Context

The README lists SARIF output as not implemented. SARIF would let teams surface agent-security regression failures through GitHub code scanning and other security dashboards.

Acceptance criteria

• Add a CLI flag such as --sarif-out <path>.
• Emit SARIF v2.1.0 with stable rule IDs for assertion types.
• Include scenario ID, assertion ID, result, severity, and evidence.
• Map failed assertions to SARIF results.
• Add tests for generated SARIF structure.
• Document limitations, especially that this is regression output rather than a scanner.

Useful files

• src/agent_harness/cli.py
• src/agent_harness/result.py
• schemas/result.schema.json
• README.md