agent-inspect 6.17.3 → 6.17.5

package/packages/core/dist/checks.d.cts

@@ -1,5 +1,5 @@
-import { L as LogicalProjectionDiagnostic, a as LogicalTraceEvent, T as TraceCheckInput, b as TraceCheckResult } from './index-Xk9X-yjY.cjs';
-export { B as BaselineRegressionRuleOptions, D as DecisionRuleOptions, G as GuardrailRuleOptions, c as LlmUsageRuleOptions, M as MaxStepDurationRuleOptions, O as ObservedOutcomeRuleOptions, R as RetrievalRuleOptions, d as RunDepthRuleOptions, e as RunDurationRuleOptions, f as RunEventCountRuleOptions, g as RunStatusRuleOptions, h as RunTraceChecksOptions, S as SafetyFindingCategory, i as SafetyFindingConfidence, j as SafetyOversizedAttributeRuleOptions, k as SafetyRawContentRuleOptions, l as SafetyRedactionRuleOptions, m as SafetySecretPattern, n as SafetySecretPatternRuleOptions, o as StallDetectionRuleOptions, p as StructureIncompleteRuleOptions, q as StructureOrphanRuleOptions, r as StructureParallelWidthRuleOptions, s as StructureRelationshipRuleOptions, t as ToolFailureRuleOptions, u as ToolOrderingRuleOptions, v as ToolUsageRuleOptions, w as TraceCheckContext, x as TraceCheckDiagnostic, y as TraceCheckDiagnosticCode, z as TraceCheckEvidence, A as TraceCheckFacts, C as TraceCheckFinding, E as TraceCheckFindingStatus, F as TraceCheckRule, H as TraceCheckRuleCategory, I as TraceCheckSeverity, J as TraceCheckStatus, K as TraceCheckSummary, N as TraceSignalRuleOptions, P as createBaselineRegressionRule, Q as createDecisionRule, U as createGuardrailRule, V as createLlmUsageRule, W as createMaxStepDurationRule, X as createObservedOutcomeRule, Y as createRequireCompletedRule, Z as createRetrievalRule, _ as createRunDepthRule, $ as createRunDurationRule, a0 as createRunEventCountRule, a1 as createRunStatusRule, a2 as createSafetyOversizedAttributeRule, a3 as createSafetyRawContentRule, a4 as createSafetyRedactionRule, a5 as createSafetySecretPatternRule, a6 as createStallDetectionRule, a7 as createStructureCycleRule, a8 as createStructureIncompleteRule, a9 as createStructureOrphanRule, aa as createStructureParallelWidthRule, ab as createStructureRelationshipRule, ac as createToolFailureRule, ad as createToolOrderingRule, ae as createToolUsageRule, af as projectLogicalEvents, ag as resolveCanonicalToolName, ah as runTraceChecks } from './index-Xk9X-yjY.cjs';
+import { L as LogicalProjectionDiagnostic, a as LogicalTraceEvent, T as TraceCheckInput, b as TraceCheckResult } from './index-DWu54Y28.cjs';
+export { B as BaselineRegressionRuleOptions, D as DecisionRuleOptions, G as GuardrailRuleOptions, c as LlmUsageRuleOptions, M as MaxStepDurationRuleOptions, O as ObservedOutcomeRuleOptions, R as RetrievalRuleOptions, d as RunDepthRuleOptions, e as RunDurationRuleOptions, f as RunEventCountRuleOptions, g as RunStatusRuleOptions, h as RunTraceChecksOptions, S as SafetyFindingCategory, i as SafetyFindingConfidence, j as SafetyOversizedAttributeRuleOptions, k as SafetyRawContentRuleOptions, l as SafetyRedactionRuleOptions, m as SafetySecretPattern, n as SafetySecretPatternRuleOptions, o as StallDetectionRuleOptions, p as StructureIncompleteRuleOptions, q as StructureOrphanRuleOptions, r as StructureParallelWidthRuleOptions, s as StructureRelationshipRuleOptions, t as ToolFailureRuleOptions, u as ToolOrderingRuleOptions, v as ToolUsageRuleOptions, w as TraceCheckContext, x as TraceCheckDiagnostic, y as TraceCheckDiagnosticCode, z as TraceCheckEvidence, A as TraceCheckFacts, C as TraceCheckFinding, E as TraceCheckFindingStatus, F as TraceCheckRule, H as TraceCheckRuleCategory, I as TraceCheckRuleExecution, J as TraceCheckRuleExecutionStatus, K as TraceCheckSeverity, N as TraceCheckStatus, P as TraceCheckSummary, Q as TraceSignalRuleOptions, U as createBaselineRegressionRule, V as createDecisionRule, W as createGuardrailRule, X as createLlmUsageRule, Y as createMaxStepDurationRule, Z as createObservedOutcomeRule, _ as createRequireCompletedRule, $ as createRetrievalRule, a0 as createRunDepthRule, a1 as createRunDurationRule, a2 as createRunEventCountRule, a3 as createRunStatusRule, a4 as createSafetyOversizedAttributeRule, a5 as createSafetyRawContentRule, a6 as createSafetyRedactionRule, a7 as createSafetySecretPatternRule, a8 as createStallDetectionRule, a9 as createStructureCycleRule, aa as createStructureIncompleteRule, ab as createStructureOrphanRule, ac as createStructureParallelWidthRule, ad as createStructureRelationshipRule, ae as createToolFailureRule, af as createToolOrderingRule, ag as createToolUsageRule, ah as projectLogicalEvents, ai as resolveCanonicalToolName, aj as runTraceChecks } from './index-DWu54Y28.cjs';
 export { PROGRAMMATIC_DIAGNOSTIC_SPECS, ProgrammaticDiagnosticCode, ProgrammaticDiagnosticSpec, formatProgrammaticDiagnostic } from './readers.cjs';
 import { T as TraceReadResult } from './index-B259NKkH.cjs';
 import { P as PersistedInspectEvent } from './persisted-inspect-event-CVZWZldL.cjs';
@@ -66,6 +66,13 @@ interface TraceContractRunRules {
     maxDurationMs?: number;
 }
 interface TraceContractToolRules {
+    /**
+     * Unconditional tool presence invariant. Every named tool must appear at least
+     * once. Do not use for cache-hit or alternate-path shortcuts — prefer
+     * `observations.required` until `alternatives.anyOf` ships (planned 6.20.0).
+     *
+     * @see docs/TRACE-CONTRACTS.md
+     */
     required?: string[];
     /** Alias of `required` (TraceContract v2 normalization). */
     requiredTools?: string[];
@@ -74,6 +81,25 @@ interface TraceContractToolRules {
     forbiddenTools?: string[];
     allowed?: string[];
     maxCalls?: number;
+    /**
+     * Required tool order as adjacent first-occurrence pairs (start/encounter order).
+     *
+     * `[A, B, C]` expands to “A before B” and “B before C”, each comparing the
+     * first occurrence of the named tool. Unlisted intermediate tools are
+     * allowed. Later repetitions do not invalidate an earlier valid order.
+     *
+     * TraceContract `requiredOrder` **implies presence**: every listed name is
+     * added to the effective required-tool set. Low-level `createToolOrderingRule`
+     * alone may still pass vacuously when an endpoint is missing.
+     *
+     * This is **not** causal happens-before. Overlapping intervals emit a
+     * non-failing overlap warning. Planned modes (6.20.0, GitHub #308):
+     * `happens-before`, `all-occurrences`.
+     *
+     * @see docs/TRACE-CONTRACTS.md
+     * @beta Available through `agent-inspect/checks`. Additive changes may ship
+     * in minor releases; breaking changes require a future major.
+     */
     requiredOrder?: string[];
 }
 interface TraceContractLlmRules {

package/packages/core/dist/checks.d.ts

@@ -1,5 +1,5 @@
-import { L as LogicalProjectionDiagnostic, a as LogicalTraceEvent, T as TraceCheckInput, b as TraceCheckResult } from './index-BsCcOKxy.js';
-export { B as BaselineRegressionRuleOptions, D as DecisionRuleOptions, G as GuardrailRuleOptions, c as LlmUsageRuleOptions, M as MaxStepDurationRuleOptions, O as ObservedOutcomeRuleOptions, R as RetrievalRuleOptions, d as RunDepthRuleOptions, e as RunDurationRuleOptions, f as RunEventCountRuleOptions, g as RunStatusRuleOptions, h as RunTraceChecksOptions, S as SafetyFindingCategory, i as SafetyFindingConfidence, j as SafetyOversizedAttributeRuleOptions, k as SafetyRawContentRuleOptions, l as SafetyRedactionRuleOptions, m as SafetySecretPattern, n as SafetySecretPatternRuleOptions, o as StallDetectionRuleOptions, p as StructureIncompleteRuleOptions, q as StructureOrphanRuleOptions, r as StructureParallelWidthRuleOptions, s as StructureRelationshipRuleOptions, t as ToolFailureRuleOptions, u as ToolOrderingRuleOptions, v as ToolUsageRuleOptions, w as TraceCheckContext, x as TraceCheckDiagnostic, y as TraceCheckDiagnosticCode, z as TraceCheckEvidence, A as TraceCheckFacts, C as TraceCheckFinding, E as TraceCheckFindingStatus, F as TraceCheckRule, H as TraceCheckRuleCategory, I as TraceCheckSeverity, J as TraceCheckStatus, K as TraceCheckSummary, N as TraceSignalRuleOptions, P as createBaselineRegressionRule, Q as createDecisionRule, U as createGuardrailRule, V as createLlmUsageRule, W as createMaxStepDurationRule, X as createObservedOutcomeRule, Y as createRequireCompletedRule, Z as createRetrievalRule, _ as createRunDepthRule, $ as createRunDurationRule, a0 as createRunEventCountRule, a1 as createRunStatusRule, a2 as createSafetyOversizedAttributeRule, a3 as createSafetyRawContentRule, a4 as createSafetyRedactionRule, a5 as createSafetySecretPatternRule, a6 as createStallDetectionRule, a7 as createStructureCycleRule, a8 as createStructureIncompleteRule, a9 as createStructureOrphanRule, aa as createStructureParallelWidthRule, ab as createStructureRelationshipRule, ac as createToolFailureRule, ad as createToolOrderingRule, ae as createToolUsageRule, af as projectLogicalEvents, ag as resolveCanonicalToolName, ah as runTraceChecks } from './index-BsCcOKxy.js';
+import { L as LogicalProjectionDiagnostic, a as LogicalTraceEvent, T as TraceCheckInput, b as TraceCheckResult } from './index-DlwbVqEs.js';
+export { B as BaselineRegressionRuleOptions, D as DecisionRuleOptions, G as GuardrailRuleOptions, c as LlmUsageRuleOptions, M as MaxStepDurationRuleOptions, O as ObservedOutcomeRuleOptions, R as RetrievalRuleOptions, d as RunDepthRuleOptions, e as RunDurationRuleOptions, f as RunEventCountRuleOptions, g as RunStatusRuleOptions, h as RunTraceChecksOptions, S as SafetyFindingCategory, i as SafetyFindingConfidence, j as SafetyOversizedAttributeRuleOptions, k as SafetyRawContentRuleOptions, l as SafetyRedactionRuleOptions, m as SafetySecretPattern, n as SafetySecretPatternRuleOptions, o as StallDetectionRuleOptions, p as StructureIncompleteRuleOptions, q as StructureOrphanRuleOptions, r as StructureParallelWidthRuleOptions, s as StructureRelationshipRuleOptions, t as ToolFailureRuleOptions, u as ToolOrderingRuleOptions, v as ToolUsageRuleOptions, w as TraceCheckContext, x as TraceCheckDiagnostic, y as TraceCheckDiagnosticCode, z as TraceCheckEvidence, A as TraceCheckFacts, C as TraceCheckFinding, E as TraceCheckFindingStatus, F as TraceCheckRule, H as TraceCheckRuleCategory, I as TraceCheckRuleExecution, J as TraceCheckRuleExecutionStatus, K as TraceCheckSeverity, N as TraceCheckStatus, P as TraceCheckSummary, Q as TraceSignalRuleOptions, U as createBaselineRegressionRule, V as createDecisionRule, W as createGuardrailRule, X as createLlmUsageRule, Y as createMaxStepDurationRule, Z as createObservedOutcomeRule, _ as createRequireCompletedRule, $ as createRetrievalRule, a0 as createRunDepthRule, a1 as createRunDurationRule, a2 as createRunEventCountRule, a3 as createRunStatusRule, a4 as createSafetyOversizedAttributeRule, a5 as createSafetyRawContentRule, a6 as createSafetyRedactionRule, a7 as createSafetySecretPatternRule, a8 as createStallDetectionRule, a9 as createStructureCycleRule, aa as createStructureIncompleteRule, ab as createStructureOrphanRule, ac as createStructureParallelWidthRule, ad as createStructureRelationshipRule, ae as createToolFailureRule, af as createToolOrderingRule, ag as createToolUsageRule, ah as projectLogicalEvents, ai as resolveCanonicalToolName, aj as runTraceChecks } from './index-DlwbVqEs.js';
 export { PROGRAMMATIC_DIAGNOSTIC_SPECS, ProgrammaticDiagnosticCode, ProgrammaticDiagnosticSpec, formatProgrammaticDiagnostic } from './readers.js';
 import { T as TraceReadResult } from './index-B9ZGvUVL.js';
 import { P as PersistedInspectEvent } from './persisted-inspect-event-BVucFVrP.js';
@@ -66,6 +66,13 @@ interface TraceContractRunRules {
     maxDurationMs?: number;
 }
 interface TraceContractToolRules {
+    /**
+     * Unconditional tool presence invariant. Every named tool must appear at least
+     * once. Do not use for cache-hit or alternate-path shortcuts — prefer
+     * `observations.required` until `alternatives.anyOf` ships (planned 6.20.0).
+     *
+     * @see docs/TRACE-CONTRACTS.md
+     */
     required?: string[];
     /** Alias of `required` (TraceContract v2 normalization). */
     requiredTools?: string[];
@@ -74,6 +81,25 @@ interface TraceContractToolRules {
     forbiddenTools?: string[];
     allowed?: string[];
     maxCalls?: number;
+    /**
+     * Required tool order as adjacent first-occurrence pairs (start/encounter order).
+     *
+     * `[A, B, C]` expands to “A before B” and “B before C”, each comparing the
+     * first occurrence of the named tool. Unlisted intermediate tools are
+     * allowed. Later repetitions do not invalidate an earlier valid order.
+     *
+     * TraceContract `requiredOrder` **implies presence**: every listed name is
+     * added to the effective required-tool set. Low-level `createToolOrderingRule`
+     * alone may still pass vacuously when an endpoint is missing.
+     *
+     * This is **not** causal happens-before. Overlapping intervals emit a
+     * non-failing overlap warning. Planned modes (6.20.0, GitHub #308):
+     * `happens-before`, `all-occurrences`.
+     *
+     * @see docs/TRACE-CONTRACTS.md
+     * @beta Available through `agent-inspect/checks`. Additive changes may ship
+     * in minor releases; breaking changes require a future major.
+     */
     requiredOrder?: string[];
 }
 interface TraceContractLlmRules {

package/packages/core/dist/checks.mjs

@@ -1,4 +1,4 @@
-export { buildTraceFacts, createBaselineRegressionRule, createDecisionRule, createGuardrailRule, createLlmUsageRule, createMaxStepDurationRule, createObservedOutcomeRule, createRequireCompletedRule, createRetrievalRule, createRunDepthRule, createRunDurationRule, createRunEventCountRule, createRunStatusRule, createSafetyOversizedAttributeRule, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createStallDetectionRule, createStructureCycleRule, createStructureIncompleteRule, createStructureOrphanRule, createStructureParallelWidthRule, createStructureRelationshipRule, createToolFailureRule, createToolOrderingRule, createToolUsageRule, defineTraceContract, evaluateTraceContract, evaluateTraceContractRead, projectLogicalEvents, resolveCanonicalToolName, runTraceChecks, summarizeSemanticParity } from './chunk-UFP54T7F.mjs';
+export { buildTraceFacts, createBaselineRegressionRule, createDecisionRule, createGuardrailRule, createLlmUsageRule, createMaxStepDurationRule, createObservedOutcomeRule, createRequireCompletedRule, createRetrievalRule, createRunDepthRule, createRunDurationRule, createRunEventCountRule, createRunStatusRule, createSafetyOversizedAttributeRule, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createStallDetectionRule, createStructureCycleRule, createStructureIncompleteRule, createStructureOrphanRule, createStructureParallelWidthRule, createStructureRelationshipRule, createToolFailureRule, createToolOrderingRule, createToolUsageRule, defineTraceContract, evaluateTraceContract, evaluateTraceContractRead, projectLogicalEvents, resolveCanonicalToolName, runTraceChecks, summarizeSemanticParity } from './chunk-DIZPIPY2.mjs';
 import './chunk-VFO76UH3.mjs';
 import './chunk-ULCGIRTC.mjs';
 import './chunk-VU6O5QAH.mjs';

package/packages/core/dist/{chunk-UFP54T7F.mjs → chunk-DIZPIPY2.mjs}

@@ -395,8 +395,11 @@ function buildTraceFacts(input) {
 }
 
 // packages/core/src/safety/sensitive-key.ts
+function keyHasExplicitSeparator(value) {
+  return /[_\-.]/.test(value);
+}
 function normalizeSensitiveKey(value) {
-  return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
+  return value.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
 }
 var NON_CREDENTIAL_TOKEN_CONFIG_KEYS = new Set(
   [
@@ -448,6 +451,7 @@ function isCredentialSensitiveKey(key, sensitiveKeys = DEFAULT_CREDENTIAL_SENSIT
   const normalized = normalizeSensitiveKey(key);
   if (!normalized) return false;
   if (NON_CREDENTIAL_TOKEN_CONFIG_KEYS.has(normalized)) return false;
+  const allowPrefixCompound = keyHasExplicitSeparator(key);
   for (const sensitive of sensitiveKeys) {
     const s = normalizeSensitiveKey(sensitive);
     if (!s) continue;
@@ -456,7 +460,8 @@ function isCredentialSensitiveKey(key, sensitiveKeys = DEFAULT_CREDENTIAL_SENSIT
       continue;
     }
     if (normalized === s) return true;
-    if (normalized.endsWith(`_${s}`) || normalized.startsWith(`${s}_`)) return true;
+    if (normalized.endsWith(`_${s}`)) return true;
+    if (allowPrefixCompound && normalized.startsWith(`${s}_`)) return true;
   }
   return false;
 }
@@ -554,10 +559,11 @@ function emptySummary() {
     passed: 0,
     failed: 0,
     warnings: 0,
-    errors: 0
+    errors: 0,
+    rulesEvaluated: 0
   };
 }
-function errorResult(input, diagnostics, selectedRun) {
+function errorResult(input, diagnostics, selectedRun, ruleExecutions = []) {
   return {
     ok: false,
     status: "error",
@@ -565,10 +571,12 @@ function errorResult(input, diagnostics, selectedRun) {
     ...selectedRun ? { runId: selectedRun.runId } : {},
     summary: {
       ...emptySummary(),
-      errors: diagnostics.filter((item) => item.severity === "error").length
+      errors: diagnostics.filter((item) => item.severity === "error").length,
+      rulesEvaluated: ruleExecutions.length
     },
     findings: [],
-    diagnostics: [...diagnostics]
+    diagnostics: [...diagnostics],
+    ruleExecutions: [...ruleExecutions]
   };
 }
 function flattenNodes(nodes) {
@@ -724,7 +732,7 @@ function normalizeFinding(rule, finding) {
     ...finding.action !== void 0 ? { action: finding.action } : {}
   };
 }
-function summarize(findings, diagnostics) {
+function summarize(findings, diagnostics, rulesEvaluated) {
   return {
     passed: findings.filter((finding) => finding.status === "pass").length,
     failed: findings.filter(
@@ -733,9 +741,21 @@ function summarize(findings, diagnostics) {
     warnings: findings.filter(
       (finding) => finding.status === "warning" || finding.severity === "warning"
     ).length,
-    errors: diagnostics.filter((item) => item.severity === "error").length
+    errors: diagnostics.filter((item) => item.severity === "error").length,
+    rulesEvaluated
   };
 }
+function classifyRuleExecution(findings, threw) {
+  if (findings.some((finding) => finding.status === "fail" && finding.severity === "error")) {
+    return "fail";
+  }
+  if (findings.some(
+    (finding) => finding.status === "warning" || finding.severity === "warning"
+  )) {
+    return "warning";
+  }
+  return "pass";
+}
 function stringAttr(event, keys) {
   for (const key of keys) {
     const value = event.attributes?.[key];
@@ -832,6 +852,9 @@ function finishedEvents(context, kind) {
     (event) => (kind === void 0 || event.kind === kind) && event.status !== "running"
   );
 }
+function toolInvocationEvents(context) {
+  return semanticEvents(context).filter((event) => event.kind === "TOOL");
+}
 function firstIndexByName(events) {
   const index = /* @__PURE__ */ new Map();
   for (const [position, event] of events.entries()) {
@@ -1279,7 +1302,7 @@ function createToolUsageRule(options) {
     category: "tool",
     defaultSeverity: "error",
     evaluate(context) {
-      const tools = finishedEvents(context, "TOOL");
+      const tools = toolInvocationEvents(context);
       const names = tools.map(toolName);
       const nameSet = new Set(names);
       const findings = [];
@@ -1320,8 +1343,9 @@ function createToolUsageRule(options) {
   };
 }
 function createToolOrderingRule(options) {
+  const ruleId = options.id ?? "tool.order";
   return {
-    id: "tool.order",
+    id: ruleId,
     category: "tool",
     defaultSeverity: "error",
     evaluate(context) {
@@ -1329,18 +1353,42 @@ function createToolOrderingRule(options) {
       const index = firstIndexByName(tools);
       const beforeIndex = index.get(options.before);
       const afterIndex = index.get(options.after);
-      if (beforeIndex === void 0 || afterIndex === void 0 || beforeIndex < afterIndex) {
+      if (beforeIndex === void 0 || afterIndex === void 0) {
         return [];
       }
-      return [
-        failFinding(
-          "tool.order",
-          `Tool ${options.before} must appear before ${options.after}.`,
-          [eventEvidence(tools[beforeIndex]), eventEvidence(tools[afterIndex])],
-          { before: options.before, after: options.after },
-          tools.map(toolName)
-        )
-      ];
+      if (beforeIndex >= afterIndex) {
+        return [
+          failFinding(
+            ruleId,
+            `Tool ${options.before} must appear before ${options.after}.`,
+            [eventEvidence(tools[beforeIndex]), eventEvidence(tools[afterIndex])],
+            { before: options.before, after: options.after },
+            tools.map(toolName)
+          )
+        ];
+      }
+      const beforeEvent = tools[beforeIndex];
+      const afterEvent = tools[afterIndex];
+      const beforeEnd = eventEndMs(beforeEvent);
+      const afterStart = eventStartMs(afterEvent);
+      if (beforeEnd !== void 0 && afterStart !== void 0 && beforeEnd > afterStart) {
+        return [
+          {
+            ruleId,
+            severity: "warning",
+            status: "warning",
+            message: `Tool order ${options.before} before ${options.after} satisfied start/encounter order, but intervals overlap so causal completion before the next tool was not established.`,
+            expected: { before: options.before, after: options.after, mode: "first-occurrence" },
+            actual: {
+              code: "tool.order.overlap",
+              beforeEndedAt: beforeEvent.endedAt,
+              afterStartedAt: afterEvent.startedAt ?? afterEvent.timestamp
+            },
+            evidence: [eventEvidence(beforeEvent), eventEvidence(afterEvent)]
+          }
+        ];
+      }
+      return [];
     }
   };
 }
@@ -2137,12 +2185,24 @@ function createBaselineRegressionRule(options) {
 }
 function createObservedOutcomeRule(options = {}) {
   const failOn = options.failOn ?? ["failed"];
+  const requireAny = options.requireAny === true;
   return {
     id: "outcome.status",
     category: "run",
     defaultSeverity: "error",
     evaluate(context) {
       const outcomes = extractOutcomesFromPersistedEvents(context.events);
+      if (requireAny && outcomes.length === 0) {
+        return [
+          failFinding(
+            "outcome.status",
+            "Expected at least one observed outcome.",
+            runEvidence(context.selectedRun),
+            { requireAny: true, expected: "at least one observed outcome" },
+            { code: "outcome.missing", actual: 0 }
+          )
+        ];
+      }
       const matching = outcomesMatchingStatus(outcomes, failOn);
       if (matching.length === 0) return [];
       return [
@@ -2178,6 +2238,18 @@ function runTraceChecks(input, options = {}) {
   if (rules.diagnostics.length > 0) {
     return errorResult(input, rules.diagnostics, selected.run);
   }
+  if (rules.rules.length === 0) {
+    return errorResult(
+      input,
+      [
+        diagnostic(
+          "AI_CHECK_NO_RULES_EVALUATED",
+          "No trace check rules were evaluated. Configure at least one rule, contract, or CLI check option."
+        )
+      ],
+      selected.run
+    );
+  }
   const facts = buildFacts(input, selected.run);
   const context = {
     ...facts,
@@ -2186,22 +2258,38 @@ function runTraceChecks(input, options = {}) {
   };
   const diagnostics = [];
   const findings = [];
+  const ruleExecutions = [];
   for (const rule of rules.rules) {
     try {
-      findings.push(...rule.evaluate(context).map((finding) => normalizeFinding(rule, finding)));
+      const ruleFindings = rule.evaluate(context).map((finding) => normalizeFinding(rule, finding));
+      findings.push(...ruleFindings);
+      ruleExecutions.push({
+        ruleId: rule.id,
+        category: rule.category,
+        status: classifyRuleExecution(ruleFindings, false),
+        findingCount: ruleFindings.length,
+        ...selected.run ? { runId: selected.run.runId } : {}
+      });
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       diagnostics.push(
         diagnostic("AI_CHECK_INTERNAL_ERROR", `Rule ${rule.id} failed: ${message}`, rule.id)
       );
+      ruleExecutions.push({
+        ruleId: rule.id,
+        category: rule.category,
+        status: "error",
+        findingCount: 0,
+        ...selected.run ? { runId: selected.run.runId } : {}
+      });
     }
   }
   if (diagnostics.length > 0) {
-    return errorResult(input, diagnostics, selected.run);
+    return errorResult(input, diagnostics, selected.run, ruleExecutions);
   }
   const eventById = new Map(input.read.events.map((event) => [event.eventId, event]));
   const sortedFindings = findings.sort(compareFindings(eventById));
-  const summary = summarize(sortedFindings, diagnostics);
+  const summary = summarize(sortedFindings, diagnostics, ruleExecutions.length);
   const status = summary.failed > 0 ? "fail" : "pass";
   return {
     ok: status === "pass",
@@ -2210,7 +2298,8 @@ function runTraceChecks(input, options = {}) {
     ...selected.run ? { runId: selected.run.runId } : {},
     summary,
     findings: sortedFindings,
-    diagnostics
+    diagnostics,
+    ruleExecutions
   };
 }
 
@@ -2305,9 +2394,13 @@ function contractToRules(contract) {
     rules.push(createStructureIncompleteRule({ requireEndedAtForStarted: true }));
   }
   if (contract.tools) {
+    const order = contract.tools.requiredOrder ?? [];
     const required = [
-      ...contract.tools.required ?? [],
-      ...contract.tools.requiredTools ?? []
+      .../* @__PURE__ */ new Set([
+        ...contract.tools.required ?? [],
+        ...contract.tools.requiredTools ?? [],
+        ...order
+      ])
     ];
     const forbidden = [
       ...contract.tools.forbidden ?? [],
@@ -2321,9 +2414,14 @@ function contractToRules(contract) {
         ...contract.tools.maxCalls !== void 0 ? { maxCount: contract.tools.maxCalls } : {}
       })
     );
-    const order = contract.tools.requiredOrder ?? [];
     for (let i = 0; i < order.length - 1; i += 1) {
-      rules.push(createToolOrderingRule({ before: order[i], after: order[i + 1] }));
+      rules.push(
+        createToolOrderingRule({
+          before: order[i],
+          after: order[i + 1],
+          id: `contract.tool.order.${i}`
+        })
+      );
     }
   }
   if (contract.llm) {
@@ -2391,5 +2489,5 @@ function evaluateTraceContractRead(read, contract, options = {}) {
 }
 
 export { buildTraceFacts, createBaselineRegressionRule, createDecisionRule, createGuardrailRule, createLlmUsageRule, createMaxStepDurationRule, createObservedOutcomeRule, createRequireCompletedRule, createRetrievalRule, createRunDepthRule, createRunDurationRule, createRunEventCountRule, createRunStatusRule, createSafetyOversizedAttributeRule, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createStallDetectionRule, createStructureCycleRule, createStructureIncompleteRule, createStructureOrphanRule, createStructureParallelWidthRule, createStructureRelationshipRule, createToolFailureRule, createToolOrderingRule, createToolUsageRule, defineTraceContract, evaluateTraceContract, evaluateTraceContractRead, projectLogicalEvents, resolveCanonicalToolName, runTraceChecks, summarizeSemanticParity };
-//# sourceMappingURL=chunk-UFP54T7F.mjs.map
-//# sourceMappingURL=chunk-UFP54T7F.mjs.map
+//# sourceMappingURL=chunk-DIZPIPY2.mjs.map
+//# sourceMappingURL=chunk-DIZPIPY2.mjs.map