agent-inspect 6.31.10 → 6.31.11

package/packages/cli/dist/{chunk-JCKC4ZRV.mjs → chunk-MQYHJL3W.mjs}

@@ -2483,7 +2483,7 @@ function stepMixLine(summary) {
   if (summary.logicSteps > 0) parts.push(`${summary.logicSteps} logic`);
   return parts.length > 0 ? parts.join(", ") : "none";
 }
-function outcomeLine(summary) {
+function executionLine(summary) {
   if (summary.status === "success") {
     return summary.errorSteps > 0 ? "Completed with step errors recorded." : "Completed successfully.";
   }
@@ -2501,7 +2501,7 @@ function outcomeLine(summary) {
   if (summary.status === "running") {
     return "Run is still in progress (no run_completed).";
   }
-  return "Outcome unknown \u2014 inspect events may be incomplete.";
+  return "Execution status unknown \u2014 inspect events may be incomplete.";
 }
 function buildRunWhatSummary(events) {
   const base = buildRunSummary(events);
@@ -2592,7 +2592,7 @@ function renderRunWhat(summary, options = {}) {
       lines.push(`Correlation: ${parts.join(", ")}`);
     }
   }
-  lines.push(`Outcome: ${outcomeLine(summary)}`);
+  lines.push(`Execution: ${executionLine(summary)}`);
   if (summary.longestStep && summary.totalSteps > 0) {
     lines.push(
       `Slowest: ${summary.longestStep.name} (${formatDuration2(summary.longestStep.durationMs)}, ${summary.longestStep.type})`
@@ -2604,167 +2604,563 @@ function renderRunWhat(summary, options = {}) {
   return lines.join("\n");
 }
 
-// packages/core/src/explain.ts
-function toDisplayStatus(status) {
-  if (status === "ok") return "success";
-  if (status === "error") return "error";
-  if (status === "running") return "running";
-  return "unknown";
-}
-function flatten(nodes, out = []) {
-  for (const node of nodes) {
-    out.push({ node, index: out.length + 1 });
-    flatten(node.children, out);
+// packages/core/src/diagnostics/programmatic.ts
+var PROGRAMMATIC_DIAGNOSTIC_SPECS = Object.freeze({
+  AI_TRACE_INPUT_INVALID: {
+    code: "AI_TRACE_INPUT_INVALID",
+    summary: 'Expected { type: "file", path }, { type: "directory", path }, { type: "string", content }, { type: "buffer", content }, or { type: "stdin" }.',
+    remediation: "For a file path, use openTraceFile(path).",
+    relatedCodes: ["invalid_input"]
+  },
+  AI_TRACE_FORMAT_UNSUPPORTED: {
+    code: "AI_TRACE_FORMAT_UNSUPPORTED",
+    summary: "No trace reader could detect the input format.",
+    remediation: "Pass an AgentInspect JSONL file via openTraceFile, or set options.format to a registered reader.",
+    relatedCodes: ["unsupported_format"]
+  },
+  AI_TRACE_FORMAT_AMBIGUOUS: {
+    code: "AI_TRACE_FORMAT_AMBIGUOUS",
+    summary: "Multiple trace readers matched the input with equal confidence.",
+    remediation: "Set options.format explicitly to disambiguate the reader.",
+    relatedCodes: ["ambiguous_format"]
+  },
+  AI_TRACE_FACTS_INPUT_NOT_NORMALIZED: {
+    code: "AI_TRACE_FACTS_INPUT_NOT_NORMALIZED",
+    summary: "TraceFacts requires TraceReadResult or PersistedInspectEvent[].",
+    remediation: "Use openTraceFile() to normalize a JSONL trace first."
+  },
+  AI_TRACE_CONTRACT_RUN_SELECTION_REQUIRED: {
+    code: "AI_TRACE_CONTRACT_RUN_SELECTION_REQUIRED",
+    summary: "Multiple runs are available; select a run before executing checks.",
+    remediation: "Pass options.runId or TraceCheckInput.selectedRun.",
+    relatedCodes: ["AI_CHECK_RUN_SELECTION_REQUIRED"]
+  },
+  AI_TRACE_RELATIONSHIP_SELF_PARENT: {
+    code: "AI_TRACE_RELATIONSHIP_SELF_PARENT",
+    summary: "A parentId equals its own event/step id.",
+    remediation: "Reject at capture (AI_LANGGRAPH_SELF_PARENT_REJECTED) or drop via logical projection; do not invent replacement parents.",
+    relatedCodes: [
+      "AI_LANGGRAPH_SELF_PARENT_REJECTED",
+      "AI_LOGICAL_SELF_PARENT_REMOVED"
+    ]
+  },
+  AI_TRACE_RELATIONSHIP_CYCLE: {
+    code: "AI_TRACE_RELATIONSHIP_CYCLE",
+    summary: "Trace contains a parentId cycle.",
+    remediation: "Use visibility-first tree linking for legacy fixtures; prefer acyclic capture for new adapter output.",
+    relatedCodes: ["structure.cycle"]
+  },
+  AI_TRACE_CONTRACT_INPUT_INVALID: {
+    code: "AI_TRACE_CONTRACT_INPUT_INVALID",
+    summary: "evaluateTraceContract expects ({ read }, contract) or use evaluateTraceContractRead(read, contract).",
+    remediation: "Pass TraceCheckInput as the first argument: evaluateTraceContract({ read }, contract).",
+    relatedCodes: ["AI_CHECK_INVALID_ARGUMENTS"]
+  },
+  AI_INSPECT_RUN_UNSUPPORTED_OPTION: {
+    code: "AI_INSPECT_RUN_UNSUPPORTED_OPTION",
+    summary: 'inspectRun does not accept a "writer" option.',
+    remediation: "Use createInspector({ writer }) then inspector.run(...). inspectRun persists via the global JSONL path (schema 0.1)."
   }
-  return out;
-}
-function redactValue(redactor, key, value) {
-  return redactor.redactValue(key, value);
-}
-function fact(id, label, value, redactor) {
-  return {
-    id,
-    label,
-    value: redactValue(redactor, id.split(".").at(-1) ?? id, value),
-    source: "trace",
-    confidence: "observed"
-  };
-}
-function topKinds(run) {
-  return Object.entries(run.metadata.kinds).filter(([, count]) => count > 0).sort((a, b) => {
-    if (b[1] !== a[1]) return b[1] - a[1];
-    return a[0].localeCompare(b[0]);
-  }).slice(0, 5).map(([kind, count]) => `${kind}:${count}`);
+});
+function formatProgrammaticDiagnostic(code, detail) {
+  const spec = PROGRAMMATIC_DIAGNOSTIC_SPECS[code];
+  const summary = detail?.trim() ? detail.trim() : spec.summary;
+  return `${code}: ${summary} Remediation: ${spec.remediation}`;
 }
-function countErrorNodes(nodes) {
-  return nodes.filter((entry) => entry.node.event.status === "error").length;
+
+// packages/core/src/checks/logical-events.ts
+function isRecord6(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function slowestNode(nodes) {
-  return nodes.filter(
-    (entry) => entry.node.event.durationMs !== void 0 && // The RUN boundary spans the whole run, so its duration always dominates
-    // and shadows every real step. Rank actual work nodes only, matching the
-    // stats slowest-step ranking, which never counts the run envelope.
-    entry.node.event.kind !== "RUN"
-  ).sort((a, b) => {
-    const delta = (b.node.event.durationMs ?? 0) - (a.node.event.durationMs ?? 0);
-    return delta !== 0 ? delta : a.index - b.index;
-  })[0];
+function legacyEvent(event) {
+  const value = event.attributes?.legacyEvent;
+  return typeof value === "string" ? value : void 0;
 }
-function attributeFacts(nodes, redactor) {
-  const facts = [];
-  for (const entry of nodes) {
-    const attrs = entry.node.event.attributes;
-    if (attrs === void 0) continue;
-    for (const key of Object.keys(attrs).sort()) {
-      facts.push({
-        id: `node.${entry.index}.attributes.${key}`,
-        label: `${entry.node.event.name} attribute ${key}`,
-        value: redactValue(redactor, key, attrs[key]),
-        source: "trace",
-        confidence: "observed"
-      });
-      if (facts.length >= 8) return facts;
-    }
-  }
-  return facts;
+function stepIdOf(event) {
+  const value = event.attributes?.stepId;
+  if (typeof value === "string" && value.trim() !== "") return value;
+  return void 0;
 }
-function buildFacts(run, redactor) {
-  const nodes = flatten(run.children);
-  const facts = [
-    fact("run.id", "Run id", run.runId, redactor),
-    fact("run.name", "Run name", run.name ?? run.runId, redactor),
-    fact("run.status", "Run status", toDisplayStatus(run.status), redactor),
-    fact("run.totalEvents", "Total events", run.metadata.totalEvents, redactor),
-    fact("run.stepCount", "Top-level step count", run.children.length, redactor),
-    fact("run.nodeCount", "Total node count", nodes.length, redactor),
-    fact("run.errorNodeCount", "Error node count", countErrorNodes(nodes), redactor),
-    fact("run.kinds", "Observed kind mix", topKinds(run), redactor)
-  ];
-  if (run.durationMs !== void 0) {
-    facts.push(fact("run.durationMs", "Run duration milliseconds", run.durationMs, redactor));
-  }
-  const slowest = slowestNode(nodes);
-  if (slowest !== void 0) {
-    facts.push(
-      fact("run.slowestNode", "Slowest observed node", {
-        name: slowest.node.event.name,
-        kind: slowest.node.event.kind,
-        durationMs: slowest.node.event.durationMs
-      }, redactor)
-    );
-  }
-  facts.push(...attributeFacts(nodes, redactor));
-  return facts;
+function cloneEvent(event) {
+  return {
+    ...event,
+    ...event.attributes !== void 0 ? { attributes: { ...event.attributes } } : {},
+    ...event.error !== void 0 ? { error: { ...event.error } } : {},
+    ...event.tokenUsage !== void 0 ? { tokenUsage: { ...event.tokenUsage } } : {},
+    ...event.source !== void 0 ? { source: { ...event.source } } : {}
+  };
 }
-function buildInferences(run, facts) {
-  const inferences = [];
-  const errorFact = facts.find((item) => item.id === "run.errorNodeCount");
-  const kindFact = facts.find((item) => item.id === "run.kinds");
-  const durationFact = facts.find((item) => item.id === "run.durationMs");
-  const errorNodeCount = typeof errorFact?.value === "number" ? errorFact.value : 0;
-  if (run.status === "error" || errorNodeCount > 0) {
-    inferences.push({
-      id: "outcome.error",
-      label: "Outcome",
-      text: "The run recorded an error status or at least one error node.",
-      evidence: ["run.status", "run.errorNodeCount"],
-      confidence: "deterministic"
-    });
-  } else if (run.status === "ok") {
-    inferences.push({
-      id: "outcome.success",
-      label: "Outcome",
-      text: "The run completed without observed error nodes.",
-      evidence: ["run.status", "run.errorNodeCount"],
-      confidence: "deterministic"
-    });
-  }
-  if (kindFact !== void 0) {
-    inferences.push({
-      id: "shape.kind-mix",
-      label: "Trace shape",
-      text: "The explanation is based on the observed event kind mix, not generated content.",
-      evidence: [kindFact.id],
-      confidence: "deterministic"
-    });
-  }
-  if (durationFact !== void 0) {
-    inferences.push({
-      id: "timing.duration",
-      label: "Timing",
-      text: "Timing claims are limited to persisted duration fields in the trace.",
-      evidence: [durationFact.id],
-      confidence: "deterministic"
-    });
+function mergeAttributes(start, complete) {
+  const merged = {
+    ...isRecord6(complete.attributes) ? complete.attributes : {},
+    ...isRecord6(start.attributes) ? start.attributes : {}
+  };
+  merged.legacyEvent = start.attributes?.legacyEvent ?? complete.attributes?.legacyEvent;
+  merged.legacyCompleteEvent = complete.attributes?.legacyEvent;
+  if (complete.attributes?.errorStack !== void 0) {
+    merged.errorStack = complete.attributes.errorStack;
   }
-  return inferences;
+  return Object.keys(merged).length > 0 ? merged : void 0;
 }
-function buildLocalExplanation(run, options = {}) {
-  const redactionProfile = options.redactionProfile ?? "local";
-  const resolved = resolveRedactionProfile(redactionProfile);
-  const redactor = new Redactor({ extraKeys: resolved.extraKeys });
-  const mode = options.mode ?? "local";
-  const facts = buildFacts(run, redactor);
+function pairStartComplete(start, complete) {
+  const attributes = mergeAttributes(start, complete);
+  const paired = {
+    ...cloneEvent(start),
+    status: complete.status,
+    timestamp: complete.timestamp ?? start.timestamp,
+    ...complete.endedAt !== void 0 ? { endedAt: complete.endedAt } : {},
+    ...complete.durationMs !== void 0 ? { durationMs: complete.durationMs } : {},
+    ...complete.error !== void 0 ? { error: { ...complete.error } } : {},
+    ...complete.tokenUsage !== void 0 && start.tokenUsage === void 0 ? { tokenUsage: { ...complete.tokenUsage } } : {},
+    ...attributes !== void 0 ? { attributes } : {}
+  };
   return {
-    mode,
-    runId: String(redactValue(redactor, "runId", run.runId)),
-    ...run.name !== void 0 ? { name: String(redactValue(redactor, "name", run.name)) } : {},
-    ...run.status !== void 0 ? { status: toDisplayStatus(run.status) } : {},
-    redactionProfile,
-    facts,
-    inferences: mode === "dry-run" ? [] : buildInferences(run, facts),
-    notes: [
-      "Generated locally without provider or network calls.",
-      "Facts are observed from normalized trace data; inferences are deterministic labels."
-    ]
+    ...paired,
+    sourceEventIds: Object.freeze([start.eventId, complete.eventId]),
+    projection: {
+      paired: true,
+      absorbedEventIds: Object.freeze([complete.eventId]),
+      parentNormalized: false,
+      ...start.parentId !== void 0 ? { originalParentId: start.parentId } : {}
+    }
   };
 }
-
-// packages/core/src/outcomes/types.ts
-var OBSERVED_OUTCOME_STATUSES = [
-  "passed",
-  "failed",
-  "unknown",
+function asLogical(event, extras) {
+  return {
+    ...cloneEvent(event),
+    sourceEventIds: Object.freeze([event.eventId]),
+    projection: {
+      paired: false,
+      absorbedEventIds: Object.freeze([]),
+      parentNormalized: extras?.parentNormalized === true,
+      ...{}
+    }
+  };
+}
+function projectLogicalEvents(events) {
+  const diagnostics = [];
+  const byRun = /* @__PURE__ */ new Map();
+  for (const event of events) {
+    const list = byRun.get(event.runId) ?? [];
+    list.push(event);
+    byRun.set(event.runId, list);
+  }
+  const absorbedIds = /* @__PURE__ */ new Set();
+  const logicalByRawId = /* @__PURE__ */ new Map();
+  const stepIdToLogicalId = /* @__PURE__ */ new Map();
+  const logical = [];
+  const orderedRuns = [...byRun.keys()].sort((a, b) => a.localeCompare(b));
+  for (const runId of orderedRuns) {
+    const runEvents = byRun.get(runId) ?? [];
+    const starts = [];
+    const completes = [];
+    const others = [];
+    for (const event of runEvents) {
+      const legacy = legacyEvent(event);
+      if (legacy === "step_started" || legacy === "run_started" && event.status === "running") {
+        starts.push(event);
+      } else if (legacy === "step_completed" || legacy === "run_completed") {
+        completes.push(event);
+      } else {
+        others.push(event);
+      }
+    }
+    const usedCompletes = /* @__PURE__ */ new Set();
+    for (const start of starts) {
+      const stepId = stepIdOf(start);
+      let match;
+      if (legacyEvent(start) === "run_started") {
+        const candidates = completes.filter(
+          (c) => !usedCompletes.has(c.eventId) && legacyEvent(c) === "run_completed"
+        );
+        if (candidates.length > 1) {
+          diagnostics.push({
+            code: "AI_LOGICAL_PAIR_AMBIGUOUS",
+            message: `Multiple run_completed rows for run ${runId}; using first by eventId.`,
+            eventIds: candidates.map((c) => c.eventId)
+          });
+          candidates.sort((a, b) => a.eventId.localeCompare(b.eventId));
+        }
+        match = candidates[0];
+      } else if (stepId) {
+        const candidates = completes.filter(
+          (c) => !usedCompletes.has(c.eventId) && legacyEvent(c) === "step_completed" && stepIdOf(c) === stepId
+        );
+        if (candidates.length > 1) {
+          diagnostics.push({
+            code: "AI_LOGICAL_PAIR_AMBIGUOUS",
+            message: `Multiple step_completed rows for stepId ${stepId}; using first by eventId.`,
+            eventIds: candidates.map((c) => c.eventId)
+          });
+          candidates.sort((a, b) => a.eventId.localeCompare(b.eventId));
+        }
+        match = candidates[0];
+      }
+      if (match) {
+        usedCompletes.add(match.eventId);
+        absorbedIds.add(match.eventId);
+        const paired = pairStartComplete(start, match);
+        logical.push(paired);
+        logicalByRawId.set(start.eventId, paired);
+        logicalByRawId.set(match.eventId, paired);
+        if (stepId) stepIdToLogicalId.set(`${runId}:${stepId}`, paired.eventId);
+      } else {
+        diagnostics.push({
+          code: "AI_LOGICAL_PAIR_UNMATCHED_START",
+          message: `No matching complete for start ${start.eventId}.`,
+          eventIds: [start.eventId]
+        });
+        const alone = asLogical(start);
+        logical.push(alone);
+        logicalByRawId.set(start.eventId, alone);
+        if (stepId) stepIdToLogicalId.set(`${runId}:${stepId}`, alone.eventId);
+      }
+    }
+    for (const complete of completes) {
+      if (usedCompletes.has(complete.eventId)) continue;
+      diagnostics.push({
+        code: "AI_LOGICAL_PAIR_UNMATCHED_COMPLETE",
+        message: `No matching start for complete ${complete.eventId}.`,
+        eventIds: [complete.eventId]
+      });
+      const alone = asLogical(complete);
+      logical.push(alone);
+      logicalByRawId.set(complete.eventId, alone);
+      const stepId = stepIdOf(complete);
+      if (stepId && !stepIdToLogicalId.has(`${runId}:${stepId}`)) {
+        stepIdToLogicalId.set(`${runId}:${stepId}`, alone.eventId);
+      }
+    }
+    for (const event of others) {
+      const alone = asLogical(event);
+      logical.push(alone);
+      logicalByRawId.set(event.eventId, alone);
+      const stepId = stepIdOf(event);
+      if (stepId && !stepIdToLogicalId.has(`${runId}:${stepId}`)) {
+        stepIdToLogicalId.set(`${runId}:${stepId}`, alone.eventId);
+      }
+    }
+  }
+  const logicalById = new Map(logical.map((e) => [e.eventId, e]));
+  const normalized = [];
+  for (const event of logical) {
+    const originalParentId = event.parentId;
+    if (!originalParentId) {
+      normalized.push(event);
+      continue;
+    }
+    let nextParent = originalParentId;
+    let remapped = false;
+    const viaAbsorbed = logicalByRawId.get(originalParentId);
+    if (viaAbsorbed && viaAbsorbed.eventId !== originalParentId) {
+      nextParent = viaAbsorbed.eventId;
+      remapped = true;
+    } else if (!logicalById.has(originalParentId)) {
+      const viaStep = stepIdToLogicalId.get(`${event.runId}:${originalParentId}`);
+      if (viaStep) {
+        nextParent = viaStep;
+        remapped = true;
+      }
+    }
+    if (!remapped) {
+      if (originalParentId === event.eventId) {
+        diagnostics.push({
+          code: "AI_LOGICAL_SELF_PARENT_REMOVED",
+          message: formatProgrammaticDiagnostic(
+            "AI_TRACE_RELATIONSHIP_SELF_PARENT",
+            `Removed self-parent edge on ${event.eventId}.`
+          ),
+          eventIds: [event.eventId]
+        });
+        const { parentId: _drop, ...rest } = event;
+        normalized.push({
+          ...rest,
+          projection: {
+            ...event.projection,
+            parentNormalized: true,
+            originalParentId
+          }
+        });
+        continue;
+      }
+      if (!logicalById.has(originalParentId) && !logicalByRawId.has(originalParentId)) {
+        const mapping = event.attributes?.parentMapping;
+        const unresolved = mapping === "unresolved" || event.attributes?.parentUnresolved === true || event.attributes?.unresolvedParent === true || // LangGraph/framework scaffolding sentinel labels are not event ids.
+        /^LangGraph$/i.test(originalParentId) || originalParentId.startsWith("unresolved:");
+        if (!unresolved) {
+          diagnostics.push({
+            code: "AI_LOGICAL_PARENT_UNRESOLVED",
+            message: `Parent ${originalParentId} unresolved for ${event.eventId}.`,
+            eventIds: [event.eventId]
+          });
+        }
+      }
+      normalized.push(event);
+      continue;
+    }
+    if (nextParent === event.eventId) {
+      diagnostics.push({
+        code: "AI_LOGICAL_SELF_PARENT_REMOVED",
+        message: formatProgrammaticDiagnostic(
+          "AI_TRACE_RELATIONSHIP_SELF_PARENT",
+          `Removed self-parent edge on ${event.eventId} (was ${originalParentId}).`
+        ),
+        eventIds: [event.eventId]
+      });
+      const { parentId: _drop, ...rest } = event;
+      normalized.push({
+        ...rest,
+        projection: {
+          ...event.projection,
+          parentNormalized: true,
+          originalParentId
+        }
+      });
+      continue;
+    }
+    diagnostics.push({
+      code: "AI_LOGICAL_PARENT_REMAPPED",
+      message: `Remapped parent ${originalParentId} \u2192 ${nextParent} for ${event.eventId}.`,
+      eventIds: [event.eventId]
+    });
+    normalized.push({
+      ...event,
+      parentId: nextParent,
+      projection: {
+        ...event.projection,
+        parentNormalized: true,
+        originalParentId
+      }
+    });
+  }
+  const rawIndex = new Map(events.map((e, i) => [e.eventId, i]));
+  normalized.sort((a, b) => {
+    const ai = rawIndex.get(a.sourceEventIds[0]) ?? 0;
+    const bi = rawIndex.get(b.sourceEventIds[0]) ?? 0;
+    return ai - bi || a.eventId.localeCompare(b.eventId);
+  });
+  return {
+    logicalEvents: Object.freeze(normalized),
+    diagnostics: Object.freeze(diagnostics)
+  };
+}
+function resolveCanonicalToolName(event) {
+  const attrs = event.attributes;
+  const direct = pickString(attrs, ["toolName", "tool"]);
+  if (direct) return direct;
+  const metadata = attrs?.metadata;
+  if (isRecord6(metadata)) {
+    const nested = pickString(metadata, ["toolName", "tool"]);
+    if (nested) return nested;
+  }
+  for (const prefix of ["tool:", "function:", "mcp-tools:"]) {
+    if (event.name.startsWith(prefix)) return event.name.slice(prefix.length);
+  }
+  return event.name;
+}
+function pickString(record, keys) {
+  if (!record) return void 0;
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === "string" && value.trim() !== "") return value.trim();
+  }
+  return void 0;
+}
+
+// packages/core/src/explain.ts
+function toDisplayStatus(status) {
+  if (status === "ok") return "success";
+  if (status === "error") return "error";
+  if (status === "running") return "running";
+  return "unknown";
+}
+function flatten(nodes, out = []) {
+  for (const node of nodes) {
+    out.push({ node, index: out.length + 1 });
+    flatten(node.children, out);
+  }
+  return out;
+}
+function redactValue(redactor, key, value) {
+  return redactor.redactValue(key, value);
+}
+function fact(id, label, value, redactor) {
+  return {
+    id,
+    label,
+    value: redactValue(redactor, id.split(".").at(-1) ?? id, value),
+    source: "trace",
+    confidence: "observed"
+  };
+}
+function topKinds(run) {
+  return Object.entries(run.metadata.kinds).filter(([, count]) => count > 0).sort((a, b) => {
+    if (b[1] !== a[1]) return b[1] - a[1];
+    return a[0].localeCompare(b[0]);
+  }).slice(0, 5).map(([kind, count]) => `${kind}:${count}`);
+}
+function countErrorNodes(nodes) {
+  return nodes.filter((entry) => entry.node.event.status === "error").length;
+}
+function slowestNode(nodes) {
+  return nodes.filter(
+    (entry) => entry.node.event.durationMs !== void 0 && // The RUN boundary spans the whole run, so its duration always dominates
+    // and shadows every real step. Rank actual work nodes only, matching the
+    // stats slowest-step ranking, which never counts the run envelope.
+    entry.node.event.kind !== "RUN"
+  ).sort((a, b) => {
+    const delta = (b.node.event.durationMs ?? 0) - (a.node.event.durationMs ?? 0);
+    return delta !== 0 ? delta : a.index - b.index;
+  })[0];
+}
+function attributeFacts(nodes, redactor) {
+  const facts = [];
+  for (const entry of nodes) {
+    const attrs = entry.node.event.attributes;
+    if (attrs === void 0) continue;
+    for (const key of Object.keys(attrs).sort()) {
+      facts.push({
+        id: `node.${entry.index}.attributes.${key}`,
+        label: `${entry.node.event.name} attribute ${key}`,
+        value: redactValue(redactor, key, attrs[key]),
+        source: "trace",
+        confidence: "observed"
+      });
+      if (facts.length >= 8) return facts;
+    }
+  }
+  return facts;
+}
+function buildFacts(run, redactor, events) {
+  const nodes = flatten(run.children);
+  const facts = [
+    fact("run.id", "Run id", run.runId, redactor),
+    fact("run.name", "Run name", run.name ?? run.runId, redactor),
+    fact("run.status", "Run status", toDisplayStatus(run.status), redactor),
+    fact("run.totalEvents", "Total events", run.metadata.totalEvents, redactor),
+    fact("run.stepCount", "Top-level step count", run.children.length, redactor),
+    fact("run.nodeCount", "Total node count", nodes.length, redactor),
+    fact("run.errorNodeCount", "Error node count", countErrorNodes(nodes), redactor),
+    fact("run.kinds", "Observed kind mix", topKinds(run), redactor)
+  ];
+  if (run.durationMs !== void 0) {
+    facts.push(fact("run.durationMs", "Run duration milliseconds", run.durationMs, redactor));
+  }
+  const slowest = slowestNode(nodes);
+  if (slowest !== void 0) {
+    facts.push(
+      fact("run.slowestNode", "Slowest observed node", {
+        name: slowest.node.event.name,
+        kind: slowest.node.event.kind,
+        durationMs: slowest.node.event.durationMs
+      }, redactor)
+    );
+  }
+  if (events !== void 0) {
+    const scoped = events.filter((event) => event.runId === run.runId);
+    const { logicalEvents: logical } = projectLogicalEvents(scoped);
+    const logicalSteps = logical.filter((event) => event.kind !== "RUN");
+    facts.push(
+      fact("run.rawEventCount", "Raw persisted event count", scoped.length, redactor),
+      fact(
+        "run.logicalStepCount",
+        "Logical lifecycle step count",
+        logicalSteps.length,
+        redactor
+      ),
+      fact(
+        "run.logicalEventCount",
+        "Logical lifecycle event count (including RUN)",
+        logical.length,
+        redactor
+      )
+    );
+    const slowestLogical = [...logicalSteps].filter((event) => typeof event.durationMs === "number").sort((a, b) => {
+      const delta = (b.durationMs ?? 0) - (a.durationMs ?? 0);
+      return delta !== 0 ? delta : a.eventId.localeCompare(b.eventId);
+    })[0];
+    if (slowestLogical !== void 0) {
+      facts.push(
+        fact("run.slowestLogicalStep", "Slowest logical lifecycle step", {
+          name: slowestLogical.name,
+          kind: slowestLogical.kind,
+          durationMs: slowestLogical.durationMs
+        }, redactor)
+      );
+    }
+  }
+  facts.push(...attributeFacts(nodes, redactor));
+  return facts;
+}
+function buildInferences(run, facts) {
+  const inferences = [];
+  const errorFact = facts.find((item) => item.id === "run.errorNodeCount");
+  const kindFact = facts.find((item) => item.id === "run.kinds");
+  const durationFact = facts.find((item) => item.id === "run.durationMs");
+  const errorNodeCount = typeof errorFact?.value === "number" ? errorFact.value : 0;
+  if (run.status === "error" || errorNodeCount > 0) {
+    inferences.push({
+      id: "outcome.error",
+      label: "Outcome",
+      text: "The run recorded an error status or at least one error node.",
+      evidence: ["run.status", "run.errorNodeCount"],
+      confidence: "deterministic"
+    });
+  } else if (run.status === "ok") {
+    inferences.push({
+      id: "outcome.success",
+      label: "Outcome",
+      text: "The run completed without observed error nodes.",
+      evidence: ["run.status", "run.errorNodeCount"],
+      confidence: "deterministic"
+    });
+  }
+  if (kindFact !== void 0) {
+    inferences.push({
+      id: "shape.kind-mix",
+      label: "Trace shape",
+      text: "The explanation is based on the observed event kind mix, not generated content.",
+      evidence: [kindFact.id],
+      confidence: "deterministic"
+    });
+  }
+  if (durationFact !== void 0) {
+    inferences.push({
+      id: "timing.duration",
+      label: "Timing",
+      text: "Timing claims are limited to persisted duration fields in the trace.",
+      evidence: [durationFact.id],
+      confidence: "deterministic"
+    });
+  }
+  return inferences;
+}
+function buildLocalExplanation(run, options = {}) {
+  const redactionProfile = options.redactionProfile ?? "local";
+  const resolved = resolveRedactionProfile(redactionProfile);
+  const redactor = new Redactor({ extraKeys: resolved.extraKeys });
+  const mode = options.mode ?? "local";
+  const facts = buildFacts(run, redactor, options.events);
+  return {
+    mode,
+    runId: String(redactValue(redactor, "runId", run.runId)),
+    ...run.name !== void 0 ? { name: String(redactValue(redactor, "name", run.name)) } : {},
+    ...run.status !== void 0 ? { status: toDisplayStatus(run.status) } : {},
+    redactionProfile,
+    facts,
+    inferences: mode === "dry-run" ? [] : buildInferences(run, facts),
+    notes: [
+      "Generated locally without provider or network calls.",
+      "Facts are observed from normalized trace data; inferences are deterministic labels."
+    ]
+  };
+}
+
+// packages/core/src/outcomes/types.ts
+var OBSERVED_OUTCOME_STATUSES = [
+  "passed",
+  "failed",
+  "unknown",
   "skipped"
 ];
 var OBSERVED_OUTCOME_METHODS = [
@@ -3479,7 +3875,17 @@ function enrichSessionSummary(summary, runs, options = {}) {
 
 // packages/core/src/sessions/checks.ts
 function emptySummary() {
-  return { passed: 0, failed: 0, warnings: 0, errors: 0, rulesEvaluated: 0 };
+  return {
+    passed: 0,
+    failed: 0,
+    warnings: 0,
+    errors: 0,
+    rulesEvaluated: 0,
+    rulesPassed: 0,
+    rulesWarning: 0,
+    rulesFailed: 0,
+    rulesError: 0
+  };
 }
 function mergeSummary(target, source) {
   return {
@@ -3487,7 +3893,11 @@ function mergeSummary(target, source) {
     failed: target.failed + source.failed,
     warnings: target.warnings + source.warnings,
     errors: target.errors + source.errors,
-    rulesEvaluated: target.rulesEvaluated + source.rulesEvaluated
+    rulesEvaluated: target.rulesEvaluated + source.rulesEvaluated,
+    rulesPassed: target.rulesPassed + source.rulesPassed,
+    rulesWarning: target.rulesWarning + source.rulesWarning,
+    rulesFailed: target.rulesFailed + source.rulesFailed,
+    rulesError: target.rulesError + source.rulesError
   };
 }
 function sessionDiagnostic(code, message) {
@@ -3884,7 +4294,7 @@ var KNOWN_EVENTS = /* @__PURE__ */ new Set([
   "step_started",
   "step_completed"
 ]);
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function safeParse(line) {
@@ -3906,7 +4316,7 @@ async function isAgentInspectTrace(filePath) {
       if (trimmed === "") continue;
       const parsed = safeParse(trimmed);
       if (!parsed) continue;
-      if (!isRecord6(parsed)) continue;
+      if (!isRecord7(parsed)) continue;
       checked += 1;
       if (isTraceEvent(parsed)) return true;
       const ev = parsed.event;
@@ -4034,691 +4444,329 @@ function buildPlaceholderArtifact() {
     note: PLACEHOLDER_NOTE
   };
 }
-
-// packages/core/src/bundle/summary.ts
-function markdownTable(rows) {
-  const lines = ["| Field | Value |", "| --- | --- |"];
-  for (const [key, value] of rows) {
-    lines.push(`| ${key} | ${value ?? "unknown"} |`);
-  }
-  return lines.join("\n");
-}
-function buildBundleSummaryMarkdown(parts) {
-  const { metadata, checks, redaction } = parts;
-  const lines = [
-    "# AgentInspect trace bundle",
-    "",
-    metadata.note,
-    "",
-    "## Overview",
-    "",
-    markdownTable([
-      ["Created", metadata.createdAt],
-      ["AgentInspect", metadata.agentInspectVersion],
-      ["Redaction profile", metadata.redactionProfile],
-      ["Safe status", metadata.safeStatus],
-      ["Source traces", metadata.sourceTraceCount],
-      ["Runs", metadata.runIds.join(", ")],
-      ...metadata.sessionId ? [["Session", metadata.sessionId]] : [],
-      ...metadata.since ? [["Since", metadata.since]] : []
-    ]),
-    "",
-    "## Safety checks",
-    "",
-    `Aggregate: **${checks.aggregateStatus}**`,
-    ""
-  ];
-  for (const run of checks.runs) {
-    const source = run.sourceStatus !== void 0 && run.sourceStatus !== run.status ? `; source ${run.sourceStatus}` : "";
-    lines.push(
-      `- \`${run.runId}\`: artifact ${run.status}${source} (${run.findings} finding(s), ${run.errors} error(s), ${run.warnings} warning(s))`
-    );
-  }
-  lines.push("", "## Redaction", "", `Total findings: ${redaction.totalFindings}`, "");
-  for (const run of redaction.runs) {
-    const detectors = run.detectors.length > 0 ? run.detectors.join(", ") : "none";
-    lines.push(`- \`${run.runId}\`: ${run.findings} finding(s); detectors: ${detectors}`);
-  }
-  lines.push(
-    "",
-    "## Files",
-    "",
-    ...metadata.files.map((file) => `- \`${file}\``),
-    "",
-    "_Review every generated artifact before sharing outside your team._",
-    ""
-  );
-  return lines.join("\n");
-}
-function sanitizeBundleRunId(runId) {
-  let safe = typeof runId === "string" && runId.trim() !== "" ? runId.trim() : "run_unknown";
-  safe = path7.basename(safe);
-  safe = safe.replace(/[^a-zA-Z0-9._-]+/g, "_");
-  if (safe === "" || safe === "." || safe === "..") {
-    safe = "run_unknown";
-  }
-  return safe;
-}
-function bundleRunAssetRelativePath(runId, extension) {
-  const safe = sanitizeBundleRunId(runId);
-  const ext = extension.startsWith(".") ? extension : `.${extension}`;
-  return path7.posix.join("assets", "runs", `${safe}${ext}`);
-}
-function assertBundlePathContained(outputDir, relativePath) {
-  const base = path7.resolve(outputDir);
-  const resolved = path7.resolve(base, relativePath);
-  if (resolved !== base && !resolved.startsWith(base + path7.sep)) {
-    throw new Error(`Bundle path escapes output directory: ${relativePath}`);
-  }
-  return resolved;
-}
-function normalizeBundleOutputPath(out, options) {
-  const trimmed = out.trim();
-  if (trimmed === "") {
-    throw new Error("--out requires a non-empty path.");
-  }
-  const resolved = path7.resolve(trimmed);
-  if (options?.preserveZipExtension !== true && resolved.toLowerCase().endsWith(".zip")) {
-    return resolved.slice(0, -4);
-  }
-  return resolved;
-}
-function defaultBundleOutputPath(runIds) {
-  const label = runIds.length === 1 ? sanitizeBundleRunId(runIds[0]) : `multi-${runIds.length}`;
-  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  return path7.resolve(`agent-inspect-bundle-${label}-${stamp}`);
-}
-
-// packages/core/src/evidence/types.ts
-var EVIDENCE_FORMAT_VERSION = "1.0";
-var EVIDENCE_ASSESSMENT_NOTE = "Best-effort local safety verification only; not a compliance certification.";
-var EVIDENCE_MANIFEST_FILENAME = "evidence.json";
-var EVIDENCE_RESOLVED_CONTRACT_FILENAME = "contract.resolved.json";
-var SHA256_RE = /^[a-f0-9]{64}$/i;
-function sha256Hex(data) {
-  const hash = createHash("sha256");
-  if (typeof data === "string") {
-    hash.update(data, "utf8");
-  } else {
-    hash.update(data);
-  }
-  return hash.digest("hex");
-}
-function isSha256Hex(value) {
-  return SHA256_RE.test(value);
-}
-function sha256Equals(expected, actual) {
-  if (!isSha256Hex(expected) || !isSha256Hex(actual)) {
-    return false;
-  }
-  const a = expected.toLowerCase();
-  const b = actual.toLowerCase();
-  if (a.length !== b.length) return false;
-  let mismatch = 0;
-  for (let i = 0; i < a.length; i += 1) {
-    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  }
-  return mismatch === 0;
-}
-function assertEvidenceRelativePath(relativePath) {
-  if (typeof relativePath !== "string" || relativePath.trim() === "") {
-    throw new Error("Evidence file path must be a non-empty relative path.");
-  }
-  const trimmed = relativePath.trim().replaceAll("\\", "/");
-  if (path7.isAbsolute(trimmed) || trimmed.startsWith("/")) {
-    throw new Error(`Evidence file path must be relative: ${relativePath}`);
-  }
-  const parts = trimmed.split("/").filter((part) => part !== "");
-  if (parts.length === 0) {
-    throw new Error(`Evidence file path must be relative: ${relativePath}`);
-  }
-  for (const part of parts) {
-    if (part === "." || part === "..") {
-      throw new Error(`Evidence file path must not contain "." or "..": ${relativePath}`);
-    }
-  }
-  return parts.join("/");
-}
-
-// packages/core/src/evidence/manifest.ts
-function stable(value) {
-  if (Array.isArray(value)) return value.map(stable);
-  if (value === null || typeof value !== "object") return value;
-  const record = value;
-  return Object.fromEntries(
-    Object.keys(record).sort((a, b) => a.localeCompare(b)).map((key) => [key, stable(record[key])])
-  );
-}
-function serializeEvidenceManifest(manifest) {
-  return `${JSON.stringify(stable(manifest), null, 2)}
-`;
-}
-function inferEvidenceFileRole(relativePath) {
-  const normalized = assertEvidenceRelativePath(relativePath);
-  const base = normalized.includes("/") ? normalized.slice(normalized.lastIndexOf("/") + 1) : normalized;
-  if (base === "evidence.html" || base === "trace.html" || base.endsWith(".html")) {
-    return "report";
-  }
-  if (base === "trace.jsonl" || base.endsWith(".jsonl")) {
-    return "redacted-trace";
-  }
-  if (base === "check-results.json") {
-    return "checks";
-  }
-  if (base === "contract.resolved.json") {
-    return "contract";
-  }
-  if (base === "redaction-report.json") {
-    return "redaction-report";
-  }
-  if (base === "summary.md") {
-    return "summary";
-  }
-  return "other";
-}
-function buildEvidenceFileEntries(files) {
-  const byPath = /* @__PURE__ */ new Map();
-  for (const file of files) {
-    const relativePath = assertEvidenceRelativePath(file.path);
-    if (relativePath === EVIDENCE_MANIFEST_FILENAME) {
-      throw new Error(
-        `Do not include ${EVIDENCE_MANIFEST_FILENAME} in packaged file hashes (self-hash is undefined).`
-      );
-    }
-    if (byPath.has(relativePath)) {
-      throw new Error(`Duplicate evidence file path: ${relativePath}`);
-    }
-    byPath.set(relativePath, {
-      path: relativePath,
-      sha256: sha256Hex(file.content),
-      role: file.role ?? inferEvidenceFileRole(relativePath)
-    });
-  }
-  return [...byPath.values()].sort((a, b) => a.path.localeCompare(b.path));
-}
-function buildEvidenceManifest(parts) {
-  const runIds = [...parts.runIds];
-  if (runIds.length === 0) {
-    throw new Error("Evidence manifest requires at least one run id.");
-  }
-  for (const item of parts.sourceHashes) {
-    if (!runIds.includes(item.runId)) {
-      throw new Error(`sourceHashes runId "${item.runId}" is not listed in source.runIds.`);
-    }
-    if (item.algorithm !== "sha256") {
-      throw new Error(`Unsupported source hash algorithm: ${item.algorithm}`);
-    }
-  }
-  const assessment = {
-    status: parts.assessmentStatus,
-    note: parts.note ?? EVIDENCE_ASSESSMENT_NOTE
-  };
-  if (parts.sourceStatus !== void 0) {
-    assessment.sourceStatus = parts.sourceStatus;
-  }
-  return {
-    evidenceFormatVersion: EVIDENCE_FORMAT_VERSION,
-    generator: {
-      name: parts.generatorName ?? "agent-inspect",
-      version: parts.generatorVersion
-    },
-    createdAt: parts.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-    source: {
-      runIds,
-      traceSchemaVersions: [...parts.traceSchemaVersions].sort((a, b) => a.localeCompare(b)),
-      sourceHashes: [...parts.sourceHashes].sort((a, b) => a.runId.localeCompare(b.runId))
-    },
-    policy: {
-      redactionProfile: parts.redactionProfile,
-      verificationPolicy: parts.verificationPolicy ?? parts.redactionProfile
-    },
-    assessment,
-    ...parts.semantics !== void 0 ? { semantics: { ...parts.semantics } } : {},
-    ...parts.contract !== void 0 ? { contract: { ...parts.contract } } : {},
-    files: buildEvidenceFileEntries(parts.files)
-  };
-}
-function validateEvidenceManifest(value) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error("Evidence manifest must be a JSON object.");
+
+// packages/core/src/bundle/summary.ts
+function markdownTable(rows) {
+  const lines = ["| Field | Value |", "| --- | --- |"];
+  for (const [key, value] of rows) {
+    lines.push(`| ${key} | ${value ?? "unknown"} |`);
   }
-  const record = value;
-  if (record.evidenceFormatVersion !== EVIDENCE_FORMAT_VERSION) {
-    throw new Error(
-      `Unsupported evidenceFormatVersion: ${String(record.evidenceFormatVersion)}`
+  return lines.join("\n");
+}
+function buildBundleSummaryMarkdown(parts) {
+  const { metadata, checks, redaction } = parts;
+  const lines = [
+    "# AgentInspect trace bundle",
+    "",
+    metadata.note,
+    "",
+    "## Overview",
+    "",
+    markdownTable([
+      ["Created", metadata.createdAt],
+      ["AgentInspect", metadata.agentInspectVersion],
+      ["Redaction profile", metadata.redactionProfile],
+      ["Safe status", metadata.safeStatus],
+      ["Source traces", metadata.sourceTraceCount],
+      ["Runs", metadata.runIds.join(", ")],
+      ...metadata.sessionId ? [["Session", metadata.sessionId]] : [],
+      ...metadata.since ? [["Since", metadata.since]] : []
+    ]),
+    "",
+    "## Safety checks",
+    "",
+    `Aggregate: **${checks.aggregateStatus}**`,
+    ""
+  ];
+  for (const run of checks.runs) {
+    const source = run.sourceStatus !== void 0 && run.sourceStatus !== run.status ? `; source ${run.sourceStatus}` : "";
+    lines.push(
+      `- \`${run.runId}\`: artifact ${run.status}${source} (${run.findings} finding(s), ${run.errors} error(s), ${run.warnings} warning(s))`
     );
   }
-  const generator = record.generator;
-  if (generator === null || typeof generator !== "object" || Array.isArray(generator) || typeof generator.name !== "string" || typeof generator.version !== "string") {
-    throw new Error("Evidence manifest requires generator.name and generator.version.");
-  }
-  const source = record.source;
-  if (source === null || typeof source !== "object" || Array.isArray(source)) {
-    throw new Error("Evidence manifest requires source.");
-  }
-  const sourceRecord = source;
-  if (!Array.isArray(sourceRecord.runIds) || sourceRecord.runIds.length === 0) {
-    throw new Error("Evidence manifest source.runIds must be a non-empty array.");
-  }
-  if (!Array.isArray(sourceRecord.traceSchemaVersions)) {
-    throw new Error("Evidence manifest source.traceSchemaVersions must be an array.");
-  }
-  if (!Array.isArray(sourceRecord.sourceHashes)) {
-    throw new Error("Evidence manifest source.sourceHashes must be an array.");
-  }
-  const policy = record.policy;
-  if (policy === null || typeof policy !== "object" || Array.isArray(policy)) {
-    throw new Error("Evidence manifest requires policy.");
-  }
-  const assessment = record.assessment;
-  if (assessment === null || typeof assessment !== "object" || Array.isArray(assessment) || typeof assessment.status !== "string") {
-    throw new Error("Evidence manifest requires assessment.status.");
-  }
-  if (!Array.isArray(record.files) || record.files.length === 0) {
-    throw new Error("Evidence manifest files must be a non-empty array.");
-  }
-  for (const file of record.files) {
-    if (file === null || typeof file !== "object" || Array.isArray(file)) {
-      throw new Error("Evidence manifest file entries must be objects.");
-    }
-    const entry = file;
-    if (typeof entry.path !== "string") {
-      throw new Error("Evidence file entry requires path.");
-    }
-    assertEvidenceRelativePath(entry.path);
-    if (typeof entry.sha256 !== "string" || !/^[a-f0-9]{64}$/i.test(entry.sha256)) {
-      throw new Error(`Evidence file entry requires sha256 hex for ${entry.path}.`);
-    }
+  lines.push("", "## Redaction", "", `Total findings: ${redaction.totalFindings}`, "");
+  for (const run of redaction.runs) {
+    const detectors = run.detectors.length > 0 ? run.detectors.join(", ") : "none";
+    lines.push(`- \`${run.runId}\`: ${run.findings} finding(s); detectors: ${detectors}`);
   }
-  return value;
+  lines.push(
+    "",
+    "## Files",
+    "",
+    ...metadata.files.map((file) => `- \`${file}\``),
+    "",
+    "_Review every generated artifact before sharing outside your team._",
+    ""
+  );
+  return lines.join("\n");
 }
-function parseEvidenceManifestJson(text) {
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`Evidence manifest is not valid JSON: ${message}`);
+function sanitizeBundleRunId(runId) {
+  let safe = typeof runId === "string" && runId.trim() !== "" ? runId.trim() : "run_unknown";
+  safe = path7.basename(safe);
+  safe = safe.replace(/[^a-zA-Z0-9._-]+/g, "_");
+  if (safe === "" || safe === "." || safe === "..") {
+    safe = "run_unknown";
   }
-  return validateEvidenceManifest(parsed);
+  return safe;
 }
-function collectTraceSchemaVersions(jsonl) {
-  const versions = /* @__PURE__ */ new Set();
-  for (const line of jsonl.split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (trimmed === "") continue;
-    try {
-      const row = JSON.parse(trimmed);
-      if (typeof row.schemaVersion === "string" && row.schemaVersion.trim() !== "") {
-        versions.add(row.schemaVersion.trim());
-      }
-    } catch {
-    }
-  }
-  return [...versions].sort((a, b) => a.localeCompare(b));
+function bundleRunAssetRelativePath(runId, extension) {
+  const safe = sanitizeBundleRunId(runId);
+  const ext = extension.startsWith(".") ? extension : `.${extension}`;
+  return path7.posix.join("assets", "runs", `${safe}${ext}`);
 }
-
-// packages/core/src/diagnostics/programmatic.ts
-var PROGRAMMATIC_DIAGNOSTIC_SPECS = Object.freeze({
-  AI_TRACE_INPUT_INVALID: {
-    code: "AI_TRACE_INPUT_INVALID",
-    summary: 'Expected { type: "file", path }, { type: "directory", path }, { type: "string", content }, { type: "buffer", content }, or { type: "stdin" }.',
-    remediation: "For a file path, use openTraceFile(path).",
-    relatedCodes: ["invalid_input"]
-  },
-  AI_TRACE_FORMAT_UNSUPPORTED: {
-    code: "AI_TRACE_FORMAT_UNSUPPORTED",
-    summary: "No trace reader could detect the input format.",
-    remediation: "Pass an AgentInspect JSONL file via openTraceFile, or set options.format to a registered reader.",
-    relatedCodes: ["unsupported_format"]
-  },
-  AI_TRACE_FORMAT_AMBIGUOUS: {
-    code: "AI_TRACE_FORMAT_AMBIGUOUS",
-    summary: "Multiple trace readers matched the input with equal confidence.",
-    remediation: "Set options.format explicitly to disambiguate the reader.",
-    relatedCodes: ["ambiguous_format"]
-  },
-  AI_TRACE_FACTS_INPUT_NOT_NORMALIZED: {
-    code: "AI_TRACE_FACTS_INPUT_NOT_NORMALIZED",
-    summary: "TraceFacts requires TraceReadResult or PersistedInspectEvent[].",
-    remediation: "Use openTraceFile() to normalize a JSONL trace first."
-  },
-  AI_TRACE_CONTRACT_RUN_SELECTION_REQUIRED: {
-    code: "AI_TRACE_CONTRACT_RUN_SELECTION_REQUIRED",
-    summary: "Multiple runs are available; select a run before executing checks.",
-    remediation: "Pass options.runId or TraceCheckInput.selectedRun.",
-    relatedCodes: ["AI_CHECK_RUN_SELECTION_REQUIRED"]
-  },
-  AI_TRACE_RELATIONSHIP_SELF_PARENT: {
-    code: "AI_TRACE_RELATIONSHIP_SELF_PARENT",
-    summary: "A parentId equals its own event/step id.",
-    remediation: "Reject at capture (AI_LANGGRAPH_SELF_PARENT_REJECTED) or drop via logical projection; do not invent replacement parents.",
-    relatedCodes: [
-      "AI_LANGGRAPH_SELF_PARENT_REJECTED",
-      "AI_LOGICAL_SELF_PARENT_REMOVED"
-    ]
-  },
-  AI_TRACE_RELATIONSHIP_CYCLE: {
-    code: "AI_TRACE_RELATIONSHIP_CYCLE",
-    summary: "Trace contains a parentId cycle.",
-    remediation: "Use visibility-first tree linking for legacy fixtures; prefer acyclic capture for new adapter output.",
-    relatedCodes: ["structure.cycle"]
-  },
-  AI_TRACE_CONTRACT_INPUT_INVALID: {
-    code: "AI_TRACE_CONTRACT_INPUT_INVALID",
-    summary: "evaluateTraceContract expects ({ read }, contract) or use evaluateTraceContractRead(read, contract).",
-    remediation: "Pass TraceCheckInput as the first argument: evaluateTraceContract({ read }, contract).",
-    relatedCodes: ["AI_CHECK_INVALID_ARGUMENTS"]
-  },
-  AI_INSPECT_RUN_UNSUPPORTED_OPTION: {
-    code: "AI_INSPECT_RUN_UNSUPPORTED_OPTION",
-    summary: 'inspectRun does not accept a "writer" option.',
-    remediation: "Use createInspector({ writer }) then inspector.run(...). inspectRun persists via the global JSONL path (schema 0.1)."
+function assertBundlePathContained(outputDir, relativePath) {
+  const base = path7.resolve(outputDir);
+  const resolved = path7.resolve(base, relativePath);
+  if (resolved !== base && !resolved.startsWith(base + path7.sep)) {
+    throw new Error(`Bundle path escapes output directory: ${relativePath}`);
   }
-});
-function formatProgrammaticDiagnostic(code, detail) {
-  const spec = PROGRAMMATIC_DIAGNOSTIC_SPECS[code];
-  const summary = detail?.trim() ? detail.trim() : spec.summary;
-  return `${code}: ${summary} Remediation: ${spec.remediation}`;
+  return resolved;
 }
-
-// packages/core/src/checks/logical-events.ts
-function isRecord7(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
+function normalizeBundleOutputPath(out, options) {
+  const trimmed = out.trim();
+  if (trimmed === "") {
+    throw new Error("--out requires a non-empty path.");
+  }
+  const resolved = path7.resolve(trimmed);
+  if (options?.preserveZipExtension !== true && resolved.toLowerCase().endsWith(".zip")) {
+    return resolved.slice(0, -4);
+  }
+  return resolved;
 }
-function legacyEvent(event) {
-  const value = event.attributes?.legacyEvent;
-  return typeof value === "string" ? value : void 0;
+function defaultBundleOutputPath(runIds) {
+  const label = runIds.length === 1 ? sanitizeBundleRunId(runIds[0]) : `multi-${runIds.length}`;
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  return path7.resolve(`agent-inspect-bundle-${label}-${stamp}`);
 }
-function stepIdOf(event) {
-  const value = event.attributes?.stepId;
-  if (typeof value === "string" && value.trim() !== "") return value;
-  return void 0;
+
+// packages/core/src/evidence/types.ts
+var EVIDENCE_FORMAT_VERSION = "1.0";
+var EVIDENCE_ASSESSMENT_NOTE = "Best-effort local safety verification only; not a compliance certification.";
+var EVIDENCE_MANIFEST_FILENAME = "evidence.json";
+var EVIDENCE_RESOLVED_CONTRACT_FILENAME = "contract.resolved.json";
+var SHA256_RE = /^[a-f0-9]{64}$/i;
+function sha256Hex(data) {
+  const hash = createHash("sha256");
+  if (typeof data === "string") {
+    hash.update(data, "utf8");
+  } else {
+    hash.update(data);
+  }
+  return hash.digest("hex");
 }
-function cloneEvent(event) {
-  return {
-    ...event,
-    ...event.attributes !== void 0 ? { attributes: { ...event.attributes } } : {},
-    ...event.error !== void 0 ? { error: { ...event.error } } : {},
-    ...event.tokenUsage !== void 0 ? { tokenUsage: { ...event.tokenUsage } } : {},
-    ...event.source !== void 0 ? { source: { ...event.source } } : {}
-  };
+function isSha256Hex(value) {
+  return SHA256_RE.test(value);
 }
-function mergeAttributes(start, complete) {
-  const merged = {
-    ...isRecord7(complete.attributes) ? complete.attributes : {},
-    ...isRecord7(start.attributes) ? start.attributes : {}
-  };
-  merged.legacyEvent = start.attributes?.legacyEvent ?? complete.attributes?.legacyEvent;
-  merged.legacyCompleteEvent = complete.attributes?.legacyEvent;
-  if (complete.attributes?.errorStack !== void 0) {
-    merged.errorStack = complete.attributes.errorStack;
+function sha256Equals(expected, actual) {
+  if (!isSha256Hex(expected) || !isSha256Hex(actual)) {
+    return false;
   }
-  return Object.keys(merged).length > 0 ? merged : void 0;
+  const a = expected.toLowerCase();
+  const b = actual.toLowerCase();
+  if (a.length !== b.length) return false;
+  let mismatch = 0;
+  for (let i = 0; i < a.length; i += 1) {
+    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return mismatch === 0;
 }
-function pairStartComplete(start, complete) {
-  const attributes = mergeAttributes(start, complete);
-  const paired = {
-    ...cloneEvent(start),
-    status: complete.status,
-    timestamp: complete.timestamp ?? start.timestamp,
-    ...complete.endedAt !== void 0 ? { endedAt: complete.endedAt } : {},
-    ...complete.durationMs !== void 0 ? { durationMs: complete.durationMs } : {},
-    ...complete.error !== void 0 ? { error: { ...complete.error } } : {},
-    ...complete.tokenUsage !== void 0 && start.tokenUsage === void 0 ? { tokenUsage: { ...complete.tokenUsage } } : {},
-    ...attributes !== void 0 ? { attributes } : {}
-  };
-  return {
-    ...paired,
-    sourceEventIds: Object.freeze([start.eventId, complete.eventId]),
-    projection: {
-      paired: true,
-      absorbedEventIds: Object.freeze([complete.eventId]),
-      parentNormalized: false,
-      ...start.parentId !== void 0 ? { originalParentId: start.parentId } : {}
+function assertEvidenceRelativePath(relativePath) {
+  if (typeof relativePath !== "string" || relativePath.trim() === "") {
+    throw new Error("Evidence file path must be a non-empty relative path.");
+  }
+  const trimmed = relativePath.trim().replaceAll("\\", "/");
+  if (path7.isAbsolute(trimmed) || trimmed.startsWith("/")) {
+    throw new Error(`Evidence file path must be relative: ${relativePath}`);
+  }
+  const parts = trimmed.split("/").filter((part) => part !== "");
+  if (parts.length === 0) {
+    throw new Error(`Evidence file path must be relative: ${relativePath}`);
+  }
+  for (const part of parts) {
+    if (part === "." || part === "..") {
+      throw new Error(`Evidence file path must not contain "." or "..": ${relativePath}`);
     }
-  };
+  }
+  return parts.join("/");
 }
-function asLogical(event, extras) {
-  return {
-    ...cloneEvent(event),
-    sourceEventIds: Object.freeze([event.eventId]),
-    projection: {
-      paired: false,
-      absorbedEventIds: Object.freeze([]),
-      parentNormalized: extras?.parentNormalized === true,
-      ...{}
-    }
-  };
+
+// packages/core/src/evidence/manifest.ts
+function stable(value) {
+  if (Array.isArray(value)) return value.map(stable);
+  if (value === null || typeof value !== "object") return value;
+  const record = value;
+  return Object.fromEntries(
+    Object.keys(record).sort((a, b) => a.localeCompare(b)).map((key) => [key, stable(record[key])])
+  );
 }
-function projectLogicalEvents(events) {
-  const diagnostics = [];
-  const byRun = /* @__PURE__ */ new Map();
-  for (const event of events) {
-    const list = byRun.get(event.runId) ?? [];
-    list.push(event);
-    byRun.set(event.runId, list);
+function serializeEvidenceManifest(manifest) {
+  return `${JSON.stringify(stable(manifest), null, 2)}
+`;
+}
+function inferEvidenceFileRole(relativePath) {
+  const normalized = assertEvidenceRelativePath(relativePath);
+  const base = normalized.includes("/") ? normalized.slice(normalized.lastIndexOf("/") + 1) : normalized;
+  if (base === "evidence.html" || base === "trace.html" || base.endsWith(".html")) {
+    return "report";
   }
-  const absorbedIds = /* @__PURE__ */ new Set();
-  const logicalByRawId = /* @__PURE__ */ new Map();
-  const stepIdToLogicalId = /* @__PURE__ */ new Map();
-  const logical = [];
-  const orderedRuns = [...byRun.keys()].sort((a, b) => a.localeCompare(b));
-  for (const runId of orderedRuns) {
-    const runEvents = byRun.get(runId) ?? [];
-    const starts = [];
-    const completes = [];
-    const others = [];
-    for (const event of runEvents) {
-      const legacy = legacyEvent(event);
-      if (legacy === "step_started" || legacy === "run_started" && event.status === "running") {
-        starts.push(event);
-      } else if (legacy === "step_completed" || legacy === "run_completed") {
-        completes.push(event);
-      } else {
-        others.push(event);
-      }
-    }
-    const usedCompletes = /* @__PURE__ */ new Set();
-    for (const start of starts) {
-      const stepId = stepIdOf(start);
-      let match;
-      if (legacyEvent(start) === "run_started") {
-        const candidates = completes.filter(
-          (c) => !usedCompletes.has(c.eventId) && legacyEvent(c) === "run_completed"
-        );
-        if (candidates.length > 1) {
-          diagnostics.push({
-            code: "AI_LOGICAL_PAIR_AMBIGUOUS",
-            message: `Multiple run_completed rows for run ${runId}; using first by eventId.`,
-            eventIds: candidates.map((c) => c.eventId)
-          });
-          candidates.sort((a, b) => a.eventId.localeCompare(b.eventId));
-        }
-        match = candidates[0];
-      } else if (stepId) {
-        const candidates = completes.filter(
-          (c) => !usedCompletes.has(c.eventId) && legacyEvent(c) === "step_completed" && stepIdOf(c) === stepId
-        );
-        if (candidates.length > 1) {
-          diagnostics.push({
-            code: "AI_LOGICAL_PAIR_AMBIGUOUS",
-            message: `Multiple step_completed rows for stepId ${stepId}; using first by eventId.`,
-            eventIds: candidates.map((c) => c.eventId)
-          });
-          candidates.sort((a, b) => a.eventId.localeCompare(b.eventId));
-        }
-        match = candidates[0];
-      }
-      if (match) {
-        usedCompletes.add(match.eventId);
-        absorbedIds.add(match.eventId);
-        const paired = pairStartComplete(start, match);
-        logical.push(paired);
-        logicalByRawId.set(start.eventId, paired);
-        logicalByRawId.set(match.eventId, paired);
-        if (stepId) stepIdToLogicalId.set(`${runId}:${stepId}`, paired.eventId);
-      } else {
-        diagnostics.push({
-          code: "AI_LOGICAL_PAIR_UNMATCHED_START",
-          message: `No matching complete for start ${start.eventId}.`,
-          eventIds: [start.eventId]
-        });
-        const alone = asLogical(start);
-        logical.push(alone);
-        logicalByRawId.set(start.eventId, alone);
-        if (stepId) stepIdToLogicalId.set(`${runId}:${stepId}`, alone.eventId);
-      }
-    }
-    for (const complete of completes) {
-      if (usedCompletes.has(complete.eventId)) continue;
-      diagnostics.push({
-        code: "AI_LOGICAL_PAIR_UNMATCHED_COMPLETE",
-        message: `No matching start for complete ${complete.eventId}.`,
-        eventIds: [complete.eventId]
-      });
-      const alone = asLogical(complete);
-      logical.push(alone);
-      logicalByRawId.set(complete.eventId, alone);
-      const stepId = stepIdOf(complete);
-      if (stepId && !stepIdToLogicalId.has(`${runId}:${stepId}`)) {
-        stepIdToLogicalId.set(`${runId}:${stepId}`, alone.eventId);
-      }
-    }
-    for (const event of others) {
-      const alone = asLogical(event);
-      logical.push(alone);
-      logicalByRawId.set(event.eventId, alone);
-      const stepId = stepIdOf(event);
-      if (stepId && !stepIdToLogicalId.has(`${runId}:${stepId}`)) {
-        stepIdToLogicalId.set(`${runId}:${stepId}`, alone.eventId);
-      }
-    }
+  if (base === "trace.jsonl" || base.endsWith(".jsonl")) {
+    return "redacted-trace";
   }
-  const logicalById = new Map(logical.map((e) => [e.eventId, e]));
-  const normalized = [];
-  for (const event of logical) {
-    const originalParentId = event.parentId;
-    if (!originalParentId) {
-      normalized.push(event);
-      continue;
-    }
-    let nextParent = originalParentId;
-    let remapped = false;
-    const viaAbsorbed = logicalByRawId.get(originalParentId);
-    if (viaAbsorbed && viaAbsorbed.eventId !== originalParentId) {
-      nextParent = viaAbsorbed.eventId;
-      remapped = true;
-    } else if (!logicalById.has(originalParentId)) {
-      const viaStep = stepIdToLogicalId.get(`${event.runId}:${originalParentId}`);
-      if (viaStep) {
-        nextParent = viaStep;
-        remapped = true;
-      }
-    }
-    if (!remapped) {
-      if (originalParentId === event.eventId) {
-        diagnostics.push({
-          code: "AI_LOGICAL_SELF_PARENT_REMOVED",
-          message: formatProgrammaticDiagnostic(
-            "AI_TRACE_RELATIONSHIP_SELF_PARENT",
-            `Removed self-parent edge on ${event.eventId}.`
-          ),
-          eventIds: [event.eventId]
-        });
-        const { parentId: _drop, ...rest } = event;
-        normalized.push({
-          ...rest,
-          projection: {
-            ...event.projection,
-            parentNormalized: true,
-            originalParentId
-          }
-        });
-        continue;
-      }
-      if (!logicalById.has(originalParentId) && !logicalByRawId.has(originalParentId)) {
-        const mapping = event.attributes?.parentMapping;
-        const unresolved = mapping === "unresolved" || event.attributes?.parentUnresolved === true || event.attributes?.unresolvedParent === true || // LangGraph/framework scaffolding sentinel labels are not event ids.
-        /^LangGraph$/i.test(originalParentId) || originalParentId.startsWith("unresolved:");
-        if (!unresolved) {
-          diagnostics.push({
-            code: "AI_LOGICAL_PARENT_UNRESOLVED",
-            message: `Parent ${originalParentId} unresolved for ${event.eventId}.`,
-            eventIds: [event.eventId]
-          });
-        }
-      }
-      normalized.push(event);
-      continue;
+  if (base === "check-results.json") {
+    return "checks";
+  }
+  if (base === "contract.resolved.json") {
+    return "contract";
+  }
+  if (base === "redaction-report.json") {
+    return "redaction-report";
+  }
+  if (base === "summary.md") {
+    return "summary";
+  }
+  return "other";
+}
+function buildEvidenceFileEntries(files) {
+  const byPath = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const relativePath = assertEvidenceRelativePath(file.path);
+    if (relativePath === EVIDENCE_MANIFEST_FILENAME) {
+      throw new Error(
+        `Do not include ${EVIDENCE_MANIFEST_FILENAME} in packaged file hashes (self-hash is undefined).`
+      );
     }
-    if (nextParent === event.eventId) {
-      diagnostics.push({
-        code: "AI_LOGICAL_SELF_PARENT_REMOVED",
-        message: formatProgrammaticDiagnostic(
-          "AI_TRACE_RELATIONSHIP_SELF_PARENT",
-          `Removed self-parent edge on ${event.eventId} (was ${originalParentId}).`
-        ),
-        eventIds: [event.eventId]
-      });
-      const { parentId: _drop, ...rest } = event;
-      normalized.push({
-        ...rest,
-        projection: {
-          ...event.projection,
-          parentNormalized: true,
-          originalParentId
-        }
-      });
-      continue;
+    if (byPath.has(relativePath)) {
+      throw new Error(`Duplicate evidence file path: ${relativePath}`);
     }
-    diagnostics.push({
-      code: "AI_LOGICAL_PARENT_REMAPPED",
-      message: `Remapped parent ${originalParentId} \u2192 ${nextParent} for ${event.eventId}.`,
-      eventIds: [event.eventId]
-    });
-    normalized.push({
-      ...event,
-      parentId: nextParent,
-      projection: {
-        ...event.projection,
-        parentNormalized: true,
-        originalParentId
-      }
+    byPath.set(relativePath, {
+      path: relativePath,
+      sha256: sha256Hex(file.content),
+      role: file.role ?? inferEvidenceFileRole(relativePath)
     });
   }
-  const rawIndex = new Map(events.map((e, i) => [e.eventId, i]));
-  normalized.sort((a, b) => {
-    const ai = rawIndex.get(a.sourceEventIds[0]) ?? 0;
-    const bi = rawIndex.get(b.sourceEventIds[0]) ?? 0;
-    return ai - bi || a.eventId.localeCompare(b.eventId);
-  });
+  return [...byPath.values()].sort((a, b) => a.path.localeCompare(b.path));
+}
+function buildEvidenceManifest(parts) {
+  const runIds = [...parts.runIds];
+  if (runIds.length === 0) {
+    throw new Error("Evidence manifest requires at least one run id.");
+  }
+  for (const item of parts.sourceHashes) {
+    if (!runIds.includes(item.runId)) {
+      throw new Error(`sourceHashes runId "${item.runId}" is not listed in source.runIds.`);
+    }
+    if (item.algorithm !== "sha256") {
+      throw new Error(`Unsupported source hash algorithm: ${item.algorithm}`);
+    }
+  }
+  const assessment = {
+    status: parts.assessmentStatus,
+    note: parts.note ?? EVIDENCE_ASSESSMENT_NOTE
+  };
+  if (parts.sourceStatus !== void 0) {
+    assessment.sourceStatus = parts.sourceStatus;
+  }
   return {
-    logicalEvents: Object.freeze(normalized),
-    diagnostics: Object.freeze(diagnostics)
+    evidenceFormatVersion: EVIDENCE_FORMAT_VERSION,
+    generator: {
+      name: parts.generatorName ?? "agent-inspect",
+      version: parts.generatorVersion
+    },
+    createdAt: parts.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    source: {
+      runIds,
+      traceSchemaVersions: [...parts.traceSchemaVersions].sort((a, b) => a.localeCompare(b)),
+      sourceHashes: [...parts.sourceHashes].sort((a, b) => a.runId.localeCompare(b.runId))
+    },
+    policy: {
+      redactionProfile: parts.redactionProfile,
+      verificationPolicy: parts.verificationPolicy ?? parts.redactionProfile
+    },
+    assessment,
+    ...parts.semantics !== void 0 ? { semantics: { ...parts.semantics } } : {},
+    ...parts.contract !== void 0 ? { contract: { ...parts.contract } } : {},
+    ...parts.inputs !== void 0 ? { inputs: { ...parts.inputs } } : {},
+    files: buildEvidenceFileEntries(parts.files)
   };
 }
-function resolveCanonicalToolName(event) {
-  const attrs = event.attributes;
-  const direct = pickString(attrs, ["toolName", "tool"]);
-  if (direct) return direct;
-  const metadata = attrs?.metadata;
-  if (isRecord7(metadata)) {
-    const nested = pickString(metadata, ["toolName", "tool"]);
-    if (nested) return nested;
+function validateEvidenceManifest(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Evidence manifest must be a JSON object.");
   }
-  for (const prefix of ["tool:", "function:", "mcp-tools:"]) {
-    if (event.name.startsWith(prefix)) return event.name.slice(prefix.length);
+  const record = value;
+  if (record.evidenceFormatVersion !== EVIDENCE_FORMAT_VERSION) {
+    throw new Error(
+      `Unsupported evidenceFormatVersion: ${String(record.evidenceFormatVersion)}`
+    );
   }
-  return event.name;
+  const generator = record.generator;
+  if (generator === null || typeof generator !== "object" || Array.isArray(generator) || typeof generator.name !== "string" || typeof generator.version !== "string") {
+    throw new Error("Evidence manifest requires generator.name and generator.version.");
+  }
+  const source = record.source;
+  if (source === null || typeof source !== "object" || Array.isArray(source)) {
+    throw new Error("Evidence manifest requires source.");
+  }
+  const sourceRecord = source;
+  if (!Array.isArray(sourceRecord.runIds) || sourceRecord.runIds.length === 0) {
+    throw new Error("Evidence manifest source.runIds must be a non-empty array.");
+  }
+  if (!Array.isArray(sourceRecord.traceSchemaVersions)) {
+    throw new Error("Evidence manifest source.traceSchemaVersions must be an array.");
+  }
+  if (!Array.isArray(sourceRecord.sourceHashes)) {
+    throw new Error("Evidence manifest source.sourceHashes must be an array.");
+  }
+  const policy = record.policy;
+  if (policy === null || typeof policy !== "object" || Array.isArray(policy)) {
+    throw new Error("Evidence manifest requires policy.");
+  }
+  const assessment = record.assessment;
+  if (assessment === null || typeof assessment !== "object" || Array.isArray(assessment) || typeof assessment.status !== "string") {
+    throw new Error("Evidence manifest requires assessment.status.");
+  }
+  if (!Array.isArray(record.files) || record.files.length === 0) {
+    throw new Error("Evidence manifest files must be a non-empty array.");
+  }
+  for (const file of record.files) {
+    if (file === null || typeof file !== "object" || Array.isArray(file)) {
+      throw new Error("Evidence manifest file entries must be objects.");
+    }
+    const entry = file;
+    if (typeof entry.path !== "string") {
+      throw new Error("Evidence file entry requires path.");
+    }
+    assertEvidenceRelativePath(entry.path);
+    if (typeof entry.sha256 !== "string" || !/^[a-f0-9]{64}$/i.test(entry.sha256)) {
+      throw new Error(`Evidence file entry requires sha256 hex for ${entry.path}.`);
+    }
+  }
+  return value;
 }
-function pickString(record, keys) {
-  if (!record) return void 0;
-  for (const key of keys) {
-    const value = record[key];
-    if (typeof value === "string" && value.trim() !== "") return value.trim();
+function parseEvidenceManifestJson(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Evidence manifest is not valid JSON: ${message}`);
   }
-  return void 0;
+  return validateEvidenceManifest(parsed);
+}
+function collectTraceSchemaVersions(jsonl) {
+  const versions = /* @__PURE__ */ new Set();
+  for (const line of jsonl.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (trimmed === "") continue;
+    try {
+      const row = JSON.parse(trimmed);
+      if (typeof row.schemaVersion === "string" && row.schemaVersion.trim() !== "") {
+        versions.add(row.schemaVersion.trim());
+      }
+    } catch {
+    }
+  }
+  return [...versions].sort((a, b) => a.localeCompare(b));
 }
 
 // packages/core/src/checks/derived-failure.ts
@@ -7069,7 +7117,17 @@ function emptyPassResult(input, runId) {
     status: "pass",
     format: input.read.format,
     ...runId !== void 0 ? { runId } : {},
-    summary: { passed: 0, failed: 0, warnings: 0, errors: 0, rulesEvaluated: 0 },
+    summary: {
+      passed: 0,
+      failed: 0,
+      warnings: 0,
+      errors: 0,
+      rulesEvaluated: 0,
+      rulesPassed: 0,
+      rulesWarning: 0,
+      rulesFailed: 0,
+      rulesError: 0
+    },
     findings: [],
     diagnostics: [],
     ruleExecutions: []
@@ -7097,7 +7155,11 @@ function mergeContractResults(input, parts, extraFindings = []) {
         (finding) => finding.status === "warning" || finding.severity === "warning"
       ).length,
       errors,
-      rulesEvaluated: ruleExecutions.length
+      rulesEvaluated: ruleExecutions.length,
+      rulesPassed: ruleExecutions.filter((item) => item.status === "pass").length,
+      rulesWarning: ruleExecutions.filter((item) => item.status === "warning").length,
+      rulesFailed: ruleExecutions.filter((item) => item.status === "fail").length,
+      rulesError: ruleExecutions.filter((item) => item.status === "error").length
     },
     findings,
     diagnostics,
@@ -7175,7 +7237,11 @@ function invalidContractInputResult() {
       failed: 0,
       warnings: 0,
       errors: 1,
-      rulesEvaluated: 0
+      rulesEvaluated: 0,
+      rulesPassed: 0,
+      rulesWarning: 0,
+      rulesFailed: 0,
+      rulesError: 0
     },
     findings: [],
     diagnostics: [
@@ -7228,7 +7294,11 @@ function evaluateTraceContract(input, contract, options = {}) {
         failed: 0,
         warnings: 0,
         errors: shapeErrors.length,
-        rulesEvaluated: 0
+        rulesEvaluated: 0,
+        rulesPassed: 0,
+        rulesWarning: 0,
+        rulesFailed: 0,
+        rulesError: 0
       },
       findings: [],
       diagnostics: shapeErrors.map((item) => ({
@@ -7253,7 +7323,11 @@ function evaluateTraceContract(input, contract, options = {}) {
         failed: 0,
         warnings: 0,
         errors: scoped.diagnostics.length,
-        rulesEvaluated: 0
+        rulesEvaluated: 0,
+        rulesPassed: 0,
+        rulesWarning: 0,
+        rulesFailed: 0,
+        rulesError: 0
       },
       findings: [],
       diagnostics: scoped.diagnostics,
@@ -7451,7 +7525,11 @@ function emptySummary2() {
     failed: 0,
     warnings: 0,
     errors: 0,
-    rulesEvaluated: 0
+    rulesEvaluated: 0,
+    rulesPassed: 0,
+    rulesWarning: 0,
+    rulesFailed: 0,
+    rulesError: 0
   };
 }
 function errorResult(input, diagnostics, selectedRun, ruleExecutions = []) {
@@ -7463,7 +7541,11 @@ function errorResult(input, diagnostics, selectedRun, ruleExecutions = []) {
     summary: {
       ...emptySummary2(),
       errors: diagnostics.filter((item) => item.severity === "error").length,
-      rulesEvaluated: ruleExecutions.length
+      rulesEvaluated: ruleExecutions.length,
+      rulesPassed: ruleExecutions.filter((item) => item.status === "pass").length,
+      rulesWarning: ruleExecutions.filter((item) => item.status === "warning").length,
+      rulesFailed: ruleExecutions.filter((item) => item.status === "fail").length,
+      rulesError: ruleExecutions.filter((item) => item.status === "error").length
     },
     findings: [],
     diagnostics: [...diagnostics],
@@ -7623,7 +7705,7 @@ function normalizeFinding(rule, finding) {
     ...finding.action !== void 0 ? { action: finding.action } : {}
   };
 }
-function summarize(findings, diagnostics, rulesEvaluated) {
+function summarize(findings, diagnostics, ruleExecutions) {
   return {
     passed: findings.filter((finding) => finding.status === "pass").length,
     failed: findings.filter(
@@ -7633,7 +7715,11 @@ function summarize(findings, diagnostics, rulesEvaluated) {
       (finding) => finding.status === "warning" || finding.severity === "warning"
     ).length,
     errors: diagnostics.filter((item) => item.severity === "error").length,
-    rulesEvaluated
+    rulesEvaluated: ruleExecutions.length,
+    rulesPassed: ruleExecutions.filter((item) => item.status === "pass").length,
+    rulesWarning: ruleExecutions.filter((item) => item.status === "warning").length,
+    rulesFailed: ruleExecutions.filter((item) => item.status === "fail").length,
+    rulesError: ruleExecutions.filter((item) => item.status === "error").length
   };
 }
 function classifyRuleExecution(findings, threw) {
@@ -9299,7 +9385,7 @@ function runTraceChecks(input, options = {}) {
   }
   const eventById = new Map(input.read.events.map((event) => [event.eventId, event]));
   const sortedFindings = findings.sort(compareFindings(eventById));
-  const summary = summarize(sortedFindings, diagnostics, ruleExecutions.length);
+  const summary = summarize(sortedFindings, diagnostics, ruleExecutions);
   const status = summary.failed > 0 ? "fail" : "pass";
   return {
     ok: status === "pass",
@@ -11242,6 +11328,28 @@ function asPositiveNumber(value, label) {
   }
   return value;
 }
+function asExpectConfig(value, label) {
+  if (value === void 0) return void 0;
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new Error(`${label} must be an object.`);
+  }
+  const raw = value;
+  const checkStatus = raw.checkStatus;
+  if (checkStatus !== "pass" && checkStatus !== "fail" && checkStatus !== "error") {
+    throw new Error(`${label}.checkStatus must be "pass", "fail", or "error".`);
+  }
+  const findingRuleIds = asStringArray(raw.findingRuleIds, `${label}.findingRuleIds`);
+  const minAssertions = asPositiveNumber(raw.minAssertions, `${label}.minAssertions`);
+  const rejectUnexpectedFindings = raw.rejectUnexpectedFindings === void 0 ? void 0 : typeof raw.rejectUnexpectedFindings === "boolean" ? raw.rejectUnexpectedFindings : (() => {
+    throw new Error(`${label}.rejectUnexpectedFindings must be a boolean.`);
+  })();
+  return {
+    checkStatus,
+    ...findingRuleIds !== void 0 ? { findingRuleIds } : {},
+    ...rejectUnexpectedFindings !== void 0 ? { rejectUnexpectedFindings } : {},
+    ...minAssertions !== void 0 ? { minAssertions } : {}
+  };
+}
 function validateCaseConfig(value, index) {
   const diagnostics = [];
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
@@ -11284,7 +11392,8 @@ function validateCaseConfig(value, index) {
             raw.expectedObservations,
             `cases[${index}].expectedObservations`
           )
-        } : {}
+        } : {},
+        ...asExpectConfig(raw.expect, `cases[${index}].expect`) !== void 0 ? { expect: asExpectConfig(raw.expect, `cases[${index}].expect`) } : {}
       },
       diagnostics
     };
@@ -13919,6 +14028,78 @@ function validateExpectedObservations(suiteCase, read) {
   }
   return { ok: diagnostics.length === 0, diagnostics };
 }
+function evaluateCaseExpect(suiteCase, checkResult, observationCount) {
+  const expectation = suiteCase.expect;
+  if (expectation === void 0) {
+    return { ok: true, diagnostics: [] };
+  }
+  const diagnostics = [];
+  if (checkResult.status !== expectation.checkStatus) {
+    diagnostics.push(
+      diagnostic5(
+        "AI_SUITE_EXPECT_MISMATCH",
+        `Expected check status "${expectation.checkStatus}", got "${checkResult.status}".`,
+        "error",
+        suiteCase.id
+      )
+    );
+  }
+  const failedFindings = checkResult.findings.filter(
+    (finding) => finding.status === "fail" && finding.severity === "error"
+  );
+  const requiredIds = expectation.findingRuleIds ?? [];
+  for (const ruleId of requiredIds) {
+    if (!failedFindings.some((finding) => finding.ruleId === ruleId)) {
+      diagnostics.push(
+        diagnostic5(
+          "AI_SUITE_EXPECT_MISMATCH",
+          `Expected failing finding for rule "${ruleId}" was not present.`,
+          "error",
+          suiteCase.id
+        )
+      );
+    }
+  }
+  const rejectUnexpected = expectation.rejectUnexpectedFindings !== false;
+  if (rejectUnexpected && requiredIds.length > 0) {
+    for (const finding of failedFindings) {
+      if (!requiredIds.includes(finding.ruleId)) {
+        diagnostics.push(
+          diagnostic5(
+            "AI_SUITE_EXPECT_MISMATCH",
+            `Unexpected failing finding for rule "${finding.ruleId}".`,
+            "error",
+            suiteCase.id
+          )
+        );
+      }
+    }
+  }
+  if (expectation.minAssertions !== void 0) {
+    const assertionCount = checkResult.ruleExecutions.length + observationCount;
+    if (assertionCount < expectation.minAssertions) {
+      diagnostics.push(
+        diagnostic5(
+          "AI_SUITE_EXPECT_MISMATCH",
+          `Expected at least ${expectation.minAssertions} assertion(s), got ${assertionCount}.`,
+          "error",
+          suiteCase.id
+        )
+      );
+    }
+  }
+  if (expectation.checkStatus === "fail" && checkResult.diagnostics.some((item) => item.severity === "error") && checkResult.status === "error") {
+    diagnostics.push(
+      diagnostic5(
+        "AI_SUITE_EXPECT_MISMATCH",
+        'Check ended in evaluator/config error; semantic failure expectation requires status "fail".',
+        "error",
+        suiteCase.id
+      )
+    );
+  }
+  return { ok: diagnostics.length === 0, diagnostics };
+}
 async function runSuiteCase(suiteCase, config, options) {
   const resolved = await resolveSuiteCaseTrace(suiteCase, options);
   if (resolved.missing || resolved.tracePath === void 0) {
@@ -13971,9 +14152,21 @@ async function runSuiteCase(suiteCase, config, options) {
     status: "pass",
     format: read.format,
     findings: [],
-    diagnostics: []};
+    diagnostics: [],
+    ruleExecutions: []
+  };
   const observationResult = validateExpectedObservations(suiteCase, read);
-  const diagnostics = [
+  const checkOk = checkResult.ok;
+  const observationsOk = observationResult.ok;
+  const evalOk = config.eval?.requireSuccess === true ? checkResult.findings.every(
+    (finding) => finding.ruleId !== "run.status" || finding.status !== "fail"
+  ) && checkResult.diagnostics.every((item) => item.severity !== "error") : void 0;
+  const expectResult = evaluateCaseExpect(
+    suiteCase,
+    checkResult,
+    compiled.observationCount
+  );
+  const checkFailureDiagnostics = [
     ...checkResult.diagnostics.map(
       (item) => diagnostic5(
         "AI_SUITE_CASE_CHECK_FAILED",
@@ -13989,15 +14182,24 @@ async function runSuiteCase(suiteCase, config, options) {
         finding.severity,
         suiteCase.id
       )
-    ),
-    ...observationResult.diagnostics
+    )
   ];
-  const checkOk = checkResult.ok;
-  const observationsOk = observationResult.ok;
-  const evalOk = config.eval?.requireSuccess === true ? checkResult.findings.every(
-    (finding) => finding.ruleId !== "run.status" || finding.status !== "fail"
-  ) && checkResult.diagnostics.every((item) => item.severity !== "error") : void 0;
-  const ok = checkOk && observationsOk;
+  const expectMatched = suiteCase.expect !== void 0 && expectResult.ok && observationsOk;
+  const diagnostics = expectMatched ? [
+    ...observationResult.diagnostics,
+    ...expectResult.diagnostics,
+    diagnostic5(
+      "AI_SUITE_CASE_CHECK_FAILED",
+      `Expected semantic failure matched (check.status=${checkResult.status}).`,
+      "info",
+      suiteCase.id
+    )
+  ] : [
+    ...checkFailureDiagnostics,
+    ...observationResult.diagnostics,
+    ...expectResult.diagnostics
+  ];
+  const ok = suiteCase.expect !== void 0 ? expectResult.ok && observationsOk : checkOk && observationsOk;
   const status = ok ? "pass" : checkResult.status === "error" ? "error" : "fail";
   return {
     id: suiteCase.id,
@@ -15173,5 +15375,5 @@ function renderGateReport(result, options = {}) {
 }
 
 export { ATTRIBUTION_CONFIDENCES, COHORT_METRIC_IDS, DEFAULT_REDACT_KEYS, DEFAULT_SUITE_ARTIFACTS_DIR, EVIDENCE_FORMAT_VERSION, EVIDENCE_HTML_FILENAME, EVIDENCE_MANIFEST_FILENAME, Redactor, TraceDirectory, TraceReadError, TreeBuilder, aggregateBundleSafeStatus, aggregateSessionCheckResults, analyzeCohort, applyProfileMetadataCaps, assertBundlePathContained, assertEvidenceRelativePath, buildActivitySummary, buildBundleMetadata, buildBundleSummaryMarkdown, buildEvidenceCausalFailureViewHtml, buildEvidenceCiPackage, buildEvidenceCircuitViewHtml, buildEvidenceContractsViewHtml, buildEvidenceDiffViewHtml, buildEvidenceHtmlShell, buildEvidenceManifest, buildEvidenceOutcomesViewHtml, buildEvidenceProvenanceViewHtml, buildEvidenceSafetyViewHtml, buildEvidenceTimelineViewHtml, buildEvidenceToolsLlmViewHtml, buildEvidenceTreeViewHtml, buildLocalExplanation, buildPlaceholderArtifact, buildRunSummary, buildRunTimeline, buildRunWhatSummary, buildSessionIndex, buildTraceStats, buildZipArchive, bundleFailsOnSafety, bundleRunAssetRelativePath, collectTraceSchemaVersions, compactAttributes, createBaselineRegressionRule, createLlmUsageRule, createMaxStepDurationRule, createObservedOutcomeRule, createRequireCompletedRule, createRunDepthRule, createRunDurationRule, createRunStatusRule, createSafetyOversizedAttributeRule, createSafetyRawContentRule, createSafetyRedactionRule, createSafetySecretPatternRule, createStallDetectionRule, createStructureCycleRule, createStructureOrphanRule, createStructureParallelWidthRule, createStructureRelationshipRule, createToolUsageRule, defaultBundleOutputPath, defaultSuiteConfigTemplate, defineTraceContract, diffRuns, diffTraceEvents, enrichSessionRunRecord, escapeHtml, escapeMarkdown, evaluateTraceContract, extractMetadata, extractOutcomesFromTraceEvents, filterMetasBySessionScope, filterTraces, flattenTree, formatDuration2 as formatDuration, formatStepLabel, formatTimestamp, gateHasThresholds, getIndent, getTraceFilePath, inferEvidenceFileRole, isAgentInspectTrace, isAttributionConfidence, isCredentialSensitiveKey, isPersistedInspectEvent, loadSessionRunRecords, loadSuiteConfig, loadTraceMetadataList, manualTraceEventsToComparableRun, nanoid, normalizeBundleOutputPath, openTrace, parseCohortMetricList, parseDuration, parseDurationFilter, parseGateList, parseTraceJsonl, persistedInspectEventsToRunTrees, persistedInspectEventsToTraceEvents, projectLogicalEvents, renderActivitySummaryHuman, renderCohortReport, renderErrorLine, renderGateReport, renderObservedOutcomesHtml, renderObservedOutcomesMarkdown, renderRunDiff, renderRunWhat, renderStepLine, renderSuiteReport, renderTimeline, renderTraceStats, resolveBundleRunIds, resolveRedactionProfile, resolveSuiteTemplate, resolveTraceDir, runGate, runSuite, runTraceChecks, safeString, sanitizeBundleRunId, searchTraces, serializeEvidenceManifest, sha256Hex, stableJson, stringContainsHighConfidenceCredential, summarizeObservedOutcomes, summarizeSemanticParity, traceEventToPersistedInspectEvent, truncateName, truncateStringForProfile, validateEvent, validateSuiteConfig, verifyEvidenceDirectory, zeroKinds };
-//# sourceMappingURL=chunk-JCKC4ZRV.mjs.map
-//# sourceMappingURL=chunk-JCKC4ZRV.mjs.map
+//# sourceMappingURL=chunk-MQYHJL3W.mjs.map
+//# sourceMappingURL=chunk-MQYHJL3W.mjs.map