@ai-sdlc/orchestrator 0.10.0 → 0.13.0

package/dist/compliance/composer.js

@@ -0,0 +1,258 @@
+/**
+ * Regime → DerivedGates composer (RFC-0022 §9 Phase 2).
+ *
+ * Reads the CompliancePosture's declared regime list, looks up each regime's
+ * DerivedGates values from spec/compliance/regime-mappings.yaml, composes
+ * them using "tightest-wins" semantics (RFC-0022 §6), applies adopter
+ * regimeOverrides per-regime (OQ-1), and finally applies operator-level
+ * derivedGates overrides last.
+ *
+ * Key design decisions:
+ *  - YAML mapping file is read at call time (not module load) so tests can
+ *    supply a custom mappings path without patching module state.
+ *  - Tightest-wins is axis-specific: ordinal enums max, boolean OR, numeric max.
+ *  - UnknownRegime is thrown when a declared regime ID has no entry in the
+ *    mapping table (Phase 2 activation of the placeholder from Phase 1 errors.ts).
+ *  - Adopter regimeOverrides (OQ-1) let per-regime control values be adjusted
+ *    before the operator-override pass, enabling bespoke auditor interpretations
+ *    without changing the canonical mapping table.
+ *  - Operator derivedGates overrides (validated by the loader) always win last.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { parse as parseYaml } from 'yaml';
+import { BASELINE_DERIVED_GATES } from './types.js';
+import { UnknownRegime } from './errors.js';
+// ── Constants ─────────────────────────────────────────────────────────────
+/**
+ * Path to the canonical regime-mappings.yaml, relative to the package root.
+ * The composer resolves this against the nearest ancestor directory containing
+ * the file (walking up from the orchestrator package).
+ *
+ * Tests may override via `ComposerOptions.mappingsPath`.
+ */
+const DEFAULT_MAPPINGS_PATH = 'spec/compliance/regime-mappings.yaml';
+// ── Ordinal helpers ───────────────────────────────────────────────────────
+const SECRET_SCAN_ORDINAL = {
+    minimal: 0,
+    standard: 1,
+    strict: 2,
+};
+const REVIEWER_AUTHORITY_ORDINAL = {
+    open: 0,
+    allowlist: 1,
+    'allowlist+role': 2,
+};
+// ── Mapping loader ────────────────────────────────────────────────────────
+/**
+ * Load and parse the regime-mappings.yaml file.
+ */
+function loadMappingsFile(mappingsPath) {
+    if (!existsSync(mappingsPath)) {
+        throw new Error(`Regime mappings file not found at '${mappingsPath}'. ` +
+            `Expected spec/compliance/regime-mappings.yaml in the repository root.`);
+    }
+    const content = readFileSync(mappingsPath, 'utf-8');
+    const parsed = parseYaml(content);
+    if (!parsed?.regimes || typeof parsed.regimes !== 'object') {
+        throw new Error(`Invalid regime-mappings.yaml: expected a top-level 'regimes' map at '${mappingsPath}'.`);
+    }
+    return parsed;
+}
+// ── Tightest-wins logic ───────────────────────────────────────────────────
+/**
+ * Merge a single regime's DerivedGates into the accumulator using
+ * "tightest-wins" semantics per axis (RFC-0022 §6).
+ */
+function mergeRegimeGates(accumulator, incoming) {
+    // databaseBranchPool: per-shard beats shared-with-rls
+    const databaseBranchPool = accumulator.databaseBranchPool === 'per-shard' || incoming.databaseBranchPool === 'per-shard'
+        ? 'per-shard'
+        : 'shared-with-rls';
+    // secretScanStrictness: ordinal max
+    const incomingOrdinal = SECRET_SCAN_ORDINAL[incoming.secretScanStrictness];
+    const accOrdinal = SECRET_SCAN_ORDINAL[accumulator.secretScanStrictness];
+    const secretScanStrictness = incomingOrdinal > accOrdinal ? incoming.secretScanStrictness : accumulator.secretScanStrictness;
+    // attestationRequired: boolean OR
+    const attestationRequired = accumulator.attestationRequired || incoming.attestationRequired;
+    // auditRetentionDays: numeric max
+    const auditRetentionDays = Math.max(accumulator.auditRetentionDays, incoming.auditRetentionDays);
+    // reviewerAuthorityModel: ordinal max
+    const incomingReviewerOrdinal = REVIEWER_AUTHORITY_ORDINAL[incoming.reviewerAuthorityModel];
+    const accReviewerOrdinal = REVIEWER_AUTHORITY_ORDINAL[accumulator.reviewerAuthorityModel];
+    const reviewerAuthorityModel = incomingReviewerOrdinal > accReviewerOrdinal
+        ? incoming.reviewerAuthorityModel
+        : accumulator.reviewerAuthorityModel;
+    return {
+        databaseBranchPool,
+        secretScanStrictness,
+        attestationRequired,
+        auditRetentionDays,
+        reviewerAuthorityModel,
+    };
+}
+// ── Adopter regimeOverrides application ──────────────────────────────────
+/**
+ * Apply adopter-supplied per-regime overrides to a regime's base DerivedGates.
+ *
+ * Per OQ-1: adopters may supply `compliance.yaml regimeOverrides.<regimeId>`
+ * to adjust per-regime control values before the tightest-wins composition
+ * pass. This lets adopters document bespoke auditor interpretations
+ * (e.g., "our HIPAA auditor accepts shared-with-rls with X controls evidence").
+ *
+ * The override entry uses the same field names as DerivedGates; `_notes` is
+ * carried for audit traceability but not validated here (the loader handles
+ * that for operator-level overrides; adopter regimeOverrides are advisory).
+ */
+function applyRegimeOverrides(base, override) {
+    return {
+        databaseBranchPool: override.databaseBranchPool ?? base.databaseBranchPool,
+        secretScanStrictness: override.secretScanStrictness ?? base.secretScanStrictness,
+        attestationRequired: override.attestationRequired ?? base.attestationRequired,
+        auditRetentionDays: override.auditRetentionDays ?? base.auditRetentionDays,
+        reviewerAuthorityModel: override.reviewerAuthorityModel ?? base.reviewerAuthorityModel,
+    };
+}
+// ── Operator override application ────────────────────────────────────────
+/**
+ * Apply operator-level derivedGates overrides as the final pass.
+ *
+ * Per RFC-0022 §6: operator overrides always win. The loader already validated
+ * that each overridden field has a non-empty `_notes` entry; here we just
+ * apply the values.
+ */
+function applyOperatorOverrides(composed, overrides) {
+    return {
+        databaseBranchPool: overrides.databaseBranchPool ?? composed.databaseBranchPool,
+        secretScanStrictness: overrides.secretScanStrictness ?? composed.secretScanStrictness,
+        attestationRequired: overrides.attestationRequired ?? composed.attestationRequired,
+        auditRetentionDays: overrides.auditRetentionDays ?? composed.auditRetentionDays,
+        reviewerAuthorityModel: overrides.reviewerAuthorityModel ?? composed.reviewerAuthorityModel,
+    };
+}
+/**
+ * Compose a loaded CompliancePosture into a concrete DerivedGates value.
+ *
+ * Algorithm (RFC-0022 §6):
+ *  1. Start from BASELINE_DERIVED_GATES.
+ *  2. For each declared regime, look up its entry in regime-mappings.yaml.
+ *     Throw UnknownRegime if not found.
+ *  3. Apply adopter regimeOverrides (per-regime) before composition (OQ-1).
+ *  4. Merge each regime's gates into the accumulator via tightest-wins.
+ *  5. Apply operator derivedGates overrides last — they always win.
+ *
+ * @param posture - A single CompliancePosture (element from the loader's list).
+ * @param options - Optional override for the mappings file path.
+ * @returns CompositionResult with the resolved DerivedGates.
+ * @throws UnknownRegime if any declared regime ID is not in the mapping table.
+ */
+export function composePostureDerivedGates(posture, options = {}) {
+    // Resolve mappings file path
+    let mappingsPath;
+    if (options.mappingsPath) {
+        mappingsPath = options.mappingsPath;
+    }
+    else {
+        const repoRoot = options.repoRoot ?? findRepoRoot();
+        mappingsPath = resolve(repoRoot, DEFAULT_MAPPINGS_PATH);
+    }
+    const mappingsFile = loadMappingsFile(mappingsPath);
+    const regimes = posture.spec.regimes;
+    // Baseline: no regimes declared → return baseline
+    if (regimes.length === 0) {
+        return {
+            derivedGates: { ...BASELINE_DERIVED_GATES },
+            composedRegimes: [],
+            regimesWithAdopterOverrides: [],
+            operatorOverriddenFields: [],
+        };
+    }
+    // Extract adopter regimeOverrides if present (OQ-1)
+    // The CompliancePosture spec does not currently have a `regimeOverrides` field
+    // at the TypeScript type level (it's an OQ-1 addition); we read it via type
+    // assertion since the loader passes through unknown fields from YAML.
+    const regimeOverrides = (posture.spec['regimeOverrides'] ??
+        {});
+    let accumulator = { ...BASELINE_DERIVED_GATES };
+    const composedRegimes = [];
+    const regimesWithAdopterOverrides = [];
+    for (const regime of regimes) {
+        const regimeId = regime.id;
+        const mappingEntry = mappingsFile.regimes[regimeId];
+        if (!mappingEntry) {
+            throw new UnknownRegime(regimeId);
+        }
+        // Apply adopter per-regime override before tightest-wins composition (OQ-1)
+        let effectiveEntry = mappingEntry;
+        if (regimeOverrides[regimeId]) {
+            effectiveEntry = applyRegimeOverrides(mappingEntry, regimeOverrides[regimeId]);
+            regimesWithAdopterOverrides.push(regimeId);
+        }
+        accumulator = mergeRegimeGates(accumulator, effectiveEntry);
+        composedRegimes.push(regimeId);
+    }
+    // Apply operator-level derivedGates overrides last (always win)
+    const operatorOverrides = posture.spec.derivedGates;
+    let finalGates = accumulator;
+    const operatorOverriddenFields = [];
+    if (operatorOverrides) {
+        const overrideKeys = [
+            'databaseBranchPool',
+            'secretScanStrictness',
+            'attestationRequired',
+            'auditRetentionDays',
+            'reviewerAuthorityModel',
+        ];
+        for (const key of overrideKeys) {
+            if (key in operatorOverrides && operatorOverrides[key] !== undefined) {
+                operatorOverriddenFields.push(key);
+            }
+        }
+        finalGates = applyOperatorOverrides(accumulator, operatorOverrides);
+    }
+    return {
+        derivedGates: finalGates,
+        composedRegimes,
+        regimesWithAdopterOverrides,
+        operatorOverriddenFields,
+    };
+}
+// ── Repo root detection ───────────────────────────────────────────────────
+/**
+ * Walk up from the current file's directory to find the repository root.
+ * Detected by the presence of spec/compliance/regime-mappings.yaml or package.json
+ * with a workspace marker.
+ *
+ * Falls back to `process.cwd()` if the walk exhausts without finding the root.
+ */
+function findRepoRoot() {
+    // Walk up from the orchestrator package directory
+    try {
+        return findMappingsFileDir(new URL('.', import.meta.url).pathname);
+    }
+    catch {
+        // Fallback: walk up from cwd
+        return findMappingsFileDir(process.cwd());
+    }
+}
+/**
+ * Walk up from baseDir to find a directory containing
+ * `spec/compliance/regime-mappings.yaml`.
+ */
+function findMappingsFileDir(baseDir) {
+    let dir = baseDir;
+    for (let i = 0; i < 10; i++) {
+        const candidate = resolve(dir, DEFAULT_MAPPINGS_PATH);
+        if (existsSync(candidate)) {
+            return dir;
+        }
+        const parent = resolve(dir, '..');
+        if (parent === dir) {
+            break;
+        }
+        dir = parent;
+    }
+    // Return current directory as last resort; loadMappingsFile will give a clear error
+    return process.cwd();
+}
+//# sourceMappingURL=composer.js.map

package/dist/compliance/errors.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Custom error classes for the CompliancePosture loader (RFC-0022 §9 Phase 1).
+ *
+ * These errors signal load-time validation failures that the loader surface
+ * propagates to callers so they can provide actionable operator messages.
+ */
+/**
+ * Thrown when a declared regime is missing required attestation metadata.
+ *
+ * Per RFC-0022 §5: compliance regimes are legal claims; the framework MUST NOT
+ * let an operator silently declare HIPAA coverage without recording who said so.
+ * A CompliancePosture whose regimes lack `attestedBy` or `attestedAt` fails to
+ * load with this error.
+ */
+export declare class MissingComplianceAttestation extends Error {
+    readonly regimeId: string;
+    readonly missingField: 'attestedBy' | 'attestedAt';
+    constructor(regimeId: string, missingField: 'attestedBy' | 'attestedAt');
+}
+/**
+ * Thrown when a `derivedGates` override is present without a corresponding
+ * `_notes` entry (or the notes entry is empty).
+ *
+ * Per RFC-0022 §6 (OQ-2): every operator override on a derived gate carries an
+ * `attestedNotes` entry; the framework refuses to load a posture with `derivedGates`
+ * overrides whose notes are missing or empty. Forcing explicit rationale makes
+ * overrides audit-traceable.
+ */
+export declare class MissingDerivedGateOverrideNotes extends Error {
+    readonly gateField: string;
+    constructor(gateField: string);
+}
+/**
+ * Thrown when a regime `id` is declared but not present in the framework's
+ * canonical regime registry (spec/compliance/regime-mappings.yaml).
+ *
+ * Phase 1 note: the regime-mappings.yaml file ships in Phase 2 (AISDLC-323).
+ * In Phase 1, this error is reserved for future use when the composer validates
+ * declared regime IDs against the mapping table. The loader does NOT throw this
+ * error in Phase 1 — unknown regime IDs are loaded and passed through unchanged
+ * (the composer in Phase 2 will validate them against the mapping).
+ */
+export declare class UnknownRegime extends Error {
+    readonly regimeId: string;
+    constructor(regimeId: string);
+}
+/**
+ * Thrown when .ai-sdlc/compliance.yaml exists but fails JSON Schema validation
+ * against spec/schemas/compliance-posture.v1.schema.json.
+ *
+ * Distinct from MissingComplianceAttestation and MissingDerivedGateOverrideNotes
+ * which are semantic validations layered on top of schema validation.
+ */
+export declare class CompliancePostureValidationError extends Error {
+    readonly validationErrors: Array<{
+        path: string;
+        message: string;
+    }>;
+    constructor(validationErrors: Array<{
+        path: string;
+        message: string;
+    }>);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/compliance/errors.js

@@ -0,0 +1,85 @@
+/**
+ * Custom error classes for the CompliancePosture loader (RFC-0022 §9 Phase 1).
+ *
+ * These errors signal load-time validation failures that the loader surface
+ * propagates to callers so they can provide actionable operator messages.
+ */
+/**
+ * Thrown when a declared regime is missing required attestation metadata.
+ *
+ * Per RFC-0022 §5: compliance regimes are legal claims; the framework MUST NOT
+ * let an operator silently declare HIPAA coverage without recording who said so.
+ * A CompliancePosture whose regimes lack `attestedBy` or `attestedAt` fails to
+ * load with this error.
+ */
+export class MissingComplianceAttestation extends Error {
+    regimeId;
+    missingField;
+    constructor(regimeId, missingField) {
+        super(`CompliancePosture regime '${regimeId}' is missing required attestation field '${missingField}'. ` +
+            `Compliance regimes are legal claims — the framework requires explicit operator/legal sign-off. ` +
+            `Add '${missingField}' to the regime declaration in .ai-sdlc/compliance.yaml.`);
+        this.name = 'MissingComplianceAttestation';
+        this.regimeId = regimeId;
+        this.missingField = missingField;
+    }
+}
+/**
+ * Thrown when a `derivedGates` override is present without a corresponding
+ * `_notes` entry (or the notes entry is empty).
+ *
+ * Per RFC-0022 §6 (OQ-2): every operator override on a derived gate carries an
+ * `attestedNotes` entry; the framework refuses to load a posture with `derivedGates`
+ * overrides whose notes are missing or empty. Forcing explicit rationale makes
+ * overrides audit-traceable.
+ */
+export class MissingDerivedGateOverrideNotes extends Error {
+    gateField;
+    constructor(gateField) {
+        super(`CompliancePosture 'derivedGates.${gateField}' is overridden but 'derivedGates._notes.${gateField}' ` +
+            `is missing or empty. All derived-gate overrides require a non-empty rationale in _notes ` +
+            `for audit traceability (RFC-0022 §6 OQ-2). ` +
+            `Add a non-empty notes entry: derivedGates._notes.${gateField}: "<rationale>".`);
+        this.name = 'MissingDerivedGateOverrideNotes';
+        this.gateField = gateField;
+    }
+}
+/**
+ * Thrown when a regime `id` is declared but not present in the framework's
+ * canonical regime registry (spec/compliance/regime-mappings.yaml).
+ *
+ * Phase 1 note: the regime-mappings.yaml file ships in Phase 2 (AISDLC-323).
+ * In Phase 1, this error is reserved for future use when the composer validates
+ * declared regime IDs against the mapping table. The loader does NOT throw this
+ * error in Phase 1 — unknown regime IDs are loaded and passed through unchanged
+ * (the composer in Phase 2 will validate them against the mapping).
+ */
+export class UnknownRegime extends Error {
+    regimeId;
+    constructor(regimeId) {
+        super(`CompliancePosture declares regime '${regimeId}' which is not in the framework's canonical ` +
+            `regime registry. Known regimes are listed in spec/compliance/regime-mappings.yaml. ` +
+            `If this is a custom/adopter-specific regime, it will not derive framework gate defaults ` +
+            `automatically (the composer only handles known regimes).`);
+        this.name = 'UnknownRegime';
+        this.regimeId = regimeId;
+    }
+}
+/**
+ * Thrown when .ai-sdlc/compliance.yaml exists but fails JSON Schema validation
+ * against spec/schemas/compliance-posture.v1.schema.json.
+ *
+ * Distinct from MissingComplianceAttestation and MissingDerivedGateOverrideNotes
+ * which are semantic validations layered on top of schema validation.
+ */
+export class CompliancePostureValidationError extends Error {
+    validationErrors;
+    constructor(validationErrors) {
+        const summary = validationErrors.map((e) => `${e.path}: ${e.message}`).join('; ');
+        super(`CompliancePosture at .ai-sdlc/compliance.yaml failed schema validation: ${summary}. ` +
+            `See spec/schemas/compliance-posture.v1.schema.json for the required shape.`);
+        this.name = 'CompliancePostureValidationError';
+        this.validationErrors = validationErrors;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/compliance/loader.d.ts

@@ -0,0 +1,52 @@
+/**
+ * CompliancePosture loader (RFC-0022 §9 Phase 1).
+ *
+ * Reads `.ai-sdlc/compliance.yaml`, validates against
+ * `spec/schemas/compliance-posture.v1.schema.json`, enforces semantic rules
+ * (OQ-2 override-notes, OQ-6 list return type), and returns the parsed posture.
+ *
+ * Key design decisions:
+ *  - Returns CompliancePosture[] (single-element list in v1) per OQ-6 so v2
+ *    multi-tenant composition is additive — not a breaking API change.
+ *  - Missing manifest → BASELINE_POSTURE returned (no error; AC #6).
+ *  - Regime missing attestedBy / attestedAt → MissingComplianceAttestation thrown.
+ *  - DerivedGates override without _notes entry → MissingDerivedGateOverrideNotes thrown.
+ *  - Schema invalid → CompliancePostureValidationError thrown.
+ */
+import type { CompliancePosture } from './types.js';
+/**
+ * Default path within the project root for the compliance manifest.
+ * Overridable by passing `manifestPath` to `loadCompliancePosture`.
+ */
+export declare const DEFAULT_COMPLIANCE_MANIFEST_PATH = ".ai-sdlc/compliance.yaml";
+/**
+ * Options for `loadCompliancePosture`.
+ */
+export interface LoadCompliancePostureOptions {
+    /**
+     * Absolute path to the directory containing `.ai-sdlc/compliance.yaml`.
+     * Defaults to `process.cwd()`.
+     */
+    projectRoot?: string;
+    /**
+     * Override the manifest file path (relative to `projectRoot`).
+     * Defaults to `.ai-sdlc/compliance.yaml`.
+     */
+    manifestPath?: string;
+}
+/**
+ * Load and validate the project's CompliancePosture from disk.
+ *
+ * Returns a single-element `CompliancePosture[]` per OQ-6 (v2 forward-compat:
+ * v2 multi-tenant will return multiple elements; the single-element v1 shape
+ * is already a list so callers compose against `posture[0].spec.derivedGates`
+ * today and multi-posture composition in v2 is purely additive).
+ *
+ * Semantics:
+ *  - Missing manifest → `[BASELINE_POSTURE]` (AC #6: existing projects with
+ *    no compliance.yaml get the "(none declared)" baseline; no gate changes).
+ *  - Valid manifest → `[parsed_posture]`.
+ *  - Invalid manifest → throws one of the compliance error classes.
+ */
+export declare function loadCompliancePosture(options?: LoadCompliancePostureOptions): CompliancePosture[];
+//# sourceMappingURL=loader.d.ts.map

package/dist/compliance/loader.js

@@ -0,0 +1,124 @@
+/**
+ * CompliancePosture loader (RFC-0022 §9 Phase 1).
+ *
+ * Reads `.ai-sdlc/compliance.yaml`, validates against
+ * `spec/schemas/compliance-posture.v1.schema.json`, enforces semantic rules
+ * (OQ-2 override-notes, OQ-6 list return type), and returns the parsed posture.
+ *
+ * Key design decisions:
+ *  - Returns CompliancePosture[] (single-element list in v1) per OQ-6 so v2
+ *    multi-tenant composition is additive — not a breaking API change.
+ *  - Missing manifest → BASELINE_POSTURE returned (no error; AC #6).
+ *  - Regime missing attestedBy / attestedAt → MissingComplianceAttestation thrown.
+ *  - DerivedGates override without _notes entry → MissingDerivedGateOverrideNotes thrown.
+ *  - Schema invalid → CompliancePostureValidationError thrown.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { parse as parseYaml } from 'yaml';
+import { validateResource } from '@ai-sdlc/reference';
+import { BASELINE_POSTURE } from './types.js';
+import { CompliancePostureValidationError, MissingComplianceAttestation, MissingDerivedGateOverrideNotes, } from './errors.js';
+// ── Constants ────────────────────────────────────────────────────────────
+/**
+ * Default path within the project root for the compliance manifest.
+ * Overridable by passing `manifestPath` to `loadCompliancePosture`.
+ */
+export const DEFAULT_COMPLIANCE_MANIFEST_PATH = '.ai-sdlc/compliance.yaml';
+/**
+ * Gate fields that are present in DerivedGates (excluding _notes itself).
+ * Used to enumerate override fields for OQ-2 validation.
+ */
+const DERIVED_GATE_FIELDS = [
+    'databaseBranchPool',
+    'secretScanStrictness',
+    'attestationRequired',
+    'auditRetentionDays',
+    'reviewerAuthorityModel',
+];
+/**
+ * Load and validate the project's CompliancePosture from disk.
+ *
+ * Returns a single-element `CompliancePosture[]` per OQ-6 (v2 forward-compat:
+ * v2 multi-tenant will return multiple elements; the single-element v1 shape
+ * is already a list so callers compose against `posture[0].spec.derivedGates`
+ * today and multi-posture composition in v2 is purely additive).
+ *
+ * Semantics:
+ *  - Missing manifest → `[BASELINE_POSTURE]` (AC #6: existing projects with
+ *    no compliance.yaml get the "(none declared)" baseline; no gate changes).
+ *  - Valid manifest → `[parsed_posture]`.
+ *  - Invalid manifest → throws one of the compliance error classes.
+ */
+export function loadCompliancePosture(options = {}) {
+    const projectRoot = options.projectRoot ?? process.cwd();
+    const relPath = options.manifestPath ?? DEFAULT_COMPLIANCE_MANIFEST_PATH;
+    const manifestPath = resolve(projectRoot, relPath);
+    // AC #6: missing manifest → baseline posture (no error)
+    if (!existsSync(manifestPath)) {
+        return [BASELINE_POSTURE];
+    }
+    // Parse YAML
+    let raw;
+    try {
+        const content = readFileSync(manifestPath, 'utf-8');
+        raw = parseYaml(content);
+    }
+    catch (err) {
+        throw new CompliancePostureValidationError([
+            { path: '/', message: `Failed to parse YAML: ${err.message}` },
+        ]);
+    }
+    // JSON Schema validation via reference package
+    // validateResource infers kind from the document and validates against the registered schema.
+    // CompliancePosture is in SCHEMA_FILES so it will NOT be skipped.
+    const result = validateResource(raw);
+    if (result.skipped) {
+        // This should not happen since CompliancePosture is a registered kind —
+        // guard defensively in case the manifest has an unexpected kind field.
+        throw new CompliancePostureValidationError([
+            {
+                path: '/kind',
+                message: `Expected kind 'CompliancePosture' but got kind '${raw?.kind}'`,
+            },
+        ]);
+    }
+    if (!result.valid) {
+        throw new CompliancePostureValidationError((result.errors ?? []).map((e) => ({ path: e.path, message: e.message })));
+    }
+    const posture = result.data;
+    // Semantic validation #1 — regime attestation (OQ-2 / AC #5)
+    for (const regime of posture.spec.regimes) {
+        if (!regime.attestedBy || regime.attestedBy.trim() === '') {
+            throw new MissingComplianceAttestation(regime.id, 'attestedBy');
+        }
+        if (!regime.attestedAt || regime.attestedAt.trim() === '') {
+            throw new MissingComplianceAttestation(regime.id, 'attestedAt');
+        }
+    }
+    // Semantic validation #2 — derivedGates override notes (OQ-2 / AC #5)
+    if (posture.spec.derivedGates) {
+        validateDerivedGatesOverrideNotes(posture.spec.derivedGates);
+    }
+    return [posture];
+}
+/**
+ * Validate that every overridden derived gate field has a corresponding
+ * non-empty `_notes` entry. Throws `MissingDerivedGateOverrideNotes` on first
+ * violation (fail-fast — single validation error at a time for clear messaging).
+ */
+function validateDerivedGatesOverrideNotes(overrides) {
+    const notes = overrides._notes ?? {};
+    for (const field of DERIVED_GATE_FIELDS) {
+        // Field has been overridden if the key exists (even if value is undefined)
+        if (!(field in overrides)) {
+            continue;
+        }
+        // The field is present — check for a non-empty _notes entry
+        const note = notes[field];
+        if (note === undefined || note.trim() === '') {
+            throw new MissingDerivedGateOverrideNotes(field);
+        }
+    }
+}
+//# sourceMappingURL=loader.js.map