agentmetry 0.5.0__tar.gz → 0.6.0__tar.gz

{agentmetry-0.5.0 → agentmetry-0.6.0}/.gitignore

@@ -96,3 +96,7 @@ docs/*-review-*.md
 docs/*audit*prompt*.md
 docs/audit-*.md
 docs/*-audit-*.md
+
+# pytest-cov data file
+.coverage
+.coverage.*

{agentmetry-0.5.0 → agentmetry-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentmetry
-Version: 0.5.0
+Version: 0.6.0
 Summary: Local-first flight recorder for AI coding agents: hash-chained audit trail, MITRE-mapped sequence detection, DLP
 Project-URL: Homepage, https://agentmetry.ai
 Project-URL: Source, https://github.com/blitzcrieg1/agentmetry
@@ -35,8 +35,9 @@ Requires-Dist: uvicorn[standard]>=0.32.0
 Requires-Dist: websockets>=14.0
 Provides-Extra: dev
 Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
+Requires-Dist: pytest-cov>=6.0; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
-Requires-Dist: ruff==0.16.0; extra == 'dev'
+Requires-Dist: ruff==0.16.4; extra == 'dev'
 Description-Content-Type: text/markdown
 
 # Agentmetry

{agentmetry-0.5.0 → agentmetry-0.6.0}/agentmetry/cli/__init__.py

@@ -7,6 +7,7 @@ Pure stdlib + httpx; never imports the FastAPI app (fast startup, no side effect
 from __future__ import annotations
 
 import argparse
+import logging
 import os
 import shutil
 import socket
@@ -30,11 +31,13 @@ _TASK_NAME = "Agentmetry Orchestrator"
 # Paths bundled by backup, relative to the repo root.
 _BACKUP_PREFIXES = ("vault/", "apps/orchestrator/data/")
 _BACKUP_EXCLUDE_DIRS = {"logs"}
+logger = logging.getLogger(__name__)
+
 _BACKUP_EXCLUDE_SUFFIXES = {".pid"}
 
 
 def _base_url(port: int, host: str = "127.0.0.1") -> str:
-    display = host if host != "0.0.0.0" else "127.0.0.1"
+    display = host if host != "0.0.0.0" else "127.0.0.1"  # noqa: S104
     return f"http://{display}:{port}"
 
 
@@ -65,8 +68,12 @@ def _fetch_health(port: int) -> dict | None:
         resp = httpx.get(f"{_base_url(port)}/api/v1/health", timeout=10.0)
         if resp.status_code == 200:
             return resp.json()
-    except Exception:
-        pass
+    except Exception as exc:
+        # Not running is the expected answer here and `None` says so. Logged at
+        # debug anyway: a probe that fails for a reason other than "nothing is
+        # listening" (TLS, a proxy, a permission error) otherwise looks identical
+        # to a stopped orchestrator, and that is an hour of somebody's afternoon.
+        logger.debug("health probe on port %s failed: %s", port, exc)
     return None
 
 
@@ -77,7 +84,7 @@ def cmd_start(args: argparse.Namespace) -> int:
     host = getattr(args, "host", "127.0.0.1")
     if _fetch_health(args.port):
         print(f"Already running on {_base_url(args.port, host)}")
-        if host == "0.0.0.0":
+        if host == "0.0.0.0":  # noqa: S104
             _print_lan_hint(args.port)
         return 0
 
@@ -112,7 +119,7 @@ def cmd_start(args: argparse.Namespace) -> int:
     while time.monotonic() < deadline:
         if _fetch_health(args.port):
             print(f"Agentmetry running on {_base_url(args.port, host)} (pid {proc.pid})")
-            if host == "0.0.0.0":
+            if host == "0.0.0.0":  # noqa: S104
                 _print_lan_hint(args.port)
             return 0
         if proc.poll() is not None:
@@ -937,7 +944,7 @@ def cmd_verify(args: argparse.Namespace) -> int:
                 print(line)
             if source == "config" and not anchor_log.is_file():
                 print(f"    AGENTMETRY_ANCHOR_LOG points at {anchor_log}, which does not exist")
-            if not coverage.ok:
+            if coverage.tampering:
                 # The chain printed OK several lines ago and it was telling the
                 # truth: the file is internally consistent, because whoever
                 # rewrote it made it so. Leaving that as the last word would let
@@ -947,6 +954,17 @@ def cmd_verify(args: argparse.Namespace) -> int:
                     "published anchor. The file was rewritten."
                 )
                 return 1
+            if not coverage.ok:
+                # Checkpoints exist and none of them cover this file. Worth
+                # failing, because an operator who configured an anchor log
+                # believes they are anchored. Not worth calling tampering:
+                # nothing here contradicts the trail, and a trust command that
+                # says "rewritten" about a clean file gets muted.
+                print(
+                    "FAILED — no checkpoint in this anchor log covers this trail. "
+                    "Check AGENTMETRY_ANCHOR_LOG, or anchor this file."
+                )
+                return 1
             return 0
         print(f"FAILED — {result.message}")
         if result.first_bad_line:
@@ -1055,7 +1073,12 @@ def main(argv: list[str] | None = None) -> int:
     # platform. Same guard as scripts/demo.py.
     try:
         sys.stdout.reconfigure(encoding="utf-8")  # type: ignore[union-attr]
-    except Exception:  # pragma: no cover - depends on the host console
+    except Exception:  # noqa: S110  # pragma: no cover - host console dependent
+        # The one swallow with nowhere to swallow into: this runs before logging
+        # is configured, and the failure means the console cannot render UTF-8,
+        # which is also why a log line about it would not render. The fallback is
+        # the console's own encoding, which is what would have happened without
+        # the call.
         pass
 
     parser = argparse.ArgumentParser(prog="agentmetry", description="Agentmetry local ops")

{agentmetry-0.5.0 → agentmetry-0.6.0}/agentmetry/core/audit/detection/disposition.py

@@ -62,6 +62,44 @@ _NOTE_REQUIRED = frozenset({"false_positive", "risk_accepted"})
 #: States that mean no further action is expected.
 CLOSED_STATUSES = frozenset({"resolved", "false_positive", "risk_accepted"})
 
+
+def _loggable(value: object, *, limit: int = 120) -> str:
+    """Flatten a value so it cannot forge log lines.
+
+    `rule_id`, `decided_by` and the disposition keys derived from
+    `correlation_id` all originate outside this process: a rule id can come from
+    an operator's YAML, a correlation id comes from the agent. A newline in any
+    of them lets the writer append whatever they like to the orchestrator log,
+    including lines that look like ours.
+
+    The bound is worth stating precisely. The trail is unaffected: canonical
+    events are JSON and the encoder escapes a newline inside a string, so
+    evidence was never forgeable this way. This protects the operator log, which
+    is what a human reads while deciding whether the evidence is worth opening.
+
+    The replacements are written out one call at a time on purpose. An earlier
+    version did the same job with `str.encode("unicode_escape")`, which is
+    shorter and which CodeQL cannot follow, so `py/log-injection` stayed open on
+    code that was already fixed. A sanitizer the scanner does not recognise
+    leaves you arguing with a dashboard instead of reading it.
+
+    Line breaks become visible escapes rather than disappearing, so a value that
+    contained one still looks different from one that did not.
+    """
+    text = str(value)
+    if len(text) > limit:
+        text = text[: limit - 3] + "..."
+    # Backslash first, or the escapes introduced below get double-escaped.
+    text = text.replace("\\", "\\\\")
+    text = text.replace("\r", "\\r")
+    text = text.replace("\n", "\\n")
+    text = text.replace("\t", "\\t")
+    # Anything else non-printable (NUL, the ESC that starts an ANSI sequence)
+    # is dropped rather than escaped: it carries no meaning a reader needs and
+    # a terminal will act on some of it.
+    return "".join(ch for ch in text if ch.isprintable())
+
+
 _MAX_NOTE_CHARS = 4000
 _MAX_ASSIGNEE_CHARS = 128
 
@@ -234,7 +272,11 @@ class DispositionStore:
                     "DELETE FROM detection_dispositions WHERE detection_key = ?",
                     (stale_key,),
                 )
-                logger.info("Migrated disposition %s -> %s after rule rename", stale_key, key)
+                logger.info(
+                    "Migrated disposition %s -> %s after rule rename",
+                    _loggable(stale_key),
+                    _loggable(key),
+                )
 
         history.append({
             "status": normalized,
@@ -535,14 +577,18 @@ async def apply_disposition(
         try:
             await sink.emit(event)
         except Exception:
-            logger.exception("Failed to forward disposition for %s", rule_id)
+            logger.exception("Failed to forward disposition for %s", _loggable(rule_id))
 
+    # `previous` and `normalized` are validated against STATUSES before they get
+    # here, so passing them raw was safe and CodeQL kept flagging them anyway.
+    # Sanitizing a closed-set value is a no-op, and a no-op costs less than a
+    # dismissal somebody has to re-justify every time the tab is read.
     logger.info(
         "DISPOSITION %s %s -> %s by %s",
-        rule_id,
-        previous,
-        normalized,
-        decided_by or "operator",
+        _loggable(rule_id),
+        _loggable(previous),
+        _loggable(normalized),
+        _loggable(decided_by or "operator"),
     )
     return current
 

{agentmetry-0.5.0 → agentmetry-0.6.0}/agentmetry/core/audit/detection/yaml_config.py

@@ -2,11 +2,14 @@
 
 from __future__ import annotations
 
+import logging
 from pathlib import Path
 from typing import Any
 
 import yaml
 
+logger = logging.getLogger(__name__)
+
 _ORCH_ROOT = Path(__file__).resolve().parents[4]
 _DEFAULT_MANIFEST = _ORCH_ROOT.parent.parent / "policies" / "detection" / "manifest.yaml"
 
@@ -35,8 +38,11 @@ def _manifest_path() -> Path:
         custom = settings.detection_rules_path
         if custom:
             return Path(custom)
-    except Exception:
-        pass
+    except Exception as exc:
+        # Falling back to the packaged manifest is correct, but doing it in
+        # silence means an operator who configured their own rules runs the
+        # default ones and is never told.
+        logger.debug("could not read detection_rules_path from settings: %s", exc)
     return _DEFAULT_MANIFEST
 
 

{agentmetry-0.5.0 → agentmetry-0.6.0}/agentmetry/core/audit/ingest.py

@@ -3,7 +3,7 @@
 from __future__ import annotations
 
 import logging
-from typing import Any
+from typing import Any, NamedTuple
 
 from agentmetry.core.audit.detection.live import (
     build_detection_event,
@@ -177,7 +177,19 @@ def _get_sink():
     return _sink
 
 
-def _schema_payload_fields(payload: dict[str, Any]) -> tuple[str, str, int, str]:
+class _SchemaFields(NamedTuple):
+    """Parsed `mcp_schema` payload. A NamedTuple because it outgrew a tuple."""
+
+    server: str
+    fingerprint: str
+    tool_count: int
+    source: str
+    server_version: str
+    list_changed: bool | None
+    tool_digests: dict[str, str]
+
+
+def _schema_payload_fields(payload: dict[str, Any]) -> _SchemaFields:
     tool = payload.get("tool") if isinstance(payload.get("tool"), dict) else {}
     server = str(tool.get("server") or payload.get("server") or "")
     fingerprint = str(payload.get("schema_fingerprint") or "")
@@ -186,11 +198,34 @@ def _schema_payload_fields(payload: dict[str, Any]) -> tuple[str, str, int, str]
     except (TypeError, ValueError):
         tool_count = 0
     source = str(payload.get("adapter") or "mcp_proxy")
-    return server, fingerprint, tool_count, source
+    server_version = str(payload.get("server_version") or "")
+    list_changed = payload.get("list_changed")
+    if list_changed is not None and not isinstance(list_changed, bool):
+        list_changed = None
+    raw_digests = payload.get("schema_tool_digests")
+    tool_digests = (
+        {str(k): str(v) for k, v in raw_digests.items() if isinstance(v, str)}
+        if isinstance(raw_digests, dict)
+        else {}
+    )
+    return _SchemaFields(
+        server, fingerprint, tool_count, source, server_version, list_changed, tool_digests
+    )
+
+
+def build_schema_canonical(
+    payload: dict[str, Any], status: str, delta: dict[str, Any] | None = None
+) -> dict[str, Any]:
+    """Attestation that a `tools/list` was observed. Names and descriptions stay off it.
 
+    `delta` names which tools moved, and is only meaningful when the listing
+    changed. It carries hashed tool ids and counts, never a tool name and never
+    any part of a description: enough for an operator to say "that one" and
+    reach for an inspector, not enough to put the payload in the trail.
 
-def build_schema_canonical(payload: dict[str, Any], status: str) -> dict[str, Any]:
-    """Attestation that a `tools/list` was observed. Names and descriptions stay off it."""
+    The delta is passed in rather than computed here because it has to be read
+    before the store advances, and this function must stay pure.
+    """
     import uuid
     from datetime import datetime, timezone
 
@@ -199,13 +234,40 @@ def build_schema_canonical(payload: dict[str, Any], status: str) -> dict[str, An
     from agentmetry.core.audit.atlas import RUG_PULL
     from agentmetry.core.diagnostics.mcp_schema import server_id
 
-    server, fingerprint, tool_count, _source = _schema_payload_fields(payload)
+    fields = _schema_payload_fields(payload)
+    server, fingerprint, tool_count = fields.server, fields.fingerprint, fields.tool_count
+    server_version, list_changed = fields.server_version, fields.list_changed
     outcome = "changed" if status == "changed" else "success"
     reason = (
         "MCP tool schema changed; config may be unchanged (rug-pull candidate)"
         if status == "changed"
         else "MCP tool schema observed"
     )
+    mcp_schema: dict[str, Any] = {
+        "server_id": server_id(server) if server else "",
+        "fingerprint": fingerprint,
+        "tool_count": tool_count,
+        "status": status,
+        # Only a schema that MOVED is the technique. `new` is the first
+        # sight of a server and `same` is a quiet reconnect; tagging either
+        # as a rug pull would put a Defense Evasion label on installing a
+        # tool. ATT&CK has no id for this at all, which is the clearest
+        # case in the product for ATLAS existing alongside it.
+        **({"atlas": dict(RUG_PULL)} if status == "changed" else {}),
+    }
+    if server_version:
+        mcp_schema["server_version"] = server_version
+    if list_changed is not None:
+        mcp_schema["list_changed"] = list_changed
+    if status == "changed" and delta and (
+        delta.get("changed") or delta.get("added") or delta.get("removed")
+    ):
+        # Only on a move. A `new` server has nothing to diff against, and
+        # attaching an empty delta to `same` would put a field on the quietest
+        # event class in the trail for no reader.
+        mcp_schema["tools_changed"] = list(delta.get("changed") or [])
+        mcp_schema["tools_added"] = int(delta.get("added") or 0)
+        mcp_schema["tools_removed"] = int(delta.get("removed") or 0)
     return {
         "schema_version": SCHEMA_VERSION,
         "event_id": str(uuid.uuid4()),
@@ -223,21 +285,74 @@ def build_schema_canonical(payload: dict[str, Any], status: str) -> dict[str, An
         "actor": {"type": "system", "id": "agentmetry", "role": "recorder"},
         "action": {"type": "mcp_schema", "outcome": outcome, "reason": reason},
         "agent": {"name": "agentmetry", "skill_id": ""},
+        "mcp_schema": mcp_schema,
+    }
+
+
+def build_schema_unavailable_canonical(payload: dict[str, Any]) -> dict[str, Any]:
+    """A `tools/list` attempt that did not land.
+
+    Carries no fingerprint, because there is nothing to fingerprint, and no
+    ATLAS block, because a failed fetch is not a technique. `status` is
+    `unavailable` rather than an absence, so a SIEM can tell a server that has
+    not moved from one nobody managed to read.
+    """
+    import uuid
+    from datetime import datetime, timezone
+
+    from agentmetry.core.audit.canonical import SCHEMA_VERSION
+    from agentmetry.core.audit.identity import identity_fields
+    from agentmetry.core.diagnostics.mcp_schema import server_id
+
+    tool = payload.get("tool") if isinstance(payload.get("tool"), dict) else {}
+    server = str(tool.get("server") or payload.get("server") or "")
+    reason = str(payload.get("reason") or "tools/list failed")
+    return {
+        "schema_version": SCHEMA_VERSION,
+        "event_id": str(uuid.uuid4()),
+        "session_id": str(payload.get("session_id") or ""),
+        "correlation_id": str(payload.get("correlation_id") or payload.get("thread_id") or ""),
+        "timestamp_utc": str(payload.get("timestamp_utc") or datetime.now(timezone.utc).isoformat()),
+        **identity_fields(),
+        "source_topic": "agentmetry/mcp_schema",
+        "source": {
+            "tier": "external",
+            "app": str(payload.get("source_app") or "mcp_proxy"),
+            "adapter": str(payload.get("adapter") or "mcp_audit_proxy"),
+        },
+        "initiator": {"actor_type": "system", "trigger": "scheduled", "operator_id": ""},
+        "actor": {"type": "system", "id": "agentmetry", "role": "recorder"},
+        "action": {
+            "type": "mcp_schema",
+            "outcome": "unavailable",
+            "reason": f"MCP tools/list did not complete: {reason}",
+        },
+        "agent": {"name": "agentmetry", "skill_id": ""},
         "mcp_schema": {
             "server_id": server_id(server) if server else "",
-            "fingerprint": fingerprint,
-            "tool_count": tool_count,
-            "status": status,
-            # Only a schema that MOVED is the technique. `new` is the first
-            # sight of a server and `same` is a quiet reconnect; tagging either
-            # as a rug pull would put a Defense Evasion label on installing a
-            # tool. ATT&CK has no id for this at all, which is the clearest
-            # case in the product for ATLAS existing alongside it.
-            **({"atlas": dict(RUG_PULL)} if status == "changed" else {}),
+            "status": "unavailable",
         },
     }
 
 
+async def _ingest_unavailable_schema(payload: dict[str, Any]) -> dict[str, Any]:
+    """Record that a listing failed, and leave the stored baseline alone.
+
+    The store is untouched on purpose. Advancing it from a failure is the
+    mechanism that turns a flaky registry into a rug-pull alert, which is the
+    thing this event exists to stop.
+    """
+    from agentmetry.core.audit.trail_db import get_trail_db
+
+    canonical = build_schema_unavailable_canonical(payload)
+    get_trail_db().insert(canonical)
+    sink = _get_sink()
+    if sink is None:
+        raise RuntimeError("No audit sinks configured")
+    await sink.emit(canonical)
+    return canonical
+
+
 async def _ingest_observed_schema(payload: dict[str, Any]) -> dict[str, Any]:
     """Record a `tools/list` fingerprint. Emit a trail event only when it moves.
 
@@ -257,23 +372,39 @@ async def _ingest_observed_schema(payload: dict[str, Any]) -> dict[str, Any]:
     from agentmetry.core.audit.trail_db import get_trail_db
     from agentmetry.core.diagnostics.mcp_schema import (
         classify_observation,
+        classify_tool_delta,
         record_observation,
     )
 
-    server, fingerprint, tool_count, source = _schema_payload_fields(payload)
-    status = classify_observation(server, fingerprint)
-    canonical = build_schema_canonical(payload, status)
+    f = _schema_payload_fields(payload)
+    status = classify_observation(f.server, f.fingerprint, tool_count=f.tool_count)
+    # Read before the store advances. Afterwards the previous per-tool map is
+    # gone and the question "which tool moved" has no answer left.
+    delta = classify_tool_delta(f.server, f.tool_digests) if status == "changed" else None
+    canonical = build_schema_canonical(payload, status, delta)
+
+    def _advance() -> str:
+        return record_observation(
+            f.server,
+            f.fingerprint,
+            f.tool_count,
+            source=f.source,
+            server_version=f.server_version,
+            list_changed=f.list_changed,
+            tool_digests=f.tool_digests,
+        )
+
     if status == "same":
         # Only the timestamp moves, and nothing alerts on it, so there is
         # nothing to make durable first.
-        record_observation(server, fingerprint, tool_count, source=source)
+        _advance()
         return canonical
     get_trail_db().insert(canonical)
     sink = _get_sink()
     if sink is None:
         raise RuntimeError("No audit sinks configured")
     await sink.emit(canonical)
-    record_observation(server, fingerprint, tool_count, source=source)
+    _advance()
     return canonical
 
 
@@ -282,8 +413,11 @@ async def ingest_external_event(payload: dict[str, Any]) -> dict[str, Any]:
     if not settings.audit_ingest_enabled:
         raise ValueError("External audit ingest is disabled")
 
-    if str(payload.get("event_type") or "") == "mcp_schema":
+    event_type = str(payload.get("event_type") or "")
+    if event_type == "mcp_schema":
         return await _ingest_observed_schema(payload)
+    if event_type == "mcp_schema_unavailable":
+        return await _ingest_unavailable_schema(payload)
 
     canonical = build_external_canonical(payload)
 

{agentmetry-0.5.0 → agentmetry-0.6.0}/agentmetry/core/audit/trail_anchor.py

@@ -46,6 +46,7 @@ a range and the tail is named as what it is: chain-verified, not anchored.
 from __future__ import annotations
 
 import json
+import logging
 import os
 import platform
 from dataclasses import dataclass, field
@@ -55,6 +56,8 @@ from typing import Any, Protocol, runtime_checkable
 
 from agentmetry.core.audit.trail_merkle import merkle_root, read_leaves
 
+logger = logging.getLogger(__name__)
+
 ANCHOR_VERSION = 1
 ANCHOR_ALG = "rfc6962-sha256"
 
@@ -96,8 +99,13 @@ def resolve_anchor_log(
         configured = str(getattr(settings, "anchor_log_path", "") or "").strip()
         if configured:
             return Path(configured), "config"
-    except Exception:
-        pass
+    except Exception as exc:
+        # This one matters more than it looks. Falling back in silence means
+        # `verify` compares the trail against a log sitting beside it, which an
+        # attacker who rewrote one could rewrite as well. The operator configured
+        # an external anchor precisely to avoid that, and would never learn the
+        # setting was not read.
+        logger.debug("could not read anchor_log_path from settings: %s", exc)
     return anchor_path(Path(trail_path)), "default"
 
 
@@ -118,8 +126,8 @@ def default_host_id() -> str:
         configured = str(getattr(settings, "operator_id", "") or "").strip()
         if configured:
             return configured
-    except Exception:
-        pass
+    except Exception as exc:
+        logger.debug("could not read operator_id from settings: %s", exc)
     return platform.node() or "unknown-host"
 
 
@@ -311,6 +319,13 @@ class CheckpointResult:
     checkpoint: Checkpoint
     ok: bool
     message: str
+    # A checkpoint written for a different file says nothing about this one, in
+    # either direction. Scoring it as a failure made `verify --trail` report
+    # TAMPERING on a clean trail whenever AGENTMETRY_ANCHOR_LOG held checkpoints
+    # for another trail, which is the ordinary case after an export or a rename.
+    # A trust command that cries wolf on a good file gets muted, and then it is
+    # not a trust command.
+    applicable: bool = True
 
 
 @dataclass(frozen=True)
@@ -327,13 +342,29 @@ class AnchorCoverage:
     def ok(self) -> bool:
         return all(r.ok for r in self.results)
 
+    @property
+    def tampering(self) -> bool:
+        """A checkpoint that *does* cover this trail disagrees with it.
+
+        Distinct from `not ok`, which is also true when every checkpoint in the
+        log was written for some other file. That is a misconfiguration and
+        deserves saying, but calling it tampering is a false statement about a
+        file nothing has contradicted.
+        """
+        return any(r.applicable and not r.ok for r in self.results)
+
     @property
     def unanchored(self) -> int:
         return max(0, self.tree_size - self.anchored_through)
 
     @property
     def failures(self) -> list[CheckpointResult]:
-        return [r for r in self.results if not r.ok]
+        return [r for r in self.results if r.applicable and not r.ok]
+
+    @property
+    def not_applicable(self) -> list[CheckpointResult]:
+        """Checkpoints written for a different trail. Reported, never scored."""
+        return [r for r in self.results if not r.applicable]
 
 
 def verify_anchors(
@@ -350,6 +381,10 @@ def verify_anchors(
       chain alone cannot see;
     * the checkpoint is malformed — says nothing about the trail either way, and
       must not be scored as a pass.
+
+    A checkpoint naming a *different* trail is a fourth case and not a failure.
+    It is reported so the count is honest and then ignored, because scoring it
+    either way would be an opinion about a file it never committed to.
     """
     anchors = Path(anchor_file) if anchor_file else anchor_path(Path(trail_path))
     checkpoints = read_checkpoints(anchors)
@@ -360,7 +395,12 @@ def verify_anchors(
     for cp in checkpoints:
         if cp.trail_name and cp.trail_name != Path(trail_path).name:
             results.append(
-                CheckpointResult(cp, False, f"checkpoint is for a different trail ({cp.trail_name})")
+                CheckpointResult(
+                    cp,
+                    False,
+                    f"checkpoint is for a different trail ({cp.trail_name})",
+                    applicable=False,
+                )
             )
             continue
         try:
@@ -416,6 +456,15 @@ def coverage_lines(coverage: AnchorCoverage) -> list[str]:
     lines = [f"  anchors: {coverage.checkpoints} checkpoint(s)"]
     for failure in coverage.failures:
         lines.append(f"    TAMPERING — {failure.message}")
+    skipped = coverage.not_applicable
+    if skipped:
+        # Counted, not listed. One line stays readable when a shared anchor log
+        # holds hundreds of checkpoints for other trails.
+        names = sorted({r.checkpoint.trail_name for r in skipped if r.checkpoint.trail_name})
+        lines.append(
+            f"    {len(skipped)} checkpoint(s) skipped: written for "
+            f"{', '.join(names) or 'another trail'}, not this file"
+        )
 
     if coverage.anchored_through:
         lines.append(f"    records 1-{coverage.anchored_through} anchored")

{agentmetry-0.5.0 → agentmetry-0.6.0}/agentmetry/core/audit/trail_db.py

@@ -232,6 +232,13 @@ class AuditTrailDB:
         if before_utc and after_utc:
             raise ValueError("Use only one of before_utc or after_utc")
 
+        # The three f-string queries below are suppressed for S608. Every element
+        # of `clauses` is a literal built in this function, and the only
+        # interpolation inside one is `placeholders`, which is a run of "?".
+        # `focus` is validated against a closed set and raises on anything
+        # else. Every caller-supplied value reaches sqlite through `params`,
+        # never through the string. Adding a clause that interpolates a value
+        # would make the suppressions wrong, so add it as a "?" instead.
         where = f"WHERE {' AND '.join(clauses)}" if clauses else ""
 
         conn = self._get_conn()
@@ -239,7 +246,7 @@ class AuditTrailDB:
         if before_utc:
             sql = f"""SELECT event_json FROM audit_events {where}
                       {"AND" if clauses else "WHERE"} timestamp_utc < ?
-                      ORDER BY timestamp_utc DESC, id DESC LIMIT ?"""
+                      ORDER BY timestamp_utc DESC, id DESC LIMIT ?"""  # noqa: S608
             params.extend([before_utc, limit + 1])
             rows = conn.execute(sql, params).fetchall()
             has_older = len(rows) > limit
@@ -248,7 +255,7 @@ class AuditTrailDB:
         elif after_utc:
             sql = f"""SELECT event_json FROM audit_events {where}
                       {"AND" if clauses else "WHERE"} timestamp_utc > ?
-                      ORDER BY timestamp_utc ASC, id ASC LIMIT ?"""
+                      ORDER BY timestamp_utc ASC, id ASC LIMIT ?"""  # noqa: S608
             params.extend([after_utc, limit + 1])
             rows = conn.execute(sql, params).fetchall()
             has_newer = len(rows) > limit
@@ -257,7 +264,7 @@ class AuditTrailDB:
         else:
             # Latest page: get last N rows
             sql = f"""SELECT event_json FROM audit_events {where}
-                      ORDER BY timestamp_utc DESC, id DESC LIMIT ?"""
+                      ORDER BY timestamp_utc DESC, id DESC LIMIT ?"""  # noqa: S608
             params.append(limit + 1)
             rows = conn.execute(sql, params).fetchall()
             has_older = len(rows) > limit

{agentmetry-0.5.0 → agentmetry-0.6.0}/agentmetry/core/bus/events.py

@@ -20,7 +20,7 @@ ALERT_COST = "run/cost_alert"
 ALERT_DRIFT = "run/drift_alert"
 
 # High-volume, ephemeral — excluded from the outbox.
-LLM_TOKEN = "llm/token"
+LLM_TOKEN = "llm/token"  # noqa: S105  - an event topic name, not a credential
 
 # Vault
 VAULT_FILE_CHANGED = "vault/file_changed"