[ericksondelacruz]

Summary

OBS-006..008 check that the agent-reliability-otel-labels labels are written at all. This PR adds OBS-009..012, four repo-scope rules that check the labels are correct:

Rule	Fires when	Severity	Confidence
OBS-009	A Run is shared between runs: built at module scope, in a class body, or as a Python default argument, or given a literal run id	medium	0.6
OBS-010	Tool spans are labelled only on success: no mark_tool_span in a finally / except / catch block, an error callback, or a .finally / .catch handler	low	0.55
OBS-011	Every tool-span label passes attempt as a constant	low	0.7
OBS-012	No run-end label can record a failure	low	0.55

Changes

• Discovery (internal/analysis/otel_labels_facts.go). OtelLabelsSignal gains the run_construct kind and the facts the rules read: ModuleScope, RunIDConst, FailureSafe, HookUnknown, ErrorPath, AttemptConst, SideEffect and ExitReason. Three cases are deliberately not flagged:
  • A Python if __name__ == "__main__": construct is a one-run script.
  • A non-static TS/JS class field runs once per instance.
  • Labels inside an OpenAI Agents RunHooks / AgentHooks on_tool_end are treated as unknown, not unsafe.
• Rules. Four new predicates. Test files never count, and one correct call credits the whole repo.
• Finding location. Findings point at the offending call's file and line, so SARIF renders them as located results.
• Report. The scan report gains otel_labels. It is not folded into ScanID.
• Schema. schema_version goes from 26 to 27, because main already took 22 for LC-116 and 23–26 for the agent_config pack.
• Docs. ARCHITECTURE, COVERAGE, README, CLAUDE.md and schema.yaml are updated. The fixture holds 347 rules.

Testing

• go vet ./... and go test -race ./... pass.
• scripts/check-rules-sync.sh against the agent-reliability-rules branch feat/otel-labels-correctness: in sync, 133 files (re-run 2026-10-26 after merging main).
• The 0.1.1 README examples from agent-reliability-otel-labels were scanned with this build: all facts are correct and no OBS-009..012 fires. The 0.1.0 examples fire all four, each at the offending line.
• On 10 real agent repos, findings were identical before and after (checked 2026-10-08, before the rebase onto main).

Merge order

• Do not merge until agent-reliability-otel-labels 0.1.1 is published. The 0.1.0 README example trips OBS-009..012. The release PR is "Release 0.1.1: README examples that label failed tool calls and failed runs" in agent-reliability-otel-labels.
• Merge together with the feat/otel-labels-correctness PRs in agent-reliability-rules and trustabl-rulebook. The rulebook PR is "Rationale for OBS-009..012 (otel-labels label correctness) and LC-116".
• CI's rules-sync job uses the rules branch with the same name when it exists.

Known limits

Recorded in the design spec and not addressed in this PR:

• OBS-009 fires on a module-level Run() in examples/ or scripts/.
• A few failure-safe shapes are not recognised: Python __exit__, and TS .then(ok, onRejected).
• self.run = Run() in a long-lived object is not caught.
• A conditional exit reason whose branches are all literals counts as variable.

[sairenchristianbuerano]

Resolve merge conflict

[sairenchristianbuerano]

@ericksondelacruz heads-up on the rule schema number before this merges.

main is now at schema 25 in both the analyzer and the rules pack: AGCFG-008 (Codex hooks) took 24 and AGCFG-009 (AGENTS.md hidden text) took 25. This PR still sets 23 (it was 22), and the companion rules PR #184 sets 23 too. Merged as is, the engine constant would go backwards while the pack says 25, and an older engine would skip the OTel label rules without telling anyone.

Before merging:

1. Merge or rebase main. Expect conflicts in internal/rules/schema_version.go, testdata/rules-fixture/manifest.yaml, schema.go, evaluator.go, schema.yaml and policies_test.go (AGCFG-008 and 009 touched the same places).
2. Set the schema to the next free number, 26 (or 27 if the CI rules pair in feat(analysis): add github_workflow component and CI-001..005 predicates (rule schema 28, provisional) #264 merges first). Check main right before you set it. Use the same number in internal/rules/schema_version.go, the analyzer's testdata/rules-fixture/manifest.yaml, and manifest.yaml in docs(skill): list every --detectors category the CLI accepts #184.
3. Run go test ./... and check the rule files are still identical in the fixture and the rules pack.
4. Merge the analyzer first, then docs(skill): list every --detectors category the CLI accepts #184 and the rulebook PR right after.

[ericksondelacruz]

@ericksondelacruz heads-up on the rule schema number before this merges.

main is now at schema 25 in both the analyzer and the rules pack: AGCFG-008 (Codex hooks) took 24 and AGCFG-009 (AGENTS.md hidden text) took 25. This PR still sets 23 (it was 22), and the companion rules PR #184 sets 23 too. Merged as is, the engine constant would go backwards while the pack says 25, and an older engine would skip the OTel label rules without telling anyone.

Before merging:

1. Merge or rebase main. Expect conflicts in internal/rules/schema_version.go, testdata/rules-fixture/manifest.yaml, schema.go, evaluator.go, schema.yaml and policies_test.go (AGCFG-008 and 009 touched the same places).
2. Set the schema to the next free number, 26 (or 27 if the CI rules pair in feat(analysis): add github_workflow component and CI-001..005 predicates (rule schema 30, provisional) #264 merges first). Check main right before you set it. Use the same number in internal/rules/schema_version.go, the analyzer's testdata/rules-fixture/manifest.yaml, and manifest.yaml in docs(skill): list every --detectors category the CLI accepts #184.
3. Run go test ./... and check the rule files are still identical in the fixture and the rules pack.
4. Merge the analyzer first, then docs(skill): list every --detectors category the CLI accepts #184 and the rulebook PR right after.

This is now handled. Thank you!