vmware-debug 1.8.3__tar.gz → 1.8.5__tar.gz

{vmware_debug-1.8.3 → vmware_debug-1.8.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vmware-debug
-Version: 1.8.3
+Version: 1.8.5
 Summary: VMware diagnostic brain — read-only incident triage, log/event correlation, and root-cause routing across the VMware skill family
 Author-email: Wei Zhou <wei-wz.zhou@broadcom.com>
 License-Expression: MIT
@@ -13,7 +13,7 @@ Requires-Python: >=3.10
 Requires-Dist: mcp[cli]<2.0,>=1.10
 Requires-Dist: rich<15.0,>=13.0
 Requires-Dist: typer<1.0,>=0.12
-Requires-Dist: vmware-policy<2.0,>=1.8.0
+Requires-Dist: vmware-policy<2.0,>=1.8.5
 Description-Content-Type: text/markdown
 
 <!-- mcp-name: io.github.zw008/vmware-debug -->

{vmware_debug-1.8.3 → vmware_debug-1.8.5}/RELEASE_NOTES.md

@@ -1,3 +1,160 @@
+## v1.8.5 (2026-07-20) — the two fixes v1.8.4 announced now actually work
+
+Four adversarial reviews of v1.8.4 found that both of its headline fixes were
+incomplete in ways the release notes did not reflect. This release makes them
+real. If you are on 1.8.4, this is the one to take.
+
+### Fixed — a failure that was *returned* was still audited as a success
+
+vmware-policy 1.8.4 added `report_tool_failure()` for tools that catch an
+exception and return an error payload instead of raising. **No skill called it.**
+
+Every string-returning tool therefore kept doing exactly what 1.8.4 said it had
+stopped doing: writing `status=ok` to `~/.vmware/audit.db` for an operation that
+failed, recording an undo token for a change that never happened, and telling the
+circuit breaker the call succeeded so repeated failures never tripped it.
+
+The surface this covered is not marginal:
+
+| Skill | What was mis-audited |
+|---|---|
+| vmware-aiops | 25 of 49 tools, including **every undo-bearing write** — a failed `vm_power_on` left an undo token saying "power it back off" |
+| vmware-avi | all 28 tools, including `vs_toggle` and `ako_restart` |
+| vmware-storage | all 4 write tools |
+| vmware-nsx | the 5 delete tools |
+
+vmware-avi is worth calling out: before 1.8.4 its exceptions propagated and the
+audit was correct. 1.8.4 caught them and returned a string, so **that release made
+its audit trail worse than it had been.**
+
+Skills whose tools already return dict payloads (vmware-monitor, vmware-vks,
+vmware-aria, vmware-log-insight, vmware-harden, vmware-debug, vmware-pilot) were
+already detected correctly. They gained a test proving it rather than a redundant
+call.
+
+### Fixed — narrowing `OSError` did not close the leak it was meant to close
+
+1.8.4 narrowed the `_safe_error` passthrough because bare `OSError` let TLS and
+DNS failures reach the agent with hostnames and certificate subjects in them.
+That narrowing had no effect on the error it was written for:
+
+```
+ssl.SSLCertVerificationError → ssl.SSLError → OSError, ValueError
+```
+
+`ValueError` has been on every allowlist since long before 1.8.4, so a
+certificate failure kept passing through — the commonest self-signed-certificate
+failure in this family, carrying the hostname it was checked against. An
+allowlist structurally cannot express "not this one".
+
+Where `ssl.SSLError` can actually surface — the pyVmomi skills — it is now
+reduced *ahead* of the allowlist. In the httpx skills TLS arrives wrapped as
+`httpx.ConnectError`, and in vmware-avi as `requests.exceptions.SSLError`, so the
+guard cannot fire there; in those skills the leak was the raw exception
+interpolated into an already-allowlisted `*ApiError`, and that is now authored
+text naming the config target and `verify_ssl` instead of the exception.
+
+The missing-password error — this family's most common first-run failure, whose
+entire remedy is the environment variable name it carries — keeps its message
+through a narrow `ConfigError(OSError)` rather than the base class. Connection
+failures are translated at the connection layer into an authored remedy that
+names the target and the setting to change, with the raw detail left on
+`__cause__` for the server log.
+
+### Also fixed
+
+- **vmware-vks**: the quickstart documented a password variable the code never
+  reads — following `README.md` verbatim produced "Password not found". Five
+  places, plus six references to a `doctor` command this CLI has never had, two
+  descriptions promising fields the tools do not return, and eight teaching
+  messages that `RuntimeError` was masking.
+- **vmware-nsx**: an error cited `--route-advertisement`; the flag is `--advertise`.
+- **vmware-pilot**: `get_workflow_status` told the model to call `approve` — a
+  tool the read-only gate withholds — as the required next step; and a hint
+  pointed at a filename that could never appear in that message.
+- **vmware-aiops**: `vm_task_status` polling a *failed task* returned
+  `{"state": "error", "error": ...}` from a successful read, which the new
+  detection read as the call itself failing. The field is now `task_error`.
+  **This is a breaking change for anything parsing that payload.**
+- Several remedies that were still being cut by the 300-character cap the 1.8.4
+  notes claimed to have addressed.
+
+### Known and not fixed
+
+`ConnectionError` remains one type from two sources in several skills — a
+skill's own authored message and urllib3's `HTTPSConnectionPool(host=..., port=...)`
+share it, and an allowlist cannot separate them. vmware-vks is converted; the
+rest need their own domain type and are deferred rather than half-done.
+
+## v1.8.4 (2026-07-20) — errors that teach, and tool descriptions a small model can route from
+
+A capability eval was rolled out across the family and asked two open questions:
+when a call fails, is the model told enough to fix it, and can it pick the right
+tool from the description alone? Both answers were worse than anyone thought, and
+in several places the reason was that the measurement was looking somewhere other
+than where the model reads.
+
+### Fixed — teaching messages were being discarded on the way to the agent
+
+`_safe_error` reduces unrecognised exceptions to `"<Class>: operation failed."`
+so raw API text, credentials in URLs and internal paths cannot reach an agent.
+Its allowlist held only the builtin validation errors — so this skill's **own**
+domain exceptions, the ones that exist precisely to carry a corrected next step,
+had their messages replaced by their class names.
+
+The effect was invisible from the CLI, which prints those messages in full.
+
+The worst case was shared by nine skills: `config.py` raises exactly one
+`OSError`, the missing-password error, whose entire remedy is the environment
+variable name it names. An agent hitting an unconfigured target received
+`OSError: operation failed.` and had nothing to act on. That is the family's most
+common first-run failure, and it landed one release after the documented variable
+names were corrected — so the message that would have unstuck the operator was
+the one being thrown away.
+
+The rule is now the property it always meant: **every exception this skill raises
+on purpose passes through**, and only genuinely unplanned ones are reduced.
+`RuntimeError` stays reduced — it is the generic catch-all and in several skills
+carries raw upstream text.
+
+### Fixed — error messages now carry the correction
+
+Every message that reported a failure without saying how to recover was
+rewritten: it names the offending value, gives an imperative remedy, and names
+something concrete to act on — a tool that exists, a real CLI command, a config
+file, an environment variable. Recovery becomes an instruction-following problem
+rather than an inference one, which is what a weak model can still do.
+
+Three classes of defect surfaced while doing it:
+
+- **Remedies that were never delivered.** `_safe_error` truncates with no
+  ellipsis, so a message longer than the cap loses its closing sentence
+  silently. One message had been shipping at 396 characters against a 300-char
+  cap — its remedy had never once reached an agent. Messages now lead with the
+  remedy so a long interpolated value truncates the expendable detail instead.
+- **Commands that do not exist.** One skill's error hints named a `doctor`
+  subcommand it does not have.
+- **Tools that do not exist.** A tool description pointed at two sibling-skill
+  tools that had been renamed, and another named a tool that had moved to a
+  different skill entirely.
+
+### Improved — tool descriptions state when to use them and what to call next
+
+The description is the API for a small model: an unstated routing rule is a
+routing rule that does not exist, and a tool with no stated next hop is one the
+model stops at. Descriptions now say when to prefer this tool over a sibling,
+what shape comes back, the caveat that bites, and which tool to call after.
+
+**Manifest size did not grow.** Descriptions load into every session, so the
+routing clauses were paid for by cutting duplicated reference material —
+repeated boilerplate, examples that restated the parameter list, and prose
+copies of the pagination contract.
+
+### Note
+
+Every tool and CLI command named anywhere in this release was verified against
+the live MCP registry and the live command tree, not against documentation.
+
 ## v1.8.3 (2026-07-20) — credentials resolve as a pair; documented env vars now exist
 
 ### Changed — version alignment

{vmware_debug-1.8.3 → vmware_debug-1.8.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "vmware-debug"
-version = "1.8.3"
+version = "1.8.5"
 description = "VMware diagnostic brain — read-only incident triage, log/event correlation, and root-cause routing across the VMware skill family"
 readme = "README.md"
 license = "MIT"
@@ -21,7 +21,7 @@ dependencies = [
     "typer>=0.12,<1.0",
     "rich>=13.0,<15.0",
     "mcp[cli]>=1.10,<2.0",
-    "vmware-policy>=1.8.0,<2.0",
+    "vmware-policy>=1.8.5,<2.0",
 ]
 
 [project.scripts]
@@ -31,6 +31,12 @@ vmware-debug-mcp = "vmware_debug.mcp_server.server:main"
 [tool.hatch.build.targets.wheel]
 packages = ["vmware_debug"]
 
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+markers = [
+    "capability: Capability evals — scored trends, not pass/fail gates. Excluded from the default run (they measure quality, so <100% is expected and must not read as a broken build). Run them with: pytest -m capability",
+]
+addopts = "-m 'not capability'"
 [dependency-groups]
 dev = [
     "pytest>=8.0,<10.0",

{vmware_debug-1.8.3 → vmware_debug-1.8.5}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/zw008/VMware-Debug",
     "source": "github"
   },
-  "version": "1.8.3",
+  "version": "1.8.5",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "vmware-debug",
-      "version": "1.8.3",
+      "version": "1.8.5",
       "transport": {
         "type": "stdio"
       }

vmware_debug-1.8.5/tests/eval/capability/_family.py

@@ -0,0 +1,204 @@
+"""What every skill in the family exposes — generated, do not edit.
+
+Written by scripts/install_capability_evals.sh, which is the only place
+that can see all twelve repos at once. Error messages and tool
+descriptions route across skills, so checking those citations needs the
+sibling surfaces; deriving them here beats a hand-kept list that goes
+stale without saying so.
+"""
+
+from __future__ import annotations
+
+FAMILY_TOOLS: dict[str, frozenset[str]] = {
+    'vmware-aiops': frozenset({
+        'acknowledge_vcenter_alarm', 'attach_iso_to_vm', 'batch_clone_vms',
+        'batch_deploy_from_spec', 'batch_linked_clone_vms', 'browse_datastore',
+        'cluster_add_host', 'cluster_configure', 'cluster_create', 'cluster_delete',
+        'cluster_health_summary', 'cluster_info', 'cluster_remove_host',
+        'convert_vm_to_template', 'cross_vcenter_attention',
+        'datastore_investigation_bundle', 'deploy_linked_clone', 'deploy_vm_from_ova',
+        'deploy_vm_from_template', 'host_investigation_bundle', 'list_vcenter_alarms',
+        'reset_vcenter_alarm', 'scan_datastore_images', 'vm_apply_plan', 'vm_cancel_ttl',
+        'vm_clean_slate', 'vm_clone', 'vm_create', 'vm_create_plan', 'vm_create_snapshot',
+        'vm_delete', 'vm_delete_snapshot', 'vm_guest_download', 'vm_guest_exec',
+        'vm_guest_exec_output', 'vm_guest_provision', 'vm_guest_upload',
+        'vm_investigation_bundle', 'vm_list_plans', 'vm_list_snapshots', 'vm_list_ttl',
+        'vm_migrate', 'vm_power_off', 'vm_power_on', 'vm_reconfigure', 'vm_revert_snapshot',
+        'vm_rollback_plan', 'vm_set_ttl', 'vm_task_status',
+    }),
+    'vmware-aria': frozenset({
+        'acknowledge_alert', 'cancel_alert', 'create_alert_definition',
+        'delete_alert_definition', 'delete_report', 'generate_report', 'get_alert',
+        'get_aria_health', 'get_capacity_overview', 'get_remaining_capacity', 'get_report',
+        'get_resource', 'get_resource_health', 'get_resource_metrics',
+        'get_resource_riskbadge', 'get_time_remaining', 'get_top_consumers',
+        'investigate_alert', 'list_alert_definitions', 'list_alerts', 'list_anomalies',
+        'list_collector_groups', 'list_report_definitions', 'list_reports',
+        'list_resources', 'list_rightsizing_recommendations', 'list_symptom_definitions',
+        'set_alert_definition_state',
+    }),
+    'vmware-avi': frozenset({
+        'ako_amko_status', 'ako_clusters', 'ako_config_diff', 'ako_config_show',
+        'ako_config_upgrade', 'ako_ingress_check', 'ako_ingress_diagnose',
+        'ako_ingress_map', 'ako_logs', 'ako_restart', 'ako_status', 'ako_sync_diff',
+        'ako_sync_force', 'ako_sync_status', 'ako_version', 'pool_list',
+        'pool_member_disable', 'pool_member_enable', 'pool_members', 'se_health', 'se_list',
+        'ssl_expiry_check', 'ssl_list', 'vs_analytics', 'vs_error_logs', 'vs_list',
+        'vs_status', 'vs_toggle',
+    }),
+    'vmware-debug': frozenset({
+        'incident_timeline', 'list_symptom_categories',
+    }),
+    'vmware-harden': frozenset({
+        'get_baseline_rules', 'get_remediation', 'list_baselines', 'list_drift_events',
+        'list_violations', 'scan_target',
+    }),
+    'vmware-log-insight': frozenset({
+        'alert_get', 'alert_history', 'alert_list', 'log_aggregate', 'log_fields',
+        'log_search', 'log_version',
+    }),
+    'vmware-monitor': frozenset({
+        'active_sessions', 'active_tasks', 'certificate_status', 'cluster_health_summary',
+        'cross_vcenter_attention', 'datastore_capacity', 'datastore_investigation_bundle',
+        'get_alarms', 'get_events', 'get_host_sensors', 'get_host_services',
+        'host_investigation_bundle', 'host_log_scan', 'host_performance', 'license_status',
+        'list_all_clusters', 'list_all_datastores', 'list_all_networks', 'list_esxi_hosts',
+        'list_virtual_machines', 'ntp_status', 'resource_pool_usage', 'snapshot_aging',
+        'vm_info', 'vm_investigation_bundle', 'vm_list_snapshots', 'vm_performance',
+    }),
+    'vmware-nsx': frozenset({
+        'configure_tier0_bgp', 'create_ip_pool', 'create_nat_rule', 'create_segment',
+        'create_static_route', 'create_tier1_gateway', 'delete_ip_pool', 'delete_nat_rule',
+        'delete_segment', 'delete_static_route', 'delete_tier1_gateway',
+        'get_bgp_neighbors', 'get_edge_cluster_status', 'get_ip_pool_usage',
+        'get_logical_port_status', 'get_nsx_manager_status', 'get_segment',
+        'get_segment_port_for_vm', 'get_tier0_gateway', 'get_tier1_gateway',
+        'get_transport_node_status', 'list_edge_clusters', 'list_ip_pools',
+        'list_nat_rules', 'list_nsx_alarms', 'list_segments', 'list_static_routes',
+        'list_tier0_gateways', 'list_tier1_gateways', 'list_transport_nodes',
+        'list_transport_zones', 'update_segment', 'update_tier1_gateway',
+    }),
+    'vmware-nsx-security': frozenset({
+        'apply_vm_tag', 'create_dfw_policy', 'create_dfw_rule', 'create_group',
+        'delete_dfw_policy', 'delete_dfw_rule', 'delete_group', 'get_dfw_policy',
+        'get_dfw_rule_stats', 'get_group', 'get_idps_status', 'get_traceflow_result',
+        'list_dfw_policies', 'list_dfw_rules', 'list_groups', 'list_idps_profiles',
+        'list_vm_tags', 'remove_vm_tag', 'run_traceflow', 'update_dfw_policy',
+        'update_dfw_rule',
+    }),
+    'vmware-pilot': frozenset({
+        'approve', 'cancel_workflow', 'confirm_draft', 'create_workflow', 'design_workflow',
+        'get_skill_catalog', 'get_workflow_status', 'list_workflows', 'plan_workflow',
+        'review_workflow', 'rollback', 'run_workflow', 'update_draft',
+    }),
+    'vmware-storage': frozenset({
+        'browse_datastore', 'list_all_datastores', 'list_cached_images',
+        'scan_datastore_images', 'storage_iscsi_add_target', 'storage_iscsi_enable',
+        'storage_iscsi_remove_target', 'storage_iscsi_status', 'storage_rescan',
+        'vsan_capacity', 'vsan_health',
+    }),
+    'vmware-vks': frozenset({
+        'check_vks_compatibility', 'create_namespace', 'create_tkc_cluster',
+        'delete_namespace', 'delete_tkc_cluster', 'get_harbor_info', 'get_namespace',
+        'get_supervisor_kubeconfig', 'get_supervisor_status', 'get_tkc_available_versions',
+        'get_tkc_cluster', 'get_tkc_kubeconfig', 'list_namespace_storage_usage',
+        'list_namespaces', 'list_supervisor_storage_policies', 'list_tkc_clusters',
+        'list_vm_classes', 'scale_tkc_cluster', 'update_namespace', 'upgrade_tkc_cluster',
+    }),
+}
+
+FAMILY_COMMANDS: dict[str, frozenset[str]] = {
+    'vmware-aiops': frozenset({
+        'alarm acknowledge', 'alarm list', 'alarm reset', 'attention', 'cluster add-host',
+        'cluster configure', 'cluster create', 'cluster delete', 'cluster info',
+        'cluster remove-host', 'daemon start', 'daemon status', 'daemon stop',
+        'datastore browse', 'datastore scan-images', 'deploy batch', 'deploy batch-clone',
+        'deploy iso', 'deploy linked-clone', 'deploy mark-template', 'deploy ova',
+        'deploy template', 'doctor', 'hub status', 'init', 'investigate datastore',
+        'investigate host', 'investigate vm', 'mcp', 'mcp-config generate',
+        'mcp-config install', 'mcp-config list', 'plan list', 'scan now', 'summary',
+        'vm cancel-ttl', 'vm clean-slate', 'vm clone', 'vm create', 'vm delete',
+        'vm guest-download', 'vm guest-exec', 'vm guest-upload', 'vm list-ttl',
+        'vm migrate', 'vm power-off', 'vm power-on', 'vm reconfigure', 'vm set-ttl',
+        'vm snapshot-create', 'vm snapshot-delete', 'vm snapshot-list',
+        'vm snapshot-revert', 'vm task-status',
+    }),
+    'vmware-aria': frozenset({
+        'alert acknowledge', 'alert cancel', 'alert definitions', 'alert get', 'alert list',
+        'anomaly list', 'anomaly risk', 'capacity overview', 'capacity remaining',
+        'capacity rightsizing', 'capacity time-remaining', 'doctor', 'health collectors',
+        'health status', 'init', 'mcp', 'report definitions', 'report delete',
+        'report generate', 'report get', 'report list', 'resource get', 'resource health',
+        'resource list', 'resource metrics', 'resource top',
+    }),
+    'vmware-avi': frozenset({
+        'ako amko-status', 'ako clusters', 'ako config-diff', 'ako config-show',
+        'ako config-upgrade', 'ako ingress-check', 'ako ingress-diagnose',
+        'ako ingress-map', 'ako logs', 'ako restart', 'ako status', 'ako sync-diff',
+        'ako sync-force', 'ako sync-status', 'ako version', 'analytics', 'config', 'doctor',
+        'init', 'logs', 'mcp', 'pool disable', 'pool enable', 'pool members', 'se health',
+        'se list', 'ssl expiry', 'ssl list', 'vs disable', 'vs enable', 'vs list',
+        'vs status',
+    }),
+    'vmware-debug': frozenset({
+        'categories', 'mcp', 'triage', 'version',
+    }),
+    'vmware-harden': frozenset({
+        'advise', 'apply', 'baseline import', 'baseline list', 'baseline validate',
+        'doctor', 'drift', 'mcp', 'report', 'scan', 'web',
+    }),
+    'vmware-log-insight': frozenset({
+        'aggregate', 'alert get', 'alert history', 'alert list', 'doctor', 'fields', 'mcp',
+        'search', 'version',
+    }),
+    'vmware-monitor': frozenset({
+        'activity sessions', 'activity tasks', 'attention', 'capacity datastores',
+        'capacity pools', 'daemon start', 'daemon status', 'daemon stop', 'doctor',
+        'health alarms', 'health events', 'health sensors', 'health services',
+        'infra certs', 'infra licenses', 'infra ntp', 'init', 'inventory clusters',
+        'inventory datastores', 'inventory hosts', 'inventory networks', 'inventory vms',
+        'investigate datastore', 'investigate host', 'investigate vm', 'mcp',
+        'mcp-config generate', 'mcp-config list', 'perf hosts', 'perf vms', 'scan now',
+        'snapshots aging', 'summary', 'vm info', 'vm snapshot-list',
+    }),
+    'vmware-nsx': frozenset({
+        'doctor', 'gateway configure-tier0-bgp', 'gateway create-tier1',
+        'gateway delete-tier1', 'gateway update-tier1', 'health alarms',
+        'health edge-cluster-status', 'health manager-status',
+        'health transport-node-status', 'init', 'inventory get-segment',
+        'inventory get-tier0', 'inventory get-tier1', 'inventory list-edge-clusters',
+        'inventory list-segments', 'inventory list-tier0s', 'inventory list-tier1s',
+        'inventory list-transport-nodes', 'inventory list-transport-zones',
+        'ip-pool create', 'ip-pool delete', 'mcp', 'mcp-config generate',
+        'mcp-config install', 'mcp-config list', 'nat create-rule', 'nat delete-rule',
+        'networking bgp-neighbors', 'networking ip-pool-usage', 'networking list-ip-pools',
+        'networking list-nat-rules', 'networking list-static-routes', 'route create-static',
+        'route delete-static', 'segment create', 'segment delete', 'segment update',
+        'troubleshoot port-status', 'troubleshoot vm-segment',
+    }),
+    'vmware-nsx-security': frozenset({
+        'doctor', 'group delete', 'group get', 'group list', 'idps profiles', 'idps status',
+        'init', 'mcp', 'policy create', 'policy delete', 'policy get', 'policy list',
+        'rule delete', 'rule list', 'rule stats', 'tag apply', 'tag list', 'tag remove',
+        'traceflow run',
+    }),
+    'vmware-pilot': frozenset({
+        'mcp', 'version',
+    }),
+    'vmware-storage': frozenset({
+        'datastore browse', 'datastore list', 'datastore scan-images', 'doctor', 'init',
+        'iscsi add-target', 'iscsi enable', 'iscsi remove-target', 'iscsi rescan',
+        'iscsi status', 'mcp', 'vsan capacity', 'vsan health',
+    }),
+    'vmware-vks': frozenset({
+        'check', 'harbor', 'init', 'kubeconfig get', 'kubeconfig supervisor', 'mcp',
+        'namespace create', 'namespace delete', 'namespace get', 'namespace list',
+        'namespace update', 'namespace vm-classes', 'preflight-auth', 'storage',
+        'supervisor status', 'supervisor storage-policies', 'tkc create', 'tkc delete',
+        'tkc get', 'tkc list', 'tkc scale', 'tkc upgrade', 'tkc versions',
+    }),
+}
+
+#: Every tool name anywhere in the family, for citation checks that do
+#: not care which skill owns the name.
+ALL_TOOLS: frozenset[str] = frozenset().union(*FAMILY_TOOLS.values())

vmware_debug-1.8.5/tests/eval/capability/_scores.json

@@ -0,0 +1,184 @@
+{
+  "_comment": "Capability eval scores. Regenerate with: pytest -m capability. These are tracked trends, not pass/fail gates \u2014 see _scoring.py. Entries marked stale=true were carried over from an earlier run because this run did not measure them.",
+  "scores": {
+    "entity_reachability_full": {
+      "detail": {
+        "broken_chains": [],
+        "entry_points": [
+          "incident_timeline",
+          "list_symptom_categories"
+        ],
+        "reachable_on_surface": 0,
+        "reachable_only_via_description": 0,
+        "required_entity_params": 0,
+        "required_params_classified": "0/1",
+        "tool_count": 2
+      },
+      "maximum": 1,
+      "pct": 100.0,
+      "unit": "required entity params",
+      "value": 1
+    },
+    "entity_reachability_read_only": {
+      "detail": {
+        "broken_chains": [],
+        "entry_points": [
+          "incident_timeline",
+          "list_symptom_categories"
+        ],
+        "reachable_on_surface": 0,
+        "reachable_only_via_description": 0,
+        "required_entity_params": 0,
+        "required_params_classified": "0/1",
+        "tool_count": 2
+      },
+      "maximum": 1,
+      "pct": 100.0,
+      "unit": "required entity params",
+      "value": 1
+    },
+    "entry_point_availability": {
+      "detail": {
+        "full_entry_points": 2,
+        "read_only_entry_points": 2
+      },
+      "maximum": 2,
+      "pct": 100.0,
+      "unit": "entry points",
+      "value": 2
+    },
+    "error_actionability": {
+      "detail": {
+        "composed_hint_sites": [],
+        "dead_end_count": 0,
+        "dead_end_errors": [],
+        "per_dimension_pct": {
+          "names_artifact": 100.0,
+          "names_input": 100.0,
+          "states_remedy": 100.0
+        },
+        "raise_sites": 7
+      },
+      "maximum": 21,
+      "pct": 100.0,
+      "unit": "points",
+      "value": 21
+    },
+    "manifest_context_headroom": {
+      "detail": {
+        "heaviest_tools": {
+          "incident_timeline": 329,
+          "list_symptom_categories": 121
+        },
+        "manifest_tokens": 450,
+        "mean_tokens_per_tool": 225.0,
+        "reference_context": 16384,
+        "tool_count": 2
+      },
+      "maximum": 16384,
+      "pct": 97.3,
+      "unit": "tokens",
+      "value": 15934
+    },
+    "parameter_documentation_coverage": {
+      "detail": {
+        "undocumented_by_tool": {}
+      },
+      "maximum": 4,
+      "pct": 100.0,
+      "unit": "parameters",
+      "value": 4
+    },
+    "per_tool_token_discipline": {
+      "detail": {
+        "ceiling": 350,
+        "over_ceiling": {}
+      },
+      "maximum": 2,
+      "pct": 100.0,
+      "unit": "tools",
+      "value": 2
+    },
+    "read_only_manifest_saving": {
+      "detail": {
+        "full_manifest_tokens": 450,
+        "full_tool_count": 2,
+        "gated_manifest_tokens": 450,
+        "gated_tool_count": 2,
+        "withheld_tools": []
+      },
+      "maximum": 450,
+      "pct": 0.0,
+      "unit": "tokens",
+      "value": 0
+    },
+    "read_write_marker_coverage": {
+      "detail": {
+        "unmarked": []
+      },
+      "maximum": 2,
+      "pct": 100.0,
+      "unit": "points",
+      "value": 2
+    },
+    "remedy_survives_truncation": {
+      "detail": {
+        "budget_chars": 500,
+        "over_budget": [],
+        "remedy_after_interpolation": [
+          "envelope.py:135",
+          "envelope.py:95",
+          "envelope.py:160",
+          "envelope.py:107",
+          "envelope.py:200",
+          "timeline.py:119"
+        ]
+      },
+      "maximum": 7,
+      "pct": 100.0,
+      "unit": "messages",
+      "value": 7
+    },
+    "teaching_error_rate": {
+      "detail": {},
+      "maximum": 7,
+      "pct": 100.0,
+      "unit": "messages",
+      "value": 7
+    },
+    "tool_description_quality": {
+      "detail": {
+        "per_dimension_pct": {
+          "args": 100.0,
+          "gotcha": 100.0,
+          "marker": 100.0,
+          "next_hop": 100.0,
+          "what": 100.0,
+          "when": 100.0
+        },
+        "tools_graded": 2,
+        "weakest_tools": {
+          "incident_timeline": [],
+          "list_symptom_categories": []
+        }
+      },
+      "maximum": 12,
+      "pct": 100.0,
+      "unit": "points",
+      "value": 12
+    },
+    "tool_failure_payload_quality": {
+      "detail": {
+        "bare_string_error_lines": [],
+        "carries_hint": 1,
+        "dict_shaped": 1,
+        "error_return_sites": 1,
+        "hint_names_artifact": 1
+      },
+      "maximum": 3,
+      "pct": 100.0,
+      "unit": "checks",
+      "value": 3
+    }
+  }
+}