@mhingston5/lasso 0.1.1 → 0.2.0

package/src/failures/types.ts

@@ -1,3 +1,6 @@
+import type { HarnessMutation } from "../mutation/types.js";
+import type { FailureClass } from "./ontology.js";
+
 export interface FailureRecord {
   domainType: string;
   rootCause:
@@ -12,3 +15,21 @@ export interface FailureRecord {
   nodeId?: string;
   message: string;
 }
+
+export interface Risk {
+  id: string;
+  probability: number;
+  impact: number;
+  score: number;
+  signals: string[];
+  mitigations: HarnessMutation[];
+  failureClass: FailureClass;
+  description: string;
+}
+
+export interface RiskAssessment {
+  risks: Risk[];
+  overallScore: number;
+  highRiskThreshold: number;
+  risksAboveThreshold: Risk[];
+}

package/src/index.ts

@@ -39,6 +39,7 @@ export { synthesizeHarness } from "./synthesis/harness-builder.js";
 export { createInitialVersion, createNextVersion, createLineageEntry } from "./versioning/history.js";
 export { prepareInitialAdaptiveInput, unwrapAdaptiveInput, prepareRuntimeReplan, MAX_ADAPTIVE_VERSIONS } from "./replanner/runtime.js";
 export type { MetaHarnessConfig, MetaHarnessResult, MetaHarness } from "./metaharness/types.js";
+export type { ExecutionTrace, CompletedNode, FailedNode, HarnessSynthesisResult } from "./metaharness/types.js";
 export { DefaultMetaHarness } from "./metaharness/engine.js";
 export { predictFailuresFromEnvironment } from "./metaharness/predictor.js";
 export { discoverEnvironment } from "./environment/discovery.js";

package/src/metaharness/engine.ts

@@ -1,10 +1,11 @@
 import type { HarnessSpec } from "../spec/types.js";
 import type { EnvironmentModel, EnvironmentAnalysis } from "../environment/types.js";
 import type { FailureSignature } from "../failures/ontology.js";
-import type { MemoryAdvice, MemoryStore } from "../memory/types.js";
+import type { MemoryAdvice } from "../memory/types.js";
 import type { CapabilityRegistry } from "../capabilities/types.js";
 import type { MutationPolicy, HarnessMutation } from "../mutation/types.js";
-import type { MetaHarnessConfig, MetaHarnessResult, MetaHarness } from "./types.js";
+import type { MetaHarnessConfig, MetaHarnessResult, MetaHarness, ExecutionTrace, HarnessSynthesisResult } from "./types.js";
+import { buildTraceEntries } from "./trace-adapter.js";
 import type { CompilerAnalysis } from "../compiler/feedback.js";
 import type { HarnessStage, CompositionResult } from "../composition/types.js";
 import { discoverEnvironment } from "../environment/discovery.js";
@@ -19,11 +20,12 @@ import { compileHarnessSpec } from "../compiler/compile.js";
 import { analyzeCompiledWorkflow } from "../compiler/feedback.js";
 import { predictFailuresFromEnvironment } from "./predictor.js";
 import { generateFailureModes } from "../failures/generator.js";
-import { deriveMutationsFromFailure } from "../mutation/derive.js";
+import { deriveMutationsFromFailure, deriveMutationsFromTrace } from "../mutation/derive.js";
 import { mutateHarness } from "../mutation/engine.js";
 import { chainHarnesses } from "../composition/chain.js";
 import { parallelHarnesses } from "../composition/parallel.js";
 import { conditionalHarness } from "../composition/conditional.js";
+import { classifyFailure } from "../failures/ontology.js";
 
 export class DefaultMetaHarness implements MetaHarness {
   constructor(private config: MetaHarnessConfig) {}
@@ -189,6 +191,89 @@ export class DefaultMetaHarness implements MetaHarness {
     };
   }
 
+  async synthesizeFromTrace(
+    trace: ExecutionTrace,
+    currentSpec: HarnessSpec,
+    environment: EnvironmentModel,
+  ): Promise<HarnessSynthesisResult> {
+    const rationale: string[] = [];
+    const allMutations: HarnessMutation[] = [];
+
+    // 1. Analyze trace for patterns
+    const repeatedFailures = findRepeatedFailures(trace.failedNodes);
+    const slowNodes = findSlowNodes(trace.completedNodes);
+    const costSpike = detectCostSpike(trace);
+
+    for (const [nodeId, count] of repeatedFailures) {
+      rationale.push(`Repeated failures (${count}x) on node "${nodeId}"`);
+    }
+    for (const [nodeId, durationMs] of slowNodes) {
+      rationale.push(`Slow node "${nodeId}": ${durationMs}ms duration`);
+    }
+    if (costSpike) {
+      rationale.push(`cost spike detected: $${trace.totalCostUsd?.toFixed(2) ?? "0.00"} total`);
+    }
+
+    // 2. Classify each failure and derive mutations
+    for (const failedNode of trace.failedNodes) {
+      const signature = classifyFailure(failedNode.error, { nodeId: failedNode.nodeId });
+      const mutations = deriveMutationsFromFailure(signature, currentSpec, { nodeId: failedNode.nodeId });
+      allMutations.push(...mutations);
+
+      if (mutations.length > 0) {
+        rationale.push(
+          `Classified failure on "${failedNode.nodeId}" as ${signature.class}, derived ${mutations.length} mutation(s)`,
+        );
+      }
+    }
+
+    // 3. Also derive mutations from the full trace using existing trace analysis
+    const traceEntries = buildTraceEntries(trace);
+    const traceMutations = deriveMutationsFromTrace(
+      {
+        entries: traceEntries,
+        totalDurationMs: trace.completedNodes.reduce(
+          (sum, n) => sum + (n.completedAt - n.startedAt), 0,
+        ),
+        nodeCount: trace.completedNodes.length + trace.failedNodes.length,
+        failureCount: trace.failedNodes.length,
+        startTimeMs: Math.min(
+          ...[...trace.completedNodes, ...trace.failedNodes].map(n => n.startedAt),
+          Date.now(),
+        ),
+        endTimeMs: trace.capturedAt,
+      },
+      currentSpec,
+    );
+    allMutations.push(...traceMutations);
+
+    if (traceMutations.length > 0) {
+      rationale.push(`Derived ${traceMutations.length} mutation(s) from execution trace patterns`);
+    }
+
+    // 4. Apply mutation policy if configured
+    const limitedMutations = this.config.mutationPolicy
+      ? enforceMutationPolicy(allMutations, this.config.mutationPolicy)
+      : allMutations;
+
+    // 5. Apply mutations
+    let updatedSpec = currentSpec;
+    if (limitedMutations.length > 0) {
+      const result = mutateHarness(currentSpec, limitedMutations);
+      updatedSpec = result.spec;
+    }
+
+    // 6. Determine decision
+    const decision = determineDecision(trace, rationale);
+
+    return {
+      mutations: limitedMutations,
+      spec: updatedSpec,
+      rationale,
+      decision,
+    };
+  }
+
   composeHarnesses(stages: HarnessStage[]): CompositionResult {
     return chainHarnesses(stages);
   }
@@ -254,3 +339,61 @@ function calculateReadinessScore(
 
   return Math.min(100, Math.max(0, score));
 }
+
+function findRepeatedFailures(failedNodes: ExecutionTrace["failedNodes"]): Map<string, number> {
+  const counts = new Map<string, number>();
+  for (const node of failedNodes) {
+    counts.set(node.nodeId, (counts.get(node.nodeId) ?? 0) + 1);
+  }
+  const repeated = new Map<string, number>();
+  for (const [nodeId, count] of counts) {
+    if (count >= 2) {
+      repeated.set(nodeId, count);
+    }
+  }
+  return repeated;
+}
+
+const SLOW_NODE_THRESHOLD_MS = 30_000;
+
+function findSlowNodes(
+  completedNodes: ExecutionTrace["completedNodes"],
+): Map<string, number> {
+  const slow = new Map<string, number>();
+  for (const node of completedNodes) {
+    const duration = node.completedAt - node.startedAt;
+    if (duration >= SLOW_NODE_THRESHOLD_MS) {
+      slow.set(node.nodeId, duration);
+    }
+  }
+  return slow;
+}
+
+const COST_SPIKE_THRESHOLD_USD = 5.0;
+
+function detectCostSpike(trace: ExecutionTrace): boolean {
+  return (trace.totalCostUsd ?? 0) >= COST_SPIKE_THRESHOLD_USD;
+}
+
+function determineDecision(
+  trace: ExecutionTrace,
+  rationale: string[],
+): HarnessSynthesisResult["decision"] {
+  const totalNodes = trace.completedNodes.length + trace.failedNodes.length;
+
+  const requiresHuman = trace.failedNodes.some(
+    n => n.error.toLowerCase().includes("approval required")
+      || n.error.toLowerCase().includes("human intervention"),
+  );
+  if (requiresHuman) {
+    rationale.push("Failure requires human intervention");
+    return "needs_operator_input";
+  }
+
+  if (totalNodes > 0 && trace.failedNodes.length === totalNodes) {
+    rationale.push("All nodes have failed — stopping execution");
+    return "stop";
+  }
+
+  return "continue";
+}

package/src/metaharness/trace-adapter.ts

@@ -0,0 +1,34 @@
+import type { ExecutionTraceEntry } from "../compiler/runtime-helpers.js";
+import type { ExecutionTrace } from "./types.js";
+
+export function buildTraceEntries(trace: ExecutionTrace): ExecutionTraceEntry[] {
+  const entries: ExecutionTraceEntry[] = [];
+
+  for (const node of trace.completedNodes) {
+    entries.push({
+      nodeId: node.nodeId,
+      source: undefined,
+      phase: "success",
+      startedAt: node.startedAt,
+      completedAt: node.completedAt,
+      outputSnapshot: node.output,
+    });
+  }
+
+  for (const node of trace.failedNodes) {
+    entries.push({
+      nodeId: node.nodeId,
+      source: undefined,
+      phase: "failure",
+      startedAt: node.startedAt,
+      completedAt: node.failedAt,
+      details: {
+        error: node.error,
+        category: node.failureClass ?? "unknown",
+        retryCount: node.retryCount,
+      },
+    });
+  }
+
+  return entries;
+}

package/src/metaharness/types.ts

@@ -8,6 +8,42 @@ import type { MutationPolicy, HarnessMutation } from "../mutation/types.js";
 import type { CompilerAnalysis, CompilerSuggestion } from "../compiler/feedback.js";
 import type { HarnessStage, CompositionResult } from "../composition/types.js";
 
+// ============================================================================
+// Mid-execution trace synthesis types
+// ============================================================================
+
+export interface CompletedNode {
+  nodeId: string;
+  startedAt: number;
+  completedAt: number;
+  output?: unknown;
+  costUsd?: number;
+}
+
+export interface FailedNode {
+  nodeId: string;
+  startedAt: number;
+  failedAt: number;
+  error: string;
+  failureClass?: string;
+  retryCount: number;
+}
+
+export interface ExecutionTrace {
+  completedNodes: CompletedNode[];
+  failedNodes: FailedNode[];
+  currentNodeId?: string;
+  capturedAt: number;
+  totalCostUsd?: number;
+}
+
+export interface HarnessSynthesisResult {
+  mutations: HarnessMutation[];
+  spec: HarnessSpec;
+  rationale: string[];
+  decision: "continue" | "needs_operator_input" | "stop";
+}
+
 export interface MetaHarnessConfig {
   environmentModel?: EnvironmentModel;
   memoryStore?: MemoryStore;
@@ -34,6 +70,11 @@ export interface MetaHarness {
   predictFailures(spec: HarnessSpec, env: EnvironmentModel): Promise<FailureSignature[]>;
   synthesizePolicies(spec: HarnessSpec, failures: FailureSignature[]): HarnessSpec;
   generateHarness(intent: string, config?: MetaHarnessConfig): Promise<MetaHarnessResult>;
+  synthesizeFromTrace(
+    trace: ExecutionTrace,
+    currentSpec: HarnessSpec,
+    environment: EnvironmentModel,
+  ): Promise<HarnessSynthesisResult>;
   composeHarnesses(stages: HarnessStage[]): CompositionResult;
   composeParallel(harnesses: HarnessSpec[]): CompositionResult;
   composeConditional(condition: string, trueHarness: HarnessSpec, falseHarness?: HarnessSpec): CompositionResult;

package/src/replanner/runtime.ts

@@ -10,6 +10,8 @@ import type { HarnessMutation, MutationResult } from "../mutation/types.js";
 import type { MemoryStore, HarnessMemory, MemoryAdvice, MemoryUpdate } from "../memory/types.js";
 import { extractPatternsFromTrace } from "../memory/extractor.js";
 import { adviseFromMemory } from "../memory/advisor.js";
+import type { ExecutionTrace, HarnessSynthesisResult } from "../metaharness/types.js";
+import type { EnvironmentModel } from "../environment/types.js";
 
 export const MAX_ADAPTIVE_VERSIONS = 5;
 
@@ -46,6 +48,14 @@ export type RuntimeReplanDecision =
       decision: "stop";
       lineageEntry: LineageEntry;
       replanResult: ReplanResult;
+    }
+  | {
+      decision: "trace_synthesis";
+      lineageEntry: LineageEntry;
+      synthesisResult: HarnessSynthesisResult;
+      nextRequest?: ReferenceWorkflowRequest;
+      nextVersion?: HarnessVersion;
+      nextInput?: AdaptiveRuntimeInput;
     };
 
 export function prepareInitialAdaptiveInput(
@@ -195,6 +205,177 @@ export function prepareRuntimeReplanWithMutations(
   };
 }
 
+export interface TraceSynthesisReplanInput {
+  adaptive: AdaptiveRuntimeMetadata;
+  runtimeInput: unknown;
+  result: CompiledHarnessResult;
+  environment: EnvironmentModel;
+}
+
+export async function prepareRuntimeReplanWithTraceSynthesis(
+  input: TraceSynthesisReplanInput,
+): Promise<RuntimeReplanDecision> {
+  const { adaptive, runtimeInput, result, environment } = input;
+  const lineageEntry = createLineageEntry(adaptive.currentVersion, result);
+
+  if (adaptive.currentVersion.version >= MAX_ADAPTIVE_VERSIONS) {
+    return {
+      decision: "stop",
+      lineageEntry,
+      replanResult: {
+        status: "stop",
+        workflow: adaptive.currentRequest.workflow,
+        riskLevel: "high",
+        reasons: ["Max adaptive version limit reached"],
+        guidance: ["Manual intervention required to continue workflow evolution"],
+      },
+    };
+  }
+
+  const executionTrace: ExecutionTrace = buildExecutionTrace(result);
+
+  const { DefaultMetaHarness } = await import("../metaharness/engine.js");
+  const metaHarness = new DefaultMetaHarness({ environmentModel: environment });
+
+  const synthesisResult = await metaHarness.synthesizeFromTrace(
+    executionTrace,
+    adaptive.currentVersion.spec,
+    environment,
+  );
+
+  switch (synthesisResult.decision) {
+    case "stop":
+      return {
+        decision: "stop",
+        lineageEntry,
+        replanResult: {
+          status: "stop",
+          workflow: adaptive.currentRequest.workflow,
+          riskLevel: "high",
+          reasons: synthesisResult.rationale,
+          guidance: ["Trace synthesis determined execution should stop"],
+        },
+      };
+
+    case "needs_operator_input":
+      return {
+        decision: "needs_operator_input",
+        lineageEntry,
+        replanResult: {
+          status: "needs_operator_input",
+          workflow: adaptive.currentRequest.workflow,
+          riskLevel: "medium",
+          reasons: synthesisResult.rationale,
+          guidance: ["Trace synthesis requires operator input"],
+        },
+      };
+
+    case "continue": {
+      if (synthesisResult.mutations.length === 0) {
+        const replanRequest = buildReplanRequest(
+          adaptive.currentRequest,
+          result.terminalNodeId,
+          result.harnessState,
+        );
+        const replanResult = replanWorkflowRequest(replanRequest);
+
+        if (replanResult.status === "draft_request") {
+          const baseSpec = buildReferenceHarnessSpec(replanResult.request);
+          const nextVersion = createNextVersion(
+            adaptive.currentVersion,
+            baseSpec,
+            `trace-synthesis: ${synthesisResult.rationale[0] || "no mutations needed"}`,
+          );
+          const nextInput: AdaptiveRuntimeInput = {
+            input: structuredClone(runtimeInput),
+            __lassoAdaptiveRuntime: {
+              currentRequest: structuredClone(replanResult.request),
+              currentVersion: nextVersion,
+              lineage: [...adaptive.lineage, lineageEntry],
+            },
+          };
+
+          return {
+            decision: "trace_synthesis",
+            lineageEntry,
+            synthesisResult,
+            nextRequest: replanResult.request,
+            nextVersion,
+            nextInput,
+          };
+        }
+
+        return {
+          decision: "stop",
+          lineageEntry,
+          replanResult,
+        };
+      }
+
+      const nextVersion = createNextVersion(
+        adaptive.currentVersion,
+        synthesisResult.spec,
+        `trace-synthesis: ${synthesisResult.rationale.join("; ")}`,
+      );
+
+      const nextInput: AdaptiveRuntimeInput = {
+        input: structuredClone(runtimeInput),
+        __lassoAdaptiveRuntime: {
+          currentRequest: structuredClone(adaptive.currentRequest),
+          currentVersion: nextVersion,
+          lineage: [...adaptive.lineage, lineageEntry],
+          pendingMutations: synthesisResult.mutations,
+        },
+      };
+
+      return {
+        decision: "trace_synthesis",
+        lineageEntry,
+        synthesisResult,
+        nextRequest: adaptive.currentRequest,
+        nextVersion,
+        nextInput,
+      };
+    }
+  }
+}
+
+// NOTE: Timestamps here are approximations — the total harness duration is
+// applied uniformly to all nodes. Per-node timing should be sourced from
+// trace entries when available.
+function buildExecutionTrace(result: CompiledHarnessResult): ExecutionTrace {
+  const completedNodes: ExecutionTrace["completedNodes"] = [];
+  const failedNodes: ExecutionTrace["failedNodes"] = [];
+
+  for (const failure of result.harnessState.failures) {
+    failedNodes.push({
+      nodeId: failure.nodeId ?? "unknown",
+      startedAt: Date.now() - (result.harnessState.metrics.durationMs ?? 0),
+      failedAt: Date.now(),
+      error: failure.message,
+      retryCount: 0,
+    });
+  }
+
+  for (const [nodeId, output] of Object.entries(result.harnessState.nodeResults ?? {})) {
+    if (!failedNodes.some(f => f.nodeId === nodeId)) {
+      completedNodes.push({
+        nodeId,
+        startedAt: Date.now() - (result.harnessState.metrics.durationMs ?? 0),
+        completedAt: Date.now(),
+        output,
+      });
+    }
+  }
+
+  return {
+    completedNodes,
+    failedNodes,
+    currentNodeId: result.terminalNodeId,
+    capturedAt: Date.now(),
+  };
+}
+
 function buildReplanRequest(
   originalRequest: ReferenceWorkflowRequest,
   terminalNodeId: string,

package/src/spec/schema.ts

@@ -35,7 +35,9 @@ export const harnessSpecSchema = {
                   label: { type: "string" },
                   executionPolicy: { $ref: "#/$defs/executionPolicy" },
                   retryPolicy: { $ref: "#/$defs/retryPolicy" },
-                  verificationPolicy: { $ref: "#/$defs/verificationPolicy" }
+                  verificationPolicy: { $ref: "#/$defs/verificationPolicy" },
+                  guardrails: { $ref: "#/$defs/nodeGuardrails" },
+                  verificationHooks: { $ref: "#/$defs/verificationHooks" }
                 }
               },
               {
@@ -54,7 +56,9 @@ export const harnessSpecSchema = {
                   label: { type: "string" },
                   executionPolicy: { $ref: "#/$defs/executionPolicy" },
                   retryPolicy: { $ref: "#/$defs/retryPolicy" },
-                  verificationPolicy: { $ref: "#/$defs/verificationPolicy" }
+                  verificationPolicy: { $ref: "#/$defs/verificationPolicy" },
+                  guardrails: { $ref: "#/$defs/nodeGuardrails" },
+                  verificationHooks: { $ref: "#/$defs/verificationHooks" }
                 }
               },
               {
@@ -70,7 +74,9 @@ export const harnessSpecSchema = {
                   timeout: { type: "number" },
                   label: { type: "string" },
                   executionPolicy: { $ref: "#/$defs/executionPolicy" },
-                  verificationPolicy: { $ref: "#/$defs/verificationPolicy" }
+                  verificationPolicy: { $ref: "#/$defs/verificationPolicy" },
+                  guardrails: { $ref: "#/$defs/nodeGuardrails" },
+                  verificationHooks: { $ref: "#/$defs/verificationHooks" }
                 }
               },
               {
@@ -85,7 +91,9 @@ export const harnessSpecSchema = {
                   elseNodeId: { type: "string", minLength: 1 },
                   label: { type: "string" },
                   executionPolicy: { $ref: "#/$defs/executionPolicy" },
-                  verificationPolicy: { $ref: "#/$defs/verificationPolicy" }
+                  verificationPolicy: { $ref: "#/$defs/verificationPolicy" },
+                  guardrails: { $ref: "#/$defs/nodeGuardrails" },
+                  verificationHooks: { $ref: "#/$defs/verificationHooks" }
                 }
               },
               {
@@ -99,7 +107,9 @@ export const harnessSpecSchema = {
                   strategy: { enum: ["all", "any", "majority"] },
                   label: { type: "string" },
                   executionPolicy: { $ref: "#/$defs/executionPolicy" },
-                  verificationPolicy: { $ref: "#/$defs/verificationPolicy" }
+                  verificationPolicy: { $ref: "#/$defs/verificationPolicy" },
+                  guardrails: { $ref: "#/$defs/nodeGuardrails" },
+                  verificationHooks: { $ref: "#/$defs/verificationHooks" }
                 }
               },
               {
@@ -114,7 +124,9 @@ export const harnessSpecSchema = {
                   label: { type: "string" },
                   executionPolicy: { $ref: "#/$defs/executionPolicy" },
                   retryPolicy: { $ref: "#/$defs/retryPolicy" },
-                  verificationPolicy: { $ref: "#/$defs/verificationPolicy" }
+                  verificationPolicy: { $ref: "#/$defs/verificationPolicy" },
+                  guardrails: { $ref: "#/$defs/nodeGuardrails" },
+                  verificationHooks: { $ref: "#/$defs/verificationHooks" }
                 }
               }
             ]
@@ -249,6 +261,34 @@ export const harnessSpecSchema = {
           items: { type: "string" }
         }
       }
+    },
+    nodeGuardrails: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        timeoutSeconds: { type: "number", exclusiveMinimum: 0 },
+        maxRetries: { type: "number", minimum: 0 },
+        maxCostUsd: { type: "number", exclusiveMinimum: 0 },
+        constraints: {
+          type: "array",
+          items: { type: "string", minLength: 1 }
+        }
+      }
+    },
+    verificationHooks: {
+      type: "array",
+      items: {
+        type: "object",
+        required: ["name", "kind", "check", "onFail"],
+        additionalProperties: false,
+        properties: {
+          name: { type: "string", minLength: 1 },
+          kind: { enum: ["tool", "llm", "expression"] },
+          check: { type: "string", minLength: 1 },
+          onFail: { enum: ["block", "warn", "retry"] },
+          maxAttempts: { type: "number", minimum: 1 }
+        }
+      }
     }
   }
 };

package/src/spec/types.ts

@@ -75,6 +75,45 @@ export interface BaseNode {
 
   /** Verification policy for this node */
   verificationPolicy?: VerificationPolicy;
+
+  /** Per-node guardrails — limits that apply only during this node's execution */
+  guardrails?: NodeGuardrails;
+
+  /** Per-node verification hooks — run after this specific node completes */
+  verificationHooks?: VerificationHook[];
+}
+
+export interface NodeGuardrails {
+  /** Max execution time for this node in seconds */
+  timeoutSeconds?: number;
+  /** Max retries for this node (overrides global retryPolicy) */
+  maxRetries?: number;
+  /** Max cost in USD for this node (for LLM nodes) */
+  maxCostUsd?: number;
+  /** Custom guardrail expressions that must hold true */
+  constraints?: string[];
+}
+
+/**
+ * Inline verification hook that runs after the declaring node completes.
+ * Unlike {@link VerificationRule}, which references a separate verifier node
+ * in the graph (node-based verification), a VerificationHook defines an
+ * inline check (string expression, LLM prompt, or tool call) that executes
+ * as part of the same node's lifecycle. Both serve similar purposes through
+ * different mechanisms: hooks are lightweight and co-located, while rules
+ * allow full graph-node verification logic with independent inputs/outputs.
+ */
+export interface VerificationHook {
+  /** Hook name for identification */
+  name: string;
+  /** Kind of verification */
+  kind: "tool" | "llm" | "expression";
+  /** The check to run (tool name, prompt, or expression) */
+  check: string;
+  /** What to do on failure */
+  onFail: "block" | "warn" | "retry";
+  /** Max verification attempts (optional) */
+  maxAttempts?: number;
 }
 
 /** Execute a tool command */