agent-contracts 0.11.5 → 0.11.6

package/README.md

@@ -1234,7 +1234,9 @@ Checks:
 Checks:
 
 * bidirectional consistency
-* validation coverage
+* validation coverage — warns when artifacts lack validations or have empty `required_validations` (fails under `--strict`)
+* artifact-required-validation wiring — verifies every entry in `artifact.required_validations` exists, targets the correct artifact, and is referenced in a workflow step or task
+* task-output-validation completeness — checks that tasks producing artifacts (via `execution_steps.produces_artifact` or agent `can_write_artifacts`) cover those artifacts' `required_validations`
 * workflow graph completeness
 * merge integrity
 * read-only write violations
@@ -1244,6 +1246,10 @@ Checks:
 * YAML safety — warns when YAML 1.1 reserved words (`on`, `yes`, `no`, `true`, `false`, etc.) are used in positions where they may be misinterpreted by non-1.2 parsers
 * naming/style issues through Spectral rules
 
+#### `--strict` mode
+
+When `--strict` is passed to `lint` or `check`, warnings are treated as failures (exit code 1). This is particularly relevant for artifact-centric validation rules — empty `required_validations`, orphaned validation wiring, and incomplete task coverage are all warnings that become blocking under `--strict`.
+
 ---
 
 ## Best used with runtime frameworks

package/dist/cli.js

@@ -52288,6 +52288,7 @@ var validationCoverageRule = {
       }
       validationsByArtifact.get(val.target_artifact).add(val.kind);
     }
+    const strictArtifactTypes = ["code", "config", "schema"];
     for (const [artId, art] of Object.entries(dsl.artifacts)) {
       const kinds = validationsByArtifact.get(artId);
       if (!kinds || kinds.size === 0) {
@@ -52299,8 +52300,7 @@ var validationCoverageRule = {
         });
         continue;
       }
-      const mechanicalTypes = ["code", "config", "schema"];
-      if (mechanicalTypes.includes(art.type) && !kinds.has("mechanical") && !kinds.has("schema")) {
+      if (strictArtifactTypes.includes(art.type) && !kinds.has("mechanical") && !kinds.has("schema")) {
         diagnostics.push({
           ruleId: "validation-coverage",
           severity: "warning",
@@ -52309,6 +52309,16 @@ var validationCoverageRule = {
         });
       }
     }
+    for (const [artId, art] of Object.entries(dsl.artifacts)) {
+      if (art.required_validations.length === 0) {
+        diagnostics.push({
+          ruleId: "validation-coverage",
+          severity: "warning",
+          path: `artifacts.${artId}`,
+          message: `Artifact "${artId}" has empty required_validations`
+        });
+      }
+    }
     const referencedValidations = /* @__PURE__ */ new Set();
     for (const wf of Object.values(dsl.workflow)) {
       for (const step of wf.steps) {
@@ -52695,6 +52705,101 @@ var yamlReservedKeySafetyRule = {
   }
 };
 
+// src/linter/rules/artifact-required-validation-wiring.ts
+var artifactRequiredValidationWiringRule = {
+  id: "artifact-required-validation-wiring",
+  description: "Every validation listed in artifact.required_validations must exist, target the artifact, and be referenced in a workflow step or task.",
+  run(dsl) {
+    const diagnostics = [];
+    const referencedValidations = /* @__PURE__ */ new Set();
+    for (const wf of Object.values(dsl.workflow)) {
+      for (const step of wf.steps) {
+        if (step.type === "validation") {
+          referencedValidations.add(step.validation);
+        }
+      }
+    }
+    for (const task of Object.values(dsl.tasks)) {
+      for (const valId of task.validations) {
+        referencedValidations.add(valId);
+      }
+    }
+    for (const [artId, art] of Object.entries(dsl.artifacts)) {
+      for (const reqValId of art.required_validations) {
+        const val = dsl.validations[reqValId];
+        if (!val) {
+          diagnostics.push({
+            ruleId: "artifact-required-validation-wiring",
+            severity: "error",
+            path: `artifacts.${artId}`,
+            message: `required_validation "${reqValId}" does not exist in validations`
+          });
+          continue;
+        }
+        if (val.target_artifact !== artId) {
+          diagnostics.push({
+            ruleId: "artifact-required-validation-wiring",
+            severity: "error",
+            path: `artifacts.${artId}`,
+            message: `required_validation "${reqValId}" has target_artifact "${val.target_artifact}" instead of "${artId}"`
+          });
+        }
+        if (!referencedValidations.has(reqValId)) {
+          diagnostics.push({
+            ruleId: "artifact-required-validation-wiring",
+            severity: "warning",
+            path: `artifacts.${artId}`,
+            message: `required_validation "${reqValId}" is defined but not referenced in any workflow step or task`
+          });
+        }
+      }
+    }
+    return diagnostics;
+  }
+};
+
+// src/linter/rules/task-output-validation-completeness.ts
+var taskOutputValidationCompletenessRule = {
+  id: "task-output-validation-completeness",
+  description: "Tasks producing artifacts should cover those artifacts' required_validations in their validations list.",
+  run(dsl) {
+    const diagnostics = [];
+    for (const [taskId, task] of Object.entries(dsl.tasks)) {
+      const producedArtifacts = /* @__PURE__ */ new Set();
+      if (task.execution_steps) {
+        for (const step of task.execution_steps) {
+          if (step.produces_artifact) {
+            producedArtifacts.add(step.produces_artifact);
+          }
+        }
+      }
+      const agent = dsl.agents[task.target_agent];
+      if (agent) {
+        for (const artId of agent.can_write_artifacts) {
+          producedArtifacts.add(artId);
+        }
+      }
+      const taskValidations = new Set(task.validations);
+      for (const artId of producedArtifacts) {
+        const art = dsl.artifacts[artId];
+        if (!art || art.required_validations.length === 0) continue;
+        const missing = art.required_validations.filter(
+          (v2) => !taskValidations.has(v2)
+        );
+        if (missing.length > 0) {
+          diagnostics.push({
+            ruleId: "task-output-validation-completeness",
+            severity: "warning",
+            path: `tasks.${taskId}`,
+            message: `Task produces artifact "${artId}" which requires validations [${missing.join(", ")}] but task.validations does not include them`
+          });
+        }
+      }
+    }
+    return diagnostics;
+  }
+};
+
 // src/linter/linter.ts
 var builtinRules = [
   validationCoverageRule,
@@ -52704,7 +52809,9 @@ var builtinRules = [
   artifactOwnershipRule,
   toolCommandsRule,
   guardrailPolicyCoverageRule,
-  yamlReservedKeySafetyRule
+  yamlReservedKeySafetyRule,
+  artifactRequiredValidationWiringRule,
+  taskOutputValidationCompletenessRule
 ];
 function lint(dsl, rules = builtinRules) {
   const diagnostics = [];