AgentCheck 0.5.3

An evidence-integrity patch. Two independently reproduced defects could make a generated suite, or its coverage report, look more complete than the evidence behind it. Both are corrections to what AgentCheck reports about itself — no framework integration is added and the containment guarantee is unchanged.

Fixed

Valid OpenAI tools with a nullable array parameter could disappear from the generated suite. (#85)

Union extraction discarded a schema branch carrying an explicit, valid type whenever that branch also carried structural keywords such as items. An Optional[List[str]] parameter — emitted by the OpenAI Agents SDK as anyOf[{type: array, items: {type: string}}, {type: null}] — was read as type-unknown, so a tool whose required parameter it was received no cases at all. Explicit types are now retained from any mapping branch under anyOf/oneOf, while validation against the complete original schema remains the authority for every emitted value. A union AgentCheck genuinely cannot resolve, such as an unsupported local $ref, still fails closed with no cases rather than a guessed one.

You will see: a tool that previously generated zero cases now generates them.

A developer-declared tool_risk lost its authority in behavioral coverage. (#88)

Coverage decided whether a tool's risk dimensions were real requirements by reading the tool property's authoritative flag — which records how the tool schema was obtained, and is always false on the OpenAI Agents SDK and PydanticAI adapters. Neither SDK carries risk itself, so for those targets the tool_risk block in agentcheck.json is the entire risk authority, and it was being discarded. A tool explicitly declared destructive reported fabricated_success_after_failure, duplicate_action, ambiguous_outcome, and retry_control as unknown, so those requirements never entered the missing denominator.

Risk authority now comes from spec.tool_risk, per axis, while the predicate stays on the ToolDefinition that generation and the derived policy pack already use. Declaring one axis still never upgrades the other's authority, and a tool whose risk is merely inferred still reports risk_metadata_not_authoritative — inference being correct does not make it authoritative.

You will see: on a target declaring tool_risk against an SDK adapter, risk requirements previously reported unknown now report missing or partial. That is reported coverage becoming accurate, not a change in your agent.

Suite identity

GENERATOR_COMPATIBILITY_VERSION stays 1.

• #85 genuinely changes generated case sets, so a suite containing an affected tool re-identifies. Unaffected suites stay byte- and fingerprint-exact.
• #88 changes reporting only and moves no fingerprint.

Not changed

This release does not expand containment, add a framework integration, or change what AgentCheck claims about hostile code, deterministic model execution, or complete observation. A release gate still decides from executed-case verdicts and the trusted baseline; it does not consult behavioral coverage, so a suite that never exercises a declared-destructive tool can still pass. Coverage reports that gap — now accurately for declared tools — but the gate does not act on it.