imprint-mcp 0.6.4 → 0.6.6

package/src/cli.ts

@@ -40,6 +40,45 @@ export function parseDuration(dur: string): number | null {
   return num;
 }
 
+export type TeachSelectionMode =
+  | 'tool'
+  | 'primary'
+  | 'all-explicit'
+  | 'all-default'
+  | 'interactive-default-all';
+
+/** Pure CLI selection-mode resolver shared by validation and telemetry. */
+export function resolveTeachSelectionMode(opts: {
+  tool?: string;
+  primaryTool?: boolean;
+  allTools?: boolean;
+  noInteractive?: boolean;
+}): { mode: TeachSelectionMode; error?: string } {
+  if (opts.tool && opts.allTools) {
+    return { mode: 'tool', error: 'error: --tool cannot be combined with --all-tools' };
+  }
+  if (opts.tool && opts.primaryTool) {
+    return { mode: 'tool', error: 'error: --tool cannot be combined with --primary-tool' };
+  }
+  if (opts.allTools && opts.primaryTool) {
+    return {
+      mode: 'primary',
+      error: 'error: --all-tools cannot be combined with --primary-tool',
+    };
+  }
+  return {
+    mode: opts.tool
+      ? 'tool'
+      : opts.primaryTool
+        ? 'primary'
+        : opts.allTools
+          ? 'all-explicit'
+          : opts.noInteractive
+            ? 'all-default'
+            : 'interactive-default-all',
+  };
+}
+
 const HELP = `imprint v${VERSION} — teach an AI agent to use any website. Once.
 
 USAGE
@@ -112,7 +151,7 @@ export const VERB_HELP: Record<string, VerbHelp> = {
     summary:
       'Record a workflow, compile both artifacts, emit the tool, and connect to your AI platform — all in one interactive flow. Supports resuming incomplete runs and multiple workflows per site.',
     usage: [
-      'imprint teach <site> [--url <url>] [--from-session <path>] [--persist-profile] [--no-interactive] [--all-tools] [--tool <toolName>] [--provider <name>] [--model <name>] [--timeout <duration>] [--keep-test] [--skip-replay] [--from-step <step>] [--to-step <step>] [--only <step>]',
+      'imprint teach <site> [--url <url>] [--from-session <path>] [--persist-profile] [--no-interactive] [--primary-tool | --all-tools] [--tool <toolName>] [--provider <name>] [--model <name>] [--timeout <duration>] [--keep-test] [--skip-replay] [--from-step <step>] [--to-step <step>] [--only <step>]',
     ],
     flags: [
       { name: '--url <url>', description: 'Starting URL (else about:blank).' },
@@ -123,13 +162,15 @@ export const VERB_HELP: Record<string, VerbHelp> = {
       { name: '--persist-profile', description: 'Reuse a stable Chrome profile for this site.' },
       {
         name: '--no-interactive',
-        description:
-          'Run without prompts; compile the primary detected tool and print integration snippets.',
+        description: 'Run without prompts; compile all detected tools by default.',
       },
       {
         name: '--all-tools',
-        description:
-          'With --no-interactive, compile every detected candidate tool instead of only the primary.',
+        description: 'Explicitly compile all detected tools (the default).',
+      },
+      {
+        name: '--primary-tool',
+        description: 'Compile only the primary detected tool and its upstream dependencies.',
       },
       {
         name: '--tool <toolName>',
@@ -153,17 +194,17 @@ export const VERB_HELP: Record<string, VerbHelp> = {
       {
         name: '--keep-test',
         description:
-          'Retain the agent-generated parser.test.ts after compile (debug). Default deletes it; the test reads the gitignored redacted session via $IMPRINT_SESSION_PATH and is not portable. Also settable via IMPRINT_KEEP_TEST=1.',
+          'Retain the agent-generated parser.test.ts and request.test.ts after compile (debug). Default deletes them; parser tests read the gitignored redacted session via $IMPRINT_SESSION_PATH and are not portable. Also settable via IMPRINT_KEEP_TEST=1.',
       },
       {
         name: '--skip-replay',
         description:
-          "Skip the replay-and-diff stage. Faster, but the compile agent won't be able to distinguish browser-minted values from constants, which may reduce workflow accuracy.",
+          "Skip the replay-and-diff stage. Faster, but the compile agent won't be able to distinguish browser-minted values from constants, which may reduce workflow accuracy. By default, the preceding effect-aware triage suppresses replay entirely when the recording contains an irreversible request.",
       },
       {
         name: '--from-step <step>',
         description:
-          'Resume a prior run starting at <step> (record, redact, replay-and-diff, triage, detect-candidates, plan-prereqs, generate, compile-playbook, emit, register). Only allowed if a prior run reached/crossed that point — earlier phase outputs are reused. Not combinable with --from-session.',
+          'Resume a prior run starting at <step> (record, redact, triage, replay-and-diff, detect-candidates, plan-prereqs, generate, compile-playbook, emit, register). Only allowed if a prior run reached/crossed that point — earlier phase outputs are reused. Not combinable with --from-session.',
       },
       {
         name: '--to-step <step>',
@@ -224,7 +265,7 @@ export const VERB_HELP: Record<string, VerbHelp> = {
       {
         name: '--keep-test',
         description:
-          'Retain the agent-generated parser.test.ts after compile (debug). Default deletes it; the test reads the gitignored redacted session via $IMPRINT_SESSION_PATH and is not portable. Also settable via IMPRINT_KEEP_TEST=1.',
+          'Retain the agent-generated parser.test.ts and request.test.ts after compile (debug). Default deletes them; parser tests read the gitignored redacted session via $IMPRINT_SESSION_PATH and are not portable. Also settable via IMPRINT_KEEP_TEST=1.',
       },
     ],
     example: 'imprint generate ~/.imprint/acmecorp/sessions/<ts>.redacted.json',
@@ -1423,6 +1464,7 @@ async function main(argv: string[]): Promise<number> {
           'persist-profile': { type: 'boolean' },
           'no-interactive': { type: 'boolean' },
           'all-tools': { type: 'boolean' },
+          'primary-tool': { type: 'boolean' },
           tool: { type: 'string' },
           provider: { type: 'string' },
           model: { type: 'string' },
@@ -1464,8 +1506,14 @@ async function main(argv: string[]): Promise<number> {
           return 2;
         }
       }
-      if (values.tool && values['all-tools']) {
-        console.error('error: --tool cannot be combined with --all-tools');
+      const selection = resolveTeachSelectionMode({
+        tool: values.tool,
+        primaryTool: values['primary-tool'],
+        allTools: values['all-tools'],
+        noInteractive: values['no-interactive'],
+      });
+      if (selection.error) {
+        console.error(selection.error);
         return 2;
       }
 
@@ -1500,6 +1548,7 @@ async function main(argv: string[]): Promise<number> {
       const ctrl = new AbortController();
       const onSigint = (): void => ctrl.abort();
       process.once('SIGINT', onSigint);
+      const teachSelectionMode = selection.mode;
 
       try {
         const { teach } = await import('./imprint/teach.ts');
@@ -1513,7 +1562,10 @@ async function main(argv: string[]): Promise<number> {
             'imprint.provider': values.provider ?? 'auto',
             'imprint.model': values.model ?? 'auto',
             'imprint.timeout_ms': teachTimeoutMs ?? 'default',
-            'imprint.all_tools': values['all-tools'] ?? false,
+            'imprint.all_tools':
+              teachSelectionMode === 'all-explicit' || teachSelectionMode === 'all-default',
+            'imprint.selection_mode': teachSelectionMode,
+            'imprint.primary_tool': values['primary-tool'] ?? false,
             'imprint.tool': values.tool,
             'imprint.no_interactive': values['no-interactive'] ?? false,
             'imprint.skip_replay': values['skip-replay'] ?? false,
@@ -1530,7 +1582,7 @@ async function main(argv: string[]): Promise<number> {
               model: values.model,
               maxDurationMs: teachTimeoutMs,
               keepTest: values['keep-test'] || process.env.IMPRINT_KEEP_TEST === '1',
-              allTools: values['all-tools'],
+              primaryTool: values['primary-tool'],
               tool: values.tool,
               skipReplay: values['skip-replay'],
               fromStep: fromStepArg,
@@ -1570,6 +1622,7 @@ async function main(argv: string[]): Promise<number> {
           'revision-mode': { type: 'boolean' },
           provider: { type: 'string' },
           site: { type: 'string' },
+          'shared-triage-json': { type: 'string' },
         },
         allowPositionals: false,
       });
@@ -1587,6 +1640,7 @@ async function main(argv: string[]): Promise<number> {
       const { SharedModuleManifestSchema, AuthToolPlanSchema } = await import(
         './imprint/build-plan.ts'
       );
+      const { SharedTriageSelectionSchema } = await import('./imprint/triage-selection.ts');
       const candidate = values['candidate-json']
         ? ToolCandidateSchema.parse(JSON.parse(values['candidate-json']))
         : undefined;
@@ -1599,6 +1653,9 @@ async function main(argv: string[]): Promise<number> {
       const authToolPlan = values['auth-plan-json']
         ? AuthToolPlanSchema.parse(JSON.parse(values['auth-plan-json']))
         : undefined;
+      const sharedTriageSelection = values['shared-triage-json']
+        ? SharedTriageSelectionSchema.parse(JSON.parse(values['shared-triage-json']))
+        : undefined;
       await runCompileMcpServer({
         sessionPath: values['session-path'],
         toolDir,
@@ -1615,6 +1672,7 @@ async function main(argv: string[]): Promise<number> {
           | 'cursor-cli'
           | undefined,
         site: values.site,
+        sharedTriageSelection,
       });
       return 0;
     }

package/src/imprint/audit.ts

@@ -21,6 +21,7 @@ import {
   type AuthVerificationReceiptStatus,
   readAuthVerificationReceiptStatus,
 } from './auth-compile-tools.ts';
+import { workflowHasIrreversibleEffect } from './effects.ts';
 import { type ProviderName, preferredAgentModel } from './llm.ts';
 import { createLog } from './log.ts';
 import { imprintHomeDir } from './paths.ts';
@@ -129,6 +130,7 @@ interface AuditToolPartition {
   eligible: ResolvedTool[];
   nonInteractiveAuthNames: string[];
   skippedInteractiveAuth: SkippedInteractiveAuth[];
+  skippedIrreversible: string[];
 }
 
 interface DetectedButUnemittedTool {
@@ -185,8 +187,13 @@ export function partitionAuditTools(tools: readonly ResolvedTool[]): AuditToolPa
   const eligible: ResolvedTool[] = [];
   const nonInteractiveAuthNames: string[] = [];
   const skippedInteractiveAuth: SkippedInteractiveAuth[] = [];
+  const skippedIrreversible: string[] = [];
 
   for (const tool of tools) {
+    if (workflowHasIrreversibleEffect(tool.workflow)) {
+      skippedIrreversible.push(tool.workflow.toolName);
+      continue;
+    }
     // authConfig is the authoritative capability marker for legacy workflows
     // where the newer optional toolKind field may be absent.
     const auth = tool.workflow.authConfig;
@@ -229,7 +236,7 @@ export function partitionAuditTools(tools: readonly ResolvedTool[]): AuditToolPa
     });
   }
 
-  return { eligible, nonInteractiveAuthNames, skippedInteractiveAuth };
+  return { eligible, nonInteractiveAuthNames, skippedInteractiveAuth, skippedIrreversible };
 }
 
 /**
@@ -566,6 +573,7 @@ export async function runAudit(opts: RunAuditOptions): Promise<AuditScore> {
         eligible: tools,
         nonInteractiveAuthNames,
         skippedInteractiveAuth,
+        skippedIrreversible,
       } = partitionAuditTools(discoveredTools);
       const auditedToolCount = tools.length;
       const detectedButUnemitted = detectedButUnemittedTools(
@@ -603,6 +611,9 @@ export async function runAudit(opts: RunAuditOptions): Promise<AuditScore> {
           `skipping interactive auth ${skipped.name}: ${skipped.reason}; receipt=${skipped.verificationStatus}`,
         );
       }
+      for (const name of skippedIrreversible) {
+        log(`skipping irreversible workflow ${name}: live audit is intentionally disabled`);
+      }
 
       // Parameters that shipped live-unverified at compile time (Fix D). Tell the
       // auditor to probe them especially — these are the most likely to be broken
@@ -648,7 +659,7 @@ export async function runAudit(opts: RunAuditOptions): Promise<AuditScore> {
               tokenDeps,
             });
       if (auditedToolCount === 0) {
-        log('all discovered tools require human-interactive authentication; auditor not spawned');
+        log('all discovered tools are excluded from live audit; auditor not spawned');
       }
       recordLlmUsageSpan(
         'audit.llm_usage',
@@ -747,6 +758,7 @@ export async function runAudit(opts: RunAuditOptions): Promise<AuditScore> {
         'imprint.audit.detected_tool_count': detectedToolCount,
         'imprint.audit.detected_but_unemitted_count': detectedButUnemitted.length,
         'imprint.audit.skipped_interactive_auth_count': skippedInteractiveAuth.length,
+        'imprint.audit.skipped_irreversible_count': skippedIrreversible.length,
         'imprint.audit.verdict': score.verdict,
         'imprint.audit.unverified_and_ungradeable_count': unverifiedAndUngradeable.length,
         'imprint.audit.missing_tool_count': missingToolNames.length,
@@ -766,6 +778,7 @@ export async function runAudit(opts: RunAuditOptions): Promise<AuditScore> {
         detectedToolCount,
         detectedButUnemittedTools: detectedButUnemitted,
         skippedInteractiveAuth,
+        skippedIrreversible,
         ungradeableTools: ungradeableNames,
         /** Connected tools without an invocation record. A partial audit
          *  cannot pass merely because the auditor named an uncalled tool. */
@@ -808,6 +821,7 @@ export async function runAudit(opts: RunAuditOptions): Promise<AuditScore> {
           report: drive.report,
           auditedToolCount,
           skippedInteractiveAuth,
+          skippedIrreversible,
           detectedToolCount,
           detectedButUnemittedTools: detectedButUnemitted,
         });
@@ -1124,19 +1138,19 @@ export function buildUnverifiedParamNote(
     .map((u) => `${u.tool}(${u.params.join(', ')})`)
     .join(
       '; ',
-    )}. Give each one a \`parameters\` verdict (works / no_op / broken / untestable) like any other — do not let an unverified parameter pass without a differential test. Only skip probing when the tool is genuinely state-changing / irreversible, or when repeated paced attempts for that parameter stay blocked by infrastructure. A bot-defended idempotent read is still testable after the warm browser session is established.`;
+    )}. Give each one a \`parameters\` verdict (works / no_op / broken / untestable) like any other — do not let an unverified parameter pass without a differential test. Only skip probing when the connected tool is state-changing, or when repeated paced attempts for that parameter stay blocked by infrastructure. Irreversible tools are excluded before this prompt is built. A bot-defended idempotent read is still testable after the warm browser session is established.`;
 }
 
 export function buildAuditInitialPrompt(opts: DriveAuditOptions, unverifiedNote: string): string {
   const nonInteractiveAuthNames = opts.nonInteractiveAuthNames ?? [];
   const authNote = nonInteractiveAuthNames.length
-    ? `\n\nThe following authentication tool(s) are eligible because every action completes without a human pause: ${nonInteractiveAuthNames.join(', ')}. Call each exactly once with one safe baseline. Never differentially probe or retry authentication actions. If any DATA tool returns AUTH_EXPIRED, classify that invocation as infra/inconclusive evidence; do not call an authentication tool in response.`
+    ? `\n\nEligible unattended authentication tool(s): ${nonInteractiveAuthNames.join(', ')}. Apply the unattended authentication rules only to these tools, with at most one recovery authentication call total across this audit.`
     : '\n\nNo authentication tool is eligible in this audit. If a DATA tool returns AUTH_EXPIRED, classify that invocation as infra/inconclusive evidence; do not attempt to authenticate.';
   return `Audit every MCP tool connected to you for the site "${opts.site}".
 
 There are ${opts.toolNames.length} connected tool(s). For each one: read its description and input schema, invoke it with a realistic parameter set, judge the result, and classify each invocation as correct | tool_broken | infra | bad_params per your system prompt.
 
-Parameter coverage is mandatory for idempotent read tools. A cold cdp-replay/browser-backed first call may be slow because it launches or warms a trusted browser session, but later calls usually reuse that warm session and are much cheaper. Do NOT use the first call's cold-start latency as a reason to skip parameter probes. For search/list/calendar/lookup/quote/read tools, keep making paced sequential differential calls until each advertised parameter has a verdict, unless the same parameter remains blocked by infrastructure after repeated paced retries. For genuinely state-changing or irreversible tools (book/pay/send/cancel/delete/order), make only the safe baseline call and mark parameters untestable with that state-changing reason.
+Parameter coverage is mandatory for idempotent read tools. A cold cdp-replay/browser-backed first call may be slow because it launches or warms a trusted browser session, but later calls usually reuse that warm session and are much cheaper. Do NOT use the first call's cold-start latency as a reason to skip parameter probes. For search/list/calendar/lookup/quote/read tools, keep making paced sequential differential calls until each advertised parameter has a verdict, unless the same parameter remains blocked by infrastructure after repeated paced retries. For connected state-changing but reversible tools, make only one safe baseline call and mark parameters untestable with that state-changing reason. Irreversible workflows are never connected to this audit.
 
 Promo/coupon/voucher/discount-code parameters require a known valid code to prove a visible effect. If neither the schema nor another tool output gives you a valid code, classify that parameter as untestable; do not invent a random code and call an unchanged response no_op.
 
@@ -1592,6 +1606,7 @@ function printSummary(
     report: AuditReport;
     auditedToolCount: number;
     skippedInteractiveAuth: SkippedInteractiveAuth[];
+    skippedIrreversible: string[];
     detectedToolCount: number;
     detectedButUnemittedTools: DetectedButUnemittedTool[];
   },
@@ -1614,6 +1629,9 @@ function printSummary(
       `[imprint]   skipped interactive auth ${skipped.name} — ${skipped.reason}; verification receipt: ${skipped.verificationStatus}`,
     );
   }
+  for (const name of extra.skippedIrreversible) {
+    console.log(`[imprint]   skipped irreversible workflow ${name} — live audit disabled`);
+  }
   if (extra.detectedButUnemittedTools.length > 0) {
     console.log(
       `[imprint]   ${extra.detectedButUnemittedTools.length}/${extra.detectedToolCount} detected tool(s) were not emitted and are excluded from scoring: ${extra.detectedButUnemittedTools.map((tool) => tool.name).join(', ')}`,

package/src/imprint/auth-compile-agent.ts

@@ -27,6 +27,7 @@ import {
   AUTH_COMPILE_TOOL_NAMES,
   AUTH_VERIFICATION_ATTEMPT_SENTINEL,
   authExternalVerification,
+  authLivePreflightFailures,
   authWorkflowHash,
   authWorkflowPreflightFailures,
   buildAuthCompileTools,
@@ -85,20 +86,21 @@ function buildAuthInitialMessage(opts: {
   authToolPlan: NonNullable<AuthToolPlan>;
 }): string {
   const { site, toolName, toolDir, authToolPlan } = opts;
-  const headerCaptures = (authToolPlan.captures ?? []).filter((c) => {
+  const durableCaptures = (authToolPlan.captures ?? []).filter((c) => {
     const u = (c.usedAs ?? '').toLowerCase();
-    // Cookies persist automatically — only surface NON-cookie header contracts.
-    return u.startsWith('header:') && u !== 'header:cookie' && u !== 'header:set-cookie';
+    // Cookies persist automatically. Every other downstream transport needs a
+    // durable credential contract, including JSON/form body fields.
+    return u.length > 0 && u !== 'header:cookie' && u !== 'header:set-cookie';
   });
   const durableCaptureNote =
-    headerCaptures.length > 0
-      ? `\n- durable credential contracts (data tools consume these as \${credential.<name>}): ${headerCaptures
+    durableCaptures.length > 0
+      ? `\n- durable credential contracts (data tools consume these as \${credential.<name>}): ${durableCaptures
           .map(
             (c) => `${c.name} (used as ${c.usedAs}; seed source ${c.source}, locator ${c.locator})`,
           )
           .join(
             '; ',
-          )}\n  → Capture each value on the recording-grounded producing request and include its name in authConfig.persist. The seed source/locator is only a hint.`
+          )}\n  → These names are downstream credential interface names, not required internal capture names. Capture each value on the recording-grounded producing request and include the interface name in authConfig.persist. If you choose a different capture name, declare authConfig.persistBindings[interfaceName] = captureName. The seed source/locator is only a hint.`
       : '';
   return `A new auth compile task is starting.
 
@@ -456,10 +458,12 @@ async function runAuthSegmentLoop(opts: AuthSegmentLoopOptions): Promise<Compile
       const checkpointStartedAt = Date.now();
       try {
         if (cp.kind === 'run_verification') {
-          const preflightFailures = authWorkflowPreflightFailures(
+          const preflightFailures = await authLivePreflightFailures(
             opts.toolDir,
             opts.session,
             opts.authToolPlan.credentialNames,
+            [...opts.authToolPlan.credentialRequestSeqs, ...opts.authToolPlan.authRequestSeqs],
+            opts.sessionPath,
           );
           if (Date.now() >= activeDeadlineMs) {
             resultMsg =

package/src/imprint/auth-compile-tools.ts

@@ -10,17 +10,21 @@ import { join as pathJoin } from 'node:path';
 import type { AgentTool } from './agent.ts';
 import {
   type CompileToolContext,
+  bodyEncodingContractFailures,
   buildReadFileTool,
   buildReadRequestTool,
   buildReadResponseBodyTool,
   buildReadSessionSummaryTool,
-  buildRunBashTool,
+  buildRunTestsTool,
   buildSearchRequestsTool,
   buildWriteFileTool,
+  irreversibleProvenanceFailures,
+  requestEncodingTestContractFailures,
 } from './compile-tools.ts';
+import { isIrreversibleRequest, workflowHasIrreversibleEffect } from './effects.ts';
 import { recordedRequestMatchesWorkflow } from './recording-request.ts';
-import { captureHeader, captureValueMatches, jsonpath } from './request-capture.ts';
-import { type Session, type Workflow, WorkflowSchema } from './types.ts';
+import { captureHeader, captureValueMatches, resolveJsonCapture } from './request-capture.ts';
+import { type Session, type Workflow, WorkflowSchema, persistedCaptureName } from './types.ts';
 
 type TeachCredentials = { site: string; values: Record<string, string> };
 
@@ -40,7 +44,7 @@ export const AUTH_COMPILE_TOOL_NAMES = [
   'read_response_body',
   'write_file',
   'read_file',
-  'run_bash',
+  'run_tests',
   'run_verification',
   'inspect_verification_page',
   'prompt_user',
@@ -50,7 +54,7 @@ export const AUTH_COMPILE_TOOL_NAMES = [
 export function buildAuthCompileTools(
   session: Session,
   toolDir: string,
-  _sessionPath: string,
+  sessionPath: string,
   teachCredentials: TeachCredentials,
 ): AgentTool[] {
   const context: CompileToolContext = { teachCredentials };
@@ -61,7 +65,19 @@ export function buildAuthCompileTools(
     buildReadResponseBodyTool(session),
     buildWriteFileTool(toolDir),
     buildReadFileTool(toolDir),
-    buildRunBashTool(toolDir),
+    buildRunTestsTool(
+      toolDir,
+      sessionPath,
+      {
+        // Auth request/capture tests are offline and use synthetic credentials.
+        // Explicitly mask any inherited teach payload so agent-authored test
+        // output cannot expose real credentials to the compile model.
+        IMPRINT_TEACH_CREDENTIALS: '',
+      },
+      {
+        networkDisabled: session.requests.some(isIrreversibleRequest),
+      },
+    ),
   ];
 }
 
@@ -75,9 +91,57 @@ export function authWorkflowPreflightFailures(
   return parseWorkflow(workflowPath, requiredCredentialNames, session).failures;
 }
 
+export async function authLivePreflightFailures(
+  toolDir: string,
+  session?: Session,
+  requiredCredentialNames: readonly string[] = [],
+  authRequestSeqs: readonly number[] = [],
+  sessionPath = '',
+): Promise<string[]> {
+  const failures = authWorkflowPreflightFailures(toolDir, session, requiredCredentialNames);
+  if (failures.length > 0) return failures;
+  const parsed = parseWorkflow(
+    pathJoin(toolDir, 'workflow.json'),
+    requiredCredentialNames,
+    session,
+  );
+  if (!parsed.workflow) return parsed.failures;
+  const requestTestPath = pathJoin(toolDir, 'request.test.ts');
+  failures.push(
+    ...bodyEncodingContractFailures(parsed.workflow),
+    ...requestEncodingTestContractFailures(
+      parsed.workflow,
+      existsSync(requestTestPath) ? readFileSync(requestTestPath, 'utf8') : undefined,
+    ),
+    ...persistedCaptureTestContractFailures(
+      parsed.workflow,
+      existsSync(requestTestPath) ? readFileSync(requestTestPath, 'utf8') : undefined,
+    ),
+  );
+  if (session) {
+    failures.push(
+      ...irreversibleProvenanceFailures(session, parsed.workflow, {
+        candidateRequestSeqs: [...authRequestSeqs],
+      }),
+    );
+  }
+  if (workflowHasIrreversibleEffect(parsed.workflow)) {
+    failures.push('auth live verification is disabled for workflows with irreversible requests');
+  }
+  if (failures.length === 0 && existsSync(requestTestPath)) {
+    const testResult = await buildRunTestsTool(toolDir, sessionPath, undefined, {
+      networkDisabled: workflowHasIrreversibleEffect(parsed.workflow),
+    }).handler({});
+    if (testResult.isError) {
+      failures.push(`agent-authored request tests failed: ${testResult.result}`);
+    }
+  }
+  return failures;
+}
+
 export function authExternalVerification(
   toolDir: string,
-  requiredSessionCaptures: Array<{ name: string; usedAs?: string }> = [],
+  requiredDurableCredentials: Array<{ name: string; usedAs?: string }> = [],
   options: { requireLiveAttempt?: boolean; requiredCredentialNames?: readonly string[] } = {},
 ): string[] {
   const workflowPath = pathJoin(toolDir, 'workflow.json');
@@ -87,12 +151,27 @@ export function authExternalVerification(
   if (!parsed.workflow) return parsed.failures;
   const failures = [...parsed.failures];
   const workflow = parsed.workflow;
+  failures.push(...bodyEncodingContractFailures(workflow));
+  failures.push(
+    ...requestEncodingTestContractFailures(
+      workflow,
+      existsSync(pathJoin(toolDir, 'request.test.ts'))
+        ? readFileSync(pathJoin(toolDir, 'request.test.ts'), 'utf8')
+        : undefined,
+    ),
+    ...persistedCaptureTestContractFailures(
+      workflow,
+      existsSync(pathJoin(toolDir, 'request.test.ts'))
+        ? readFileSync(pathJoin(toolDir, 'request.test.ts'), 'utf8')
+        : undefined,
+    ),
+  );
   const persisted = new Set(workflow.authConfig?.persist ?? []);
 
-  const missingContracts = requiredSessionCaptures.filter((capture) => {
+  const missingContracts = requiredDurableCredentials.filter((capture) => {
     const target = (capture.usedAs ?? '').toLowerCase();
     return (
-      target.startsWith('header:') &&
+      target.length > 0 &&
       target !== 'header:cookie' &&
       target !== 'header:set-cookie' &&
       !persisted.has(capture.name)
@@ -100,7 +179,7 @@ export function authExternalVerification(
   });
   if (missingContracts.length > 0) {
     failures.push(
-      `authConfig.persist must include downstream credential capture(s): ${missingContracts
+      `authConfig.persist must include downstream credential interface(s): ${missingContracts
         .map((capture) => capture.name)
         .join(', ')}`,
     );
@@ -112,6 +191,25 @@ export function authExternalVerification(
   return failures;
 }
 
+function persistedCaptureTestContractFailures(
+  workflow: Workflow,
+  source: string | undefined,
+): string[] {
+  const persisted = workflow.authConfig?.persist ?? [];
+  if (persisted.length === 0) return [];
+  if (source === undefined) {
+    return [
+      'request.test.ts is required to prove persisted auth captures against their exact recorded response fields',
+    ];
+  }
+  return persisted
+    .filter((name) => !source.includes(`persisted-capture:${name}`))
+    .map(
+      (name) =>
+        `request.test.ts must include a passing "persisted-capture:${name}" test that independently decodes the recorded producer response and asserts the compiled capture equals that exact structured value`,
+    );
+}
+
 function parseWorkflow(
   path: string,
   requiredCredentialNames: readonly string[] = [],
@@ -274,17 +372,28 @@ function authProgramFailures(
   }
 
   if (!hasSuccess) failures.push('authConfig.actions has no success outcome');
+  const persistedCredentials = new Set(config.persist);
+  for (const credentialName of Object.keys(config.persistBindings ?? {})) {
+    if (!persistedCredentials.has(credentialName)) {
+      failures.push(
+        `authConfig.persistBindings declares unused credential ${JSON.stringify(credentialName)}`,
+      );
+    }
+  }
   for (const name of config.persist) {
-    if (!captures.has(name)) {
-      failures.push(`authConfig.persist references unknown capture ${JSON.stringify(name)}`);
+    const captureName = persistedCaptureName(config, name);
+    if (!captures.has(captureName)) {
+      failures.push(
+        `authConfig.persist credential ${JSON.stringify(name)} references unknown capture ${JSON.stringify(captureName)}`,
+      );
       continue;
     }
-    const owner = captureOwners.get(name);
+    const owner = captureOwners.get(captureName);
     if (!owner) continue;
     const { request, capture } = owner;
     if (request.recordingRequestSeq === undefined) {
       failures.push(
-        `persisted capture ${JSON.stringify(name)} must declare recordingRequestSeq on its producing request`,
+        `persisted capture ${JSON.stringify(captureName)} must declare recordingRequestSeq on its producing request`,
       );
     } else if (session) {
       const recorded = session.requests.find(
@@ -292,16 +401,16 @@ function authProgramFailures(
       );
       if (!recorded) {
         failures.push(
-          `persisted capture ${JSON.stringify(name)} references missing recorded request seq ${request.recordingRequestSeq}`,
+          `persisted capture ${JSON.stringify(captureName)} references missing recorded request seq ${request.recordingRequestSeq}`,
         );
       } else if (!recordedRequestMatchesWorkflow(recorded, request)) {
         failures.push(
-          `persisted capture ${JSON.stringify(name)} recordingRequestSeq ${request.recordingRequestSeq} does not match its workflow request`,
+          `persisted capture ${JSON.stringify(captureName)} recordingRequestSeq ${request.recordingRequestSeq} does not match its workflow request`,
         );
       } else {
         if (!recordedResponseProducesCapture(recorded, capture)) {
           failures.push(
-            `persisted capture ${JSON.stringify(name)} is not produced by recorded request seq ${request.recordingRequestSeq}`,
+            `persisted capture ${JSON.stringify(captureName)} is not produced by recorded request seq ${request.recordingRequestSeq}`,
           );
         }
       }
@@ -323,7 +432,7 @@ function recordedResponseProducesCapture(
   let value: unknown;
   if (capture.source === 'json') {
     try {
-      value = jsonpath(JSON.parse(body), capture.path);
+      value = resolveJsonCapture(JSON.parse(body), capture.path, capture.decodeJsonPath);
     } catch {
       return false;
     }

package/src/imprint/auth-verifier.ts

@@ -59,7 +59,7 @@ export class AuthVerifier {
   async runAction(
     action: string,
     parameters: Record<string, string | number | boolean> = {},
-    options: { freshSession?: boolean; cleanSession?: boolean } = {},
+    options: { freshSession?: boolean; cleanSession?: boolean; signal?: AbortSignal } = {},
   ): Promise<AuthActionResult> {
     if (options.freshSession || options.cleanSession) await this.reset();
     this.rememberSensitiveValues(parameters);
@@ -74,6 +74,7 @@ export class AuthVerifier {
       cdpPool: this.cdpPool,
       forceBackend: 'cdp-replay',
       initialState: this.continuation,
+      signal: options.signal,
     });
     const durationMs = Date.now() - startedAt;
     const result = ladder.result;