vmware-debug 1.12.1__tar.gz → 1.13.0__tar.gz

{vmware_debug-1.12.1 → vmware_debug-1.13.0}/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "vmware-debug",
   "displayName": "VMware Debug",
-  "version": "1.12.1",
+  "version": "1.13.0",
   "description": "VMware incident timeline, root-cause routing, local case ledger; no vSphere access. 14 MCP tools.",
   "author": {
     "name": "Wei Zhou",

{vmware_debug-1.12.1 → vmware_debug-1.13.0}/.mcp.json

@@ -5,7 +5,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-debug==1.12.1",
+        "vmware-debug==1.13.0",
         "vmware-debug-mcp"
       ]
     }

{vmware_debug-1.12.1 → vmware_debug-1.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vmware-debug
-Version: 1.12.1
+Version: 1.13.0
 Summary: VMware diagnostic brain — offline incident triage, log/event correlation, and root-cause routing across the VMware skill family
 Project-URL: Homepage, https://github.com/vmware-skills/VMware-Debug
 Project-URL: Repository, https://github.com/vmware-skills/VMware-Debug
@@ -18,7 +18,7 @@ Requires-Dist: mcp[cli]<2.0,>=1.10
 Requires-Dist: pyyaml<7.0,>=6.0
 Requires-Dist: rich<15.0,>=13.0
 Requires-Dist: typer<1.0,>=0.12
-Requires-Dist: vmware-policy<2.0,>=1.15.0
+Requires-Dist: vmware-policy<2.0,>=1.16.0
 Description-Content-Type: text/markdown
 
 <!-- mcp-name: io.github.vmware-skills/vmware-debug -->

{vmware_debug-1.12.1 → vmware_debug-1.13.0}/RELEASE_NOTES.md

@@ -1,3 +1,60 @@
+## v1.13.0 — exclusion is per hypothesis
+
+Found in a real investigation of an Aria "vCenter app health is affected" alert on 2026-09-15, then corrected
+after an independent review the same day.
+
+**Ruling out one hypothesis no longer excludes the case.** Two sources ruled out H2 (host memory reclaim) while the
+leading H1 stayed open behind three gaps, and `case_grade` graded the whole case Excluded — which reads as "the
+answer was ruled out". Now the case is Excluded only when every registered hypothesis is ruled out; otherwise it
+is graded for what remains.
+
+* **Only evidence that rules nothing out counts for the hypotheses still open.** Evidence records what it
+  falsifies, never what it supports. The first version of this change counted the observations that ruled H2 out
+  as corroboration for H1, and a hypothesis added with no evidence at all inherited Probable. Independent sources
+  and decisive items for the open hypotheses are now counted only from items with an empty `falsifies`.
+* A gap whose `blocks` lists only ruled-out hypotheses no longer holds the grade back; the reasons list it under
+  "No longer blocking" instead of "Blocking gap(s)".
+* **Behaviour change:** `case_grade` returns `hypotheses`, every registered hypothesis as `{id, status}` with
+  status `open` or `excluded`. A case directory without a readable `hypotheses.md` is graded as if none were
+  registered, with a reason, instead of failing.
+* Re-running the same investigation after the change: H2 and H3 excluded, H1 open, **Probable** from two sources
+  that rule nothing out, held below Confirmed by four open gaps.
+
+Known and unchanged: excluding a hypothesis still needs two independent sources across the whole case, not two
+that falsify that hypothesis; `case_hypotheses` marks a hypothesis refuted on a single falsifier.
+
+## v1.12.2 — every tool call is audited, failures included
+
+Until now no vmware-debug MCP tool wrote to `~/.vmware/audit.db`. The server said that was on
+purpose — nothing here acts on a VMware target — and the case ledger stood in as the record. It
+records the investigation, not the calls: in a live session case evidence was submitted with
+invented fetch times, and nothing could show when the calls had really been made or which failed.
+
+* All 14 MCP tools now go through `@vmware_tool`. Each call writes one row under the tool's own
+  name; a call that raises or returns `{"error": …}` is recorded as `error`.
+* `payload` (`case_submit_evidence`) and `events` (`incident_timeline`) are kept out of the row.
+  The row still has the case id, source skill and tool, query, fetch time and outcome; the data
+  itself is in the case folder, or with the caller.
+* The CLI twins audit too: `categories` as `list_symptom_categories`, `triage` as
+  `incident_timeline` — including a `triage` that fails on bad input. `version` and `mcp` still
+  write no row.
+* **Event text is not copied into the row.** `incident_timeline` and `case_timeline` return event
+  text (`hypotheses[].sample_text`, `classification.unmatched_samples`, `rejected`), and a probe
+  with `password=…` and `https://user:pass@host` in an event stored both in the row's result. Both
+  tools now declare `sensitive_result`: the row keeps the call, arguments and status (a returned
+  `{"error": …}` is still `error`) and records the result as `[redacted: return value declared
+  sensitive]`. The other tools return ids, counts, grades and text you passed as an argument, and
+  are stored after vmware-policy's credential scrubbing.
+* Because the tools now pass through `guard()`, vmware-policy's rules apply to them: a `deny` rule
+  naming a debug tool, or with no `operations`, refuses it; a malformed `~/.vmware/rules.yaml`
+  refuses every tool (the `categories`/`triage` commands exit 1 with a traceback ending in the
+  reason); the runaway guard refuses the 26th identical call within 120 s. It compares a digest of the
+  arguments the tool received, not the audit row's redacted copy, so `incident_timeline` calls with
+  different events are not identical — this needs vmware-policy 1.16.0, which this release requires.
+  Environment-scoped rules still never match (debug has no targets), and maintenance windows never
+  gate a debug tool (all are `low` risk). `references/setup-guide.md` said the opposite — that no
+  policy rule applies — and is corrected.
+
 ## v1.12.1 — every CLI command declares what it reaches
 
 Across the family, CLI reads never wrote `~/.vmware/audit.db`; they now do (`@audited`, under the

{vmware_debug-1.12.1 → vmware_debug-1.13.0}/openclaw.plugin.json

@@ -11,7 +11,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-debug==1.12.1",
+        "vmware-debug==1.13.0",
         "vmware-debug-mcp"
       ]
     }

{vmware_debug-1.12.1 → vmware_debug-1.13.0}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zw008/vmware-debug",
-  "version": "1.12.1",
+  "version": "1.13.0",
   "description": "VMware incident timeline, root-cause routing, local case ledger; no vSphere access. 14 MCP tools.",
   "private": true,
   "license": "MIT",

{vmware_debug-1.12.1 → vmware_debug-1.13.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "vmware-debug"
-version = "1.12.1"
+version = "1.13.0"
 description = "VMware diagnostic brain — offline incident triage, log/event correlation, and root-cause routing across the VMware skill family"
 readme = "README.md"
 license = "MIT"
@@ -21,7 +21,7 @@ dependencies = [
     "typer>=0.12,<1.0",
     "rich>=13.0,<15.0",
     "mcp[cli]>=1.10,<2.0",
-    "vmware-policy>=1.15.0,<2.0",
+    "vmware-policy>=1.16.0,<2.0",
     # Imported directly by ops/cases/grading.py for the rules file. It has
     # always arrived transitively via vmware-policy; a package should
     # declare what it imports rather than rely on a dependency's dependency.

{vmware_debug-1.12.1 → vmware_debug-1.13.0}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/vmware-skills/VMware-Debug",
     "source": "github"
   },
-  "version": "1.12.1",
+  "version": "1.13.0",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "vmware-debug",
-      "version": "1.12.1",
+      "version": "1.13.0",
       "runtimeHint": "uvx",
       "packageArguments": [
         {

{vmware_debug-1.12.1 → vmware_debug-1.13.0}/skills/vmware-debug/SKILL.md

@@ -51,7 +51,7 @@ write tools touch only the local case ledger.
 ## Quick Install
 
 ```bash
-uv tool install vmware-debug==1.12.1
+uv tool install vmware-debug==1.13.0
 vmware-debug categories          # see what it can diagnose
 ```
 
@@ -175,7 +175,10 @@ ledger — submit the missing evidence, or record the gap that is blocking it.
 - **Confirmed** — that, plus a decisive item: a direct hardware diagnostic, a
   version-checked knowledge-base entry, or a vendor SR; and no gap left open
 - **Excluded** — an observation that actually rules it out. "We looked and found
-  nothing" is a gap, not an exclusion
+  nothing" is a gap, not an exclusion. Exclusion is per hypothesis: the case is
+  Excluded only when every registered hypothesis is ruled out. Otherwise
+  `case_grade` grades what remains, counting only evidence that rules nothing
+  out, and lists each hypothesis as `open` or `excluded` in `hypotheses`
 
 `case_plan` is not a checklist: submit evidence and the next plan is shorter,
 lose a source and it routes around it. Its `unavailable` half is the important
@@ -275,10 +278,32 @@ No network, nothing executed. The seven [WRITE] tools write only to the local ca
 ledger under `$OPS_HOME`; nothing here touches a remote VMware estate. Evidence, gaps,
 hypotheses and grade history are only ever added to — `timeline.md` is regenerated from
 the evidence and `case.json` holds the current grade and state. Remediation is always routed to
-aiops/pilot, where the double-confirm / approval / audit gates live (audit DB
-`~/.vmware/audit.db`). debug has no config and no connection, so it registers no
-environment resolver, and its tools do not pass through the policy engine — no policy
-rule applies to them. See `references/setup-guide.md`.
+aiops/pilot, where the double-confirm / approval gates live.
+
+**What the audit row holds.** Every debug tool call — a failed one included — writes one
+row to `~/.vmware/audit.db` through `@vmware_tool`, as do the `categories` and `triage`
+CLI commands under their MCP tools' names. The row records the tool, time, OS user,
+detected agent, arguments, status (`ok`, `error`, `denied`, `budget_exceeded`,
+`interrupted`) and a result. Two arguments are stored as `***`: evidence `payload` and
+`incident_timeline` `events`. Two results are not stored at all — `incident_timeline` and
+`case_timeline` quote event text (`sample_text`, `unmatched_samples`, `rejected`), which
+can carry anything the source logged, so their row says
+`[redacted: return value declared sensitive]`. Every other result (ids, counts, grades,
+your own summaries and statements) is stored after credential scrubbing. The data itself
+is in the case folder, or with you.
+
+**What debug inherits from vmware-policy**, since its tools pass through `guard()`:
+- **Runaway guard** — the 26th call to one tool with identical arguments within 120 s is
+  refused (`budget_exceeded`; `VMWARE_RUNAWAY_MAX`, `VMWARE_RUNAWAY_WINDOW_SEC`). It
+  compares a digest of the arguments the tool received (vmware-policy ≥1.16.0), so
+  calls with different `events` are not identical.
+- **A malformed `~/.vmware/rules.yaml` fails closed** — every tool is refused with a reason
+  naming the file; `categories`/`triage` exit 1 with a traceback ending in that message.
+- **A `deny` rule without `operations`** matches every tool, debug's included.
+- **Environment-scoped rules never match** — debug registers no resolver (no targets).
+- **Maintenance windows** gate only `high`/`critical` risk; every debug tool is `low`.
+
+See `references/setup-guide.md`.
 
 **Case data is sensitive and is kept until you delete it.** Each case lives in
 `$OPS_HOME/cases/<case-id>/` (default `~/.vmware/cases/`), created owner-only (`0700`).

{vmware_debug-1.12.1 → vmware_debug-1.13.0}/skills/vmware-debug/references/agent-guardrails.md

@@ -46,7 +46,7 @@ These are structural, so it cannot.
 | "Do not fabricate a timeline — build it from the events I gave you" | **`incident_timeline` correlates only its input.** It is source-agnostic and has no way to fetch anything, so the timeline cannot contain an event the agent did not supply. |
 | "Tell me when the symptom is outside what you can recognise" | **`list_symptom_categories`** states the catalogue, and unmatched symptoms come back as `uncategorized` rather than being forced into the nearest signature. |
 | "Use explicit limits for queries that may return large amounts of data" | **The list envelope.** `list_symptom_categories` returns `{items, returned, limit, total, truncated, hint}` with `truncated` always `false` — which is the point: it states that the catalogue is complete instead of leaving you to infer it. |
-| "Log everything you looked at" | **The case ledger, for investigations.** Evidence submitted to a case is recorded with its source skill, tool, query and fetch time. Debug's own tool calls are not written to `~/.vmware/audit.db`: none of them acts on a VMware target. |
+| "Log everything you looked at" | **`~/.vmware/audit.db` and the case ledger.** Every debug tool call, a failed one included, writes one audit row (tool, time, user, agent, arguments, status and result — evidence `payload` and `events` are stored as `***`, and the results of `incident_timeline` and `case_timeline`, which quote event text, are not stored at all). Evidence submitted to a case is also recorded in the ledger with its source skill, tool, query and fetch time — so pass the real fetch time, never a placeholder. |
 
 ---
 

{vmware_debug-1.12.1 → vmware_debug-1.13.0}/skills/vmware-debug/references/setup-guide.md

@@ -6,7 +6,7 @@ is a pure, offline correlation engine. There is no `config.yaml` and no `.env`.
 ## Install
 
 ```bash
-uv tool install vmware-debug==1.12.1
+uv tool install vmware-debug==1.13.0
 vmware-debug categories      # verify it runs
 ```
 
@@ -15,7 +15,7 @@ vmware-debug categories      # verify it runs
 ```json
 {
   "command": "uvx",
-  "args": ["--from", "vmware-debug==1.12.1", "vmware-debug-mcp"]
+  "args": ["--from", "vmware-debug==1.13.0", "vmware-debug-mcp"]
 }
 ```
 
@@ -53,8 +53,31 @@ routes fixes to (vmware-aiops, vmware-pilot).
    `staging` / `lab`) per target in their own `config.yaml` as an optional label
    an environment-scoped `deny` rule can match on. debug has no config and no
    connection to declare one about, so it registers no environment resolver —
-   it has no basis to answer for any target. Its tools do not pass through the
-   policy engine either, so no policy rule, environment-scoped or not, applies
-   to them.
-7. **Static analysis** — `uvx bandit -r vmware_debug/` (release bar:
+   it has no basis to answer for any target — and an environment-scoped rule
+   never matches its tools. Every other policy rule does apply: each MCP tool
+   and the `categories` / `triage` CLI commands pass through vmware-policy's
+   `guard()`. Verified behaviour:
+   - A `deny` rule naming a debug tool, or with no `operations` key at all,
+     refuses it (status `denied`, with the rule's reason).
+   - A malformed `~/.vmware/rules.yaml` fails closed: every tool is refused with
+     a reason naming the file and the way out (fix it, or
+     `VMWARE_POLICY_DISABLED=1`). The `categories` and `triage` commands exit 1
+     with a Python traceback whose last lines are that message; `version` and
+     `mcp` are unaffected.
+   - Runaway guard: within one MCP server process, the 26th call to the same
+     tool with identical arguments inside 120 s is refused (`budget_exceeded`).
+     Tune with `VMWARE_RUNAWAY_MAX` / `VMWARE_RUNAWAY_WINDOW_SEC`. The guard
+     compares a SHA-256 digest of the arguments the tool actually received
+     (vmware-policy ≥1.16.0), not the redacted copy in the audit row — so calls
+     with different `events` or `payload` are never counted as identical.
+   - A `maintenance_window` gates only `high`/`critical` risk operations; every
+     debug tool is `low`, so a window never blocks one.
+7. **Audit row contents** — one row per call in `~/.vmware/audit.db`: tool,
+   time, OS user, detected agent, arguments, status and result. `payload` and
+   `events` are stored as `***`. The results of `incident_timeline` and
+   `case_timeline` are not stored (`[redacted: return value declared
+   sensitive]`) because they quote event text; other results are stored after
+   credential scrubbing. The status is still truthful — a call that returns
+   `{"error": …}` is `error`.
+8. **Static analysis** — `uvx bandit -r vmware_debug/` (release bar:
    0 Medium+).

vmware_debug-1.13.0/tests/test_case_grading_per_hypothesis.py

@@ -0,0 +1,131 @@
+"""Excluded is a verdict about a hypothesis, not about the whole case.
+
+2026-09-15, a real investigation of a vCenter app-health alert: two sources
+ruled out H2 (host memory reclaim) while the leading H1 stayed open behind three
+gaps. ``case_grade`` graded the whole case Excluded, which reads as "the answer
+was ruled out". The investigator had to explain in prose that only H2 was.
+
+The first version of the fix over-corrected, and an independent review caught
+it: the observations that ruled H2 out were then counted as corroboration for
+H1, and a hypothesis added with no evidence at all inherited Probable. Evidence
+records only what it falsifies, never what it supports, so an item that rules a
+hypothesis out must not count for the ones left open.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from vmware_debug.ops.cases.api import grade
+from vmware_debug.ops.cases.evidence import Evidence, Gap, record_evidence, record_gap
+from vmware_debug.ops.cases.grading import grade_case
+from vmware_debug.ops.cases.hypotheses import add_hypothesis
+from vmware_debug.ops.cases.model import Scope
+from vmware_debug.ops.cases.store import create_case
+
+AT = "2026-09-15T13:30:00Z"
+
+
+@pytest.fixture(autouse=True)
+def isolated_home(tmp_path, monkeypatch):
+    monkeypatch.setenv("OPS_HOME", str(tmp_path / "vmware"))
+
+
+@pytest.fixture
+def two_hypotheses():
+    cid = create_case(
+        Scope(
+            summary="vcenter app health",
+            determined_by="aria alert",
+            product_versions={"vsphere": "8.0.3"},
+        ),
+        at=AT,
+    ).case_id
+    add_hypothesis(cid, "appliance memory pressure")  # H1
+    add_hypothesis(cid, "host reclaims appliance memory")  # H2
+    return cid
+
+
+def _evidence(skill: str, falsifies: tuple[str, ...] = ()) -> Evidence:
+    return Evidence(
+        source_skill=skill,
+        source_tool="t",
+        query={},
+        fetched_at="2026-09-15T13:31:00Z",
+        summary="s",
+        falsifies=falsifies,
+    )
+
+
+def _gap(blocks: tuple[str, ...], could_falsify: bool = True) -> Gap:
+    return Gap(
+        what="swap history",
+        why="not collected",
+        blocks=blocks,
+        could_falsify=could_falsify,
+        how_to_close="vami",
+    )
+
+
+def test_ruling_out_one_hypothesis_does_not_exclude_the_case(two_hypotheses):
+    record_evidence(two_hypotheses, _evidence("vmware-aria", falsifies=("H2",)))
+    record_evidence(two_hypotheses, _evidence("vmware-monitor", falsifies=("H2",)))
+    r = grade_case(two_hypotheses)
+    assert r.grade == "candidate"
+    assert r.hypotheses == (("H1", "open"), ("H2", "excluded"))
+    assert any("Still open: H1" in reason for reason in r.reasons)
+
+
+def test_the_case_is_excluded_when_every_hypothesis_is_ruled_out(two_hypotheses):
+    record_evidence(two_hypotheses, _evidence("vmware-aria", falsifies=("H1", "H2")))
+    record_evidence(two_hypotheses, _evidence("vmware-monitor"))
+    assert grade_case(two_hypotheses).grade == "excluded"
+
+
+def test_evidence_that_rules_one_out_is_not_corroboration_for_the_rest(two_hypotheses):
+    """aria rules H2 out; monitor says something unrelated. Nothing is about H1."""
+    record_evidence(two_hypotheses, _evidence("vmware-aria", falsifies=("H2",)))
+    record_evidence(two_hypotheses, _evidence("vmware-monitor"))
+    assert grade_case(two_hypotheses).grade == "candidate"
+
+
+def test_a_new_hypothesis_does_not_inherit_probable(two_hypotheses):
+    record_evidence(two_hypotheses, _evidence("vmware-aria", falsifies=("H1", "H2")))
+    record_evidence(two_hypotheses, _evidence("vmware-monitor", falsifies=("H1", "H2")))
+    assert grade_case(two_hypotheses).grade == "excluded"
+    add_hypothesis(two_hypotheses, "something else")  # H3, no evidence at all
+    r = grade_case(two_hypotheses)
+    assert r.grade == "candidate"
+    assert ("H3", "open") in r.hypotheses
+
+
+def test_a_gap_that_blocks_only_a_ruled_out_hypothesis_holds_nothing_back(two_hypotheses):
+    """Otherwise a question nobody needs answered any more pins H1 at Candidate."""
+    record_evidence(two_hypotheses, _evidence("vmware-aria", falsifies=("H2",)))
+    record_evidence(two_hypotheses, _evidence("vmware-monitor", falsifies=("H2",)))
+    record_evidence(two_hypotheses, _evidence("vmware-monitor"))
+    record_evidence(two_hypotheses, _evidence("vmware-log-insight"))
+    record_gap(two_hypotheses, _gap(blocks=("H2",)))
+    r = grade_case(two_hypotheses)
+    assert r.grade == "probable"
+    assert not any(reason.startswith("Blocking gap(s)") for reason in r.reasons)
+    assert any("No longer blocking" in reason for reason in r.reasons)
+
+
+def test_a_gap_that_still_blocks_an_open_hypothesis_still_holds(two_hypotheses):
+    record_evidence(two_hypotheses, _evidence("vmware-aria", falsifies=("H2",)))
+    record_evidence(two_hypotheses, _evidence("vmware-monitor", falsifies=("H2",)))
+    record_evidence(two_hypotheses, _evidence("vmware-monitor"))
+    record_evidence(two_hypotheses, _evidence("vmware-log-insight"))
+    record_gap(two_hypotheses, _gap(blocks=("H1", "H2")))
+    assert grade_case(two_hypotheses).grade == "candidate"
+
+
+def test_the_tool_result_lists_each_hypothesis(two_hypotheses):
+    record_evidence(two_hypotheses, _evidence("vmware-aria", falsifies=("H2",)))
+    record_evidence(two_hypotheses, _evidence("vmware-monitor"))
+    out = grade(two_hypotheses, at=AT)
+    assert out["hypotheses"] == [
+        {"id": "H1", "status": "open"},
+        {"id": "H2", "status": "excluded"},
+    ]