@cohortapp/agent-sdk 2.3.0

package/scripts/disclosure_assessment.py

@@ -0,0 +1,873 @@
+#!/usr/bin/env python3
+"""Post-Draft Disclosure Assessment Engine — Layer 2 hard gate.
+
+Analyses a draft message against recipient information boundaries and
+provenance data to determine whether it is safe to send.
+
+Usage (CLI):
+  echo "Let's discuss the PartnerCo operations schedule" | \\
+      python3 scripts/disclosure_assessment.py --recipient casey-morgan
+
+  python3 scripts/disclosure_assessment.py \\
+      --recipient casey-morgan --channel strategic-initiative \\
+      --message "The JVA negotiation is progressing well"
+
+Exit codes:
+  0 = passed or warn (safe to send, possibly with a warning)
+  1 = stripped   (send but strip / redact the flagged content)
+  2 = blocked    (do not send)
+
+Output: JSON to stdout.
+
+Created: 2026-04-05 — Task 7, Layer 2 disclosure assessment system
+"""
+
+import argparse
+import hashlib
+import json
+import os
+import sys
+import time
+import uuid
+from datetime import datetime, timezone, timedelta
+from pathlib import Path
+
+# ─── Paths ────────────────────────────────────────────────────────────────────
+SCRIPT_DIR = Path(__file__).resolve().parent
+REPO_ROOT = SCRIPT_DIR.parent
+USER_PROFILES_DIR = REPO_ROOT / "memory" / "profiles" / "users"
+CHANNEL_PROFILES_DIR = REPO_ROOT / "memory" / "profiles" / "channels"
+PROVENANCE_INDEX = REPO_ROOT / "memory" / "provenance" / "index.jsonl"
+AUDIT_LOG_DIR = REPO_ROOT / "logs" / "audit"
+
+# ─── Constants ────────────────────────────────────────────────────────────────
+SEVERITY_ORDER = {"low": 0, "medium": 1, "high": 2, "critical": 3}
+SEVERITY_ACTIONS = {
+    "critical": "block_and_escalate",
+    "high": "block_and_flag",
+    "medium": "strip_and_send",
+    "low": "warn_and_send",
+}
+
+# Words that provide no discriminating signal when extracted from matter/source_id
+_COMMON_WORDS = frozenset({
+    "2024", "2025", "2026", "2027",
+    "meeting", "email", "slack", "call", "chat",
+    "the", "and", "for", "with", "from", "into", "onto",
+    "a", "an", "of", "in", "on", "at", "by", "to",
+    "review", "update", "notes", "summary", "discussion",
+})
+_MIN_KEYWORD_LEN = 3
+
+
+# ─── YAML Parser ──────────────────────────────────────────────────────────────
+# Reuse the same minimal parser pattern from disclosure_boundaries.py.
+# Try to import it; fall back to a local copy so there is no hard dependency.
+
+try:
+    from disclosure_boundaries import (
+        _parse_yaml,
+        load_profile as _load_profile_from_boundaries,
+        load_recent_provenance as _load_provenance_from_boundaries,
+    )
+    _have_boundaries_module = True
+except ImportError:
+    _have_boundaries_module = False
+
+
+def _parse_yaml(text: str) -> dict:
+    """Parse YAML text into a Python dict. PyYAML if available, else custom."""
+    try:
+        import yaml as _yaml
+        return _yaml.safe_load(text) or {}
+    except ImportError:
+        pass
+
+    lines = text.split("\n")
+    result, _ = _parse_block(lines, 0, 0)
+    return result if isinstance(result, dict) else {}
+
+
+def _next_content(lines, start):
+    i = start
+    while i < len(lines):
+        s = lines[i].lstrip()
+        if s and not s.startswith("#"):
+            return len(lines[i]) - len(lines[i].lstrip()), i
+        i += 1
+    return None, None
+
+
+def _parse_block(lines, start, base_indent):
+    result = {}
+    i = start
+    while i < len(lines):
+        raw = lines[i]
+        stripped = raw.lstrip()
+        if not stripped or stripped.startswith("#"):
+            i += 1
+            continue
+        indent = len(raw) - len(raw.lstrip())
+        if indent < base_indent and i > start:
+            break
+        if indent > base_indent and i > start:
+            break
+        if stripped.startswith("- "):
+            if not result:
+                lst, i = _parse_list(lines, i, indent)
+                return lst, i
+            break
+        if ":" in stripped and not stripped.startswith("-"):
+            colon_pos = stripped.index(":")
+            key = stripped[:colon_pos].strip()
+            rest = stripped[colon_pos + 1:].strip()
+            if rest.startswith("["):
+                result[key] = _parse_inline_list(rest)
+                i += 1
+                continue
+            if rest in (">", "|", ">-", "|-", ">+", "|+"):
+                value, i = _parse_block_scalar(lines, i + 1, indent)
+                result[key] = value
+                continue
+            if rest:
+                result[key] = _yaml_scalar(rest)
+                i += 1
+            else:
+                child_indent, child_idx = _next_content(lines, i + 1)
+                if child_indent is not None and child_indent > indent:
+                    child_stripped = lines[child_idx].lstrip()
+                    if child_stripped.startswith("- "):
+                        value, i = _parse_list(lines, child_idx, child_indent)
+                    elif child_stripped.startswith("["):
+                        value = _parse_inline_list(child_stripped)
+                        i = child_idx + 1
+                    else:
+                        value, i = _parse_block(lines, child_idx, child_indent)
+                    result[key] = value
+                else:
+                    result[key] = None
+                    i += 1
+        else:
+            i += 1
+    return result, i
+
+
+def _parse_list(lines, start, base_indent):
+    result = []
+    i = start
+    while i < len(lines):
+        raw = lines[i]
+        stripped = raw.lstrip()
+        if not stripped or stripped.startswith("#"):
+            i += 1
+            continue
+        indent = len(raw) - len(raw.lstrip())
+        if indent < base_indent:
+            break
+        if indent > base_indent:
+            break
+        if not stripped.startswith("- "):
+            break
+        item_content = stripped[2:].strip()
+        if item_content.startswith("["):
+            result.append(_parse_inline_list(item_content))
+            i += 1
+            continue
+        if item_content in (">", "|", ">-", "|-", ">+", "|+"):
+            value, i = _parse_block_scalar(lines, i + 1, indent)
+            result.append(value)
+            continue
+        if ":" in item_content and not item_content.startswith('"') and not item_content.startswith("'"):
+            colon_pos = item_content.index(":")
+            k = item_content[:colon_pos].strip()
+            v = item_content[colon_pos + 1:].strip()
+            item_dict = {k: _parse_inline_list(v) if v.startswith("[") else (_yaml_scalar(v) if v else None)}
+            child_indent, child_idx = _next_content(lines, i + 1)
+            if child_indent is not None and child_indent > indent:
+                child_stripped = lines[child_idx].lstrip()
+                if child_stripped.startswith("- "):
+                    i += 1
+                else:
+                    extra, i = _parse_block(lines, child_idx, child_indent)
+                    if isinstance(extra, dict):
+                        item_dict.update(extra)
+            else:
+                i += 1
+            result.append(item_dict)
+        else:
+            result.append(_yaml_scalar(item_content))
+            i += 1
+    return result, i
+
+
+def _parse_block_scalar(lines, start, owner_indent):
+    parts = []
+    i = start
+    while i < len(lines):
+        raw = lines[i]
+        stripped = raw.lstrip()
+        if not stripped:
+            i += 1
+            continue
+        indent = len(raw) - len(raw.lstrip())
+        if indent <= owner_indent:
+            break
+        parts.append(stripped)
+        i += 1
+    return " ".join(parts), i
+
+
+def _parse_inline_list(text: str):
+    text = text.strip()
+    if not (text.startswith("[") and text.endswith("]")):
+        return [_yaml_scalar(text)] if text else []
+    inner = text[1:-1].strip()
+    if not inner:
+        return []
+    items = []
+    current = ""
+    in_quote = None
+    for ch in inner:
+        if ch in ('"', "'") and in_quote is None:
+            in_quote = ch
+        elif ch == in_quote:
+            in_quote = None
+        elif ch == "," and in_quote is None:
+            items.append(_yaml_scalar(current.strip()))
+            current = ""
+            continue
+        current += ch
+    if current.strip():
+        items.append(_yaml_scalar(current.strip()))
+    return items
+
+
+def _yaml_scalar(text: str):
+    if text is None:
+        return None
+    text = text.strip()
+    if not text:
+        return None
+    if (text.startswith('"') and text.endswith('"')) or \
+       (text.startswith("'") and text.endswith("'")):
+        return text[1:-1]
+    for sep in ("  #", "\t#"):
+        if sep in text:
+            text = text[:text.index(sep)].strip()
+    if text.lower() in ("true", "yes"):
+        return True
+    if text.lower() in ("false", "no"):
+        return False
+    if text.lower() in ("null", "~"):
+        return None
+    try:
+        return int(text)
+    except ValueError:
+        pass
+    try:
+        return float(text)
+    except ValueError:
+        pass
+    return text
+
+
+# ─── Profile Loading ──────────────────────────────────────────────────────────
+
+def _load_profile(slug: str) -> dict | None:
+    """Load a user profile YAML. Returns None if not found."""
+    path = USER_PROFILES_DIR / f"{slug}.yaml"
+    if not path.exists():
+        return None
+    return _parse_yaml(path.read_text(encoding="utf-8"))
+
+
+def _load_channel_members(channel: str) -> list[str]:
+    """Resolve channel slug/id → member slug list.
+
+    Accepts a Slack channel ID (C...) or a profile name slug.
+    Returns list of member slugs, empty list if channel not found.
+    """
+    if not channel:
+        return []
+
+    # Search all channel profile files
+    for profile_path in CHANNEL_PROFILES_DIR.glob("*.yaml"):
+        try:
+            data = _parse_yaml(profile_path.read_text(encoding="utf-8"))
+        except Exception:
+            continue
+        slack_id = str(data.get("slack_id") or "")
+        name = str(data.get("name") or profile_path.stem)
+        if channel in (slack_id, name, profile_path.stem):
+            members = data.get("members") or []
+            return [str(m) for m in members if m]
+
+    return []
+
+
+def _load_provenance_recent(hours: int = 48) -> list[dict]:
+    """Load provenance records from the last *hours* hours."""
+    if not PROVENANCE_INDEX.exists():
+        return []
+
+    cutoff = datetime.now(tz=timezone.utc) - timedelta(hours=hours)
+    records = []
+
+    with PROVENANCE_INDEX.open(encoding="utf-8") as fh:
+        for line in fh:
+            line = line.strip()
+            if not line:
+                continue
+            try:
+                rec = json.loads(line)
+            except json.JSONDecodeError:
+                continue
+
+            ts_raw = rec.get("timestamp", "")
+            try:
+                ts_str = ts_raw.replace("Z", "+00:00")
+                ts = datetime.fromisoformat(ts_str)
+                if ts.tzinfo is None:
+                    ts = ts.replace(tzinfo=timezone.utc)
+            except (ValueError, AttributeError):
+                records.append(rec)
+                continue
+
+            if ts >= cutoff:
+                records.append(rec)
+
+    return records
+
+
+def _log_assessment(
+    *,
+    message_id: str,
+    channel: str | None,
+    recipients: list[str],
+    restricted_recipients: list[str],
+    references_assessed: list[dict],
+    outcome: str,
+    severity: str | None,
+    action: str,
+    draft_hash: str,
+    assessment_duration_ms: float,
+) -> None:
+    """Append one line to the dated disclosure-assessments audit log."""
+    AUDIT_LOG_DIR.mkdir(parents=True, exist_ok=True)
+    date_str = datetime.now(tz=timezone.utc).strftime("%Y-%m-%d")
+    log_path = AUDIT_LOG_DIR / f"{date_str}-disclosure-assessments.jsonl"
+
+    record = {
+        "timestamp": datetime.now(tz=timezone.utc).isoformat(),
+        "message_id": message_id,
+        "channel": channel,
+        "recipients": recipients,
+        "restricted_recipients": restricted_recipients,
+        "references_assessed": references_assessed,
+        "outcome": outcome,
+        "severity": severity,
+        "action": action,
+        "draft_hash": draft_hash,
+        "assessment_duration_ms": round(assessment_duration_ms, 2),
+    }
+
+    with log_path.open("a", encoding="utf-8") as fh:
+        fh.write(json.dumps(record) + "\n")
+
+
+# ─── Reference Extraction ─────────────────────────────────────────────────────
+
+def _extract_keywords(text: str) -> set[str]:
+    """Extract discriminating keywords from a provenance matter/source_id."""
+    if not text:
+        return set()
+    # Split on hyphens, underscores, slashes, and whitespace
+    parts = [p.strip().lower() for p in __import__("re").split(r"[-_/\s]+", text)]
+    return {
+        p for p in parts
+        if p and len(p) >= _MIN_KEYWORD_LEN and p not in _COMMON_WORDS
+    }
+
+
+def _extract_matter_references(draft: str, provenance_records: list[dict]) -> list[dict]:
+    """Find provenance records whose keywords appear in the draft text.
+
+    Returns a list of match dicts:
+      {
+        "record": <provenance record dict>,
+        "matched_keywords": [str, ...],
+        "match_confidence": "high" | "medium",
+      }
+    """
+    if not draft.strip():
+        return []
+
+    draft_lower = draft.lower()
+    matches = []
+
+    for rec in provenance_records:
+        matter = str(rec.get("matter") or "")
+        source_id = str(rec.get("source_id") or "")
+
+        keywords = _extract_keywords(matter) | _extract_keywords(source_id)
+        if not keywords:
+            continue
+
+        matched = [kw for kw in keywords if kw in draft_lower]
+        if not matched:
+            continue
+
+        confidence = "high" if len(matched) >= 2 else "medium"
+        matches.append({
+            "record": rec,
+            "matched_keywords": matched,
+            "match_confidence": confidence,
+        })
+
+    return matches
+
+
+# ─── Per-Reference Assessment ─────────────────────────────────────────────────
+
+def _assess_reference(
+    ref_match: dict,
+    recipient_slug: str,
+    boundaries: dict,
+) -> dict:
+    """Assess a single matched provenance reference against a recipient's boundaries.
+
+    Returns:
+      {
+        "source_id": str,
+        "matter": str,
+        "match_confidence": str,
+        "matched_keywords": list,
+        "checks": [{"check": str, "result": str, "severity": str | None, "reason": str}],
+        "highest_severity": str | None,
+      }
+    """
+    rec = ref_match["record"]
+    match_confidence = ref_match["match_confidence"]
+    matched_keywords = ref_match["matched_keywords"]
+
+    source_id = str(rec.get("source_id") or "unknown")
+    matter = str(rec.get("matter") or "")
+    sensitivity_signals = [str(s).lower() for s in (rec.get("sensitivity_signals") or [])]
+    participants = [str(p).lower() for p in (rec.get("participants") or [])]
+    context_domain = str(rec.get("context_domain") or "").lower()
+
+    conflicts = boundaries.get("conflicts") or []
+    excluded_domains = [str(d).lower() for d in (boundaries.get("excluded_domains") or [])]
+
+    # Build conflict matter set
+    conflict_matters = set()
+    for c in conflicts:
+        if isinstance(c, dict):
+            m = c.get("matter")
+            if m:
+                conflict_matters.add(str(m).lower())
+        elif isinstance(c, str):
+            conflict_matters.add(c.lower())
+
+    recipient_lower = recipient_slug.lower()
+    checks = []
+    highest_severity = None
+
+    # ── 1. Privilege check ──────────────────────────────────────────────────
+    has_privilege = any(s in ("legal_privilege", "negotiation_position") for s in sensitivity_signals)
+    if has_privilege:
+        priv_signals = [s for s in sensitivity_signals if s in ("legal_privilege", "negotiation_position")]
+        checks.append({
+            "check": "privilege",
+            "result": "FAIL",
+            "severity": "critical",
+            "reason": f"Provenance carries privileged sensitivity signals: {', '.join(priv_signals)}",
+        })
+        highest_severity = _escalate_severity(highest_severity, "critical")
+    else:
+        checks.append({
+            "check": "privilege",
+            "result": "PASS",
+            "severity": None,
+            "reason": "No privilege signals detected",
+        })
+
+    # ── 2. Conflict check ───────────────────────────────────────────────────
+    matter_lower = matter.lower()
+    is_conflict_matter = bool(matter_lower and matter_lower in conflict_matters)
+    if is_conflict_matter:
+        # Critical if also has privilege, otherwise high
+        conflict_sev = "critical" if has_privilege else "high"
+        # Find nature note
+        nature = ""
+        for c in conflicts:
+            if isinstance(c, dict) and str(c.get("matter", "")).lower() == matter_lower:
+                nature = c.get("nature", "")
+                break
+        checks.append({
+            "check": "conflict",
+            "result": "FAIL",
+            "severity": conflict_sev,
+            "reason": f"Matter '{matter}' is a declared conflict for this recipient"
+            + (f" — {nature}" if nature else ""),
+        })
+        highest_severity = _escalate_severity(highest_severity, conflict_sev)
+    else:
+        checks.append({
+            "check": "conflict",
+            "result": "PASS",
+            "severity": None,
+            "reason": "No declared conflict on this matter",
+        })
+
+    # ── 3. Participant check ────────────────────────────────────────────────
+    is_participant = recipient_lower in participants
+    if is_participant:
+        checks.append({
+            "check": "participant",
+            "result": "PASS",
+            "severity": None,
+            "reason": f"Recipient is listed as a participant in this provenance record",
+        })
+        # Participant check passing does NOT affect highest_severity
+    else:
+        checks.append({
+            "check": "participant",
+            "result": "FAIL",
+            "severity": "medium",
+            "reason": f"Recipient '{recipient_slug}' is not a participant in provenance record '{source_id}'",
+        })
+        highest_severity = _escalate_severity(highest_severity, "medium")
+
+    # ── 4. Domain check ─────────────────────────────────────────────────────
+    domain_excluded = bool(context_domain and context_domain in excluded_domains)
+    if domain_excluded:
+        # High if also not a participant, medium if alone
+        domain_sev = "high" if not is_participant else "medium"
+        checks.append({
+            "check": "domain",
+            "result": "FAIL",
+            "severity": domain_sev,
+            "reason": f"Context domain '{context_domain}' is in recipient's excluded domains",
+        })
+        highest_severity = _escalate_severity(highest_severity, domain_sev)
+    else:
+        checks.append({
+            "check": "domain",
+            "result": "PASS",
+            "severity": None,
+            "reason": "Context domain not in excluded domains"
+            if context_domain
+            else "No context domain on provenance record",
+        })
+
+    # ── 5. Necessity check (contextual — LLM layer) ─────────────────────────
+    checks.append({
+        "check": "necessity",
+        "result": "REVIEW",
+        "severity": None,
+        "reason": "Contextual necessity judgment deferred to LLM layer",
+    })
+
+    # ── Low confidence escalation ───────────────────────────────────────────
+    if match_confidence == "medium" and highest_severity is not None:
+        before = highest_severity
+        escalated = _escalate_one_level(highest_severity)
+        highest_severity = escalated
+        # Annotate in checks
+        checks.append({
+            "check": "confidence_escalation",
+            "result": "ESCALATED",
+            "severity": escalated,
+            "reason": f"Match confidence is 'medium' — severity escalated from '{before}' to '{escalated}'",
+        })
+
+    return {
+        "source_id": source_id,
+        "matter": matter,
+        "match_confidence": match_confidence,
+        "matched_keywords": matched_keywords,
+        "checks": checks,
+        "highest_severity": highest_severity,
+    }
+
+
+def _escalate_severity(current: str | None, candidate: str) -> str:
+    """Return whichever severity is higher."""
+    if current is None:
+        return candidate
+    return candidate if SEVERITY_ORDER.get(candidate, -1) > SEVERITY_ORDER.get(current, -1) else current
+
+
+def _escalate_one_level(severity: str) -> str:
+    """Escalate a severity by one step (low→medium, medium→high, high→critical)."""
+    order = ["low", "medium", "high", "critical"]
+    idx = order.index(severity) if severity in order else -1
+    if idx < 0 or idx >= len(order) - 1:
+        return severity
+    return order[idx + 1]
+
+
+def _severity_to_outcome(severity: str | None) -> str:
+    """Map highest severity to overall outcome."""
+    if severity is None:
+        return "passed"
+    level = SEVERITY_ORDER.get(severity, -1)
+    if level >= SEVERITY_ORDER["high"]:
+        return "blocked"
+    if level == SEVERITY_ORDER["medium"]:
+        return "stripped"
+    return "passed"
+
+
+# ─── Main Assessment ──────────────────────────────────────────────────────────
+
+def assess_disclosure(
+    draft: str,
+    recipient_slug: str,
+    channel: str | None = None,
+    message_id: str | None = None,
+) -> dict:
+    """Assess a draft message against recipient disclosure boundaries.
+
+    Args:
+        draft:          Full text of the draft message.
+        recipient_slug: Slug of the primary recipient (e.g. 'casey-morgan').
+        channel:        Optional Slack channel slug or ID.  When provided the
+                        channel's full member list is resolved and each restricted
+                        member is assessed independently.  The most restrictive
+                        outcome wins.
+        message_id:     Optional caller-supplied message identifier.  Auto-
+                        generated (UUID4) if not provided.
+
+    Returns a dict with keys:
+        outcome                "passed" | "stripped" | "blocked"
+        severity               None | "low" | "medium" | "high" | "critical"
+        action                 str describing the recommended action
+        references_assessed    list of per-reference assessment dicts
+        assessment_duration_ms float
+    """
+    t_start = time.monotonic()
+
+    if message_id is None:
+        message_id = str(uuid.uuid4())
+
+    # ── Determine full recipient list ────────────────────────────────────────
+    all_recipients: list[str] = [recipient_slug]
+    if channel:
+        members = _load_channel_members(channel)
+        for m in members:
+            if m not in all_recipients:
+                all_recipients.append(m)
+
+    # ── Separate unrestricted vs restricted recipients ───────────────────────
+    restricted_recipients: list[str] = []
+    unprofiled_recipients: list[str] = []
+
+    for slug in all_recipients:
+        profile = _load_profile(slug)
+        if profile is None:
+            unprofiled_recipients.append(slug)
+            restricted_recipients.append(slug)
+            print(
+                f"[disclosure_assessment] WARNING: No profile for recipient '{slug}' "
+                "— treating as maximally restricted.",
+                file=sys.stderr,
+            )
+            continue
+
+        boundaries = profile.get("information_boundaries") or {}
+        domains_of_interest = boundaries.get("domains_of_interest") or []
+
+        # Unrestricted: ["*"]
+        if domains_of_interest == ["*"]:
+            continue
+
+        restricted_recipients.append(slug)
+
+    # ── Short-circuit: no restricted recipients ──────────────────────────────
+    if not restricted_recipients:
+        duration_ms = (time.monotonic() - t_start) * 1000
+        _log_assessment(
+            message_id=message_id,
+            channel=channel,
+            recipients=all_recipients,
+            restricted_recipients=[],
+            references_assessed=[],
+            outcome="passed",
+            severity=None,
+            action="no_restricted_recipients",
+            draft_hash=hashlib.sha256(draft.encode()).hexdigest()[:16],
+            assessment_duration_ms=duration_ms,
+        )
+        return {
+            "outcome": "passed",
+            "severity": None,
+            "action": "no_restricted_recipients",
+            "references_assessed": [],
+            "assessment_duration_ms": round(duration_ms, 2),
+        }
+
+    # ── Short-circuit: empty draft ───────────────────────────────────────────
+    if not draft.strip():
+        duration_ms = (time.monotonic() - t_start) * 1000
+        _log_assessment(
+            message_id=message_id,
+            channel=channel,
+            recipients=all_recipients,
+            restricted_recipients=restricted_recipients,
+            references_assessed=[],
+            outcome="passed",
+            severity=None,
+            action="empty_draft",
+            draft_hash="",
+            assessment_duration_ms=duration_ms,
+        )
+        return {
+            "outcome": "passed",
+            "severity": None,
+            "action": "empty_draft",
+            "references_assessed": [],
+            "assessment_duration_ms": round(duration_ms, 2),
+        }
+
+    # ── Load provenance records ──────────────────────────────────────────────
+    provenance_records = _load_provenance_recent(hours=48)
+
+    # ── Extract draft references against provenance ──────────────────────────
+    ref_matches = _extract_matter_references(draft, provenance_records)
+
+    # ── Assess each reference against each restricted recipient ──────────────
+    all_ref_assessments: list[dict] = []
+    overall_severity: str | None = None
+
+    for ref_match in ref_matches:
+        # Per-recipient assessments for this reference
+        per_recipient: list[dict] = []
+
+        for slug in restricted_recipients:
+            if slug in unprofiled_recipients:
+                # Maximally restricted — any provenance match → block
+                per_recipient.append({
+                    "recipient": slug,
+                    "highest_severity": "critical",
+                    "checks": [{
+                        "check": "unprofiled_recipient",
+                        "result": "FAIL",
+                        "severity": "critical",
+                        "reason": f"No profile exists for recipient '{slug}' — maximally restricted",
+                    }],
+                })
+                overall_severity = _escalate_severity(overall_severity, "critical")
+                continue
+
+            profile = _load_profile(slug)
+            boundaries = (profile or {}).get("information_boundaries") or {}
+            ref_result = _assess_reference(ref_match, slug, boundaries)
+            ref_result["recipient"] = slug
+            per_recipient.append(ref_result)
+
+            if ref_result["highest_severity"] is not None:
+                overall_severity = _escalate_severity(overall_severity, ref_result["highest_severity"])
+
+        # Collapse per-recipient into a single reference assessment entry
+        combined_severity = None
+        for pr in per_recipient:
+            sev = pr.get("highest_severity")
+            if sev is not None:
+                combined_severity = _escalate_severity(combined_severity, sev)
+
+        all_ref_assessments.append({
+            "source_id": ref_match["record"].get("source_id", "unknown"),
+            "matter": ref_match["record"].get("matter", ""),
+            "match_confidence": ref_match["match_confidence"],
+            "matched_keywords": ref_match["matched_keywords"],
+            "per_recipient": per_recipient,
+            "combined_severity": combined_severity,
+        })
+
+    # ── Determine final outcome ──────────────────────────────────────────────
+    outcome = _severity_to_outcome(overall_severity)
+    action = SEVERITY_ACTIONS.get(overall_severity, "send") if overall_severity else "send"
+
+    duration_ms = (time.monotonic() - t_start) * 1000
+
+    # ── Audit log ────────────────────────────────────────────────────────────
+    draft_hash = hashlib.sha256(draft.encode()).hexdigest()[:16]
+    _log_assessment(
+        message_id=message_id,
+        channel=channel,
+        recipients=all_recipients,
+        restricted_recipients=restricted_recipients,
+        references_assessed=all_ref_assessments,
+        outcome=outcome,
+        severity=overall_severity,
+        action=action,
+        draft_hash=draft_hash,
+        assessment_duration_ms=duration_ms,
+    )
+
+    return {
+        "outcome": outcome,
+        "severity": overall_severity,
+        "action": action,
+        "references_assessed": all_ref_assessments,
+        "assessment_duration_ms": round(duration_ms, 2),
+    }
+
+
+# ─── CLI ─────────────────────────────────────────────────────────────────────
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Post-draft disclosure assessment engine (Layer 2).",
+    )
+    parser.add_argument(
+        "--recipient",
+        required=True,
+        help="Recipient slug (e.g. casey-morgan)",
+    )
+    parser.add_argument(
+        "--channel",
+        default=None,
+        help="Optional Slack channel slug or ID to resolve full member list",
+    )
+    parser.add_argument(
+        "--message",
+        default=None,
+        help="Draft message text (reads from stdin if not provided)",
+    )
+    parser.add_argument(
+        "--message-id",
+        default=None,
+        dest="message_id",
+        help="Optional message ID for audit tracing",
+    )
+    args = parser.parse_args()
+
+    # Read draft
+    if args.message is not None:
+        draft = args.message
+    else:
+        draft = sys.stdin.read()
+
+    result = assess_disclosure(
+        draft=draft,
+        recipient_slug=args.recipient,
+        channel=args.channel,
+        message_id=args.message_id,
+    )
+
+    print(json.dumps(result, indent=2))
+
+    outcome = result.get("outcome", "passed")
+    if outcome == "blocked":
+        sys.exit(2)
+    elif outcome == "stripped":
+        sys.exit(1)
+    else:
+        sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()