One interface for humans and agents
Every operational command supports--format json. The envelope always includes a schema version,
command, status, optional run identifier, structured data, and structured errors. Human-readable
output calls the same application service and safety kernel.
Contracts
A run manifest declares an exact scenario path and digest, seed, adapter, decision provider, policy, capability request, and resource limits. It cannot define grants or increase the built-in profile ceilings. Approval evidence contains the exact manifest SHA-256, reviewer identity, and approved capability scope. It provides provenance and change detection, not authentication. Protect or sign it outside an agent’s writable context when a stronger boundary is required.Stable exit codes
Evidence bundle
Each completed run contains the approved manifest, approval evidence, separated target and evaluator scenario views, canonical state and events, execution summary, and report. Pure-read bundles contain one final state, retrieval, context, decision, and assessment. Controlled CRAF bundles contain one shared initial state, per-arm final states and outputs, per-arm evaluator assessments, and a comparison assessment.inventory.json records the path, size, and SHA-256 of every file. Retain the inventory SHA-256
reported by risi run outside the bundle when an independent integrity anchor is needed.
The craf-reference manifest requests exactly three episodes and six retrieval calls. Its result is
controlled_mechanism_recovered only when the required control, vulnerable, and protected pattern
passes every evaluator invariant. This is a local synthetic engineering result, not a finding about
an external system.