agent-postmortem 0.3.4__py3-none-any.whl

agent_postmortem/detectors/git_cwd_mismatch.py

@@ -0,0 +1,74 @@
+"""Detects a Bash command that ran outside any git repository.
+
+DESIGN.md 4.3: minor severity, fires on every anchored, not-in-payload
+'git_not_repo' MarkerHit (docs/DESIGN.md 4.13.2: the registry's own shape
+restricts this id to a tool_result paired to Bash). metrics: count.
+rule_id: R-GIT-CWD. Skips a read_only_output event (docs/DESIGN.md 4.3's
+self-reference rule): a read-only Bash call (cat, sed, git show/diff/log/
+grep/blame/cat-file, and the rest) quoting the marker from a file on disk
+is not a command that actually ran outside a git repository.
+"""
+
+from __future__ import annotations
+
+from .. import severity as severity_rules
+from ..models import Event, Finding, Run
+from .base import (
+    KINDS_BOTH,
+    Detector,
+    anchored_marker_hits,
+    event_for_marker_hit,
+    evidence_line,
+    make_finding_id,
+    single_agent_id,
+    tooling_attempts,
+)
+
+ID = "git_cwd_mismatch"
+SEVERITY = "minor"
+RULE_ID = "R-GIT-CWD"
+_REGISTRY_MARKER = "git_not_repo"
+
+
+class GitCwdMismatch:
+    id = ID
+    severity_default = SEVERITY
+    kinds = KINDS_BOTH
+
+    def run(self, run: Run) -> list[Finding]:
+        hits: list[Event] = []
+        hit_agents: list[str] = []
+        for attempt in tooling_attempts(run):
+            for hit in anchored_marker_hits(attempt, _REGISTRY_MARKER):
+                event = event_for_marker_hit(attempt, hit)
+                if event is None or event.read_only_output:
+                    continue
+                hits.append(event)
+                hit_agents.append(attempt.agent_id)
+        if not hits:
+            return []
+        agent_id = single_agent_id(hit_agents)
+
+        count = len(hits)
+        plural = "s" if count != 1 else ""
+        title = f"{count} Bash command{plural} ran outside a git repository"
+        evidence = [evidence_line(run, event) for event in hits]
+
+        return [
+            Finding(
+                detector=ID,
+                severity=severity_rules.resolve(run, ID),
+                title=title,
+                run_id=run.run_id,
+                agent_id=agent_id,
+                evidence=evidence,
+                metrics={"count": count},
+                rule_id=RULE_ID,
+                finding_id=make_finding_id(
+                    run.run_id, ID, agent_id, evidence[0] if evidence else None
+                ),
+            )
+        ]
+
+
+DETECTOR: Detector = GitCwdMismatch()

agent_postmortem/detectors/mislabeled_kill.py

@@ -0,0 +1,164 @@
+"""mislabeled_kill: an attempt's transcript ends with the runtime's kill
+sentinel, which Claude Code logs as "[Request interrupted by user]" even
+when no human pressed anything. reader.py sets Attempt.interrupt for every
+such attempt and attributes its cause against the parent transcript (docs/
+DESIGN.md 4.4); this detector turns each attributed interrupt into a
+Finding whose severity, title, and rule_id follow that cause. The main
+attempt of a session run is never evaluated here: run.attempts is child
+attempts only and never includes it (docs/DESIGN.md 4.3).
+"""
+
+from __future__ import annotations
+
+from .. import severity as severity_rules
+from ..models import Attempt, Event, Finding, Run
+from .base import KINDS_BOTH, Detector, anchored_marker_hits, evidence_line, make_finding_id
+
+
+def _kill_event(attempt: Attempt) -> Event | None:
+    """The kill sentinel event: the last 'user'-kind event in the attempt.
+    attempt.interrupt being set already guarantees one exists; this just
+    re-locates it for evidence purposes (Interrupt itself only carries its
+    timestamp, not the Event)."""
+    last_user_index = None
+    for index, event in enumerate(attempt.events):
+        if event.kind == "user":
+            last_user_index = index
+    return attempt.events[last_user_index] if last_user_index is not None else None
+
+
+def _backgrounded_precursor_line(attempt: Attempt) -> int | None:
+    """docs/DESIGN.md 4.4, 4.13.8: the transcript line of an anchored
+    bash_backgrounded tool_result (4.13.2) when it is the attempt's last tool
+    activity: no `tool_use` and no later `tool_result` event follows it in
+    the attempt (parallel calls can return out of order, so a later result of
+    another call also disqualifies it). None otherwise."""
+    last_tool = None
+    for index, event in enumerate(attempt.events):
+        if event.kind in ("tool_use", "tool_result"):
+            last_tool = index
+    if last_tool is None:
+        return None
+    last = attempt.events[last_tool]
+    if last.kind != "tool_result" or last.tool_use_id is None:
+        return None
+    for hit in anchored_marker_hits(attempt, "bash_backgrounded"):
+        if hit.event_line == last.line_no and hit.tool_use_id == last.tool_use_id:
+            return hit.event_line
+    return None
+
+
+def _severity_and_title(run: Run, attempt: Attempt) -> tuple[str, str]:
+    """Severity and title for attempt.interrupt.cause. The severity is the row
+    of docs/DESIGN.md 4.3's table for (cause, silence class, position); the
+    title keeps the four forms 4.4 specifies. "Consistent with a runtime kill"
+    is added to an unattributed interrupt after a long silence (the one 300 s
+    rule)."""
+    interrupt = attempt.interrupt
+    label = attempt.label
+    cause = interrupt.cause
+    silence = interrupt.silence_seconds
+    silence_class = severity_rules.silence_class(silence)
+    severity = severity_rules.resolve(
+        run, "mislabeled_kill", cause=cause, silence=silence_class,
+        position=severity_rules.position(run, attempt),
+    )
+
+    if cause == "parent_stop":
+        return severity, f"{label} stopped by the parent session"
+
+    if cause == "human":
+        return severity, f"{label} interrupted together with the parent session"
+
+    # The precursor clause only states what was observed just before the
+    # kill; it never says the backgrounding caused it (4.13.8).
+    precursor_line = _backgrounded_precursor_line(attempt)
+    precursor = (
+        f", after a Bash command was moved to the background (line {precursor_line})"
+        if precursor_line is not None else ""
+    )
+
+    if cause == "runtime":
+        silence_text = (
+            "unknown silence" if silence is None else f"{int(round(silence))}s of silence"
+        )
+        title = (
+            f"{label} attempt {attempt.ordinal} was killed by the runtime after "
+            f"{silence_text}{precursor}, logged as a user interrupt"
+        )
+        return severity, title
+
+    # unattributed
+    if silence is None:
+        return severity, f"{label} interrupted with silence unknown, cause unattributed"
+    base = (
+        f"{label} interrupted after {int(round(silence))}s of silence{precursor}, "
+        "cause unattributed"
+    )
+    if silence_class == "long":
+        return severity, f"{base}, consistent with a runtime kill"
+    return severity, base
+
+
+def _rule_id(cause: str, severity: str) -> str | None:
+    """R-MONITOR-RETRIES only when the cause is runtime, or when it is
+    unattributed and major (docs/DESIGN.md 4.3): the two cases where the
+    evidence itself points at the runtime, not at the parent session or a
+    human."""
+    if cause == "runtime":
+        return "R-MONITOR-RETRIES"
+    if cause == "unattributed" and severity == "major":
+        return "R-MONITOR-RETRIES"
+    return None
+
+
+class MislabeledKill:
+    id = "mislabeled_kill"
+    severity_default = "major"  # the highest row; the real severity comes from the table
+    kinds = KINDS_BOTH
+
+    def run(self, run: Run) -> list[Finding]:
+        findings: list[Finding] = []
+
+        for attempt in run.attempts:
+            interrupt = attempt.interrupt
+            if interrupt is None:
+                continue
+            kill_event = _kill_event(attempt)
+            if kill_event is None:
+                continue
+
+            severity, title = _severity_and_title(run, attempt)
+            rule_id = _rule_id(interrupt.cause, severity)
+
+            evidence = []
+            if interrupt.preceding is not None:
+                evidence.append(evidence_line(run, interrupt.preceding))
+            evidence.append(evidence_line(run, kill_event))
+            if interrupt.cause_evidence is not None:
+                evidence.append(evidence_line(run, interrupt.cause_evidence))
+
+            metrics = {
+                "silence_seconds": interrupt.silence_seconds,
+                "cause": interrupt.cause,
+                "events": len(attempt.events),
+            }
+
+            findings.append(Finding(
+                detector=self.id,
+                severity=severity,
+                title=title,
+                run_id=run.run_id,
+                agent_id=attempt.agent_id,
+                evidence=evidence,
+                metrics=metrics,
+                rule_id=rule_id,
+                finding_id=make_finding_id(
+                    run.run_id, self.id, attempt.agent_id, evidence[0] if evidence else None
+                ),
+            ))
+
+        return findings
+
+
+DETECTOR: Detector = MislabeledKill()

agent_postmortem/detectors/missing_artifact.py

@@ -0,0 +1,159 @@
+"""Detects an attempt told to write a file that never showed up.
+
+DESIGN.md 4.3, 4.13.4: info severity (D2), fires when an attempt's first user
+event names an absolute path it must write (a write/save/append/create/persist
+verb followed within 80 chars by a path ending .md/.json/.txt/.jsonl) and the
+path is not present at scan time. This is the only detector that touches
+anything outside the run directory, with claim_contradiction: one
+severity.absence() (an os.stat) on the named path and nothing else. The
+check is `observed_later`: the file may have existed when the run ended and
+been moved or removed since, and the finding's title says so. The `verified`
+metric records whether the path is under the home directory or /tmp.
+rule_id: R-ASSERT-ARTIFACT.
+"""
+
+from __future__ import annotations
+
+import re
+import tempfile
+from pathlib import Path
+
+from .. import severity as severity_rules
+from ..models import Attempt, Event, Finding, Run, TitleParts
+from .base import KINDS_BOTH, Detector, evidence_line, make_finding_id
+
+ID = "missing_artifact"
+SEVERITY = "info"  # the highest (only) row of docs/DESIGN.md 4.3
+RULE_ID = "R-ASSERT-ARTIFACT"
+_MAX_GAP = 80
+
+# A write/save/append/create/persist verb, then up to _MAX_GAP arbitrary
+# characters, then an absolute path ending in one of the artifact
+# extensions. The path itself is not length-limited, only its start. The
+# trailing (?!...) boundary keeps a longer filename that merely contains one
+# of the extensions (report.md.backup) from being truncated into a shorter
+# path that does not actually exist as its own file (report.md).
+_ARTIFACT_PATH_RE = re.compile(
+    r"""\b(?:write|save|append|create|persist)\b.{0,80}?(/[^\s,;:"'()]+\.(?:md|json|txt|jsonl))(?![A-Za-z0-9_.-])""",
+    re.IGNORECASE | re.DOTALL,
+)
+
+# A negation immediately before the verb ("Do not write ..."). Checked in a
+# short fixed window before the verb rather than a variable-length regex
+# lookbehind, which Python's re module does not support.
+_NEGATION_RE = re.compile(
+    r"\b(?:do\s+not|does\s+not|don't|never|must\s+not|should\s+not|won't|cannot|can't)\s*$",
+    re.IGNORECASE,
+)
+_NEGATION_WINDOW = 20
+
+# /tmp is kept literally (it is the conventional POSIX temp root real
+# prompts name, and what DESIGN.md's own fixtures use) and supplemented with
+# tempfile.gettempdir(), since on some machines and on any non-POSIX system
+# the OS temp root is elsewhere. gettempdir() is resolved lazily, inside
+# _allowed_roots() below, not here at import time: some sandboxes have no
+# discoverable temp directory at all, and gettempdir() raises in that case
+# (docs/DESIGN.md 4.3). Since detectors/__init__.py imports every detector
+# module eagerly, a module-level call here would crash importing
+# agent_postmortem itself -- including `agent-postmortem demo`, which needs
+# no filesystem access at all.
+_STATIC_ALLOWED_ROOTS = (Path.home(), Path("/tmp"))
+
+
+def _allowed_roots() -> tuple[Path, ...]:
+    """Path.home() and /tmp, plus tempfile.gettempdir() when it can be
+    resolved. A gettempdir() failure is tolerated as simply 'no extra temp
+    root' rather than propagated -- it is not evidence that a path is
+    untrusted, only that this one extra check could not run."""
+    try:
+        extra = Path(tempfile.gettempdir())
+    except OSError:
+        return _STATIC_ALLOWED_ROOTS
+    return _STATIC_ALLOWED_ROOTS + (extra,)
+
+def _first_user_event(attempt: Attempt) -> Event | None:
+    for event in attempt.events:
+        if event.kind == "user":
+            return event
+    return None
+
+
+def _is_under_allowed_root(path: Path) -> bool:
+    try:
+        resolved = path.resolve()
+    except OSError:
+        resolved = path
+    for root in _allowed_roots():
+        try:
+            resolved.relative_to(root.resolve())
+            return True
+        except (OSError, ValueError):
+            continue
+    return False
+
+
+_ABSENT_TEMPLATE = (
+    "{path} is absent now; the tool cannot tell whether it existed when the run ended"
+)
+_UNCHECKED_TEMPLATE = (
+    "{path} could not be checked now; the tool cannot tell whether it existed "
+    "when the run ended"
+)
+
+
+def _title_parts(path: str, state: str) -> TitleParts:
+    """D2 (docs/DESIGN.md 4.13.4): a check made now says nothing about the end of the run. The
+    title is a fixed template and the path (F fix 7, W7-2): a renderer formats it once and never
+    scans the result."""
+    template = _ABSENT_TEMPLATE if state == "absent_now" else _UNCHECKED_TEMPLATE
+    return TitleParts(template, path)
+
+
+def _title(path: str, state: str) -> str:
+    """The title with the real path (what `raw` prints)."""
+    return _title_parts(path, state).raw()
+
+
+class MissingArtifact:
+    id = ID
+    severity_default = SEVERITY
+    kinds = KINDS_BOTH
+
+    def run(self, run: Run) -> list[Finding]:
+        findings: list[Finding] = []
+        for attempt in run.attempts:
+            event = _first_user_event(attempt)
+            if event is None:
+                continue
+            for match in _ARTIFACT_PATH_RE.finditer(event.text):
+                preceding = event.text[max(0, match.start() - _NEGATION_WINDOW):match.start()]
+                if _NEGATION_RE.search(preceding):
+                    continue
+                path_str = match.group(1)
+                state = severity_rules.absence(path_str)
+                if state == "present_now":
+                    continue
+                verified = _is_under_allowed_root(Path(path_str))
+                severity = severity_rules.resolve(
+                    run, ID, obligation="prompt_path", absence=state,
+                )
+                evidence = [evidence_line(run, event)]
+                parts = _title_parts(path_str, state)
+                findings.append(
+                    Finding(
+                        detector=ID,
+                        severity=severity,
+                        title=parts.raw(),
+                        title_parts=parts,
+                        run_id=run.run_id,
+                        agent_id=attempt.agent_id,
+                        evidence=evidence,
+                        metrics={"paths": [path_str], "verified": verified},
+                        rule_id=RULE_ID,
+                        finding_id=make_finding_id(run.run_id, ID, attempt.agent_id, evidence[0]),
+                    )
+                )
+        return findings
+
+
+DETECTOR: Detector = MissingArtifact()

agent_postmortem/detectors/permission_denied.py

@@ -0,0 +1,99 @@
+"""Detects tool calls the runtime refused (docs/DESIGN.md 4.3, 4.13.2, 4.13.4; G7, v0.3.1).
+
+Fires on every anchored, not-in-payload `permission_denied` MarkerHit: an `is_error` tool result
+whose text starts with one of the runtime's four denial sentences (markers.denial_kind). One
+finding per attempt that holds at least one, the main thread of a session included (its finding
+carries no agent id and backs the run story), minor at every level.
+
+The title counts the denials by kind, zero counts omitted. Evidence is up to 5 `file:line`
+pointers and nothing else: the permission-rule sentence carries the denied command, so no excerpt
+of any denial reaches a finding. `read_only_output` is not consulted: the text is the runtime's
+own reply to the call, not output a command printed.
+"""
+
+from __future__ import annotations
+
+from .. import markers
+from .. import severity as severity_rules
+from ..models import Attempt, Event, Finding, Run
+from .base import (
+    KINDS_BOTH,
+    Detector,
+    anchored_marker_hits,
+    event_for_marker_hit,
+    make_finding_id,
+    relative_path,
+    tooling_attempts,
+)
+
+ID = "permission_denied"
+SEVERITY = "minor"
+MAX_EVIDENCE = 5
+
+# (kind, metrics key, title label), in the title's fixed order
+_KINDS = (
+    (markers.DENIAL_AUTO_MODE, "auto_mode", "auto mode"),
+    (markers.DENIAL_USER, "user", "user"),
+    (markers.DENIAL_PERMISSION_RULE, "permission_rule", "permission rule"),
+    (markers.DENIAL_SAFETY_CHECK, "safety_check", "safety check"),
+)
+
+
+def _attempt_denials(attempt: Attempt) -> list[tuple[Event, str]]:
+    """(event, kind) for every anchored denial of this attempt, in transcript order."""
+    ordered = sorted(
+        anchored_marker_hits(attempt, ID), key=lambda hit: (hit.event_line, hit.tool_use_id or ""),
+    )
+    found: list[tuple[Event, str]] = []
+    for hit in ordered:
+        event = event_for_marker_hit(attempt, hit)
+        if event is None:
+            continue
+        kind = markers.denial_prefix_kind(event.text)
+        if kind is None:  # cannot be classified: not claimed
+            continue
+        found.append((event, kind))
+    return found
+
+
+class PermissionDenied:
+    id = ID
+    severity_default = SEVERITY
+    kinds = KINDS_BOTH
+
+    def run(self, run: Run) -> list[Finding]:
+        findings: list[Finding] = []
+        for attempt in tooling_attempts(run):
+            denials = _attempt_denials(attempt)
+            if not denials:
+                continue
+            counts = {key: 0 for _kind, key, _label in _KINDS}
+            for _event, kind in denials:
+                for known, key, _label in _KINDS:
+                    if kind == known:
+                        counts[key] += 1
+            total = len(denials)
+            parts = [f"{label} {counts[key]}" for _k, key, label in _KINDS if counts[key]]
+            title = (
+                f"{total} tool {'call' if total == 1 else 'calls'} denied ({', '.join(parts)})"
+            )
+            evidence = [
+                f"{relative_path(run, event.path)}:{event.line_no}"
+                for event, _kind in denials[:MAX_EVIDENCE]
+            ]
+            agent_id = None if attempt is run.main else attempt.agent_id
+            findings.append(Finding(
+                detector=ID,
+                severity=severity_rules.resolve(run, ID),
+                title=title,
+                run_id=run.run_id,
+                agent_id=agent_id,
+                evidence=evidence,
+                metrics={"count": total, **counts},
+                rule_id=None,
+                finding_id=make_finding_id(run.run_id, ID, agent_id, evidence[0]),
+            ))
+        return findings
+
+
+DETECTOR: Detector = PermissionDenied()

agent_postmortem/detectors/silent_retry.py

@@ -0,0 +1,163 @@
+"""silent_retry: a logical agent (a journal key) was restarted more than once.
+
+The Workflow runtime silently discards a killed attempt and starts a fresh
+one under the same key; nothing in the journal calls this out as a failure.
+Every attempt before the last one for a key was thrown away, so its
+wall-clock time is wasted work. Fires once per key that shows more than one
+attempt, as a single Finding carrying every rule the retry backs in
+rule_ids: R-RETRY-SAFE always, plus R-CAP-CONCURRENCY too when two or more
+logical agents in the run started their first attempt within 5 seconds of
+each other (simultaneous launches are the observed trigger for paired
+stalls and kills) -- never two separate Findings for the same retry.
+
+Evidence never quotes a non-final attempt's own prompt (that text is
+user-authored and, for a retried key, is often the exact same prompt
+repeated verbatim on every attempt -- a privacy residual, not useful
+evidence). For each non-final attempt, evidence points at the kill sentinel
+line that ended it, when present (a runtime marker, docs/DESIGN.md section
+3, never something the agent or user wrote); an attempt whose transcript is
+missing or lacks a sentinel is simply omitted. Then, for the final attempt,
+one plain pointer line names where it started, with no excerpt at all:
+"<transcript>:<line>: attempt <ordinal> started". See docs/DESIGN.md
+section 4.3.
+"""
+
+from __future__ import annotations
+
+from .. import severity as severity_rules
+from ..markers import KILL_SENTINEL_PREFIX
+from ..models import Attempt, Event, Finding, Run
+from .base import (
+    KINDS_WORKFLOW_ONLY,
+    Detector,
+    attempt_seconds,
+    evidence_line,
+    format_duration,
+    make_finding_id,
+    relative_path,
+)
+
+_BURST_WINDOW_SECONDS = 5.0
+
+
+def _first_event(attempt: Attempt) -> Event | None:
+    return attempt.events[0] if attempt.events else None
+
+
+def _kill_sentinel_event(attempt: Attempt) -> Event | None:
+    """The attempt's last user event, if it starts with the kill sentinel
+    (docs/DESIGN.md section 3): the runtime's own marker, never the
+    attempt's own prompt text, so it is safe to quote as evidence. None when
+    the attempt has no events (a missing transcript) or its last user event
+    is not the sentinel."""
+    last_user: Event | None = None
+    for event in attempt.events:
+        if event.kind == "user":
+            last_user = event
+    if last_user is not None and last_user.text.startswith(KILL_SENTINEL_PREFIX):
+        return last_user
+    return None
+
+
+def _final_attempt_pointer(run: Run, attempt: Attempt) -> str | None:
+    """A plain path:line pointer at the final attempt's own start, with no
+    excerpt of its prompt (docs/DESIGN.md 4.5): a completed attempt's first
+    line is user-authored prompt text -- often the very same prompt every
+    other attempt of this key also carries -- so quoting it here would be
+    the same privacy residual this detector exists to avoid. None when the
+    attempt has no events (a missing transcript)."""
+    first_event = _first_event(attempt)
+    if first_event is None:
+        return None
+    path = relative_path(run, first_event.path)
+    return f"{path}:{first_event.line_no}: attempt {attempt.ordinal} started"
+
+
+def _run_has_burst(run: Run) -> bool:
+    """True when 2+ logical agents started their first attempt within 5s."""
+    starts = []
+    for agent in run.agents:
+        attempts = sorted(agent.attempts, key=lambda a: a.ordinal)
+        if attempts and attempts[0].first_ts is not None:
+            starts.append(attempts[0].first_ts)
+    starts.sort()
+    return any(
+        (later - earlier).total_seconds() <= _BURST_WINDOW_SECONDS
+        for earlier, later in zip(starts, starts[1:])
+    )
+
+
+class SilentRetry:
+    id = "silent_retry"
+    severity_default = "major"
+    kinds = KINDS_WORKFLOW_ONLY
+
+    def run(self, run: Run) -> list[Finding]:
+        findings: list[Finding] = []
+        burst = _run_has_burst(run)
+        work_risk: str | None = None  # run-level (4.13.4), read once and only when needed
+
+        for agent in run.agents:
+            attempts = sorted(agent.attempts, key=lambda a: a.ordinal)
+            if len(attempts) <= 1:
+                continue
+
+            non_final = attempts[:-1]
+            final = attempts[-1]
+            wasted_seconds = sum(attempt_seconds(attempt) for attempt in non_final)
+
+            evidence: list[str] = []
+            for attempt in non_final:
+                sentinel = _kill_sentinel_event(attempt)
+                if sentinel is not None:
+                    evidence.append(evidence_line(run, sentinel))
+            final_pointer = _final_attempt_pointer(run, final)
+            if final_pointer is not None:
+                evidence.append(final_pointer)
+
+            metrics = {
+                "attempts": len(attempts),
+                "keys": 1,
+                "wasted_seconds": wasted_seconds,
+                "burst": burst,
+            }
+            # docs/DESIGN.md 4.3: N attempts is N-1 restarts (2 attempts is
+            # one restart, not two) -- the honesty rule (section 2) means the
+            # title must count the thing it names, not the length of the
+            # list it was counted from.
+            restarts = len(attempts) - 1
+            restart_word = "time" if restarts == 1 else "times"
+            title = (
+                f"{agent.label} restarted {restarts} {restart_word}, "
+                f"{format_duration(wasted_seconds)} wasted"
+            )
+            agent_id = final.agent_id
+            if work_risk is None:
+                work_risk = severity_rules.work_risk(run)
+            severity = severity_rules.resolve(
+                run, self.id,
+                recovered=severity_rules.recovered(run, attempts[0], include_self=False),
+                work_risk=work_risk,
+            )
+            rule_ids = ("R-RETRY-SAFE", "R-CAP-CONCURRENCY") if burst else ("R-RETRY-SAFE",)
+            finding_id = make_finding_id(
+                run.run_id, self.id, agent_id, evidence[0] if evidence else None
+            )
+
+            findings.append(Finding(
+                detector=self.id,
+                severity=severity,
+                title=title,
+                run_id=run.run_id,
+                agent_id=agent_id,
+                evidence=evidence,
+                metrics=metrics,
+                rule_id=rule_ids[0],
+                rule_ids=rule_ids,
+                finding_id=finding_id,
+            ))
+
+        return findings
+
+
+DETECTOR: Detector = SilentRetry()