@blamejs/core 0.7.24 → 0.7.39

package/lib/crypto.js

@@ -203,6 +203,21 @@ function decryptEnvelope(packed, privateKeys) {
     symmetricKey = kdf(Buffer.concat([mlkemSs, ecSs]), C.BYTES.bytes(32));
   } else if (kemId === C.KEM_IDS.ML_KEM_1024) {
     symmetricKey = kdf(mlkemSs, C.BYTES.bytes(32));
+  } else if (kemId === C.KEM_IDS.ML_KEM_768_X25519) {
+    // ML-KEM-768 + X25519 hybrid envelope. The mlkemPriv must be an
+    // ML-KEM-768 key (not 1024); operators are responsible for passing
+    // the correct keypair via privateKeys when the envelope was sealed
+    // with this algorithm. Same length-prefixed shape as the P-384
+    // hybrid: 2-byte ec-eph-len + DER X25519 pubkey + nonce + ct.
+    var x25519EphLen = packed.readUInt16BE(pos); pos += 2;
+    var x25519EphDer = packed.subarray(pos, pos + x25519EphLen); pos += x25519EphLen;
+    var x25519PrivPem = typeof privateKeys === "string" ? null : privateKeys.x25519PrivateKey;
+    if (!x25519PrivPem) throw new Error("ML-KEM-768 + X25519 hybrid envelope requires x25519PrivateKey");
+    var x25519Ss = nodeCrypto.diffieHellman({
+      privateKey: nodeCrypto.createPrivateKey(x25519PrivPem),
+      publicKey:  nodeCrypto.createPublicKey({ key: x25519EphDer, type: "spki", format: "der" }),
+    });
+    symmetricKey = kdf(Buffer.concat([mlkemSs, x25519Ss]), C.BYTES.bytes(32));
   } else {
     throw new Error("Invalid envelope: unsupported KEM ID " + kemId);
   }
@@ -241,6 +256,80 @@ function decryptPacked(packed, key, aad) {
   );
 }
 
+// ---- ML-KEM-768 + X25519 hybrid (TLS-interop envelope) ----
+//
+// The IETF / Cloudflare / Chrome standardized hybrid for TLS 1.3
+// (codepoint 0x11EC). Smaller payload than ML-KEM-1024 + P-384
+// (~1.1 KB vs ~1.6 KB), wider interop with peers using the same
+// hybrid (Cloudflare Workers, Chrome, blamejs-on-the-other-side).
+//
+// Operators wire this when the recipient publishes ML-KEM-768 +
+// X25519 keys. Generation:
+//
+//   var pair = b.crypto.generateMlkem768X25519KeyPair();
+//   // → { mlkemPublicKey, mlkemPrivateKey,
+//   //     x25519PublicKey, x25519PrivateKey }
+//
+//   var envelope = b.crypto.encryptMlkem768X25519(plaintext, {
+//     mlkemPublicKey:    recipient.mlkemPublicKey,
+//     x25519PublicKey:   recipient.x25519PublicKey,
+//   });
+//
+// Decryption goes through the existing b.crypto.decrypt(envelope,
+// privateKeys) — the envelope-magic dispatch handles KEM_IDS.
+// ML_KEM_768_X25519. privateKeys MUST shape as { privateKey,
+// x25519PrivateKey } — privateKey is the ML-KEM-768 PEM, NOT the
+// default ML-KEM-1024.
+
+function generateMlkem768X25519KeyPair() {
+  var mlkem = generateKeyPair("ml-kem-768");
+  var x25519 = generateKeyPair("x25519");
+  return {
+    mlkemPublicKey:    mlkem.publicKey,
+    mlkemPrivateKey:   mlkem.privateKey,
+    x25519PublicKey:   x25519.publicKey,
+    x25519PrivateKey:  x25519.privateKey,
+  };
+}
+
+function encryptMlkem768X25519(plaintext, recipient) {
+  if (!recipient || !recipient.mlkemPublicKey || !recipient.x25519PublicKey) {
+    throw new Error("encryptMlkem768X25519 requires { mlkemPublicKey, x25519PublicKey }");
+  }
+  var mlkemPub = nodeCrypto.createPublicKey(recipient.mlkemPublicKey);
+  var kem = nodeCrypto.encapsulate(mlkemPub);
+  var ephX25519 = generateKeyPair("x25519", {
+    publicKeyEncoding:  { type: "spki",  format: "der" },
+    privateKeyEncoding: { type: "pkcs8", format: "pem" },
+  });
+  var x25519Ss = nodeCrypto.diffieHellman({
+    privateKey: nodeCrypto.createPrivateKey(ephX25519.privateKey),
+    publicKey:  nodeCrypto.createPublicKey(recipient.x25519PublicKey),
+  });
+  var key = kdf(Buffer.concat([kem.sharedKey, x25519Ss]), C.BYTES.bytes(32));
+  var nonce = generateBytes(C.BYTES.bytes(24));
+  var ct = xchacha20poly1305(key, nonce).encrypt(Buffer.from(plaintext, "utf8"));
+
+  var kemCtLen = Buffer.alloc(2); kemCtLen.writeUInt16BE(kem.ciphertext.length);
+  var x25519EphDer = ephX25519.publicKey;
+  var x25519EphLen = Buffer.alloc(2); x25519EphLen.writeUInt16BE(x25519EphDer.length);
+
+  return Buffer.concat([
+    Buffer.from([C.ENVELOPE_MAGIC, C.KEM_IDS.ML_KEM_768_X25519,
+                 C.ACTIVE.CIPHER, C.ACTIVE.KDF]),
+    kemCtLen, kem.ciphertext, x25519EphLen, x25519EphDer, nonce, Buffer.from(ct),
+  ]).toString("base64");
+}
+
+// Operator-audit accessor — exposes every supported KEM hybrid for
+// compliance audit visibility ("which envelopes does this deploy
+// accept on decrypt?").
+var SUPPORTED_KEM_ALGORITHMS = Object.freeze([
+  { id: "ml-kem-1024",          envelopeId: C.KEM_IDS.ML_KEM_1024,        description: "ML-KEM-1024 KEM-only (legacy single-component)" },
+  { id: "ml-kem-1024-p384",     envelopeId: C.KEM_IDS.ML_KEM_1024_P384,   description: "ML-KEM-1024 + ECDH P-384 hybrid (framework default)" },
+  { id: "ml-kem-768-x25519",    envelopeId: C.KEM_IDS.ML_KEM_768_X25519,  description: "ML-KEM-768 + X25519 hybrid (IETF / Cloudflare / Chrome TLS 1.3 codepoint 0x11EC)" },
+]);
+
 module.exports = {
   // Hashing
   sha3Hash:                    sha3Hash,
@@ -254,12 +343,15 @@ module.exports = {
   // Keys
   generateEncryptionKeyPair:   generateEncryptionKeyPair,
   generateSigningKeyPair:      generateSigningKeyPair,
+  generateMlkem768X25519KeyPair: generateMlkem768X25519KeyPair,
   // Signatures
   sign:                        sign,
   verify:                      verify,
   // Envelope encrypt/decrypt
   encrypt:                     encrypt,
   decrypt:                     decrypt,
+  encryptMlkem768X25519:       encryptMlkem768X25519,
+  SUPPORTED_KEM_ALGORITHMS:    SUPPORTED_KEM_ALGORITHMS,
   // Symmetric buffer encrypt/decrypt
   encryptPacked:               encryptPacked,
   decryptPacked:               decryptPacked,

package/lib/dora.js

@@ -0,0 +1,347 @@
+"use strict";
+/**
+ * b.dora — DORA Article 17 ICT-related incident-reporting workflow.
+ *
+ * Digital Operational Resilience Act (Regulation (EU) 2022/2554)
+ * Article 17 requires every "financial entity" subject to DORA to
+ * classify, document, and report ICT-related incidents according to
+ * the harmonized RTS template (Commission Delegated Regulation
+ * 2024/1772). This primitive is the framework hook — operators wire
+ * it into their incident-management workflow; the framework owns the
+ * classification rubric, the three-stage report shape (initial /
+ * intermediate / final), and the audit-chain integration.
+ *
+ *   var dora = b.dora.create({ audit: b.audit });
+ *
+ *   var classification = dora.classify({
+ *     dataAffected:        "phi" | "financial" | "personal" | "operational" | "none",
+ *     systemsAffected:     ["payments-gateway", "core-ledger"],
+ *     durationMs:          C.TIME.hours(4),
+ *     severityIndicator:   "critical" | "high" | "medium" | "low",
+ *     economicImpact:      { eur: 50000 },
+ *     affectedClients:     1200,
+ *     geographicScope:     ["DE", "FR"],
+ *     reputationalImpact:  "media" | "internal" | "none",
+ *   });
+ *   // → { classification: "major" | "significant" | "minor",
+ *   //     mustReport: true|false, mustReportInitialBy: ms-since-detection,
+ *   //     reasons: [...] }
+ *
+ *   var initial = dora.report({
+ *     incidentId:        "INC-2026-0042",
+ *     classification:    "major",
+ *     stage:             "initial",
+ *     detectedAt:        Date.now() - C.TIME.minutes(60),
+ *     description:       "Payment-gateway outage — 2-hour customer-facing impact",
+ *     causeKnown:        false,
+ *     mitigationStarted: true,
+ *   });
+ *
+ *   // 72h after detection: intermediate update
+ *   dora.report(Object.assign({}, initial, { stage: "intermediate", ... }));
+ *   // 1 month later (or upon closure): final report
+ *   dora.report(Object.assign({}, initial, { stage: "final", rootCause: "...", ... }));
+ *
+ * Audit posture (audit namespace "dora"):
+ *   - dora.incident.classified  — every classify() call
+ *   - dora.incident.reported    — every report() submission
+ *   - dora.incident.draftFinal  — every draftFinalReport() generation
+ *
+ * The primitive does NOT submit to ESAs / national supervisors — that
+ * step is operator-side (channel + credentials are operator-specific).
+ * The primitive produces the RTS-template-shaped record that the
+ * operator's submission code drops into the regulator's API.
+ */
+
+var lazyRequire = require("./lazy-require");
+var validateOpts = require("./validate-opts");
+var C = require("./constants");
+var { DoraError } = require("./framework-error");
+
+var audit = lazyRequire(function () { return require("./audit"); });
+var observability = lazyRequire(function () { return require("./observability"); });
+
+// ---- Classification thresholds (RTS 2024/1772 Articles 1-12) ----
+
+// Article 1 — major incident criteria. An incident classifies as
+// "major" when ANY of the following thresholds is met:
+//   - Critical/severe data integrity / confidentiality / availability
+//     impact
+//   - >= 100k clients affected OR >= 10% of clients
+//   - Economic impact >= 100k EUR
+//   - Cross-border (>= 2 EU member states) impact
+//   - Critical-process disruption >= 8h
+//   - Reputational impact (media coverage)
+var MAJOR_INCIDENT_THRESHOLDS = Object.freeze({
+  affectedClientsAbsolute:      100000,                                          // allow:raw-byte-literal — RTS 2024/1772 Art. 1(1)(a) regulator-fixed cap (100k clients)
+  affectedClientsPercentile:    0.10,                                            // RTS Art. 1(1)(a) — 10% client base
+  economicImpactEur:            100000,                                          // allow:raw-byte-literal — RTS 2024/1772 Art. 1(1)(c) regulator-fixed cap (100k EUR)
+  geographicMemberStates:       2,                                               // RTS Art. 1(1)(d) — 2+ member states
+  durationCriticalProcessMs:    C.TIME.hours(8),                                 // RTS Art. 1(1)(e) — 8h
+});
+
+// Article 8 — significant incident (one threshold below major).
+// Default threshold values per ESA guidelines.
+var SIGNIFICANT_INCIDENT_THRESHOLDS = Object.freeze({
+  affectedClientsAbsolute:      10000,                                           // allow:raw-byte-literal — ESA-guideline regulator-fixed cap (10k clients)
+  affectedClientsPercentile:    0.01,                                            // 1% client base
+  economicImpactEur:            10000,                                           // allow:raw-byte-literal — ESA-guideline regulator-fixed cap (10k EUR)
+  durationCriticalProcessMs:    C.TIME.hours(2),                                 // 2h
+});
+
+// Article 19 — initial report deadline: 24h from "first awareness".
+// Article 19(4) — intermediate update: within 72h of initial.
+// Article 19(6) — final report: within 1 month of initial.
+var INITIAL_REPORT_DEADLINE_MS      = C.TIME.hours(24);
+var INTERMEDIATE_REPORT_DEADLINE_MS = C.TIME.hours(72);
+var FINAL_REPORT_DEADLINE_MS        = C.TIME.days(30);
+
+var VALID_DATA_AFFECTED = ["phi", "financial", "personal", "operational", "none"];
+var VALID_SEVERITY      = ["critical", "high", "medium", "low"];
+var VALID_REPUTATIONAL  = ["media", "internal", "none"];
+var VALID_STAGES        = ["initial", "intermediate", "final"];
+var VALID_CLASSIFICATIONS = ["major", "significant", "minor"];
+
+// ---- Classification rubric ----
+
+function _classifyImpl(input) {
+  var reasons = [];
+  var hitsMajor = 0;
+  var hitsSignificant = 0;
+
+  // 1. Severity indicator — critical alone qualifies as major.
+  if (input.severityIndicator === "critical") {
+    hitsMajor += 1;
+    reasons.push("severity-critical");
+  } else if (input.severityIndicator === "high") {
+    hitsSignificant += 1;
+    reasons.push("severity-high");
+  }
+
+  // 2. Affected clients (absolute).
+  if (typeof input.affectedClients === "number" && input.affectedClients > 0) {
+    if (input.affectedClients >= MAJOR_INCIDENT_THRESHOLDS.affectedClientsAbsolute) {
+      hitsMajor += 1;
+      reasons.push("clients-major-absolute");
+    } else if (input.affectedClients >= SIGNIFICANT_INCIDENT_THRESHOLDS.affectedClientsAbsolute) {
+      hitsSignificant += 1;
+      reasons.push("clients-significant-absolute");
+    }
+  }
+
+  // 3. Economic impact.
+  if (input.economicImpact && typeof input.economicImpact.eur === "number") {
+    if (input.economicImpact.eur >= MAJOR_INCIDENT_THRESHOLDS.economicImpactEur) {
+      hitsMajor += 1;
+      reasons.push("economic-major");
+    } else if (input.economicImpact.eur >= SIGNIFICANT_INCIDENT_THRESHOLDS.economicImpactEur) {
+      hitsSignificant += 1;
+      reasons.push("economic-significant");
+    }
+  }
+
+  // 4. Geographic scope (cross-border).
+  if (Array.isArray(input.geographicScope) &&
+      input.geographicScope.length >= MAJOR_INCIDENT_THRESHOLDS.geographicMemberStates) {
+    hitsMajor += 1;
+    reasons.push("geographic-cross-border");
+  }
+
+  // 5. Duration (critical-process disruption).
+  if (typeof input.durationMs === "number" && input.durationMs > 0) {
+    if (input.durationMs >= MAJOR_INCIDENT_THRESHOLDS.durationCriticalProcessMs) {
+      hitsMajor += 1;
+      reasons.push("duration-major");
+    } else if (input.durationMs >= SIGNIFICANT_INCIDENT_THRESHOLDS.durationCriticalProcessMs) {
+      hitsSignificant += 1;
+      reasons.push("duration-significant");
+    }
+  }
+
+  // 6. Reputational impact (Article 1(1)(f)).
+  if (input.reputationalImpact === "media") {
+    hitsMajor += 1;
+    reasons.push("reputational-media");
+  }
+
+  // 7. Sensitive data classes — phi / financial → at minimum significant.
+  if (input.dataAffected === "phi" || input.dataAffected === "financial") {
+    hitsSignificant += 1;
+    reasons.push("data-sensitive-" + input.dataAffected);
+  }
+
+  var classification;
+  if (hitsMajor >= 1) {
+    classification = "major";
+  } else if (hitsSignificant >= 1) {
+    classification = "significant";
+  } else {
+    classification = "minor";
+  }
+  var mustReport = classification !== "minor";
+  return {
+    classification:        classification,
+    mustReport:            mustReport,
+    mustReportInitialByMs: mustReport ? INITIAL_REPORT_DEADLINE_MS : null,
+    reasons:               reasons,
+  };
+}
+
+// ---- Report-shape validators (RTS 2024/1772 templates) ----
+
+function _validateReportInput(input) {
+  if (!input || typeof input !== "object") {
+    throw new DoraError("dora/bad-report",
+      "report: input must be an object");
+  }
+  if (typeof input.incidentId !== "string" || input.incidentId.length === 0) {
+    throw new DoraError("dora/missing-incident-id",
+      "report: incidentId is required (non-empty string)");
+  }
+  if (VALID_CLASSIFICATIONS.indexOf(input.classification) === -1) {
+    throw new DoraError("dora/bad-classification",
+      "report: classification must be one of " +
+      VALID_CLASSIFICATIONS.join(", ") + ", got " + JSON.stringify(input.classification));
+  }
+  if (VALID_STAGES.indexOf(input.stage) === -1) {
+    throw new DoraError("dora/bad-stage",
+      "report: stage must be one of " + VALID_STAGES.join(", ") +
+      ", got " + JSON.stringify(input.stage));
+  }
+  if (typeof input.detectedAt !== "number" || !isFinite(input.detectedAt) || input.detectedAt <= 0) {
+    throw new DoraError("dora/bad-detected-at",
+      "report: detectedAt must be a positive ms-since-epoch number");
+  }
+  if (typeof input.description !== "string" || input.description.length === 0) {
+    throw new DoraError("dora/missing-description",
+      "report: description is required");
+  }
+}
+
+// ---- Public surface ----
+
+function create(opts) {
+  opts = opts || {};
+  validateOpts(opts, ["audit", "observability"], "dora.create");
+  var auditOn = opts.audit !== false;
+
+  function _emit(action, info) {
+    if (!auditOn) return;
+    try {
+      audit().safeEmit({
+        action:   action,
+        outcome:  info.outcome || "success",
+        metadata: info.metadata || {},
+      });
+    } catch (_e) { /* audit best-effort */ }
+  }
+
+  function classify(input) {
+    if (!input || typeof input !== "object") {
+      throw new DoraError("dora/bad-classify-input",
+        "classify: input must be an object");
+    }
+    if (input.dataAffected !== undefined &&
+        VALID_DATA_AFFECTED.indexOf(input.dataAffected) === -1) {
+      throw new DoraError("dora/bad-data-affected",
+        "classify: dataAffected must be one of " +
+        VALID_DATA_AFFECTED.join(", "));
+    }
+    if (input.severityIndicator !== undefined &&
+        VALID_SEVERITY.indexOf(input.severityIndicator) === -1) {
+      throw new DoraError("dora/bad-severity",
+        "classify: severityIndicator must be one of " + VALID_SEVERITY.join(", "));
+    }
+    if (input.reputationalImpact !== undefined &&
+        VALID_REPUTATIONAL.indexOf(input.reputationalImpact) === -1) {
+      throw new DoraError("dora/bad-reputational",
+        "classify: reputationalImpact must be one of " + VALID_REPUTATIONAL.join(", "));
+    }
+    var rv = _classifyImpl(input);
+    _emit("dora.incident.classified", {
+      metadata: {
+        classification: rv.classification,
+        mustReport:     rv.mustReport,
+        reasons:        rv.reasons,
+      },
+    });
+    return rv;
+  }
+
+  function report(input) {
+    _validateReportInput(input);
+    var record = {
+      incidentId:     input.incidentId,
+      classification: input.classification,
+      stage:          input.stage,
+      detectedAt:     input.detectedAt,
+      reportedAt:     Date.now(),
+      description:    input.description,
+      causeKnown:     input.causeKnown !== undefined ? !!input.causeKnown : null,
+      rootCause:      input.rootCause || null,
+      mitigationStarted: input.mitigationStarted !== undefined ? !!input.mitigationStarted : null,
+      systemsAffected:   input.systemsAffected || [],
+      affectedClients:   input.affectedClients || null,
+      economicImpact:    input.economicImpact || null,
+      geographicScope:   input.geographicScope || [],
+      durationMs:        input.durationMs || null,
+      reputationalImpact: input.reputationalImpact || null,
+      contactPoint:      input.contactPoint || null,
+      // Article 19 deadline — operator-side scheduler uses this.
+      nextStageDueAt:    null,
+    };
+    if (input.stage === "initial") {
+      record.nextStageDueAt = input.detectedAt + INTERMEDIATE_REPORT_DEADLINE_MS;
+    } else if (input.stage === "intermediate") {
+      record.nextStageDueAt = input.detectedAt + FINAL_REPORT_DEADLINE_MS;
+    }
+    _emit("dora.incident.reported", {
+      metadata: {
+        incidentId:     record.incidentId,
+        classification: record.classification,
+        stage:          record.stage,
+      },
+    });
+    try { observability().count("dora.incident.reported", 1, {
+      classification: record.classification, stage: record.stage,
+    }); } catch (_e) { /* obs best-effort */ }
+    return record;
+  }
+
+  function draftFinalReport(initialOrIntermediate) {
+    if (!initialOrIntermediate || typeof initialOrIntermediate !== "object") {
+      throw new DoraError("dora/bad-draft-input",
+        "draftFinalReport: input must be a prior report record");
+    }
+    var draft = Object.assign({}, initialOrIntermediate, {
+      stage:        "final",
+      reportedAt:   Date.now(),
+      // RTS Article 19(6) final-report shape — operator must fill before
+      // submission.
+      rootCause:           initialOrIntermediate.rootCause || null,
+      remediationActions:  [],
+      lessonsLearned:      "",
+      preventiveMeasures:  [],
+    });
+    _emit("dora.incident.draftFinal", {
+      metadata: { incidentId: draft.incidentId },
+    });
+    return draft;
+  }
+
+  return {
+    classify:          classify,
+    report:            report,
+    draftFinalReport:  draftFinalReport,
+  };
+}
+
+module.exports = {
+  create:                              create,
+  MAJOR_INCIDENT_THRESHOLDS:           MAJOR_INCIDENT_THRESHOLDS,
+  SIGNIFICANT_INCIDENT_THRESHOLDS:     SIGNIFICANT_INCIDENT_THRESHOLDS,
+  INITIAL_REPORT_DEADLINE_MS:          INITIAL_REPORT_DEADLINE_MS,
+  INTERMEDIATE_REPORT_DEADLINE_MS:     INTERMEDIATE_REPORT_DEADLINE_MS,
+  FINAL_REPORT_DEADLINE_MS:            FINAL_REPORT_DEADLINE_MS,
+  DoraError:                           DoraError,
+};

package/lib/framework-error.js

@@ -249,6 +249,24 @@ var GuardMarkdownError    = defineClass("GuardMarkdownError",    { alwaysPermane
 // in addresses, bidi/null/control chars in headers + addresses, header-
 // folding smuggling, BOM injection. alwaysPermanent.
 var GuardEmailError       = defineClass("GuardEmailError",       { alwaysPermanent: true });
+// DoraError covers DORA Article 17 incident-reporting workflow errors
+// (classification refusal, report-shape validation, ESA-template
+// generation, audit-chain integration). Permanent — these are
+// configuration / submission errors, not transient.
+var DoraError             = defineClass("DoraError",             { alwaysPermanent: true });
+// ComplianceError covers compliance-coordinator misuse: unknown
+// posture name, runtime-switch refusal, assertion failures.
+// Permanent — these are configuration errors, not transient.
+var ComplianceError       = defineClass("ComplianceError",       { alwaysPermanent: true });
+// SmtpPolicyError covers MTA-STS / DANE / TLS-RPT misuse: bad-policy
+// shape, fetch failures, TLSA-record format errors, missing records.
+// Permanent — these are policy / DNS configuration errors, not
+// transient.
+var SmtpPolicyError       = defineClass("SmtpPolicyError",       { alwaysPermanent: true });
+// MailAuthError covers SPF / DKIM-verify / DMARC / ARC misuse: bad
+// record shape, fetch failures, missing keys, alignment issues.
+// Permanent — DNS-config / message-shape errors, not transient.
+var MailAuthError         = defineClass("MailAuthError",         { alwaysPermanent: true });
 
 module.exports = {
   FrameworkError:         FrameworkError,
@@ -290,4 +308,8 @@ module.exports = {
   GuardXmlError:          GuardXmlError,
   GuardMarkdownError:     GuardMarkdownError,
   GuardEmailError:        GuardEmailError,
+  DoraError:              DoraError,
+  ComplianceError:        ComplianceError,
+  SmtpPolicyError:        SmtpPolicyError,
+  MailAuthError:          MailAuthError,
 };

package/lib/gate-contract.js

@@ -66,6 +66,7 @@ var validateOpts = require("./validate-opts");
 var { GateContractError } = require("./framework-error");
 
 var observability = lazyRequire(function () { return require("./observability"); });
+var compliance = lazyRequire(function () { return require("./compliance"); });
 
 // Forensic-id token width (bytes); 64 bits is enough for cross-gate
 // correlation in a single request scope.
@@ -804,12 +805,27 @@ function resolveProfileAndPosture(opts, cfg) {
     }
     overlay = cfg.profiles[opts.profile];
   }
-  if (typeof opts.compliancePosture === "string") {
-    if (!cfg.compliancePostures || !cfg.compliancePostures[opts.compliancePosture]) {
+  // Compliance-posture resolution — operator-supplied opt wins; if not
+  // given, fall back to the global posture set via b.compliance.set().
+  // The fallback IS the value-add of the top-level coordinator: every
+  // primitive with a compliancePosture opt picks up the deployment's
+  // declared posture without per-call wiring.
+  var posture = opts.compliancePosture;
+  if (typeof posture !== "string") {
+    var globalPosture;
+    try { globalPosture = compliance().current(); }
+    catch (_e) { globalPosture = null; }
+    if (typeof globalPosture === "string" &&
+        cfg.compliancePostures && cfg.compliancePostures[globalPosture]) {
+      posture = globalPosture;
+    }
+  }
+  if (typeof posture === "string") {
+    if (!cfg.compliancePostures || !cfg.compliancePostures[posture]) {
       throw ErrorClass.factory(prefix + ".bad-posture",
-        "unknown compliancePosture " + JSON.stringify(opts.compliancePosture));
+        "unknown compliancePosture " + JSON.stringify(posture));
     }
-    overlay = Object.assign({}, overlay, cfg.compliancePostures[opts.compliancePosture]);
+    overlay = Object.assign({}, overlay, cfg.compliancePostures[posture]);
   }
   return Object.assign({}, cfg.defaults || {}, overlay, opts);
 }