feat: Agent Pack bundle format, on-chain verification, and conformance tests

.github/workflows/ci.yml

@@ -0,0 +1,130 @@
+name: CI
+
+on:
+  push:
+    branches: [main, develop, feature/*]
+  pull_request:
+    branches: [main, develop]
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: -D warnings
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          cache-on-failure: true
+
+      - name: Format check
+        run: cargo fmt --all -- --check
+
+      - name: Clippy
+        run: cargo clippy --workspace --all-targets --exclude risc0-methods -- -D warnings
+
+      - name: Build
+        run: cargo build --workspace --exclude risc0-methods
+
+      - name: Test
+        run: cargo test --workspace --exclude risc0-methods
+
+  solidity:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: contracts
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Foundry
+        uses: foundry-rs/foundry-toolchain@v1
+
+      - name: Build contracts
+        run: forge build
+
+      - name: Run all Solidity tests
+        run: forge test -vv
+
+      - name: Run conformance tests specifically
+        run: forge test --match-path test/KernelOutputParser.Conformance.t.sol -vvv
+
+  agent-pack:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          cache-on-failure: true
+
+      - name: Build agent-pack
+        run: cargo build -p agent-pack
+
+      - name: Test agent-pack
+        run: cargo test -p agent-pack
+
+      - name: Verify example manifest structure
+        run: |
+          cargo run -p agent-pack -- verify \
+            --structure-only \
+            --manifest dist/agent-pack.example.json
+
+      - name: Create bundle from fixture
+        run: |
+          cargo run -p agent-pack -- pack \
+            --manifest crates/agent-pack/tests/fixtures/test-manifest.json \
+            --elf crates/agent-pack/tests/fixtures/mock-guest.elf \
+            --out bundle-example
+
+      - name: Verify packed bundle
+        run: |
+          cargo run -p agent-pack -- verify \
+            --manifest bundle-example/agent-pack.json \
+            --base-dir bundle-example
+
+      - name: Upload bundle artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: agent-pack-bundle-example
+          path: bundle-example/
+
+  agent-pack-onchain:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          cache-on-failure: true
+
+      - name: Build agent-pack with onchain feature
+        run: cargo build -p agent-pack --features onchain
+
+      - name: Test agent-pack with onchain feature
+        run: cargo test -p agent-pack --features onchain
+
+      - name: Clippy with onchain feature
+        run: cargo clippy -p agent-pack --features onchain -- -D warnings
+
+  # Optional: Build with risc0 feature (requires additional setup)
+  # Uncomment when risc0 toolchain is available in CI
+  # agent-pack-risc0:
+  #   runs-on: ubuntu-latest
+  #   steps:
+  #     - uses: actions/checkout@v4
+  #     - uses: dtolnay/rust-toolchain@stable
+  #     - uses: risc0/risc0/.github/actions/install@main
+  #     - name: Build with risc0 feature
+  #       run: cargo build -p agent-pack --features risc0

.gitignore

@@ -2,4 +2,9 @@ CLAUDE.md
 target/
 */target/
 /.claude
-/prompts
+/prompts
+/bundles/*
+/run/*
+
+# Generated agent-pack manifests (keep only the example)
+dist/agent-pack.json

Cargo.toml

@@ -22,6 +22,7 @@ members = [
 
     # Tools
     "crates/agent-pack",
+    "crates/reference-integrator",
 ]
 
 [workspace.dependencies]

contracts/script/TestVerifyAndParse.s.sol

@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
-import {Script, console} from "forge-std/Script.sol";
-import {KernelExecutionVerifier} from "../src/KernelExecutionVerifier.sol";
+import { Script, console } from "forge-std/Script.sol";
+import { KernelExecutionVerifier } from "../src/KernelExecutionVerifier.sol";
 
 contract TestVerifyAndParse is Script {
     // Deployed contract address on Sepolia
@@ -16,10 +16,12 @@ contract TestVerifyAndParse is Script {
         KernelExecutionVerifier verifier = KernelExecutionVerifier(VERIFIER_ADDRESS);
 
         // Seal from zkVM proof (with selector prefix 0x73c457ba)
-        bytes memory seal = hex"73c457ba14a54a4b4694dafbf4de2a28afb50e08ad058997b71fbc5f0ceee539dd63f503016e967d32903d32812f4e950fb1035750b6c448ce3ba603e6a4162c1ac78f320a6e9cbd7ff7a966d430d4b541c5621fb5075f57d73af0737770361f832a7b07225de9bba2c86a3a5026d62643570fb01293631ea28358353f6c768f101d52492d4cf2637053c900c6149937bd8fec2b08de9c3c0e1db72989b35f255da1a32b2f0bfe9c1f2e9e4795ea0a183b5302a53386c6f96880f014d78631818b69e92f1436b22c0e6213d192df183e6df6523f5693f01dc8db8088474b51328e4a54892df02090e8f7db0fb979b45655747a58a0598e54e2d5d33e695cf2acee0a60a9";
+        bytes memory seal =
+            hex"73c457ba14a54a4b4694dafbf4de2a28afb50e08ad058997b71fbc5f0ceee539dd63f503016e967d32903d32812f4e950fb1035750b6c448ce3ba603e6a4162c1ac78f320a6e9cbd7ff7a966d430d4b541c5621fb5075f57d73af0737770361f832a7b07225de9bba2c86a3a5026d62643570fb01293631ea28358353f6c768f101d52492d4cf2637053c900c6149937bd8fec2b08de9c3c0e1db72989b35f255da1a32b2f0bfe9c1f2e9e4795ea0a183b5302a53386c6f96880f014d78631818b69e92f1436b22c0e6213d192df183e6df6523f5693f01dc8db8088474b51328e4a54892df02090e8f7db0fb979b45655747a58a0598e54e2d5d33e695cf2acee0a60a9";
 
         // Journal from zkVM proof (209 bytes)
-        bytes memory journal = hex"01000000010000004242424242424242424242424242424242424242424242424242424242424242943395a6221a2b9c6f62bac3a07f1fb05980f48e00f8b6bdb5eb738ac98499eebbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbcccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc01000000000000008b9f6c2e7972d334d9347953b2ad91c5283a5dc9f68e5f1309f1e012ece73334a4b1f22de8149ff8156f11d5aa0585e03844cc76b1d52f5e11b420312d64037101";
+        bytes memory journal =
+            hex"01000000010000004242424242424242424242424242424242424242424242424242424242424242943395a6221a2b9c6f62bac3a07f1fb05980f48e00f8b6bdb5eb738ac98499eebbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbcccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc01000000000000008b9f6c2e7972d334d9347953b2ad91c5283a5dc9f68e5f1309f1e012ece73334a4b1f22de8149ff8156f11d5aa0585e03844cc76b1d52f5e11b420312d64037101";
 
         console.log("=== Test verifyAndParse ===");
         console.log("Verifier address:", VERIFIER_ADDRESS);
@@ -37,14 +39,18 @@ contract TestVerifyAndParse is Script {
 
         if (registeredImageId == bytes32(0)) {
             console.log("\nAgent not registered. Run RegisterAgent script first.");
-            console.log("Command: forge script script/TestVerifyAndParse.s.sol:RegisterAgent --rpc-url $RPC_URL --broadcast");
+            console.log(
+                "Command: forge script script/TestVerifyAndParse.s.sol:RegisterAgent --rpc-url $RPC_URL --broadcast"
+            );
             return;
         }
 
         // Call verifyAndParse (view function, no broadcast needed)
         console.log("\nCalling verifyAndParse...");
 
-        try verifier.verifyAndParse(journal, seal) returns (KernelExecutionVerifier.ParsedJournal memory parsed) {
+        try verifier.verifyAndParse(journal, seal) returns (
+            KernelExecutionVerifier.ParsedJournal memory parsed
+        ) {
             console.log("\n=== Verification SUCCESS ===");
             console.log("Agent ID:");
             console.logBytes32(parsed.agentId);
@@ -91,6 +97,8 @@ contract RegisterAgent is Script {
         vm.stopBroadcast();
 
         console.log("\nAgent registered successfully!");
-        console.log("Now run: forge script script/TestVerifyAndParse.s.sol:TestVerifyAndParse --rpc-url $RPC_URL");
+        console.log(
+            "Now run: forge script script/TestVerifyAndParse.s.sol:TestVerifyAndParse --rpc-url $RPC_URL"
+        );
     }
 }

contracts/src/KernelExecutionVerifier.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.20;
 
-import {IRiscZeroVerifier} from "./interfaces/IRiscZeroVerifier.sol";
+import { IRiscZeroVerifier } from "./interfaces/IRiscZeroVerifier.sol";
 
 /// @title KernelExecutionVerifier
 /// @notice Verifies RISC Zero proofs of zkVM kernel execution and parses KernelJournalV1
@@ -140,7 +140,7 @@ contract KernelExecutionVerifier {
     /// @param seal The RISC Zero proof seal
     /// @return parsed The parsed and validated journal fields
     function verifyAndParse(bytes calldata journal, bytes calldata seal)
-        external 
+        external
         view
         returns (ParsedJournal memory parsed)
     {

contracts/src/KernelOutputParser.sol

@@ -172,7 +172,7 @@ library KernelOutputParser {
                 revert MalformedOutput(actionStart, actionLen, offset - actionStart);
             }
 
-            actions[i] = Action({actionType: actionType, target: target, payload: payload});
+            actions[i] = Action({ actionType: actionType, target: target, payload: payload });
         }
 
         // Verify we consumed all data
@@ -269,7 +269,11 @@ library KernelOutputParser {
     }
 
     /// @notice Read a bytes32 from calldata using assembly for robustness
-    function _readBytes32(bytes calldata data, uint256 offset) private pure returns (bytes32 result) {
+    function _readBytes32(bytes calldata data, uint256 offset)
+        private
+        pure
+        returns (bytes32 result)
+    {
         // Copy 32 bytes from calldata into memory and load as bytes32
         assembly {
             // calldataload loads 32 bytes from calldata at the given offset