@agent-inspect/mcp-server 6.26.0 → 6.28.0

package/dist/cli.cjs

@@ -2150,6 +2150,9 @@ function inferEvidenceFileRole(relativePath) {
   if (base === "check-results.json") {
     return "checks";
   }
+  if (base === "contract.resolved.json") {
+    return "contract";
+  }
   if (base === "redaction-report.json") {
     return "redaction-report";
   }
@@ -2216,670 +2219,204 @@ function buildEvidenceManifest(parts) {
     },
     assessment,
     ...parts.semantics !== void 0 ? { semantics: { ...parts.semantics } } : {},
+    ...parts.contract !== void 0 ? { contract: { ...parts.contract } } : {},
     files: buildEvidenceFileEntries(parts.files)
   };
 }
 
-// packages/core/src/exporters/helpers.ts
-var REDACT_SUBSTRINGS = [
+// packages/core/src/diagnostics/programmatic.ts
+var PROGRAMMATIC_DIAGNOSTIC_SPECS = Object.freeze({
+  AI_TRACE_INPUT_INVALID: {
+    code: "AI_TRACE_INPUT_INVALID",
+    summary: 'Expected { type: "file", path }, { type: "directory", path }, { type: "string", content }, { type: "buffer", content }, or { type: "stdin" }.',
+    remediation: "For a file path, use openTraceFile(path).",
+    relatedCodes: ["invalid_input"]
+  },
+  AI_TRACE_FORMAT_UNSUPPORTED: {
+    code: "AI_TRACE_FORMAT_UNSUPPORTED",
+    summary: "No trace reader could detect the input format.",
+    remediation: "Pass an AgentInspect JSONL file via openTraceFile, or set options.format to a registered reader.",
+    relatedCodes: ["unsupported_format"]
+  },
+  AI_TRACE_FORMAT_AMBIGUOUS: {
+    code: "AI_TRACE_FORMAT_AMBIGUOUS",
+    summary: "Multiple trace readers matched the input with equal confidence.",
+    remediation: "Set options.format explicitly to disambiguate the reader.",
+    relatedCodes: ["ambiguous_format"]
+  },
+  AI_TRACE_FACTS_INPUT_NOT_NORMALIZED: {
+    code: "AI_TRACE_FACTS_INPUT_NOT_NORMALIZED",
+    summary: "TraceFacts requires TraceReadResult or PersistedInspectEvent[].",
+    remediation: "Use openTraceFile() to normalize a JSONL trace first."
+  },
+  AI_TRACE_CONTRACT_RUN_SELECTION_REQUIRED: {
+    code: "AI_TRACE_CONTRACT_RUN_SELECTION_REQUIRED",
+    summary: "Multiple runs are available; select a run before executing checks.",
+    remediation: "Pass options.runId or TraceCheckInput.selectedRun.",
+    relatedCodes: ["AI_CHECK_RUN_SELECTION_REQUIRED"]
+  },
+  AI_TRACE_RELATIONSHIP_SELF_PARENT: {
+    code: "AI_TRACE_RELATIONSHIP_SELF_PARENT",
+    summary: "A parentId equals its own event/step id.",
+    remediation: "Reject at capture (AI_LANGGRAPH_SELF_PARENT_REJECTED) or drop via logical projection; do not invent replacement parents.",
+    relatedCodes: [
+      "AI_LANGGRAPH_SELF_PARENT_REJECTED",
+      "AI_LOGICAL_SELF_PARENT_REMOVED"
+    ]
+  },
+  AI_TRACE_RELATIONSHIP_CYCLE: {
+    code: "AI_TRACE_RELATIONSHIP_CYCLE",
+    summary: "Trace contains a parentId cycle.",
+    remediation: "Use visibility-first tree linking for legacy fixtures; prefer acyclic capture for new adapter output.",
+    relatedCodes: ["structure.cycle"]
+  }
+});
+function formatProgrammaticDiagnostic(code, detail) {
+  const spec = PROGRAMMATIC_DIAGNOSTIC_SPECS[code];
+  const summary = detail?.trim() ? detail.trim() : spec.summary;
+  return `${code}: ${summary} Remediation: ${spec.remediation}`;
+}
+
+// packages/core/src/safety/sensitive-key.ts
+function keyHasExplicitSeparator(value) {
+  return /[_\-.]/.test(value);
+}
+function normalizeSensitiveKey(value) {
+  return value.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+}
+var NON_CREDENTIAL_TOKEN_CONFIG_KEYS = new Set(
+  [
+    "tokens",
+    "max_tokens",
+    "min_tokens",
+    "ls_max_tokens",
+    "token_count",
+    "token_limit",
+    "token_budget",
+    "input_tokens",
+    "output_tokens",
+    "total_tokens",
+    "cached_tokens",
+    "prompt_tokens",
+    "completion_tokens"
+  ].map(normalizeSensitiveKey)
+);
+var DEFAULT_CREDENTIAL_SENSITIVE_KEYS = [
   "authorization",
   "cookie",
   "token",
+  "access_token",
+  "accesstoken",
+  "auth_token",
+  "authtoken",
+  "refresh_token",
+  "refreshtoken",
+  "id_token",
+  "idtoken",
+  "bearer_token",
+  "bearertoken",
+  "api_token",
+  "apitoken",
   "apikey",
+  "api_key",
   "password",
   "secret",
   "email"
 ];
-function shouldRedactKey(key) {
-  const k = key.toLowerCase();
-  for (const s of REDACT_SUBSTRINGS) {
-    if (k.includes(s)) return true;
-  }
-  return false;
+function isTokenCredentialKey(normalized) {
+  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
+  if (normalized === "token") return true;
+  if (normalized.endsWith("tokens")) return false;
+  return normalized.endsWith("token");
 }
-function safeString(value, maxLength) {
-  if (value === null || value === void 0) return "";
-  let s;
-  if (typeof value === "string") s = value;
-  else if (typeof value === "number" || typeof value === "boolean") s = String(value);
-  else s = stableJson(value, false);
-  if (maxLength !== void 0 && maxLength >= 0 && s.length > maxLength) {
-    return `${s.slice(0, maxLength)}\u2026`;
+function isCredentialSensitiveKey(key, sensitiveKeys = DEFAULT_CREDENTIAL_SENSITIVE_KEYS) {
+  if (!key) return false;
+  const normalized = normalizeSensitiveKey(key);
+  if (!normalized) return false;
+  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
+  const allowPrefixCompound = keyHasExplicitSeparator(key);
+  for (const sensitive of sensitiveKeys) {
+    const s = normalizeSensitiveKey(sensitive);
+    if (!s) continue;
+    if (s === "token") {
+      if (isTokenCredentialKey(normalized)) return true;
+      continue;
+    }
+    if (normalized === s) return true;
+    if (normalized.endsWith(`_${s}`)) return true;
+    if (allowPrefixCompound && normalized.startsWith(`${s}_`)) return true;
   }
-  return s;
-}
-function escapeMarkdown(value) {
-  return value.replace(/\|/g, "\\|").replace(/\r\n/g, "\n").replace(/\r/g, "\n").replace(/\n/g, " ");
+  return false;
 }
-function escapeHtml(value) {
-  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+
+// packages/core/src/checks/logical-events.ts
+function isRecord6(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function sortKeysDeep(input) {
-  if (input === null || typeof input !== "object") return input;
-  if (Array.isArray(input)) return input.map(sortKeysDeep);
-  const o = input;
-  const out = {};
-  for (const k of Object.keys(o).sort()) {
-    out[k] = sortKeysDeep(o[k]);
-  }
-  return out;
+function legacyEvent(event) {
+  const value = event.attributes?.legacyEvent;
+  return typeof value === "string" ? value : void 0;
 }
-function stableJson(value, pretty) {
-  const sorted = sortKeysDeep(value);
-  return pretty === true ? JSON.stringify(sorted, null, 2) : JSON.stringify(sorted);
+function stepIdOf(event) {
+  const value = event.attributes?.stepId;
+  if (typeof value === "string" && value.trim() !== "") return value;
+  return void 0;
 }
-function compactAttributes(attrs2, options) {
-  if (attrs2 === void 0) return {};
-  const maxLen = options?.maxLength ?? 500;
-  const redacted = options?.redacted ?? true;
-  const out = {};
-  for (const key of Object.keys(attrs2).sort()) {
-    if (redacted && shouldRedactKey(key)) {
-      out[key] = "[REDACTED]";
-      continue;
-    }
-    const v = attrs2[key];
-    out[key] = compactValue(v, maxLen, redacted);
-  }
-  return out;
+function cloneEvent(event) {
+  return {
+    ...event,
+    ...event.attributes !== void 0 ? { attributes: { ...event.attributes } } : {},
+    ...event.error !== void 0 ? { error: { ...event.error } } : {},
+    ...event.tokenUsage !== void 0 ? { tokenUsage: { ...event.tokenUsage } } : {},
+    ...event.source !== void 0 ? { source: { ...event.source } } : {}
+  };
 }
-function compactValue(value, maxLen, redacted) {
-  if (value === null || typeof value !== "object") {
-    return typeof value === "string" ? safeString(value, maxLen) : value;
-  }
-  if (Array.isArray(value)) {
-    const arr = value.slice(0, 20).map((x) => compactValue(x, maxLen, redacted));
-    if (value.length > 20) arr.push(`\u2026(+${value.length - 20} more)`);
-    return arr;
-  }
-  const o = value;
-  const inner = {};
-  for (const k of Object.keys(o)) {
-    if (redacted && shouldRedactKey(k)) inner[k] = "[REDACTED]";
-    else inner[k] = compactValue(o[k], maxLen, redacted);
+function mergeAttributes(start, complete) {
+  const merged = {
+    ...isRecord6(complete.attributes) ? complete.attributes : {},
+    ...isRecord6(start.attributes) ? start.attributes : {}
+  };
+  merged.legacyEvent = start.attributes?.legacyEvent ?? complete.attributes?.legacyEvent;
+  merged.legacyCompleteEvent = complete.attributes?.legacyEvent;
+  if (complete.attributes?.errorStack !== void 0) {
+    merged.errorStack = complete.attributes.errorStack;
   }
-  return inner;
+  return Object.keys(merged).length > 0 ? merged : void 0;
 }
-function flattenTree(tree) {
-  const out = [];
-  function walk(nodes) {
-    for (const n of nodes) {
-      out.push(n);
-      if (n.children.length > 0) walk(n.children);
+function pairStartComplete(start, complete) {
+  const attributes = mergeAttributes(start, complete);
+  const paired = {
+    ...cloneEvent(start),
+    status: complete.status,
+    timestamp: complete.timestamp ?? start.timestamp,
+    ...complete.endedAt !== void 0 ? { endedAt: complete.endedAt } : {},
+    ...complete.durationMs !== void 0 ? { durationMs: complete.durationMs } : {},
+    ...complete.error !== void 0 ? { error: { ...complete.error } } : {},
+    ...complete.tokenUsage !== void 0 && start.tokenUsage === void 0 ? { tokenUsage: { ...complete.tokenUsage } } : {},
+    ...attributes !== void 0 ? { attributes } : {}
+  };
+  return {
+    ...paired,
+    sourceEventIds: Object.freeze([start.eventId, complete.eventId]),
+    projection: {
+      paired: true,
+      absorbedEventIds: Object.freeze([complete.eventId]),
+      parentNormalized: false,
+      ...start.parentId !== void 0 ? { originalParentId: start.parentId } : {}
     }
-  }
-  walk(tree.children);
-  return out;
+  };
 }
-
-// packages/core/src/diff/comparable.ts
-function extractOutputPreview(meta) {
-  if (meta === void 0) return void 0;
-  if ("outputPreview" in meta) return meta.outputPreview;
-  if ("resultPreview" in meta) return meta.resultPreview;
-  return void 0;
-}
-function mapStepStatus(s) {
-  if (s === void 0) return "running";
-  return s;
-}
-function manualTraceEventsToComparableRun(events) {
-  const started = events.find((e) => e.event === "run_started");
-  if (!started || started.event !== "run_started") {
-    throw new Error("Invalid trace: missing run_started");
-  }
-  const rs = started;
-  const runId = rs.runId;
-  const completedAll = events.filter((e) => e.event === "run_completed");
-  const lastCompleted = completedAll[completedAll.length - 1];
-  let runStatus;
-  if (lastCompleted === void 0) runStatus = "running";
-  else runStatus = lastCompleted.status;
-  const durationMs = lastCompleted !== void 0 && Number.isFinite(lastCompleted.durationMs) ? lastCompleted.durationMs : void 0;
-  const steps = /* @__PURE__ */ new Map();
-  let order = 0;
-  for (const e of events) {
-    if (e.event !== "step_started") continue;
-    const s = e;
-    const meta = s.metadata ? { ...s.metadata } : void 0;
-    steps.set(s.stepId, {
-      id: s.stepId,
-      parentId: s.parentId,
-      name: s.name,
-      type: s.type,
-      order: order++,
-      timestamp: s.timestamp,
-      metadata: meta
-    });
-  }
-  for (const e of events) {
-    if (e.event !== "step_completed") continue;
-    const acc = steps.get(e.stepId);
-    if (!acc) continue;
-    acc.status = e.status;
-    acc.durationMs = e.durationMs;
-    if (e.error?.message) acc.errorMsg = e.error.message;
-    const extra = e;
-    if (extra.metadata !== void 0 && typeof extra.metadata === "object") {
-      acc.metadata = { ...acc.metadata ?? {}, ...extra.metadata };
-    }
-  }
-  const nodes = /* @__PURE__ */ new Map();
-  for (const acc of steps.values()) {
-    let meta = acc.metadata ? { ...acc.metadata } : void 0;
-    if (acc.parentId !== void 0 && !steps.has(acc.parentId)) {
-      meta = { ...meta ?? {}, agent_inspect_diff_parent_missing: true };
-    }
-    const outputPreview = extractOutputPreview(meta);
-    if (meta !== void 0 && ("outputPreview" in meta || "resultPreview" in meta)) {
-      delete meta.outputPreview;
-      delete meta.resultPreview;
-    }
-    const sc = {
-      id: acc.id,
-      name: acc.name,
-      type: acc.type,
-      status: mapStepStatus(acc.status),
-      durationMs: acc.durationMs,
-      error: acc.errorMsg,
-      metadata: meta && Object.keys(meta).length > 0 ? meta : void 0,
-      outputPreview,
-      children: []
-    };
-    nodes.set(acc.id, sc);
-  }
-  const roots = [];
-  const sortByOrder = (a, b) => {
-    const oa = steps.get(a.id)?.order ?? 0;
-    const ob = steps.get(b.id)?.order ?? 0;
-    return oa - ob;
-  };
-  for (const acc of steps.values()) {
-    const node = nodes.get(acc.id);
-    if (acc.parentId !== void 0 && nodes.has(acc.parentId)) {
-      nodes.get(acc.parentId).children.push(node);
-    } else {
-      roots.push(node);
-    }
-  }
-  roots.sort(sortByOrder);
-  for (const n of nodes.values()) {
-    n.children.sort(sortByOrder);
-  }
-  return {
-    runId,
-    name: rs.name,
-    status: runStatus,
-    durationMs,
-    steps: roots
-  };
-}
-
-// packages/core/src/diff/engine.ts
-var DEFAULT_THRESHOLD_MS = 0;
-function pathSeg(step, index) {
-  return { index, name: step.name, stepId: step.id };
-}
-function buildPath(segments) {
-  return { path: [...segments] };
-}
-function pairSteps(left, right) {
-  const usedRight = /* @__PURE__ */ new Set();
-  const pairs = [];
-  for (let i = 0; i < left.length; i++) {
-    const L = left[i];
-    let R = right.find((r) => !usedRight.has(r.id) && r.id === L.id);
-    if (R === void 0 && i < right.length && !usedRight.has(right[i].id)) {
-      const cand = right[i];
-      if (cand.name === L.name && (cand.type ?? "") === (L.type ?? "")) {
-        R = cand;
-      }
-    }
-    if (R === void 0) {
-      R = right.find(
-        (r) => !usedRight.has(r.id) && r.name === L.name && (r.type ?? "") === (L.type ?? "")
-      );
-    }
-    if (R !== void 0) {
-      usedRight.add(R.id);
-      pairs.push([L, R]);
-    } else {
-      pairs.push([L, void 0]);
-    }
-  }
-  for (const R of right) {
-    if (!usedRight.has(R.id)) {
-      pairs.push([void 0, R]);
-    }
-  }
-  return pairs;
-}
-function compareLeafSteps(L, R, segments, opts, out) {
-  const path17 = buildPath(segments);
-  if (L.name !== R.name) {
-    out.push({
-      kind: "structure",
-      severity: "warning",
-      message: "Step name differs",
-      path: path17,
-      left: L.name,
-      right: R.name
-    });
-  }
-  if ((L.type ?? "") !== (R.type ?? "")) {
-    out.push({
-      kind: "step-type",
-      severity: "warning",
-      message: "Step type differs",
-      path: path17,
-      left: L.type,
-      right: R.type
-    });
-  }
-  if ((L.status ?? "") !== (R.status ?? "")) {
-    out.push({
-      kind: "step-status",
-      severity: "warning",
-      message: "Step status differs",
-      path: path17,
-      left: L.status,
-      right: R.status
-    });
-  }
-  const le = L.error ?? "";
-  const re = R.error ?? "";
-  if (le !== re) {
-    out.push({
-      kind: "error",
-      severity: "error",
-      message: "Step error message differs",
-      path: path17,
-      left: le || void 0,
-      right: re || void 0
-    });
-  }
-  if (!opts.ignoreDuration) {
-    const ld = L.durationMs;
-    const rd = R.durationMs;
-    const th = opts.durationThresholdMs;
-    let differs = false;
-    if (ld === void 0 && rd === void 0) differs = false;
-    else if (ld === void 0 || rd === void 0) differs = true;
-    else differs = Math.abs(ld - rd) > th;
-    if (differs) {
-      out.push({
-        kind: "duration",
-        severity: "info",
-        message: "Step duration differs",
-        path: path17,
-        left: ld,
-        right: rd
-      });
-    }
-  }
-  const lm = stableJson(L.metadata ?? {});
-  const rm = stableJson(R.metadata ?? {});
-  if (lm !== rm) {
-    out.push({
-      kind: "metadata",
-      severity: "info",
-      message: "Step metadata differs",
-      path: path17,
-      left: L.metadata,
-      right: R.metadata
-    });
-  }
-  const lo = stableJson(L.outputPreview ?? null);
-  const ro = stableJson(R.outputPreview ?? null);
-  if (lo !== ro) {
-    out.push({
-      kind: "output",
-      severity: "info",
-      message: "Output preview differs",
-      path: path17,
-      left: L.outputPreview,
-      right: R.outputPreview
-    });
-  }
-}
-function compareRecursive(L, R, segments, opts, out) {
-  compareLeafSteps(L, R, segments, opts, out);
-  const pairs = pairSteps(L.children, R.children);
-  let ci = 0;
-  for (const [lch, rch] of pairs) {
-    if (lch !== void 0 && rch !== void 0) {
-      compareRecursive(lch, rch, [...segments, pathSeg(lch, ci)], opts, out);
-    } else if (lch !== void 0) {
-      out.push({
-        kind: "step-removed",
-        severity: "warning",
-        message: `Step only in left run: ${lch.name}`,
-        path: buildPath([...segments, pathSeg(lch, ci)]),
-        left: lch.id,
-        right: void 0
-      });
-    } else if (rch !== void 0) {
-      out.push({
-        kind: "step-added",
-        severity: "warning",
-        message: `Step only in right run: ${rch.name}`,
-        path: buildPath([...segments, pathSeg(rch, ci)]),
-        left: void 0,
-        right: rch.id
-      });
-    }
-    ci += 1;
-  }
-}
-function mergeDiffDefaults(options) {
-  return {
-    ignoreDuration: false,
-    durationThresholdMs: DEFAULT_THRESHOLD_MS,
-    focus: "all",
-    check: "all"
-  };
-}
-function kindMatchesFilter(kind, merged) {
-  return true;
-}
-function diffRuns(left, right, options) {
-  const merged = mergeDiffDefaults();
-  const opts = {
-    ignoreDuration: merged.ignoreDuration,
-    durationThresholdMs: merged.durationThresholdMs
-  };
-  const raw = [];
-  if ((left.status ?? "") !== (right.status ?? "")) {
-    raw.push({
-      kind: "run-status",
-      severity: "warning",
-      message: "Run completion status differs",
-      left: left.status,
-      right: right.status
-    });
-  }
-  {
-    const ld = left.durationMs;
-    const rd = right.durationMs;
-    const th = merged.durationThresholdMs;
-    let differs = false;
-    if (ld === void 0 && rd === void 0) differs = false;
-    else if (ld === void 0 || rd === void 0) differs = true;
-    else differs = Math.abs(ld - rd) > th;
-    if (differs) {
-      raw.push({
-        kind: "duration",
-        severity: "info",
-        message: "Run duration differs",
-        left: ld,
-        right: rd
-      });
-    }
-  }
-  const pairs = pairSteps(left.steps, right.steps);
-  let idx = 0;
-  for (const [ls, rs] of pairs) {
-    if (ls !== void 0 && rs !== void 0) {
-      compareRecursive(ls, rs, [pathSeg(ls, idx)], opts, raw);
-      idx += 1;
-    } else if (ls !== void 0) {
-      raw.push({
-        kind: "step-removed",
-        severity: "warning",
-        message: `Step only in left run: ${ls.name}`,
-        path: buildPath([pathSeg(ls, idx)]),
-        left: ls.id,
-        right: void 0
-      });
-      idx += 1;
-    } else if (rs !== void 0) {
-      raw.push({
-        kind: "step-added",
-        severity: "warning",
-        message: `Step only in right run: ${rs.name}`,
-        path: buildPath([pathSeg(rs, idx)]),
-        left: void 0,
-        right: rs.id
-      });
-      idx += 1;
-    }
-  }
-  const differences = raw.filter((d) => kindMatchesFilter(d.kind));
-  let errors = 0;
-  let warnings = 0;
-  let info = 0;
-  for (const d of differences) {
-    if (d.severity === "error") errors += 1;
-    else if (d.severity === "warning") warnings += 1;
-    else info += 1;
-  }
-  const firstVisible = differences[0];
-  const firstDivergence = firstVisible !== void 0 ? {
-    kind: "first-divergence",
-    severity: firstVisible.severity,
-    message: `First divergence: ${firstVisible.message}`,
-    path: firstVisible.path,
-    left: firstVisible.left,
-    right: firstVisible.right
-  } : void 0;
-  const summary = {
-    leftRunId: left.runId,
-    rightRunId: right.runId,
-    totalDifferences: differences.length,
-    errors,
-    warnings,
-    info,
-    firstDivergence
-  };
-  return { summary, differences };
-}
-
-// packages/core/src/evidence/zip.ts
-(() => {
-  const table = new Uint32Array(256);
-  for (let n = 0; n < 256; n += 1) {
-    let c = n;
-    for (let k = 0; k < 8; k += 1) {
-      c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
-    }
-    table[n] = c >>> 0;
-  }
-  return table;
-})();
-
-// packages/core/src/diagnostics/programmatic.ts
-var PROGRAMMATIC_DIAGNOSTIC_SPECS = Object.freeze({
-  AI_TRACE_INPUT_INVALID: {
-    code: "AI_TRACE_INPUT_INVALID",
-    summary: 'Expected { type: "file", path }, { type: "directory", path }, { type: "string", content }, { type: "buffer", content }, or { type: "stdin" }.',
-    remediation: "For a file path, use openTraceFile(path).",
-    relatedCodes: ["invalid_input"]
-  },
-  AI_TRACE_FORMAT_UNSUPPORTED: {
-    code: "AI_TRACE_FORMAT_UNSUPPORTED",
-    summary: "No trace reader could detect the input format.",
-    remediation: "Pass an AgentInspect JSONL file via openTraceFile, or set options.format to a registered reader.",
-    relatedCodes: ["unsupported_format"]
-  },
-  AI_TRACE_FORMAT_AMBIGUOUS: {
-    code: "AI_TRACE_FORMAT_AMBIGUOUS",
-    summary: "Multiple trace readers matched the input with equal confidence.",
-    remediation: "Set options.format explicitly to disambiguate the reader.",
-    relatedCodes: ["ambiguous_format"]
-  },
-  AI_TRACE_FACTS_INPUT_NOT_NORMALIZED: {
-    code: "AI_TRACE_FACTS_INPUT_NOT_NORMALIZED",
-    summary: "TraceFacts requires TraceReadResult or PersistedInspectEvent[].",
-    remediation: "Use openTraceFile() to normalize a JSONL trace first."
-  },
-  AI_TRACE_CONTRACT_RUN_SELECTION_REQUIRED: {
-    code: "AI_TRACE_CONTRACT_RUN_SELECTION_REQUIRED",
-    summary: "Multiple runs are available; select a run before executing checks.",
-    remediation: "Pass options.runId or TraceCheckInput.selectedRun.",
-    relatedCodes: ["AI_CHECK_RUN_SELECTION_REQUIRED"]
-  },
-  AI_TRACE_RELATIONSHIP_SELF_PARENT: {
-    code: "AI_TRACE_RELATIONSHIP_SELF_PARENT",
-    summary: "A parentId equals its own event/step id.",
-    remediation: "Reject at capture (AI_LANGGRAPH_SELF_PARENT_REJECTED) or drop via logical projection; do not invent replacement parents.",
-    relatedCodes: [
-      "AI_LANGGRAPH_SELF_PARENT_REJECTED",
-      "AI_LOGICAL_SELF_PARENT_REMOVED"
-    ]
-  },
-  AI_TRACE_RELATIONSHIP_CYCLE: {
-    code: "AI_TRACE_RELATIONSHIP_CYCLE",
-    summary: "Trace contains a parentId cycle.",
-    remediation: "Use visibility-first tree linking for legacy fixtures; prefer acyclic capture for new adapter output.",
-    relatedCodes: ["structure.cycle"]
-  }
-});
-function formatProgrammaticDiagnostic(code, detail) {
-  const spec = PROGRAMMATIC_DIAGNOSTIC_SPECS[code];
-  const summary = detail?.trim() ? detail.trim() : spec.summary;
-  return `${code}: ${summary} Remediation: ${spec.remediation}`;
-}
-
-// packages/core/src/safety/sensitive-key.ts
-function keyHasExplicitSeparator(value) {
-  return /[_\-.]/.test(value);
-}
-function normalizeSensitiveKey(value) {
-  return value.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-}
-var NON_CREDENTIAL_TOKEN_CONFIG_KEYS = new Set(
-  [
-    "tokens",
-    "max_tokens",
-    "min_tokens",
-    "ls_max_tokens",
-    "token_count",
-    "token_limit",
-    "token_budget",
-    "input_tokens",
-    "output_tokens",
-    "total_tokens",
-    "cached_tokens",
-    "prompt_tokens",
-    "completion_tokens"
-  ].map(normalizeSensitiveKey)
-);
-var DEFAULT_CREDENTIAL_SENSITIVE_KEYS = [
-  "authorization",
-  "cookie",
-  "token",
-  "access_token",
-  "accesstoken",
-  "auth_token",
-  "authtoken",
-  "refresh_token",
-  "refreshtoken",
-  "id_token",
-  "idtoken",
-  "bearer_token",
-  "bearertoken",
-  "api_token",
-  "apitoken",
-  "apikey",
-  "api_key",
-  "password",
-  "secret",
-  "email"
-];
-function isTokenCredentialKey(normalized) {
-  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
-  if (normalized === "token") return true;
-  if (normalized.endsWith("tokens")) return false;
-  return normalized.endsWith("token");
-}
-function isCredentialSensitiveKey(key, sensitiveKeys = DEFAULT_CREDENTIAL_SENSITIVE_KEYS) {
-  if (!key) return false;
-  const normalized = normalizeSensitiveKey(key);
-  if (!normalized) return false;
-  if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
-  const allowPrefixCompound = keyHasExplicitSeparator(key);
-  for (const sensitive of sensitiveKeys) {
-    const s = normalizeSensitiveKey(sensitive);
-    if (!s) continue;
-    if (s === "token") {
-      if (isTokenCredentialKey(normalized)) return true;
-      continue;
-    }
-    if (normalized === s) return true;
-    if (normalized.endsWith(`_${s}`)) return true;
-    if (allowPrefixCompound && normalized.startsWith(`${s}_`)) return true;
-  }
-  return false;
-}
-
-// packages/core/src/checks/logical-events.ts
-function isRecord6(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function legacyEvent(event) {
-  const value = event.attributes?.legacyEvent;
-  return typeof value === "string" ? value : void 0;
-}
-function stepIdOf(event) {
-  const value = event.attributes?.stepId;
-  if (typeof value === "string" && value.trim() !== "") return value;
-  return void 0;
-}
-function cloneEvent(event) {
-  return {
-    ...event,
-    ...event.attributes !== void 0 ? { attributes: { ...event.attributes } } : {},
-    ...event.error !== void 0 ? { error: { ...event.error } } : {},
-    ...event.tokenUsage !== void 0 ? { tokenUsage: { ...event.tokenUsage } } : {},
-    ...event.source !== void 0 ? { source: { ...event.source } } : {}
-  };
-}
-function mergeAttributes(start, complete) {
-  const merged = {
-    ...isRecord6(complete.attributes) ? complete.attributes : {},
-    ...isRecord6(start.attributes) ? start.attributes : {}
-  };
-  merged.legacyEvent = start.attributes?.legacyEvent ?? complete.attributes?.legacyEvent;
-  merged.legacyCompleteEvent = complete.attributes?.legacyEvent;
-  if (complete.attributes?.errorStack !== void 0) {
-    merged.errorStack = complete.attributes.errorStack;
-  }
-  return Object.keys(merged).length > 0 ? merged : void 0;
-}
-function pairStartComplete(start, complete) {
-  const attributes = mergeAttributes(start, complete);
-  const paired = {
-    ...cloneEvent(start),
-    status: complete.status,
-    timestamp: complete.timestamp ?? start.timestamp,
-    ...complete.endedAt !== void 0 ? { endedAt: complete.endedAt } : {},
-    ...complete.durationMs !== void 0 ? { durationMs: complete.durationMs } : {},
-    ...complete.error !== void 0 ? { error: { ...complete.error } } : {},
-    ...complete.tokenUsage !== void 0 && start.tokenUsage === void 0 ? { tokenUsage: { ...complete.tokenUsage } } : {},
-    ...attributes !== void 0 ? { attributes } : {}
-  };
-  return {
-    ...paired,
-    sourceEventIds: Object.freeze([start.eventId, complete.eventId]),
-    projection: {
-      paired: true,
-      absorbedEventIds: Object.freeze([complete.eventId]),
-      parentNormalized: false,
-      ...start.parentId !== void 0 ? { originalParentId: start.parentId } : {}
-    }
-  };
-}
-function asLogical(event, extras) {
-  return {
-    ...cloneEvent(event),
-    sourceEventIds: Object.freeze([event.eventId]),
-    projection: {
-      paired: false,
-      absorbedEventIds: Object.freeze([]),
-      parentNormalized: extras?.parentNormalized === true,
-      ...{}
-    }
-  };
+function asLogical(event, extras) {
+  return {
+    ...cloneEvent(event),
+    sourceEventIds: Object.freeze([event.eventId]),
+    projection: {
+      paired: false,
+      absorbedEventIds: Object.freeze([]),
+      parentNormalized: extras?.parentNormalized === true,
+      ...{}
+    }
+  };
 }
 function projectLogicalEvents(events) {
   const diagnostics = [];
@@ -2967,1441 +2504,1908 @@ function projectLogicalEvents(events) {
         message: `No matching start for complete ${complete.eventId}.`,
         eventIds: [complete.eventId]
       });
-      const alone = asLogical(complete);
-      logical.push(alone);
-      logicalByRawId.set(complete.eventId, alone);
-      const stepId = stepIdOf(complete);
-      if (stepId && !stepIdToLogicalId.has(`${runId}:${stepId}`)) {
-        stepIdToLogicalId.set(`${runId}:${stepId}`, alone.eventId);
-      }
+      const alone = asLogical(complete);
+      logical.push(alone);
+      logicalByRawId.set(complete.eventId, alone);
+      const stepId = stepIdOf(complete);
+      if (stepId && !stepIdToLogicalId.has(`${runId}:${stepId}`)) {
+        stepIdToLogicalId.set(`${runId}:${stepId}`, alone.eventId);
+      }
+    }
+    for (const event of others) {
+      const alone = asLogical(event);
+      logical.push(alone);
+      logicalByRawId.set(event.eventId, alone);
+      const stepId = stepIdOf(event);
+      if (stepId && !stepIdToLogicalId.has(`${runId}:${stepId}`)) {
+        stepIdToLogicalId.set(`${runId}:${stepId}`, alone.eventId);
+      }
+    }
+  }
+  const logicalById = new Map(logical.map((e) => [e.eventId, e]));
+  const normalized = [];
+  for (const event of logical) {
+    const originalParentId = event.parentId;
+    if (!originalParentId) {
+      normalized.push(event);
+      continue;
+    }
+    let nextParent = originalParentId;
+    let remapped = false;
+    const viaAbsorbed = logicalByRawId.get(originalParentId);
+    if (viaAbsorbed && viaAbsorbed.eventId !== originalParentId) {
+      nextParent = viaAbsorbed.eventId;
+      remapped = true;
+    } else if (!logicalById.has(originalParentId)) {
+      const viaStep = stepIdToLogicalId.get(`${event.runId}:${originalParentId}`);
+      if (viaStep) {
+        nextParent = viaStep;
+        remapped = true;
+      }
+    }
+    if (!remapped) {
+      if (originalParentId === event.eventId) {
+        diagnostics.push({
+          code: "AI_LOGICAL_SELF_PARENT_REMOVED",
+          message: formatProgrammaticDiagnostic(
+            "AI_TRACE_RELATIONSHIP_SELF_PARENT",
+            `Removed self-parent edge on ${event.eventId}.`
+          ),
+          eventIds: [event.eventId]
+        });
+        const { parentId: _drop, ...rest } = event;
+        normalized.push({
+          ...rest,
+          projection: {
+            ...event.projection,
+            parentNormalized: true,
+            originalParentId
+          }
+        });
+        continue;
+      }
+      if (!logicalById.has(originalParentId) && !logicalByRawId.has(originalParentId)) {
+        const mapping = event.attributes?.parentMapping;
+        const unresolved = mapping === "unresolved" || event.attributes?.parentUnresolved === true || event.attributes?.unresolvedParent === true || // LangGraph/framework scaffolding sentinel labels are not event ids.
+        /^LangGraph$/i.test(originalParentId) || originalParentId.startsWith("unresolved:");
+        if (!unresolved) {
+          diagnostics.push({
+            code: "AI_LOGICAL_PARENT_UNRESOLVED",
+            message: `Parent ${originalParentId} unresolved for ${event.eventId}.`,
+            eventIds: [event.eventId]
+          });
+        }
+      }
+      normalized.push(event);
+      continue;
+    }
+    if (nextParent === event.eventId) {
+      diagnostics.push({
+        code: "AI_LOGICAL_SELF_PARENT_REMOVED",
+        message: formatProgrammaticDiagnostic(
+          "AI_TRACE_RELATIONSHIP_SELF_PARENT",
+          `Removed self-parent edge on ${event.eventId} (was ${originalParentId}).`
+        ),
+        eventIds: [event.eventId]
+      });
+      const { parentId: _drop, ...rest } = event;
+      normalized.push({
+        ...rest,
+        projection: {
+          ...event.projection,
+          parentNormalized: true,
+          originalParentId
+        }
+      });
+      continue;
+    }
+    diagnostics.push({
+      code: "AI_LOGICAL_PARENT_REMAPPED",
+      message: `Remapped parent ${originalParentId} \u2192 ${nextParent} for ${event.eventId}.`,
+      eventIds: [event.eventId]
+    });
+    normalized.push({
+      ...event,
+      parentId: nextParent,
+      projection: {
+        ...event.projection,
+        parentNormalized: true,
+        originalParentId
+      }
+    });
+  }
+  const rawIndex = new Map(events.map((e, i) => [e.eventId, i]));
+  normalized.sort((a, b) => {
+    const ai = rawIndex.get(a.sourceEventIds[0]) ?? 0;
+    const bi = rawIndex.get(b.sourceEventIds[0]) ?? 0;
+    return ai - bi || a.eventId.localeCompare(b.eventId);
+  });
+  return {
+    logicalEvents: Object.freeze(normalized),
+    diagnostics: Object.freeze(diagnostics)
+  };
+}
+function resolveCanonicalToolName(event) {
+  const attrs2 = event.attributes;
+  const direct = pickString(attrs2, ["toolName", "tool"]);
+  if (direct) return direct;
+  const metadata = attrs2?.metadata;
+  if (isRecord6(metadata)) {
+    const nested = pickString(metadata, ["toolName", "tool"]);
+    if (nested) return nested;
+  }
+  for (const prefix of ["tool:", "function:", "mcp-tools:"]) {
+    if (event.name.startsWith(prefix)) return event.name.slice(prefix.length);
+  }
+  return event.name;
+}
+function pickString(record, keys) {
+  if (!record) return void 0;
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === "string" && value.trim() !== "") return value.trim();
+  }
+  return void 0;
+}
+
+// packages/core/src/checks/derived-failure.ts
+function isRecord7(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function pickString2(record, keys) {
+  if (!record) return void 0;
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === "string" && value.trim() !== "") return value;
+  }
+  return void 0;
+}
+function pickNumber(record, keys) {
+  if (!record) return void 0;
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+      return value;
+    }
+  }
+  return void 0;
+}
+function eventMetadata(event) {
+  const attrs2 = isRecord7(event.attributes) ? event.attributes : void 0;
+  const nested = attrs2 !== void 0 && isRecord7(attrs2.metadata) ? attrs2.metadata : void 0;
+  return {
+    ...attrs2 ?? {},
+    ...nested ?? {}
+  };
+}
+function canonicalName(event) {
+  if (event.kind === "TOOL") return resolveCanonicalToolName(event);
+  return event.name;
+}
+function linkKeys(event) {
+  const meta = eventMetadata(event);
+  const keys = [];
+  for (const key of ["linkedStepId", "toolCallId", "mcpToolCallId"]) {
+    const value = pickString2(meta, [key]);
+    if (value !== void 0) keys.push(`${key}:${value}`);
+  }
+  const stepId = pickString2(meta, ["stepId"]);
+  if (stepId !== void 0) keys.push(`stepId:${stepId}`);
+  return keys;
+}
+function buildRunContexts(logicalEvents) {
+  const byRun = /* @__PURE__ */ new Map();
+  for (const event of logicalEvents) {
+    const existing = byRun.get(event.runId) ?? {
+      runId: event.runId,
+      name: event.name
+    };
+    const meta = eventMetadata(event);
+    if (event.kind === "RUN" || existing.name === event.runId) {
+      existing.name = event.name || existing.name;
+    }
+    if (event.kind === "RUN" && event.status !== void 0 && event.status !== "running") {
+      existing.status = event.status;
+    }
+    existing.retryOf ??= pickString2(meta, ["retryOf"]);
+    existing.attempt ??= pickNumber(meta, ["attempt", "retryAttempt", "retryCount"]);
+    existing.sessionId ??= pickString2(meta, ["sessionId", "conversationId"]);
+    existing.groupId ??= pickString2(meta, ["groupId"]);
+    existing.parentGroupId ??= pickString2(meta, ["parentGroupId"]);
+    existing.fallbackOf ??= pickString2(meta, ["fallbackOf", "fallbackFrom"]);
+    byRun.set(event.runId, existing);
+  }
+  return byRun;
+}
+function sameCorrelationScope(a, b) {
+  if (a.sessionId && b.sessionId && a.sessionId === b.sessionId) return true;
+  if (a.groupId && b.groupId && a.groupId === b.groupId) return true;
+  if (a.parentGroupId && b.parentGroupId && a.parentGroupId === b.parentGroupId) {
+    return true;
+  }
+  return false;
+}
+function isSuccessful(event) {
+  return event.status === "ok";
+}
+function isFailure(event) {
+  return event.status === "error";
+}
+function compareEventOrder(a, b) {
+  const byTime = a.timestamp.localeCompare(b.timestamp);
+  if (byTime !== 0) return byTime;
+  return a.eventId.localeCompare(b.eventId);
+}
+function collectCandidates(failure, logicalEvents, runs) {
+  const failureRun = runs.get(failure.runId);
+  const failureLinks = new Set(linkKeys(failure));
+  const failureName = canonicalName(failure);
+  const failureAttempt = pickNumber(eventMetadata(failure), ["attempt", "retryAttempt", "retryCount"]) ?? failureRun?.attempt;
+  const candidates = [];
+  for (const event of logicalEvents) {
+    if (event.eventId === failure.eventId) continue;
+    if (event.status === "running") continue;
+    const eventRun = runs.get(event.runId);
+    const eventMeta = eventMetadata(event);
+    const sameRun = event.runId === failure.runId;
+    if (eventRun?.retryOf === failure.runId) {
+      candidates.push({
+        event,
+        basis: "retryOf",
+        confidence: "explicit",
+        viaRunId: event.runId
+      });
+      continue;
     }
-    for (const event of others) {
-      const alone = asLogical(event);
-      logical.push(alone);
-      logicalByRawId.set(event.eventId, alone);
-      const stepId = stepIdOf(event);
-      if (stepId && !stepIdToLogicalId.has(`${runId}:${stepId}`)) {
-        stepIdToLogicalId.set(`${runId}:${stepId}`, alone.eventId);
-      }
+    if (eventRun?.fallbackOf === failure.runId || pickString2(eventMeta, ["fallbackOf", "fallbackFrom"]) === failure.runId) {
+      candidates.push({
+        event,
+        basis: "fallbackOf",
+        confidence: "explicit",
+        viaRunId: event.runId
+      });
+      continue;
     }
-  }
-  const logicalById = new Map(logical.map((e) => [e.eventId, e]));
-  const normalized = [];
-  for (const event of logical) {
-    const originalParentId = event.parentId;
-    if (!originalParentId) {
-      normalized.push(event);
+    if (sameRun && compareEventOrder(failure, event) >= 0) continue;
+    const eventLinks = linkKeys(event);
+    const sharedLink = eventLinks.find((key) => failureLinks.has(key));
+    if (sharedLink !== void 0) {
+      candidates.push({
+        event,
+        basis: sharedLink.split(":")[0] ?? "linkedId",
+        confidence: "explicit"
+      });
       continue;
     }
-    let nextParent = originalParentId;
-    let remapped = false;
-    const viaAbsorbed = logicalByRawId.get(originalParentId);
-    if (viaAbsorbed && viaAbsorbed.eventId !== originalParentId) {
-      nextParent = viaAbsorbed.eventId;
-      remapped = true;
-    } else if (!logicalById.has(originalParentId)) {
-      const viaStep = stepIdToLogicalId.get(`${event.runId}:${originalParentId}`);
-      if (viaStep) {
-        nextParent = viaStep;
-        remapped = true;
-      }
+    const eventAttempt = pickNumber(eventMeta, ["attempt", "retryAttempt", "retryCount"]) ?? eventRun?.attempt;
+    const sameParent = failure.parentId !== void 0 && event.parentId !== void 0 && failure.parentId === event.parentId;
+    const differentParent = failure.parentId !== void 0 && event.parentId !== void 0 && failure.parentId !== event.parentId;
+    const sessionScoped = failureRun !== void 0 && eventRun !== void 0 && sameCorrelationScope(failureRun, eventRun);
+    if (canonicalName(event) === failureName && failureAttempt !== void 0 && eventAttempt !== void 0 && eventAttempt > failureAttempt && !differentParent && (sameParent || sessionScoped || sameRun)) {
+      candidates.push({
+        event,
+        basis: "attempt-progression",
+        confidence: "correlated",
+        ...event.runId !== failure.runId ? { viaRunId: event.runId } : {}
+      });
     }
-    if (!remapped) {
-      if (originalParentId === event.eventId) {
-        diagnostics.push({
-          code: "AI_LOGICAL_SELF_PARENT_REMOVED",
-          message: formatProgrammaticDiagnostic(
-            "AI_TRACE_RELATIONSHIP_SELF_PARENT",
-            `Removed self-parent edge on ${event.eventId}.`
-          ),
-          eventIds: [event.eventId]
-        });
-        const { parentId: _drop, ...rest } = event;
-        normalized.push({
-          ...rest,
-          projection: {
-            ...event.projection,
-            parentNormalized: true,
-            originalParentId
-          }
-        });
-        continue;
-      }
-      if (!logicalById.has(originalParentId) && !logicalByRawId.has(originalParentId)) {
-        const mapping = event.attributes?.parentMapping;
-        const unresolved = mapping === "unresolved" || event.attributes?.parentUnresolved === true || event.attributes?.unresolvedParent === true || // LangGraph/framework scaffolding sentinel labels are not event ids.
-        /^LangGraph$/i.test(originalParentId) || originalParentId.startsWith("unresolved:");
-        if (!unresolved) {
-          diagnostics.push({
-            code: "AI_LOGICAL_PARENT_UNRESOLVED",
-            message: `Parent ${originalParentId} unresolved for ${event.eventId}.`,
-            eventIds: [event.eventId]
-          });
-        }
-      }
-      normalized.push(event);
-      continue;
+  }
+  const byId = /* @__PURE__ */ new Map();
+  for (const candidate of candidates) {
+    const prev = byId.get(candidate.event.eventId);
+    if (!prev || prev.confidence !== "explicit" && candidate.confidence === "explicit") {
+      byId.set(candidate.event.eventId, candidate);
     }
-    if (nextParent === event.eventId) {
-      diagnostics.push({
-        code: "AI_LOGICAL_SELF_PARENT_REMOVED",
-        message: formatProgrammaticDiagnostic(
-          "AI_TRACE_RELATIONSHIP_SELF_PARENT",
-          `Removed self-parent edge on ${event.eventId} (was ${originalParentId}).`
+  }
+  return [...byId.values()].sort((a, b) => compareEventOrder(a.event, b.event));
+}
+function classifyFailure(failure, candidates, runs, logicalEvents) {
+  const successful = candidates.filter((c) => isSuccessful(c.event));
+  const unsuccessful = candidates.filter((c) => !isSuccessful(c.event));
+  const retryRunIds = Object.freeze(
+    [...new Set(candidates.map((c) => c.viaRunId).filter((id) => id !== void 0))].sort(
+      (a, b) => a.localeCompare(b)
+    )
+  );
+  if (successful.length > 1) {
+    const distinctRuns = new Set(successful.map((c) => c.event.runId));
+    const distinctParents = new Set(
+      successful.map((c) => c.event.parentId ?? "").filter((id) => id !== "")
+    );
+    if (distinctRuns.size > 1 || distinctParents.size > 1) {
+      return {
+        eventId: failure.eventId,
+        runId: failure.runId,
+        name: failure.name,
+        kind: failure.kind,
+        role: "unknown",
+        confidence: "unknown",
+        basis: Object.freeze(["ambiguous-recovery-candidates"]),
+        recoveryEventIds: Object.freeze(
+          successful.map((c) => c.event.eventId).sort((a, b) => a.localeCompare(b))
         ),
-        eventIds: [event.eventId]
-      });
-      const { parentId: _drop, ...rest } = event;
-      normalized.push({
-        ...rest,
-        projection: {
-          ...event.projection,
-          parentNormalized: true,
-          originalParentId
-        }
-      });
-      continue;
+        retryRunIds
+      };
     }
-    diagnostics.push({
-      code: "AI_LOGICAL_PARENT_REMAPPED",
-      message: `Remapped parent ${originalParentId} \u2192 ${nextParent} for ${event.eventId}.`,
-      eventIds: [event.eventId]
-    });
-    normalized.push({
-      ...event,
-      parentId: nextParent,
-      projection: {
-        ...event.projection,
-        parentNormalized: true,
-        originalParentId
-      }
-    });
   }
-  const rawIndex = new Map(events.map((e, i) => [e.eventId, i]));
-  normalized.sort((a, b) => {
-    const ai = rawIndex.get(a.sourceEventIds[0]) ?? 0;
-    const bi = rawIndex.get(b.sourceEventIds[0]) ?? 0;
-    return ai - bi || a.eventId.localeCompare(b.eventId);
-  });
+  if (successful.length >= 1) {
+    const best = successful[0];
+    return {
+      eventId: failure.eventId,
+      runId: failure.runId,
+      name: failure.name,
+      kind: failure.kind,
+      role: "recovered",
+      confidence: best.confidence,
+      basis: Object.freeze([best.basis]),
+      recoveryEventIds: Object.freeze(
+        successful.map((c) => c.event.eventId).sort((a, b) => a.localeCompare(b))
+      ),
+      retryRunIds
+    };
+  }
+  if (candidates.length > 0) {
+    const best = candidates[0];
+    return {
+      eventId: failure.eventId,
+      runId: failure.runId,
+      name: failure.name,
+      kind: failure.kind,
+      role: "transient",
+      confidence: best.confidence,
+      basis: Object.freeze([
+        best.basis,
+        unsuccessful.some((c) => c.event.status === void 0) ? "retry-incomplete" : "retry-without-success"
+      ]),
+      recoveryEventIds: Object.freeze([]),
+      retryRunIds
+    };
+  }
+  const failureMeta = eventMetadata(failure);
+  const declaredSuccessor = pickString2(failureMeta, [
+    "retriedBy",
+    "nextRetryRunId",
+    "retryRunId"
+  ]);
+  if (declaredSuccessor !== void 0 && !runs.has(declaredSuccessor)) {
+    return {
+      eventId: failure.eventId,
+      runId: failure.runId,
+      name: failure.name,
+      kind: failure.kind,
+      role: "transient",
+      confidence: "explicit",
+      basis: Object.freeze(["retry-declared", "retry-run-missing"]),
+      recoveryEventIds: Object.freeze([]),
+      retryRunIds: Object.freeze([declaredSuccessor])
+    };
+  }
+  for (const run of runs.values()) {
+    if (run.retryOf === failure.runId) {
+      return {
+        eventId: failure.eventId,
+        runId: failure.runId,
+        name: failure.name,
+        kind: failure.kind,
+        role: "transient",
+        confidence: "explicit",
+        basis: Object.freeze(["retryOf", "retry-run-missing-or-empty"]),
+        recoveryEventIds: Object.freeze([]),
+        retryRunIds: Object.freeze([run.runId])
+      };
+    }
+  }
+  const failureRun = runs.get(failure.runId);
+  const hasSuccessorDeclared = [...runs.values()].some((run) => run.retryOf === failure.runId);
+  const isFinalInChain = failureRun !== void 0 && !hasSuccessorDeclared && (failureRun.retryOf !== void 0 || failureRun.attempt !== void 0 && failureRun.attempt > 1 || pickNumber(eventMetadata(failure), ["attempt"]) !== void 0);
+  if (isFinalInChain && failureRun?.status === "error" && !logicalEvents.some(
+    (event) => event.runId === failure.runId && event.eventId !== failure.eventId && isSuccessful(event) && canonicalName(event) === canonicalName(failure)
+  )) {
+    return {
+      eventId: failure.eventId,
+      runId: failure.runId,
+      name: failure.name,
+      kind: failure.kind,
+      role: "terminal",
+      confidence: failureRun.retryOf !== void 0 ? "explicit" : "correlated",
+      basis: Object.freeze(["final-retry-chain-member", "enclosing-run-error"]),
+      recoveryEventIds: Object.freeze([]),
+      retryRunIds: Object.freeze(
+        failureRun.retryOf !== void 0 ? [failureRun.retryOf] : []
+      )
+    };
+  }
   return {
-    logicalEvents: Object.freeze(normalized),
-    diagnostics: Object.freeze(diagnostics)
+    eventId: failure.eventId,
+    runId: failure.runId,
+    name: failure.name,
+    kind: failure.kind,
+    role: "unknown",
+    confidence: "unknown",
+    basis: Object.freeze(["no-explicit-or-correlated-recovery"]),
+    recoveryEventIds: Object.freeze([]),
+    retryRunIds: Object.freeze([])
   };
 }
-function resolveCanonicalToolName(event) {
-  const attrs2 = event.attributes;
-  const direct = pickString(attrs2, ["toolName", "tool"]);
-  if (direct) return direct;
-  const metadata = attrs2?.metadata;
-  if (isRecord6(metadata)) {
-    const nested = pickString(metadata, ["toolName", "tool"]);
-    if (nested) return nested;
-  }
-  for (const prefix of ["tool:", "function:", "mcp-tools:"]) {
-    if (event.name.startsWith(prefix)) return event.name.slice(prefix.length);
-  }
-  return event.name;
-}
-function pickString(record, keys) {
-  if (!record) return void 0;
-  for (const key of keys) {
-    const value = record[key];
-    if (typeof value === "string" && value.trim() !== "") return value.trim();
-  }
-  return void 0;
-}
-
-// packages/core/src/checks/derived-failure.ts
-function isRecord7(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function pickString2(record, keys) {
-  if (!record) return void 0;
-  for (const key of keys) {
-    const value = record[key];
-    if (typeof value === "string" && value.trim() !== "") return value;
+function deriveFailureFacts(logicalEvents) {
+  const runs = buildRunContexts(logicalEvents);
+  const failures = logicalEvents.filter((event) => isFailure(event)).sort(compareEventOrder);
+  const failureFacts = failures.map(
+    (failure) => classifyFailure(failure, collectCandidates(failure, logicalEvents, runs), runs, logicalEvents)
+  );
+  const byRole = /* @__PURE__ */ new Map([
+    ["transient", []],
+    ["recovered", []],
+    ["terminal", []],
+    ["unknown", []]
+  ]);
+  for (const fact of failureFacts) {
+    byRole.get(fact.role).push(fact);
   }
-  return void 0;
-}
-function pickNumber(record, keys) {
-  if (!record) return void 0;
-  for (const key of keys) {
-    const value = record[key];
-    if (typeof value === "number" && Number.isFinite(value) && value > 0) {
-      return value;
-    }
+  for (const [role, list] of byRole) {
+    byRole.set(
+      role,
+      Object.freeze(
+        [...list].sort((a, b) => {
+          const byRun = a.runId.localeCompare(b.runId);
+          if (byRun !== 0) return byRun;
+          return a.eventId.localeCompare(b.eventId);
+        })
+      )
+    );
   }
-  return void 0;
-}
-function eventMetadata(event) {
-  const attrs2 = isRecord7(event.attributes) ? event.attributes : void 0;
-  const nested = attrs2 !== void 0 && isRecord7(attrs2.metadata) ? attrs2.metadata : void 0;
+  const failureRoleCounts = {
+    transient: byRole.get("transient").length,
+    recovered: byRole.get("recovered").length,
+    terminal: byRole.get("terminal").length,
+    unknown: byRole.get("unknown").length
+  };
   return {
-    ...attrs2 ?? {},
-    ...nested ?? {}
+    failureFacts: Object.freeze(failureFacts),
+    failuresByRole: byRole,
+    failureRoleCounts
   };
 }
-function canonicalName(event) {
-  if (event.kind === "TOOL") return resolveCanonicalToolName(event);
-  return event.name;
+
+// packages/core/src/checks/relationship-facts.ts
+function attrs(event) {
+  return event.attributes && typeof event.attributes === "object" ? event.attributes : {};
 }
-function linkKeys(event) {
-  const meta = eventMetadata(event);
-  const keys = [];
-  for (const key of ["linkedStepId", "toolCallId", "mcpToolCallId"]) {
-    const value = pickString2(meta, [key]);
-    if (value !== void 0) keys.push(`${key}:${value}`);
-  }
-  const stepId = pickString2(meta, ["stepId"]);
-  if (stepId !== void 0) keys.push(`stepId:${stepId}`);
-  return keys;
+function stringAttr(record, key) {
+  const value = record[key];
+  return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
 }
-function buildRunContexts(logicalEvents) {
-  const byRun = /* @__PURE__ */ new Map();
-  for (const event of logicalEvents) {
-    const existing = byRun.get(event.runId) ?? {
-      runId: event.runId,
-      name: event.name
-    };
-    const meta = eventMetadata(event);
-    if (event.kind === "RUN" || existing.name === event.runId) {
-      existing.name = event.name || existing.name;
+function deriveRelationshipFacts(events) {
+  const relationships = [];
+  const diagnostics = [];
+  const byId = new Map(events.map((event) => [event.eventId, event]));
+  const seen = /* @__PURE__ */ new Set();
+  const push = (edge) => {
+    const key = `${edge.type}:${edge.fromEventId}:${edge.toEventId ?? ""}:${edge.externalRef ?? ""}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    relationships.push(edge);
+  };
+  for (const event of events) {
+    if (event.parentId) {
+      push({
+        type: "parent-child",
+        fromEventId: event.parentId,
+        toEventId: event.eventId,
+        confidence: byId.has(event.parentId) ? "explicit" : "unknown",
+        basis: ["persisted.parentId"]
+      });
+      if (!byId.has(event.parentId)) {
+        diagnostics.push({
+          code: "AI_RELATIONSHIP_PARENT_MISSING",
+          message: `parentId ${event.parentId} is not present in the event set.`,
+          eventId: event.eventId
+        });
+      }
     }
-    if (event.kind === "RUN" && event.status !== void 0 && event.status !== "running") {
-      existing.status = event.status;
+    const bag = attrs(event);
+    const meta = extractSessionWorkflowMetadata(bag) ?? {};
+    const nested = bag.metadata && typeof bag.metadata === "object" ? extractSessionWorkflowMetadata(bag.metadata) : void 0;
+    const workflow = { ...meta, ...nested };
+    if (workflow.retryOf) {
+      const target = events.find((candidate) => candidate.runId === workflow.retryOf);
+      push({
+        type: "retry-of",
+        fromEventId: event.eventId,
+        ...target ? { toEventId: target.eventId } : {},
+        externalRef: workflow.retryOf,
+        confidence: target ? "explicit" : "correlated",
+        basis: ["attributes.retryOf"]
+      });
+    }
+    const attemptOf = stringAttr(bag, "attemptOf") ?? stringAttr(bag, "operationId");
+    if (attemptOf && workflow.attempt !== void 0) {
+      push({
+        type: "attempt-of",
+        fromEventId: event.eventId,
+        externalRef: attemptOf,
+        confidence: "explicit",
+        basis: workflow.attempt !== void 0 ? ["attributes.attempt", "attributes.operationId"] : ["attributes.operationId"]
+      });
+    }
+    const fallbackOf = stringAttr(bag, "fallbackOf");
+    if (fallbackOf) {
+      push({
+        type: "fallback-of",
+        fromEventId: event.eventId,
+        externalRef: fallbackOf,
+        confidence: "explicit",
+        basis: ["attributes.fallbackOf"]
+      });
+    }
+    const remediationOf = stringAttr(bag, "remediationOf");
+    if (remediationOf) {
+      push({
+        type: "remediation-of",
+        fromEventId: event.eventId,
+        externalRef: remediationOf,
+        confidence: "explicit",
+        basis: ["attributes.remediationOf"]
+      });
+    }
+    const evidenceFor = stringAttr(bag, "evidenceFor");
+    if (evidenceFor) {
+      push({
+        type: "evidence-for",
+        fromEventId: event.eventId,
+        ...byId.has(evidenceFor) ? { toEventId: evidenceFor } : { externalRef: evidenceFor },
+        confidence: byId.has(evidenceFor) ? "explicit" : "correlated",
+        basis: ["attributes.evidenceFor"]
+      });
+    }
+    const acceptedBy = stringAttr(bag, "acceptedBy");
+    if (acceptedBy) {
+      push({
+        type: "accepted-by",
+        fromEventId: event.eventId,
+        ...byId.has(acceptedBy) ? { toEventId: acceptedBy } : { externalRef: acceptedBy },
+        confidence: byId.has(acceptedBy) ? "explicit" : "correlated",
+        basis: ["attributes.acceptedBy"]
+      });
+    }
+    const supersedes = stringAttr(bag, "supersedes");
+    if (supersedes) {
+      push({
+        type: "supersedes",
+        fromEventId: event.eventId,
+        ...byId.has(supersedes) ? { toEventId: supersedes } : { externalRef: supersedes },
+        confidence: byId.has(supersedes) ? "explicit" : "correlated",
+        basis: ["attributes.supersedes"]
+      });
+    }
+    const sourceLineage = stringAttr(bag, "sourceLineage") ?? stringAttr(bag, "sourceEventId");
+    if (sourceLineage) {
+      push({
+        type: "source-lineage",
+        fromEventId: event.eventId,
+        externalRef: sourceLineage,
+        confidence: "explicit",
+        basis: ["attributes.sourceLineage"]
+      });
+    }
+    const unsupported = stringAttr(bag, "relationshipType");
+    if (unsupported && unsupported !== "parent-child" && ![
+      "source-lineage",
+      "attempt-of",
+      "retry-of",
+      "fallback-of",
+      "remediation-of",
+      "evidence-for",
+      "accepted-by",
+      "supersedes"
+    ].includes(unsupported)) {
+      diagnostics.push({
+        code: "AI_RELATIONSHIP_UNSUPPORTED_TYPE",
+        message: `Unsupported relationshipType ${unsupported} was reported without flattening.`,
+        eventId: event.eventId
+      });
     }
-    existing.retryOf ??= pickString2(meta, ["retryOf"]);
-    existing.attempt ??= pickNumber(meta, ["attempt", "retryAttempt", "retryCount"]);
-    existing.sessionId ??= pickString2(meta, ["sessionId", "conversationId"]);
-    existing.groupId ??= pickString2(meta, ["groupId"]);
-    existing.parentGroupId ??= pickString2(meta, ["parentGroupId"]);
-    existing.fallbackOf ??= pickString2(meta, ["fallbackOf", "fallbackFrom"]);
-    byRun.set(event.runId, existing);
   }
-  return byRun;
+  return {
+    relationships: Object.freeze(relationships),
+    diagnostics: Object.freeze(diagnostics)
+  };
 }
-function sameCorrelationScope(a, b) {
-  if (a.sessionId && b.sessionId && a.sessionId === b.sessionId) return true;
-  if (a.groupId && b.groupId && a.groupId === b.groupId) return true;
-  if (a.parentGroupId && b.parentGroupId && a.parentGroupId === b.parentGroupId) {
-    return true;
+
+// packages/core/src/checks/trace-facts.ts
+function summarizeSemanticParity(events) {
+  const projection = projectLogicalEvents(events);
+  const logical = projection.logicalEvents;
+  const finishedTools = logical.filter(
+    (event) => event.kind === "TOOL" && event.status !== "running"
+  );
+  const finishedToolNames = Object.freeze(
+    finishedTools.map((event) => resolveCanonicalToolName(event)).sort((a, b) => a.localeCompare(b))
+  );
+  const derived = deriveFailureFacts(logical);
+  return {
+    rawEventCount: events.length,
+    logicalEventCount: logical.length,
+    runningLogicalCount: logical.filter((event) => event.status === "running").length,
+    finishedToolNames,
+    finishedToolCount: finishedTools.length,
+    pairedCount: logical.filter((event) => event.projection.paired).length,
+    parentRemapCount: projection.diagnostics.filter(
+      (item) => item.code === "AI_LOGICAL_PARENT_REMAPPED"
+    ).length,
+    diagnostics: projection.diagnostics,
+    failureRoleCounts: derived.failureRoleCounts
+  };
+}
+var TRACE_FACTS_INPUT_NOT_NORMALIZED = formatProgrammaticDiagnostic(
+  "AI_TRACE_FACTS_INPUT_NOT_NORMALIZED"
+);
+function isTraceReadResult(input) {
+  if (typeof input !== "object" || input === null || Array.isArray(input)) {
+    return false;
   }
-  return false;
+  const record = input;
+  return Array.isArray(record.events) && Array.isArray(record.runs) && typeof record.format === "string" && Array.isArray(record.warnings);
 }
-function isSuccessful(event) {
-  return event.status === "ok";
+function looksLikeRawV01TraceEvents(input) {
+  if (!Array.isArray(input) || input.length === 0) return false;
+  const first = input[0];
+  if (typeof first !== "object" || first === null) return false;
+  const row = first;
+  return typeof row.event === "string" && (row.schemaVersion === "0.1" || row.eventId === void 0);
 }
-function isFailure(event) {
-  return event.status === "error";
+function isPersistedInspectEventArray(input) {
+  if (!Array.isArray(input)) return false;
+  if (input.length === 0) return true;
+  const first = input[0];
+  if (typeof first !== "object" || first === null) return false;
+  const row = first;
+  return typeof row.eventId === "string" && (row.schemaVersion === "0.2" || row.schemaVersion === "1.0" || row.schemaVersion === "0.1") && typeof row.event !== "string";
 }
-function compareEventOrder(a, b) {
-  const byTime = a.timestamp.localeCompare(b.timestamp);
-  if (byTime !== 0) return byTime;
-  return a.eventId.localeCompare(b.eventId);
+function resolveTraceFactsEvents(input) {
+  if (isTraceReadResult(input)) {
+    return input.events;
+  }
+  if (looksLikeRawV01TraceEvents(input)) {
+    throw new TypeError(TRACE_FACTS_INPUT_NOT_NORMALIZED);
+  }
+  if (isPersistedInspectEventArray(input)) {
+    return input;
+  }
+  throw new TypeError(TRACE_FACTS_INPUT_NOT_NORMALIZED);
 }
-function collectCandidates(failure, logicalEvents, runs) {
-  const failureRun = runs.get(failure.runId);
-  const failureLinks = new Set(linkKeys(failure));
-  const failureName = canonicalName(failure);
-  const failureAttempt = pickNumber(eventMetadata(failure), ["attempt", "retryAttempt", "retryCount"]) ?? failureRun?.attempt;
-  const candidates = [];
-  for (const event of logicalEvents) {
-    if (event.eventId === failure.eventId) continue;
-    if (event.status === "running") continue;
-    const eventRun = runs.get(event.runId);
-    const eventMeta = eventMetadata(event);
-    const sameRun = event.runId === failure.runId;
-    if (eventRun?.retryOf === failure.runId) {
-      candidates.push({
-        event,
-        basis: "retryOf",
-        confidence: "explicit",
-        viaRunId: event.runId
-      });
-      continue;
-    }
-    if (eventRun?.fallbackOf === failure.runId || pickString2(eventMeta, ["fallbackOf", "fallbackFrom"]) === failure.runId) {
-      candidates.push({
-        event,
-        basis: "fallbackOf",
-        confidence: "explicit",
-        viaRunId: event.runId
-      });
-      continue;
+function buildTraceFacts(input) {
+  const events = resolveTraceFactsEvents(input);
+  const projection = projectLogicalEvents(events);
+  const toolsByName = /* @__PURE__ */ new Map();
+  const llmEvents = [];
+  const outcomeEvents = [];
+  for (const event of projection.logicalEvents) {
+    if (event.kind === "TOOL" && event.status !== "running") {
+      const name = resolveCanonicalToolName(event);
+      const list = toolsByName.get(name) ?? [];
+      list.push(event);
+      toolsByName.set(name, list);
     }
-    if (sameRun && compareEventOrder(failure, event) >= 0) continue;
-    const eventLinks = linkKeys(event);
-    const sharedLink = eventLinks.find((key) => failureLinks.has(key));
-    if (sharedLink !== void 0) {
-      candidates.push({
-        event,
-        basis: sharedLink.split(":")[0] ?? "linkedId",
-        confidence: "explicit"
-      });
-      continue;
+    if (event.kind === "LLM" && event.status !== "running") {
+      llmEvents.push(event);
     }
-    const eventAttempt = pickNumber(eventMeta, ["attempt", "retryAttempt", "retryCount"]) ?? eventRun?.attempt;
-    const sameParent = failure.parentId !== void 0 && event.parentId !== void 0 && failure.parentId === event.parentId;
-    const differentParent = failure.parentId !== void 0 && event.parentId !== void 0 && failure.parentId !== event.parentId;
-    const sessionScoped = failureRun !== void 0 && eventRun !== void 0 && sameCorrelationScope(failureRun, eventRun);
-    if (canonicalName(event) === failureName && failureAttempt !== void 0 && eventAttempt !== void 0 && eventAttempt > failureAttempt && !differentParent && (sameParent || sessionScoped || sameRun)) {
-      candidates.push({
-        event,
-        basis: "attempt-progression",
-        confidence: "correlated",
-        ...event.runId !== failure.runId ? { viaRunId: event.runId } : {}
-      });
+    if (event.kind === "OUTCOME") {
+      outcomeEvents.push(event);
     }
   }
-  const byId = /* @__PURE__ */ new Map();
-  for (const candidate of candidates) {
-    const prev = byId.get(candidate.event.eventId);
-    if (!prev || prev.confidence !== "explicit" && candidate.confidence === "explicit") {
-      byId.set(candidate.event.eventId, candidate);
+  for (const [name, list] of [...toolsByName.entries()]) {
+    toolsByName.set(name, Object.freeze([...list]));
+  }
+  const derived = deriveFailureFacts(projection.logicalEvents);
+  const relationship = deriveRelationshipFacts(events);
+  const summary = summarizeSemanticParity(events);
+  return {
+    rawEvents: Object.freeze([...events]),
+    logicalEvents: projection.logicalEvents,
+    diagnostics: projection.diagnostics,
+    toolsByName,
+    llmEvents: Object.freeze(llmEvents),
+    outcomeEvents: Object.freeze(outcomeEvents),
+    summary: {
+      ...summary,
+      failureRoleCounts: derived.failureRoleCounts
+    },
+    failureFacts: derived.failureFacts,
+    failuresByRole: derived.failuresByRole,
+    relationships: relationship.relationships,
+    relationshipDiagnostics: relationship.diagnostics
+  };
+}
+
+// packages/core/src/checks/index.ts
+var SEVERITY_RANK = {
+  error: 0,
+  warning: 1,
+  info: 2
+};
+var STATUS_RANK = {
+  fail: 0,
+  warning: 1,
+  pass: 2
+};
+var DEFAULT_SENSITIVE_KEYS = DEFAULT_CREDENTIAL_SENSITIVE_KEYS;
+var DEFAULT_RAW_CONTENT_KEYS = [
+  "body",
+  "headers",
+  "input",
+  "messages",
+  "output",
+  "payload",
+  "prompt",
+  "requestbody",
+  "request_body",
+  "responsebody",
+  "response_body",
+  "rawprompt",
+  "raw_prompt",
+  "rawoutput",
+  "raw_output",
+  "toolinput",
+  "tool_input",
+  "tooloutput",
+  "tool_output",
+  // Framework / agent metadata that carries user or task text
+  "currenttask",
+  "current_task",
+  "task",
+  "userinput",
+  "user_input",
+  "requesttext",
+  "request_text",
+  "conversationtext",
+  "conversation_text"
+];
+var DEFAULT_SAFE_RAW_CONTENT_PATH_PREFIXES = [
+  "tokenUsage",
+  "usage",
+  "tokens"
+];
+var SAFE_USAGE_LEAF_KEYS = /* @__PURE__ */ new Set([
+  "input",
+  "output",
+  "total",
+  "cached",
+  "input_tokens",
+  "inputtokens",
+  "output_tokens",
+  "outputtokens",
+  "total_tokens",
+  "totaltokens",
+  "prompt_tokens",
+  "prompttokens",
+  "completion_tokens",
+  "completiontokens"
+]);
+var DEFAULT_SECRET_PATTERNS = [
+  { id: "bearer-token", pattern: /Bearer\s+[A-Za-z0-9._~+/-]{12,}=*/ },
+  { id: "openai-key", pattern: /sk-[A-Za-z0-9_-]{16,}/ },
+  { id: "aws-access-key", pattern: /AKIA[0-9A-Z]{16}/ },
+  { id: "github-token", pattern: /gh[opsu]_[A-Za-z0-9_]{20,}/ },
+  // Keep in sync with packages/redact/src/key-value-secret.ts (KEY_VALUE_SECRET_PATTERN_SOURCE).
+  {
+    id: "key-value-secret",
+    pattern: /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=([^\s"'\\]{8,})/i
+  }
+];
+function compareStrings(a, b) {
+  return (a ?? "").localeCompare(b ?? "");
+}
+function diagnostic(code, message, ruleId) {
+  return {
+    code,
+    message,
+    severity: "error",
+    ...ruleId ? { ruleId } : {}
+  };
+}
+function emptySummary() {
+  return {
+    passed: 0,
+    failed: 0,
+    warnings: 0,
+    errors: 0,
+    rulesEvaluated: 0
+  };
+}
+function errorResult(input, diagnostics, selectedRun, ruleExecutions = []) {
+  return {
+    ok: false,
+    status: "error",
+    format: input.read.format,
+    ...selectedRun ? { runId: selectedRun.runId } : {},
+    summary: {
+      ...emptySummary(),
+      errors: diagnostics.filter((item) => item.severity === "error").length,
+      rulesEvaluated: ruleExecutions.length
+    },
+    findings: [],
+    diagnostics: [...diagnostics],
+    ruleExecutions: [...ruleExecutions]
+  };
+}
+function flattenNodes(nodes) {
+  return nodes.flatMap((node) => [node, ...flattenNodes(node.children)]);
+}
+function buildFacts(input, selectedRun) {
+  const scopedRuns = selectedRun ? [selectedRun] : input.read.runs;
+  const scopedRunIds = new Set(scopedRuns.map((run) => run.runId));
+  const scopedEvents = selectedRun === void 0 ? input.read.events : input.read.events.filter((event) => scopedRunIds.has(event.runId));
+  const nodes = flattenNodes(scopedRuns.flatMap((run) => run.children));
+  const nodesByEventId = /* @__PURE__ */ new Map();
+  const childrenByParentId = /* @__PURE__ */ new Map();
+  for (const node of nodes) {
+    nodesByEventId.set(node.event.eventId, node);
+    const parentId = node.event.parentId;
+    if (parentId) {
+      const children = childrenByParentId.get(parentId) ?? [];
+      children.push(node);
+      childrenByParentId.set(parentId, children);
     }
   }
-  return [...byId.values()].sort((a, b) => compareEventOrder(a.event, b.event));
+  const projection = projectLogicalEvents(scopedEvents);
+  return {
+    format: input.read.format,
+    runs: Object.freeze([...input.read.runs]),
+    events: Object.freeze([...scopedEvents]),
+    logicalEvents: projection.logicalEvents,
+    logicalProjectionDiagnostics: projection.diagnostics,
+    readerWarnings: Object.freeze([...input.read.warnings]),
+    unsupportedFields: Object.freeze([...input.read.unsupportedFields]),
+    sourceFiles: Object.freeze([...input.read.sourceFiles]),
+    nodesByEventId,
+    childrenByParentId,
+    rootNodes: Object.freeze(scopedRuns.flatMap((run) => run.children))
+  };
 }
-function classifyFailure(failure, candidates, runs, logicalEvents) {
-  const successful = candidates.filter((c) => isSuccessful(c.event));
-  const unsuccessful = candidates.filter((c) => !isSuccessful(c.event));
-  const retryRunIds = Object.freeze(
-    [...new Set(candidates.map((c) => c.viaRunId).filter((id) => id !== void 0))].sort(
-      (a, b) => a.localeCompare(b)
-    )
-  );
-  if (successful.length > 1) {
-    const distinctRuns = new Set(successful.map((c) => c.event.runId));
-    const distinctParents = new Set(
-      successful.map((c) => c.event.parentId ?? "").filter((id) => id !== "")
-    );
-    if (distinctRuns.size > 1 || distinctParents.size > 1) {
+function resolveSelectedRun(input, runId) {
+  if (input.selectedRun) {
+    if (runId && input.selectedRun.runId !== runId) {
       return {
-        eventId: failure.eventId,
-        runId: failure.runId,
-        name: failure.name,
-        kind: failure.kind,
-        role: "unknown",
-        confidence: "unknown",
-        basis: Object.freeze(["ambiguous-recovery-candidates"]),
-        recoveryEventIds: Object.freeze(
-          successful.map((c) => c.event.eventId).sort((a, b) => a.localeCompare(b))
-        ),
-        retryRunIds
+        diagnostics: [
+          diagnostic(
+            "AI_CHECK_INVALID_ARGUMENTS",
+            `Selected run ${input.selectedRun.runId} does not match requested run ${runId}.`
+          )
+        ]
       };
     }
+    return { run: input.selectedRun, diagnostics: [] };
   }
-  if (successful.length >= 1) {
-    const best = successful[0];
-    return {
-      eventId: failure.eventId,
-      runId: failure.runId,
-      name: failure.name,
-      kind: failure.kind,
-      role: "recovered",
-      confidence: best.confidence,
-      basis: Object.freeze([best.basis]),
-      recoveryEventIds: Object.freeze(
-        successful.map((c) => c.event.eventId).sort((a, b) => a.localeCompare(b))
-      ),
-      retryRunIds
-    };
-  }
-  if (candidates.length > 0) {
-    const best = candidates[0];
-    return {
-      eventId: failure.eventId,
-      runId: failure.runId,
-      name: failure.name,
-      kind: failure.kind,
-      role: "transient",
-      confidence: best.confidence,
-      basis: Object.freeze([
-        best.basis,
-        unsuccessful.some((c) => c.event.status === void 0) ? "retry-incomplete" : "retry-without-success"
-      ]),
-      recoveryEventIds: Object.freeze([]),
-      retryRunIds
-    };
-  }
-  const failureMeta = eventMetadata(failure);
-  const declaredSuccessor = pickString2(failureMeta, [
-    "retriedBy",
-    "nextRetryRunId",
-    "retryRunId"
-  ]);
-  if (declaredSuccessor !== void 0 && !runs.has(declaredSuccessor)) {
-    return {
-      eventId: failure.eventId,
-      runId: failure.runId,
-      name: failure.name,
-      kind: failure.kind,
-      role: "transient",
-      confidence: "explicit",
-      basis: Object.freeze(["retry-declared", "retry-run-missing"]),
-      recoveryEventIds: Object.freeze([]),
-      retryRunIds: Object.freeze([declaredSuccessor])
-    };
-  }
-  for (const run of runs.values()) {
-    if (run.retryOf === failure.runId) {
+  if (runId) {
+    const run = input.read.runs.find((candidate) => candidate.runId === runId);
+    if (!run) {
       return {
-        eventId: failure.eventId,
-        runId: failure.runId,
-        name: failure.name,
-        kind: failure.kind,
-        role: "transient",
-        confidence: "explicit",
-        basis: Object.freeze(["retryOf", "retry-run-missing-or-empty"]),
-        recoveryEventIds: Object.freeze([]),
-        retryRunIds: Object.freeze([run.runId])
+        diagnostics: [
+          diagnostic("AI_CHECK_RUN_SELECTION_REQUIRED", `Run not found: ${runId}.`)
+        ]
       };
     }
+    return { run, diagnostics: [] };
   }
-  const failureRun = runs.get(failure.runId);
-  const hasSuccessorDeclared = [...runs.values()].some((run) => run.retryOf === failure.runId);
-  const isFinalInChain = failureRun !== void 0 && !hasSuccessorDeclared && (failureRun.retryOf !== void 0 || failureRun.attempt !== void 0 && failureRun.attempt > 1 || pickNumber(eventMetadata(failure), ["attempt"]) !== void 0);
-  if (isFinalInChain && failureRun?.status === "error" && !logicalEvents.some(
-    (event) => event.runId === failure.runId && event.eventId !== failure.eventId && isSuccessful(event) && canonicalName(event) === canonicalName(failure)
-  )) {
+  if (input.read.runs.length === 1) {
+    return { run: input.read.runs[0], diagnostics: [] };
+  }
+  if (input.read.runs.length === 0) {
     return {
-      eventId: failure.eventId,
-      runId: failure.runId,
-      name: failure.name,
-      kind: failure.kind,
-      role: "terminal",
-      confidence: failureRun.retryOf !== void 0 ? "explicit" : "correlated",
-      basis: Object.freeze(["final-retry-chain-member", "enclosing-run-error"]),
-      recoveryEventIds: Object.freeze([]),
-      retryRunIds: Object.freeze(
-        failureRun.retryOf !== void 0 ? [failureRun.retryOf] : []
-      )
+      diagnostics: [
+        diagnostic(
+          "AI_CHECK_RUN_SELECTION_REQUIRED",
+          formatProgrammaticDiagnostic(
+            "AI_TRACE_CONTRACT_RUN_SELECTION_REQUIRED",
+            "No runs are available for checks."
+          )
+        )
+      ]
     };
-  }
-  return {
-    eventId: failure.eventId,
-    runId: failure.runId,
-    name: failure.name,
-    kind: failure.kind,
-    role: "unknown",
-    confidence: "unknown",
-    basis: Object.freeze(["no-explicit-or-correlated-recovery"]),
-    recoveryEventIds: Object.freeze([]),
-    retryRunIds: Object.freeze([])
-  };
-}
-function deriveFailureFacts(logicalEvents) {
-  const runs = buildRunContexts(logicalEvents);
-  const failures = logicalEvents.filter((event) => isFailure(event)).sort(compareEventOrder);
-  const failureFacts = failures.map(
-    (failure) => classifyFailure(failure, collectCandidates(failure, logicalEvents, runs), runs, logicalEvents)
-  );
-  const byRole = /* @__PURE__ */ new Map([
-    ["transient", []],
-    ["recovered", []],
-    ["terminal", []],
-    ["unknown", []]
-  ]);
-  for (const fact of failureFacts) {
-    byRole.get(fact.role).push(fact);
-  }
-  for (const [role, list] of byRole) {
-    byRole.set(
-      role,
-      Object.freeze(
-        [...list].sort((a, b) => {
-          const byRun = a.runId.localeCompare(b.runId);
-          if (byRun !== 0) return byRun;
-          return a.eventId.localeCompare(b.eventId);
-        })
-      )
-    );
-  }
-  const failureRoleCounts = {
-    transient: byRole.get("transient").length,
-    recovered: byRole.get("recovered").length,
-    terminal: byRole.get("terminal").length,
-    unknown: byRole.get("unknown").length
-  };
+  }
   return {
-    failureFacts: Object.freeze(failureFacts),
-    failuresByRole: byRole,
-    failureRoleCounts
+    diagnostics: [
+      diagnostic(
+        "AI_CHECK_RUN_SELECTION_REQUIRED",
+        formatProgrammaticDiagnostic("AI_TRACE_CONTRACT_RUN_SELECTION_REQUIRED")
+      )
+    ]
   };
 }
-
-// packages/core/src/checks/relationship-facts.ts
-function attrs(event) {
-  return event.attributes && typeof event.attributes === "object" ? event.attributes : {};
-}
-function stringAttr(record, key) {
-  const value = record[key];
-  return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
-}
-function deriveRelationshipFacts(events) {
-  const relationships = [];
+function selectRules(rules, selectedIds) {
   const diagnostics = [];
-  const byId = new Map(events.map((event) => [event.eventId, event]));
-  const seen = /* @__PURE__ */ new Set();
-  const push = (edge) => {
-    const key = `${edge.type}:${edge.fromEventId}:${edge.toEventId ?? ""}:${edge.externalRef ?? ""}`;
-    if (seen.has(key)) return;
-    seen.add(key);
-    relationships.push(edge);
-  };
-  for (const event of events) {
-    if (event.parentId) {
-      push({
-        type: "parent-child",
-        fromEventId: event.parentId,
-        toEventId: event.eventId,
-        confidence: byId.has(event.parentId) ? "explicit" : "unknown",
-        basis: ["persisted.parentId"]
-      });
-      if (!byId.has(event.parentId)) {
-        diagnostics.push({
-          code: "AI_RELATIONSHIP_PARENT_MISSING",
-          message: `parentId ${event.parentId} is not present in the event set.`,
-          eventId: event.eventId
-        });
-      }
-    }
-    const bag = attrs(event);
-    const meta = extractSessionWorkflowMetadata(bag) ?? {};
-    const nested = bag.metadata && typeof bag.metadata === "object" ? extractSessionWorkflowMetadata(bag.metadata) : void 0;
-    const workflow = { ...meta, ...nested };
-    if (workflow.retryOf) {
-      const target = events.find((candidate) => candidate.runId === workflow.retryOf);
-      push({
-        type: "retry-of",
-        fromEventId: event.eventId,
-        ...target ? { toEventId: target.eventId } : {},
-        externalRef: workflow.retryOf,
-        confidence: target ? "explicit" : "correlated",
-        basis: ["attributes.retryOf"]
-      });
-    }
-    const attemptOf = stringAttr(bag, "attemptOf") ?? stringAttr(bag, "operationId");
-    if (attemptOf && workflow.attempt !== void 0) {
-      push({
-        type: "attempt-of",
-        fromEventId: event.eventId,
-        externalRef: attemptOf,
-        confidence: "explicit",
-        basis: workflow.attempt !== void 0 ? ["attributes.attempt", "attributes.operationId"] : ["attributes.operationId"]
-      });
-    }
-    const fallbackOf = stringAttr(bag, "fallbackOf");
-    if (fallbackOf) {
-      push({
-        type: "fallback-of",
-        fromEventId: event.eventId,
-        externalRef: fallbackOf,
-        confidence: "explicit",
-        basis: ["attributes.fallbackOf"]
-      });
-    }
-    const remediationOf = stringAttr(bag, "remediationOf");
-    if (remediationOf) {
-      push({
-        type: "remediation-of",
-        fromEventId: event.eventId,
-        externalRef: remediationOf,
-        confidence: "explicit",
-        basis: ["attributes.remediationOf"]
-      });
-    }
-    const evidenceFor = stringAttr(bag, "evidenceFor");
-    if (evidenceFor) {
-      push({
-        type: "evidence-for",
-        fromEventId: event.eventId,
-        ...byId.has(evidenceFor) ? { toEventId: evidenceFor } : { externalRef: evidenceFor },
-        confidence: byId.has(evidenceFor) ? "explicit" : "correlated",
-        basis: ["attributes.evidenceFor"]
-      });
-    }
-    const acceptedBy = stringAttr(bag, "acceptedBy");
-    if (acceptedBy) {
-      push({
-        type: "accepted-by",
-        fromEventId: event.eventId,
-        ...byId.has(acceptedBy) ? { toEventId: acceptedBy } : { externalRef: acceptedBy },
-        confidence: byId.has(acceptedBy) ? "explicit" : "correlated",
-        basis: ["attributes.acceptedBy"]
-      });
+  const byId = /* @__PURE__ */ new Map();
+  for (const rule of rules) {
+    if (byId.has(rule.id)) {
+      diagnostics.push(
+        diagnostic("AI_CHECK_INVALID_CONFIG", `Duplicate trace check rule id: ${rule.id}.`, rule.id)
+      );
+      continue;
     }
-    const supersedes = stringAttr(bag, "supersedes");
-    if (supersedes) {
-      push({
-        type: "supersedes",
-        fromEventId: event.eventId,
-        ...byId.has(supersedes) ? { toEventId: supersedes } : { externalRef: supersedes },
-        confidence: byId.has(supersedes) ? "explicit" : "correlated",
-        basis: ["attributes.supersedes"]
-      });
+    byId.set(rule.id, rule);
+  }
+  if (selectedIds && selectedIds.length > 0) {
+    const selected = new Set(selectedIds);
+    for (const id of selected) {
+      if (!byId.has(id)) {
+        diagnostics.push(
+          diagnostic("AI_CHECK_INVALID_CONFIG", `Unknown trace check rule id: ${id}.`, id)
+        );
+      }
     }
-    const sourceLineage = stringAttr(bag, "sourceLineage") ?? stringAttr(bag, "sourceEventId");
-    if (sourceLineage) {
-      push({
-        type: "source-lineage",
-        fromEventId: event.eventId,
-        externalRef: sourceLineage,
-        confidence: "explicit",
-        basis: ["attributes.sourceLineage"]
-      });
+    return {
+      rules: [...byId.values()].filter((rule) => selected.has(rule.id)).sort(compareRules),
+      diagnostics
+    };
+  }
+  return { rules: [...byId.values()].sort(compareRules), diagnostics };
+}
+function compareRules(a, b) {
+  return a.id.localeCompare(b.id);
+}
+function eventTimestamp(finding, eventById) {
+  const eventId = finding.evidence[0]?.eventId;
+  return eventId ? eventById.get(eventId)?.timestamp ?? "" : "";
+}
+function compareFindings(eventById) {
+  return (a, b) => {
+    if (SEVERITY_RANK[a.severity] !== SEVERITY_RANK[b.severity]) {
+      return SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity];
     }
-    const unsupported = stringAttr(bag, "relationshipType");
-    if (unsupported && unsupported !== "parent-child" && ![
-      "source-lineage",
-      "attempt-of",
-      "retry-of",
-      "fallback-of",
-      "remediation-of",
-      "evidence-for",
-      "accepted-by",
-      "supersedes"
-    ].includes(unsupported)) {
-      diagnostics.push({
-        code: "AI_RELATIONSHIP_UNSUPPORTED_TYPE",
-        message: `Unsupported relationshipType ${unsupported} was reported without flattening.`,
-        eventId: event.eventId
-      });
+    const byRule = a.ruleId.localeCompare(b.ruleId);
+    if (byRule !== 0) return byRule;
+    if (STATUS_RANK[a.status] !== STATUS_RANK[b.status]) {
+      return STATUS_RANK[a.status] - STATUS_RANK[b.status];
     }
-  }
+    const byRun = compareStrings(a.evidence[0]?.runId, b.evidence[0]?.runId);
+    if (byRun !== 0) return byRun;
+    const byTime = eventTimestamp(a, eventById).localeCompare(eventTimestamp(b, eventById));
+    if (byTime !== 0) return byTime;
+    const byEvent = compareStrings(a.evidence[0]?.eventId, b.evidence[0]?.eventId);
+    if (byEvent !== 0) return byEvent;
+    return compareStrings(a.evidence[0]?.path, b.evidence[0]?.path);
+  };
+}
+function normalizeFinding(rule, finding) {
   return {
-    relationships: Object.freeze(relationships),
-    diagnostics: Object.freeze(diagnostics)
+    ruleId: finding.ruleId || rule.id,
+    severity: finding.severity ?? rule.defaultSeverity,
+    status: finding.status,
+    message: finding.message,
+    ...finding.expected !== void 0 ? { expected: finding.expected } : {},
+    ...finding.actual !== void 0 ? { actual: finding.actual } : {},
+    evidence: [...finding.evidence ?? []],
+    ...finding.category !== void 0 ? { category: finding.category } : {},
+    ...finding.confidence !== void 0 ? { confidence: finding.confidence } : {},
+    ...finding.detector !== void 0 ? { detector: finding.detector } : {},
+    ...finding.action !== void 0 ? { action: finding.action } : {}
   };
 }
-
-// packages/core/src/checks/trace-facts.ts
-function summarizeSemanticParity(events) {
-  const projection = projectLogicalEvents(events);
-  const logical = projection.logicalEvents;
-  const finishedTools = logical.filter(
-    (event) => event.kind === "TOOL" && event.status !== "running"
-  );
-  const finishedToolNames = Object.freeze(
-    finishedTools.map((event) => resolveCanonicalToolName(event)).sort((a, b) => a.localeCompare(b))
-  );
-  const derived = deriveFailureFacts(logical);
+function summarize(findings, diagnostics, rulesEvaluated) {
+  return {
+    passed: findings.filter((finding) => finding.status === "pass").length,
+    failed: findings.filter(
+      (finding) => finding.status === "fail" && finding.severity === "error"
+    ).length,
+    warnings: findings.filter(
+      (finding) => finding.status === "warning" || finding.severity === "warning"
+    ).length,
+    errors: diagnostics.filter((item) => item.severity === "error").length,
+    rulesEvaluated
+  };
+}
+function classifyRuleExecution(findings, threw) {
+  if (findings.some((finding) => finding.status === "fail" && finding.severity === "error")) {
+    return "fail";
+  }
+  if (findings.some(
+    (finding) => finding.status === "warning" || finding.severity === "warning"
+  )) {
+    return "warning";
+  }
+  return "pass";
+}
+function eventEvidence(event, path17) {
+  return {
+    runId: event.runId,
+    eventId: event.eventId,
+    parentId: event.parentId,
+    traceId: event.trace?.traceId,
+    spanId: event.trace?.spanId,
+    kind: event.kind,
+    name: event.name,
+    status: event.status,
+    ...path17 ? { path: path17 } : {}
+  };
+}
+function runEvidence(run) {
+  return run ? [{ runId: run.runId, name: run.name, status: run.status }] : [];
+}
+function failFinding(ruleId, message, evidence, expected, actual, meta) {
   return {
-    rawEventCount: events.length,
-    logicalEventCount: logical.length,
-    runningLogicalCount: logical.filter((event) => event.status === "running").length,
-    finishedToolNames,
-    finishedToolCount: finishedTools.length,
-    pairedCount: logical.filter((event) => event.projection.paired).length,
-    parentRemapCount: projection.diagnostics.filter(
-      (item) => item.code === "AI_LOGICAL_PARENT_REMAPPED"
-    ).length,
-    diagnostics: projection.diagnostics,
-    failureRoleCounts: derived.failureRoleCounts
+    ruleId,
+    severity: meta?.severity ?? "error",
+    status: meta?.status ?? "fail",
+    message,
+    ...expected !== void 0 ? { expected } : {},
+    ...actual !== void 0 ? { actual } : {},
+    evidence: [...evidence],
+    ...meta?.category !== void 0 ? { category: meta.category } : {},
+    ...meta?.confidence !== void 0 ? { confidence: meta.confidence } : {},
+    ...meta?.detector !== void 0 ? { detector: meta.detector } : {},
+    ...meta?.action !== void 0 ? { action: meta.action } : {}
   };
 }
-var TRACE_FACTS_INPUT_NOT_NORMALIZED = formatProgrammaticDiagnostic(
-  "AI_TRACE_FACTS_INPUT_NOT_NORMALIZED"
-);
-function isTraceReadResult(input) {
-  if (typeof input !== "object" || input === null || Array.isArray(input)) {
-    return false;
-  }
-  const record = input;
-  return Array.isArray(record.events) && Array.isArray(record.runs) && typeof record.format === "string" && Array.isArray(record.warnings);
+function semanticEvents(context) {
+  return context.logicalEvents ?? context.events;
 }
-function looksLikeRawV01TraceEvents(input) {
-  if (!Array.isArray(input) || input.length === 0) return false;
-  const first = input[0];
-  if (typeof first !== "object" || first === null) return false;
-  const row = first;
-  return typeof row.event === "string" && (row.schemaVersion === "0.1" || row.eventId === void 0);
+function isRecord8(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function isPersistedInspectEventArray(input) {
-  if (!Array.isArray(input)) return false;
-  if (input.length === 0) return true;
-  const first = input[0];
-  if (typeof first !== "object" || first === null) return false;
-  const row = first;
-  return typeof row.eventId === "string" && (row.schemaVersion === "0.2" || row.schemaVersion === "1.0" || row.schemaVersion === "0.1") && typeof row.event !== "string";
+function normalizedKey(value) {
+  return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
 }
-function resolveTraceFactsEvents(input) {
-  if (isTraceReadResult(input)) {
-    return input.events;
+function lastPathSegment(path17) {
+  const parts = path17.split(".");
+  return parts[parts.length - 1] ?? path17;
+}
+function valueType(value) {
+  if (Array.isArray(value)) return "array";
+  if (value === null) return "null";
+  return typeof value;
+}
+function serializedByteLength(value) {
+  try {
+    return Buffer.byteLength(JSON.stringify(value), "utf-8");
+  } catch {
+    return void 0;
   }
-  if (looksLikeRawV01TraceEvents(input)) {
-    throw new TypeError(TRACE_FACTS_INPUT_NOT_NORMALIZED);
+}
+function pushValueEntries(entries, event, value, path17, key, depth = 0) {
+  entries.push({ event, path: path17, key, value });
+  if (depth >= 8) return;
+  if (Array.isArray(value)) {
+    for (const [index, item] of value.entries()) {
+      pushValueEntries(entries, event, item, `${path17}.${index}`, String(index), depth + 1);
+    }
+    return;
   }
-  if (isPersistedInspectEventArray(input)) {
-    return input;
+  if (!isRecord8(value)) return;
+  for (const nestedKey of Object.keys(value).sort((a, b) => a.localeCompare(b))) {
+    pushValueEntries(
+      entries,
+      event,
+      value[nestedKey],
+      `${path17}.${nestedKey}`,
+      nestedKey,
+      depth + 1
+    );
   }
-  throw new TypeError(TRACE_FACTS_INPUT_NOT_NORMALIZED);
 }
-function buildTraceFacts(input) {
-  const events = resolveTraceFactsEvents(input);
-  const projection = projectLogicalEvents(events);
-  const toolsByName = /* @__PURE__ */ new Map();
-  const llmEvents = [];
-  const outcomeEvents = [];
-  for (const event of projection.logicalEvents) {
-    if (event.kind === "TOOL" && event.status !== "running") {
-      const name = resolveCanonicalToolName(event);
-      const list = toolsByName.get(name) ?? [];
-      list.push(event);
-      toolsByName.set(name, list);
-    }
-    if (event.kind === "LLM" && event.status !== "running") {
-      llmEvents.push(event);
+function eventValueEntries(event, options = {}) {
+  const entries = [];
+  if (event.attributes !== void 0) {
+    pushValueEntries(entries, event, event.attributes, "attributes", "attributes");
+  }
+  if (options.includeSummaries) {
+    if (event.inputSummary !== void 0) {
+      pushValueEntries(entries, event, event.inputSummary, "inputSummary", "inputSummary");
     }
-    if (event.kind === "OUTCOME") {
-      outcomeEvents.push(event);
+    if (event.outputSummary !== void 0) {
+      pushValueEntries(entries, event, event.outputSummary, "outputSummary", "outputSummary");
     }
   }
-  for (const [name, list] of [...toolsByName.entries()]) {
-    toolsByName.set(name, Object.freeze([...list]));
+  if (options.includeError && event.error !== void 0) {
+    pushValueEntries(entries, event, event.error, "error", "error");
   }
-  const derived = deriveFailureFacts(projection.logicalEvents);
-  const relationship = deriveRelationshipFacts(events);
-  const summary = summarizeSemanticParity(events);
-  return {
-    rawEvents: Object.freeze([...events]),
-    logicalEvents: projection.logicalEvents,
-    diagnostics: projection.diagnostics,
-    toolsByName,
-    llmEvents: Object.freeze(llmEvents),
-    outcomeEvents: Object.freeze(outcomeEvents),
-    summary: {
-      ...summary,
-      failureRoleCounts: derived.failureRoleCounts
-    },
-    failureFacts: derived.failureFacts,
-    failuresByRole: derived.failuresByRole,
-    relationships: relationship.relationships,
-    relationshipDiagnostics: relationship.diagnostics
-  };
+  return entries;
 }
-
-// packages/core/src/checks/contract.ts
-new Set(OBSERVED_OUTCOME_METHODS);
-
-// packages/core/src/checks/index.ts
-var SEVERITY_RANK = {
-  error: 0,
-  warning: 1,
-  info: 2
-};
-var STATUS_RANK = {
-  fail: 0,
-  warning: 1,
-  pass: 2
-};
-var DEFAULT_SENSITIVE_KEYS = DEFAULT_CREDENTIAL_SENSITIVE_KEYS;
-var DEFAULT_RAW_CONTENT_KEYS = [
-  "body",
-  "headers",
-  "input",
-  "messages",
-  "output",
-  "payload",
-  "prompt",
-  "requestbody",
-  "request_body",
-  "responsebody",
-  "response_body",
-  "rawprompt",
-  "raw_prompt",
-  "rawoutput",
-  "raw_output",
-  "toolinput",
-  "tool_input",
-  "tooloutput",
-  "tool_output",
-  // Framework / agent metadata that carries user or task text
-  "currenttask",
-  "current_task",
-  "task",
-  "userinput",
-  "user_input",
-  "requesttext",
-  "request_text",
-  "conversationtext",
-  "conversation_text"
-];
-var DEFAULT_SAFE_RAW_CONTENT_PATH_PREFIXES = [
-  "tokenUsage",
-  "usage",
-  "tokens"
-];
-var SAFE_USAGE_LEAF_KEYS = /* @__PURE__ */ new Set([
-  "input",
-  "output",
-  "total",
-  "cached",
-  "input_tokens",
-  "inputtokens",
-  "output_tokens",
-  "outputtokens",
-  "total_tokens",
-  "totaltokens",
-  "prompt_tokens",
-  "prompttokens",
-  "completion_tokens",
-  "completiontokens"
-]);
-var DEFAULT_SECRET_PATTERNS = [
-  { id: "bearer-token", pattern: /Bearer\s+[A-Za-z0-9._~+/-]{12,}=*/ },
-  { id: "openai-key", pattern: /sk-[A-Za-z0-9_-]{16,}/ },
-  { id: "aws-access-key", pattern: /AKIA[0-9A-Z]{16}/ },
-  { id: "github-token", pattern: /gh[opsu]_[A-Za-z0-9_]{20,}/ },
-  // Keep in sync with packages/redact/src/key-value-secret.ts (KEY_VALUE_SECRET_PATTERN_SOURCE).
-  {
-    id: "key-value-secret",
-    pattern: /\b(?:api[_-]?key|internal[_-]?token|access[_-]?token|auth[_-]?token|password|secret|token)=([^\s"'\\]{8,})/i
-  }
-];
-function compareStrings(a, b) {
-  return (a ?? "").localeCompare(b ?? "");
+function limitFindings(findings, maxFindings) {
+  if (maxFindings === void 0 || findings.length <= maxFindings) return findings;
+  return findings.slice(0, Math.max(0, maxFindings));
 }
-function diagnostic(code, message, ruleId) {
+function hasRedactionMarker(value, markers) {
+  return markers.some((marker) => value.includes(marker)) || /^\[HASH:[A-Za-z0-9_-]+\]$/.test(value);
+}
+function isSensitiveKey(key, sensitiveKeys) {
+  return isCredentialSensitiveKey(key, sensitiveKeys);
+}
+function isRawContentKey(key, forbiddenKeys) {
+  if (!key) return false;
+  const normalized = normalizedKey(key);
+  return forbiddenKeys.some((forbidden) => normalized === normalizedKey(forbidden));
+}
+function isSafeRawContentMetricPath(path17, key, safePathPrefixes) {
+  const leaf = normalizedKey(key ?? lastPathSegment(path17));
+  if (!SAFE_USAGE_LEAF_KEYS.has(leaf)) return false;
+  const parts = path17.split(".").filter(Boolean);
+  if (parts.length < 2) return false;
+  const parent = parts[parts.length - 2] ?? "";
+  const parentNorm = normalizedKey(parent);
+  return safePathPrefixes.some((prefix) => parentNorm === normalizedKey(prefix));
+}
+function isRawContentPath(path17, key, forbiddenKeys, safePathPrefixes) {
+  if (isSafeRawContentMetricPath(path17, key, safePathPrefixes)) return false;
+  return isRawContentKey(key ?? lastPathSegment(path17), forbiddenKeys);
+}
+function createRunStatusRule(options = {}) {
+  const expected = options.expected ?? "ok";
+  const allowIncomplete = options.allowIncomplete === true;
   return {
-    code,
-    message,
-    severity: "error",
-    ...ruleId ? { ruleId } : {}
+    id: "run.status",
+    category: "run",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const findings = [];
+      const actual = context.selectedRun?.status ?? "unknown";
+      if (actual !== expected) {
+        findings.push(
+          failFinding(
+            "run.status",
+            `Run status ${actual} did not match expected ${expected}.`,
+            runEvidence(context.selectedRun),
+            expected,
+            actual
+          )
+        );
+      }
+      if (!allowIncomplete) {
+        const running = semanticEvents(context).filter((event) => event.status === "running");
+        if (running.length > 0) {
+          findings.push(
+            failFinding(
+              "run.status",
+              "Run contains incomplete running events.",
+              running.map((event) => eventEvidence(event)),
+              "no running events",
+              running.length
+            )
+          );
+        }
+      }
+      return findings;
+    }
   };
 }
-function emptySummary() {
+function createSafetyRedactionRule(options = {}) {
+  const sensitiveKeys = options.sensitiveKeys ?? DEFAULT_SENSITIVE_KEYS;
+  const markers = options.redactedMarkers ?? ["[REDACTED]", "[REDACTED:"];
   return {
-    passed: 0,
-    failed: 0,
-    warnings: 0,
-    errors: 0,
-    rulesEvaluated: 0
+    id: "safety.redaction",
+    category: "safety",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const findings = [];
+      for (const event of context.events) {
+        for (const entry of eventValueEntries(event, { includeSummaries: true, includeError: true })) {
+          if (!isSensitiveKey(entry.key ?? lastPathSegment(entry.path), sensitiveKeys)) continue;
+          if (typeof entry.value === "string" && hasRedactionMarker(entry.value, markers)) continue;
+          findings.push(
+            failFinding(
+              "safety.redaction",
+              `Sensitive-looking field at ${entry.path} is not redacted.`,
+              [eventEvidence(event, entry.path)],
+              "redaction marker",
+              { path: entry.path, valueType: valueType(entry.value) },
+              {
+                category: "credential",
+                confidence: "high",
+                detector: "safety.redaction",
+                action: "redact"
+              }
+            )
+          );
+        }
+      }
+      return limitFindings(findings, options.maxFindings);
+    }
   };
 }
-function errorResult(input, diagnostics, selectedRun, ruleExecutions = []) {
+function createSafetyRawContentRule(options = {}) {
+  const forbiddenKeys = options.forbiddenKeys ?? DEFAULT_RAW_CONTENT_KEYS;
+  const safePathPrefixes = options.safePathPrefixes ?? DEFAULT_SAFE_RAW_CONTENT_PATH_PREFIXES;
   return {
-    ok: false,
-    status: "error",
-    format: input.read.format,
-    ...selectedRun ? { runId: selectedRun.runId } : {},
-    summary: {
-      ...emptySummary(),
-      errors: diagnostics.filter((item) => item.severity === "error").length,
-      rulesEvaluated: ruleExecutions.length
-    },
-    findings: [],
-    diagnostics: [...diagnostics],
-    ruleExecutions: [...ruleExecutions]
+    id: "safety.rawPrompt",
+    category: "safety",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const findings = [];
+      for (const event of context.events) {
+        for (const entry of eventValueEntries(event, { includeSummaries: options.includeSummaries })) {
+          const key = entry.key ?? lastPathSegment(entry.path);
+          if (!isRawContentPath(entry.path, key, forbiddenKeys, safePathPrefixes)) continue;
+          findings.push(
+            failFinding(
+              "safety.rawPrompt",
+              `Raw content-like field ${entry.path} is present.`,
+              [eventEvidence(event, entry.path)],
+              "metadata-only trace fields",
+              { path: entry.path, valueType: valueType(entry.value) },
+              {
+                category: "raw-content",
+                confidence: "high",
+                detector: "safety.rawPrompt",
+                action: "redact-or-omit"
+              }
+            )
+          );
+        }
+      }
+      return limitFindings(findings, options.maxFindings);
+    }
   };
 }
-function flattenNodes(nodes) {
-  return nodes.flatMap((node) => [node, ...flattenNodes(node.children)]);
+function createSafetySecretPatternRule(options = {}) {
+  const patterns = options.patterns ?? DEFAULT_SECRET_PATTERNS;
+  const maxStringLength = options.maxStringLength ?? 4096;
+  return {
+    id: "safety.secretPattern",
+    category: "safety",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const findings = [];
+      for (const event of context.events) {
+        for (const entry of eventValueEntries(event, { includeSummaries: true, includeError: true })) {
+          if (typeof entry.value !== "string") continue;
+          const sample = entry.value.slice(0, maxStringLength);
+          for (const pattern of patterns) {
+            pattern.pattern.lastIndex = 0;
+            if (!pattern.pattern.test(sample)) continue;
+            pattern.pattern.lastIndex = 0;
+            findings.push(
+              failFinding(
+                "safety.secretPattern",
+                `Secret-like pattern ${pattern.id} matched at ${entry.path}.`,
+                [eventEvidence(event, entry.path)],
+                "no secret-like strings",
+                { pattern: pattern.id, path: entry.path },
+                {
+                  category: "credential",
+                  confidence: "high",
+                  detector: pattern.id,
+                  action: "redact"
+                }
+              )
+            );
+            break;
+          }
+        }
+      }
+      return limitFindings(findings, options.maxFindings);
+    }
+  };
 }
-function buildFacts(input, selectedRun) {
-  const scopedRuns = selectedRun ? [selectedRun] : input.read.runs;
-  const scopedRunIds = new Set(scopedRuns.map((run) => run.runId));
-  const scopedEvents = selectedRun === void 0 ? input.read.events : input.read.events.filter((event) => scopedRunIds.has(event.runId));
-  const nodes = flattenNodes(scopedRuns.flatMap((run) => run.children));
-  const nodesByEventId = /* @__PURE__ */ new Map();
-  const childrenByParentId = /* @__PURE__ */ new Map();
-  for (const node of nodes) {
-    nodesByEventId.set(node.event.eventId, node);
-    const parentId = node.event.parentId;
-    if (parentId) {
-      const children = childrenByParentId.get(parentId) ?? [];
-      children.push(node);
-      childrenByParentId.set(parentId, children);
+function createSafetyOversizedAttributeRule(options) {
+  return {
+    id: "safety.oversizedAttribute",
+    category: "safety",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const findings = [];
+      for (const event of context.events) {
+        for (const entry of eventValueEntries(event, { includeSummaries: true, includeError: true })) {
+          if (typeof entry.value === "string" && options.maxStringLength !== void 0 && entry.value.length > options.maxStringLength) {
+            findings.push(
+              failFinding(
+                "safety.oversizedAttribute",
+                `String at ${entry.path} exceeds ${options.maxStringLength} characters.`,
+                [eventEvidence(event, entry.path)],
+                { maxStringLength: options.maxStringLength },
+                { path: entry.path, length: entry.value.length },
+                {
+                  category: "size",
+                  confidence: "high",
+                  detector: "safety.oversizedAttribute",
+                  action: "truncate-or-omit"
+                }
+              )
+            );
+          }
+          if (Array.isArray(entry.value) && options.maxArrayLength !== void 0 && entry.value.length > options.maxArrayLength) {
+            findings.push(
+              failFinding(
+                "safety.oversizedAttribute",
+                `Array at ${entry.path} exceeds ${options.maxArrayLength} items.`,
+                [eventEvidence(event, entry.path)],
+                { maxArrayLength: options.maxArrayLength },
+                { path: entry.path, length: entry.value.length },
+                {
+                  category: "size",
+                  confidence: "high",
+                  detector: "safety.oversizedAttribute",
+                  action: "truncate-or-omit"
+                }
+              )
+            );
+          }
+          if (isRecord8(entry.value) && options.maxObjectKeys !== void 0 && Object.keys(entry.value).length > options.maxObjectKeys) {
+            findings.push(
+              failFinding(
+                "safety.oversizedAttribute",
+                `Object at ${entry.path} exceeds ${options.maxObjectKeys} keys.`,
+                [eventEvidence(event, entry.path)],
+                { maxObjectKeys: options.maxObjectKeys },
+                { path: entry.path, keys: Object.keys(entry.value).length },
+                {
+                  category: "size",
+                  confidence: "high",
+                  detector: "safety.oversizedAttribute",
+                  action: "truncate-or-omit"
+                }
+              )
+            );
+          }
+          if (options.maxSerializedBytes !== void 0) {
+            const bytes = serializedByteLength(entry.value);
+            if (bytes !== void 0 && bytes > options.maxSerializedBytes) {
+              findings.push(
+                failFinding(
+                  "safety.oversizedAttribute",
+                  `Value at ${entry.path} exceeds ${options.maxSerializedBytes} serialized bytes.`,
+                  [eventEvidence(event, entry.path)],
+                  { maxSerializedBytes: options.maxSerializedBytes },
+                  { path: entry.path, bytes },
+                  {
+                    category: "size",
+                    confidence: "high",
+                    detector: "safety.oversizedAttribute",
+                    action: "truncate-or-omit"
+                  }
+                )
+              );
+            }
+          }
+        }
+      }
+      return limitFindings(findings, options.maxFindings);
     }
-  }
-  const projection = projectLogicalEvents(scopedEvents);
-  return {
-    format: input.read.format,
-    runs: Object.freeze([...input.read.runs]),
-    events: Object.freeze([...scopedEvents]),
-    logicalEvents: projection.logicalEvents,
-    logicalProjectionDiagnostics: projection.diagnostics,
-    readerWarnings: Object.freeze([...input.read.warnings]),
-    unsupportedFields: Object.freeze([...input.read.unsupportedFields]),
-    sourceFiles: Object.freeze([...input.read.sourceFiles]),
-    nodesByEventId,
-    childrenByParentId,
-    rootNodes: Object.freeze(scopedRuns.flatMap((run) => run.children))
   };
 }
-function resolveSelectedRun(input, runId) {
-  if (input.selectedRun) {
-    if (runId && input.selectedRun.runId !== runId) {
-      return {
-        diagnostics: [
-          diagnostic(
-            "AI_CHECK_INVALID_ARGUMENTS",
-            `Selected run ${input.selectedRun.runId} does not match requested run ${runId}.`
-          )
-        ]
-      };
-    }
-    return { run: input.selectedRun, diagnostics: [] };
-  }
-  if (runId) {
-    const run = input.read.runs.find((candidate) => candidate.runId === runId);
-    if (!run) {
-      return {
-        diagnostics: [
-          diagnostic("AI_CHECK_RUN_SELECTION_REQUIRED", `Run not found: ${runId}.`)
-        ]
-      };
-    }
-    return { run, diagnostics: [] };
+function runTraceChecks(input, options = {}) {
+  const selected = resolveSelectedRun(input, options.runId);
+  if (selected.diagnostics.length > 0) {
+    return errorResult(input, selected.diagnostics, selected.run);
   }
-  if (input.read.runs.length === 1) {
-    return { run: input.read.runs[0], diagnostics: [] };
+  const rules = selectRules(options.rules ?? [], options.select);
+  if (rules.diagnostics.length > 0) {
+    return errorResult(input, rules.diagnostics, selected.run);
   }
-  if (input.read.runs.length === 0) {
-    return {
-      diagnostics: [
+  if (rules.rules.length === 0) {
+    return errorResult(
+      input,
+      [
         diagnostic(
-          "AI_CHECK_RUN_SELECTION_REQUIRED",
-          formatProgrammaticDiagnostic(
-            "AI_TRACE_CONTRACT_RUN_SELECTION_REQUIRED",
-            "No runs are available for checks."
-          )
+          "AI_CHECK_NO_RULES_EVALUATED",
+          "No trace check rules were evaluated. Configure at least one rule, contract, or CLI check option."
         )
-      ]
-    };
+      ],
+      selected.run
+    );
   }
-  return {
-    diagnostics: [
-      diagnostic(
-        "AI_CHECK_RUN_SELECTION_REQUIRED",
-        formatProgrammaticDiagnostic("AI_TRACE_CONTRACT_RUN_SELECTION_REQUIRED")
-      )
-    ]
+  const facts = buildFacts(input, selected.run);
+  const context = {
+    ...facts,
+    ...selected.run ? { selectedRun: selected.run } : {},
+    ...input.sourceLabel ? { sourceLabel: input.sourceLabel } : {}
   };
-}
-function selectRules(rules, selectedIds) {
   const diagnostics = [];
-  const byId = /* @__PURE__ */ new Map();
-  for (const rule of rules) {
-    if (byId.has(rule.id)) {
+  const findings = [];
+  const ruleExecutions = [];
+  for (const rule of rules.rules) {
+    try {
+      const ruleFindings = rule.evaluate(context).map((finding) => normalizeFinding(rule, finding));
+      findings.push(...ruleFindings);
+      ruleExecutions.push({
+        ruleId: rule.id,
+        category: rule.category,
+        status: classifyRuleExecution(ruleFindings, false),
+        findingCount: ruleFindings.length,
+        ...selected.run ? { runId: selected.run.runId } : {}
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
       diagnostics.push(
-        diagnostic("AI_CHECK_INVALID_CONFIG", `Duplicate trace check rule id: ${rule.id}.`, rule.id)
+        diagnostic("AI_CHECK_INTERNAL_ERROR", `Rule ${rule.id} failed: ${message}`, rule.id)
       );
-      continue;
+      ruleExecutions.push({
+        ruleId: rule.id,
+        category: rule.category,
+        status: "error",
+        findingCount: 0,
+        ...selected.run ? { runId: selected.run.runId } : {}
+      });
     }
-    byId.set(rule.id, rule);
   }
-  if (selectedIds && selectedIds.length > 0) {
-    const selected = new Set(selectedIds);
-    for (const id of selected) {
-      if (!byId.has(id)) {
-        diagnostics.push(
-          diagnostic("AI_CHECK_INVALID_CONFIG", `Unknown trace check rule id: ${id}.`, id)
-        );
-      }
-    }
-    return {
-      rules: [...byId.values()].filter((rule) => selected.has(rule.id)).sort(compareRules),
-      diagnostics
-    };
+  if (diagnostics.length > 0) {
+    return errorResult(input, diagnostics, selected.run, ruleExecutions);
   }
-  return { rules: [...byId.values()].sort(compareRules), diagnostics };
-}
-function compareRules(a, b) {
-  return a.id.localeCompare(b.id);
-}
-function eventTimestamp(finding, eventById) {
-  const eventId = finding.evidence[0]?.eventId;
-  return eventId ? eventById.get(eventId)?.timestamp ?? "" : "";
-}
-function compareFindings(eventById) {
-  return (a, b) => {
-    if (SEVERITY_RANK[a.severity] !== SEVERITY_RANK[b.severity]) {
-      return SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity];
-    }
-    const byRule = a.ruleId.localeCompare(b.ruleId);
-    if (byRule !== 0) return byRule;
-    if (STATUS_RANK[a.status] !== STATUS_RANK[b.status]) {
-      return STATUS_RANK[a.status] - STATUS_RANK[b.status];
-    }
-    const byRun = compareStrings(a.evidence[0]?.runId, b.evidence[0]?.runId);
-    if (byRun !== 0) return byRun;
-    const byTime = eventTimestamp(a, eventById).localeCompare(eventTimestamp(b, eventById));
-    if (byTime !== 0) return byTime;
-    const byEvent = compareStrings(a.evidence[0]?.eventId, b.evidence[0]?.eventId);
-    if (byEvent !== 0) return byEvent;
-    return compareStrings(a.evidence[0]?.path, b.evidence[0]?.path);
-  };
-}
-function normalizeFinding(rule, finding) {
-  return {
-    ruleId: finding.ruleId || rule.id,
-    severity: finding.severity ?? rule.defaultSeverity,
-    status: finding.status,
-    message: finding.message,
-    ...finding.expected !== void 0 ? { expected: finding.expected } : {},
-    ...finding.actual !== void 0 ? { actual: finding.actual } : {},
-    evidence: [...finding.evidence ?? []],
-    ...finding.category !== void 0 ? { category: finding.category } : {},
-    ...finding.confidence !== void 0 ? { confidence: finding.confidence } : {},
-    ...finding.detector !== void 0 ? { detector: finding.detector } : {},
-    ...finding.action !== void 0 ? { action: finding.action } : {}
-  };
-}
-function summarize(findings, diagnostics, rulesEvaluated) {
+  const eventById = new Map(input.read.events.map((event) => [event.eventId, event]));
+  const sortedFindings = findings.sort(compareFindings(eventById));
+  const summary = summarize(sortedFindings, diagnostics, ruleExecutions.length);
+  const status = summary.failed > 0 ? "fail" : "pass";
   return {
-    passed: findings.filter((finding) => finding.status === "pass").length,
-    failed: findings.filter(
-      (finding) => finding.status === "fail" && finding.severity === "error"
-    ).length,
-    warnings: findings.filter(
-      (finding) => finding.status === "warning" || finding.severity === "warning"
-    ).length,
-    errors: diagnostics.filter((item) => item.severity === "error").length,
-    rulesEvaluated
+    ok: status === "pass",
+    status,
+    format: input.read.format,
+    ...selected.run ? { runId: selected.run.runId } : {},
+    summary,
+    findings: sortedFindings,
+    diagnostics,
+    ruleExecutions
   };
 }
-function classifyRuleExecution(findings, threw) {
-  if (findings.some((finding) => finding.status === "fail" && finding.severity === "error")) {
-    return "fail";
-  }
-  if (findings.some(
-    (finding) => finding.status === "warning" || finding.severity === "warning"
-  )) {
-    return "warning";
+
+// packages/core/src/checks/contract.ts
+new Set(OBSERVED_OUTCOME_METHODS);
+
+// packages/core/src/exporters/helpers.ts
+var REDACT_SUBSTRINGS = [
+  "authorization",
+  "cookie",
+  "token",
+  "apikey",
+  "password",
+  "secret",
+  "email"
+];
+function shouldRedactKey(key) {
+  const k = key.toLowerCase();
+  for (const s of REDACT_SUBSTRINGS) {
+    if (k.includes(s)) return true;
   }
-  return "pass";
-}
-function eventEvidence(event, path17) {
-  return {
-    runId: event.runId,
-    eventId: event.eventId,
-    parentId: event.parentId,
-    traceId: event.trace?.traceId,
-    spanId: event.trace?.spanId,
-    kind: event.kind,
-    name: event.name,
-    status: event.status,
-    ...path17 ? { path: path17 } : {}
-  };
-}
-function runEvidence(run) {
-  return run ? [{ runId: run.runId, name: run.name, status: run.status }] : [];
-}
-function failFinding(ruleId, message, evidence, expected, actual, meta) {
-  return {
-    ruleId,
-    severity: meta?.severity ?? "error",
-    status: meta?.status ?? "fail",
-    message,
-    ...expected !== void 0 ? { expected } : {},
-    ...actual !== void 0 ? { actual } : {},
-    evidence: [...evidence],
-    ...meta?.category !== void 0 ? { category: meta.category } : {},
-    ...meta?.confidence !== void 0 ? { confidence: meta.confidence } : {},
-    ...meta?.detector !== void 0 ? { detector: meta.detector } : {},
-    ...meta?.action !== void 0 ? { action: meta.action } : {}
-  };
-}
-function semanticEvents(context) {
-  return context.logicalEvents ?? context.events;
-}
-function isRecord8(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
+  return false;
 }
-function normalizedKey(value) {
-  return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
+function safeString(value, maxLength) {
+  if (value === null || value === void 0) return "";
+  let s;
+  if (typeof value === "string") s = value;
+  else if (typeof value === "number" || typeof value === "boolean") s = String(value);
+  else s = stableJson(value, false);
+  if (maxLength !== void 0 && maxLength >= 0 && s.length > maxLength) {
+    return `${s.slice(0, maxLength)}\u2026`;
+  }
+  return s;
 }
-function lastPathSegment(path17) {
-  const parts = path17.split(".");
-  return parts[parts.length - 1] ?? path17;
+function escapeMarkdown(value) {
+  return value.replace(/\|/g, "\\|").replace(/\r\n/g, "\n").replace(/\r/g, "\n").replace(/\n/g, " ");
 }
-function valueType(value) {
-  if (Array.isArray(value)) return "array";
-  if (value === null) return "null";
-  return typeof value;
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
-function serializedByteLength(value) {
-  try {
-    return Buffer.byteLength(JSON.stringify(value), "utf-8");
-  } catch {
-    return void 0;
+function sortKeysDeep(input) {
+  if (input === null || typeof input !== "object") return input;
+  if (Array.isArray(input)) return input.map(sortKeysDeep);
+  const o = input;
+  const out = {};
+  for (const k of Object.keys(o).sort()) {
+    out[k] = sortKeysDeep(o[k]);
   }
+  return out;
 }
-function pushValueEntries(entries, event, value, path17, key, depth = 0) {
-  entries.push({ event, path: path17, key, value });
-  if (depth >= 8) return;
-  if (Array.isArray(value)) {
-    for (const [index, item] of value.entries()) {
-      pushValueEntries(entries, event, item, `${path17}.${index}`, String(index), depth + 1);
+function stableJson(value, pretty) {
+  const sorted = sortKeysDeep(value);
+  return pretty === true ? JSON.stringify(sorted, null, 2) : JSON.stringify(sorted);
+}
+function compactAttributes(attrs2, options) {
+  if (attrs2 === void 0) return {};
+  const maxLen = options?.maxLength ?? 500;
+  const redacted = options?.redacted ?? true;
+  const out = {};
+  for (const key of Object.keys(attrs2).sort()) {
+    if (redacted && shouldRedactKey(key)) {
+      out[key] = "[REDACTED]";
+      continue;
     }
-    return;
-  }
-  if (!isRecord8(value)) return;
-  for (const nestedKey of Object.keys(value).sort((a, b) => a.localeCompare(b))) {
-    pushValueEntries(
-      entries,
-      event,
-      value[nestedKey],
-      `${path17}.${nestedKey}`,
-      nestedKey,
-      depth + 1
-    );
+    const v = attrs2[key];
+    out[key] = compactValue(v, maxLen, redacted);
   }
+  return out;
 }
-function eventValueEntries(event, options = {}) {
-  const entries = [];
-  if (event.attributes !== void 0) {
-    pushValueEntries(entries, event, event.attributes, "attributes", "attributes");
+function compactValue(value, maxLen, redacted) {
+  if (value === null || typeof value !== "object") {
+    return typeof value === "string" ? safeString(value, maxLen) : value;
   }
-  if (options.includeSummaries) {
-    if (event.inputSummary !== void 0) {
-      pushValueEntries(entries, event, event.inputSummary, "inputSummary", "inputSummary");
-    }
-    if (event.outputSummary !== void 0) {
-      pushValueEntries(entries, event, event.outputSummary, "outputSummary", "outputSummary");
-    }
+  if (Array.isArray(value)) {
+    const arr = value.slice(0, 20).map((x) => compactValue(x, maxLen, redacted));
+    if (value.length > 20) arr.push(`\u2026(+${value.length - 20} more)`);
+    return arr;
   }
-  if (options.includeError && event.error !== void 0) {
-    pushValueEntries(entries, event, event.error, "error", "error");
+  const o = value;
+  const inner = {};
+  for (const k of Object.keys(o)) {
+    if (redacted && shouldRedactKey(k)) inner[k] = "[REDACTED]";
+    else inner[k] = compactValue(o[k], maxLen, redacted);
   }
-  return entries;
-}
-function limitFindings(findings, maxFindings) {
-  if (maxFindings === void 0 || findings.length <= maxFindings) return findings;
-  return findings.slice(0, Math.max(0, maxFindings));
-}
-function hasRedactionMarker(value, markers) {
-  return markers.some((marker) => value.includes(marker)) || /^\[HASH:[A-Za-z0-9_-]+\]$/.test(value);
-}
-function isSensitiveKey(key, sensitiveKeys) {
-  return isCredentialSensitiveKey(key, sensitiveKeys);
+  return inner;
 }
-function isRawContentKey(key, forbiddenKeys) {
-  if (!key) return false;
-  const normalized = normalizedKey(key);
-  return forbiddenKeys.some((forbidden) => normalized === normalizedKey(forbidden));
+function flattenTree(tree) {
+  const out = [];
+  function walk(nodes) {
+    for (const n of nodes) {
+      out.push(n);
+      if (n.children.length > 0) walk(n.children);
+    }
+  }
+  walk(tree.children);
+  return out;
 }
-function isSafeRawContentMetricPath(path17, key, safePathPrefixes) {
-  const leaf = normalizedKey(key ?? lastPathSegment(path17));
-  if (!SAFE_USAGE_LEAF_KEYS.has(leaf)) return false;
-  const parts = path17.split(".").filter(Boolean);
-  if (parts.length < 2) return false;
-  const parent = parts[parts.length - 2] ?? "";
-  const parentNorm = normalizedKey(parent);
-  return safePathPrefixes.some((prefix) => parentNorm === normalizedKey(prefix));
+
+// packages/core/src/diff/comparable.ts
+function extractOutputPreview(meta) {
+  if (meta === void 0) return void 0;
+  if ("outputPreview" in meta) return meta.outputPreview;
+  if ("resultPreview" in meta) return meta.resultPreview;
+  return void 0;
 }
-function isRawContentPath(path17, key, forbiddenKeys, safePathPrefixes) {
-  if (isSafeRawContentMetricPath(path17, key, safePathPrefixes)) return false;
-  return isRawContentKey(key ?? lastPathSegment(path17), forbiddenKeys);
+function mapStepStatus(s) {
+  if (s === void 0) return "running";
+  return s;
 }
-function createRunStatusRule(options = {}) {
-  const expected = options.expected ?? "ok";
-  const allowIncomplete = options.allowIncomplete === true;
-  return {
-    id: "run.status",
-    category: "run",
-    defaultSeverity: "error",
-    evaluate(context) {
-      const findings = [];
-      const actual = context.selectedRun?.status ?? "unknown";
-      if (actual !== expected) {
-        findings.push(
-          failFinding(
-            "run.status",
-            `Run status ${actual} did not match expected ${expected}.`,
-            runEvidence(context.selectedRun),
-            expected,
-            actual
-          )
-        );
-      }
-      if (!allowIncomplete) {
-        const running = semanticEvents(context).filter((event) => event.status === "running");
-        if (running.length > 0) {
-          findings.push(
-            failFinding(
-              "run.status",
-              "Run contains incomplete running events.",
-              running.map((event) => eventEvidence(event)),
-              "no running events",
-              running.length
-            )
-          );
-        }
-      }
-      return findings;
+function manualTraceEventsToComparableRun(events) {
+  const started = events.find((e) => e.event === "run_started");
+  if (!started || started.event !== "run_started") {
+    throw new Error("Invalid trace: missing run_started");
+  }
+  const rs = started;
+  const runId = rs.runId;
+  const completedAll = events.filter((e) => e.event === "run_completed");
+  const lastCompleted = completedAll[completedAll.length - 1];
+  let runStatus;
+  if (lastCompleted === void 0) runStatus = "running";
+  else runStatus = lastCompleted.status;
+  const durationMs = lastCompleted !== void 0 && Number.isFinite(lastCompleted.durationMs) ? lastCompleted.durationMs : void 0;
+  const steps = /* @__PURE__ */ new Map();
+  let order = 0;
+  for (const e of events) {
+    if (e.event !== "step_started") continue;
+    const s = e;
+    const meta = s.metadata ? { ...s.metadata } : void 0;
+    steps.set(s.stepId, {
+      id: s.stepId,
+      parentId: s.parentId,
+      name: s.name,
+      type: s.type,
+      order: order++,
+      timestamp: s.timestamp,
+      metadata: meta
+    });
+  }
+  for (const e of events) {
+    if (e.event !== "step_completed") continue;
+    const acc = steps.get(e.stepId);
+    if (!acc) continue;
+    acc.status = e.status;
+    acc.durationMs = e.durationMs;
+    if (e.error?.message) acc.errorMsg = e.error.message;
+    const extra = e;
+    if (extra.metadata !== void 0 && typeof extra.metadata === "object") {
+      acc.metadata = { ...acc.metadata ?? {}, ...extra.metadata };
+    }
+  }
+  const nodes = /* @__PURE__ */ new Map();
+  for (const acc of steps.values()) {
+    let meta = acc.metadata ? { ...acc.metadata } : void 0;
+    if (acc.parentId !== void 0 && !steps.has(acc.parentId)) {
+      meta = { ...meta ?? {}, agent_inspect_diff_parent_missing: true };
+    }
+    const outputPreview = extractOutputPreview(meta);
+    if (meta !== void 0 && ("outputPreview" in meta || "resultPreview" in meta)) {
+      delete meta.outputPreview;
+      delete meta.resultPreview;
+    }
+    const sc = {
+      id: acc.id,
+      name: acc.name,
+      type: acc.type,
+      status: mapStepStatus(acc.status),
+      durationMs: acc.durationMs,
+      error: acc.errorMsg,
+      metadata: meta && Object.keys(meta).length > 0 ? meta : void 0,
+      outputPreview,
+      children: []
+    };
+    nodes.set(acc.id, sc);
+  }
+  const roots = [];
+  const sortByOrder = (a, b) => {
+    const oa = steps.get(a.id)?.order ?? 0;
+    const ob = steps.get(b.id)?.order ?? 0;
+    return oa - ob;
+  };
+  for (const acc of steps.values()) {
+    const node = nodes.get(acc.id);
+    if (acc.parentId !== void 0 && nodes.has(acc.parentId)) {
+      nodes.get(acc.parentId).children.push(node);
+    } else {
+      roots.push(node);
     }
+  }
+  roots.sort(sortByOrder);
+  for (const n of nodes.values()) {
+    n.children.sort(sortByOrder);
+  }
+  return {
+    runId,
+    name: rs.name,
+    status: runStatus,
+    durationMs,
+    steps: roots
   };
 }
-function createSafetyRedactionRule(options = {}) {
-  const sensitiveKeys = options.sensitiveKeys ?? DEFAULT_SENSITIVE_KEYS;
-  const markers = options.redactedMarkers ?? ["[REDACTED]", "[REDACTED:"];
-  return {
-    id: "safety.redaction",
-    category: "safety",
-    defaultSeverity: "error",
-    evaluate(context) {
-      const findings = [];
-      for (const event of context.events) {
-        for (const entry of eventValueEntries(event, { includeSummaries: true, includeError: true })) {
-          if (!isSensitiveKey(entry.key ?? lastPathSegment(entry.path), sensitiveKeys)) continue;
-          if (typeof entry.value === "string" && hasRedactionMarker(entry.value, markers)) continue;
-          findings.push(
-            failFinding(
-              "safety.redaction",
-              `Sensitive-looking field at ${entry.path} is not redacted.`,
-              [eventEvidence(event, entry.path)],
-              "redaction marker",
-              { path: entry.path, valueType: valueType(entry.value) },
-              {
-                category: "credential",
-                confidence: "high",
-                detector: "safety.redaction",
-                action: "redact"
-              }
-            )
-          );
-        }
+
+// packages/core/src/diff/engine.ts
+var DEFAULT_THRESHOLD_MS = 0;
+function pathSeg(step, index) {
+  return { index, name: step.name, stepId: step.id };
+}
+function buildPath(segments) {
+  return { path: [...segments] };
+}
+function pairSteps(left, right) {
+  const usedRight = /* @__PURE__ */ new Set();
+  const pairs = [];
+  for (let i = 0; i < left.length; i++) {
+    const L = left[i];
+    let R = right.find((r) => !usedRight.has(r.id) && r.id === L.id);
+    if (R === void 0 && i < right.length && !usedRight.has(right[i].id)) {
+      const cand = right[i];
+      if (cand.name === L.name && (cand.type ?? "") === (L.type ?? "")) {
+        R = cand;
       }
-      return limitFindings(findings, options.maxFindings);
     }
-  };
+    if (R === void 0) {
+      R = right.find(
+        (r) => !usedRight.has(r.id) && r.name === L.name && (r.type ?? "") === (L.type ?? "")
+      );
+    }
+    if (R !== void 0) {
+      usedRight.add(R.id);
+      pairs.push([L, R]);
+    } else {
+      pairs.push([L, void 0]);
+    }
+  }
+  for (const R of right) {
+    if (!usedRight.has(R.id)) {
+      pairs.push([void 0, R]);
+    }
+  }
+  return pairs;
 }
-function createSafetyRawContentRule(options = {}) {
-  const forbiddenKeys = options.forbiddenKeys ?? DEFAULT_RAW_CONTENT_KEYS;
-  const safePathPrefixes = options.safePathPrefixes ?? DEFAULT_SAFE_RAW_CONTENT_PATH_PREFIXES;
-  return {
-    id: "safety.rawPrompt",
-    category: "safety",
-    defaultSeverity: "error",
-    evaluate(context) {
-      const findings = [];
-      for (const event of context.events) {
-        for (const entry of eventValueEntries(event, { includeSummaries: options.includeSummaries })) {
-          const key = entry.key ?? lastPathSegment(entry.path);
-          if (!isRawContentPath(entry.path, key, forbiddenKeys, safePathPrefixes)) continue;
-          findings.push(
-            failFinding(
-              "safety.rawPrompt",
-              `Raw content-like field ${entry.path} is present.`,
-              [eventEvidence(event, entry.path)],
-              "metadata-only trace fields",
-              { path: entry.path, valueType: valueType(entry.value) },
-              {
-                category: "raw-content",
-                confidence: "high",
-                detector: "safety.rawPrompt",
-                action: "redact-or-omit"
-              }
-            )
-          );
-        }
-      }
-      return limitFindings(findings, options.maxFindings);
+function compareLeafSteps(L, R, segments, opts, out) {
+  const path17 = buildPath(segments);
+  if (L.name !== R.name) {
+    out.push({
+      kind: "structure",
+      severity: "warning",
+      message: "Step name differs",
+      path: path17,
+      left: L.name,
+      right: R.name
+    });
+  }
+  if ((L.type ?? "") !== (R.type ?? "")) {
+    out.push({
+      kind: "step-type",
+      severity: "warning",
+      message: "Step type differs",
+      path: path17,
+      left: L.type,
+      right: R.type
+    });
+  }
+  if ((L.status ?? "") !== (R.status ?? "")) {
+    out.push({
+      kind: "step-status",
+      severity: "warning",
+      message: "Step status differs",
+      path: path17,
+      left: L.status,
+      right: R.status
+    });
+  }
+  const le = L.error ?? "";
+  const re = R.error ?? "";
+  if (le !== re) {
+    out.push({
+      kind: "error",
+      severity: "error",
+      message: "Step error message differs",
+      path: path17,
+      left: le || void 0,
+      right: re || void 0
+    });
+  }
+  if (!opts.ignoreDuration) {
+    const ld = L.durationMs;
+    const rd = R.durationMs;
+    const th = opts.durationThresholdMs;
+    let differs = false;
+    if (ld === void 0 && rd === void 0) differs = false;
+    else if (ld === void 0 || rd === void 0) differs = true;
+    else differs = Math.abs(ld - rd) > th;
+    if (differs) {
+      out.push({
+        kind: "duration",
+        severity: "info",
+        message: "Step duration differs",
+        path: path17,
+        left: ld,
+        right: rd
+      });
     }
-  };
+  }
+  const lm = stableJson(L.metadata ?? {});
+  const rm = stableJson(R.metadata ?? {});
+  if (lm !== rm) {
+    out.push({
+      kind: "metadata",
+      severity: "info",
+      message: "Step metadata differs",
+      path: path17,
+      left: L.metadata,
+      right: R.metadata
+    });
+  }
+  const lo = stableJson(L.outputPreview ?? null);
+  const ro = stableJson(R.outputPreview ?? null);
+  if (lo !== ro) {
+    out.push({
+      kind: "output",
+      severity: "info",
+      message: "Output preview differs",
+      path: path17,
+      left: L.outputPreview,
+      right: R.outputPreview
+    });
+  }
 }
-function createSafetySecretPatternRule(options = {}) {
-  const patterns = options.patterns ?? DEFAULT_SECRET_PATTERNS;
-  const maxStringLength = options.maxStringLength ?? 4096;
-  return {
-    id: "safety.secretPattern",
-    category: "safety",
-    defaultSeverity: "error",
-    evaluate(context) {
-      const findings = [];
-      for (const event of context.events) {
-        for (const entry of eventValueEntries(event, { includeSummaries: true, includeError: true })) {
-          if (typeof entry.value !== "string") continue;
-          const sample = entry.value.slice(0, maxStringLength);
-          for (const pattern of patterns) {
-            pattern.pattern.lastIndex = 0;
-            if (!pattern.pattern.test(sample)) continue;
-            pattern.pattern.lastIndex = 0;
-            findings.push(
-              failFinding(
-                "safety.secretPattern",
-                `Secret-like pattern ${pattern.id} matched at ${entry.path}.`,
-                [eventEvidence(event, entry.path)],
-                "no secret-like strings",
-                { pattern: pattern.id, path: entry.path },
-                {
-                  category: "credential",
-                  confidence: "high",
-                  detector: pattern.id,
-                  action: "redact"
-                }
-              )
-            );
-            break;
-          }
-        }
-      }
-      return limitFindings(findings, options.maxFindings);
+function compareRecursive(L, R, segments, opts, out) {
+  compareLeafSteps(L, R, segments, opts, out);
+  const pairs = pairSteps(L.children, R.children);
+  let ci = 0;
+  for (const [lch, rch] of pairs) {
+    if (lch !== void 0 && rch !== void 0) {
+      compareRecursive(lch, rch, [...segments, pathSeg(lch, ci)], opts, out);
+    } else if (lch !== void 0) {
+      out.push({
+        kind: "step-removed",
+        severity: "warning",
+        message: `Step only in left run: ${lch.name}`,
+        path: buildPath([...segments, pathSeg(lch, ci)]),
+        left: lch.id,
+        right: void 0
+      });
+    } else if (rch !== void 0) {
+      out.push({
+        kind: "step-added",
+        severity: "warning",
+        message: `Step only in right run: ${rch.name}`,
+        path: buildPath([...segments, pathSeg(rch, ci)]),
+        left: void 0,
+        right: rch.id
+      });
     }
-  };
+    ci += 1;
+  }
 }
-function createSafetyOversizedAttributeRule(options) {
+function mergeDiffDefaults(options) {
   return {
-    id: "safety.oversizedAttribute",
-    category: "safety",
-    defaultSeverity: "error",
-    evaluate(context) {
-      const findings = [];
-      for (const event of context.events) {
-        for (const entry of eventValueEntries(event, { includeSummaries: true, includeError: true })) {
-          if (typeof entry.value === "string" && options.maxStringLength !== void 0 && entry.value.length > options.maxStringLength) {
-            findings.push(
-              failFinding(
-                "safety.oversizedAttribute",
-                `String at ${entry.path} exceeds ${options.maxStringLength} characters.`,
-                [eventEvidence(event, entry.path)],
-                { maxStringLength: options.maxStringLength },
-                { path: entry.path, length: entry.value.length },
-                {
-                  category: "size",
-                  confidence: "high",
-                  detector: "safety.oversizedAttribute",
-                  action: "truncate-or-omit"
-                }
-              )
-            );
-          }
-          if (Array.isArray(entry.value) && options.maxArrayLength !== void 0 && entry.value.length > options.maxArrayLength) {
-            findings.push(
-              failFinding(
-                "safety.oversizedAttribute",
-                `Array at ${entry.path} exceeds ${options.maxArrayLength} items.`,
-                [eventEvidence(event, entry.path)],
-                { maxArrayLength: options.maxArrayLength },
-                { path: entry.path, length: entry.value.length },
-                {
-                  category: "size",
-                  confidence: "high",
-                  detector: "safety.oversizedAttribute",
-                  action: "truncate-or-omit"
-                }
-              )
-            );
-          }
-          if (isRecord8(entry.value) && options.maxObjectKeys !== void 0 && Object.keys(entry.value).length > options.maxObjectKeys) {
-            findings.push(
-              failFinding(
-                "safety.oversizedAttribute",
-                `Object at ${entry.path} exceeds ${options.maxObjectKeys} keys.`,
-                [eventEvidence(event, entry.path)],
-                { maxObjectKeys: options.maxObjectKeys },
-                { path: entry.path, keys: Object.keys(entry.value).length },
-                {
-                  category: "size",
-                  confidence: "high",
-                  detector: "safety.oversizedAttribute",
-                  action: "truncate-or-omit"
-                }
-              )
-            );
-          }
-          if (options.maxSerializedBytes !== void 0) {
-            const bytes = serializedByteLength(entry.value);
-            if (bytes !== void 0 && bytes > options.maxSerializedBytes) {
-              findings.push(
-                failFinding(
-                  "safety.oversizedAttribute",
-                  `Value at ${entry.path} exceeds ${options.maxSerializedBytes} serialized bytes.`,
-                  [eventEvidence(event, entry.path)],
-                  { maxSerializedBytes: options.maxSerializedBytes },
-                  { path: entry.path, bytes },
-                  {
-                    category: "size",
-                    confidence: "high",
-                    detector: "safety.oversizedAttribute",
-                    action: "truncate-or-omit"
-                  }
-                )
-              );
-            }
-          }
-        }
-      }
-      return limitFindings(findings, options.maxFindings);
-    }
+    ignoreDuration: false,
+    durationThresholdMs: DEFAULT_THRESHOLD_MS,
+    focus: "all",
+    check: "all"
   };
 }
-function runTraceChecks(input, options = {}) {
-  const selected = resolveSelectedRun(input, options.runId);
-  if (selected.diagnostics.length > 0) {
-    return errorResult(input, selected.diagnostics, selected.run);
-  }
-  const rules = selectRules(options.rules ?? [], options.select);
-  if (rules.diagnostics.length > 0) {
-    return errorResult(input, rules.diagnostics, selected.run);
+function kindMatchesFilter(kind, merged) {
+  return true;
+}
+function diffRuns(left, right, options) {
+  const merged = mergeDiffDefaults();
+  const opts = {
+    ignoreDuration: merged.ignoreDuration,
+    durationThresholdMs: merged.durationThresholdMs
+  };
+  const raw = [];
+  if ((left.status ?? "") !== (right.status ?? "")) {
+    raw.push({
+      kind: "run-status",
+      severity: "warning",
+      message: "Run completion status differs",
+      left: left.status,
+      right: right.status
+    });
   }
-  if (rules.rules.length === 0) {
-    return errorResult(
-      input,
-      [
-        diagnostic(
-          "AI_CHECK_NO_RULES_EVALUATED",
-          "No trace check rules were evaluated. Configure at least one rule, contract, or CLI check option."
-        )
-      ],
-      selected.run
-    );
+  {
+    const ld = left.durationMs;
+    const rd = right.durationMs;
+    const th = merged.durationThresholdMs;
+    let differs = false;
+    if (ld === void 0 && rd === void 0) differs = false;
+    else if (ld === void 0 || rd === void 0) differs = true;
+    else differs = Math.abs(ld - rd) > th;
+    if (differs) {
+      raw.push({
+        kind: "duration",
+        severity: "info",
+        message: "Run duration differs",
+        left: ld,
+        right: rd
+      });
+    }
   }
-  const facts = buildFacts(input, selected.run);
-  const context = {
-    ...facts,
-    ...selected.run ? { selectedRun: selected.run } : {},
-    ...input.sourceLabel ? { sourceLabel: input.sourceLabel } : {}
-  };
-  const diagnostics = [];
-  const findings = [];
-  const ruleExecutions = [];
-  for (const rule of rules.rules) {
-    try {
-      const ruleFindings = rule.evaluate(context).map((finding) => normalizeFinding(rule, finding));
-      findings.push(...ruleFindings);
-      ruleExecutions.push({
-        ruleId: rule.id,
-        category: rule.category,
-        status: classifyRuleExecution(ruleFindings, false),
-        findingCount: ruleFindings.length,
-        ...selected.run ? { runId: selected.run.runId } : {}
+  const pairs = pairSteps(left.steps, right.steps);
+  let idx = 0;
+  for (const [ls, rs] of pairs) {
+    if (ls !== void 0 && rs !== void 0) {
+      compareRecursive(ls, rs, [pathSeg(ls, idx)], opts, raw);
+      idx += 1;
+    } else if (ls !== void 0) {
+      raw.push({
+        kind: "step-removed",
+        severity: "warning",
+        message: `Step only in left run: ${ls.name}`,
+        path: buildPath([pathSeg(ls, idx)]),
+        left: ls.id,
+        right: void 0
       });
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      diagnostics.push(
-        diagnostic("AI_CHECK_INTERNAL_ERROR", `Rule ${rule.id} failed: ${message}`, rule.id)
-      );
-      ruleExecutions.push({
-        ruleId: rule.id,
-        category: rule.category,
-        status: "error",
-        findingCount: 0,
-        ...selected.run ? { runId: selected.run.runId } : {}
+      idx += 1;
+    } else if (rs !== void 0) {
+      raw.push({
+        kind: "step-added",
+        severity: "warning",
+        message: `Step only in right run: ${rs.name}`,
+        path: buildPath([pathSeg(rs, idx)]),
+        left: void 0,
+        right: rs.id
       });
+      idx += 1;
     }
   }
-  if (diagnostics.length > 0) {
-    return errorResult(input, diagnostics, selected.run, ruleExecutions);
+  const differences = raw.filter((d) => kindMatchesFilter(d.kind));
+  let errors = 0;
+  let warnings = 0;
+  let info = 0;
+  for (const d of differences) {
+    if (d.severity === "error") errors += 1;
+    else if (d.severity === "warning") warnings += 1;
+    else info += 1;
   }
-  const eventById = new Map(input.read.events.map((event) => [event.eventId, event]));
-  const sortedFindings = findings.sort(compareFindings(eventById));
-  const summary = summarize(sortedFindings, diagnostics, ruleExecutions.length);
-  const status = summary.failed > 0 ? "fail" : "pass";
-  return {
-    ok: status === "pass",
-    status,
-    format: input.read.format,
-    ...selected.run ? { runId: selected.run.runId } : {},
-    summary,
-    findings: sortedFindings,
-    diagnostics,
-    ruleExecutions
+  const firstVisible = differences[0];
+  const firstDivergence = firstVisible !== void 0 ? {
+    kind: "first-divergence",
+    severity: firstVisible.severity,
+    message: `First divergence: ${firstVisible.message}`,
+    path: firstVisible.path,
+    left: firstVisible.left,
+    right: firstVisible.right
+  } : void 0;
+  const summary = {
+    leftRunId: left.runId,
+    rightRunId: right.runId,
+    totalDifferences: differences.length,
+    errors,
+    warnings,
+    info,
+    firstDivergence
   };
+  return { summary, differences };
 }
 
+// packages/core/src/evidence/zip.ts
+(() => {
+  const table = new Uint32Array(256);
+  for (let n = 0; n < 256; n += 1) {
+    let c = n;
+    for (let k = 0; k < 8; k += 1) {
+      c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
+    }
+    table[n] = c >>> 0;
+  }
+  return table;
+})();
+
 // packages/core/src/persisted/token-usage.ts
 function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);