Prove it.

# Catches the vibes-vs-contract failure mode: an agent processes a payment
# without first validating it. The user-facing response sounds correct and
# the customer is satisfied, so an LLM-as-judge sees nothing wrong. The
# deterministic contract sees what's missing.
#
# Reference trace: examples/traces/incidents/vibes_vs_contract.json
# Companion judge output: examples/traces/incidents/vibes_vs_contract.judge.json
#
# Why two distinct prerequisites: payment safety in production typically
# requires both a business-logic check (validate_payment: amount, idempotency,
# fraud rules) and a card-instrument check (verify_card: AVS/CVV/3DS).
# Either one alone would not be enough to authorise capture.

requires_prior_work:
  submit_payment:
    required: [validate_payment, verify_card]
    min_distinct: 2

# Catches: Replit agent running DROP DATABASE on production (July 2025).
# Block any drop_database / drop_table call before it executes.
banned_tools:
  - drop_database
  - drop_table

# Catches: Amazon Kiro agent deleting an AWS environment (Dec 2025,
# 13-hour outage). Block delete_environment before it executes.
banned_tools:
  - delete_environment

# Catches: n8n upgrade silently breaking tool output schemas (Feb 2026).
# Tool outputs that don't match the expected shape fire schema_validation.
schemas:
  vector_store_query:
    type: object
    required: [output]
  generate_response:
    type: object
    required: [output, status]

# Catches: AutoGen-style runaway loop calling llm_call 22 times.
# Cap repetition + cap per-trace cost.
max_tool_repeat: 10
cost_budget_usd: 5.0

# Catches: agent retrying the same broken tool call repeatedly with
# identical arguments instead of changing approach. The #1 failure
# mode in production agents.
max_retries: 3

# Catches: multi-agent orchestrators dispatching the same task twice
# to different agents (duplicate assign_task). Constrain the worker
# tools and bound repetition.
max_tool_repeat: 1
allowed_tools: [research, compile_report]

# Catches the brilliant-intern shortcut: agent "finishes" the task
# without doing real work. Two layers of defence:
#   1. `search` must return at least 1 result (schema minItems).
#   2. `finish` must be preceded by at least one call each of
#      `search` AND `analyze` before the agent is allowed to declare
#      success.
#
# Detected in examples/traces/incidents/lazy_agent_shortcut.json,
# the agent called search, got an empty result set, and called finish
# with {"status": "ok", "summary": "done"} anyway.

schemas:
  search:
    type: object
    required: [results]
    properties:
      results:
        type: array
        minItems: 1
  finish:
    type: object
    required: [summary]
    properties:
      summary:
        type: string
        minLength: 40

requires_prior_work:
  finish:
    required: [search, analyze]
    min_distinct: 2

# Catches: Air Canada chatbot (Feb 2024) telling a customer a
# bereavement refund policy that did not exist. Tribunal ordered
# Air Canada to honour the hallucinated answer.
#
# Rule: any policy-reply tool must be preceded by a call to the
# source-of-truth policy lookup. The agent cannot make up policy.
requires_prior_work:
  send_policy_reply:
    required: [lookup_official_policy]
    min_distinct: 1

# Catches: prompt injection via retrieved document (OWASP LLM01:2025).
# Agent reads an external page; the page contains "ignore previous
# instructions..." markers; agent then takes a destructive action
# (e.g. exfil email).
#
# Two layers of defence:
#   1. banned_tools bars send_email when content-origin is untrusted.
#      In a real deployment the agent would have a narrower send_email
#      (e.g. only to approved recipients); this pack treats send_email
#      as privileged.
#   2. requires_prior_work forces human approval before send_email.
#      Any email cannot be sent without an approval_request call first.
banned_tools:
  - send_email_untrusted
requires_prior_work:
  send_email:
    required: [request_human_approval]
    min_distinct: 1

# Catches: agent compiling user input into SQL that contains a
# destructive compound statement. The user's question carried a
# "DROP TABLE" payload through the natural-language → SQL compiler
# and into execute_sql.
#
# Defence: scan execute_sql tool_input for known-dangerous SQL
# constructs. In production you would pair this with a SQL AST
# validator; this config is the minimum guard-time defence that
# catches the obvious payload.
dangerous_input_patterns:
  execute_sql:
    - "DROP\\s+TABLE"
    - "DROP\\s+DATABASE"
    - "TRUNCATE\\s+TABLE"
    - ";\\s*DELETE\\s+FROM"

# Catches: agent requesting human approval, receiving a denial, and
# executing the action anyway. Ordering alone (tool_must_precede)
# cannot catch this, the sequence looks correct. The fix is an
# output-conditional gate that blocks the downstream tool when the
# gate tool returned a denial.
gates:
  - tool: request_approval
    key: approved
    block_value: false
    blocked: execute_transfer

# Catches: DataTalks.Club production database wipe (early March 2026).
#
# Claude Code session switched machines mid-engagement. Local terraform
# state was stale and pointed at production. Agent ran
# `terraform destroy` as part of a "clean up the dev env" task. Result:
# 2.5 years of homework, projects, and leaderboard data, 1,943,200
# rows, deleted along with their snapshots. AWS restored from an
# internal snapshot ~24 hours later.
#
# Public source: https://x.com/Al_Grigor/status/2029889772181934425
# Follow-up coverage (Tom's Hardware, AwesomeAgents, many others).
#
# Primitive: scan Bash tool_input for destructive verbs that should
# never run unattended. Same shape as the SQL injection fixture, but
# guarding a different tool and a broader verb set.
dangerous_input_patterns:
  Bash:
    - "terraform\\s+(destroy|apply\\s+.*-auto-approve)"
    - "rm\\s+-rf\\s+/"
    - "DROP\\s+(TABLE|DATABASE|SCHEMA)"
    - "aws\\s+[a-z0-9-]+\\s+delete-"
    - "kubectl\\s+delete\\s+(ns|namespace)"
    - "gcloud\\s+.*\\s+delete"

# Catches: AI-SDR agents placing outbound voice/SMS without prior
# consent + DNC checks. Anchored to the FTC v. Air AI Technologies
# settlement (March 24, 2026, $18M judgment, suspended) and active
# class actions Lamb v. Mortgage One (E.D. Mich. Feb 24, 2026) and
# Finley v. Altrua.
#
# Public sources:
#   - biglysales.com/air-ai-ftc-settlement-ai-calling-alternatives
#   - henson-legal.com/newsroom/ai-tcpa-lawsuit-mortgage-one-class-action
#   - ginsburglawgroup.com/2026/02/ai-robocalls-the-tcpa-consent-rules
#
# Statutory exposure under TCPA: $500–$1,500 per call. A mid-market
# AI-SDR agent making 10,000 unchecked calls/month is a $5M/month
# insurance problem.
#
# Primitive: requires_prior_work on outbound tools. Before any
# send_voice_call / send_sms / send_outreach, the agent must have
# called BOTH check_dnc_registry AND verify_consent for the contact.
# Same pattern as the Air Canada and Kiro HITL fixtures, tuned to
# the GTM-compliance shape.
requires_prior_work:
  send_voice_call:
    required: [check_dnc_registry, verify_consent]
  send_sms:
    required: [check_dnc_registry, verify_consent]
  send_outreach:
    required: [check_dnc_registry, verify_consent]

# Second layer: block calls explicitly flagged DNC or consent=denied
gates:
  - after: check_dnc_registry
    output_key: dnc
    block_value: true
    blocked: [send_voice_call, send_sms, send_outreach]
  - after: verify_consent
    output_key: consent_type
    block_value: none
    blocked: [send_voice_call, send_sms, send_outreach]

# Catches the pattern behind the February 2026 Claude Code regression:
# agents flipping from research-first (Read/Grep/Glob before Edit) to
# edit-first (blind Edits with no prior exploration, rapid same-file
# edits, trial-and-error signature).
#
# The industry noticed this regression ~60 days late via Reddit
# session-file forensics. Every symptom was sitting in OTel traces
# the whole time. The config below is what a day-3 detector looks
# like — runs structurally on the trajectory shape, not on model
# probabilities.
#
# Rules:
#   1. Edit must be preceded by at least one distinct prior tool call
#      (Read, Grep, Glob, Bash, anything that implies the agent
#      investigated before typing).
#   2. No tool may run more than 2 times consecutively. A 3rd identical
#      call in a row is the trial-and-error signature.

requires_prior_work:
  Edit:
    min_distinct: 1

max_tool_repeat: 2
max_retries: 3