agent-inspect 6.27.0 → 6.29.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 6.29.0
+
+### Minor Changes
+
+- 0e5732e: Provider usage fidelity: preserve cache-read (`cached`), cache-write (`cacheWrite`), and reasoning token fields across core normalization and adapters. Add isolated AI SDK peer matrix (`ai@^6` required; AI SDK 7 soft-blocked pending telemetry API migration). No pricing engine; root Node remains `>=20`.
+
+## 6.28.0
+
+### Minor Changes
+
+- 228b4df: Package resolved TraceContract / check-preset snapshots into Evidence v2 (`contract.resolved.json`) with digest binding to check results, honest partial/unavailable status for custom rules, and verify support — no signing or trusted-time claims (schema stays 1.0).
+
 ## 6.27.0
 
 ### Minor Changes

package/README.md

@@ -212,7 +212,7 @@ The root package is enough for custom capture, the CLI, checks, and Evidence wor
 
 ## Status and documentation
 
-**Current published baseline:** **6.27.0** · persisted schema `1.0` · Node.js `>=20` · MIT.
+**Current published baseline:** **6.29.0** · persisted schema `1.0` · Node.js `>=20` · MIT.
 
 Legacy v0.1 and v0.2 traces remain readable. Check the npm badge and [changelog](CHANGELOG.md) for the current published version.
 

package/docs/BUNDLES.md

@@ -37,7 +37,8 @@ trace.html                 # offline HTML (index for multi-run)
 trace.jsonl                # redacted JSONL copy
 summary.md                 # human overview
 metadata.json              # legacy manifest (version, profile, safe status)
-check-results.json         # verify-safe results per run
+check-results.json         # verify-safe / check results per run (may include contract digest binding)
+contract.resolved.json     # optional resolved TraceContract / preset snapshot (6.28+)
 redaction-report.json      # detector summary (no secret values)
 eval-results.json          # placeholder unless eval artifacts are added later
 performance-summary.json   # placeholder unless perf artifacts are added later
@@ -73,6 +74,8 @@ Profiles:
 
 Bundles are **derived copies**, not compliance certification. Always review `evidence.html` / `summary.md`, `check-results.json`, and run `bundle verify` before attaching to tickets or PRs.
 
+When `contract.resolved.json` is present (6.28+), reviewers can inspect the resolved TraceContract or check preset that was evaluated and confirm digests via `bundle verify`. Custom/programmatic rules are marked `partial` and are not fully replayable from JSON. Contract binding is **not** a signature or trusted-time claim — see [EVIDENCE-FORMAT.md](./EVIDENCE-FORMAT.md#contract-binding-628).
+
 See also [SAFE-TRACE-SHARING.md](./SAFE-TRACE-SHARING.md) and [CLI.md §6.24](./CLI.md#624-bundle).
 
 ## Review workflow

package/docs/LIMITATIONS.md

@@ -81,7 +81,7 @@ This document states what AgentInspect **does not** provide today. It complement
 
 ## Economics
 
-- **No cost engine**: no pricing tables, invoice-grade usage, or provider billing reconciliation.
+- **No cost engine**: no pricing tables, invoice-grade usage, or provider billing reconciliation. Usage fidelity may preserve cache-read (`cached`), cache-write (`cacheWrite`), and reasoning token counts when providers report them; those fields are observational only.
 - **Token usage is supplied metadata only**: AgentInspect may display `input`, `output`, `total`, and `cached` counts when callers/adapters provide them; core does not count tokens or infer provider billing.
 
 ## Local observability commands (v1.4.0)

package/docs/SAFE-TRACE-SHARING.md

@@ -34,6 +34,8 @@ Manual traces redact common sensitive keys **before disk** by default. Pass `red
 
 When a maintainer or support responder needs reproducible evidence, follow the [safe support reproduction workflow](./SUPPORT-REPRODUCTION.md) to create and review a minimized Evidence bundle. Do not attach a raw trace directory.
 
+For reviewer-reproducible trajectory checks (6.28+), prefer Evidence that includes `contract.resolved.json` and a matching `contract` digest in `evidence.json` / `check-results.json`. That lets a reviewer see the resolved TraceContract or check preset that was evaluated. Custom/programmatic rules remain `partial` — JSON cannot replay executable rule functions. Contract binding verifies packaged digests only; it does **not** prove producer identity, trusted time, or that the artifact is safe to publish. See [EVIDENCE-FORMAT.md](./EVIDENCE-FORMAT.md#contract-binding-628).
+
 - Use **`--redaction-profile share`** for PR/issue attachments; use **`strict`** when sharing outside your team.
 - **Review** the exported file — profiles do not detect all sensitive data.
 - Treat traces written with `redact: false` as sensitive. Review every event before sharing them outside your team.

package/docs/SCHEMA.md

@@ -264,7 +264,7 @@ Canonical samples: `fixtures/traces-v0.2/*.jsonl` (validated by `pnpm fixtures:c
 | `attributes` | no | Shallow metadata bag (redaction-ready) |
 | `inputSummary` / `outputSummary` | no | Truncated previews when explicitly captured |
 | `error` | no | `{ name?, message, code? }` when `status: "error"` |
-| `tokenUsage` | no | `{ input?, output?, total?, cached? }` when supplied/known |
+| `tokenUsage` | no | `{ input?, output?, total?, cached?, cacheWrite?, reasoning? }` when supplied/known. `cached` is cache-read; `cacheWrite` / `reasoning` are informational and are never added to `total`. No pricing fields. |
 | `trace` | no | Optional `{ traceId?, spanId?, parentSpanId? }` for future OTel alignment |
 
 Programmatic helpers: see [API.md](./API.md) §13 (experimental persisted-event foundation).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-inspect",
-  "version": "6.27.0",
+  "version": "6.29.0",
   "license": "MIT",
   "type": "module",
   "description": "Local evidence debugger and trajectory-test toolkit for TypeScript AI agents — execution trees, TraceContract checks, Evidence v2, and read-only MCP",
@@ -250,6 +250,7 @@
     "demo:generate": "node scripts/demo-generate.mjs",
     "demo:verify": "node scripts/demo-verify.mjs",
     "compat:smoke": "node scripts/compat-smoke.mjs",
+    "compat:ai-sdk-matrix": "node scripts/ai-sdk-peer-matrix.mjs",
     "fixtures:check": "node scripts/validate-fixtures.mjs",
     "recipes:check": "node scripts/validate-recipes.mjs",
     "perf:baseline": "node scripts/performance-baseline.mjs",