thingagent 0.1.1__py3-none-any.whl

thingagent/__init__.py

@@ -0,0 +1,26 @@
+# Copyright 2026 The thingagent Authors
+# SPDX-License-Identifier: Apache-2.0
+"""thingagent: LLM agents served as WoT Things, acting only through thingctx's gate."""
+
+from thingagent.agent import Agent, Question, Step
+from thingagent.channel import ChatChannel
+from thingagent.check import check
+from thingagent.decide import ChatDecider, Decider, DecisionsDecider, checked
+from thingagent.grants import grants
+from thingagent.harness import Harness
+from thingagent.rules import Rule
+
+__all__ = [
+    "Agent",
+    "ChatChannel",
+    "ChatDecider",
+    "Decider",
+    "DecisionsDecider",
+    "Harness",
+    "Question",
+    "Rule",
+    "Step",
+    "check",
+    "checked",
+    "grants",
+]

thingagent/agent.py

@@ -0,0 +1,296 @@
+# Copyright 2026 The thingagent Authors
+# SPDX-License-Identifier: Apache-2.0
+"""An agent's definition, and the Thing Description it is served under.
+
+The definition holds the behavior: the model, instructions, questions, the table
+from each answer to its steps, the properties it reads, the actions it may take on
+a task, the limits on their arguments, and which of them a person must approve.
+The TD holds only the interface (``decide``, ``ask``, ``approve``, ``do`` for an
+agent that may act, and the ``decided`` and ``did`` events) plus every value a
+decision may choose, so a reader sees what the agent can decide without seeing how.
+"""
+
+from __future__ import annotations
+
+import json
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any
+
+from thingctx.authz import limited
+
+QUESTION_TYPES = ("predicate", "choice", "score")
+# Every agent's Thing id starts with this, whichever harness serves it.
+AGENT_ID = "urn:thingagent:agent:"
+
+
+@dataclass(frozen=True)
+class Step:
+    """One action a decision takes: a fleet action tool, its arguments, and the
+    question a person must approve first, if any."""
+
+    invoke: str
+    args: dict[str, Any] = field(default_factory=dict)
+    approve: str | None = None
+
+
+@dataclass(frozen=True)
+class Question:
+    """A question shaped like OpenAI's Decisions API: a ``predicate`` answered
+    with a probability, a ``choice`` among ``values``, or a ``score`` among
+    ordered ``values``."""
+
+    type: str
+    name: str
+    instructions: str
+    values: tuple[str, ...] = ()
+
+
+@dataclass(frozen=True)
+class Approval:
+    """How a person approves a step: how long to wait, and the steps that show a
+    question is waiting (``signal``) and answered (``clear``)."""
+
+    timeout: float | None = None
+    signal: tuple[Step, ...] = ()
+    clear: tuple[Step, ...] = ()
+
+
+def _steps(raw: list[dict[str, Any]]) -> tuple[Step, ...]:
+    return tuple(Step(s["invoke"], s.get("args", {}), s.get("approve")) for s in raw)
+
+
+@dataclass(frozen=True)
+class Agent:
+    """One agent. ``act`` maps a question name, then an answer value, to the steps
+    that answer takes; an answer with no entry takes none. ``may`` names the fleet
+    actions the agent may take on a task, with arguments it chooses. ``limits``
+    maps any action it may take or its steps take to a JSON Schema its arguments
+    must satisfy. ``approve`` maps any action it may take to the question its
+    person must say yes to first. ``options`` configure the model library or
+    Decisions endpoint with every call."""
+
+    name: str
+    title: str
+    instructions: str
+    model: str = ""
+    questions: tuple[Question, ...] = ()
+    act: dict[str, dict[str, tuple[Step, ...]]] = field(default_factory=dict)
+    reads: tuple[str, ...] = ()
+    image: str | None = None
+    person: str | None = None
+    may: tuple[str, ...] = ()
+    limits: dict[str, dict[str, Any]] = field(default_factory=dict)
+    approve: dict[str, str] = field(default_factory=dict)
+    approval: Approval = field(default_factory=Approval)
+    rounds: int = 12
+    options: dict[str, Any] = field(default_factory=dict)
+
+    @classmethod
+    def from_dict(cls, raw: dict[str, Any]) -> Agent:
+        """Build an agent from its definition. Raises ``ValueError`` for a question
+        of an unknown type, a step under an answer the question cannot give, a limit
+        or an approval for an action the agent may not take, or a limit with a
+        numeric bound and no ``type``, which a value that is no number would pass."""
+        questions = tuple(
+            Question(q["type"], q["name"], q.get("instructions", ""), tuple(q.get("values", ())))
+            for q in raw.get("questions", ())
+        )
+        for q in questions:
+            if q.type not in QUESTION_TYPES:
+                raise ValueError(f"question {q.name!r} has unknown type {q.type!r}")
+        allowed = {q.name: set(q.values) for q in questions}
+        act: dict[str, dict[str, tuple[Step, ...]]] = {}
+        for qname, by_value in raw.get("act", {}).items():
+            for value in by_value:
+                if value not in allowed.get(qname, set()):
+                    raise ValueError(f"act names {qname}={value!r}, which no question can answer")
+            act[qname] = {value: _steps(steps) for value, steps in by_value.items()}
+        may = tuple(raw.get("may", ()))
+        approve = dict(raw.get("approve", {}))
+        for action in approve:
+            if action not in may:
+                raise ValueError(f"approve names {action}, which the agent may not take")
+        approval = raw.get("approval", {})
+        agent = cls(
+            name=raw["name"],
+            title=raw.get("title", raw["name"]),
+            instructions=raw.get("instructions", ""),
+            model=raw.get("model", ""),
+            questions=questions,
+            act=act,
+            reads=tuple(raw.get("reads", ())),
+            image=raw.get("image"),
+            person=raw.get("person"),
+            may=may,
+            limits=dict(raw.get("limits", {})),
+            approve=approve,
+            approval=Approval(
+                approval.get("timeout"),
+                _steps(approval.get("signal", [])),
+                _steps(approval.get("clear", [])),
+            ),
+            rounds=raw.get("rounds", 12),
+            options=dict(raw.get("options", {})),
+        )
+        taken = {*agent.may, *(step.invoke for step in agent.steps())}
+        for action in agent.limits:
+            if action not in taken:
+                raise ValueError(f"limits names {action}, which the agent may not take")
+            try:
+                limited(agent.name, action, "invokeaction", agent.limits[action])
+            except ValueError as exc:
+                raise ValueError(f"agent {agent.name}, limits {action}: {exc}") from None
+        return agent
+
+    @classmethod
+    def load(cls, path: str | Path) -> Agent:
+        return cls.from_dict(json.loads(Path(path).read_text()))
+
+    @property
+    def decides_only(self) -> bool:
+        """True for a Decisions model, which answers only decide."""
+        return self.model.startswith("decisions/")
+
+    def steps(self) -> tuple[Step, ...]:
+        """Every step the act table and approvals can run, each with fixed
+        arguments."""
+        table = (s for by_value in self.act.values() for steps in by_value.values() for s in steps)
+        return (*table, *self.approval.signal, *self.approval.clear)
+
+    def _decision(self) -> dict[str, Any]:
+        """The schema of what ``decide`` returns and ``decided`` reports: every
+        answer it may give, each in its Decisions shape, or a refusal and its reason,
+        and the usage and cost the model reports."""
+        shapes: list[dict[str, Any]] = []
+        for q in self.questions:
+            value: dict[str, Any] = (
+                {"type": "number", "minimum": 0, "maximum": 1}
+                if q.type == "predicate"
+                else {"enum": list(q.values)}
+            )
+            field = "probability" if q.type == "predicate" else q.type
+            properties = {"type": {"const": q.type}, "name": {"const": q.name}, field: value}
+            if q.type != "predicate":
+                properties["confidence"] = {"type": "number"}
+            shapes.append(
+                {"type": "object", "properties": properties, "required": ["type", "name", field]}
+            )
+        answers: dict[str, Any] = {"type": "array", "maxItems": 0}
+        if self.questions:
+            refusal = {
+                "type": "object",
+                "properties": {
+                    "type": {"const": "refusal"},
+                    "name": {"enum": [q.name for q in self.questions]},
+                    "reason": {"enum": ["model_refused", "not_a_choice", "request_failed"]},
+                },
+                "required": ["type", "name"],
+            }
+            answers = {"type": "array", "items": {"oneOf": [*shapes, refusal]}}
+        return {
+            "type": "object",
+            "properties": {
+                "agent": {"const": self.name},
+                "correlation": {"type": "string"},
+                "trigger": {"type": "object"},
+                "answers": answers,
+                "acted": {"type": "array", "items": {"type": "object"}},
+                "at": {"type": "string", "format": "date-time"},
+                "usage": {
+                    "type": "object",
+                    "properties": {
+                        "input_tokens": {"type": "integer"},
+                        "output_tokens": {"type": "integer"},
+                    },
+                },
+                "cost": {"type": "number"},
+            },
+            "required": ["agent", "correlation", "trigger", "answers", "acted", "at"],
+        }
+
+    def td(self) -> dict[str, Any]:
+        """The agent's Thing Description: its interface and its allowed answers."""
+        decision = self._decision()
+        td: dict[str, Any] = {
+            "@context": "https://www.w3.org/2022/wot/td/v1.1",
+            "id": f"{AGENT_ID}{self.name}",
+            "title": self.title,
+            "securityDefinitions": {"nosec_sc": {"scheme": "nosec"}},
+            "security": ["nosec_sc"],
+            "actions": {
+                "decide": {
+                    "description": (
+                        "Answer the agent's questions about a trigger and take the steps "
+                        "the answers call for. A trigger whose correlation was already "
+                        "decided gets that decision again and runs nothing."
+                    ),
+                    "input": {"type": "object"},
+                    "output": decision,
+                    "forms": [{"href": "local://decide"}],
+                },
+                "ask": {
+                    "description": "Read Things and answer. Never acts.",
+                    "synchronous": True,
+                    "input": {
+                        "type": "object",
+                        "properties": {"prompt": {"type": "string"}},
+                        "required": ["prompt"],
+                    },
+                    "output": {"type": "object", "properties": {"answer": {"type": "string"}}},
+                    "forms": [{"href": "local://ask"}],
+                },
+                "approve": {
+                    "description": (
+                        "A person's answer to the question the agent asked before taking "
+                        "action, a tool name. It answers no question about another action."
+                    ),
+                    "input": {
+                        "type": "object",
+                        "properties": {
+                            "person": {"type": "string"},
+                            "yes": {"type": "boolean"},
+                            "action": {"type": "string"},
+                        },
+                        "required": ["person", "yes", "action"],
+                    },
+                    "output": {"type": "object"},
+                    "forms": [{"href": "local://approve"}],
+                },
+            },
+            "events": {"decided": {"data": decision, "forms": [{"href": "local://decided"}]}},
+        }
+        if self.may:
+            did = {
+                "type": "object",
+                "properties": {
+                    "agent": {"const": self.name},
+                    "correlation": {"type": "string"},
+                    "task": {"type": "string"},
+                    "answer": {"type": "string"},
+                    "acted": {"type": "array", "items": {"type": "object"}},
+                    "at": {"type": "string", "format": "date-time"},
+                },
+                "required": ["agent", "correlation", "task", "answer", "acted", "at"],
+            }
+            td["actions"]["do"] = {
+                "description": (
+                    "Carry out a task with the actions the agent may take, each checked "
+                    "where it lands, some after a person approves. A repeated correlation "
+                    "gets the first result again and runs nothing."
+                ),
+                "synchronous": True,
+                "input": {
+                    "type": "object",
+                    "properties": {
+                        "task": {"type": "string"},
+                        "correlation": {"type": "string"},
+                        "trigger": {"type": "object"},
+                    },
+                    "required": ["task"],
+                },
+                "output": did,
+                "forms": [{"href": "local://do"}],
+            }
+            td["events"]["did"] = {"data": did, "forms": [{"href": "local://did"}]}
+        return td

thingagent/channel.py

@@ -0,0 +1,121 @@
+# Copyright 2026 The thingagent Authors
+# SPDX-License-Identifier: Apache-2.0
+"""A chat channel, served as a Thing.
+
+A chat service adapter calls ``receive`` for each message a person writes and
+delivers each ``message`` event that ``send`` emits. When a person has a question
+pending, their next message is read as the answer, not as a new request.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+from collections.abc import AsyncIterator
+from typing import Any
+
+from thingctx.bindings import LocalBinding
+
+_log = logging.getLogger("thingagent")
+YES = frozenset({"yes", "y", "ok", "approve", "approved"})
+
+
+class ChatChannel:
+    def __init__(self, name: str = "chat") -> None:
+        self.name = name
+        self.outbox: list[dict[str, str]] = []
+        self.binding = LocalBinding({"send": self.send, "receive": self.receive})
+        self._waiting: dict[str, asyncio.Future[str]] = {}
+        # The action each open question asks about, by person.
+        self._about: dict[str, str | None] = {}
+        # One open question per person, so a reply cannot answer the wrong one.
+        self._turns: dict[str, asyncio.Lock] = {}
+        self._inbox: asyncio.Queue[dict[str, str]] = asyncio.Queue()
+
+    def td(self) -> dict[str, Any]:
+        text = {"person": {"type": "string"}, "text": {"type": "string"}}
+        message = {"type": "object", "properties": text, "required": ["person", "text"]}
+        done = {"type": "object"}
+        return {
+            "@context": "https://www.w3.org/2022/wot/td/v1.1",
+            "id": f"urn:thingagent:channel:{self.name}",
+            "title": f"Chat channel {self.name}",
+            "securityDefinitions": {"nosec_sc": {"scheme": "nosec"}},
+            "security": ["nosec_sc"],
+            "actions": {
+                "send": {"input": message, "output": done, "forms": [{"href": "local://send"}]},
+                "receive": {
+                    "input": message,
+                    "output": done,
+                    "forms": [{"href": "local://receive"}],
+                },
+            },
+            "events": {
+                "message": {
+                    "description": "A message for a person, for an adapter to deliver.",
+                    "data": message,
+                    "forms": [{"href": "local://message"}],
+                }
+            },
+        }
+
+    async def send(self, person: str, text: str) -> dict[str, Any]:
+        message = {"person": person, "text": text}
+        self.outbox.append(message)
+        self.binding.emit("message", message)
+        return {"sent": True}
+
+    async def receive(self, person: str, text: str) -> dict[str, Any]:
+        waiting = self._waiting.pop(person, None)
+        if waiting is not None and not waiting.done():
+            waiting.set_result(text)
+            return {"answered": True}
+        self._inbox.put_nowait({"person": person, "text": text})
+        return {"received": True}
+
+    async def answer(self, person: str, yes: bool, action: str) -> dict[str, Any]:
+        """Answer the question ``person`` has open, only when it asks about
+        ``action``. Unlike ``receive``, it drops an answer with no open question, or
+        one about another action, instead of reading it as a request; the question
+        stays open."""
+        waiting = self._waiting.get(person)
+        if waiting is None or waiting.done():
+            return {"answered": False}
+        if self._about.get(person) != action:
+            _log.warning(
+                "thingagent: dropped an answer for %s about %s, not its question", person, action
+            )
+            return {"answered": False, "refused": f"{person}'s open question is not about {action}"}
+        del self._waiting[person]
+        waiting.set_result("yes" if yes else "no")
+        return {"answered": True}
+
+    async def messages(self) -> AsyncIterator[dict[str, str]]:
+        """Every message that is not an answer, for the harness that routes them."""
+        while True:
+            yield await self._inbox.get()
+
+    async def confirm(
+        self, person: str, question: str, timeout: float, action: str | None = None
+    ) -> bool:
+        """Put ``question`` to ``person`` and wait for the reply. Only a yes within
+        ``timeout`` seconds confirms; silence is a no. Questions to one person
+        queue: a later one is asked once the earlier one is answered or times out,
+        and then gets its own ``timeout``. Only ``answer`` naming ``action``, or the
+        person's own reply, answers it."""
+        async with self._turns.setdefault(person, asyncio.Lock()):
+            future: asyncio.Future[str] = asyncio.get_running_loop().create_future()
+            self._waiting[person] = future
+            self._about[person] = action
+            await self.send(person, question)
+            try:
+                reply = await asyncio.wait_for(future, timeout)
+            except asyncio.TimeoutError:
+                _log.warning(
+                    "thingagent: %s did not answer in %g s, so the answer is no", person, timeout
+                )
+                return False
+            finally:
+                if self._waiting.get(person) is future:
+                    del self._waiting[person]
+            return reply.strip().lower() in YES

thingagent/check.py

@@ -0,0 +1,231 @@
+# Copyright 2026 The thingagent Authors
+# SPDX-License-Identifier: Apache-2.0
+"""Check agents and rules against the fleet's TDs before anything runs."""
+
+from __future__ import annotations
+
+from collections import Counter
+from collections.abc import Collection, Mapping
+from typing import Any
+
+from thingctx.thing import thing_slug
+
+from thingagent.agent import Agent
+from thingagent.rules import Rule, broker_address, loopback
+
+
+def _index(tds: list[dict[str, Any]], kind: str) -> dict[str, dict[str, Any]]:
+    return {
+        f"{thing_slug(td['id'])}__{name}": affordance
+        for td in tds
+        for name, affordance in td.get(kind, {}).items()
+    }
+
+
+def _only_mqtt(affordance: dict[str, Any]) -> bool:
+    # thingctx sends an MQTT action with no declared output without waiting for a
+    # reply, unless the call carries the caller's token.
+    forms = affordance.get("forms", [])
+    return bool(forms) and all(f.get("href", "").startswith("mqtt") for f in forms)
+
+
+def _carries_token(td: dict[str, Any]) -> bool:
+    """True when thingctx sends the caller's token with each message to ``td``'s
+    Thing, so each call waits for an answer: an active scheme is a header bearer
+    scheme that names its parameter."""
+    defs = td.get("securityDefinitions", {})
+    active = td.get("security", [])
+    schemes = [defs.get(name, {}) for name in ([active] if isinstance(active, str) else active)]
+    return any(
+        s.get("scheme") == "bearer" and s.get("in", "header") == "header" and bool(s.get("name"))
+        for s in schemes
+    )
+
+
+def _observable(prop: dict[str, Any] | None) -> bool:
+    return prop is not None and any(
+        "observeproperty" in f.get("op", []) for f in prop.get("forms", [])
+    )
+
+
+def _calls(rule: Rule, agents: dict[str, Agent]) -> list[str]:
+    """What is wrong with the agent action ``rule`` calls and the input it gives."""
+    name, _, action = rule.calls.partition("__")
+    agent = agents.get(name)
+    if agent is None or action not in ("decide", "do", "approve"):
+        return [
+            f"rule {rule.name} calls {rule.calls}, which is not an agent's decide, do or approve"
+        ]
+    if action == "do" and not agent.may:
+        return [f"rule {rule.name} calls {rule.calls}, but {name} may take no action"]
+    if action == "do" and not isinstance(rule.args.get("task"), str):
+        return [f"rule {rule.name} calls {rule.calls} with no task in its args"]
+    if action == "approve" and not (
+        isinstance(rule.args.get("person"), str)
+        and isinstance(rule.args.get("yes"), bool)
+        and isinstance(rule.args.get("action"), str)
+    ):
+        return [
+            f"rule {rule.name} calls {rule.calls} without a person, a yes and an action in its args"
+        ]
+    return []
+
+
+def plain_bus_risk(broker: str, *, tls: bool, insecure_bus: bool) -> str | None:
+    """Why ``broker`` may not be used, or None: its host is not this machine and the
+    link has no TLS (neither ``mqtts://`` nor ``tls``), unless ``insecure_bus``."""
+    try:
+        secure = tls or broker_address(broker)[2]
+    except ValueError as exc:
+        return str(exc)
+    if secure or insecure_bus or loopback(broker):
+        return None
+    return (
+        f"the broker {broker} is not on this machine and the link has no TLS, so passwords "
+        'and tokens cross the network in the clear; use mqtts:// or tls, or set "insecure_bus": '
+        "true to accept that risk"
+    )
+
+
+def open_bus_risks(
+    agents: list[Agent],
+    *,
+    broker_binds_identity: bool,
+    logins: Collection[str],
+    guard: bool,
+    policy: bool,
+) -> list[str]:
+    """Each agent that can act on a bus where a token read off it can be replayed
+    (the broker is not said to bind each login to its identity, or the agent has no
+    login of its own) or where any login can call it (the agents' own gateway has
+    no ``guard`` or no ``policy``)."""
+    why = (
+        "it has no login"
+        if broker_binds_identity
+        else "the broker is not set to bind each login to its identity"
+    )
+    lacks = " and ".join(f"no {n}" for n, has in (("guard", guard), ("policy", policy)) if not has)
+    risks: list[str] = []
+    for agent in (a for a in agents if a.steps() or a.may):
+        if not (broker_binds_identity and agent.name in logins):
+            risks.append(
+                f"{agent.name} can act on the fleet, but {why}, so anyone on the bus can "
+                "replay a token read there or publish its events; set broker_binds_identity "
+                'to true and give it a login, or set "open_bus": true to accept that risk'
+            )
+        if lacks:
+            risks.append(
+                f"{agent.name} can act on the fleet, but the agents' gateway has {lacks}, so "
+                'any login on the bus may call it; set guard and policy, or set "open_bus": '
+                "true to accept that risk"
+            )
+    return risks
+
+
+def check(
+    agents: list[Agent],
+    rules: list[Rule],
+    fleet: list[dict[str, Any]],
+    *,
+    tokens: Collection[str] = (),
+    allow: Mapping[str, Collection[str]] | None = None,
+    broker: str | None = None,
+    broker_binds_identity: bool = False,
+    logins: Collection[str] = (),
+    guard: bool = False,
+    policy: bool = False,
+    open_bus: bool = False,
+    tls: bool = False,
+    insecure_bus: bool = False,
+    clients: Collection[Agent] = (),
+) -> list[str]:
+    """Every problem found, once each, as a sentence; an empty list means none.
+    ``tokens`` names the agents that call with a token. ``allow`` maps a person to
+    the agents they may chat with. With ``broker``, an agent that can act needs
+    ``broker_binds_identity``, a login in ``logins``, and a ``guard`` and a
+    ``policy`` on the agents' gateway, unless ``open_bus``, and a broker that is not
+    on this machine needs ``tls`` or an ``mqtts://`` address, unless
+    ``insecure_bus`` (see :func:`plain_bus_risk`). A rule calls an agent
+    this harness runs. ``clients`` call from outside, so each only reads and takes
+    actions; one with a model, an act table or questions is refused."""
+    properties, actions, events = (_index(fleet, k) for k in ("properties", "actions", "events"))
+    owners = {
+        f"{thing_slug(td['id'])}__{name}": td for td in fleet for name in td.get("actions", {})
+    }
+    problems: list[str] = []
+    # A name is an identity: the token's sub, the broker login and the grants' key.
+    names = Counter([*(a.name for a in (*agents, *clients)), *(r.name for r in rules)])
+    problems += [
+        f"{name} names more than one agent, client or rule; each needs a name of its own"
+        for name, count in names.items()
+        if count > 1
+    ]
+    plain = broker and plain_bus_risk(broker, tls=tls, insecure_bus=insecure_bus)
+    if plain:
+        problems.append(plain)
+    if broker and not open_bus:
+        problems += open_bus_risks(
+            agents,
+            broker_binds_identity=broker_binds_identity,
+            logins=logins,
+            guard=guard,
+            policy=policy,
+        )
+    problems += [
+        f"client {client.name} has {', '.join(has)}, but a client only reads and takes actions"
+        for client in clients
+        if (has := [k for k in ("model", "act", "questions") if getattr(client, k)])
+    ]
+    for agent in (*agents, *clients):
+        if agent.decides_only:
+            # A decisions model answers only decide; every other call needs a chat model.
+            only = f"{agent.name} has a decisions model, which can only decide,"
+            if agent.may:
+                problems.append(f"{only} but it may take actions on a task")
+            if not agent.questions:
+                problems.append(f"{only} but it has no questions")
+            problems += [
+                f"{only} but {person} may chat with it"
+                for person, names in (allow or {}).items()
+                if agent.name in names
+            ]
+        problems += [
+            f"{agent.name} reads {name}, which no fleet TD has"
+            for name in (*agent.reads, *([agent.image] if agent.image else []))
+            if name not in properties
+        ]
+        for invoke in (*(step.invoke for step in agent.steps()), *agent.may):
+            action = actions.get(invoke)
+            if action is None:
+                problems.append(f"{agent.name} invokes {invoke}, which no fleet TD has")
+            elif action is not None and (
+                "output" not in action
+                and _only_mqtt(action)
+                and not (agent.name in tokens and _carries_token(owners[invoke]))
+            ):
+                problems.append(
+                    f"{agent.name} invokes {invoke}, which declares no output, "
+                    "so over MQTT nothing confirms it ran or was refused"
+                )
+    by_name = {agent.name: agent for agent in agents}
+    for rule in rules:
+        problems += _calls(rule, by_name)
+        event = rule.event
+        observed = event not in events and _observable(properties.get(event))
+        data = properties[event] if observed else events.get(event, {}).get("data")
+        fields = data.get("properties", {}) if isinstance(data, dict) else {}
+        needed = [k.split(".")[0] for k in rule.when]
+        if event not in events and not observed:
+            problems.append(
+                f"rule {rule.name} reads {event}, which no fleet TD has as an event or "
+                "an observable property"
+            )
+        elif not isinstance(data, dict) or data.get("type") != "object":
+            problems.append(f"rule {rule.name} reads {event}, whose data is not an object")
+        else:
+            problems += [
+                f"rule {rule.name} reads {name} from {event}, which its data lacks"
+                for name in needed
+                if name not in fields
+            ]
+    return list(dict.fromkeys(problems))