fleetproof 0.2.1__tar.gz → 0.3.0__tar.gz

{fleetproof-0.2.1/src/fleetproof.egg-info → fleetproof-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fleetproof
-Version: 0.2.1
+Version: 0.3.0
 Summary: Independent, out-of-band verification for agent fleets.
 Author: Gathrazio
 License: MIT
@@ -74,6 +74,7 @@ No language model sits in the grading path. Grading is comparison.
 | SubagentStop hook | The per-subagent gate: records what the agent claimed, grades it at that agent's tier, blocks a false "done". |
 | `fleetproof fleet` | The dispatch board: every dispatch, its state, its tier, and whether anything graded it. |
 | `fleetproof report` | One self-contained HTML file: per run, claimed-done vs. independently-verified. |
+| `fleetproof telemetry` | v0.3: per-dispatch outcome records, a local reliability summary, and a strict-allowlist export. |
 
 Runtime dependencies: none (Python standard library only). A tool whose job is
 being trustworthy should add as little dependency and supply-chain surface as it can.
@@ -207,6 +208,67 @@ transition trail, and which process wrote each transition.
   is also why the lookup is scoped to non-terminal dispatches: an agent id can be
   reused once a dispatch is closed out.
 
+## Verification telemetry (v0.3)
+
+The ledger records what happened to each dispatch. v0.3 turns those records into
+reliability data an operator can actually read — and, when they choose to, share.
+
+Enable it per repo with `.fleetproof/config.json`:
+
+```json
+{ "telemetry_era": "2026-08-21" }
+```
+
+From that date, every dispatch gains a `telemetry.json`, written on the checker/hook
+side at verdict or close time — never by the agent being measured. Runs from before
+the date read back as pre-telemetry and are never back-filled or guessed.
+
+Each finished dispatch derives one of nine **outcome classes** from its transition
+history — bookkeeping, not judgment:
+
+- `verified` — the claim survived the checks.
+- `near_miss` — a gate-blocked retry whose work product *changed* before passing:
+  a real failure, caught before acceptance.
+- `verifier_flake` — the retry passed with the work product *unchanged*: the
+  contradiction was wrong, not the work. Counted separately so flaky checks can't
+  inflate the near-miss number.
+- `contradicted` — the claim did not survive.
+- `ungraded` — checks existed but no verdict ever landed. This is a control
+  failure and every summary says so; it is never folded into a benign class.
+- `unverifiable` — reported, but nothing in the claim was checkable. Never counts
+  as success.
+- `silent_idle` / `terminated_unreported` / `terminated_unclassified` — died
+  without reporting, split by the recorded terminate reason.
+
+The commands:
+
+```
+fleetproof telemetry summary                  # local-only reliability read
+fleetproof telemetry loss <run-id>            # one question per failure: hours or dollars
+fleetproof telemetry export --recipient X     # allowlist extract for sharing
+fleetproof telemetry anchor                   # record the current chain head
+```
+
+`summary` prints outcome and severity distributions with their numerators and
+denominators spelled out, override rates, and the corpus's own integrity rates
+(stop-only captures, missing telemetry files) — a dataset that can't measure its
+own holes isn't worth reading.
+
+`export` is built the opposite way from most exports: a strict per-field
+**allowlist** — closed enums, counts, bands, versions, and salted identifiers.
+Free text, prompts, paths, and every name you chose yourself never leave the
+machine; timestamps coarsen to dates. Each export carries a completeness manifest
+(runs per day per class, gaps visible) and a methodology note that says plainly
+what `verified` means here: conformance to *your own declared checks* at a
+measured coverage — not a judgment of work quality.
+
+The honest trust model, stated rather than implied: local records are
+operator-attested. The checker writes verdicts from a separate process, and v0.3
+chains a rolling hash over the records as they're written (`anchor` gives you a
+head you can sign or store elsewhere) — but a local ledger on a shared filesystem
+is not tamper-proof against everything that can write to it, and FleetProof will
+not pretend otherwise.
+
 ## Install (each line is one command in Claude Code)
 
 ```

{fleetproof-0.2.1 → fleetproof-0.3.0}/README.md

@@ -53,6 +53,7 @@ No language model sits in the grading path. Grading is comparison.
 | SubagentStop hook | The per-subagent gate: records what the agent claimed, grades it at that agent's tier, blocks a false "done". |
 | `fleetproof fleet` | The dispatch board: every dispatch, its state, its tier, and whether anything graded it. |
 | `fleetproof report` | One self-contained HTML file: per run, claimed-done vs. independently-verified. |
+| `fleetproof telemetry` | v0.3: per-dispatch outcome records, a local reliability summary, and a strict-allowlist export. |
 
 Runtime dependencies: none (Python standard library only). A tool whose job is
 being trustworthy should add as little dependency and supply-chain surface as it can.
@@ -186,6 +187,67 @@ transition trail, and which process wrote each transition.
   is also why the lookup is scoped to non-terminal dispatches: an agent id can be
   reused once a dispatch is closed out.
 
+## Verification telemetry (v0.3)
+
+The ledger records what happened to each dispatch. v0.3 turns those records into
+reliability data an operator can actually read — and, when they choose to, share.
+
+Enable it per repo with `.fleetproof/config.json`:
+
+```json
+{ "telemetry_era": "2026-08-21" }
+```
+
+From that date, every dispatch gains a `telemetry.json`, written on the checker/hook
+side at verdict or close time — never by the agent being measured. Runs from before
+the date read back as pre-telemetry and are never back-filled or guessed.
+
+Each finished dispatch derives one of nine **outcome classes** from its transition
+history — bookkeeping, not judgment:
+
+- `verified` — the claim survived the checks.
+- `near_miss` — a gate-blocked retry whose work product *changed* before passing:
+  a real failure, caught before acceptance.
+- `verifier_flake` — the retry passed with the work product *unchanged*: the
+  contradiction was wrong, not the work. Counted separately so flaky checks can't
+  inflate the near-miss number.
+- `contradicted` — the claim did not survive.
+- `ungraded` — checks existed but no verdict ever landed. This is a control
+  failure and every summary says so; it is never folded into a benign class.
+- `unverifiable` — reported, but nothing in the claim was checkable. Never counts
+  as success.
+- `silent_idle` / `terminated_unreported` / `terminated_unclassified` — died
+  without reporting, split by the recorded terminate reason.
+
+The commands:
+
+```
+fleetproof telemetry summary                  # local-only reliability read
+fleetproof telemetry loss <run-id>            # one question per failure: hours or dollars
+fleetproof telemetry export --recipient X     # allowlist extract for sharing
+fleetproof telemetry anchor                   # record the current chain head
+```
+
+`summary` prints outcome and severity distributions with their numerators and
+denominators spelled out, override rates, and the corpus's own integrity rates
+(stop-only captures, missing telemetry files) — a dataset that can't measure its
+own holes isn't worth reading.
+
+`export` is built the opposite way from most exports: a strict per-field
+**allowlist** — closed enums, counts, bands, versions, and salted identifiers.
+Free text, prompts, paths, and every name you chose yourself never leave the
+machine; timestamps coarsen to dates. Each export carries a completeness manifest
+(runs per day per class, gaps visible) and a methodology note that says plainly
+what `verified` means here: conformance to *your own declared checks* at a
+measured coverage — not a judgment of work quality.
+
+The honest trust model, stated rather than implied: local records are
+operator-attested. The checker writes verdicts from a separate process, and v0.3
+chains a rolling hash over the records as they're written (`anchor` gives you a
+head you can sign or store elsewhere) — but a local ledger on a shared filesystem
+is not tamper-proof against everything that can write to it, and FleetProof will
+not pretend otherwise.
+
 ## Install (each line is one command in Claude Code)
 
 ```

{fleetproof-0.2.1 → fleetproof-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fleetproof"
-version = "0.2.1"
+version = "0.3.0"
 description = "Independent, out-of-band verification for agent fleets."
 readme = "README.md"
 requires-python = ">=3.10"

{fleetproof-0.2.1 → fleetproof-0.3.0}/src/fleetproof/cli.py

@@ -15,6 +15,8 @@ surface as it can. Subcommands:
     subagent-stop  SubagentStop-hook entry: the per-subagent report-and-verify gate
     dispatch  ledger verbs: new / report / close a dispatch
     fleet     the dispatch board — every dispatch, its state, and whether it reported
+    telemetry summary (local-only aggregates) / export (allowlisted bundle) /
+              anchor (chain head) / loss (the one raw-loss question per failure)
 
 Output is plain ASCII on purpose: these commands get read in cp1252 consoles on
 Windows, where a stray unicode glyph is a UnicodeEncodeError, not a nicer table.
@@ -27,7 +29,7 @@ import json
 import os
 import shutil
 import sys
-from datetime import datetime, timedelta, timezone
+from datetime import date, datetime, timedelta, timezone
 from pathlib import Path
 
 # The CLI must not record its own invocations.
@@ -51,6 +53,8 @@ from .hookgate import (
     subagent_stop_main,
 )
 from .ledger import (
+    REASON_OPERATOR_CLOSE,
+    VALID_TERMINATE_REASONS,
     LedgerError,
     close_dispatch,
     create_dispatch,
@@ -76,6 +80,7 @@ from .runlog import (
     project_root,
     runs_dir,
 )
+from .telemetry import TelemetryError, build_telemetry, record_failure_loss
 
 
 def _cmd_init(args: argparse.Namespace) -> int:
@@ -348,10 +353,19 @@ def _cmd_dispatch_report(args: argparse.Namespace) -> int:
 
 def _cmd_dispatch_close(args: argparse.Namespace) -> int:
     try:
-        record = close_dispatch(args.run_id)
+        record = close_dispatch(args.run_id, reason=args.reason)
     except LedgerError as e:
         _emit_error("ledger_error", str(e), args.format)
         return 1
+    # The close finalizes the lifecycle, so the telemetry record derives here.
+    # Best-effort: a telemetry failure must not turn a successful close into a
+    # failed command — the summary surfaces the missing record as an integrity
+    # defect instead.
+    try:
+        build_telemetry(record.run_id)
+    except Exception as e:
+        print(f"[fleetproof] telemetry build failed for {record.run_id}: {e}",
+              file=sys.stderr)
     if args.format == "json":
         print(json.dumps(record.to_dict(), indent=2))
     else:
@@ -416,6 +430,105 @@ def _cmd_fleet(args: argparse.Namespace) -> int:
     return 0
 
 
+def _parse_date(value: str | None, label: str) -> "date | None":
+    if value is None:
+        return None
+    try:
+        return date.fromisoformat(value)
+    except ValueError as e:
+        raise ValueError(f"--{label} must be YYYY-MM-DD: {e}") from e
+
+
+def _cmd_telemetry_summary(args: argparse.Namespace) -> int:
+    from .telemetry_export import summarize
+    summary = summarize()
+    if args.format == "json":
+        print(json.dumps(summary, indent=2))
+        return 0
+    print("Telemetry summary (LOCAL-ONLY: clear-text names and exact times;")
+    print("anything shareable goes through `fleetproof telemetry export`).")
+    for name, block in summary["windows"].items():
+        counts = block["counts"]
+        shown = {k: v for k, v in counts.items() if v}
+        print(f"\n[{name}] {block['total_dispatches']} dispatch(es), "
+              f"{block['classifiable_dispatches']} classifiable")
+        print(f"  outcomes: {shown if shown else 'none'}")
+        for metric in ("delivery_failure_rate", "false_claim_rate",
+                       "near_miss_rate", "verifier_flake_rate",
+                       "ungraded_rate", "unverifiable_rate",
+                       "telemetry_missing_rate", "stop_only_fraction"):
+            m = block[metric]
+            rate = f"{m['rate']:.3f}" if m["rate"] is not None else "n/a"
+            print(f"  {metric}: {m['numerator']}/{m['denominator']} = {rate}")
+        sev = block["severity_distribution"]
+        print(f"  severity: {({k: v for k, v in sev.items() if v}) or 'no failures'}")
+        override = block["override_rate_by_source"]
+        for source in ("hook", "operator"):
+            m = override[source]
+            rate = f"{m['rate']:.3f}" if m["rate"] is not None else "n/a"
+            print(f"  override_rate[{source}]: {m['numerator']}/{m['denominator']} = {rate}")
+    timeline = summary["spec_hash_timeline"]
+    if timeline:
+        print("\nspec-hash timeline:")
+        for entry in timeline:
+            print(f"  {entry['first_seen']}  {short_spec_hash(entry['spec_sha256'])}")
+    return 0
+
+
+def _cmd_telemetry_export(args: argparse.Namespace) -> int:
+    from .telemetry_export import export_telemetry
+    try:
+        since = _parse_date(args.since, "since")
+        until = _parse_date(args.until, "until")
+    except ValueError as e:
+        _emit_error("bad_date", str(e), args.format)
+        return 2
+    try:
+        out = export_telemetry(
+            args.recipient,
+            out_dir=Path(args.output) if args.output else None,
+            since=since, until=until)
+    except TelemetryError as e:
+        _emit_error("telemetry_error", str(e), args.format)
+        return 1
+    if args.format == "json":
+        print(json.dumps({"ok": True, "export_dir": str(out)}))
+    else:
+        print(f"Wrote export bundle to {out}")
+        print("Label: identified, minimized (single-party exports are "
+              "identified by construction).")
+    return 0
+
+
+def _cmd_telemetry_anchor(args: argparse.Namespace) -> int:
+    from .telemetry_export import anchor_chain
+    anchor = anchor_chain()
+    if args.format == "json":
+        print(json.dumps(anchor, indent=2))
+    else:
+        print(f"chain head: {anchor['chain_head']}")
+        print(f"entries:    {anchor['chain_entries']}")
+        print(anchor["note"])
+    return 0
+
+
+def _cmd_telemetry_loss(args: argparse.Namespace) -> int:
+    try:
+        telemetry = record_failure_loss(
+            args.run_id, args.value, args.unit,
+            default_accepted=args.default_accepted or None)
+    except TelemetryError as e:
+        _emit_error("telemetry_error", str(e), args.format)
+        return 1
+    if args.format == "json":
+        print(json.dumps(telemetry, indent=2))
+    else:
+        print(f"{args.run_id}: severity {telemetry['failure.severity_band']} "
+              f"(floor {telemetry['failure.severity_floor']}), "
+              f"loss {telemetry['failure.estimated_loss']}")
+    return 0
+
+
 def _emit_error(code: str, message: str, fmt: str) -> None:
     if fmt == "json":
         print(json.dumps({"ok": False, "error_code": code, "message": message}), file=sys.stderr)
@@ -508,9 +621,54 @@ def build_parser() -> argparse.ArgumentParser:
 
     p_dclose = dsub.add_parser("close", help="Terminate a dispatch.")
     p_dclose.add_argument("run_id")
+    # Defaulted, not required: the CLI is the operator's close path, so the
+    # honest machine-set reason for it is operator-close. Scripted sweepers and
+    # session-teardown callers override it to say what they actually are.
+    p_dclose.add_argument(
+        "--reason", choices=sorted(VALID_TERMINATE_REASONS),
+        default=REASON_OPERATOR_CLOSE,
+        help="Why this dispatch is being terminated (default: operator-close).")
     _add_format(p_dclose)
     p_dclose.set_defaults(func=_cmd_dispatch_close)
 
+    p_tel = sub.add_parser("telemetry", help="Verification-telemetry surfaces.")
+    tsub = p_tel.add_subparsers(dest="telemetry_command", required=True)
+
+    p_tsum = tsub.add_parser(
+        "summary",
+        help="Local-only outcome/severity/integrity summary with trailing windows.")
+    _add_format(p_tsum)
+    p_tsum.set_defaults(func=_cmd_telemetry_summary)
+
+    p_texp = tsub.add_parser(
+        "export",
+        help="Write the allowlisted, date-bucketed export bundle for one recipient.")
+    p_texp.add_argument("--recipient", required=True,
+                        help="Counterparty label; selects (or mints) the export salt.")
+    p_texp.add_argument("-o", "--output", default=None, help="Output directory.")
+    p_texp.add_argument("--since", default=None, help="Window start, YYYY-MM-DD.")
+    p_texp.add_argument("--until", default=None, help="Window end, YYYY-MM-DD.")
+    _add_format(p_texp)
+    p_texp.set_defaults(func=_cmd_telemetry_export)
+
+    p_tanc = tsub.add_parser(
+        "anchor",
+        help="Record the telemetry chain head as an anchorable value.")
+    _add_format(p_tanc)
+    p_tanc.set_defaults(func=_cmd_telemetry_anchor)
+
+    p_tloss = tsub.add_parser(
+        "loss",
+        help="Record the one raw loss quantity for a failed run (hours or usd).")
+    p_tloss.add_argument("run_id")
+    p_tloss.add_argument("--value", type=float, required=True,
+                         help="The raw quantity; the band is derived, never chosen.")
+    p_tloss.add_argument("--unit", choices=["hours", "usd"], required=True)
+    p_tloss.add_argument("--default-accepted", action="store_true",
+                         help="The suggested default was accepted unchanged.")
+    _add_format(p_tloss)
+    p_tloss.set_defaults(func=_cmd_telemetry_loss)
+
     p_fleet = sub.add_parser("fleet", help="The dispatch board, newest first.")
     p_fleet.add_argument("--open", action="store_true",
                          help="Only dispatches that have not terminated.")

fleetproof-0.3.0/src/fleetproof/config.py

@@ -0,0 +1,131 @@
+"""Deployment-level telemetry configuration.
+
+Verification telemetry needs a handful of facts that are properties of the
+*deployment*, not of any single run: when telemetry capture was turned on, what
+kind of work this deployment does, and how the operator wants it identified in
+aggregates. Asking per run would violate the "automatic or it won't exist"
+posture, so they live in one JSON file the operator edits once:
+
+    .fleetproof/config.json
+    {
+      "telemetry_era": "2026-08-20",
+      "run_context": "production",
+      "deployment_id": "my-fleet",
+      "operator_id": "me",
+      "eval_suite_id": null
+    }
+
+Everything is optional and the file itself is optional: an absent or unreadable
+config reads back as empty, and every consumer treats a missing value as "not
+configured" rather than inventing one.
+
+``telemetry_era`` is the dated cutover that marks when this deployment started
+capturing telemetry. It is stamped into each dispatch record *at creation* so
+era membership is a property of the dispatch itself, never inferred from
+whether a telemetry file happens to exist later — file absence is deletable,
+a stamp written at dispatch time is on the record the aggregate reads.
+
+The config file is resolved next to the runs directory (the ``.fleetproof/``
+project marker), so tests that override the runs dir get an isolated config
+for free, the same way the drift marker does.
+"""
+
+from __future__ import annotations
+
+import json
+from datetime import date, datetime, timezone
+from pathlib import Path
+from typing import Any
+
+from .runlog import runs_dir
+
+CONFIG_FILENAME = "config.json"
+
+# The kinds of work a deployment can declare itself to be doing. An aggregate
+# that cannot tell real work from drills or synthetic load is worth less than
+# one that can, so the value is per-deployment config — never per-run prompting,
+# and never guessed from the work itself.
+RUN_CONTEXT_PRODUCTION = "production"
+RUN_CONTEXT_DEVELOPMENT = "development"
+RUN_CONTEXT_DRILL = "drill"
+RUN_CONTEXT_SYNTHETIC = "synthetic"
+VALID_RUN_CONTEXTS = frozenset({
+    RUN_CONTEXT_PRODUCTION,
+    RUN_CONTEXT_DEVELOPMENT,
+    RUN_CONTEXT_DRILL,
+    RUN_CONTEXT_SYNTHETIC,
+})
+
+
+def config_path() -> Path:
+    return runs_dir().parent / CONFIG_FILENAME
+
+
+def load_config() -> dict[str, Any]:
+    """The deployment config, or an empty dict when absent/unreadable.
+
+    A malformed config must not take down a hook, so every failure mode reads
+    as "not configured" — the consequence is a pre-telemetry-shaped record,
+    which is the honest description of a deployment whose config is broken.
+    """
+    try:
+        data = json.loads(config_path().read_text(encoding="utf-8-sig"))
+    except (OSError, json.JSONDecodeError):
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def telemetry_era_stamp(config: dict[str, Any] | None = None) -> str | None:
+    """The era value to stamp onto a dispatch created now, or None.
+
+    Returns the configured cutover date string once the cutover date has
+    arrived; a future-dated cutover (or no cutover at all) yields None, and the
+    dispatch is created pre-telemetry. The comparison is by date, matching the
+    granularity the config declares.
+    """
+    cfg = config if config is not None else load_config()
+    raw = cfg.get("telemetry_era")
+    if not isinstance(raw, str) or not raw.strip():
+        return None
+    try:
+        cutover = date.fromisoformat(raw.strip())
+    except ValueError:
+        return None
+    if datetime.now(timezone.utc).date() < cutover:
+        return None
+    return raw.strip()
+
+
+def run_context(config: dict[str, Any] | None = None) -> str:
+    """The deployment's declared run context; ``production`` when unconfigured.
+
+    Defaulting to ``production`` is deliberate: a deployment that never touched
+    the config is doing its real work, and letting real work default into a
+    discounted bucket would under-count the corpus that matters. Drills and
+    synthetic load are the exceptional cases, so they are the ones that require
+    an explicit declaration. An unknown value degrades to the default rather
+    than crashing a hook on a typo.
+    """
+    cfg = config if config is not None else load_config()
+    value = cfg.get("run_context")
+    if isinstance(value, str) and value in VALID_RUN_CONTEXTS:
+        return value
+    return RUN_CONTEXT_PRODUCTION
+
+
+def _config_str(key: str, config: dict[str, Any] | None = None) -> str | None:
+    cfg = config if config is not None else load_config()
+    value = cfg.get(key)
+    return value if isinstance(value, str) and value.strip() else None
+
+
+def deployment_id(config: dict[str, Any] | None = None) -> str | None:
+    return _config_str("deployment_id", config)
+
+
+def operator_id(config: dict[str, Any] | None = None) -> str | None:
+    return _config_str("operator_id", config)
+
+
+def eval_suite_id(config: dict[str, Any] | None = None) -> str | None:
+    return _config_str("eval_suite_id", config)

{fleetproof-0.2.1 → fleetproof-0.3.0}/src/fleetproof/hookgate.py

@@ -41,7 +41,13 @@ from typing import Any
 
 from pathlib import Path
 
-from .checker import run_checks, select_checks, session_spec_baseline, spec_drifted
+from .checker import (
+    CheckReport,
+    run_checks,
+    select_checks,
+    session_spec_baseline,
+    spec_drifted,
+)
 from .checks import (
     SPEC_DRIFT_NOTE,
     CheckSpecError,
@@ -66,6 +72,7 @@ from .ledger import (
     record_verdict,
 )
 from .runlog import SESSION_ID_ENV, record, runs_dir
+from .telemetry import build_telemetry
 
 
 def _read_hook_input() -> dict[str, Any]:
@@ -433,13 +440,34 @@ def _pin_drift_reason(pinned: str | None, current: str | None) -> str:
 
 
 def _try_close(run_id: str) -> None:
-    """Terminate a dispatch, tolerating an already-closed one."""
+    """Terminate a dispatch, tolerating an already-closed one.
+
+    No terminate reason is passed: the reason vocabulary exists to split apart
+    the ways a dispatch dies *from ``dispatched``*, and this close only ever
+    runs after a report is on record (post-verdict, or post-grading with an
+    empty selection) — a state where the reason plays no part in how the
+    outcome reads back.
+    """
     try:
         close_dispatch(run_id, by="hook")
     except LedgerError as e:
         sys.stderr.write(f"[fleetproof] could not close dispatch {run_id}: {e}\n")
 
 
+def _try_build_telemetry(run_id: str, check_report=None, checks=None) -> None:
+    """Best-effort telemetry build, on the checker's side of the boundary.
+
+    A telemetry failure must not wedge the gate. The cost of swallowing one is
+    an era-stamped run without telemetry.json — which the summary surfaces as
+    a ``telemetry_missing`` integrity defect, the visible form a capture
+    failure is supposed to take.
+    """
+    try:
+        build_telemetry(run_id, check_report=check_report, checks=checks)
+    except Exception as e:
+        sys.stderr.write(f"[fleetproof] telemetry build failed for {run_id}: {e}\n")
+
+
 def subagent_stop(payload: dict[str, Any]) -> tuple[dict[str, Any] | None, int]:
     """The per-subagent gate. Returns ``(decision_or_None, exit_code)``.
 
@@ -526,6 +554,14 @@ def subagent_stop(payload: dict[str, Any]) -> tuple[dict[str, Any] | None, int]:
     selected = select_checks(checks, dispatch.tier) if checks else []
     if not selected:
         _try_close(dispatch.run_id)
+        # The grading *happened* and selected nothing — recorded as an empty
+        # CheckReport so the telemetry layer can tell "checked nothing on
+        # purpose" (unverifiable) apart from "grading never ran" (ungraded).
+        _try_build_telemetry(
+            dispatch.run_id,
+            check_report=CheckReport(spec_sha256=spec_hash(), tier=dispatch.tier),
+            checks=[],
+        )
         return None, 0
 
     report = run_checks(selected, record_to_log=True, tier=dispatch.tier)
@@ -536,6 +572,7 @@ def subagent_stop(payload: dict[str, Any]) -> tuple[dict[str, Any] | None, int]:
             detail="; ".join(r.id for r in report.blocking_failures),
             by=VERDICT_BY,
         )
+        _try_build_telemetry(dispatch.run_id, check_report=report, checks=selected)
         return _subagent_block(_failure_reason(report), _evidence_context(report)), 0
 
     record_verdict(
@@ -545,6 +582,9 @@ def subagent_stop(payload: dict[str, Any]) -> tuple[dict[str, Any] | None, int]:
         by=VERDICT_BY,
     )
     _try_close(dispatch.run_id)
+    # Built after the close, so the outcome class derives from a finished
+    # lifecycle rather than a snapshot mid-transition.
+    _try_build_telemetry(dispatch.run_id, check_report=report, checks=selected)
     return None, 0