@sweny-ai/core 0.1.215 → 0.1.217

package/dist/eval/grounded.d.ts

@@ -0,0 +1,56 @@
+import type { OutputGroundedQuote, OutputGroundedRule, ToolAccess, ToolCall } from "../types.js";
+/** What a node's grounding is checked against. */
+export interface GroundingEvidence {
+    /** The evaluated attempt's tool calls, with outputs (in memory). */
+    toolCalls: ToolCall[];
+    /** The context the node's prompt received: `{ input, ...priorNodes }`. */
+    context?: Record<string, unknown>;
+    /** The evaluated node's id. Its own earlier visit (loops) is not evidence. */
+    nodeId?: string;
+    /** The author's text the prompt carried: instruction, rules, context sources. Always evidence. */
+    authored?: string[];
+    /** Access class of the node's skill tools by name. A `write` skill tool is never evidence. */
+    toolAccess?: ReadonlyMap<string, ToolAccess>;
+}
+export declare const BUILTIN_PATTERNS: readonly ["url", "github_ref", "issue_key"];
+/** What `{}` scans prose for. Issue keys only when listed: prose is full of `UTF-8`-style tokens. */
+export declare const DEFAULT_PATTERNS: readonly ["url", "github_ref"];
+/** Same cap as `output_matches[].matches` (see value.ts). */
+export declare const MAX_REGEX_SOURCE_LENGTH = 1000;
+/** Offending values listed per failure group before "and N more". */
+export declare const MAX_LISTED = 8;
+/** Shortest quote accepted by default, after whitespace normalization. */
+export declare const DEFAULT_MIN_QUOTE = 8;
+/**
+ * Tools whose result is not evidence: shells, subagents, file writers, the
+ * safe-output tool (`emit_output`, EMIT_OUTPUT_TOOL in safe-outputs.ts) and
+ * tools that echo what they were given. Lower-cased; Claude Code, Codex and pi names.
+ */
+export declare const NOT_EVIDENCE_TOOLS: ReadonlySet<string>;
+type Verdict = {
+    pass: boolean;
+    reasoning?: string;
+};
+/**
+ * Canonical form for comparing URLs: scheme and host lowercased and the
+ * default port dropped (by URL), any trailing slash on the path dropped.
+ * Path, query and fragment stay as written. A scheme-less GitHub or
+ * Atlassian link gets `https://`. A string that is not a URL comes back trimmed.
+ */
+export declare function normalizeUrl(raw: string): string;
+/** `needle` occurs in `hay` as a whole token: no letter, digit, `_` or `-` against a word edge. */
+export declare function containsToken(hay: string, needle: string): boolean;
+/** A tool's result is evidence by default only when the tool reads. */
+export declare function isEvidenceTool(c: ToolCall, toolAccess?: ReadonlyMap<string, ToolAccess>): boolean;
+/** A `tools` entry names this call: a bare name for sweny's own or a built-in, else `server/tool` or `mcp__server__tool`. */
+export declare function namesCall(name: string, c: ToolCall): boolean;
+/** The whitespace rule for a quote. `trim` is the default. */
+export declare function normalizeQuote(s: string, mode: OutputGroundedQuote["whitespace"]): string;
+/**
+ * Evaluate an `output_grounded` rule against the node's output and evidence.
+ * Never throws: a bad config (malformed path, invalid pattern) is a failure
+ * with a reason, not a silent pass. A configured path that matched nothing
+ * passes with a warning in the reasoning.
+ */
+export declare function evaluateGroundedRule(rule: OutputGroundedRule, data: unknown, evidence: GroundingEvidence): Verdict;
+export {};

package/dist/eval/grounded.js

@@ -0,0 +1,416 @@
+// ─── Eval: output_grounded (#580) ────────────────────────────────────
+//
+// A `function` rule with two checks, both pure and deterministic (no model call):
+//
+// - Ids: every URL and `owner/repo#N` ref a node outputs (plus issue keys or
+//   custom patterns when listed, and every value at the configured `ids`
+//   paths) must appear in what the agent saw: the outputs of its own
+//   successful read-tool calls, the author's text its prompt carried, and (by
+//   default) the workflow input and the prior-node context.
+// - Quotes: every value at a `quotes` path must appear verbatim, under an
+//   explicit whitespace rule, in one string of a named tool's output.
+//
+// Evidence lives in memory only. Tool outputs are never journaled (see
+// NODE_RESULT_JOURNAL), so the verdict is computed once, while the run holds
+// them, and the EvalResult is what the journal keeps. A node replayed on
+// resume keeps its journaled verdict; a node that re-runs is re-checked
+// against its new tool outputs.
+import { isErrorOutput } from "./function.js";
+export const BUILTIN_PATTERNS = ["url", "github_ref", "issue_key"];
+/** What `{}` scans prose for. Issue keys only when listed: prose is full of `UTF-8`-style tokens. */
+export const DEFAULT_PATTERNS = ["url", "github_ref"];
+/** Same cap as `output_matches[].matches` (see value.ts). */
+export const MAX_REGEX_SOURCE_LENGTH = 1000;
+/** Offending values listed per failure group before "and N more". */
+export const MAX_LISTED = 8;
+/** Shortest quote accepted by default, after whitespace normalization. */
+export const DEFAULT_MIN_QUOTE = 8;
+/**
+ * Tools whose result is not evidence: shells, subagents, file writers, the
+ * safe-output tool (`emit_output`, EMIT_OUTPUT_TOOL in safe-outputs.ts) and
+ * tools that echo what they were given. Lower-cased; Claude Code, Codex and pi names.
+ */
+export const NOT_EVIDENCE_TOOLS = new Set([
+    "bash",
+    "bashoutput",
+    "killshell",
+    "shell",
+    "apply_patch",
+    "task",
+    "agent",
+    "write",
+    "edit",
+    "multiedit",
+    "notebookedit",
+    "todowrite",
+    "structuredoutput",
+    "exitplanmode",
+    "emit_output",
+]);
+/** A tool name that says it writes, sends or runs: its result likely echoes its input. */
+const WRITE_VERB_RE = /(?:^|[_-])(?:create|update|save|add|post|send|delete|remove|set|write|edit|upsert|put|patch|merge|close|reopen|assign|comment|reply|publish|push|commit|run|exec|execute|echo|emit)(?:[_-]|$)/i;
+const URL_BODY = String.raw `[^\s<>"'${"`"}()[\]{}|\\^]+`;
+/** `http(s)://...` in any case, or a scheme-less GitHub or Atlassian link. */
+const URL_RE = new RegExp(String.raw `https?:\/\/${URL_BODY}|(?<![\w.@/:-])(?:github\.com|[\w-]+\.atlassian\.net)\/${URL_BODY}`, "gi");
+const KNOWN_HOST_RE = /^(?:github\.com|[\w-]+\.atlassian\.net)\//i;
+const TRAILING_PUNCT_RE = /[.,;:!?]+$/;
+const GITHUB_REF_RE = /(?<![\w./-])([\w.-]+)\/([\w.-]+)#(\d+)(?!\w)/g;
+const ISSUE_KEY_RE = /(?<![\w-])([A-Z][A-Z0-9]{1,9})-\d+(?![\w-])/g;
+/** Matched against a normalized URL: `//host/owner/repo/(issues|pull)/N` at the end. */
+const GITHUB_URL_RE = /\/\/[^/]+\/([^/]+)\/([^/]+)\/(?:issues|pull)\/(\d+)$/;
+const NUMBER_RE = /^-?\d+(?:\.\d+)?$/;
+const WORD_CHAR = /[\w-]/;
+const SEGMENT_RE = /^([A-Za-z_]\w*)(\[\*\])?$/;
+const IDENT_RE = /^[A-Za-z_]\w*$/;
+/** sweny's own MCP server: its tools are matched by bare name, like built-ins. */
+const OWN_SERVER = "sweny-core";
+// ─── URLs ────────────────────────────────────────────────────────────
+/**
+ * Canonical form for comparing URLs: scheme and host lowercased and the
+ * default port dropped (by URL), any trailing slash on the path dropped.
+ * Path, query and fragment stay as written. A scheme-less GitHub or
+ * Atlassian link gets `https://`. A string that is not a URL comes back trimmed.
+ */
+export function normalizeUrl(raw) {
+    const s = raw.trim();
+    try {
+        const u = new URL(KNOWN_HOST_RE.test(s) ? `https://${s}` : s);
+        return `${u.protocol}//${u.host}${u.pathname.replace(/\/+$/, "")}${u.search}${u.hash}`;
+    }
+    catch {
+        return s;
+    }
+}
+/** The URL minus its fragment. */
+function withoutFragment(normalized) {
+    return normalized.split("#")[0];
+}
+/** The URL minus its last path segment (`https://h/a/b/3` -> `https://h/a/b`); none for a bare origin. */
+function urlCollection(normalized) {
+    const base = withoutFragment(normalized);
+    const pathStart = base.indexOf("/", base.indexOf("//") + 2);
+    return pathStart === -1 ? undefined : base.slice(0, base.lastIndexOf("/"));
+}
+// ─── Walking values ──────────────────────────────────────────────────
+/** `a.b`, `a[0]`, `a["not an identifier"]`. */
+function childPath(parent, key) {
+    if (!IDENT_RE.test(String(key)))
+        return `${parent}[${JSON.stringify(key)}]`;
+    return parent === "" ? `${key}` : `${parent}.${key}`;
+}
+/** Every string (and, with `numbers`, number) leaf under a value of the output, with its concrete path. */
+function leaves(value, path, numbers) {
+    if (typeof value === "string")
+        return [{ path, text: value }];
+    if (numbers && typeof value === "number")
+        return [{ path, text: String(value) }];
+    if (typeof value !== "object" || value === null)
+        return [];
+    if (Array.isArray(value))
+        return value.flatMap((v, i) => leaves(v, childPath(path, i), numbers));
+    return Object.entries(value).flatMap(([k, v]) => leaves(v, childPath(path, k), numbers));
+}
+/** Every string and number in an evidence value, and its object keys (never array indexes). Cycles read once. */
+function evidenceText(value, seen = new WeakSet()) {
+    if (typeof value === "string")
+        return { values: [value], keys: [] };
+    if (typeof value === "number")
+        return { values: [String(value)], keys: [] };
+    if (typeof value !== "object" || value === null || seen.has(value))
+        return { values: [], keys: [] };
+    seen.add(value);
+    const entries = Array.isArray(value)
+        ? value.map((v) => [undefined, v])
+        : Object.entries(value);
+    const out = { values: [], keys: [] };
+    for (const [k, v] of entries) {
+        const inner = evidenceText(v, seen);
+        out.values.push(...inner.values);
+        out.keys.push(...(k === undefined ? [] : [k]), ...inner.keys);
+    }
+    return out;
+}
+/**
+ * Resolve an eval path (grammar: spec nodes#path-grammar) to concrete
+ * `{ path, value }` pairs, so a failure names `items[3].url`, not
+ * `items[*].url`. A path that does not resolve has nothing to check (the
+ * caller warns). A malformed path throws.
+ */
+function resolveConcrete(data, path) {
+    let current = [{ path: "", value: data }];
+    for (const part of path.replace(/^(all|any):/, "").split(".")) {
+        const m = SEGMENT_RE.exec(part);
+        if (!m)
+            throw new Error(`malformed path '${path}'`);
+        const name = m[1];
+        current = current.flatMap((c) => {
+            const obj = c.value;
+            if (typeof obj !== "object" || obj === null || Array.isArray(obj) || !(name in obj))
+                return [];
+            const p = childPath(c.path, name);
+            const child = obj[name];
+            if (m[2] === undefined)
+                return [{ path: p, value: child }];
+            return Array.isArray(child) ? child.map((el, i) => ({ path: childPath(p, i), value: el })) : [];
+        });
+    }
+    return current;
+}
+const isBuiltin = (p) => BUILTIN_PATTERNS.includes(p);
+function compileRegex(p) {
+    if (p.length > MAX_REGEX_SOURCE_LENGTH) {
+        throw new Error(`invalid pattern: regex source exceeds ${MAX_REGEX_SOURCE_LENGTH} characters`);
+    }
+    try {
+        return { name: p, re: new RegExp(p, "g") };
+    }
+    catch (e) {
+        throw new Error(`invalid pattern /${p}/: ${e.message}`);
+    }
+}
+function compilePatterns(patterns) {
+    return { builtins: patterns.filter(isBuiltin), custom: patterns.filter((p) => !isBuiltin(p)).map(compileRegex) };
+}
+/** Built-ins only: what runs over tool outputs (a user regex never does). */
+const BUILTINS_ONLY = compilePatterns(BUILTIN_PATTERNS);
+/**
+ * Find ids and URLs in one string. Every pattern reads the whole text, so an
+ * id inside a URL's path, query or fragment is a candidate of its own.
+ */
+function extract(text, compiled, path = "") {
+    const out = [];
+    const has = (p) => compiled.builtins.includes(p);
+    if (has("url")) {
+        for (const m of text.matchAll(URL_RE)) {
+            const value = m[0].replace(TRAILING_PUNCT_RE, "");
+            out.push({ path, value, type: "url", cls: urlCollection(normalizeUrl(value)) });
+        }
+    }
+    if (has("github_ref")) {
+        for (const m of text.matchAll(GITHUB_REF_RE)) {
+            out.push({ path, value: m[0], type: "github_ref", cls: `gh:${m[1]}/${m[2]}`.toLowerCase() });
+        }
+    }
+    if (has("issue_key")) {
+        for (const m of text.matchAll(ISSUE_KEY_RE))
+            out.push({ path, value: m[0], cls: `key:${m[1]}` });
+    }
+    for (const c of compiled.custom) {
+        for (const m of text.matchAll(c.re)) {
+            const value = m[1] ?? m[0];
+            if (value !== "")
+                out.push({ path, value });
+        }
+    }
+    return out;
+}
+/** A whole value at an `ids` path, classified (for `stale`) when it has a recognizable kind. */
+function wholeValue(value, path) {
+    const same = extract(value, BUILTINS_ONLY, path).find((c) => c.value === value);
+    return { ...(same ?? { path, value }), whole: true };
+}
+// ─── Evidence ────────────────────────────────────────────────────────
+/** One body of evidence, indexed for lookup. Built in memory, never stored. */
+class Corpus {
+    values = [];
+    keys = [];
+    urls = new Set();
+    bases = new Set();
+    refs = new Set();
+    add(value) {
+        const text = evidenceText(value);
+        this.keys.push(...text.keys);
+        for (const s of text.values) {
+            this.values.push(s);
+            for (const m of s.matchAll(URL_RE)) {
+                const url = normalizeUrl(m[0].replace(TRAILING_PUNCT_RE, ""));
+                this.urls.add(url);
+                this.bases.add(withoutFragment(url));
+                const gh = GITHUB_URL_RE.exec(withoutFragment(url));
+                if (gh)
+                    this.refs.add(`${gh[1]}/${gh[2]}#${gh[3]}`.toLowerCase());
+            }
+            for (const m of s.matchAll(GITHUB_REF_RE))
+                this.refs.add(m[0].toLowerCase());
+        }
+    }
+    has(c) {
+        if (c.type === "url") {
+            // A fragment must have been seen; a link without one is grounded by its page.
+            const url = normalizeUrl(c.value);
+            return url.includes("#") ? this.urls.has(url) : this.bases.has(url);
+        }
+        if (c.type === "github_ref" && this.refs.has(c.value.toLowerCase()))
+            return true;
+        if (c.whole && NUMBER_RE.test(c.value))
+            return this.values.some((v) => v.trim() === c.value);
+        const texts = c.whole ? this.values : [...this.values, ...this.keys];
+        return texts.some((t) => containsToken(t, c.value));
+    }
+    /** Every id kind this corpus holds, by the built-in patterns only (undefined for a kindless URL). */
+    kinds() {
+        return new Set(this.values.flatMap((t) => extract(t, BUILTINS_ONLY)).map((c) => c.cls));
+    }
+}
+/** `needle` occurs in `hay` as a whole token: no letter, digit, `_` or `-` against a word edge. */
+export function containsToken(hay, needle) {
+    const wordStart = WORD_CHAR.test(needle.charAt(0));
+    const wordEnd = WORD_CHAR.test(needle.charAt(needle.length - 1));
+    for (let i = hay.indexOf(needle); i !== -1; i = hay.indexOf(needle, i + 1)) {
+        const clearBefore = !wordStart || !WORD_CHAR.test(hay.charAt(i - 1));
+        const clearAfter = !wordEnd || !WORD_CHAR.test(hay.charAt(i + needle.length));
+        if (clearBefore && clearAfter)
+            return true;
+    }
+    return false;
+}
+function didSucceed(c) {
+    if (c.status !== undefined)
+        return c.status === "success";
+    return !isErrorOutput(c.output);
+}
+/** sweny's own tools and built-ins have no server (sweny-core counts as none). */
+function serverOf(c) {
+    return c.server === OWN_SERVER ? undefined : c.server;
+}
+/** A tool's result is evidence by default only when the tool reads. */
+export function isEvidenceTool(c, toolAccess) {
+    if (serverOf(c) === undefined) {
+        const access = toolAccess?.get(c.tool);
+        if (access !== undefined)
+            return access === "read";
+        if (NOT_EVIDENCE_TOOLS.has(c.tool.toLowerCase()))
+            return false;
+    }
+    return !WRITE_VERB_RE.test(c.tool);
+}
+/** A `tools` entry names this call: a bare name for sweny's own or a built-in, else `server/tool` or `mcp__server__tool`. */
+export function namesCall(name, c) {
+    const server = serverOf(c);
+    if (server === undefined)
+        return name === c.tool;
+    return name === `${server}/${c.tool}` || name === `mcp__${server}__${c.tool}`;
+}
+/** Successful calls that count: the named ones when `names` is set, else every read tool. */
+function evidenceCalls(evidence, names) {
+    return evidence.toolCalls.filter((c) => didSucceed(c) &&
+        (names === undefined ? isEvidenceTool(c, evidence.toolAccess) : names.some((n) => namesCall(n, c))));
+}
+// ─── Reasoning ───────────────────────────────────────────────────────
+function label(path, value) {
+    const shown = value.length > 120 ? `${value.slice(0, 119)}…` : value;
+    return `${path} ${JSON.stringify(shown)}`;
+}
+function listed(failures) {
+    const more = failures.length - MAX_LISTED;
+    return failures.slice(0, MAX_LISTED).join("; ") + (more > 0 ? `; and ${more} more` : "");
+}
+/** Resolve a configured path, noting it when it matched nothing. */
+function resolveNoting(data, path, empty) {
+    const found = resolveConcrete(data, path);
+    if (found.length === 0)
+        empty.push(path);
+    return found;
+}
+// ─── The two checks ──────────────────────────────────────────────────
+function checkIds(rule, data, evidence, empty) {
+    const compiled = compilePatterns(rule.patterns ?? DEFAULT_PATTERNS);
+    const roots = rule.paths === undefined ? [{ path: "", value: data }] : rule.paths.flatMap((p) => resolveNoting(data, p, empty));
+    const scanned = roots
+        .flatMap((r) => leaves(r.value, r.path, false))
+        .flatMap((l) => extract(l.text, compiled, l.path));
+    const whole = (rule.ids ?? [])
+        .flatMap((p) => resolveNoting(data, p, empty))
+        .flatMap((r) => leaves(r.value, r.path, true))
+        .filter((l) => l.text.trim() !== "")
+        .map((l) => wholeValue(l.text.trim(), l.path));
+    const tools = new Corpus();
+    for (const c of evidenceCalls(evidence, rule.tools))
+        tools.add(c.output);
+    const useInputs = rule.inputs !== false;
+    const useContext = rule.context !== false;
+    const given = new Corpus();
+    given.add(evidence.authored);
+    for (const [k, v] of Object.entries(evidence.context ?? {})) {
+        if (k !== evidence.nodeId && (k === "input" ? useInputs : useContext))
+            given.add(v);
+    }
+    const allow = new Set(rule.allow?.map(normalizeUrl));
+    const staleKinds = rule.stale === true ? tools.kinds() : undefined;
+    const failures = [];
+    const seen = new Set();
+    for (const c of [...scanned, ...whole]) {
+        const key = JSON.stringify([c.path, c.value]);
+        if (seen.has(key) || allow.has(normalizeUrl(c.value)) || tools.has(c))
+            continue;
+        seen.add(key);
+        if (!given.has(c))
+            failures.push(label(c.path, c.value));
+        else if (c.cls !== undefined && staleKinds?.has(c.cls)) {
+            failures.push(`${label(c.path, c.value)} (stale: this node's tools returned other ids of its kind, not this one)`);
+        }
+    }
+    if (failures.length === 0)
+        return [];
+    const sources = ["tool outputs", "instruction"];
+    if (useInputs)
+        sources.push("inputs");
+    if (useContext)
+        sources.push("prior context");
+    return [`${failures.length} value(s) not grounded (evidence: ${sources.join(", ")}): ${listed(failures)}`];
+}
+/** The whitespace rule for a quote. `trim` is the default. */
+export function normalizeQuote(s, mode) {
+    if (mode === "exact")
+        return s;
+    if (mode === "collapse")
+        return s.replace(/\s+/g, " ").trim();
+    return s.trim();
+}
+function checkQuotes(rule, data, evidence, empty) {
+    const parts = [];
+    for (const q of rule.quotes ?? []) {
+        const mode = q.whitespace ?? "trim";
+        const min = q.min_length ?? DEFAULT_MIN_QUOTE;
+        const names = q.tools ?? rule.tools;
+        // Normalizing the output under trim changes nothing a trimmed quote can match; under collapse it is the rule.
+        const hay = evidenceCalls(evidence, names).flatMap((c) => evidenceText(c.output).values.map((s) => normalizeQuote(s, mode)));
+        const failures = [];
+        for (const l of resolveNoting(data, q.path, empty).flatMap((r) => leaves(r.value, r.path, true))) {
+            const needle = normalizeQuote(l.text, mode);
+            if (!/\S/.test(needle))
+                failures.push(`${label(l.path, l.text)} (empty)`);
+            else if (needle.length < min)
+                failures.push(`${label(l.path, l.text)} (shorter than ${min} characters)`);
+            else if (!hay.some((h) => h.includes(needle)))
+                failures.push(label(l.path, l.text));
+        }
+        if (failures.length > 0) {
+            const from = names === undefined ? "any read tool's" : names.join(", ");
+            parts.push(`${failures.length} quote(s) not found verbatim in ${from} output (whitespace: ${mode}): ${listed(failures)}`);
+        }
+    }
+    return parts;
+}
+// ─── Entry point ─────────────────────────────────────────────────────
+/**
+ * Evaluate an `output_grounded` rule against the node's output and evidence.
+ * Never throws: a bad config (malformed path, invalid pattern) is a failure
+ * with a reason, not a silent pass. A configured path that matched nothing
+ * passes with a warning in the reasoning.
+ */
+export function evaluateGroundedRule(rule, data, evidence) {
+    const empty = [];
+    let parts;
+    try {
+        parts = [...checkIds(rule, data, evidence, empty), ...checkQuotes(rule, data, evidence, empty)];
+    }
+    catch (e) {
+        return { pass: false, reasoning: `output_grounded: ${e.message}` };
+    }
+    const warning = empty.length > 0 ? [`warning: nothing at ${empty.join(", ")}`] : [];
+    const notes = [...parts, ...warning];
+    if (notes.length === 0)
+        return { pass: true };
+    return { pass: parts.length === 0, reasoning: `output_grounded: ${notes.join(" | ")}` };
+}

package/dist/eval/index.d.ts

@@ -1,4 +1,4 @@
-import type { Claude, EvalPolicy, EvalResult, Evaluator, NodeResult, Workflow, Node } from "../types.js";
+import type { Claude, EvalPolicy, EvalResult, Evaluator, NodeResult, ToolAccess, Workflow, Node } from "../types.js";
 import { type ToolAliases } from "./function.js";
 export type { ToolAliases } from "./function.js";
 export interface EvaluateAllOptions {
@@ -20,6 +20,17 @@ export interface EvaluateAllOptions {
     signal?: AbortSignal;
     /** Per-call timeout forwarded to judge calls. */
     timeoutMs?: number;
+    /**
+     * The context the node's prompt received (`{ input, ...priorNodes }`).
+     * Evidence for `output_grounded`; held in memory, never journaled.
+     */
+    context?: Record<string, unknown>;
+    /** The evaluated node's id, so its own earlier visit in `context` is not evidence. */
+    nodeId?: string;
+    /** The author's text the prompt carried (instruction, rules, context sources). Evidence for `output_grounded`. */
+    authored?: string[];
+    /** Access class of the node's skill tools by name, so `output_grounded` counts only read tools. */
+    toolAccess?: ReadonlyMap<string, ToolAccess>;
 }
 /**
  * Run every declared evaluator against the node's result and return one

package/dist/eval/index.js

@@ -6,6 +6,7 @@
 import { evaluateValueRule } from "./value.js";
 import { evaluateFunctionRule } from "./function.js";
 import { evaluateJudge } from "./judge.js";
+import { evaluateGroundedRule } from "./grounded.js";
 /** Reasoning cap, matching the spec's ~500-character ceiling. */
 const MAX_REASONING_LENGTH = 500;
 /**
@@ -78,8 +79,22 @@ async function evaluateOne(e, result, opts) {
         return { name: e.name, kind: "value", pass: verdict.pass, reasoning: capReasoning(verdict.reasoning) };
     }
     if (e.kind === "function") {
-        const verdict = evaluateFunctionRule(e.rule ?? {}, result.toolCalls, opts.aliases);
-        return { name: e.name, kind: "function", pass: verdict.pass, reasoning: capReasoning(verdict.reasoning) };
+        const rule = e.rule ?? {};
+        const verdicts = [evaluateFunctionRule(rule, result.toolCalls, opts.aliases)];
+        if (rule.output_grounded) {
+            verdicts.push(evaluateGroundedRule(rule.output_grounded, result.data, {
+                toolCalls: result.toolCalls,
+                ...(opts.context ? { context: opts.context } : {}),
+                ...(opts.nodeId !== undefined ? { nodeId: opts.nodeId } : {}),
+                ...(opts.authored ? { authored: opts.authored } : {}),
+                ...(opts.toolAccess ? { toolAccess: opts.toolAccess } : {}),
+            }));
+        }
+        const failed = verdicts.filter((v) => !v.pass);
+        // A passing verdict can still carry a warning (output_grounded: a path that matched nothing).
+        const notes = (failed.length > 0 ? failed : verdicts).flatMap((v) => (v.reasoning ? [v.reasoning] : []));
+        const reasoning = notes.length > 0 ? notes.join("; ") : undefined;
+        return { name: e.name, kind: "function", pass: failed.length === 0, reasoning: capReasoning(reasoning) };
     }
     if (e.kind === "judge" && opts.claude) {
         const model = resolveJudgeModel(e, opts.node, opts.workflow, opts.claude.defaultJudgeModel);

package/dist/executor.js

@@ -934,6 +934,12 @@ async function executeRun(workflow, input, options, results, trace, at) {
                         claude: judgeClaude,
                         node,
                         workflow,
+                        // What the prompt was given: evidence for output_grounded (#580).
+                        context,
+                        nodeId: currentId,
+                        // The author's own text (never a retry preamble), and which skill tools only read.
+                        authored: [resolvedInstruction, effectiveRules, effectiveContext],
+                        toolAccess: new Map(filteredTools.map((t) => [t.name, t.access ?? "write"])),
                         sequential: budgetOn,
                         ...(signal ? { signal } : {}),
                         ...(timeoutMs !== undefined ? { timeoutMs } : {}),

package/dist/harness/claude-code.js

@@ -774,9 +774,13 @@ export class ClaudeCodeHarness {
                     if (am.message?.content && Array.isArray(am.message.content)) {
                         for (const block of am.message.content) {
                             if (block.type === "tool_use") {
+                                const server = mcpServerOf(block.name ?? "");
                                 const call = {
                                     tool: stripMcpPrefix(block.name ?? ""),
                                     input: block.input,
+                                    // External MCP tools keep their server, so output_grounded can tell
+                                    // linear's get_issue from another server's (#580).
+                                    ...(server !== undefined && server !== "sweny-core" ? { server } : {}),
                                 };
                                 toolCalls.push(call);
                                 if (typeof block.id === "string")
@@ -1058,6 +1062,11 @@ export function coreToolToSdkTool(coreTool, defaultCtx) {
     });
 }
 /** Strip MCP server prefix: "mcp__server__tool" → "tool" */
+/** The server of an `mcp__server__tool` name, else undefined. */
+function mcpServerOf(name) {
+    const parts = name.split("__");
+    return parts.length >= 3 && parts[0] === "mcp" ? parts[1] : undefined;
+}
 function stripMcpPrefix(name) {
     const parts = name.split("__");
     if (parts.length >= 3 && parts[0] === "mcp")

package/dist/harness/codex.js

@@ -762,7 +762,9 @@ export class CodexHarness {
                         : kind === "mcp_tool_call" || kind === "collab_tool_call"
                             ? String(item.tool ?? "")
                             : "web_search";
-                call = { tool, input };
+                const server = kind === "mcp_tool_call" && typeof item.server === "string" ? item.server : undefined;
+                // External MCP tools keep their server for output_grounded (#580).
+                call = { tool, input, ...(server !== undefined && server !== "sweny-core" ? { server } : {}) };
                 startCall(id, call);
                 const detail = kind === "command_execution" ? `shell: ${String(item.command ?? "")}` : tool;
                 opts.onProgress?.(detail.length > 80 ? detail.slice(0, 79) + "…" : detail);

package/dist/index.d.ts

@@ -21,7 +21,7 @@
  * })
  * ```
  */
-export type { Skill, SkillCategory, SkillDefinition, Tool, ToolContext, ToolRunContext, ConfigField, JSONSchema, Workflow, Node, Edge, EdgeWhen, WhenExpression, NodeResult, ToolCall, ExecutionEvent, Observer, Claude, Logger, TraceStep, TraceEdge, ExecutionTrace, ExecutionResult, Source, ResolvedSource, SourceKind, SourceResolutionMap, WorkflowInputs, WorkflowInputField, WorkflowInputType, InputValidationError, InputValidationResult, Evaluator, EvaluatorRule, EvalResult, EvaluatorKind, NodeRequires, NodeRetry, NodeToolFilter, OutputMatch, NodeSources, EvalPolicy, RequiresOnFail, NodeOnFail, McpTransport, WorkflowType, SkillHarnessKey, NodeAccess, NodePermissions, NodePermissionsSpec, SafeOutputType, SafeOutputDeclaration, SafeOutputsPolicy, SafeOutputReceipt, SafeOutputPin, AuthorAssociation, } from "./types.js";
+export type { Skill, SkillCategory, SkillDefinition, Tool, ToolContext, ToolRunContext, ConfigField, JSONSchema, Workflow, Node, Edge, EdgeWhen, WhenExpression, NodeResult, ToolCall, ExecutionEvent, Observer, Claude, Logger, TraceStep, TraceEdge, ExecutionTrace, ExecutionResult, Source, ResolvedSource, SourceKind, SourceResolutionMap, WorkflowInputs, WorkflowInputField, WorkflowInputType, InputValidationError, InputValidationResult, Evaluator, EvaluatorRule, OutputGroundedRule, OutputGroundedQuote, EvalResult, EvaluatorKind, NodeRequires, NodeRetry, NodeToolFilter, OutputMatch, NodeSources, EvalPolicy, RequiresOnFail, NodeOnFail, McpTransport, WorkflowType, SkillHarnessKey, NodeAccess, NodePermissions, NodePermissionsSpec, SafeOutputType, SafeOutputDeclaration, SafeOutputsPolicy, SafeOutputReceipt, SafeOutputPin, AuthorAssociation, } from "./types.js";
 export { WORKFLOW_INPUT_TYPES } from "./types.js";
 export { EVALUATOR_KINDS, EVAL_POLICIES, REQUIRES_ON_FAIL, NODE_ON_FAIL, MCP_TRANSPORTS, SKILL_CATEGORIES, SKILL_HARNESSES, SKILL_ID_PATTERN, SKILL_ID_MAX_LENGTH, isValidSkillId, NODE_ACCESS, TOOL_CLASSES, SAFE_OUTPUT_TYPES, SAFE_OUTPUT_APPLIERS, AUTHOR_ASSOCIATIONS, } from "./types.js";
 export { consoleLogger } from "./types.js";

package/dist/schema.d.ts

@@ -149,6 +149,27 @@ export declare const evalPolicyZ: z.ZodEnum<{
     any_pass: "any_pass";
     weighted: "weighted";
 }>;
+/** `output_grounded` config (#580). Mirrors `OutputGroundedRule` in types.ts. */
+export declare const outputGroundedZ: z.ZodObject<{
+    paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    inputs: z.ZodOptional<z.ZodBoolean>;
+    context: z.ZodOptional<z.ZodBoolean>;
+    stale: z.ZodOptional<z.ZodBoolean>;
+    quotes: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        whitespace: z.ZodOptional<z.ZodEnum<{
+            exact: "exact";
+            trim: "trim";
+            collapse: "collapse";
+        }>>;
+        min_length: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
 export declare const evaluatorRuleZ: z.ZodObject<{
     any_tool_called: z.ZodOptional<z.ZodArray<z.ZodString>>;
     all_tools_called: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -160,6 +181,26 @@ export declare const evaluatorRuleZ: z.ZodObject<{
         in: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
         matches: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>>;
+    output_grounded: z.ZodOptional<z.ZodObject<{
+        paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        inputs: z.ZodOptional<z.ZodBoolean>;
+        context: z.ZodOptional<z.ZodBoolean>;
+        stale: z.ZodOptional<z.ZodBoolean>;
+        quotes: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            whitespace: z.ZodOptional<z.ZodEnum<{
+                exact: "exact";
+                trim: "trim";
+                collapse: "collapse";
+            }>>;
+            min_length: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 /**
  * A single evaluator. The `kind` field discriminates required-fields:
@@ -185,6 +226,26 @@ export declare const evaluatorZ: z.ZodObject<{
             in: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
             matches: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>>;
+        output_grounded: z.ZodOptional<z.ZodObject<{
+            paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            inputs: z.ZodOptional<z.ZodBoolean>;
+            context: z.ZodOptional<z.ZodBoolean>;
+            stale: z.ZodOptional<z.ZodBoolean>;
+            quotes: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                whitespace: z.ZodOptional<z.ZodEnum<{
+                    exact: "exact";
+                    trim: "trim";
+                    collapse: "collapse";
+                }>>;
+                min_length: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
     rubric: z.ZodOptional<z.ZodString>;
     pass_when: z.ZodOptional<z.ZodString>;
@@ -467,6 +528,26 @@ export declare const nodeZ: z.ZodObject<{
                 in: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
                 matches: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>>;
+            output_grounded: z.ZodOptional<z.ZodObject<{
+                paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                inputs: z.ZodOptional<z.ZodBoolean>;
+                context: z.ZodOptional<z.ZodBoolean>;
+                stale: z.ZodOptional<z.ZodBoolean>;
+                quotes: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    path: z.ZodString;
+                    tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    whitespace: z.ZodOptional<z.ZodEnum<{
+                        exact: "exact";
+                        trim: "trim";
+                        collapse: "collapse";
+                    }>>;
+                    min_length: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>>>;
+            }, z.core.$strict>>;
         }, z.core.$strict>>;
         rubric: z.ZodOptional<z.ZodString>;
         pass_when: z.ZodOptional<z.ZodString>;
@@ -675,6 +756,26 @@ export declare const workflowZ: z.ZodObject<{
                     in: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
                     matches: z.ZodOptional<z.ZodString>;
                 }, z.core.$strict>>>;
+                output_grounded: z.ZodOptional<z.ZodObject<{
+                    paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    inputs: z.ZodOptional<z.ZodBoolean>;
+                    context: z.ZodOptional<z.ZodBoolean>;
+                    stale: z.ZodOptional<z.ZodBoolean>;
+                    quotes: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                        path: z.ZodString;
+                        tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                        whitespace: z.ZodOptional<z.ZodEnum<{
+                            exact: "exact";
+                            trim: "trim";
+                            collapse: "collapse";
+                        }>>;
+                        min_length: z.ZodOptional<z.ZodNumber>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
             }, z.core.$strict>>;
             rubric: z.ZodOptional<z.ZodString>;
             pass_when: z.ZodOptional<z.ZodString>;
@@ -938,6 +1039,22 @@ export declare function parseWorkflow(raw: unknown): {
                     in?: unknown[] | undefined;
                     matches?: string | undefined;
                 }[] | undefined;
+                output_grounded?: {
+                    paths?: string[] | undefined;
+                    ids?: string[] | undefined;
+                    patterns?: string[] | undefined;
+                    allow?: string[] | undefined;
+                    tools?: string[] | undefined;
+                    inputs?: boolean | undefined;
+                    context?: boolean | undefined;
+                    stale?: boolean | undefined;
+                    quotes?: {
+                        path: string;
+                        tools?: string[] | undefined;
+                        whitespace?: "exact" | "trim" | "collapse" | undefined;
+                        min_length?: number | undefined;
+                    }[] | undefined;
+                } | undefined;
             } | undefined;
             rubric?: string | undefined;
             pass_when?: string | undefined;
@@ -1233,6 +1350,93 @@ export declare const workflowJsonSchema: {
                             };
                             readonly minItems: 1;
                         };
+                        readonly output_grounded: {
+                            readonly type: "object";
+                            readonly description: "function only. Every id and URL in the output must appear in the node's successful read-tool outputs, its instruction, the workflow input or prior nodes' context.";
+                            readonly additionalProperties: false;
+                            readonly properties: {
+                                readonly paths: {
+                                    readonly type: "array";
+                                    readonly items: {
+                                        readonly type: "string";
+                                        readonly minLength: 1;
+                                    };
+                                    readonly minItems: 1;
+                                };
+                                readonly ids: {
+                                    readonly type: "array";
+                                    readonly items: {
+                                        readonly type: "string";
+                                        readonly minLength: 1;
+                                    };
+                                    readonly minItems: 1;
+                                };
+                                readonly patterns: {
+                                    readonly type: "array";
+                                    readonly items: {
+                                        readonly type: "string";
+                                        readonly minLength: 1;
+                                    };
+                                };
+                                readonly allow: {
+                                    readonly type: "array";
+                                    readonly items: {
+                                        readonly type: "string";
+                                        readonly minLength: 1;
+                                    };
+                                    readonly minItems: 1;
+                                };
+                                readonly tools: {
+                                    readonly type: "array";
+                                    readonly items: {
+                                        readonly type: "string";
+                                        readonly minLength: 1;
+                                    };
+                                    readonly minItems: 1;
+                                };
+                                readonly inputs: {
+                                    readonly type: "boolean";
+                                };
+                                readonly context: {
+                                    readonly type: "boolean";
+                                };
+                                readonly stale: {
+                                    readonly type: "boolean";
+                                };
+                                readonly quotes: {
+                                    readonly type: "array";
+                                    readonly minItems: 1;
+                                    readonly description: "Values that must appear verbatim in a tool's output.";
+                                    readonly items: {
+                                        readonly type: "object";
+                                        readonly required: readonly ["path"];
+                                        readonly additionalProperties: false;
+                                        readonly properties: {
+                                            readonly path: {
+                                                readonly type: "string";
+                                                readonly minLength: 1;
+                                            };
+                                            readonly tools: {
+                                                readonly type: "array";
+                                                readonly items: {
+                                                    readonly type: "string";
+                                                    readonly minLength: 1;
+                                                };
+                                                readonly minItems: 1;
+                                            };
+                                            readonly whitespace: {
+                                                readonly type: "string";
+                                                readonly enum: readonly ["exact", "trim", "collapse"];
+                                            };
+                                            readonly min_length: {
+                                                readonly type: "integer";
+                                                readonly minimum: 1;
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
                     };
                 };
                 readonly rubric: {
@@ -1286,6 +1490,23 @@ export declare const workflowJsonSchema: {
                         readonly required: readonly ["rule"];
                     };
                 };
+            }, {
+                readonly if: {
+                    readonly properties: {
+                        readonly kind: {
+                            readonly const: "value";
+                        };
+                    };
+                };
+                readonly then: {
+                    readonly properties: {
+                        readonly rule: {
+                            readonly not: {
+                                readonly required: readonly ["output_grounded"];
+                            };
+                        };
+                    };
+                };
             }];
         };
         readonly Permissions: {

package/dist/schema.js

@@ -126,6 +126,31 @@ export const evalPolicyZ = z.enum(EVAL_POLICIES);
  * workflow fails at load time rather than throwing mid-run from `aggregateEval`.
  */
 const SUPPORTED_EVAL_POLICIES = new Set(["all_pass"]);
+/** `output_grounded` config (#580). Mirrors `OutputGroundedRule` in types.ts. */
+export const outputGroundedZ = z
+    .object({
+    paths: z.array(z.string().min(1)).min(1).optional(),
+    ids: z.array(z.string().min(1)).min(1).optional(),
+    // `[]` is allowed: it turns the pattern scan off.
+    patterns: z.array(z.string().min(1)).optional(),
+    allow: z.array(z.string().min(1)).min(1).optional(),
+    tools: z.array(z.string().min(1)).min(1).optional(),
+    inputs: z.boolean().optional(),
+    context: z.boolean().optional(),
+    stale: z.boolean().optional(),
+    quotes: z
+        .array(z
+        .object({
+        path: z.string().min(1),
+        tools: z.array(z.string().min(1)).min(1).optional(),
+        whitespace: z.enum(["exact", "trim", "collapse"]).optional(),
+        min_length: z.number().int().min(1).optional(),
+    })
+        .strict())
+        .min(1)
+        .optional(),
+})
+    .strict();
 export const evaluatorRuleZ = z
     .object({
     any_tool_called: z.array(z.string().min(1)).min(1).optional(),
@@ -133,14 +158,16 @@ export const evaluatorRuleZ = z
     no_tool_called: z.array(z.string().min(1)).min(1).optional(),
     output_required: z.array(z.string().min(1)).min(1).optional(),
     output_matches: z.array(outputMatchZ).min(1).optional(),
+    output_grounded: outputGroundedZ.optional(),
 })
     .strict()
     .refine((r) => r.any_tool_called !== undefined ||
     r.all_tools_called !== undefined ||
     r.no_tool_called !== undefined ||
     r.output_required !== undefined ||
-    r.output_matches !== undefined, {
-    message: "evaluator rule must declare at least one of: any_tool_called, all_tools_called, no_tool_called, output_required, output_matches",
+    r.output_matches !== undefined ||
+    r.output_grounded !== undefined, {
+    message: "evaluator rule must declare at least one of: any_tool_called, all_tools_called, no_tool_called, output_required, output_matches, output_grounded",
 });
 /**
  * A single evaluator. The `kind` field discriminates required-fields:
@@ -175,6 +202,14 @@ export const evaluatorZ = z
                 path: ["rule"],
             });
         }
+        // output_grounded reads the tool trace; a value evaluator would skip it and pass silently.
+        if (e.kind === "value" && e.rule?.output_grounded !== undefined) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: `evaluator '${e.name}' declares output_grounded on kind: value; output_grounded reads the tool trace, so declare it on kind: function`,
+                path: ["rule", "output_grounded"],
+            });
+        }
         if (e.rubric !== undefined || e.pass_when !== undefined || e.model !== undefined) {
             ctx.addIssue({
                 code: z.ZodIssueCode.custom,
@@ -967,6 +1002,37 @@ export const workflowJsonSchema = {
                         no_tool_called: { type: "array", items: { type: "string", minLength: 1 }, minItems: 1 },
                         output_required: { type: "array", items: { type: "string", minLength: 1 }, minItems: 1 },
                         output_matches: { type: "array", items: { $ref: "#/$defs/OutputMatch" }, minItems: 1 },
+                        output_grounded: {
+                            type: "object",
+                            description: "function only. Every id and URL in the output must appear in the node's successful read-tool outputs, its instruction, the workflow input or prior nodes' context.",
+                            additionalProperties: false,
+                            properties: {
+                                paths: { type: "array", items: { type: "string", minLength: 1 }, minItems: 1 },
+                                ids: { type: "array", items: { type: "string", minLength: 1 }, minItems: 1 },
+                                patterns: { type: "array", items: { type: "string", minLength: 1 } },
+                                allow: { type: "array", items: { type: "string", minLength: 1 }, minItems: 1 },
+                                tools: { type: "array", items: { type: "string", minLength: 1 }, minItems: 1 },
+                                inputs: { type: "boolean" },
+                                context: { type: "boolean" },
+                                stale: { type: "boolean" },
+                                quotes: {
+                                    type: "array",
+                                    minItems: 1,
+                                    description: "Values that must appear verbatim in a tool's output.",
+                                    items: {
+                                        type: "object",
+                                        required: ["path"],
+                                        additionalProperties: false,
+                                        properties: {
+                                            path: { type: "string", minLength: 1 },
+                                            tools: { type: "array", items: { type: "string", minLength: 1 }, minItems: 1 },
+                                            whitespace: { type: "string", enum: ["exact", "trim", "collapse"] },
+                                            min_length: { type: "integer", minimum: 1 },
+                                        },
+                                    },
+                                },
+                            },
+                        },
                     },
                 },
                 rubric: {
@@ -1009,6 +1075,11 @@ export const workflowJsonSchema = {
                         not: { required: ["rule"] },
                     },
                 },
+                {
+                    // output_grounded reads the tool trace: function only.
+                    if: { properties: { kind: { const: "value" } } },
+                    then: { properties: { rule: { not: { required: ["output_grounded"] } } } },
+                },
             ],
         },
         Permissions: {

package/dist/types.d.ts

@@ -288,6 +288,67 @@ export interface EvaluatorRule {
     output_required?: string[];
     /** Each assertion must hold against `result.data`. (`value` rules.) */
     output_matches?: OutputMatch[];
+    /**
+     * Every id and URL in `result.data` must appear in what the agent saw: its
+     * successful read-tool outputs, its own instruction, plus (by default) the
+     * workflow input and prior nodes' context. (`function` rules only.) See
+     * {@link OutputGroundedRule}.
+     */
+    output_grounded?: OutputGroundedRule;
+}
+/**
+ * Config for the `output_grounded` check (#580). Every field is optional;
+ * `{}` scans the whole output for URLs and `owner/repo#N` refs.
+ */
+export interface OutputGroundedRule {
+    /** Paths into `result.data` whose strings are scanned with `patterns`. Default: the whole output. */
+    paths?: string[];
+    /** Paths whose string or number values are each one id, checked whole (e.g. `items[*].ticket_id`). */
+    ids?: string[];
+    /**
+     * What counts as an id in scanned text: built-in names `url`, `github_ref`
+     * (`owner/repo#123`), `issue_key` (`ENG-123`), or a JavaScript regex source
+     * (its first capture group is the id when it has one). Default: `url` and
+     * `github_ref`; issue keys only when listed (prose is full of `UTF-8`-style
+     * tokens), or at `ids` paths. `[]` turns the scan off.
+     */
+    patterns?: string[];
+    /** Constants that always pass (URLs compared normalized). */
+    allow?: string[];
+    /**
+     * Only these tools' outputs count as evidence, whatever their class. A bare
+     * name matches sweny's own or a built-in tool; an MCP tool is named
+     * `server/tool` (or `mcp__server__tool`). Default: every successful read tool.
+     */
+    tools?: string[];
+    /** The workflow input counts as evidence. Default `true`. */
+    inputs?: boolean;
+    /** Prior nodes' context (what this node's prompt was given) counts as evidence. Default `true`. */
+    context?: boolean;
+    /**
+     * Fail an id seen only in the input or prior context when this node's tool
+     * outputs returned other ids of the same kind (same issue-key prefix, same
+     * repo, same URL collection) but not this one. Default `false`.
+     */
+    stale?: boolean;
+    /** Values that must appear verbatim in a tool's output (never in the input or context). */
+    quotes?: OutputGroundedQuote[];
+}
+/** One `output_grounded.quotes` entry: the values at `path` must be copied from a tool's output. */
+export interface OutputGroundedQuote {
+    /** Path into `result.data`; every string or number value under it is one quote. */
+    path: string;
+    /** Tools whose outputs the quote must come from, named as in the rule's `tools`. Default: the rule's `tools`, else any read tool. */
+    tools?: string[];
+    /** Shortest quote accepted, counted after whitespace normalization. Default 8. */
+    min_length?: number;
+    /**
+     * How whitespace compares. `exact`: byte for byte. `trim` (default): the
+     * quote's leading and trailing whitespace is ignored. `collapse`: every run
+     * of whitespace, in the quote and the tool output, counts as one space, and
+     * the quote is trimmed.
+     */
+    whitespace?: "exact" | "trim" | "collapse";
 }
 /**
  * A single evaluator on a node.
@@ -859,6 +920,12 @@ export interface ToolCall {
      * evaluators fall back to inspecting `output` for an `error` key.
      */
     status?: "success" | "error";
+    /**
+     * The MCP server an external tool came from (`linear` for
+     * `mcp__linear__get_issue`). Absent for sweny's own tools, built-ins, and
+     * harnesses that do not report it. `output_grounded` matches `tools` on it.
+     */
+    server?: string;
 }
 export type ExecutionEvent = {
     type: "workflow:start";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sweny-ai/core",
-  "version": "0.1.215",
+  "version": "0.1.217",
   "type": "module",
   "bin": {
     "sweny": "./dist/cli/main.js"