agentfootprint 9.76.1 → 9.78.0

package/dist/core/agent/stages/toolCalls.js

@@ -73,6 +73,9 @@ const resultCeiling_js_1 = require("../resultCeiling.js");
 const skillSteps_js_1 = require("../../../lib/injection-engine/skillSteps.js");
 const envelope_js_1 = require("../../../lib/semantics/envelope.js");
 const ledger_js_2 = require("../../../integrity/unsupported-claim/ledger.js");
+const check_js_1 = require("../../../integrity/empty-lookup/check.js");
+const check_js_2 = require("../../../integrity/column-types/check.js");
+const integrityFindings_js_1 = require("../integrityFindings.js");
 const index_js_1 = require("../coverage/index.js");
 const toolEffects_js_1 = require("../toolEffects.js");
 /** Declaration order preserved, ids de-duplicated — the shape the gate's re-prompt
@@ -315,6 +318,73 @@ function buildToolCallsHandler(deps) {
         });
         return verdict.refusal;
     };
+    /**
+     * THE COLUMN-TYPE CONTRACT (9.78.0) — the tool declared what its rows
+     * contain, and this is where the rows are.
+     *
+     * Placed at the SAME execute boundaries as `refuseOverCeiling` and for the
+     * same reason: `resultColumns` is the TOOL AUTHOR's contract on the tool's
+     * OWN return, so it is judged the moment the handler's value lands, before
+     * governance, before placement, before the cap — and a resumed call is
+     * judged exactly as an inline one.
+     *
+     * AFTER the ceiling, deliberately. A payload the model will never read has
+     * no columns worth arguing about, and judging one that was already refused
+     * would file findings about rows nobody was ever served.
+     *
+     * `undefined` = nothing declared, nothing to refuse, or `'warn'` — the
+     * caller keeps today's path byte for byte. A string is the teaching
+     * refusal, which under `'enforce'` replaces the payload on every channel,
+     * exactly as the ceiling's does.
+     *
+     * The three field failures this exists for: LUN 0 stored as an empty string
+     * on 2,094 mappings; an 8 MiB disk rendered `0.0 GB`; a whole tool family
+     * returning its numbers as quoted strings. This catches the first and the
+     * third. It cannot catch the second — that is MEANING, and the ceiling
+     * sentence in every finding says so.
+     */
+    const judgeColumns = (scope, call, value) => {
+        const declarations = deps.columnDeclarations;
+        if (declarations === undefined)
+            return undefined;
+        const columns = declarations.get(call.toolName);
+        if (columns === undefined)
+            return undefined;
+        const { findings, disposition, refusal } = (0, check_js_2.columnTypesOf)({
+            toolName: call.toolName,
+            toolCallId: call.toolCallId,
+            columns,
+            reading: (0, check_js_2.readRowset)(value),
+            mode: deps.columnCheckMode ?? 'warn',
+        }, call.iteration);
+        // ONE encounter, TWO rows. The declaration arms both checks and a call
+        // meets both at once, so both must answer for it — a shape that is not a
+        // rowset is `not-applicable` to each, and a clean rowset is a
+        // `checked-pass` for each. Filing one row would leave the other check
+        // looking untouched, which is the rot signal, not the truth.
+        const ledger = deps.integrityLedger?.current;
+        for (const kind of ['column-type-mismatch', 'missing-column']) {
+            const kindFired = findings.some((f) => f.kind === kind);
+            // A rowset this check could read, where THIS kind found nothing, is a
+            // pass for THIS kind even when its sibling failed: the columns really
+            // were all present, or really did all hold their declared type.
+            const row = disposition === 'not-applicable'
+                ? 'not-applicable'
+                : kindFired
+                    ? 'checked-fail'
+                    : 'checked-pass';
+            ledger?.note(kind, 'write', row, kindFired ? Date.now() : undefined);
+        }
+        // The findings ARE the record of a refusal: each one names what was
+        // refused, which column, how many rows, and — through `outcomeClause` —
+        // that the model read a sentence instead of the rows. Deliberately NOT
+        // `tools.result_refused`: that event's whole vocabulary is a SIZE
+        // (`sizeChars`, `maxChars`), and reusing it here would put a fabricated
+        // ceiling on the record to describe a refusal that had nothing to do
+        // with size.
+        (0, integrityFindings_js_1.fileIntegrityFindings)(scope, findings, call.iteration);
+        return refusal;
+    };
     /**
      * Coverage declarations — `absent(…)` and `coverage(…)`, recognized at the
      * SAME execute boundaries the ceiling is measured at (one implementation,
@@ -385,6 +455,75 @@ function buildToolCallsHandler(deps) {
         scope.coverageDeclared = [...(scope.coverageDeclared ?? []), ...rows];
         return reading.status;
     };
+    /**
+     * THE WRITE SEAM (9.77.0) — `empty-lookup`, at the one moment a lookup's
+     * answer becomes a fact in the conversation.
+     *
+     * The recorded failure this exists for: a reverse-lookup tool filtered a
+     * column before a pivot, so EVERY lookup returned an empty result, for
+     * every identifier, always — and the agent reported, with confidence and in
+     * a table, that the device was logged in nowhere. It was logged in the
+     * whole time. An empty result from a broken filter is byte-identical to an
+     * empty result from a genuine absence, so nothing anywhere could notice.
+     *
+     * What CAN be noticed is the pair: the run itself produced this identifier
+     * (it came out of a result from a tool this one's author named in
+     * `argumentsFrom`), and the lookup keyed on it came back empty. The finding
+     * is an ADVISORY and says so — an empty answer can be perfectly true, and
+     * this cannot tell which one it is looking at.
+     *
+     * Judged on the TOOL'S OWN answer, before the after-tool chain rewrites it
+     * for the model: whether the lookup found anything is a fact about the
+     * tool, not about what a governance rule then did with it. A refused,
+     * placed or capped result reads as bespoke anyway — a claim ticket has no
+     * rows to count.
+     */
+    const noticeEmptyLookup = (scope, call, args, result, history, 
+    /** The call produced a real result to read (ran, no error, nothing refused it). */
+    answered) => {
+        const grounding = deps.emptyLookupGrounding;
+        if (grounding === undefined)
+            return;
+        const argumentsFrom = grounding.get(call.toolName);
+        if (argumentsFrom === undefined)
+            return;
+        const ledger = deps.integrityLedger?.current;
+        // A call that never ran, was denied, errored or had its payload refused
+        // produced no lookup result to read. Not a pass, not a fail — the check
+        // met its subject and the subject is out of scope BY RULE, which is what
+        // `not-applicable` is for. Stated, never silence.
+        if (!answered) {
+            ledger?.note('empty-lookup', 'write', 'not-applicable');
+            return;
+        }
+        // The producer corpus: every earlier `role: 'tool'` message from a tool
+        // THIS tool declares as one of its grounds. `history` here excludes the
+        // call being judged (it is pushed after), and a producer called earlier
+        // in the same batch is already in it — which is right: the model can only
+        // have taken a value from a result it had already been served.
+        const produced = [];
+        for (const message of history) {
+            if (message.role !== 'tool')
+                continue;
+            const name = message.toolName;
+            if (typeof name !== 'string' || !argumentsFrom.includes(name))
+                continue;
+            produced.push({ toolName: name, text: message.content });
+        }
+        const { findings, disposition } = (0, check_js_1.emptyLookupOf)({
+            toolName: call.toolName,
+            toolCallId: call.toolCallId,
+            args,
+            argumentsFrom,
+            // `readAbsence` is the ONE owner of the `af_absent` marker; the pure
+            // check is handed its verdict rather than re-deriving it, so
+            // `src/integrity/` stays a leaf and the reserved word keeps one
+            // spelling.
+            reading: (0, check_js_1.readLookupResult)(result, (0, index_js_1.readAbsence)(result) !== undefined),
+        }, produced, call.iteration);
+        ledger?.note('empty-lookup', 'write', disposition, disposition === 'checked-fail' ? Date.now() : undefined);
+        (0, integrityFindings_js_1.fileIntegrityFindings)(scope, findings, call.iteration);
+    };
     /**
      * The semantic envelope (9.53.0) — recognized at the SAME execute
      * boundaries as coverage and the ceiling (one implementation, every door),
@@ -1465,6 +1604,22 @@ function buildToolCallsHandler(deps) {
                         envelope: { ...envelope, content: refusal, status: 'invalid' },
                     };
                 }
+                // The column-type contract (9.78.0), at the same door and one step
+                // after the ceiling. `'warn'` files and returns undefined — this
+                // path keeps every byte it had.
+                const columnRefusal = judgeColumns(scope, { toolName, toolCallId, iteration }, content);
+                if (columnRefusal !== undefined) {
+                    return {
+                        result: columnRefusal,
+                        executed: true,
+                        // The ceiling's flag, reused for the ceiling's reason: a refused
+                        // payload must not advance the step pointer on any path, and
+                        // there is exactly one fact here — the model did not get the
+                        // result — not two spellings of it.
+                        ceilingRefused: true,
+                        envelope: { ...envelope, content: columnRefusal, status: 'invalid' },
+                    };
+                }
                 return {
                     result: content,
                     executed: true,
@@ -1496,6 +1651,17 @@ function buildToolCallsHandler(deps) {
                     envelope: { content: refusal, effects: [], status: 'invalid', malformed: [] },
                 };
             }
+            // The column-type contract on this path's own execute boundary — a
+            // resumed call's rows are judged exactly as an inline one's.
+            const columnRefusal = judgeColumns(scope, { toolName, toolCallId, iteration }, result);
+            if (columnRefusal !== undefined) {
+                return {
+                    result: columnRefusal,
+                    executed: true,
+                    ceilingRefused: true,
+                    envelope: { content: columnRefusal, effects: [], status: 'invalid', malformed: [] },
+                };
+            }
             // A status-only shape missing its `effects: []` marker is DATA (bytes
             // unchanged) — but never silently: name the dropped marker in dev mode.
             const nearMiss = (0, toolEffects_js_1.explainStatusOnlyNearMiss)(result);
@@ -2234,6 +2400,18 @@ function buildToolCallsHandler(deps) {
                                 result = overflowRefusal;
                                 toolStatus = 'invalid';
                             }
+                            else {
+                                // The column-type contract (9.78.0) — the main batch-loop
+                                // door, one step after the ceiling. Only when the payload
+                                // survived it: rows nobody will read have no columns worth
+                                // arguing about.
+                                const columnRefusal = judgeColumns(scope, { toolName: tc.name, toolCallId: tc.id, iteration }, result);
+                                if (columnRefusal !== undefined) {
+                                    ceilingRefused = true;
+                                    result = columnRefusal;
+                                    toolStatus = 'invalid';
+                                }
+                            }
                             await endCall(tc.id);
                         }
                         catch (err) {
@@ -2426,6 +2604,12 @@ function buildToolCallsHandler(deps) {
                 // placed: a refusal is already short, and 'tool-result/<name>' must
                 // never claim an error is the tool's result.
                 const placedValues = await placeResults(scope, { toolName: tc.name, toolCallId: tc.id, iteration }, { result, modelResult: rawModelResult }, executed && !error && !denied && !ceilingRefused);
+                // The write seam (9.77.0) — judged on `result`, the tool's own answer,
+                // and on `newHistory`, which at this point holds every earlier tool
+                // result and not yet this one. Same guard the placement decision uses:
+                // a call that did not run, errored, was denied or had its payload
+                // refused has no lookup answer to read.
+                noticeEmptyLookup(scope, { toolName: tc.name, toolCallId: tc.id, iteration }, callArgs, result, newHistory, executed && !error && !denied && !ceilingRefused);
                 // The ceiling, last — after the tool, after the chain. A rule that
                 // already summarized a huge result is measured on what it produced, so
                 // the cap composes with governance rather than pre-empting it.