@armoriq/policy-ir 0.1.2 → 0.1.4

package/dist/vectors.cjs

@@ -741,7 +741,43 @@ var evaluate_default = [
   { id: "VE-13b", name: "a floor hold tightens an agent allow but yields to an agent block", bound: { floor: { schemaVersion: "armor.policy.v2", policyId: "p-floor", target: { org: "*" }, layer: "floor", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-f", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "deploy", variant: 0, source: "yaml", layer: "floor" }, match: { tool: "deploy", keyTier: "exact", order: 0 }, effect: "hold" }] }, agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "hold", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-a", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "deploy", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "deploy", keyTier: "exact", order: 0 }, effect: "allow" }] } }, input: { tool: "deploy", arguments: {}, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "hold", statementId: "st-f", layer: "floor", ruleKey: "deploy" } },
   { id: "VE-14", name: "capability rule binds by tag only: tagged tool holds", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-destructive", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "destructive", variant: 0, source: "yaml", layer: "agent" }, match: { capability: "destructive" }, effect: "hold" }] } }, input: { tool: "mcp__jira__delete_issue", arguments: {}, timestamp: "2026-09-18T12:00:00Z", capabilities: ["destructive"] }, expect: { verdict: "hold", statementId: "st-destructive", layer: "agent", ruleKey: "destructive" } },
   { id: "VE-14b", name: "capability rule binds by tag only: untagged tool on the same server gets tools.default", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-destructive", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "destructive", variant: 0, source: "yaml", layer: "agent" }, match: { capability: "destructive" }, effect: "hold" }] } }, input: { tool: "mcp__jira__list_issues", arguments: {}, timestamp: "2026-09-18T12:00:00Z", capabilities: [] }, expect: { verdict: "allow", statementId: null, layer: "agent", ruleKey: "tools.default" } },
-  { id: "VE-15", name: "an expired document contributes nothing", bound: { group: { schemaVersion: "armor.policy.v2", policyId: "p-group", target: { group: "payments" }, layer: "group", defaults: { tools: "hold", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "2026-01-01T00:00:00Z", statements: [{ id: "st-g", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "group" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }] }, agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [] } }, input: { tool: "x", arguments: {}, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "allow", statementId: null, layer: "agent", ruleKey: "tools.default" } }
+  { id: "VE-15", name: "an expired document contributes nothing", bound: { group: { schemaVersion: "armor.policy.v2", policyId: "p-group", target: { group: "payments" }, layer: "group", defaults: { tools: "hold", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "2026-01-01T00:00:00Z", statements: [{ id: "st-g", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "group" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }] }, agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [] } }, input: { tool: "x", arguments: {}, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "allow", statementId: null, layer: "agent", ruleKey: "tools.default" } },
+  { id: "VX-1", name: "eq never equates true and 1", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-eq", subject: null, conditions: [{ field: "args.flag", op: "eq", value: 1 }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: { flag: true }, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "allow", statementId: "st-else", layer: "agent", ruleKey: "x" } },
+  { id: "VX-2", name: "in compares by strict equality", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-in", subject: null, conditions: [{ field: "args.n", op: "in", value: [1, 2] }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: { n: true }, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "allow", statementId: "st-else", layer: "agent", ruleKey: "x" } },
+  { id: "VX-3", name: "exists false matches an absent argument", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-ex", subject: null, conditions: [{ field: "args.note", op: "exists", value: false }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: {}, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "block", statementId: "st-ex", layer: "agent", ruleKey: "x" } },
+  { id: "VX-4", name: "a null argument is present", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-null", subject: null, conditions: [{ field: "args.note", op: "exists", value: true }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: { note: null }, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "block", statementId: "st-null", layer: "agent", ruleKey: "x" } },
+  { id: "VX-5", name: "regex searches anywhere in the value", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-re", subject: null, conditions: [{ field: "args.cmd", op: "regex", value: "rm -rf" }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: { cmd: "sudo rm -rf /" }, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "block", statementId: "st-re", layer: "agent", ruleKey: "x" } },
+  { id: "VX-6", name: "regex \\d matches ASCII digits only", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-d", subject: null, conditions: [{ field: "args.code", op: "regex", value: "^\\d+$" }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: { code: "\u0661\u0662\u0663" }, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "allow", statementId: "st-else", layer: "agent", ruleKey: "x" } },
+  { id: "VX-7", name: "glob * stops at a slash", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-g", subject: null, conditions: [{ field: "path", op: "glob", value: "~/docs/*" }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: {}, timestamp: "2026-09-18T12:00:00Z", derived: { path: "~/docs/a/b" } }, expect: { verdict: "allow", statementId: "st-else", layer: "agent", ruleKey: "x" } },
+  { id: "VX-8", name: "glob ** crosses slashes and ? is one character", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-gg", subject: null, conditions: [{ field: "path", op: "glob", value: "~/d?cs/**" }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: {}, timestamp: "2026-09-18T12:00:00Z", derived: { path: "~/docs/a/b" } }, expect: { verdict: "block", statementId: "st-gg", layer: "agent", ruleKey: "x" } },
+  { id: "VX-9", name: "a numeric comparison never matches a string", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-gt", subject: null, conditions: [{ field: "args.amount", op: "gt", value: 500 }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: { amount: "900" }, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "allow", statementId: "st-else", layer: "agent", ruleKey: "x" } },
+  { id: "VX-10", name: "ne on an absent argument does not match", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-ne", subject: null, conditions: [{ field: "args.a", op: "ne", value: "v" }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: {}, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "allow", statementId: "st-else", layer: "agent", ruleKey: "x" } },
+  { id: "VX-11", name: "a dotpath indexes into an array", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-idx", subject: null, conditions: [{ field: "args.items.0", op: "eq", value: "a" }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: { items: ["a", "b"] }, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "block", statementId: "st-idx", layer: "agent", ruleKey: "x" } },
+  { id: "VX-12", name: "length reads an array length", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-len", subject: null, conditions: [{ field: "args.items.length", op: "gt", value: 2 }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: { items: [1, 2, 3] }, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "block", statementId: "st-len", layer: "agent", ruleKey: "x" } },
+  { id: "VX-13", name: "length of a string is absent", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-slen", subject: null, conditions: [{ field: "args.name.length", op: "gt", value: 2 }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: { name: "abcdef" }, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "allow", statementId: "st-else", layer: "agent", ruleKey: "x" } },
+  { id: "VX-14", name: "startsWith on a string", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-sw", subject: null, conditions: [{ field: "args.url", op: "startsWith", value: "https://internal." }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: { url: "https://internal.example/x" }, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "block", statementId: "st-sw", layer: "agent", ruleKey: "x" } },
+  { id: "VX-15", name: "two capability statements of equal effect: the later wins", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-cap-a", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "a", variant: 0, source: "yaml", layer: "agent" }, match: { capability: "a" }, effect: "hold" }, { id: "st-cap-b", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "b", variant: 0, source: "yaml", layer: "agent" }, match: { capability: "b" }, effect: "hold" }] } }, input: { tool: "y", arguments: {}, timestamp: "2026-09-18T12:00:00Z", capabilities: ["a", "b"] }, expect: { verdict: "hold", statementId: "st-cap-b", layer: "agent", ruleKey: "b" } },
+  { id: "VX-16", name: "a rule and a capability of equal effect: the rule wins", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-rule", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "y", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "y", keyTier: "exact", order: 0 }, effect: "hold" }, { id: "st-cap", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "c", variant: 0, source: "yaml", layer: "agent" }, match: { capability: "c" }, effect: "hold" }] } }, input: { tool: "y", arguments: {}, timestamp: "2026-09-18T12:00:00Z", capabilities: ["c"] }, expect: { verdict: "hold", statementId: "st-rule", layer: "agent", ruleKey: "y" } },
+  { id: "VX-17", name: "a statement expiry with fractional seconds is still live", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-ms", subject: null, conditions: [], expiresAt: "2026-09-18T12:00:00.500Z", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }] } }, input: { tool: "x", arguments: {}, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "block", statementId: "st-ms", layer: "agent", ruleKey: "x" } },
+  { id: "VX-18", name: "a statement expiry with an offset is compared in UTC", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-off", subject: null, conditions: [], expiresAt: "2026-09-18T17:00:00+05:30", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }] } }, input: { tool: "x", arguments: {}, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "allow", statementId: null, layer: "agent", ruleKey: "tools.default" } },
+  { id: "VX-19", name: "member email matches case-insensitively", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-alice", subject: { email: "Alice@Example.com" }, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-base", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "allow" }] } }, input: { tool: "x", arguments: {}, timestamp: "2026-09-18T12:00:00Z", member: { email: "alice@example.com" } }, expect: { verdict: "block", statementId: "st-alice", layer: "member", ruleKey: "x" } },
+  { id: "VX-20", name: "schema drift is reported with a null observed hash", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-bound", subject: null, conditions: [{ field: "args.a", op: "exists", value: true, schemaBinding: { schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" } }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "hold" }] } }, input: { tool: "x", arguments: { a: 1 }, timestamp: "2026-09-18T12:00:00Z", schemaHash: null }, expect: { verdict: "hold", statementId: "st-bound", layer: "agent", ruleKey: "x", obligations: [{ type: "schema_drift", statementId: "st-bound", bound: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", observed: null }] } },
+  { id: "VX-21", name: "regex \\s matches a no-break space", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-ws", subject: null, conditions: [{ field: "args.cmd", op: "regex", value: "rm\\s+-rf" }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: { cmd: "rm\xA0-rf /" }, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "block", statementId: "st-ws", layer: "agent", ruleKey: "x" } },
+  { id: "VX-22", name: "regex $ is the end of the input, not before a final newline", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-end", subject: null, conditions: [{ field: "args.v", op: "notRegex", value: "^safe$" }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: { v: "safe\n" }, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "block", statementId: "st-end", layer: "agent", ruleKey: "x" } },
+  { id: "VX-23", name: "regex . does not match a carriage return", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-dot", subject: null, conditions: [{ field: "args.v", op: "notRegex", value: "^.$" }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: { v: "\r" }, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "block", statementId: "st-dot", layer: "agent", ruleKey: "x" } },
+  { id: "VX-24", name: "regex . matches one UTF-16 unit", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-unit", subject: null, conditions: [{ field: "args.v", op: "regex", value: "^..$" }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: { v: "\u{1F600}" }, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "block", statementId: "st-unit", layer: "agent", ruleKey: "x" } },
+  { id: "VX-25", name: "glob ? matches one UTF-16 unit", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-gq", subject: null, conditions: [{ field: "path", op: "glob", value: "/private/??" }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: {}, timestamp: "2026-09-18T12:00:00Z", derived: { path: "/private/\u{1F600}" } }, expect: { verdict: "block", statementId: "st-gq", layer: "agent", ruleKey: "x" } },
+  { id: "VX-26", name: "glob key length counts UTF-16 units", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-long", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "\u{1F600}\u{1F600}*", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "\u{1F600}\u{1F600}*", keyTier: "glob", order: 0 }, effect: "block" }, { id: "st-short", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "???*", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "???*", keyTier: "glob", order: 0 }, effect: "allow" }] } }, input: { tool: "\u{1F600}\u{1F600}x", arguments: {}, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "block", statementId: "st-long", layer: "agent", ruleKey: "\u{1F600}\u{1F600}*" } },
+  { id: "VX-27", name: "a dotpath reads own keys only", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-own", subject: null, conditions: [{ field: "args.constructor", op: "exists", value: true }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: {}, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "allow", statementId: "st-else", layer: "agent", ruleKey: "x" } },
+  { id: "VX-28", name: "a derived root reads own keys only", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-own-d", subject: null, conditions: [{ field: "toString", op: "exists", value: true }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: {}, timestamp: "2026-09-18T12:00:00Z", derived: {} }, expect: { verdict: "allow", statementId: "st-else", layer: "agent", ruleKey: "x" } },
+  { id: "VX-29", name: "an array index is ASCII digits", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-ascii", subject: null, conditions: [{ field: "args.items.\u0661", op: "exists", value: false }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: { items: ["a", "b"] }, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "block", statementId: "st-ascii", layer: "agent", ruleKey: "x" } },
+  { id: "VX-30", name: "an array index has no leading zero", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-lead", subject: null, conditions: [{ field: "args.items.01", op: "exists", value: false }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: { items: ["a", "b"] }, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "block", statementId: "st-lead", layer: "agent", ruleKey: "x" } },
+  { id: "VX-31", name: "an expiry with an expanded year is live", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-y6", subject: null, conditions: [], expiresAt: "+010000-01-01T00:00:00.000Z", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }] } }, input: { tool: "x", arguments: {}, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "block", statementId: "st-y6", layer: "agent", ruleKey: "x" } },
+  { id: "VX-33", name: "a date-only expiry is midnight UTC", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-day", subject: null, conditions: [], expiresAt: "2026-09-19", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }] } }, input: { tool: "x", arguments: {}, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "block", statementId: "st-day", layer: "agent", ruleKey: "x" } },
+  { id: "VX-34", name: "an out-of-range month makes the expiry unreadable, so the statement is not live", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-bad", subject: null, conditions: [], expiresAt: "2026-13-01T00:00:00.000Z", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }] } }, input: { tool: "x", arguments: {}, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "allow", statementId: null, layer: "agent", ruleKey: "tools.default" } },
+  { id: "VX-35", name: "day 31 of a 30-day month rolls into the next month", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-roll", subject: null, conditions: [], expiresAt: "2026-09-31T00:00:00.000Z", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }] } }, input: { tool: "x", arguments: {}, timestamp: "2026-09-30T23:00:00Z" }, expect: { verdict: "block", statementId: "st-roll", layer: "agent", ruleKey: "x" } },
+  { id: "VX-38", name: "regex \\B matches an empty value", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-nb", subject: null, conditions: [{ field: "args.v", op: "regex", value: "^\\B$" }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: { v: "" }, timestamp: "2026-09-18T12:00:00Z" }, expect: { verdict: "block", statementId: "st-nb", layer: "agent", ruleKey: "x" } },
+  { id: "VX-37", name: "glob ** does not cross a line break", bound: { agent: { schemaVersion: "armor.policy.v2", policyId: "p-agent", target: { agent: "aaaaaaaa-0000-4000-8000-000000000001" }, layer: "agent", defaults: { tools: "allow", network: "block", files: "allow", skills: "allow" }, capture: { arguments: true, redact: ["*token*"], maxBytesPerCall: 16384, sample: 1 }, expiresAt: "never", statements: [{ id: "st-gnl", subject: null, conditions: [{ field: "path", op: "glob", value: "/tmp/**" }], expiresAt: "never", provenance: { ruleKey: "x", variant: 0, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 0 }, effect: "block" }, { id: "st-else", subject: null, conditions: [], expiresAt: "never", provenance: { ruleKey: "x", variant: 1, source: "yaml", layer: "agent" }, match: { tool: "x", keyTier: "exact", order: 1 }, effect: "allow" }] } }, input: { tool: "x", arguments: {}, timestamp: "2026-09-18T12:00:00Z", derived: { path: "/tmp/a\nb" } }, expect: { verdict: "allow", statementId: "st-else", layer: "agent", ruleKey: "x" } }
 ];
 
 // vectors/document.json
@@ -931,6 +967,12 @@ spec:
   { id: "VC-11c", name: "a condition takes exactly one operator", yaml: "apiVersion: armor.io/v2\nkind: Policy\nmetadata:\n  name: vector\n  orgId: 11111111-1111-4111-8111-111111111111\ntarget:\n  agent: aaaaaaaa-0000-4000-8000-000000000001\n  mcpServers: [github]\nspec:\n  tools:\n    default: hold\n    rules:\n      create_payment:\n        - when: {args.amount: {gt: 5000, lt: 9000}}\n          action: block\n", expect: { errors: ["condition_operator"], warnings: [] } },
   { id: "VC-11d", name: "a numeric operator rejects a string operand", yaml: 'apiVersion: armor.io/v2\nkind: Policy\nmetadata:\n  name: vector\n  orgId: 11111111-1111-4111-8111-111111111111\ntarget:\n  agent: aaaaaaaa-0000-4000-8000-000000000001\n  mcpServers: [github]\nspec:\n  tools:\n    default: hold\n    rules:\n      create_payment:\n        - when: {args.amount: {gt: "5000"}}\n          action: block\n', expect: { errors: ["condition_operand"], warnings: [] } },
   { id: "VC-11e", name: "matches rejects a lookaround the Rego evaluator cannot run", yaml: "apiVersion: armor.io/v2\nkind: Policy\nmetadata:\n  name: vector\n  orgId: 11111111-1111-4111-8111-111111111111\ntarget:\n  agent: aaaaaaaa-0000-4000-8000-000000000001\n  mcpServers: [github]\nspec:\n  tools:\n    default: hold\n    rules:\n      Bash:\n        - when: {command: {matches: '(?=rm)'}}\n          action: block\n", expect: { errors: ["condition_operand"], warnings: [] } },
+  { id: "VC-11f", name: "matches rejects a named group outside the portable subset", yaml: "apiVersion: armor.io/v2\nkind: Policy\nmetadata:\n  name: vector\n  orgId: 11111111-1111-4111-8111-111111111111\ntarget:\n  agent: aaaaaaaa-0000-4000-8000-000000000001\n  mcpServers: [github]\nspec:\n  tools:\n    default: hold\n    rules:\n      Bash:\n        - when: {command: {matches: '(?<bin>rm) -rf'}}\n          action: block\n", expect: { errors: ["condition_operand"], warnings: [] } },
+  { id: "VC-11g", name: "matches rejects an empty negated class", yaml: "apiVersion: armor.io/v2\nkind: Policy\nmetadata:\n  name: vector\n  orgId: 11111111-1111-4111-8111-111111111111\ntarget:\n  agent: aaaaaaaa-0000-4000-8000-000000000001\n  mcpServers: [github]\nspec:\n  tools:\n    default: hold\n    rules:\n      Bash:\n        - when: {command: {matches: 'a[^]'}}\n          action: block\n", expect: { errors: ["condition_operand"], warnings: [] } },
+  { id: "VC-11h", name: "matches rejects a brace that is not a full quantifier", yaml: "apiVersion: armor.io/v2\nkind: Policy\nmetadata:\n  name: vector\n  orgId: 11111111-1111-4111-8111-111111111111\ntarget:\n  agent: aaaaaaaa-0000-4000-8000-000000000001\n  mcpServers: [github]\nspec:\n  tools:\n    default: hold\n    rules:\n      Bash:\n        - when: {command: {matches: 'a{,3}'}}\n          action: block\n", expect: { errors: ["condition_operand"], warnings: [] } },
+  { id: "VC-11i", name: "matches rejects a backreference", yaml: "apiVersion: armor.io/v2\nkind: Policy\nmetadata:\n  name: vector\n  orgId: 11111111-1111-4111-8111-111111111111\ntarget:\n  agent: aaaaaaaa-0000-4000-8000-000000000001\n  mcpServers: [github]\nspec:\n  tools:\n    default: hold\n    rules:\n      Bash:\n        - when: {command: {matches: '(a)\\1'}}\n          action: block\n", expect: { errors: ["condition_operand"], warnings: [] } },
+  { id: "VC-11j", name: "matches rejects a Unicode property escape", yaml: "apiVersion: armor.io/v2\nkind: Policy\nmetadata:\n  name: vector\n  orgId: 11111111-1111-4111-8111-111111111111\ntarget:\n  agent: aaaaaaaa-0000-4000-8000-000000000001\n  mcpServers: [github]\nspec:\n  tools:\n    default: hold\n    rules:\n      Bash:\n        - when: {command: {matches: '\\p{L}'}}\n          action: block\n", expect: { errors: ["condition_operand"], warnings: [] } },
+  { id: "VC-11k", name: "matches accepts classes, ranges, groups, alternation and bounded quantifiers", yaml: "apiVersion: armor.io/v2\nkind: Policy\nmetadata:\n  name: vector\n  orgId: 11111111-1111-4111-8111-111111111111\ntarget:\n  agent: aaaaaaaa-0000-4000-8000-000000000001\n  mcpServers: [github]\nspec:\n  tools:\n    default: hold\n    rules:\n      Bash:\n        - when: {command: {matches: '^(?:sudo\\s+)?(rm|shred)\\b[ \\t]+-[a-zA-Z0-9_]{1,4}\\.?\\x41\\u0042$'}}\n          action: block\n", expect: { errors: [], warnings: [] } },
   { id: "VC-1b", name: "tools.default is required", yaml: "apiVersion: armor.io/v2\nkind: Policy\nmetadata:\n  name: vector\n  orgId: 11111111-1111-4111-8111-111111111111\ntarget:\n  agent: aaaaaaaa-0000-4000-8000-000000000001\n  mcpServers: [github]\nspec:\n  tools:\n    rules:\n      Read: allow\n", expect: { errors: ["expected_verdict"], warnings: [] } }
 ];
 
@@ -938,6 +980,7 @@ spec:
 var compile_default = [
   { id: "VC-14", name: "schemaHash of the declared tool is bound on every args condition (FR-14)", yaml: "apiVersion: armor.io/v2\nkind: Policy\nmetadata:\n  name: vector\n  orgId: 11111111-1111-4111-8111-111111111111\ntarget:\n  agent: aaaaaaaa-0000-4000-8000-000000000001\nspec:\n  tools:\n    default: hold\n    rules:\n      create_payment:\n        - when: {args.amount: {gt: 5000}}\n          action: hold\n          approval: {approvers: 2, roles: [finance_lead]}\n        - action: allow\n  approvalDefaults: {approvers: 1, roles: [admin]}\n", inventory: [{ name: "create_payment", owner: { type: "agent", id: "agent-1", name: "support-agent" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true }, { name: "Read", owner: { type: "agent", id: "agent-1", name: "support-agent" }, schemaHash: "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", inputSchema: { type: "object", properties: { file_path: { type: "string" } } }, declared: true }, { name: "create_issue", owner: { type: "mcp_server", id: "srv-github", name: "github" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true, qualifiedName: "mcp__github__create_issue", capabilities: ["destructive"] }, { name: "list_issues", owner: { type: "mcp_server", id: "srv-github", name: "github" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true, qualifiedName: "mcp__github__list_issues", capabilities: [] }, { name: "delete_repo", owner: { type: "mcp_server", id: "srv-github", name: "github" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true, qualifiedName: "mcp__github__delete_repo", capabilities: ["destructive"] }, { name: "observed_only", owner: { type: "agent", id: "agent-1", name: "support-agent" }, schemaHash: null, declared: false }], expect: { errors: [], warnings: [], statementIds: ["st-create-payment-0", "st-create-payment-1"], bindings: { "st-create-payment-0": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" } } },
   { id: "VC-15", name: "an unknown control identifier compiles with a warning naming it", yaml: "apiVersion: armor.io/v2\nkind: Policy\nmetadata:\n  name: vector\n  orgId: 11111111-1111-4111-8111-111111111111\ntarget:\n  agent: aaaaaaaa-0000-4000-8000-000000000001\nspec:\n  tools:\n    default: hold\n    rules:\n      Read:\n        - action: allow\n          controls: [SOC2-CC6.1, NOT-A-CONTROL]\n  approvalDefaults: {approvers: 1, roles: [admin]}\n", inventory: [{ name: "create_payment", owner: { type: "agent", id: "agent-1", name: "support-agent" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true }, { name: "Read", owner: { type: "agent", id: "agent-1", name: "support-agent" }, schemaHash: "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", inputSchema: { type: "object", properties: { file_path: { type: "string" } } }, declared: true }, { name: "create_issue", owner: { type: "mcp_server", id: "srv-github", name: "github" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true, qualifiedName: "mcp__github__create_issue", capabilities: ["destructive"] }, { name: "list_issues", owner: { type: "mcp_server", id: "srv-github", name: "github" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true, qualifiedName: "mcp__github__list_issues", capabilities: [] }, { name: "delete_repo", owner: { type: "mcp_server", id: "srv-github", name: "github" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true, qualifiedName: "mcp__github__delete_repo", capabilities: ["destructive"] }, { name: "observed_only", owner: { type: "agent", id: "agent-1", name: "support-agent" }, schemaHash: null, declared: false }], expect: { errors: [], warnings: ["unknown_control"], statementIds: ["st-read-0"] } },
+  { id: "VC-15b", name: "FERPA, ITAR and EAR section identifiers compile with no warning", yaml: "apiVersion: armor.io/v2\nkind: Policy\nmetadata:\n  name: vector\n  orgId: 11111111-1111-4111-8111-111111111111\ntarget:\n  agent: aaaaaaaa-0000-4000-8000-000000000001\nspec:\n  tools:\n    default: hold\n    rules:\n      Read:\n        - action: allow\n          controls: [FERPA-99.31, ITAR-120.50, EAR-734.13]\n  approvalDefaults: {approvers: 1, roles: [admin]}\n", inventory: [{ name: "create_payment", owner: { type: "agent", id: "agent-1", name: "support-agent" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true }, { name: "Read", owner: { type: "agent", id: "agent-1", name: "support-agent" }, schemaHash: "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", inputSchema: { type: "object", properties: { file_path: { type: "string" } } }, declared: true }, { name: "create_issue", owner: { type: "mcp_server", id: "srv-github", name: "github" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true, qualifiedName: "mcp__github__create_issue", capabilities: ["destructive"] }, { name: "list_issues", owner: { type: "mcp_server", id: "srv-github", name: "github" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true, qualifiedName: "mcp__github__list_issues", capabilities: [] }, { name: "delete_repo", owner: { type: "mcp_server", id: "srv-github", name: "github" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true, qualifiedName: "mcp__github__delete_repo", capabilities: ["destructive"] }, { name: "observed_only", owner: { type: "agent", id: "agent-1", name: "support-agent" }, schemaHash: null, declared: false }], expect: { errors: [], warnings: [], statementIds: ["st-read-0"] } },
   { id: "VC-8", name: "a rule key not in the inventory compiles with a warning", yaml: "apiVersion: armor.io/v2\nkind: Policy\nmetadata:\n  name: vector\n  orgId: 11111111-1111-4111-8111-111111111111\ntarget:\n  agent: aaaaaaaa-0000-4000-8000-000000000001\nspec:\n  tools:\n    default: hold\n    rules:\n      nonexistent_tool: block\n  approvalDefaults: {approvers: 1, roles: [admin]}\n", inventory: [{ name: "create_payment", owner: { type: "agent", id: "agent-1", name: "support-agent" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true }, { name: "Read", owner: { type: "agent", id: "agent-1", name: "support-agent" }, schemaHash: "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", inputSchema: { type: "object", properties: { file_path: { type: "string" } } }, declared: true }, { name: "create_issue", owner: { type: "mcp_server", id: "srv-github", name: "github" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true, qualifiedName: "mcp__github__create_issue", capabilities: ["destructive"] }, { name: "list_issues", owner: { type: "mcp_server", id: "srv-github", name: "github" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true, qualifiedName: "mcp__github__list_issues", capabilities: [] }, { name: "delete_repo", owner: { type: "mcp_server", id: "srv-github", name: "github" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true, qualifiedName: "mcp__github__delete_repo", capabilities: ["destructive"] }, { name: "observed_only", owner: { type: "agent", id: "agent-1", name: "support-agent" }, schemaHash: null, declared: false }], expect: { errors: [], warnings: ["unknown_tool_key"], statementIds: ["st-nonexistent-tool-0"] } },
   { id: "VC-8b", name: "an observed-only tool compiles without a binding and says so", yaml: "apiVersion: armor.io/v2\nkind: Policy\nmetadata:\n  name: vector\n  orgId: 11111111-1111-4111-8111-111111111111\ntarget:\n  agent: aaaaaaaa-0000-4000-8000-000000000001\nspec:\n  tools:\n    default: hold\n    rules:\n      observed_only:\n        - when: {args.x: {exists: true}}\n          action: block\n  approvalDefaults: {approvers: 1, roles: [admin]}\n", inventory: [{ name: "create_payment", owner: { type: "agent", id: "agent-1", name: "support-agent" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true }, { name: "Read", owner: { type: "agent", id: "agent-1", name: "support-agent" }, schemaHash: "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", inputSchema: { type: "object", properties: { file_path: { type: "string" } } }, declared: true }, { name: "create_issue", owner: { type: "mcp_server", id: "srv-github", name: "github" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true, qualifiedName: "mcp__github__create_issue", capabilities: ["destructive"] }, { name: "list_issues", owner: { type: "mcp_server", id: "srv-github", name: "github" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true, qualifiedName: "mcp__github__list_issues", capabilities: [] }, { name: "delete_repo", owner: { type: "mcp_server", id: "srv-github", name: "github" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true, qualifiedName: "mcp__github__delete_repo", capabilities: ["destructive"] }, { name: "observed_only", owner: { type: "agent", id: "agent-1", name: "support-agent" }, schemaHash: null, declared: false }], expect: { errors: [], warnings: ["observed_only_tool"], bindings: { "st-observed-only-0": null } } },
   { id: "VC-9", name: "an args key the schema does not declare compiles with a warning", yaml: "apiVersion: armor.io/v2\nkind: Policy\nmetadata:\n  name: vector\n  orgId: 11111111-1111-4111-8111-111111111111\ntarget:\n  agent: aaaaaaaa-0000-4000-8000-000000000001\nspec:\n  tools:\n    default: hold\n    rules:\n      create_payment:\n        - when: {args.nonexistent: {gt: 5}}\n          action: block\n  approvalDefaults: {approvers: 1, roles: [admin]}\n", inventory: [{ name: "create_payment", owner: { type: "agent", id: "agent-1", name: "support-agent" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true }, { name: "Read", owner: { type: "agent", id: "agent-1", name: "support-agent" }, schemaHash: "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", inputSchema: { type: "object", properties: { file_path: { type: "string" } } }, declared: true }, { name: "create_issue", owner: { type: "mcp_server", id: "srv-github", name: "github" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true, qualifiedName: "mcp__github__create_issue", capabilities: ["destructive"] }, { name: "list_issues", owner: { type: "mcp_server", id: "srv-github", name: "github" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true, qualifiedName: "mcp__github__list_issues", capabilities: [] }, { name: "delete_repo", owner: { type: "mcp_server", id: "srv-github", name: "github" }, schemaHash: "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", inputSchema: { type: "object", properties: { amount: { type: "number" }, recipient: { type: "string" } } }, declared: true, qualifiedName: "mcp__github__delete_repo", capabilities: ["destructive"] }, { name: "observed_only", owner: { type: "agent", id: "agent-1", name: "support-agent" }, schemaHash: null, declared: false }], expect: { errors: [], warnings: ["unknown_argument"] } },