examples: add payment guard evidence export bundle#152
Merged
Conversation
Add scripts/export_payment_guard_evidence.py:
- Copies audit.jsonl, replay-store.json, config, policy into --out dir
- Runs hash-chain verification inline (no external subprocess)
- Generates verification_report.json with generated_at, bundle_type,
audit_records_count, replay_store_nonces, hash_chain_valid,
source_files, copied_files
- Missing audit.jsonl -> hard fail with clear error
- Missing replay-store.json -> exports empty {} with a warning
- Existing output dir: overwrite (documented in --help)
- Zero new dependencies (stdlib only: json, pathlib, shutil, hashlib,
argparse, datetime)
Add examples/agent-payment-guard/run_evidence_export_check.sh:
- Spins up service, runs run_service_check.sh fixtures to produce
audit.jsonl + replay-store.json, then calls the export script
- Verifies verification_report.json fields
- Re-runs verify_audit_log.py against bundled audit.jsonl
- Prints pass/fail summary
Owner
Author
|
PR looks good and mostly matches #151: stdlib-only export script, inline hash-chain verification, deterministic missing replay-store behavior, verification_report.json with the requested fields, and a smoke check that verifies the produced bundle. One small blocking gap before merge: the issue acceptance criteria includes: Please add a short section to python3 scripts/export_payment_guard_evidence.py --out proofpath-evidence-bundle/
python3 scripts/verify_audit_log.py proofpath-evidence-bundle/audit.jsonlAlso mention the output files: Optional but useful: add this to the local validation block: bash examples/agent-payment-guard/run_evidence_export_check.shAfter that, #152 should be merge-ready. Keep the non-goals as-is: no cloud upload, no archive packaging requirement, no signing, no SQLite, no wallets/SDK/RPC/JWS/EIP-712. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #151
What this adds
Two new files:
scripts/export_payment_guard_evidence.pyPortable evidence export script. Zero new dependencies (stdlib only).
Produces:
verification_report.jsonfields:generated_at— ISO 8601 UTC timestampbundle_type—"agent-payment-guard-evidence"audit_records_count— number of records in audit.jsonlreplay_store_nonces— number of spent nonces in replay-store.jsonhash_chain_valid— bool, result of inline chain verificationhash_chain_message— human-readable chain statussource_files— original paths of each inputcopied_files— list of files written into the bundleBehavior:
audit.jsonl→ hard fail with clear error messagereplay-store.json→ exports empty{}with a warning (pre-Add persistent replay store for signed intent nonces #149 migration path)hash_chain_valid: falsein report (export still completes)examples/agent-payment-guard/run_evidence_export_check.shSmoke test: spins up service → sends one valid ACCEPT → stops service → runs export → verifies bundle structure + report fields → re-runs
verify_audit_log.pyagainst bundledaudit.jsonl.Validation target
Non-goals
No cloud upload, no zip/tar, no signing, no SQLite, no new dependencies.