@bluefly/openstandardagents 0.4.3 → 0.4.5

package/dist/services/governance/governance-generator.service.js

@@ -0,0 +1,955 @@
+/**
+ * Governance Generator Service
+ *
+ * Generates governance artifacts from an OSSA agent manifest.
+ * Extracts from `extensions.governance`, `spec.autonomy`, and `spec.constraints`
+ * to produce a complete governance directory structure:
+ *
+ *   governance/compliance.yaml         -- Compliance framework declarations
+ *   governance/policies/autonomy.yaml  -- Autonomy boundaries
+ *   governance/policies/constraints.yaml -- Cost/performance/resource limits
+ *   governance/policies/team-permissions.yaml -- Per-member permissions (when team exists)
+ *   governance/audit.yaml              -- Audit trail configuration
+ *
+ * Design: generates meaningful defaults when governance data is sparse so that
+ * every exported agent ships with sensible governance out of the box.
+ */
+import * as yaml from 'yaml';
+const FRAMEWORK_REQUIREMENTS = {
+    SOC2: [
+        {
+            id: 'SOC2-CC6.1',
+            description: 'Logical and physical access controls',
+            controls: ['rbac-enforcement', 'least-privilege-access', 'access-review-quarterly'],
+        },
+        {
+            id: 'SOC2-CC6.3',
+            description: 'Role-based access with segregation of duties',
+            controls: ['role-separation', 'approval-workflows', 'privilege-escalation-monitoring'],
+        },
+        {
+            id: 'SOC2-CC7.2',
+            description: 'System monitoring and anomaly detection',
+            controls: ['audit-logging', 'anomaly-detection', 'incident-response-plan'],
+        },
+        {
+            id: 'SOC2-CC8.1',
+            description: 'Change management controls',
+            controls: ['change-approval', 'rollback-capability', 'version-tracking'],
+        },
+    ],
+    HIPAA: [
+        {
+            id: 'HIPAA-164.312(a)',
+            description: 'Access control -- unique user identification',
+            controls: ['unique-agent-identity', 'emergency-access-procedure', 'automatic-logoff'],
+        },
+        {
+            id: 'HIPAA-164.312(b)',
+            description: 'Audit controls -- hardware/software/procedural',
+            controls: ['audit-trail-immutable', 'audit-retention-6-years', 'audit-review-regular'],
+        },
+        {
+            id: 'HIPAA-164.312(c)',
+            description: 'Integrity controls',
+            controls: ['data-integrity-verification', 'tamper-detection', 'checksums'],
+        },
+        {
+            id: 'HIPAA-164.312(e)',
+            description: 'Transmission security',
+            controls: ['encryption-in-transit-tls12', 'encryption-at-rest-aes256'],
+        },
+    ],
+    GDPR: [
+        {
+            id: 'GDPR-Art5',
+            description: 'Principles of data processing',
+            controls: ['purpose-limitation', 'data-minimisation', 'storage-limitation'],
+        },
+        {
+            id: 'GDPR-Art25',
+            description: 'Data protection by design and default',
+            controls: ['privacy-by-design', 'default-privacy-settings', 'dpia-required'],
+        },
+        {
+            id: 'GDPR-Art30',
+            description: 'Records of processing activities',
+            controls: ['processing-records', 'data-flow-mapping', 'controller-documentation'],
+        },
+        {
+            id: 'GDPR-Art33',
+            description: 'Notification of data breach',
+            controls: ['breach-detection-72h', 'breach-notification-procedure', 'breach-documentation'],
+        },
+    ],
+    'PCI-DSS': [
+        {
+            id: 'PCI-DSS-Req3',
+            description: 'Protect stored cardholder data',
+            controls: ['encryption-at-rest', 'key-management', 'data-masking'],
+        },
+        {
+            id: 'PCI-DSS-Req4',
+            description: 'Encrypt cardholder data in transit',
+            controls: ['tls-1.2-minimum', 'certificate-management', 'no-plaintext-transmission'],
+        },
+        {
+            id: 'PCI-DSS-Req10',
+            description: 'Track and monitor access',
+            controls: ['audit-trail-all-access', 'log-retention-1-year', 'daily-log-review'],
+        },
+        {
+            id: 'PCI-DSS-Req11',
+            description: 'Regular security testing',
+            controls: ['quarterly-vulnerability-scan', 'annual-penetration-test', 'ids-ips'],
+        },
+    ],
+    FedRAMP: [
+        {
+            id: 'FedRAMP-AC',
+            description: 'Access control family (NIST 800-53)',
+            controls: ['account-management', 'access-enforcement', 'separation-of-duties'],
+        },
+        {
+            id: 'FedRAMP-AU',
+            description: 'Audit and accountability family',
+            controls: ['audit-events', 'audit-storage', 'audit-review-analysis'],
+        },
+        {
+            id: 'FedRAMP-SC',
+            description: 'System and communications protection',
+            controls: ['fips-140-2-cryptography', 'boundary-protection', 'cryptographic-key-management'],
+        },
+        {
+            id: 'FedRAMP-CM',
+            description: 'Configuration management',
+            controls: ['baseline-configuration', 'configuration-change-control', 'least-functionality'],
+        },
+    ],
+};
+// ── Default autonomy levels ──────────────────────────────────────────────────
+const AUTONOMY_LEVEL_DESCRIPTIONS = {
+    autonomous: 'Agent operates independently within defined boundaries. No human approval required for standard operations.',
+    'semi-autonomous': 'Agent operates independently for routine tasks but requires human approval for high-risk or irreversible actions.',
+    supervised: 'Agent proposes actions and waits for human review before execution. All outputs are reviewed.',
+    'human-in-the-loop': 'Agent assists humans but never acts independently. Every action requires explicit human confirmation.',
+};
+// ── Service implementation ───────────────────────────────────────────────────
+export class GovernanceGeneratorService {
+    /**
+     * Generate all governance artifacts from an OSSA manifest.
+     * Returns an array of ExportFile entries ready for writing.
+     */
+    generate(manifest) {
+        const files = [];
+        const governance = this.resolveGovernanceExtension(manifest);
+        const autonomy = this.resolveAutonomy(manifest);
+        const constraints = this.resolveConstraints(manifest);
+        const agentName = manifest.metadata?.name ?? 'unnamed-agent';
+        const agentVersion = manifest.metadata?.version ?? '0.0.0';
+        const agentKind = manifest.metadata?.agentKind ?? 'worker';
+        const architecturePattern = manifest.metadata?.agentArchitecture?.pattern ?? 'single';
+        // 1. compliance.yaml
+        files.push(this.generateComplianceFile(governance, agentName, agentVersion, agentKind));
+        // 2. policies/autonomy.yaml
+        files.push(this.generateAutonomyPolicy(autonomy, governance, agentName, agentKind));
+        // 3. policies/constraints.yaml
+        files.push(this.generateConstraintsPolicy(constraints, agentName));
+        // 4. policies/team-permissions.yaml (only when team exists)
+        const teamMembers = this.resolveTeamMembers(manifest);
+        if (teamMembers.length > 0) {
+            files.push(this.generateTeamPermissions(teamMembers, autonomy, governance, agentName, architecturePattern));
+        }
+        // 5. audit.yaml
+        files.push(this.generateAuditConfig(governance, agentName, agentVersion));
+        return files;
+    }
+    // ── Resolution helpers ───────────────────────────────────────────────────
+    /**
+     * Resolve governance extension from both spec-level and top-level extensions.
+     * Spec-level takes precedence. Returns a normalised structure.
+     */
+    resolveGovernanceExtension(manifest) {
+        const spec = manifest.spec;
+        const topLevel = manifest.extensions?.governance;
+        const specLevel = spec?.governance;
+        const extLevel = spec?.extensions?.governance;
+        // Merge: spec.governance > spec.extensions.governance > extensions.governance
+        return {
+            ...topLevel,
+            ...extLevel,
+            ...specLevel,
+        };
+    }
+    resolveAutonomy(manifest) {
+        return manifest.spec?.autonomy ?? {};
+    }
+    resolveConstraints(manifest) {
+        return manifest.spec?.constraints ?? {};
+    }
+    /**
+     * Extract team members from multiple possible locations:
+     *   spec.team.members, spec.team.agents, spec.team.participants
+     */
+    resolveTeamMembers(manifest) {
+        const spec = manifest.spec;
+        if (!spec?.team)
+            return [];
+        const team = spec.team;
+        const members = team.members ?? team.agents ?? team.participants ?? [];
+        return Array.isArray(members) ? members : [];
+    }
+    // ── File generators ──────────────────────────────────────────────────────
+    /**
+     * Generate governance/compliance.yaml with framework-specific requirements.
+     */
+    generateComplianceFile(governance, agentName, agentVersion, agentKind) {
+        const compliance = governance.compliance ?? {};
+        const quality = governance.quality ?? governance.quality_requirements ?? {};
+        const authorization = governance.authorization ?? {};
+        const declaredFrameworks = compliance.frameworks ?? [];
+        const dataClassification = compliance.dataClassification ??
+            compliance.data_classification ??
+            this.inferDataClassification(declaredFrameworks);
+        const auditLogging = compliance.auditLogging ??
+            compliance.audit_logging_required ??
+            declaredFrameworks.length > 0;
+        // Build framework-specific requirement sections
+        const frameworkSections = declaredFrameworks.map((fw) => {
+            const upperFw = fw.toUpperCase() === 'PCI-DSS' ? 'PCI-DSS' : fw.toUpperCase();
+            const requirements = FRAMEWORK_REQUIREMENTS[upperFw] ?? FRAMEWORK_REQUIREMENTS[fw] ?? [];
+            return {
+                framework: fw,
+                status: 'declared',
+                requirements: requirements.map((r) => ({
+                    id: r.id,
+                    description: r.description,
+                    controls: r.controls,
+                    status: 'pending-validation',
+                })),
+            };
+        });
+        // If no frameworks declared, provide a sensible default
+        if (frameworkSections.length === 0) {
+            frameworkSections.push({
+                framework: 'internal-baseline',
+                status: 'active',
+                requirements: [
+                    {
+                        id: 'BASELINE-001',
+                        description: 'Agent identity and access control',
+                        controls: ['unique-agent-identity', 'least-privilege-access'],
+                        status: 'active',
+                    },
+                    {
+                        id: 'BASELINE-002',
+                        description: 'Action audit logging',
+                        controls: ['audit-logging', 'structured-log-format'],
+                        status: 'active',
+                    },
+                    {
+                        id: 'BASELINE-003',
+                        description: 'Output validation',
+                        controls: ['output-schema-validation', 'error-handling'],
+                        status: 'active',
+                    },
+                ],
+            });
+        }
+        // Quality thresholds with sensible defaults
+        const confidenceThreshold = quality.confidenceThreshold ?? quality.confidence_threshold ?? 70;
+        const testCoverageThreshold = quality.testCoverageThreshold ?? quality.test_coverage_threshold ?? 60;
+        const securityScoreThreshold = quality.securityScoreThreshold ?? quality.security_score_threshold ?? 70;
+        const maxVulnerabilityCount = quality.maxVulnerabilityCount ?? quality.max_vulnerability_count ?? 0;
+        // Authorization clearance
+        const clearanceLevel = authorization.clearanceLevel ??
+            authorization.clearance_level ??
+            this.inferClearanceLevel(agentKind);
+        const doc = {
+            apiVersion: 'governance/v1',
+            kind: 'ComplianceProfile',
+            metadata: {
+                agent: agentName,
+                version: agentVersion,
+                generatedAt: new Date().toISOString(),
+                generatedBy: 'ossa-governance-generator',
+            },
+            spec: {
+                dataClassification,
+                auditLogging,
+                clearanceLevel,
+                qualityGates: {
+                    confidenceThreshold,
+                    testCoverageThreshold,
+                    securityScoreThreshold,
+                    maxVulnerabilityCount,
+                },
+                frameworks: frameworkSections,
+            },
+        };
+        // Include tool permissions if declared
+        const toolPermissions = authorization.toolPermissions ?? authorization.tool_permissions ?? [];
+        if (toolPermissions.length > 0) {
+            doc.spec.toolPermissions = toolPermissions.map((tp) => ({
+                tool: tp.tool,
+                riskLevel: tp.riskLevel ?? tp.risk_level ?? 'medium',
+                requiresApproval: tp.requiresApproval ?? tp.requires_approval ?? false,
+            }));
+        }
+        // Include policy references if declared
+        const policyRefs = authorization.policyReferences ?? authorization.policy_references ?? [];
+        if (policyRefs.length > 0) {
+            doc.spec.policyReferences = policyRefs;
+        }
+        return {
+            path: 'governance/compliance.yaml',
+            content: this.toYaml(doc),
+            type: 'config',
+            language: 'yaml',
+        };
+    }
+    /**
+     * Generate governance/policies/autonomy.yaml with clear boundaries.
+     */
+    generateAutonomyPolicy(autonomy, governance, agentName, agentKind) {
+        const level = autonomy.level ?? this.inferAutonomyLevel(agentKind);
+        const approvalRequired = autonomy.approval_required ?? autonomy.approvalRequired ?? level !== 'autonomous';
+        const allowedActions = autonomy.allowed_actions ?? autonomy.allowedActions ?? [];
+        const blockedActions = autonomy.blocked_actions ?? autonomy.blockedActions ?? [];
+        // Provide defaults when lists are empty
+        const effectiveAllowed = allowedActions.length > 0
+            ? allowedActions
+            : this.defaultAllowedActions(agentKind);
+        const effectiveBlocked = blockedActions.length > 0
+            ? blockedActions
+            : this.defaultBlockedActions(agentKind);
+        // Derive escalation policy from autonomy level
+        const escalationPolicy = this.buildEscalationPolicy(level, approvalRequired);
+        // Authorization-based constraints
+        const clearanceLevel = governance.authorization?.clearanceLevel ??
+            governance.authorization?.clearance_level ??
+            this.inferClearanceLevel(agentKind);
+        const doc = {
+            apiVersion: 'governance/v1',
+            kind: 'AutonomyPolicy',
+            metadata: {
+                agent: agentName,
+                description: AUTONOMY_LEVEL_DESCRIPTIONS[level] ?? `Autonomy level: ${level}`,
+            },
+            spec: {
+                level,
+                approvalRequired,
+                clearanceLevel,
+                boundaries: {
+                    allowedActions: effectiveAllowed,
+                    blockedActions: effectiveBlocked,
+                },
+                escalation: escalationPolicy,
+                riskThresholds: {
+                    low: {
+                        requiresApproval: false,
+                        description: 'Read-only operations, no side effects',
+                    },
+                    medium: {
+                        requiresApproval: level === 'supervised' || level === 'human-in-the-loop',
+                        description: 'Write operations, reversible changes',
+                    },
+                    high: {
+                        requiresApproval: level !== 'autonomous',
+                        description: 'Destructive or high-impact operations',
+                    },
+                    critical: {
+                        requiresApproval: true,
+                        description: 'System-level changes, always require human approval',
+                    },
+                },
+            },
+        };
+        return {
+            path: 'governance/policies/autonomy.yaml',
+            content: this.toYaml(doc),
+            type: 'config',
+            language: 'yaml',
+        };
+    }
+    /**
+     * Generate governance/policies/constraints.yaml with budget, performance, and resource limits.
+     */
+    generateConstraintsPolicy(constraints, agentName) {
+        const cost = constraints.cost ?? {};
+        const performance = constraints.performance ?? {};
+        const resources = constraints.resources ?? {};
+        const doc = {
+            apiVersion: 'governance/v1',
+            kind: 'ConstraintsPolicy',
+            metadata: {
+                agent: agentName,
+            },
+            spec: {
+                budget: {
+                    maxTokensPerDay: cost.maxTokensPerDay ?? 100_000,
+                    maxTokensPerRequest: cost.maxTokensPerRequest ?? 4_096,
+                    maxCostPerDay: cost.maxCostPerDay ?? 10.0,
+                    currency: cost.currency ?? 'USD',
+                    alertThresholds: {
+                        warning: 0.8,
+                        critical: 0.95,
+                    },
+                    enforcement: 'hard-limit',
+                },
+                performanceSLA: {
+                    maxLatencySeconds: performance.maxLatencySeconds ?? 30,
+                    maxErrorRate: performance.maxErrorRate ?? 0.01,
+                    timeoutSeconds: performance.timeoutSeconds ?? 60,
+                    retryPolicy: {
+                        maxAttempts: 3,
+                        backoffStrategy: 'exponential',
+                        initialDelayMs: 1000,
+                    },
+                },
+                resources: {
+                    cpu: resources.cpu ?? '500m',
+                    memory: resources.memory ?? '512Mi',
+                    gpu: resources.gpu ?? null,
+                    limits: {
+                        cpu: resources.cpu ?? '500m',
+                        memory: resources.memory ?? '512Mi',
+                    },
+                    requests: {
+                        cpu: this.halveResource(resources.cpu ?? '500m'),
+                        memory: this.halveResource(resources.memory ?? '512Mi'),
+                    },
+                },
+            },
+        };
+        return {
+            path: 'governance/policies/constraints.yaml',
+            content: this.toYaml(doc),
+            type: 'config',
+            language: 'yaml',
+        };
+    }
+    /**
+     * Generate governance/policies/team-permissions.yaml with per-member permissions.
+     * Permission scoping is based on agent kind:
+     *   - team-lead / orchestrator -> broad permissions
+     *   - teammate / worker        -> scoped to assigned role
+     *   - subagent                 -> restricted to specific tasks
+     */
+    generateTeamPermissions(members, autonomy, governance, agentName, architecturePattern) {
+        const teamLevel = autonomy.level ?? 'semi-autonomous';
+        const baseClearance = governance.authorization?.clearanceLevel ??
+            governance.authorization?.clearance_level ??
+            2;
+        const memberPermissions = members.map((member) => {
+            const memberName = member.name ?? member.agent_ref ?? member.agentRef ?? 'unnamed';
+            const memberRole = member.role ?? 'worker';
+            const memberKind = member.kind ?? member.agentKind ?? this.inferKindFromRole(memberRole);
+            const tier = this.computeMemberTier(memberKind, baseClearance);
+            return {
+                name: memberName,
+                role: memberRole,
+                kind: memberKind,
+                permissions: {
+                    clearanceLevel: tier.clearance,
+                    accessTier: tier.accessTier,
+                    approvalRequired: tier.approvalRequired,
+                    allowedOperations: tier.allowedOperations,
+                    blockedOperations: tier.blockedOperations,
+                    canEscalate: tier.canEscalate,
+                    canDelegate: tier.canDelegate,
+                },
+            };
+        });
+        const doc = {
+            apiVersion: 'governance/v1',
+            kind: 'TeamPermissions',
+            metadata: {
+                agent: agentName,
+                teamSize: members.length,
+                architecturePattern,
+            },
+            spec: {
+                teamAutonomyLevel: teamLevel,
+                coordinationModel: this.inferCoordinationModel(architecturePattern),
+                members: memberPermissions,
+                defaults: {
+                    description: 'Default permissions applied to any member not explicitly listed',
+                    clearanceLevel: Math.max(0, baseClearance - 1),
+                    accessTier: 'tier_2_write_limited',
+                    approvalRequired: true,
+                    allowedOperations: ['read', 'analyze', 'report'],
+                    blockedOperations: ['delete', 'deploy-production', 'modify-governance'],
+                },
+            },
+        };
+        return {
+            path: 'governance/policies/team-permissions.yaml',
+            content: this.toYaml(doc),
+            type: 'config',
+            language: 'yaml',
+        };
+    }
+    /**
+     * Generate governance/audit.yaml with retention, format, and event configuration.
+     */
+    generateAuditConfig(governance, agentName, agentVersion) {
+        const compliance = governance.compliance ?? {};
+        const declaredFrameworks = compliance.frameworks ?? [];
+        const auditRequired = compliance.auditLogging ??
+            compliance.audit_logging_required ??
+            true; // Default: audit is always enabled
+        // Retention based on strictest compliance requirement
+        const retentionDays = this.computeRetentionDays(declaredFrameworks);
+        const doc = {
+            apiVersion: 'governance/v1',
+            kind: 'AuditConfig',
+            metadata: {
+                agent: agentName,
+                version: agentVersion,
+            },
+            spec: {
+                enabled: auditRequired,
+                format: 'json',
+                output: {
+                    destination: 'structured-log',
+                    fallback: 'file',
+                    filePath: `logs/${agentName}/audit.jsonl`,
+                },
+                retention: {
+                    days: retentionDays,
+                    policy: retentionDays >= 365 ? 'compliance-mandatory' : 'standard',
+                    archiveAfterDays: Math.min(90, retentionDays),
+                    compressionEnabled: true,
+                },
+                events: {
+                    actionExecution: {
+                        enabled: true,
+                        detail: 'full',
+                        description: 'Log every tool call, API request, and action taken',
+                    },
+                    approvalDecisions: {
+                        enabled: true,
+                        detail: 'full',
+                        description: 'Log all approval requests and decisions (approved, denied, timed-out)',
+                    },
+                    policyEvaluations: {
+                        enabled: true,
+                        detail: 'summary',
+                        description: 'Log governance policy evaluation outcomes',
+                    },
+                    errorEvents: {
+                        enabled: true,
+                        detail: 'full',
+                        description: 'Log all errors, failures, and exception traces',
+                    },
+                    accessEvents: {
+                        enabled: true,
+                        detail: 'full',
+                        description: 'Log resource access (data reads, writes, deletions)',
+                    },
+                    configChanges: {
+                        enabled: true,
+                        detail: 'full',
+                        description: 'Log changes to agent configuration and governance policies',
+                    },
+                    costTracking: {
+                        enabled: true,
+                        detail: 'summary',
+                        description: 'Log token usage, cost accrual, and budget threshold events',
+                    },
+                },
+                integrity: {
+                    checksumAlgorithm: 'sha256',
+                    tamperDetection: declaredFrameworks.length > 0,
+                    signEntries: declaredFrameworks.some((fw) => ['HIPAA', 'FedRAMP', 'PCI-DSS'].includes(fw.toUpperCase())),
+                },
+                redaction: {
+                    enabled: true,
+                    patterns: [
+                        { type: 'pii', action: 'hash', description: 'Hash personally identifiable information' },
+                        { type: 'secrets', action: 'redact', description: 'Redact API keys, tokens, and credentials' },
+                        { type: 'phi', action: 'hash', description: 'Hash protected health information (HIPAA)' },
+                    ],
+                },
+            },
+        };
+        return {
+            path: 'governance/audit.yaml',
+            content: this.toYaml(doc),
+            type: 'config',
+            language: 'yaml',
+        };
+    }
+    // ── Inference and default helpers ────────────────────────────────────────
+    /**
+     * Infer data classification from compliance frameworks.
+     * Stricter frameworks imply higher classification.
+     */
+    inferDataClassification(frameworks) {
+        const upper = frameworks.map((f) => f.toUpperCase());
+        if (upper.includes('HIPAA') || upper.includes('PCI-DSS'))
+            return 'restricted';
+        if (upper.includes('FEDRAMP'))
+            return 'confidential';
+        if (upper.includes('SOC2') || upper.includes('GDPR'))
+            return 'internal';
+        return 'internal';
+    }
+    /**
+     * Infer clearance level from agent kind.
+     * More powerful agent kinds get higher default clearance.
+     */
+    inferClearanceLevel(agentKind) {
+        switch (agentKind) {
+            case 'orchestrator':
+            case 'supervisor':
+                return 4;
+            case 'planner':
+            case 'coordinator':
+                return 3;
+            case 'executor':
+            case 'worker':
+            case 'assistant':
+            case 'analyst':
+            case 'researcher':
+            case 'specialist':
+                return 2;
+            case 'reviewer':
+            case 'monitor':
+                return 1;
+            case 'tool':
+                return 1;
+            default:
+                return 1;
+        }
+    }
+    /**
+     * Infer autonomy level from agent kind.
+     */
+    inferAutonomyLevel(agentKind) {
+        switch (agentKind) {
+            case 'orchestrator':
+            case 'coordinator':
+                return 'semi-autonomous';
+            case 'worker':
+            case 'executor':
+                return 'autonomous';
+            case 'assistant':
+                return 'human-in-the-loop';
+            case 'reviewer':
+            case 'monitor':
+            case 'analyst':
+                return 'supervised';
+            default:
+                return 'semi-autonomous';
+        }
+    }
+    /**
+     * Default allowed actions based on agent kind.
+     */
+    defaultAllowedActions(agentKind) {
+        const base = ['read-data', 'analyze', 'generate-reports'];
+        switch (agentKind) {
+            case 'orchestrator':
+            case 'coordinator':
+                return [...base, 'delegate-tasks', 'coordinate-agents', 'monitor-progress'];
+            case 'executor':
+            case 'worker':
+                return [...base, 'execute-tasks', 'write-data', 'call-tools'];
+            case 'assistant':
+                return [...base, 'respond-to-user', 'suggest-actions'];
+            case 'reviewer':
+                return [...base, 'review-outputs', 'approve-changes', 'add-comments'];
+            case 'planner':
+                return [...base, 'create-plans', 'estimate-effort', 'prioritise-tasks'];
+            case 'monitor':
+                return [...base, 'observe-metrics', 'trigger-alerts'];
+            default:
+                return base;
+        }
+    }
+    /**
+     * Default blocked actions based on agent kind.
+     */
+    defaultBlockedActions(agentKind) {
+        const universal = [
+            'modify-own-governance',
+            'disable-audit-logging',
+            'bypass-approval-workflows',
+            'access-other-agent-credentials',
+        ];
+        switch (agentKind) {
+            case 'reviewer':
+            case 'monitor':
+            case 'analyst':
+                return [...universal, 'write-data', 'execute-deployments', 'modify-configurations'];
+            case 'assistant':
+                return [...universal, 'execute-deployments', 'modify-infrastructure'];
+            default:
+                return universal;
+        }
+    }
+    /**
+     * Build escalation policy based on autonomy level.
+     */
+    buildEscalationPolicy(level, approvalRequired) {
+        const policy = {
+            enabled: level !== 'autonomous' || approvalRequired,
+            channels: ['human-supervisor'],
+            timeoutBehavior: 'deny',
+        };
+        switch (level) {
+            case 'autonomous':
+                policy.triggerConditions = [
+                    'budget-threshold-exceeded',
+                    'error-rate-spike',
+                    'blocked-action-attempted',
+                ];
+                policy.timeoutSeconds = 300;
+                break;
+            case 'semi-autonomous':
+                policy.triggerConditions = [
+                    'high-risk-action',
+                    'budget-threshold-exceeded',
+                    'confidence-below-threshold',
+                    'blocked-action-attempted',
+                ];
+                policy.timeoutSeconds = 600;
+                break;
+            case 'supervised':
+                policy.triggerConditions = [
+                    'any-write-action',
+                    'any-external-call',
+                    'confidence-below-threshold',
+                ];
+                policy.timeoutSeconds = 900;
+                break;
+            case 'human-in-the-loop':
+                policy.triggerConditions = ['every-action'];
+                policy.timeoutSeconds = 1800;
+                break;
+            default:
+                policy.triggerConditions = ['high-risk-action', 'blocked-action-attempted'];
+                policy.timeoutSeconds = 600;
+        }
+        return policy;
+    }
+    /**
+     * Infer agent kind from a role description string.
+     */
+    inferKindFromRole(role) {
+        const lower = role.toLowerCase();
+        if (lower.includes('lead') || lower.includes('manager') || lower.includes('orchestrat'))
+            return 'team-lead';
+        if (lower.includes('review') || lower.includes('approv'))
+            return 'reviewer';
+        if (lower.includes('monitor') || lower.includes('watch') || lower.includes('observ'))
+            return 'monitor';
+        if (lower.includes('sub') || lower.includes('helper'))
+            return 'subagent';
+        if (lower.includes('plan'))
+            return 'planner';
+        if (lower.includes('execut'))
+            return 'executor';
+        return 'teammate';
+    }
+    /**
+     * Compute member permissions tier based on kind and base clearance.
+     */
+    computeMemberTier(memberKind, baseClearance) {
+        switch (memberKind) {
+            case 'team-lead':
+            case 'orchestrator':
+            case 'supervisor':
+                return {
+                    clearance: Math.min(5, baseClearance + 1),
+                    accessTier: 'tier_3_full_access',
+                    approvalRequired: false,
+                    allowedOperations: [
+                        'read', 'write', 'execute', 'delegate', 'coordinate',
+                        'approve-member-actions', 'modify-team-config', 'view-audit-logs',
+                    ],
+                    blockedOperations: [
+                        'modify-own-governance', 'disable-audit-logging',
+                        'access-other-team-credentials',
+                    ],
+                    canEscalate: true,
+                    canDelegate: true,
+                };
+            case 'coordinator':
+            case 'planner':
+                return {
+                    clearance: baseClearance,
+                    accessTier: 'tier_2_write_limited',
+                    approvalRequired: false,
+                    allowedOperations: [
+                        'read', 'analyze', 'plan', 'coordinate', 'create-issues',
+                        'assign-tasks', 'report',
+                    ],
+                    blockedOperations: [
+                        'modify-governance', 'deploy-production',
+                        'delete-data', 'modify-infrastructure',
+                    ],
+                    canEscalate: true,
+                    canDelegate: true,
+                };
+            case 'teammate':
+            case 'worker':
+            case 'executor':
+                return {
+                    clearance: baseClearance,
+                    accessTier: 'tier_2_write_limited',
+                    approvalRequired: true,
+                    allowedOperations: [
+                        'read', 'write', 'execute-assigned-tasks', 'call-tools',
+                        'report-progress',
+                    ],
+                    blockedOperations: [
+                        'modify-governance', 'deploy-production', 'approve-changes',
+                        'delete-data', 'modify-team-config',
+                    ],
+                    canEscalate: true,
+                    canDelegate: false,
+                };
+            case 'reviewer':
+                return {
+                    clearance: Math.max(1, baseClearance - 1),
+                    accessTier: 'tier_1_read',
+                    approvalRequired: false,
+                    allowedOperations: [
+                        'read', 'analyze', 'review', 'approve-changes', 'add-comments',
+                        'request-changes',
+                    ],
+                    blockedOperations: [
+                        'write-code', 'execute-deployments', 'modify-governance',
+                        'delete-data', 'modify-infrastructure',
+                    ],
+                    canEscalate: true,
+                    canDelegate: false,
+                };
+            case 'subagent':
+                return {
+                    clearance: Math.max(0, baseClearance - 2),
+                    accessTier: 'tier_1_read',
+                    approvalRequired: true,
+                    allowedOperations: [
+                        'read-assigned-scope', 'execute-specific-task', 'report-to-parent',
+                    ],
+                    blockedOperations: [
+                        'write-outside-scope', 'communicate-external',
+                        'modify-governance', 'deploy', 'delete-data',
+                        'access-other-agent-data', 'modify-team-config',
+                    ],
+                    canEscalate: false,
+                    canDelegate: false,
+                };
+            case 'monitor':
+            case 'analyst':
+                return {
+                    clearance: Math.max(1, baseClearance - 1),
+                    accessTier: 'tier_1_read',
+                    approvalRequired: false,
+                    allowedOperations: [
+                        'read', 'observe-metrics', 'analyze-data', 'generate-reports',
+                        'trigger-alerts',
+                    ],
+                    blockedOperations: [
+                        'write-data', 'execute-tasks', 'modify-governance',
+                        'deploy', 'delete-data',
+                    ],
+                    canEscalate: true,
+                    canDelegate: false,
+                };
+            default:
+                return {
+                    clearance: Math.max(0, baseClearance - 1),
+                    accessTier: 'tier_1_read',
+                    approvalRequired: true,
+                    allowedOperations: ['read', 'analyze', 'report'],
+                    blockedOperations: [
+                        'write', 'delete', 'deploy', 'modify-governance',
+                    ],
+                    canEscalate: false,
+                    canDelegate: false,
+                };
+        }
+    }
+    /**
+     * Derive coordination model from architecture pattern.
+     */
+    inferCoordinationModel(pattern) {
+        switch (pattern) {
+            case 'hierarchical':
+                return 'manager-worker';
+            case 'swarm':
+                return 'peer-to-peer-with-handoffs';
+            case 'pipeline':
+                return 'sequential-chain';
+            case 'graph':
+                return 'dag-orchestration';
+            case 'reactive':
+                return 'event-driven';
+            case 'cognitive':
+                return 'deliberative-reasoning';
+            default:
+                return 'central-coordinator';
+        }
+    }
+    /**
+     * Compute audit retention days from the strictest framework requirement.
+     *
+     * HIPAA:  6 years (2190 days)
+     * FedRAMP: 3 years (1095 days)
+     * PCI-DSS: 1 year (365 days)
+     * SOC2:   1 year (365 days)
+     * GDPR:   context-dependent, default 365 days
+     * Default: 90 days
+     */
+    computeRetentionDays(frameworks) {
+        if (frameworks.length === 0)
+            return 90;
+        const upper = frameworks.map((f) => f.toUpperCase());
+        const retentionMap = {
+            HIPAA: 2190,
+            FEDRAMP: 1095,
+            'PCI-DSS': 365,
+            SOC2: 365,
+            GDPR: 365,
+        };
+        let maxRetention = 90;
+        for (const fw of upper) {
+            const retention = retentionMap[fw] ?? 90;
+            if (retention > maxRetention) {
+                maxRetention = retention;
+            }
+        }
+        return maxRetention;
+    }
+    /**
+     * Halve a Kubernetes-style resource string for request values.
+     * Examples: "1000m" -> "500m", "2Gi" -> "1Gi", "512Mi" -> "256Mi"
+     */
+    halveResource(resource) {
+        const match = resource.match(/^(\d+(?:\.\d+)?)\s*(.*)$/);
+        if (!match)
+            return resource;
+        const value = parseFloat(match[1]);
+        const unit = match[2];
+        const halved = Math.max(1, Math.round(value / 2));
+        return `${halved}${unit}`;
+    }
+    /**
+     * Serialise a document to YAML with consistent formatting.
+     */
+    toYaml(doc) {
+        return yaml.stringify(doc, {
+            indent: 2,
+            lineWidth: 120,
+            defaultStringType: 'PLAIN',
+            defaultKeyType: 'PLAIN',
+            nullStr: '~',
+        });
+    }
+}
+//# sourceMappingURL=governance-generator.service.js.map