@tangle-network/agent-eval 0.183.0 → 0.185.0

package/dist/diagnosis/index.js

@@ -0,0 +1,1328 @@
+import { n as summarizeExecution } from "../analyze-runs-sTygaDyD.js";
+import { t as packageVersion } from "../package-version-D7lQHt_-.js";
+import { c as primeProtocolSha256, d as runPrimeExchange, n as buildPrimePrompt } from "../prime-protocol-DcAK9pC8.js";
+import { t as nodeHttpPrimeBridgeTransport } from "../prime-bridge-transport-Z3cpKGoV.js";
+import { t as fromOtelSpans } from "../otel-spans-CQY1pNiN.js";
+import { createHash, createHmac, randomBytes } from "node:crypto";
+import { MODEL_ATTR_KEYS, SPAN_KINDS, TOOL_NAME_ATTR_KEYS, resolveSpanKind, validateTraceSpans } from "@tangle-network/agent-trace-contract";
+//#region src/diagnosis/secret-filter.ts
+const marker = (id) => `[REDACTED:${id}]`;
+const whole = (id) => () => marker(id);
+/**
+* The trace-archive `SECRET_ASSIGNMENT` pattern (tangle-tools
+* trace-archive/archive.py), with the prefix captured so the key name survives
+* and only the value is replaced.
+*/
+const SECRET_ASSIGNMENT_PATTERN = /^([ \t]*(?:export[ \t]+)?["']?(?:[A-Za-z_][A-Za-z0-9_.-]*)?(?:key|token|secret|password|passwd|passphrase|credentials?)[A-Za-z0-9_]*["']?[ \t]*[=:][ \t]*["']?)(?!encrypted:)(?![$`])(?=[^\s"'#,]*[0-9])(?=[^\s"'#,]*[A-Za-z])[^\s"'#,]{16,}(["']?[ \t]*,?[ \t]*(?:#.*)?\r?)$/gim;
+const DIAGNOSIS_SECRET_RULES = [
+	{
+		id: "pem-block",
+		pattern: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY-----|$)/g,
+		replace: whole("pem-block")
+	},
+	{
+		id: "secret-assignment",
+		pattern: SECRET_ASSIGNMENT_PATTERN,
+		replace: (_match, prefix, suffix) => `${prefix}${marker("secret-assignment")}${suffix}`
+	},
+	{
+		id: "json-secret",
+		pattern: /("[A-Za-z0-9_.-]*(?:key|token|secret|password|passwd|passphrase|credentials?)[A-Za-z0-9_]*"[ \t]*:[ \t]*")(?!encrypted:)(?![$`])(?=[^"\s]*[0-9])(?=[^"\s]*[A-Za-z])[^"\s]{16,}(")/gi,
+		replace: (_match, prefix, suffix) => `${prefix}${marker("json-secret")}${suffix}`
+	},
+	{
+		id: "inline-assignment",
+		pattern: /\b([A-Za-z0-9_.-]*(?:key|token|secret|password|passwd|passphrase|credentials?)[A-Za-z0-9_]*["']?[ \t]*[=:][ \t]*["']?)(?!encrypted:)(?![$`[])(?=[^\s"'#,&;]*[0-9])(?=[^\s"'#,&;]*[A-Za-z])[^\s"'#,&;]{16,}/gi,
+		replace: (_match, prefix) => `${prefix}${marker("inline-assignment")}`
+	},
+	{
+		id: "anthropic-key",
+		pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}/g,
+		replace: whole("anthropic-key")
+	},
+	{
+		id: "openai-key",
+		pattern: /\bsk-[A-Za-z0-9_-]{20,}/g,
+		replace: whole("openai-key")
+	},
+	{
+		id: "github-token",
+		pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{30,})/g,
+		replace: whole("github-token")
+	},
+	{
+		id: "slack-token",
+		pattern: /\bxox[abeoprs]-[A-Za-z0-9-]{10,}/g,
+		replace: whole("slack-token")
+	},
+	{
+		id: "aws-access-key",
+		pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
+		replace: whole("aws-access-key")
+	},
+	{
+		id: "google-api-key",
+		pattern: /\bAIza[0-9A-Za-z_-]{35}/g,
+		replace: whole("google-api-key")
+	},
+	{
+		id: "jwt",
+		pattern: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g,
+		replace: whole("jwt")
+	},
+	{
+		id: "bearer",
+		pattern: /\b(Bearer)[ \t]+[A-Za-z0-9._~+/=-]{16,}/gi,
+		replace: (_match, word) => `${word} ${marker("bearer")}`
+	},
+	{
+		id: "url-credentials",
+		pattern: /\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)[^\s@/]+@/gi,
+		replace: (_match, prefix) => `${prefix}${marker("url-credentials")}@`
+	}
+];
+/** Redact one string, adding the per-rule counts to `report`. */
+function redactSecrets(input, report = emptySecretFilterReport(), rules = DIAGNOSIS_SECRET_RULES) {
+	let output = input;
+	for (const rule of rules) {
+		let hits = 0;
+		rule.pattern.lastIndex = 0;
+		output = output.replace(rule.pattern, (match, ...rest) => {
+			hits += 1;
+			const captured = rest.slice(0, countGroups(rule.pattern)).map((value) => typeof value === "string" ? value : "");
+			return rule.replace(match, ...captured);
+		});
+		if (hits > 0) {
+			report.redactionCount += hits;
+			report.byRule[rule.id] = (report.byRule[rule.id] ?? 0) + hits;
+		}
+	}
+	return output;
+}
+/** Whether any rule matches: the miner's equivalent of trace-archive `holds_secret`. */
+function holdsSecret(input, rules = DIAGNOSIS_SECRET_RULES) {
+	return rules.some((rule) => {
+		rule.pattern.lastIndex = 0;
+		const found = rule.pattern.test(input);
+		rule.pattern.lastIndex = 0;
+		return found;
+	});
+}
+/** Redact every string leaf of a JSON-like value. Keys are kept; values are filtered. */
+function redactSecretsDeep(value, report) {
+	if (typeof value === "string") return redactSecrets(value, report);
+	if (Array.isArray(value)) return value.map((item) => redactSecretsDeep(item, report));
+	if (value !== null && typeof value === "object") {
+		const next = {};
+		for (const [key, item] of Object.entries(value)) next[key] = redactSecretsDeep(item, report);
+		return next;
+	}
+	return value;
+}
+function emptySecretFilterReport() {
+	return {
+		redactionCount: 0,
+		byRule: {}
+	};
+}
+const groupCounts = /* @__PURE__ */ new WeakMap();
+function countGroups(pattern) {
+	const cached = groupCounts.get(pattern);
+	if (cached !== void 0) return cached;
+	const count = (new RegExp(`${pattern.source}|`).exec("")?.length ?? 1) - 1;
+	groupCounts.set(pattern, count);
+	return count;
+}
+//#endregion
+//#region src/diagnosis/spans.ts
+/**
+* Ingest for the diagnosis engine: flat spans in, filtered and normalized spans
+* out. Nothing downstream of this file sees an unfiltered value.
+*
+* Input is the flat-span shape trace-adapters and the traces CLI emit, one
+* object per span: `{trace_id, span_id, parent_span_id, name, kind,
+* start_time, end_time, status | status_code, status_message, attributes,
+* resource?}`. Times may be OTLP nanosecond strings, epoch milliseconds, or
+* ISO-8601; the generic OTLP line reader treats every digit string as
+* milliseconds, so time parsing is owned here.
+*/
+/**
+* Attributes that carry prompt, response, or tool payload text. When content is
+* not included they are removed before anything reads the span, rather than
+* trusting pattern redaction over free-form prose.
+*/
+const CONTENT_ATTRIBUTE = /^(?:input\.value|output\.value|input|output|result|prompt|completion|text|thinking|message|messages|tool\.(?:input|output|arguments|result)|tool_input|tool_output|arguments|gen_ai\.(?:prompt|completion|input\.messages|output\.messages|system_instructions|tool\.call\.(?:arguments|result))(?:\..*)?|llm\.(?:input|output)_messages(?:\..*)?|llm\.prompts?(?:\..*)?|content|body|request|response|command)$|\.content$/;
+const INPUT_ATTRIBUTE_KEYS = [
+	"input.value",
+	"input",
+	"tool.input",
+	"tool.arguments",
+	"tool_input",
+	"arguments",
+	"gen_ai.tool.call.arguments"
+];
+function isContentAttribute(key) {
+	return CONTENT_ATTRIBUTE.test(key);
+}
+/**
+* Filter secrets from every string, drop content attributes unless content is
+* included, and normalize each span. Order matters: the input fingerprint is
+* keyed and taken before redaction and the content drop, so repeated-call
+* detection works on metadata-only runs without the payload itself surviving.
+*/
+function ingestSpans(raw, options) {
+	const secrets = {
+		redactionCount: 0,
+		byRule: {}
+	};
+	const dropped = /* @__PURE__ */ new Set();
+	const seen = /* @__PURE__ */ new Set();
+	const spans = [];
+	let unreadable = 0;
+	let duplicateSpans = 0;
+	const traceOfSpan = /* @__PURE__ */ new Map();
+	const ambiguous = /* @__PURE__ */ new Set();
+	const digestKey = randomBytes(32);
+	for (const line of raw) {
+		if (line === null || typeof line !== "object" || Array.isArray(line)) {
+			unreadable += 1;
+			continue;
+		}
+		const record = line;
+		const traceId = idField(record, "trace_id", "traceId");
+		const spanId = idField(record, "span_id", "spanId");
+		if (!traceId || !spanId) {
+			unreadable += 1;
+			continue;
+		}
+		const key = `${traceId}\u0000${spanId}`;
+		if (seen.has(key)) {
+			duplicateSpans += 1;
+			continue;
+		}
+		seen.add(key);
+		const firstTrace = traceOfSpan.get(spanId);
+		if (firstTrace === void 0) traceOfSpan.set(spanId, traceId);
+		else if (firstTrace !== traceId) ambiguous.add(spanId);
+		const merged = mergedAttributes(record);
+		const inputDigest = digestInput(merged, digestKey);
+		const attributes = redactSecretsDeep(merged, secrets);
+		if (!options.contentIncluded) {
+			for (const key of Object.keys(attributes)) if (isContentAttribute(key)) {
+				delete attributes[key];
+				dropped.add(key);
+			}
+		}
+		const status = readStatus(record);
+		const statusMessage = status.message === null ? null : redactSecrets(status.message, secrets);
+		const toolName = firstString(attributes, TOOL_NAME_ATTR_KEYS);
+		const model = firstString(attributes, MODEL_ATTR_KEYS);
+		const name = redactSecrets(stringOr(record.name, "unknown"), secrets);
+		spans.push({
+			traceId,
+			spanId,
+			parentSpanId: idField(record, "parent_span_id", "parentSpanId") ?? null,
+			name,
+			kind: resolveKind(record.kind, name, attributes),
+			startMs: epochMillis(record.start_time ?? record.startTime ?? record.startTimeUnixNano),
+			endMs: epochMillis(record.end_time ?? record.endTime ?? record.endTimeUnixNano),
+			status: status.code,
+			statusMessage: options.contentIncluded ? statusMessage : truncate(statusMessage, 160),
+			toolName,
+			model,
+			inputDigest,
+			attributes
+		});
+	}
+	return {
+		spans,
+		report: {
+			received: raw.length,
+			accepted: spans.length,
+			unreadable,
+			duplicateSpans,
+			ambiguousSpanIds: [...ambiguous].sort(),
+			secrets,
+			droppedAttributes: [...dropped].sort()
+		}
+	};
+}
+/** The contract shape `validateTraceSpans` reads. */
+function toContractSpan(span) {
+	return {
+		trace_id: span.traceId,
+		span_id: span.spanId,
+		parent_span_id: span.parentSpanId,
+		name: span.name,
+		...span.kind === "UNKNOWN" ? {} : { kind: span.kind },
+		start_time: isoOrEmpty(span.startMs),
+		end_time: isoOrEmpty(span.endMs),
+		status: {
+			code: span.status === "ERROR" ? "STATUS_CODE_ERROR" : span.status === "OK" ? "STATUS_CODE_OK" : "STATUS_CODE_UNSET",
+			...span.statusMessage ? { message: span.statusMessage } : {}
+		},
+		attributes: span.attributes
+	};
+}
+function durationMs(span) {
+	return span.startMs !== null && span.endMs !== null ? Math.max(0, span.endMs - span.startMs) : null;
+}
+/**
+* Epoch milliseconds from OTLP nanoseconds, epoch milliseconds, epoch seconds,
+* or ISO-8601. Digit strings are classified by length: 17 or more digits are
+* nanoseconds, 15-16 microseconds, 12-14 milliseconds, and fewer are seconds.
+*/
+function epochMillis(value) {
+	if (typeof value === "number") return Number.isFinite(value) ? scaleEpoch(value, String(Math.trunc(value)).length) : null;
+	if (typeof value !== "string" || value.length === 0) return null;
+	if (/^\d+$/.test(value)) {
+		if (value.length >= 17) return Number(BigInt(value) / 1000000n);
+		return scaleEpoch(Number(value), value.length);
+	}
+	const parsed = Date.parse(value);
+	return Number.isNaN(parsed) ? null : parsed;
+}
+function scaleEpoch(value, digits) {
+	if (digits >= 17) return Math.trunc(value / 1e6);
+	if (digits >= 15) return Math.trunc(value / 1e3);
+	if (digits >= 12) return value;
+	return value * 1e3;
+}
+function isoOrEmpty(ms) {
+	return ms === null ? "" : new Date(ms).toISOString();
+}
+function mergedAttributes(record) {
+	const out = {};
+	const resource = record.resource;
+	if (resource && typeof resource === "object" && !Array.isArray(resource)) {
+		const attrs = resource.attributes;
+		if (attrs && typeof attrs === "object" && !Array.isArray(attrs)) Object.assign(out, attrs);
+	}
+	const attrs = record.attributes;
+	if (attrs && typeof attrs === "object" && !Array.isArray(attrs)) Object.assign(out, attrs);
+	if (typeof record.scope_name === "string" && out["otel.scope.name"] === void 0) out["otel.scope.name"] = record.scope_name;
+	return out;
+}
+function readStatus(record) {
+	let code = record.status_code;
+	let message = record.status_message;
+	const status = record.status;
+	if (status && typeof status === "object" && !Array.isArray(status)) {
+		const object = status;
+		code = object.code ?? code;
+		message = object.message ?? message;
+	}
+	const text = typeof code === "string" ? code.toUpperCase() : code;
+	return {
+		code: text === 2 || text === "STATUS_CODE_ERROR" || text === "ERROR" || text === "2" ? "ERROR" : text === 1 || text === "STATUS_CODE_OK" || text === "OK" || text === "1" ? "OK" : "UNSET",
+		message: typeof message === "string" && message.length > 0 ? message : null
+	};
+}
+/**
+* The contract's classifier decides the kind, so the capability table and the
+* findings count the same tool and LLM spans. A top-level `kind` counts as a
+* declaration only when it is a contract kind; OTLP words such as
+* SPAN_KIND_INTERNAL fall through to the attribute and name signals.
+*/
+function resolveKind(kind, name, attributes) {
+	const declared = typeof kind === "string" && SPAN_KINDS.includes(kind.toUpperCase()) ? kind.toUpperCase() : void 0;
+	return resolveSpanKind({
+		...declared ? { kind: declared } : {},
+		name,
+		attributes
+	});
+}
+function digestInput(attributes, key) {
+	for (const name of INPUT_ATTRIBUTE_KEYS) {
+		const value = attributes[name];
+		if (value === void 0 || value === null || value === "") continue;
+		const text = typeof value === "string" ? value : JSON.stringify(value);
+		return createHmac("sha256", key).update(text).digest("hex").slice(0, 16);
+	}
+	return null;
+}
+function idField(record, snake, camel) {
+	const value = record[snake] ?? record[camel];
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function firstString(attributes, keys) {
+	for (const key of keys) {
+		const value = attributes[key];
+		if (typeof value === "string" && value.length > 0) return value;
+	}
+	return null;
+}
+function stringOr(value, fallback) {
+	return typeof value === "string" && value.length > 0 ? value : fallback;
+}
+function truncate(value, max) {
+	if (value === null || value.length <= max) return value;
+	return `${value.slice(0, max)}…`;
+}
+/** The analysis each capability gates, as the report names it. */
+const CAPABILITY_ANALYSES = {
+	"token-accounting": "token accounting",
+	"cost-attribution": "cost attribution",
+	"tool-usage": "tool failure rates and repeated-call detection",
+	"loop-convergence": "loop convergence (did round N+1 improve on round N)",
+	"tree-comparison": "arm-vs-arm comparison across branches of one run",
+	"steering-chain": "steering chain (which verdict caused which retry)",
+	"latency-analysis": "latency distribution"
+};
+/** Capabilities the engine reports but has no analysis for yet. */
+const NOT_BUILT = /* @__PURE__ */ new Map([
+	["loop-convergence", "the engine has no round-over-round convergence analysis yet"],
+	["tree-comparison", "the engine has no arm-vs-arm comparison yet"],
+	["steering-chain", "the engine has no steering-chain analysis yet"]
+]);
+function runDeterministicPass(spans) {
+	const validation = validateTraceSpans(spans.map(toContractSpan));
+	const capabilities = {};
+	const skipped = [];
+	for (const capability of validation.capabilities) {
+		capabilities[capability.name] = capability.available ? { available: true } : {
+			available: false,
+			reason: capability.reason ?? "the trace contract validator gave no reason"
+		};
+		const analysis = CAPABILITY_ANALYSES[capability.name] ?? capability.name;
+		if (!capability.available) skipped.push({
+			analysis,
+			reason: capability.reason ?? "capability unavailable"
+		});
+		else if (NOT_BUILT.has(capability.name)) skipped.push({
+			analysis,
+			reason: NOT_BUILT.get(capability.name)
+		});
+	}
+	const traces = groupByTrace(spans);
+	const findings = [];
+	const tools = spans.filter((span) => span.kind === "TOOL");
+	if (tools.length > 0) {
+		findings.push(...toolFailureFindings(tools));
+		if (tools.filter((span) => span.inputDigest !== null).length > 0) findings.push(...repeatedCallFindings(traces));
+		else skipped.push({
+			analysis: "repeated identical tool calls",
+			reason: `none of ${tools.length} tool spans carries its input, so identical calls cannot be told apart`
+		});
+	} else skipped.push({
+		analysis: "tool failure rates",
+		reason: "no span resolves to kind TOOL"
+	});
+	findings.push(...failedRunFindings(traces));
+	return {
+		validation,
+		capabilities,
+		skipped,
+		facts: executionFacts(spans, traces.size),
+		findings,
+		window: timeWindow(spans)
+	};
+}
+function groupByTrace(spans) {
+	const traces = /* @__PURE__ */ new Map();
+	for (const span of spans) {
+		const list = traces.get(span.traceId);
+		if (list) list.push(span);
+		else traces.set(span.traceId, [span]);
+	}
+	for (const list of traces.values()) list.sort(byStart);
+	return traces;
+}
+function toolFailureFindings(tools) {
+	const byTool = /* @__PURE__ */ new Map();
+	for (const span of tools) {
+		const name = span.toolName ?? span.name;
+		const list = byTool.get(name);
+		if (list) list.push(span);
+		else byTool.set(name, [span]);
+	}
+	const findings = [];
+	for (const [tool, calls] of byTool) {
+		const failed = calls.filter((span) => span.status === "ERROR");
+		if (calls.length < 3 || failed.length < 2) continue;
+		const rate = failed.length / calls.length;
+		const severity = rate >= .5 && failed.length >= 5 ? "high" : rate >= .2 ? "medium" : "low";
+		findings.push({
+			id: stableId("tool-failures", tool),
+			severity,
+			claim: `${failed.length} of ${calls.length} calls to the ${tool} tool failed.`,
+			consequence: `Each failed call spends a model turn noticing the error and retrying, so ${pct(rate)} of this tool's calls bought no progress.`,
+			measure: {
+				name: `${tool} tool failure rate`,
+				value: round(rate * 100),
+				unit: "%",
+				denominator: `${calls.length} calls to ${tool}`
+			},
+			evidence: failed.slice(0, 8).map((span) => span.spanId),
+			confidence: "observed",
+			recommendation: `Read the failed ${tool} calls' status messages and fix the most common cause, or give the agent the precondition it keeps missing.`
+		});
+	}
+	return findings.sort((a, b) => (b.measure?.value ?? 0) - (a.measure?.value ?? 0)).slice(0, 10);
+}
+function repeatedCallFindings(traces) {
+	const runs = [];
+	let digestCalls = 0;
+	for (const spans of traces.values()) {
+		let current = [];
+		for (const span of spans) {
+			if (span.kind !== "TOOL" || span.inputDigest === null) continue;
+			digestCalls += 1;
+			const last = current[current.length - 1];
+			if (last && last.inputDigest === span.inputDigest && (last.toolName ?? last.name) === (span.toolName ?? span.name)) current.push(span);
+			else {
+				if (current.length >= 3) runs.push(current);
+				current = [span];
+			}
+		}
+		if (current.length >= 3) runs.push(current);
+	}
+	if (runs.length === 0) return [];
+	const wasted = runs.reduce((sum, run) => sum + run.length - 1, 0);
+	const tracesAffected = new Set(runs.map((run) => run[0].traceId)).size;
+	runs.sort((a, b) => b.length - a.length);
+	const evidence = runs.flatMap((run) => run.slice(0, 2).map((span) => span.spanId)).slice(0, 8);
+	const rate = wasted / digestCalls;
+	return [{
+		id: stableId("repeated-calls", String(runs.length)),
+		severity: rate >= .1 ? "high" : rate >= .03 ? "medium" : "low",
+		claim: `The agent made the same tool call with the same input 3 or more times with no other tool call in between, ${runs.length} times across ${tracesAffected} runs; the longest streak was ${runs[0].length} calls.`,
+		consequence: `${wasted} calls repeated the previous tool call with the same input, which is work the agent paid for twice without new information.`,
+		measure: {
+			name: "repeated identical tool calls",
+			value: wasted,
+			unit: "calls",
+			denominator: `${digestCalls} tool calls with recorded input`
+		},
+		evidence,
+		confidence: "observed",
+		recommendation: "Detect a repeated identical call in the harness and stop or change strategy after the second attempt."
+	}];
+}
+function failedRunFindings(traces) {
+	const failedRoots = [];
+	for (const spans of traces.values()) {
+		const ids = new Set(spans.map((span) => span.spanId));
+		const root = spans.find((span) => span.parentSpanId === null || !ids.has(span.parentSpanId));
+		if (root?.status === "ERROR") failedRoots.push(root);
+	}
+	if (failedRoots.length === 0) return [];
+	const rate = failedRoots.length / traces.size;
+	return [{
+		id: stableId("failed-runs", String(traces.size)),
+		severity: rate >= .25 ? "critical" : rate >= .1 ? "high" : "medium",
+		claim: `${failedRoots.length} of ${traces.size} runs ended with an error on their root span.`,
+		consequence: "A run that ends in an error delivered nothing its caller can use, and any tokens it spent are lost.",
+		measure: {
+			name: "failed runs",
+			value: round(rate * 100),
+			unit: "%",
+			denominator: `${traces.size} runs`
+		},
+		evidence: failedRoots.slice(0, 8).map((span) => span.spanId),
+		confidence: "observed",
+		recommendation: "Group the failed runs by their root status message and fix the largest group first."
+	}];
+}
+function executionFacts(spans, runs) {
+	const spansByKind = {};
+	const models = /* @__PURE__ */ new Set();
+	let errorSpans = 0;
+	let toolCalls = 0;
+	for (const span of spans) {
+		spansByKind[span.kind] = (spansByKind[span.kind] ?? 0) + 1;
+		if (span.status === "ERROR") errorSpans += 1;
+		if (span.kind === "TOOL") toolCalls += 1;
+		if (span.model) models.add(span.model);
+	}
+	const facts = {
+		runs,
+		spans: spans.length,
+		spansByKind,
+		errorSpans,
+		toolCalls,
+		models: [...models].sort(),
+		execution: null
+	};
+	try {
+		facts.execution = summarizeExecution({ runs: fromOtelSpans({ spans: spans.map(toTraceSpanEvent) }) });
+	} catch (error) {
+		facts.executionError = error instanceof Error ? error.message : String(error);
+	}
+	return facts;
+}
+function toTraceSpanEvent(span) {
+	const attributes = {};
+	for (const [key, value] of Object.entries(span.attributes)) if (typeof value === "string" || typeof value === "boolean") attributes[key] = value;
+	else if (typeof value === "number" && Number.isFinite(value)) attributes[key] = value;
+	if (span.kind !== "UNKNOWN" && attributes["openinference.span.kind"] === void 0) attributes["openinference.span.kind"] = span.kind;
+	const start = span.startMs ?? 0;
+	const end = span.endMs ?? start;
+	return {
+		traceId: span.traceId,
+		spanId: span.spanId,
+		...span.parentSpanId ? { parentSpanId: span.parentSpanId } : {},
+		name: span.name,
+		startTimeUnixNano: `${BigInt(Math.trunc(start)) * 1000000n}`,
+		endTimeUnixNano: `${BigInt(Math.trunc(end)) * 1000000n}`,
+		attributes,
+		status: {
+			code: span.status,
+			...span.statusMessage ? { message: span.statusMessage } : {}
+		}
+	};
+}
+function timeWindow(spans) {
+	let first = Number.POSITIVE_INFINITY;
+	let last = Number.NEGATIVE_INFINITY;
+	for (const span of spans) {
+		if (span.startMs !== null) first = Math.min(first, span.startMs);
+		const end = span.endMs ?? span.startMs;
+		if (end !== null) last = Math.max(last, end);
+	}
+	if (!Number.isFinite(first) || !Number.isFinite(last)) return "unknown";
+	return `${new Date(first).toISOString()}/${new Date(last).toISOString()}`;
+}
+function byStart(a, b) {
+	return (a.startMs ?? 0) - (b.startMs ?? 0) || (durationMs(b) ?? 0) - (durationMs(a) ?? 0);
+}
+function stableId(prefix, ...parts) {
+	return `${prefix}-${createHash("sha256").update(parts.join("\0")).digest("hex").slice(0, 12)}`;
+}
+function pct(rate) {
+	return `${round(rate * 100)}%`;
+}
+function round(value) {
+	return Math.round(value * 10) / 10;
+}
+//#endregion
+//#region src/diagnosis/findings.ts
+/**
+* The diagnosis findings document: what the engine returns and what the
+* diagnosis report renders. It mirrors the kit's JSON Schema
+* (`https://tangle.tools/schemas/diagnosis-findings-v1.json`, owned by the
+* traces repository's diagnosis kit) field for field, including its closed
+* objects, so a document that passes {@link validateDiagnosisFindings} passes
+* that schema.
+*/
+const DIAGNOSIS_FINDINGS_SCHEMA_ID = "https://tangle.tools/schemas/diagnosis-findings-v1.json";
+const SEVERITIES$1 = /* @__PURE__ */ new Set([
+	"critical",
+	"high",
+	"medium",
+	"low"
+]);
+const SEVERITY_RANK = {
+	critical: 0,
+	high: 1,
+	medium: 2,
+	low: 3
+};
+/**
+* Structural check against the v1 schema plus the two rules the schema states
+* in prose: an unavailable capability carries a reason, and a measure carries a
+* denominator. When `spanIds` is given, every evidence id must resolve to it.
+* Returns the list of defects; empty means valid.
+*/
+function validateDiagnosisFindings(document, options = {}) {
+	const errors = [];
+	if (!isObject(document)) return ["document is not an object"];
+	closed(document, [
+		"schemaVersion",
+		"subject",
+		"coverage",
+		"findings"
+	], "", errors);
+	if (document.schemaVersion !== 1) errors.push("schemaVersion must be 1");
+	const subject = document.subject;
+	if (!isObject(subject)) errors.push("subject must be an object");
+	else {
+		closed(subject, [
+			"label",
+			"runCount",
+			"window",
+			"contentIncluded"
+		], "subject", errors);
+		if (typeof subject.label !== "string") errors.push("subject.label must be a string");
+		if (!Number.isInteger(subject.runCount) || subject.runCount < 0) errors.push("subject.runCount must be a non-negative integer");
+		if (typeof subject.window !== "string") errors.push("subject.window must be a string");
+		if (subject.contentIncluded !== void 0 && typeof subject.contentIncluded !== "boolean") errors.push("subject.contentIncluded must be a boolean");
+	}
+	const coverage = document.coverage;
+	if (!isObject(coverage)) errors.push("coverage must be an object");
+	else {
+		closed(coverage, [
+			"capabilities",
+			"skipped",
+			"redaction"
+		], "coverage", errors);
+		if (!isObject(coverage.capabilities)) errors.push("coverage.capabilities must be an object");
+		else for (const [name, capability] of Object.entries(coverage.capabilities)) if (!isObject(capability) || typeof capability.available !== "boolean") errors.push(`coverage.capabilities.${name}.available must be a boolean`);
+		else if (!capability.available && !(typeof capability.reason === "string" && capability.reason)) errors.push(`coverage.capabilities.${name} is unavailable without a reason`);
+		if (!Array.isArray(coverage.skipped)) errors.push("coverage.skipped must be an array");
+		else coverage.skipped.forEach((entry, index) => {
+			if (!isObject(entry) || typeof entry.analysis !== "string" || typeof entry.reason !== "string") errors.push(`coverage.skipped[${index}] needs analysis and reason strings`);
+		});
+		if (coverage.redaction !== void 0) {
+			const redaction = coverage.redaction;
+			if (!isObject(redaction)) errors.push("coverage.redaction must be an object");
+			else {
+				if (!Number.isInteger(redaction.redactionCount) || redaction.redactionCount < 0) errors.push("coverage.redaction.redactionCount must be a non-negative integer");
+				if (redaction.byRule !== void 0 && !isObject(redaction.byRule)) errors.push("coverage.redaction.byRule must be an object");
+				if (redaction.droppedAttributes !== void 0 && !Array.isArray(redaction.droppedAttributes)) errors.push("coverage.redaction.droppedAttributes must be an array");
+			}
+		}
+	}
+	if (!Array.isArray(document.findings)) errors.push("findings must be an array");
+	else document.findings.forEach((finding, index) => {
+		const at = `findings[${index}]`;
+		if (!isObject(finding)) {
+			errors.push(`${at} must be an object`);
+			return;
+		}
+		closed(finding, [
+			"id",
+			"severity",
+			"claim",
+			"consequence",
+			"measure",
+			"evidence",
+			"reproduce",
+			"confidence",
+			"recommendation"
+		], at, errors);
+		for (const key of [
+			"id",
+			"claim",
+			"consequence"
+		]) if (typeof finding[key] !== "string" || !finding[key]) errors.push(`${at}.${key} must be a non-empty string`);
+		if (!SEVERITIES$1.has(finding.severity)) errors.push(`${at}.severity is invalid`);
+		if (finding.confidence !== "observed" && finding.confidence !== "inferred") errors.push(`${at}.confidence must be observed or inferred`);
+		if (!Array.isArray(finding.evidence) || finding.evidence.length === 0) errors.push(`${at}.evidence must be a non-empty array`);
+		else for (const id of finding.evidence) if (typeof id !== "string") errors.push(`${at}.evidence holds a non-string`);
+		else if (options.spanIds && !options.spanIds.has(id)) errors.push(`${at}.evidence ${id} does not resolve`);
+		if (finding.measure !== void 0) {
+			const measure = finding.measure;
+			if (!isObject(measure) || typeof measure.name !== "string" || typeof measure.value !== "number" || !Number.isFinite(measure.value) || typeof measure.unit !== "string") errors.push(`${at}.measure needs name, finite value and unit`);
+			else if (!(typeof measure.denominator === "string" && measure.denominator)) errors.push(`${at}.measure has no denominator`);
+		}
+		for (const key of ["reproduce", "recommendation"]) if (finding[key] !== void 0 && typeof finding[key] !== "string") errors.push(`${at}.${key} must be a string`);
+	});
+	return errors;
+}
+function closed(value, allowed, at, errors) {
+	for (const key of Object.keys(value)) if (!allowed.includes(key)) errors.push(`${at ? `${at}.` : ""}${key} is not allowed`);
+}
+function isObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+//#endregion
+//#region src/diagnosis/model-pass.ts
+const MAX_ROWS = 12;
+const MAX_STRING = 400;
+const SEVERITIES = /* @__PURE__ */ new Set([
+	"critical",
+	"high",
+	"medium",
+	"low"
+]);
+function modelQuestion(input) {
+	const focus = input.focus ? ` The owner's question: ${input.focus}` : "";
+	const projects = input.projects && input.projects.length > 0 ? ` The runs belong to these projects: ${input.projects.join(", ")}; set "project" on a row to one of these names when the run shows which one it concerns.` : "";
+	const withheld = input.contentIncluded ? "" : " Prompt, response and tool payload content was withheld at the owner's choice; do not report its absence as a defect, and reason from span names, kinds, order, timing, status and the remaining attributes.";
+	return input.subject === "internal" ? `Diagnose this coding-agent session from our own fleet: find concrete agent failures, wasted work, unsupported claims of success, and where the human operator's instructions caused trouble.${withheld}${projects}${focus}` : `Diagnose this agent run: find concrete failures, wasted work, and unsupported claims of success that cost the owner money, time, or correct results.${withheld}${projects}${focus}`;
+}
+function modelContractLines(subject) {
+	return [
+		"Reply with ONE fenced ```json block and nothing after it. The object has exactly two fields:",
+		"  \"answer\": one paragraph (at most 400 characters) summarising what went wrong in this run, or that nothing did.",
+		`  "rows": an array of at most ${MAX_ROWS} objects, each with "kind": ${subject === "internal" ? "\"finding\" | \"question\" | \"operator\"" : "\"finding\" | \"question\""}.`,
+		"A \"finding\" row: {\"kind\":\"finding\",\"severity\":\"critical|high|medium|low\",\"claim\":\"one sentence stating the defect\",\"consequence\":\"what it cost in money, time, failed work or escalations\",\"recommendation\":\"the fix\",\"evidence\":[\"<span_id>\", ...]}.",
+		"A \"question\" row: {\"kind\":\"question\",\"question\":\"a concrete question the owner should answer\",\"evidence\":[]}.",
+		...subject === "internal" ? ["An \"operator\" row: {\"kind\":\"operator\",\"claim\":\"one sentence critiquing how the human operator instructed or steered the agent\",\"evidence\":[\"<span_id>\", ...]}."] : [],
+		"Add \"project\": \"<repo or project name>\" to any row when the run shows which project it belongs to.",
+		"Every \"finding\" and \"operator\" row cites 1-8 span ids copied VERBATIM from the \"id\" fields of the trajectory. Rows citing ids that are not in the trajectory are discarded.",
+		"Keep every string under 400 characters. Report only what the trajectory shows; an empty rows array is a valid answer."
+	];
+}
+async function runModelPass(traces, ambiguousSpanIds, input, options, signal) {
+	const question = modelQuestion(input);
+	const contractLines = modelContractLines(input.subject);
+	const result = {
+		findings: [],
+		questions: [],
+		notes: [],
+		summaries: [],
+		rejected: [],
+		uncovered: [],
+		runs: [],
+		promptSha256: primeProtocolSha256({
+			question,
+			contractLines,
+			repairContractLines: contractLines,
+			limits: {
+				maxRows: MAX_ROWS,
+				maxString: MAX_STRING
+			}
+		})
+	};
+	const maxInlineChars = options.maxInlineChars ?? 4e5;
+	const attributeChars = options.attributeChars ?? 600;
+	const maxSegments = options.maxSegmentsPerRun ?? 3;
+	for (const { traceId, spans } of traces) {
+		const segments = segmentRun(spans, attributeChars, input.contentIncluded, maxInlineChars);
+		const chosen = segments.map((segment, index) => ({
+			...segment,
+			index
+		})).sort((a, b) => b.errors - a.errors || a.index - b.index).slice(0, maxSegments).sort((a, b) => a.index - b.index);
+		if (segments.length > chosen.length) result.uncovered.push({
+			traceId,
+			reason: `the run renders to ${segments.length} segments of at most ${maxInlineChars} characters; the model read the ${chosen.length} with the most errors (${chosen.map((segment) => segment.index + 1).join(", ")})`
+		});
+		for (const segment of chosen) {
+			const label = segments.length > 1 ? `${traceId} segment ${segment.index + 1}/${segments.length}` : traceId;
+			const ids = new Set(segment.spans.map((span) => span.spanId));
+			const outcome = await runPrimeExchange({
+				contract: {
+					rowsField: "rows",
+					contractLines,
+					repairContractLines: contractLines,
+					maxRows: MAX_ROWS,
+					decodeRow: (row) => decodeRow(row, input.subject)
+				},
+				prompt: buildPrimePrompt({
+					question,
+					contractLines,
+					trajectoryHeader: `TRAJECTORY (run ${label}; ${segment.spans.length} of the run's ${spans.length} spans, in start order; secrets redacted as [REDACTED:<kind>]):`,
+					renderedTrajectory: segment.rendered
+				}),
+				transport: options.transport,
+				url: options.url,
+				model: options.model,
+				timeoutMs: options.timeoutMs ?? 6e5,
+				repair: true,
+				...signal ? { signal } : {}
+			});
+			const delivery = {
+				segment: segment.index + 1,
+				segments: segments.length,
+				renderedChars: segment.rendered.length
+			};
+			if (!outcome.ok) {
+				result.runs.push({
+					traceId,
+					ok: false,
+					failure: `${label}: ${outcome.failure.kind}: ${outcome.failure.message}`,
+					delivery,
+					usage: outcome.usage,
+					rows: 0
+				});
+				continue;
+			}
+			for (const rejection of outcome.rejected) result.rejected.push({
+				traceId,
+				reason: `row ${rejection.index}: ${rejection.reason}`
+			});
+			if (outcome.overflow > 0) result.rejected.push({
+				traceId,
+				reason: `${outcome.overflow} valid rows beyond the ${MAX_ROWS}-row cap were dropped`
+			});
+			if (outcome.answer) result.summaries.push({
+				traceId,
+				answer: outcome.answer.slice(0, MAX_STRING)
+			});
+			acceptRows(result, outcome.rows, traceId, ids, ambiguousSpanIds);
+			result.runs.push({
+				traceId,
+				ok: true,
+				delivery,
+				usage: outcome.usage,
+				rows: outcome.rows.length
+			});
+		}
+	}
+	return result;
+}
+/** The topology reading: one exchange over the caller's run-graph summary, internal runs only. */
+async function runTopologyPass(topology, runIds, options, signal) {
+	const contractLines = [
+		"Reply with ONE fenced ```json block and nothing after it. The object has exactly two fields:",
+		"  \"answer\": one paragraph (at most 400 characters) on how the agent fleet was organised today.",
+		`  "rows": at most ${MAX_ROWS} objects, each either {"kind":"topology","claim":"one sentence on a spawn, messaging, hand-off or resume pattern that helped or hurt","evidence":["<run id>", ...],"project":"<optional>"} or {"kind":"question","question":"...","project":"<optional>","evidence":[]}.`,
+		"Every \"topology\" row cites 1-8 run ids copied VERBATIM from the graph. Keep every string under 400 characters."
+	];
+	const rendered = JSON.stringify(topology);
+	const outcome = await runPrimeExchange({
+		contract: {
+			rowsField: "rows",
+			contractLines,
+			repairContractLines: contractLines,
+			maxRows: MAX_ROWS,
+			decodeRow: (row) => decodeRow(row, "topology")
+		},
+		prompt: buildPrimePrompt({
+			question: "Analyse the topology of this agent fleet's runs: who spawned whom, who messaged whom, hand-offs and resumes. Name patterns that wasted work or lost context, and what to change.",
+			contractLines,
+			trajectoryHeader: `RUN GRAPH (${runIds.size} runs):`,
+			renderedTrajectory: rendered.length > (options.maxInlineChars ?? 4e5) ? rendered.slice(0, options.maxInlineChars ?? 4e5) : rendered
+		}),
+		transport: options.transport,
+		url: options.url,
+		model: options.model,
+		timeoutMs: options.timeoutMs ?? 6e5,
+		repair: true,
+		...signal ? { signal } : {}
+	});
+	const notes = [];
+	const questions = [];
+	const rejected = [];
+	if (outcome.ok && outcome.overflow > 0) rejected.push({ reason: `${outcome.overflow} valid topology rows beyond the ${MAX_ROWS}-row cap were dropped` });
+	if (!outcome.ok) return {
+		notes,
+		questions,
+		rejected,
+		run: {
+			traceId: "topology",
+			ok: false,
+			failure: `${outcome.failure.kind}: ${outcome.failure.message}`,
+			usage: outcome.usage,
+			rows: 0
+		}
+	};
+	for (const row of outcome.rows) {
+		if (row.kind === "question") {
+			questions.push({
+				question: row.question,
+				...row.project ? { project: row.project } : {}
+			});
+			continue;
+		}
+		const cited = row.evidence.filter((id) => runIds.has(id));
+		if (cited.length === 0) {
+			rejected.push({ reason: `topology row "${(row.claim ?? "").slice(0, 80)}" cites no run id from the graph` });
+			continue;
+		}
+		notes.push({
+			kind: "topology",
+			text: row.claim,
+			evidence: cited,
+			...row.project ? { project: row.project } : {}
+		});
+	}
+	if (outcome.answer) notes.unshift({
+		kind: "topology",
+		text: outcome.answer.slice(0, MAX_STRING),
+		evidence: []
+	});
+	return {
+		notes,
+		questions,
+		rejected,
+		run: {
+			traceId: "topology",
+			ok: true,
+			usage: outcome.usage,
+			rows: outcome.rows.length
+		}
+	};
+}
+function acceptRows(result, rows, traceId, ids, ambiguousSpanIds) {
+	for (const row of rows) {
+		const unresolved = row.evidence.filter((id) => !ids.has(id));
+		const ambiguous = row.evidence.filter((id) => ambiguousSpanIds.has(id));
+		const cited = row.evidence.filter((id) => ids.has(id) && !ambiguousSpanIds.has(id));
+		if (unresolved.length > 0) result.rejected.push({
+			traceId,
+			reason: `${row.kind} row cites ids not in the segment it read: ${unresolved.slice(0, 5).join(", ")}`
+		});
+		if (ambiguous.length > 0) result.rejected.push({
+			traceId,
+			reason: `${row.kind} row cites ids shared by several runs: ${ambiguous.slice(0, 5).join(", ")}`
+		});
+		if (row.kind === "question") {
+			result.questions.push({
+				question: row.question,
+				traceId,
+				...row.project ? { project: row.project } : {}
+			});
+			continue;
+		}
+		if (unresolved.length > 0 || ambiguous.length > 0) {
+			result.rejected.push({
+				traceId,
+				reason: `${row.kind} row "${(row.claim ?? "").slice(0, 80)}" discarded: it cites invalid evidence`
+			});
+			continue;
+		}
+		if (cited.length === 0) {
+			result.rejected.push({
+				traceId,
+				reason: `${row.kind} row "${(row.claim ?? "").slice(0, 80)}" has no resolvable evidence`
+			});
+			continue;
+		}
+		if (row.kind === "operator") {
+			result.notes.push({
+				kind: "operator",
+				text: row.claim,
+				evidence: cited,
+				traceId,
+				...row.project ? { project: row.project } : {}
+			});
+			continue;
+		}
+		result.findings.push({
+			id: stableId("inferred", traceId, row.claim),
+			severity: row.severity,
+			claim: row.claim,
+			consequence: row.consequence,
+			evidence: cited,
+			confidence: "inferred",
+			...row.recommendation ? { recommendation: row.recommendation } : {}
+		});
+	}
+}
+/**
+* Split a run, in start order, into contiguous segments that each render
+* within the inline budget. Inline is prime's only delivery, so a long run is
+* read as whole segments rather than silently truncated; which segments were
+* read and which were not is recorded by the caller.
+*/
+function segmentRun(spans, attributeChars, contentIncluded, maxInlineChars) {
+	const segments = [];
+	let current = [];
+	let parts = [];
+	let size = 2;
+	let errors = 0;
+	const flush = () => {
+		if (current.length === 0) return;
+		segments.push({
+			spans: current,
+			rendered: `[${parts.join(",")}]`,
+			errors
+		});
+		current = [];
+		parts = [];
+		size = 2;
+		errors = 0;
+	};
+	for (const span of spans) {
+		let part = JSON.stringify(renderSpan(span, attributeChars, contentIncluded));
+		if (part.length + 2 > maxInlineChars) part = JSON.stringify(renderSpan(span, 120, contentIncluded));
+		if (size + part.length + 1 > maxInlineChars) flush();
+		current.push(span);
+		parts.push(part);
+		size += part.length + 1;
+		if (span.status === "ERROR") errors += 1;
+	}
+	flush();
+	return segments;
+}
+function decodeRow(row, mode) {
+	if (row === null || typeof row !== "object" || Array.isArray(row)) return {
+		ok: false,
+		reason: "row is not an object"
+	};
+	const value = row;
+	const kind = value.kind;
+	if (typeof kind !== "string" || !(mode === "internal" ? [
+		"finding",
+		"question",
+		"operator"
+	] : mode === "customer" ? ["finding", "question"] : ["topology", "question"]).includes(kind)) return {
+		ok: false,
+		reason: `kind ${String(kind)} is not allowed here`
+	};
+	const evidence = Array.isArray(value.evidence) ? value.evidence.filter((id) => typeof id === "string" && id.length > 0).slice(0, 8) : [];
+	const project = shortString(value.project);
+	if (kind === "question") {
+		const question = shortString(value.question);
+		if (!question) return {
+			ok: false,
+			reason: "question row has no question"
+		};
+		return {
+			ok: true,
+			row: {
+				kind,
+				question,
+				evidence,
+				...project ? { project } : {}
+			}
+		};
+	}
+	const claim = shortString(value.claim);
+	if (!claim) return {
+		ok: false,
+		reason: `${kind} row has no claim`
+	};
+	if (kind !== "finding") return {
+		ok: true,
+		row: {
+			kind,
+			claim,
+			evidence,
+			...project ? { project } : {}
+		}
+	};
+	const severity = value.severity;
+	if (typeof severity !== "string" || !SEVERITIES.has(severity)) return {
+		ok: false,
+		reason: `severity ${String(severity)} is invalid`
+	};
+	const consequence = shortString(value.consequence);
+	if (!consequence) return {
+		ok: false,
+		reason: "finding row has no consequence"
+	};
+	const recommendation = shortString(value.recommendation);
+	return {
+		ok: true,
+		row: {
+			kind: "finding",
+			severity,
+			claim,
+			consequence,
+			evidence,
+			...recommendation ? { recommendation } : {},
+			...project ? { project } : {}
+		}
+	};
+}
+/** One span as the model reads it: the pivots, then the attributes that remain after filtering. */
+function renderSpan(span, attributeChars, contentIncluded) {
+	const out = {
+		id: span.spanId,
+		parent: span.parentSpanId,
+		kind: span.kind,
+		name: span.name
+	};
+	if (span.toolName) out.tool = span.toolName;
+	if (span.model) out.model = span.model;
+	if (span.status !== "UNSET") out.status = span.status;
+	if (span.statusMessage) out.status_message = clip(span.statusMessage, attributeChars);
+	const duration = durationMs(span);
+	if (duration !== null) out.ms = duration;
+	const attrs = {};
+	for (const [key, value] of Object.entries(span.attributes)) {
+		if (SKIP_ATTRIBUTES.has(key)) continue;
+		if (typeof value === "string") attrs[key] = clip(value, attributeChars);
+		else if (typeof value === "number" || typeof value === "boolean") attrs[key] = value;
+		else if (value !== null && value !== void 0) attrs[key] = clip(JSON.stringify(value), attributeChars);
+	}
+	if (Object.keys(attrs).length > 0) out.attrs = attrs;
+	if (!contentIncluded) out.content = "withheld";
+	return out;
+}
+/** Pivots already rendered above, and resource noise that repeats on every span. */
+const SKIP_ATTRIBUTES = /* @__PURE__ */ new Set([
+	"openinference.span.kind",
+	"tool.name",
+	"gen_ai.tool.name",
+	"llm.model_name",
+	"gen_ai.request.model",
+	"service.name",
+	"agent.name",
+	"source_file",
+	"otel.scope.name",
+	"telemetry.sdk.name",
+	"telemetry.sdk.language",
+	"telemetry.sdk.version"
+]);
+function clip(value, max) {
+	return value.length <= max ? value : `${value.slice(0, max)}…[+${value.length - max} chars]`;
+}
+function shortString(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	if (!trimmed) return void 0;
+	return trimmed.length <= MAX_STRING ? trimmed : `${trimmed.slice(0, MAX_STRING)}…`;
+}
+//#endregion
+//#region src/diagnosis/engine.ts
+/**
+* The agent-failure diagnosis engine: flat spans plus context in, a findings
+* document out.
+*
+* It is a plain function. Its only side effect is the model call made through
+* the caller's transport, and in deterministic mode it makes none. It keeps no
+* storage, files no issues, and retains nothing: where the spans came from and
+* where the findings go belong to the caller. That is what lets one engine
+* serve both the internal daily mining run and a customer diagnosis while their
+* data paths stay separate.
+*
+* Order of operations, each step reading only the previous step's output:
+*   1. secret filter and content drop over every input (spans, focus, topology);
+*   2. the deterministic pass: capability table, execution facts, observed findings;
+*   3. in model mode, the prime-protocol pass over the highest-signal runs;
+*   4. evidence resolution: every cited id must be a span id of the input that
+*      no other run shares; findings left without evidence are rejected.
+*/
+const DEFAULT_MAX_MODEL_TRACES = 6;
+async function diagnoseSpans(spans, context, options) {
+	if (context.subject !== "internal" && context.subject !== "customer") throw new TypeError(`diagnoseSpans: subject must be internal or customer, got ${String(context.subject)}`);
+	if (context.subject === "customer" && context.topology !== void 0) throw new TypeError("diagnoseSpans: topology analysis is internal only; a customer context must not carry one");
+	const contentIncluded = context.contentIncluded === true;
+	const { spans: filtered, report: ingest } = ingestSpans(spans, { contentIncluded });
+	const focus = context.focus === void 0 ? void 0 : redactSecrets(context.focus, ingest.secrets);
+	const deterministic = runDeterministicPass(filtered);
+	const skipped = [...deterministic.skipped];
+	const ambiguous = new Set(ingest.ambiguousSpanIds);
+	const rejected = [];
+	const questions = [];
+	const notes = [];
+	const summaries = [];
+	const runs = [];
+	let promptSha256 = null;
+	let modelFindings = [];
+	const traces = groupByTrace(filtered);
+	if (options.mode === "deterministic") skipped.push({
+		analysis: "model reading of the runs",
+		reason: options.reason ?? "deterministic mode: no model call was made"
+	});
+	else {
+		const maxTraces = options.model.maxTraces ?? 6;
+		const ranked = rankTraces(traces);
+		const selected = ranked.slice(0, maxTraces);
+		const short = traces.size - ranked.length;
+		if (ranked.length === 0) skipped.push({
+			analysis: "model reading of the runs",
+			reason: `no run has the 3 spans the model needs to read it; ${traces.size} runs were too short`
+		});
+		else if (short > 0) skipped.push({
+			analysis: `model reading of ${short} of ${traces.size} runs`,
+			reason: `those runs have fewer than 3 spans, too few for the model to read`
+		});
+		if (ranked.length > selected.length) skipped.push({
+			analysis: `model reading of ${ranked.length - selected.length} of ${ranked.length} runs`,
+			reason: `the model reads at most ${maxTraces} runs per diagnosis, chosen by error count then size`
+		});
+		const pass = await runModelPass(selected, ambiguous, {
+			subject: context.subject,
+			contentIncluded,
+			...focus ? { focus } : {},
+			...context.projects ? { projects: context.projects } : {}
+		}, options.model, options.signal);
+		promptSha256 = pass.promptSha256;
+		modelFindings = pass.findings;
+		questions.push(...pass.questions);
+		notes.push(...context.subject === "internal" ? pass.notes : []);
+		summaries.push(...pass.summaries);
+		rejected.push(...pass.rejected);
+		runs.push(...pass.runs);
+		for (const gap of pass.uncovered) skipped.push({
+			analysis: `model reading of part of run ${gap.traceId}`,
+			reason: gap.reason
+		});
+		for (const run of pass.runs) if (!run.ok) skipped.push({
+			analysis: `model reading of run ${run.traceId}`,
+			reason: run.failure ?? "failed"
+		});
+		if (context.subject === "internal" && context.topology) {
+			const topology = redactSecretsDeep(context.topology, ingest.secrets);
+			const reading = await runTopologyPass(topology, new Set((topology.runs ?? []).map((run) => run.id).filter((id) => typeof id === "string")), options.model, options.signal);
+			notes.push(...reading.notes);
+			questions.push(...reading.questions);
+			rejected.push(...reading.rejected);
+			runs.push(reading.run);
+			if (!reading.run.ok) skipped.push({
+				analysis: "topology reading",
+				reason: reading.run.failure ?? "failed"
+			});
+		}
+	}
+	const spanIds = new Set(filtered.map((span) => span.spanId));
+	const findings = resolveEvidence([...deterministic.findings, ...modelFindings], spanIds, ambiguous, rejected).sort((a, b) => SEVERITY_RANK[a.severity] - SEVERITY_RANK[b.severity] || (a.confidence === b.confidence ? 0 : a.confidence === "observed" ? -1 : 1));
+	const document = {
+		schemaVersion: 1,
+		subject: {
+			label: redactSecrets(context.label, ingest.secrets),
+			runCount: traces.size,
+			window: deterministic.window,
+			contentIncluded
+		},
+		coverage: {
+			capabilities: deterministic.capabilities,
+			skipped,
+			redaction: {
+				redactionCount: ingest.secrets.redactionCount,
+				byRule: { ...ingest.secrets.byRule },
+				droppedAttributes: ingest.droppedAttributes
+			}
+		},
+		findings
+	};
+	const defects = validateDiagnosisFindings(document, { spanIds });
+	if (defects.length > 0) throw new Error(`diagnoseSpans produced an invalid findings document: ${defects.slice(0, 5).join("; ")}`);
+	const pricing = options.mode === "model" ? options.model.pricing : void 0;
+	return {
+		document,
+		questions,
+		notes,
+		summaries,
+		facts: deterministic.facts,
+		conformance: deterministic.validation.findings,
+		ingest,
+		rejected,
+		model: {
+			used: options.mode === "model",
+			model: options.mode === "model" ? options.model.model : null,
+			runs,
+			promptSha256,
+			usage: totalUsage(runs, pricing)
+		},
+		engine: {
+			name: "agent-eval/diagnosis",
+			version: packageVersion()
+		}
+	};
+}
+/** Runs with more errors first, then larger runs; runs under MIN_MODEL_SPANS are left out. */
+function rankTraces(traces) {
+	return [...traces.entries()].filter(([, spans]) => spans.length >= 3).map(([traceId, spans]) => ({
+		traceId,
+		spans,
+		errors: spans.filter((span) => span.status === "ERROR").length
+	})).sort((a, b) => b.errors - a.errors || b.spans.length - a.spans.length || a.traceId.localeCompare(b.traceId));
+}
+function resolveEvidence(findings, spanIds, ambiguous, rejected) {
+	const kept = [];
+	for (const finding of findings) {
+		const evidence = finding.evidence.filter((id) => spanIds.has(id) && !ambiguous.has(id));
+		if (evidence.length === 0) {
+			rejected.push({ reason: `finding ${finding.id} lost all evidence: its span ids are missing or shared by several runs` });
+			continue;
+		}
+		kept.push({
+			...finding,
+			evidence
+		});
+	}
+	return kept;
+}
+/**
+* Token and cost totals over the model exchanges. No exchange attempted is a
+* measured zero. An exchange that failed without reporting usage may still
+* have been billed, so it makes the totals unknown (null) rather than zero.
+*/
+function totalUsage(runs, pricing) {
+	let inputTokens = 0;
+	let outputTokens = 0;
+	let exchanges = 0;
+	for (const run of runs) {
+		exchanges += 1;
+		inputTokens = inputTokens === null || run.usage.inputTokens === null ? null : inputTokens + run.usage.inputTokens;
+		outputTokens = outputTokens === null || run.usage.outputTokens === null ? null : outputTokens + run.usage.outputTokens;
+	}
+	const usd = exchanges === 0 ? 0 : pricing && inputTokens !== null && outputTokens !== null ? (inputTokens * pricing.inputUsdPerMillion + outputTokens * pricing.outputUsdPerMillion) / 1e6 : null;
+	return {
+		exchanges,
+		inputTokens,
+		outputTokens,
+		usd
+	};
+}
+//#endregion
+export { DEFAULT_MAX_MODEL_TRACES, DIAGNOSIS_FINDINGS_SCHEMA_ID, DIAGNOSIS_SECRET_RULES, SECRET_ASSIGNMENT_PATTERN, diagnoseSpans, epochMillis, holdsSecret, ingestSpans, isContentAttribute, nodeHttpPrimeBridgeTransport, redactSecrets, redactSecretsDeep, validateDiagnosisFindings };
+
+//# sourceMappingURL=index.js.map