrate older config or policy formats
Migrate(MigrateArgs),
/// Report policy and trace coverage
Coverage(CoverageArgs),
/// Project assay evidence into the OTel GenAI + OpenInference view (`assay.otel_projection.v0`)
ProjectOtel(ProjectOtelArgs),
/// Explain a test result or trace decision
Explain(super::commands::explain::ExplainArgs),
/// Generate and run the local demo project
Demo(DemoArgs),
/// Generate CI workflow scaffolding
InitCi(InitCiArgs),
/// Apply supported automatic fixes
Fix(FixArgs),
/// MCP runtime, discovery, kill-switch, and tool signing commands
Mcp(McpArgs),
/// Print Assay version information
Version,
/// Validate, format, and migrate policies
Policy(PolicyArgs),
/// Runtime eBPF Monitor (Linux only)
Monitor(super::commands::monitor::MonitorArgs),
/// Internal Assay-Runner Phase 1 spike command
#[cfg(feature = "runner")]
#[command(name = "runner-spike", hide = true)]
RunnerSpike(super::commands::runner_spike::RunnerSpikeArgs),
/// Manage multi-run profiles for stability analysis
Profile(super::commands::profile::ProfileArgs),
/// Run a command in a sandbox with optional Landlock filesystem and TCP-connect egress enforcement
Sandbox(SandboxArgs),
/// Evidence bundles, imports, verification, and stores
Evidence(EvidenceArgs),
/// Replay bundle management (create/verify)
Bundle(BundleArgs),
/// Replay a run from a replay bundle
Replay(ReplayArgs),
/// Attack Simulation (Hardening/Compliance)
#[cfg(feature = "sim")]
Sim(SimArgs),
/// Interactive installer and environment setup
Setup(SetupArgs),
/// Generate canonical trust-basis artifacts from verified evidence bundles
#[command(name = "trust-basis")]
TrustBasis(TrustBasisArgs),
/// Generate trust card artifacts (JSON, Markdown, and static HTML) from verified bundles
#[command(name = "trust-card", alias = "trustcard")]
TrustCard(TrustCardArgs),
}
#[derive(Parser, Debug)]
pub struct ToolArgs {
#[command(subcommand)]
pub cmd: super::commands::tool::ToolCmd,
}
#[cfg(test)]
mod tests;