Your agent run passed. Can you prove it was allowed?

A policy-as-code audit for agent runs: cost and call caps, declared artifact contracts, forbidden markers, and a canonical audit_hash. On 13 archived runs, the declared contract, not the data, decided whether they passed.