Repository navigation
feat(rules): detect missing EBTE tool-call claims and mediation (schema 32) - #276
Merged
Merged
Conversation
…ma 27) New claim_use discovery fact on Python decorated tools that declare a claim parameter (unused / passthrough / checked / wrapped; an OpenAI tool input guardrail counts as a possible mediator) and a tool_claim_use predicate, with a loader check on its values. SupportedSchemaVersion 26 -> 27. Fixture mirror of nine new rules, a ladder per SDK (OpenAI Agents, MCP, LangChain; Python): OAI-034/MCP-033/LC-028 side-effecting tool with no claim, OAI-035/MCP-034/LC-029 claim never read, OAI-036/MCP-035/LC-030 claim only printed, logged, serialized or returned.
…ions OAI-034 / MCP-033 / LC-028 move from low to info. Nobody uses a claim argument yet, so at low they would fail every --strict run on a repo with side-effecting tools. Info shows the finding and its fix in every report, never fails --strict, and weighs 0.05 in the score instead of 0.15. The unused and passthrough rungs stay medium: they fire only on code that adopted claims. The other open questions are settled without code changes. The passthrough reading and the exact `claim` name stay. The topic file stays. Claude Agent SDK is the next SDK. Signing and the badge are left to the rules repo's workflows.
ericksondelacruz
requested review from
ivanpaghubasan,
jhumel-code and
sairenchristianbuerano
and removed request for
jhumel-code
October 22, 2026 08:04
trustabl
approved these changes
Oct 22, 2026
Main took schema 27 for OBS-009..012 (#261). The 26 -> 27 bump here merged cleanly on top of it, so renumber by hand: SupportedSchemaVersion and the fixture manifest go to 28. COVERAGE.md keeps both review entries; CHANGELOG, CLAUDE.md, ARCHITECTURE and COVERAGE restate the batch as 27 -> 28 with re-derived counts (356 = 347 + 9).
ericksondelacruz
changed the title
trustabl
approved these changes
Oct 25, 2026
sairenchristianbuerano
approved these changes
Oct 25, 2026
ivanpaghubasan
approved these changes
Oct 26, 2026
Main took schema 28 for CI-001..005 (#264), 29 for CSDK-115 (#273), 30 for MCPCFG-003 and 31 for AGCFG-011 after this branch moved to 28, so renumber by hand: SupportedSchemaVersion and the fixture manifest go to 32, with a schema note for tool_claim_use. CHANGELOG keeps one Added list; CLAUDE.md and COVERAGE.md keep both sides' entries, restated as 31 -> 32 with re-derived counts (364 = 355 + 9). COVERAGE.md drops the two older review lines main had already removed.
ericksondelacruz
changed the title
This was referenced Oct 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Detects EBTE (Explanation-Bound Tool Execution) tool-call claims on Python tools and whether anything mediates them.
claim_usediscovery fact on Python decorated tools that declare aclaimparameter. Its value isunused,passthrough,checkedorwrapped. An OpenAI tool input guardrail, or an extra decorator, counts as a possible mediator (wrapped).tool_claim_usepredicate (addsabsentfor tools with noclaimparameter). The loader validates its values.SupportedSchemaVersiongoes from 31 to 32. Main took 27–31 while this was open (OBS-009..012, CI-001..005, CSDK-115, MCPCFG-003, AGCFG-011).Notes for review
--strictrun on a repo with side-effecting tools. At info the finding and its fix show in every report, never fail--strict, and weigh 0.05 in the score. The unused and passthrough rules stay medium, since they only fire on code that has adopted claims.feat/analyzer-ebte-claims). Their CI pairs with this branch, so merge this PR first.feat/ebte-claims-coverage, schemas 33–36) extends claims to the other SDKs and stacks on this one.Test plan
go build ./...,go vet ./...go test ./...(re-run 2026-10-27 after mergingmainat f0bebfa): unit tests forclaim_useclassification, predicate tests, policy cases, and scanner tests over the fixture rules