agent-contracts 0.12.2 → 0.12.4

package/dist/index.d.ts

@@ -78,6 +78,7 @@ declare const AgentSchema: z.ZodObject<{
         target: z.ZodString;
         required: z.ZodBoolean;
     }, z.core.$loose>>>;
+    guardrails: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$loose>;
 type Agent = z.infer<typeof AgentSchema>;
 
@@ -91,6 +92,7 @@ declare const ArtifactSchema: z.ZodObject<{
     states: z.ZodArray<z.ZodString>;
     required_validations: z.ZodDefault<z.ZodArray<z.ZodString>>;
     visibility: z.ZodOptional<z.ZodString>;
+    guardrails: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$loose>;
 type Artifact = z.infer<typeof ArtifactSchema>;
 
@@ -285,6 +287,7 @@ declare const DslSchema: z.ZodObject<{
             target: z.ZodString;
             required: z.ZodBoolean;
         }, z.core.$loose>>>;
+        guardrails: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$loose>>>;
     tasks: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         description: z.ZodString;
@@ -334,6 +337,7 @@ declare const DslSchema: z.ZodObject<{
             }>;
         }, z.core.$loose>>>;
         validations: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        guardrails: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$loose>>>;
     artifacts: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         type: z.ZodString;
@@ -345,6 +349,7 @@ declare const DslSchema: z.ZodObject<{
         states: z.ZodArray<z.ZodString>;
         required_validations: z.ZodDefault<z.ZodArray<z.ZodString>>;
         visibility: z.ZodOptional<z.ZodString>;
+        guardrails: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$loose>>>;
     tools: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         kind: z.ZodString;
@@ -360,6 +365,7 @@ declare const DslSchema: z.ZodObject<{
             writes: z.ZodDefault<z.ZodArray<z.ZodString>>;
             purpose: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>>;
+        guardrails: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$loose>>>;
     validations: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         target_artifact: z.ZodString;
@@ -721,6 +727,7 @@ declare const TaskSchema: z.ZodObject<{
         }>;
     }, z.core.$loose>>>;
     validations: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    guardrails: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$loose>;
 type Task = z.infer<typeof TaskSchema>;
 
@@ -746,6 +753,7 @@ declare const ToolSchema: z.ZodObject<{
         writes: z.ZodDefault<z.ZodArray<z.ZodString>>;
         purpose: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>>;
+    guardrails: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$loose>;
 type Tool = z.infer<typeof ToolSchema>;
 
@@ -1111,6 +1119,23 @@ interface SystemContext {
     bindings?: SoftwareBinding[];
     [key: string]: unknown;
 }
+interface EntityGuardrailEntry {
+    guardrail_id: string;
+    description: string;
+    rationale?: string;
+    tags: string[];
+    source: "entity" | "scope" | "both";
+    severity?: string;
+    action?: string;
+}
+interface EntityValidationEntry {
+    validation_id: string;
+    kind: string;
+    target_artifact: string;
+    executor_type: string;
+    blocking: boolean;
+    produces_evidence?: string;
+}
 interface PerTaskContext {
     task: Task & {
         id: string;
@@ -1118,6 +1143,8 @@ interface PerTaskContext {
     targetAgent: (Agent & {
         id: string;
     }) | null;
+    relatedGuardrails: EntityGuardrailEntry[];
+    relatedValidations: EntityValidationEntry[];
     dsl: Dsl;
     [key: string]: unknown;
 }
@@ -1131,6 +1158,7 @@ interface PerArtifactContext {
     consumerAgents: Dsl["agents"];
     editorAgents: Dsl["agents"];
     createdInWorkflows: string[];
+    relatedGuardrails: EntityGuardrailEntry[];
     dsl: Dsl;
     [key: string]: unknown;
 }
@@ -1141,6 +1169,8 @@ interface PerToolContext {
     invokableAgents: Dsl["agents"];
     inputArtifactDetails: Dsl["artifacts"];
     outputArtifactDetails: Dsl["artifacts"];
+    relatedGuardrails: EntityGuardrailEntry[];
+    relatedValidations: EntityValidationEntry[];
     dsl: Dsl;
     [key: string]: unknown;
 }
@@ -1231,6 +1261,8 @@ interface PerAgentContext {
     relatedTools: Dsl["tools"];
     relatedHandoffTypes: Dsl["handoff_types"];
     mergedBehavior: MergedBehavioralSpec;
+    relatedGuardrails: EntityGuardrailEntry[];
+    relatedValidations: EntityValidationEntry[];
     dsl: Dsl;
     [key: string]: unknown;
 }
@@ -1239,6 +1271,13 @@ declare function buildSystemContext(dsl: Dsl, options?: {
     loadedBindings?: LoadedBinding[];
     activeGuardrailPolicy?: string;
 }): SystemContext;
+type EntityType = "agents" | "tasks" | "tools" | "artifacts";
+declare function resolveEffectiveGuardrails(dsl: Dsl, entityType: EntityType, entityId: string): EntityGuardrailEntry[];
+/**
+ * Resolves validation IDs for an agent, task, or tool into full entries for prompts.
+ * For tools, includes validations where executor_type is "tool" and executor is the tool id.
+ */
+declare function resolveEntityValidations(dsl: Dsl, entityType: "agents" | "tasks" | "tools", entityId: string): EntityValidationEntry[];
 declare function buildTaskContext(dsl: Dsl, taskId: string): PerTaskContext;
 declare function buildArtifactContext(dsl: Dsl, artifactId: string): PerArtifactContext;
 declare function buildToolContext(dsl: Dsl, toolId: string): PerToolContext;
@@ -1330,4 +1369,4 @@ interface PathResolveResult {
 }
 declare function resolveBindingTargetPath(target: string, paths: Record<string, string>, bindingSoftware: string): PathResolveResult;
 
-export { type Agent, type AgentContractsConfig, AgentContractsConfigSchema, AgentSchema, type AppendOperator, AppendOperatorSchema, type Artifact, ArtifactSchema, BaseResolveError, type BindingOutput, BindingOutputSchema, CONTEXT_TYPES, type Check, CheckSchema, type Command, CommandSchema, type Components, ComponentsSchema, ConfigLoadError, type ContextType, ContextTypeSchema, type DelegatableTaskView, type DiagnosticMessage, type DimensionResult, type Dsl, DslLoadError, DslSchema, type EscalationCriterion, EscalationCriterionSchema, type ExecutionStep, ExecutionStepSchema, type Extends, ExtendsSchema, type ExternalParticipant, type GenerateDiagnostic, type GenerateGuardrailsOptions, type GenerateResult, type GlobalContext, type Guardrail, type GuardrailGenerationContext, type GuardrailPolicy, type GuardrailPolicyRule, type GuardrailPolicyRuleEscalation, GuardrailPolicyRuleEscalationSchema, GuardrailPolicyRuleSchema, GuardrailPolicySchema, GuardrailSchema, type GuardrailScope, GuardrailScopeSchema, type HandoffType, HandoffTypeSchema, type InsertAfterOperator, InsertAfterOperatorSchema, type LintDiagnostic, type LintRule, type LoadResult, type LoadedBinding, type Matcher, MatcherSchema, MergeError, type MergeableRecord, type MergedBehavioralSpec, type PathResolveResult, type PerAgentContext, type PerArtifactContext, type PerGuardrailContext, type PerGuardrailPolicyContext, type PerHandoffTypeContext, type PerPolicyContext, type PerTaskContext, type PerToolContext, type PerValidationContext, type PerWorkflowContext, type Policy, PolicySchema, type PolicyWhen, PolicyWhenSchema, type PrependOperator, PrependOperatorSchema, type Prerequisite, PrerequisiteSchema, type ReferenceDiagnostic, type RemoveOperator, RemoveOperatorSchema, type RenderTarget, RenderTargetSchema, type ReplaceOperator, ReplaceOperatorSchema, type Reporting, ReportingSchema, type ResolveChecksResult, type ResolveResult, type ResolvedCheck, type ResolvedConfig, type ResolvedRenderTarget, type Retry, type Rule, RuleSchema, type SchemaValidationResult, type ScoreResult, type Severity, type SoftwareBinding, SoftwareBindingSchema, type System, type SystemContext, SystemSchema, type Task, TaskSchema, type Tool, ToolSchema, type Validation, ValidationSchema, type VersionLiteral, VersionLiteralSchema, type Workflow, WorkflowSchema, type WorkflowStep, WorkflowStepSchema, type XExtensionDecl, XExtensionDeclSchema, buildArtifactContext, buildGlobalContext, buildGuardrailContext, buildGuardrailPolicyContext, buildHandoffTypeContext, buildPerAgentContext, buildPolicyContext, buildSystemContext, buildTaskContext, buildToolContext, buildValidationContext, buildWorkflowContext, builtinRules, checkDriftFromConfig, checkReferences, expandDefaults, generateGuardrails, lint, loadBindings, loadConfig, loadDsl, mergeDsl, renderFromConfig, resolve, resolveAllOf, resolveBase, resolveBindingTargetPath, resolveChecks, resolveDslPath, score, spectralLint, validateHandoffSchemas, validateSchema, yamlReservedKeySafetyRule };
+export { type Agent, type AgentContractsConfig, AgentContractsConfigSchema, AgentSchema, type AppendOperator, AppendOperatorSchema, type Artifact, ArtifactSchema, BaseResolveError, type BindingOutput, BindingOutputSchema, CONTEXT_TYPES, type Check, CheckSchema, type Command, CommandSchema, type Components, ComponentsSchema, ConfigLoadError, type ContextType, ContextTypeSchema, type DelegatableTaskView, type DiagnosticMessage, type DimensionResult, type Dsl, DslLoadError, DslSchema, type EntityGuardrailEntry, type EntityValidationEntry, type EscalationCriterion, EscalationCriterionSchema, type ExecutionStep, ExecutionStepSchema, type Extends, ExtendsSchema, type ExternalParticipant, type GenerateDiagnostic, type GenerateGuardrailsOptions, type GenerateResult, type GlobalContext, type Guardrail, type GuardrailGenerationContext, type GuardrailPolicy, type GuardrailPolicyRule, type GuardrailPolicyRuleEscalation, GuardrailPolicyRuleEscalationSchema, GuardrailPolicyRuleSchema, GuardrailPolicySchema, GuardrailSchema, type GuardrailScope, GuardrailScopeSchema, type HandoffType, HandoffTypeSchema, type InsertAfterOperator, InsertAfterOperatorSchema, type LintDiagnostic, type LintRule, type LoadResult, type LoadedBinding, type Matcher, MatcherSchema, MergeError, type MergeableRecord, type MergedBehavioralSpec, type PathResolveResult, type PerAgentContext, type PerArtifactContext, type PerGuardrailContext, type PerGuardrailPolicyContext, type PerHandoffTypeContext, type PerPolicyContext, type PerTaskContext, type PerToolContext, type PerValidationContext, type PerWorkflowContext, type Policy, PolicySchema, type PolicyWhen, PolicyWhenSchema, type PrependOperator, PrependOperatorSchema, type Prerequisite, PrerequisiteSchema, type ReferenceDiagnostic, type RemoveOperator, RemoveOperatorSchema, type RenderTarget, RenderTargetSchema, type ReplaceOperator, ReplaceOperatorSchema, type Reporting, ReportingSchema, type ResolveChecksResult, type ResolveResult, type ResolvedCheck, type ResolvedConfig, type ResolvedRenderTarget, type Retry, type Rule, RuleSchema, type SchemaValidationResult, type ScoreResult, type Severity, type SoftwareBinding, SoftwareBindingSchema, type System, type SystemContext, SystemSchema, type Task, TaskSchema, type Tool, ToolSchema, type Validation, ValidationSchema, type VersionLiteral, VersionLiteralSchema, type Workflow, WorkflowSchema, type WorkflowStep, WorkflowStepSchema, type XExtensionDecl, XExtensionDeclSchema, buildArtifactContext, buildGlobalContext, buildGuardrailContext, buildGuardrailPolicyContext, buildHandoffTypeContext, buildPerAgentContext, buildPolicyContext, buildSystemContext, buildTaskContext, buildToolContext, buildValidationContext, buildWorkflowContext, builtinRules, checkDriftFromConfig, checkReferences, expandDefaults, generateGuardrails, lint, loadBindings, loadConfig, loadDsl, mergeDsl, renderFromConfig, resolve, resolveAllOf, resolveBase, resolveBindingTargetPath, resolveChecks, resolveDslPath, resolveEffectiveGuardrails, resolveEntityValidations, score, spectralLint, validateHandoffSchemas, validateSchema, yamlReservedKeySafetyRule };

package/dist/index.js

@@ -50463,7 +50463,8 @@ var AgentSchema = z.object({
   rules: z.array(RuleSchema).optional(),
   anti_patterns: z.array(z.string()).optional(),
   escalation_criteria: z.array(EscalationCriterionSchema).optional(),
-  prerequisites: z.array(PrerequisiteSchema).optional()
+  prerequisites: z.array(PrerequisiteSchema).optional(),
+  guardrails: z.array(z.string()).optional()
 }).passthrough();
 
 // src/schema/artifact.ts
@@ -50477,7 +50478,8 @@ var ArtifactSchema = z2.object({
   consumers: z2.array(z2.string()),
   states: z2.array(z2.string()),
   required_validations: z2.array(z2.string()).default([]),
-  visibility: z2.string().optional()
+  visibility: z2.string().optional(),
+  guardrails: z2.array(z2.string()).optional()
 }).passthrough();
 
 // src/schema/binding.ts
@@ -50641,7 +50643,8 @@ var TaskSchema = z8.object({
   rules: z8.array(RuleSchema).optional(),
   anti_patterns: z8.array(z8.string()).optional(),
   escalation_criteria: z8.array(EscalationCriterionSchema).optional(),
-  validations: z8.array(z8.string()).default([])
+  validations: z8.array(z8.string()).default([]),
+  guardrails: z8.array(z8.string()).optional()
 }).passthrough();
 
 // src/schema/tool.ts
@@ -50660,7 +50663,8 @@ var ToolSchema = z9.object({
   output_artifacts: z9.array(z9.string()).default([]),
   invokable_by: z9.array(z9.string()),
   side_effects: z9.array(z9.string()).default([]),
-  commands: z9.array(CommandSchema).default([])
+  commands: z9.array(CommandSchema).default([]),
+  guardrails: z9.array(z9.string()).optional()
 }).passthrough();
 
 // src/schema/validation.ts
@@ -51776,6 +51780,34 @@ function checkReferences(dsl) {
       }
     }
   }
+  for (const [id, agent] of Object.entries(dsl.agents)) {
+    if (agent.guardrails) {
+      for (const ref of agent.guardrails) {
+        checkExists(ref, guardrailIds, "guardrails", `agents.${id}.guardrails`, "entity-guardrail-ref-not-found");
+      }
+    }
+  }
+  for (const [id, task] of Object.entries(dsl.tasks)) {
+    if (task.guardrails) {
+      for (const ref of task.guardrails) {
+        checkExists(ref, guardrailIds, "guardrails", `tasks.${id}.guardrails`, "entity-guardrail-ref-not-found");
+      }
+    }
+  }
+  for (const [id, tool] of Object.entries(dsl.tools)) {
+    if (tool.guardrails) {
+      for (const ref of tool.guardrails) {
+        checkExists(ref, guardrailIds, "guardrails", `tools.${id}.guardrails`, "entity-guardrail-ref-not-found");
+      }
+    }
+  }
+  for (const [id, art] of Object.entries(dsl.artifacts)) {
+    if (art.guardrails) {
+      for (const ref of art.guardrails) {
+        checkExists(ref, guardrailIds, "guardrails", `artifacts.${id}.guardrails`, "entity-guardrail-ref-not-found");
+      }
+    }
+  }
   for (const [id, guardrail] of Object.entries(dsl.guardrails)) {
     if (guardrail.scope.agents) {
       for (const ref of guardrail.scope.agents) {
@@ -52457,6 +52489,148 @@ var semanticValidationPhaseCoverageRule = {
   }
 };
 
+// src/linter/rules/entity-guardrail-binding.ts
+var entityGuardrailUndefinedRule = {
+  id: "entity-guardrail-undefined",
+  description: "Entity references a guardrail ID not defined in guardrails",
+  run(dsl) {
+    const diagnostics = [];
+    const guardrailIds = new Set(Object.keys(dsl.guardrails));
+    const sections = [
+      { name: "agents", entities: dsl.agents },
+      { name: "tasks", entities: dsl.tasks },
+      { name: "tools", entities: dsl.tools },
+      { name: "artifacts", entities: dsl.artifacts }
+    ];
+    for (const { name, entities } of sections) {
+      for (const [entityId, entity] of Object.entries(entities)) {
+        for (const ref of entity.guardrails ?? []) {
+          if (!guardrailIds.has(ref)) {
+            diagnostics.push({
+              ruleId: "entity-guardrail-undefined",
+              severity: "error",
+              path: `${name}.${entityId}.guardrails`,
+              message: `${name.slice(0, -1)} "${entityId}" references guardrail "${ref}" which is not defined in guardrails`
+            });
+          }
+        }
+      }
+    }
+    return diagnostics;
+  }
+};
+var entityNoGuardrailsRule = {
+  id: "entity-no-guardrails",
+  description: "Entity has no effective guardrails (neither entity-side nor scope-side)",
+  run(dsl) {
+    const diagnostics = [];
+    const scopeBindings = {
+      agents: /* @__PURE__ */ new Set(),
+      tasks: /* @__PURE__ */ new Set(),
+      tools: /* @__PURE__ */ new Set(),
+      artifacts: /* @__PURE__ */ new Set()
+    };
+    for (const guardrail of Object.values(dsl.guardrails)) {
+      for (const key of Object.keys(scopeBindings)) {
+        const ids = guardrail.scope[key];
+        if (ids) {
+          for (const id of ids) scopeBindings[key].add(id);
+        }
+      }
+    }
+    const sections = [
+      { name: "agents", entities: dsl.agents },
+      { name: "tasks", entities: dsl.tasks },
+      { name: "tools", entities: dsl.tools },
+      { name: "artifacts", entities: dsl.artifacts }
+    ];
+    for (const { name, entities } of sections) {
+      for (const [entityId, entity] of Object.entries(entities)) {
+        const hasEntitySide = (entity.guardrails ?? []).length > 0;
+        const hasScopeSide = scopeBindings[name].has(entityId);
+        if (!hasEntitySide && !hasScopeSide) {
+          diagnostics.push({
+            ruleId: "entity-no-guardrails",
+            severity: "info",
+            path: `${name}.${entityId}`,
+            message: `${name.slice(0, -1)} "${entityId}" has no effective guardrails`
+          });
+        }
+      }
+    }
+    return diagnostics;
+  }
+};
+var guardrailOrphanedRule = {
+  id: "guardrail-orphaned",
+  description: "Guardrail is not referenced by any entity and not bound to any entity via scope",
+  run(dsl) {
+    const diagnostics = [];
+    const referencedByEntities = /* @__PURE__ */ new Set();
+    const sections = [
+      dsl.agents,
+      dsl.tasks,
+      dsl.tools,
+      dsl.artifacts
+    ];
+    for (const entities of sections) {
+      for (const entity of Object.values(entities)) {
+        for (const ref of entity.guardrails ?? []) {
+          referencedByEntities.add(ref);
+        }
+      }
+    }
+    for (const [guardrailId, guardrail] of Object.entries(dsl.guardrails)) {
+      const hasEntityRef = referencedByEntities.has(guardrailId);
+      const scope = guardrail.scope;
+      const hasScopeBinding = (scope.agents?.length ?? 0) > 0 || (scope.tasks?.length ?? 0) > 0 || (scope.tools?.length ?? 0) > 0 || (scope.artifacts?.length ?? 0) > 0 || (scope.workflows?.length ?? 0) > 0;
+      if (!hasEntityRef && !hasScopeBinding) {
+        diagnostics.push({
+          ruleId: "guardrail-orphaned",
+          severity: "warning",
+          path: `guardrails.${guardrailId}`,
+          message: `Guardrail "${guardrailId}" is not referenced by any entity and has no scope bindings`
+        });
+      }
+    }
+    return diagnostics;
+  }
+};
+
+// src/linter/rules/validation-executor-no-context.ts
+var validationExecutorNoContextRule = {
+  id: "validation-executor-no-context",
+  description: "Validation executor is not wired so the validation appears in the executor's rendered context",
+  run(dsl) {
+    const diagnostics = [];
+    for (const [validationId, val] of Object.entries(dsl.validations)) {
+      if (val.executor_type === "agent") {
+        const agent = dsl.agents[val.executor];
+        if (!agent) continue;
+        const allowed = new Set(agent.can_perform_validations ?? []);
+        if (!allowed.has(validationId)) {
+          diagnostics.push({
+            ruleId: "validation-executor-no-context",
+            severity: "warning",
+            path: `agents.${val.executor}.can_perform_validations`,
+            message: `Validation "${validationId}" is executed by agent "${val.executor}" but is not listed in can_perform_validations, so it will be missing from that agent's prompt context`
+          });
+        }
+      } else if (val.executor_type === "tool") {
+        if (!dsl.tools[val.executor]) {
+          diagnostics.push({
+            ruleId: "validation-executor-no-context",
+            severity: "warning",
+            path: `validations.${validationId}.executor`,
+            message: `Validation "${validationId}" references tool executor "${val.executor}" which is not defined in tools`
+          });
+        }
+      }
+    }
+    return diagnostics;
+  }
+};
+
 // src/linter/linter.ts
 var builtinRules = [
   validationCoverageRule,
@@ -52469,7 +52643,11 @@ var builtinRules = [
   yamlReservedKeySafetyRule,
   artifactRequiredValidationWiringRule,
   taskOutputValidationCompletenessRule,
-  semanticValidationPhaseCoverageRule
+  semanticValidationPhaseCoverageRule,
+  entityGuardrailUndefinedRule,
+  entityNoGuardrailsRule,
+  guardrailOrphanedRule,
+  validationExecutorNoContextRule
 ];
 function lint(dsl, rules = builtinRules) {
   const diagnostics = [];
@@ -53183,12 +53361,96 @@ function buildGuardrailEnforcement(dsl, policy, loadedBindings) {
   }
   return entries;
 }
+function resolveEffectiveGuardrails(dsl, entityType, entityId) {
+  const entityDef = dsl[entityType][entityId];
+  const entitySide = new Set(entityDef?.guardrails ?? []);
+  const scopeSide = /* @__PURE__ */ new Set();
+  for (const [guardrailId, guardrail] of Object.entries(dsl.guardrails)) {
+    const scopeIds = guardrail.scope[entityType];
+    if (scopeIds?.includes(entityId)) {
+      scopeSide.add(guardrailId);
+    }
+  }
+  const allIds = /* @__PURE__ */ new Set([...entitySide, ...scopeSide]);
+  const activePolicyRules = /* @__PURE__ */ new Map();
+  for (const policy of Object.values(dsl.guardrail_policies)) {
+    for (const rule of policy.rules) {
+      if (!activePolicyRules.has(rule.guardrail)) {
+        activePolicyRules.set(rule.guardrail, {
+          severity: rule.severity,
+          action: rule.action
+        });
+      }
+    }
+  }
+  const entries = [];
+  for (const id of allIds) {
+    const guardrail = dsl.guardrails[id];
+    if (!guardrail) continue;
+    const fromEntity = entitySide.has(id);
+    const fromScope = scopeSide.has(id);
+    const source = fromEntity && fromScope ? "both" : fromEntity ? "entity" : "scope";
+    const policyInfo = activePolicyRules.get(id);
+    entries.push({
+      guardrail_id: id,
+      description: guardrail.description,
+      rationale: guardrail.rationale,
+      tags: guardrail.tags,
+      source,
+      severity: policyInfo?.severity,
+      action: policyInfo?.action
+    });
+  }
+  return entries;
+}
+function validationToEntityEntry(validationId, validation) {
+  return {
+    validation_id: validationId,
+    kind: validation.kind,
+    target_artifact: validation.target_artifact,
+    executor_type: validation.executor_type,
+    blocking: validation.blocking,
+    produces_evidence: validation.produces_evidence
+  };
+}
+function resolveEntityValidations(dsl, entityType, entityId) {
+  if (entityType === "agents") {
+    const agent = dsl.agents[entityId];
+    if (!agent) return [];
+    const entries2 = [];
+    for (const vid of agent.can_perform_validations ?? []) {
+      const v2 = dsl.validations[vid];
+      if (v2) entries2.push(validationToEntityEntry(vid, v2));
+    }
+    return entries2;
+  }
+  if (entityType === "tasks") {
+    const task = dsl.tasks[entityId];
+    if (!task) return [];
+    const entries2 = [];
+    for (const vid of task.validations ?? []) {
+      const v2 = dsl.validations[vid];
+      if (v2) entries2.push(validationToEntityEntry(vid, v2));
+    }
+    return entries2;
+  }
+  const entries = [];
+  for (const [vid, v2] of Object.entries(dsl.validations)) {
+    if (v2.executor_type === "tool" && v2.executor === entityId) {
+      entries.push(validationToEntityEntry(vid, v2));
+    }
+  }
+  entries.sort((a3, b3) => a3.validation_id.localeCompare(b3.validation_id));
+  return entries;
+}
 function buildTaskContext(dsl, taskId) {
   const taskDef = dsl.tasks[taskId];
   const task = { ...taskDef, id: taskId };
   const agentDef = dsl.agents[taskDef.target_agent];
   const targetAgent = agentDef ? { ...agentDef, id: taskDef.target_agent } : null;
-  return { task, targetAgent, dsl };
+  const relatedGuardrails = resolveEffectiveGuardrails(dsl, "tasks", taskId);
+  const relatedValidations = resolveEntityValidations(dsl, "tasks", taskId);
+  return { task, targetAgent, relatedGuardrails, relatedValidations, dsl };
 }
 function buildArtifactContext(dsl, artifactId) {
   const artifactDef = dsl.artifacts[artifactId];
@@ -53231,6 +53493,7 @@ function buildArtifactContext(dsl, artifactId) {
       }
     }
   }
+  const relatedGuardrails = resolveEffectiveGuardrails(dsl, "artifacts", artifactId);
   return {
     artifact,
     relatedTools,
@@ -53239,6 +53502,7 @@ function buildArtifactContext(dsl, artifactId) {
     consumerAgents,
     editorAgents,
     createdInWorkflows,
+    relatedGuardrails,
     dsl
   };
 }
@@ -53256,11 +53520,15 @@ function buildToolContext(dsl, toolId) {
     }
     return result;
   };
+  const relatedGuardrails = resolveEffectiveGuardrails(dsl, "tools", toolId);
+  const relatedValidations = resolveEntityValidations(dsl, "tools", toolId);
   return {
     tool,
     invokableAgents,
     inputArtifactDetails: pickArtifacts(toolDef.input_artifacts),
     outputArtifactDetails: pickArtifacts(toolDef.output_artifacts),
+    relatedGuardrails,
+    relatedValidations,
     dsl
   };
 }
@@ -53492,6 +53760,8 @@ function buildPerAgentContext(dsl, agent) {
   }
   const rawReceivableTasks = receivableTasks.map(({ id: _id, ...rest }) => rest);
   const mergedBehavior = mergeBehavioralSpec(agent, rawReceivableTasks);
+  const relatedGuardrails = resolveEffectiveGuardrails(dsl, "agents", agentId);
+  const relatedValidations = resolveEntityValidations(dsl, "agents", agentId);
   return {
     agent,
     tasks: receivableTasks,
@@ -53501,6 +53771,8 @@ function buildPerAgentContext(dsl, agent) {
     relatedTools,
     relatedHandoffTypes,
     mergedBehavior,
+    relatedGuardrails,
+    relatedValidations,
     dsl
   };
 }
@@ -54911,6 +55183,52 @@ function crossReferenceBidirectionality(dsl) {
     recommendations: issues.length > 0 ? [`${issues.length} unreciprocated cross-references: ${issues.slice(0, 5).join(", ")}${issues.length > 5 ? `, ... (${issues.length - 5} more)` : ""}`] : []
   };
 }
+function entityGuardrailCoverage(dsl) {
+  const entitySections = [
+    { name: "agents", entities: dsl.agents },
+    { name: "tasks", entities: dsl.tasks },
+    { name: "tools", entities: dsl.tools },
+    { name: "artifacts", entities: dsl.artifacts }
+  ];
+  const scopeBindings = {
+    agents: /* @__PURE__ */ new Set(),
+    tasks: /* @__PURE__ */ new Set(),
+    tools: /* @__PURE__ */ new Set(),
+    artifacts: /* @__PURE__ */ new Set()
+  };
+  for (const guardrail of Object.values(dsl.guardrails)) {
+    for (const key of Object.keys(scopeBindings)) {
+      const ids = guardrail.scope[key];
+      if (ids) {
+        for (const id of ids) scopeBindings[key].add(id);
+      }
+    }
+  }
+  let total = 0;
+  let covered = 0;
+  const missing = [];
+  for (const { name, entities } of entitySections) {
+    for (const [entityId, entity] of Object.entries(entities)) {
+      total++;
+      const hasEntitySide = (entity.guardrails ?? []).length > 0;
+      const hasScopeSide = scopeBindings[name].has(entityId);
+      if (hasEntitySide || hasScopeSide) {
+        covered++;
+      } else {
+        missing.push(`${name}.${entityId}`);
+      }
+    }
+  }
+  return {
+    id: "entity-guardrail-coverage",
+    label: "Entity guardrail coverage",
+    score: covered,
+    total,
+    percent: pct(covered, total),
+    weight: 1,
+    recommendations: missing.length > 0 ? [`${missing.length} entities without guardrails: ${missing.slice(0, 5).join(", ")}${missing.length > 5 ? `, ... (${missing.length - 5} more)` : ""}`] : []
+  };
+}
 function guardrailScopeResolution(dsl) {
   let totalRefs = 0;
   let resolvedRefs = 0;
@@ -54956,7 +55274,8 @@ function score(dsl) {
     workflowValidationIntegration(dsl),
     schemaCompleteness(dsl),
     crossReferenceBidirectionality(dsl),
-    guardrailScopeResolution(dsl)
+    guardrailScopeResolution(dsl),
+    entityGuardrailCoverage(dsl)
   ];
   const totalWeight = dimensions.reduce((s2, d2) => s2 + d2.weight, 0);
   const weightedSum = dimensions.reduce(
@@ -55383,6 +55702,8 @@ export {
   resolveBindingTargetPath,
   resolveChecks,
   resolveDslPath,
+  resolveEffectiveGuardrails,
+  resolveEntityValidations,
   score,
   spectralLint,
   validateHandoffSchemas,