Repository navigation
feat(rules): detect missing EBTE tool-call claims and mediation (schema 27) - #276
Open
ericksondelacruz wants to merge 2 commits into
Open
ericksondelacruz wants to merge 2 commits into
ericksondelacruz wants to merge 2 commits into
Conversation
…ma 27) New claim_use discovery fact on Python decorated tools that declare a claim parameter (unused / passthrough / checked / wrapped; an OpenAI tool input guardrail counts as a possible mediator) and a tool_claim_use predicate, with a loader check on its values. SupportedSchemaVersion 26 -> 27. Fixture mirror of nine new rules, a ladder per SDK (OpenAI Agents, MCP, LangChain; Python): OAI-034/MCP-033/LC-028 side-effecting tool with no claim, OAI-035/MCP-034/LC-029 claim never read, OAI-036/MCP-035/LC-030 claim only printed, logged, serialized or returned.
…ions OAI-034 / MCP-033 / LC-028 move from low to info. Nobody uses a claim argument yet, so at low they would fail every --strict run on a repo with side-effecting tools. Info shows the finding and its fix in every report, never fails --strict, and weighs 0.05 in the score instead of 0.15. The unused and passthrough rungs stay medium: they fire only on code that adopted claims. The other open questions are settled without code changes. The passthrough reading and the exact `claim` name stay. The topic file stays. Claude Agent SDK is the next SDK. Signing and the badge are left to the rules repo's workflows.
ericksondelacruz
requested review from
ivanpaghubasan,
jhumel-code and
sairenchristianbuerano
and removed request for
jhumel-code
October 22, 2026 08:04
trustabl
approved these changes
Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Detects EBTE (Explanation-Bound Tool Execution) tool-call claims on Python tools and whether anything mediates them.
claim_usediscovery fact on Python decorated tools that declare aclaimparameter. Its value isunused,passthrough,checkedorwrapped. An OpenAI tool input guardrail, or an extra decorator, counts as a possible mediator (wrapped).tool_claim_usepredicate (addsabsentfor tools with noclaimparameter). The loader validates its values.SupportedSchemaVersiongoes from 26 to 27.Notes for review
--strictrun on a repo with side-effecting tools. At info the finding and its fix show in every report, never fail--strict, and weigh 0.05 in the score. The unused and passthrough rules stay medium, since they only fire on code that has adopted claims.feat/analyzer-ebte-claims). Their CI pairs with this branch, so merge this PR first.feat/ebte-claims-coverage, schemas 28–31) extends claims to the other SDKs and stacks on this one.Test plan
go build ./...,go vet ./...go test ./...: unit tests forclaim_useclassification, predicate tests, policy cases, and scanner tests over the fixture rules