AGENTS.md

1# SDP Runtime Assumptions for sdp-evidence-core
2 
3## Context Objects
4**CodingWorkflowStatement**: Primary context for all evidence operations
5Wraps in-toto StatementHeader with CodingWorkflowPredicate:
6- Intent (issue_id, trigger, risk_class)
7- Plan (workstreams), Execution (branch, changed_files)
8- Verification (tests, lint, coverage)
9- Boundary (declared vs observed paths)
10- Provenance (run_id, orchestrator, runtime)
11- Trace (commits, PR URL)
12 
13All operations (attestation, validation, signing, verification) consume/produce CodingWorkflowStatement.
14 
15## Environment Variables
16**Signing** (optional):
17- SIGSTORE_ID_TOKEN, COSIGN_KEY
18- GitHub Actions: GITHUB_ACTIONS, ACTIONS_ID_TOKEN_REQUEST_TOKEN, ACTIONS_ID_TOKEN_REQUEST_URL
19- SDP_SIGSTORE_STRICT_VERIFY=1 enforces verification
20 
21**Validation**: No env vars required (pure Go logic on evidence files)
22 
23## Configuration
24- CoverageThreshold: compareOptions.CoverageThreshold (default 5.0%)
25- FileScopeThreshold: fileScopeHighSeverityOver (default 3 files)
26- BoundaryValidation: Per-workstream in docs/workstreams/backlog/{workstream}.md
27 
28## Dependencies
29**Signing** (optional): in-toto-golang, sigstore-go, cosign CLI
30**Validation**: Stdlib encoding/json, crypto/sha256, in-toto-golang (StatementHeader only)
31**Trace**: internal/kernel.TraceEvent
32 
33## Coupling Risk
34Imports internal/kernel.TraceEvent (deliberate: evidence validates same trace shape kernel emits)
35No other internal dependencies; package is self-contained
36