@cohortapp/agent-sdk 2.3.0

package/scripts/validate_outbound.py

@@ -0,0 +1,1504 @@
+#!/usr/bin/env python3
+"""Pre-send outbound correspondence validator.
+
+Checks outbound messages for:
+  1. Relationship claims — "our project manager" must match confirmed status
+  2. Title/role accuracy — titles must match org chart / profiles
+  3. AI self-disclosure — the agent must never reveal it is AI
+  4. In-person meeting self-scheduling — the agent must not attend physical meetings
+  5. Unverified commitment claims — flag strong commitment language
+
+Usage:
+  echo "message body" | python3 validate-outbound.py --type email --recipient graham@kpm.com
+  python3 validate-outbound.py --message "message body" --type slack --recipient C099ABCDEF
+
+Exit codes:
+  0 = clean (no blocking issues)
+  1 = issues found (at least one "block" severity issue)
+
+Outputs JSON to stdout:
+  {"status": "clean"|"issues_found", "issues": [...], "metadata": {...}}
+
+Performance target: < 1 second (no API calls — file reads only).
+
+Created: 2026-04-03 — triggered by ib-20260403-008 (Graham/KPM incident)
+"""
+import argparse
+import json
+import os
+import re
+import sys
+import time
+from datetime import datetime, timezone
+from pathlib import Path
+
+# Import disclosure assessment module (Information Barrier Layer 2)
+_da_module = None
+try:
+    import importlib.util as _da_ilu
+    _da_path = Path(__file__).resolve().parent / "disclosure_assessment.py"
+    if _da_path.exists():
+        _da_spec = _da_ilu.spec_from_file_location("disclosure_assessment", str(_da_path))
+        _da_mod = _da_ilu.module_from_spec(_da_spec)
+        _da_spec.loader.exec_module(_da_mod)
+        _da_module = _da_mod
+except Exception:
+    pass
+
+# Resolve paths relative to the repo root
+SCRIPT_DIR = Path(__file__).resolve().parent
+REPO_ROOT = Path(os.environ.get("AGENT_DIR", SCRIPT_DIR.parent))
+
+# Load agent identity (canonical SOT) so validation patterns can be
+# parameterised by the running agent's first name.
+try:
+    with open(REPO_ROOT / "config" / "agent.json") as _f:
+        _AGENT = json.load(_f)
+except Exception:
+    _AGENT = {"firstName": "Agent", "fullName": "Agent"}
+AGENT_FIRST_NAME = _AGENT.get("firstName", "Agent")
+
+# Data source paths
+CONTACTS_PATH = REPO_ROOT / "config" / "contacts.yaml"
+ORG_CHART_PATH = REPO_ROOT / "knowledge" / "entities" / "org-chart.md"
+USER_PROFILES_DIR = REPO_ROOT / "memory" / "profiles" / "users"
+VALIDATION_RULES_PATH = REPO_ROOT / "config" / "validation-rules.yaml"
+ENTITY_INDEX_PATH = REPO_ROOT / "memory" / "indexes" / "entity-relationships.yaml"
+AUDIT_LOG_DIR = REPO_ROOT / "logs" / "audit"
+
+
+# ─────────────────────────────────────────────
+# Nested YAML parser (handles maps, lists, and scalar values)
+# Replaces the original flat key-value parser that missed nested fields
+# like relationship.type and relationship.status (Graham incident, G4)
+# ─────────────────────────────────────────────
+def _parse_yaml_simple(text):
+    """Parse YAML text into nested dicts/lists.
+
+    Handles:
+      - Nested mappings (indented key: value blocks)
+      - Lists (- item and - key: value)
+      - Quoted and unquoted scalar values
+      - Comments and blank lines
+
+    Returns a dict (possibly nested). Flat profiles still work —
+    a flat file returns a flat dict, same as before.
+    """
+    try:
+        import yaml as _yaml
+        return _yaml.safe_load(text) or {}
+    except ImportError:
+        pass
+
+    lines = text.split('\n')
+    return _parse_yaml_block(lines, 0, 0)[0]
+
+
+def _parse_yaml_block(lines, start, base_indent):
+    """Recursively parse a YAML block starting at *start* with *base_indent*.
+
+    Returns (parsed_dict, next_line_index).
+    """
+    result = {}
+    i = start
+    while i < len(lines):
+        raw = lines[i]
+
+        # Skip blank lines and comments
+        stripped = raw.lstrip()
+        if not stripped or stripped.startswith('#'):
+            i += 1
+            continue
+
+        # Measure indentation
+        indent = len(raw) - len(raw.lstrip())
+
+        # If we've dedented past our block, stop
+        if indent < base_indent and i > start:
+            break
+
+        # Skip lines that are deeper than expected (handled recursively)
+        if indent > base_indent and i > start:
+            break
+
+        # ── List item ────────────────────────────────
+        if stripped.startswith('- '):
+            # We encountered a list where we expected a mapping value.
+            # Parse the full list and return it as a special case —
+            # caller will assign it as the value.
+            lst, i = _parse_yaml_list(lines, i, indent)
+            # If this list appears at the top level inside a mapping block,
+            # we shouldn't be here — this branch is for when a key's value
+            # is a list. Return what we have so far and let the caller handle it.
+            if not result:
+                return lst, i
+            break
+
+        # ── Mapping entry (key: ...) ─────────────────
+        if ':' in stripped and not stripped.startswith('-'):
+            key, _, rest = stripped.partition(':')
+            key = key.strip()
+            rest = rest.strip()
+
+            if rest:
+                # Inline value — scalar
+                result[key] = _yaml_scalar(rest)
+                i += 1
+            else:
+                # Block value — could be nested map or list
+                # Peek at next meaningful line to determine child indent
+                child_indent, child_idx = _next_content_line(lines, i + 1)
+                if child_indent is not None and child_indent > indent:
+                    # Check if child is a list
+                    child_stripped = lines[child_idx].lstrip()
+                    if child_stripped.startswith('- '):
+                        value, i = _parse_yaml_list(lines, child_idx, child_indent)
+                    else:
+                        value, i = _parse_yaml_block(lines, child_idx, child_indent)
+                    result[key] = value
+                else:
+                    # Empty value
+                    result[key] = None
+                    i += 1
+        else:
+            i += 1
+
+    return result, i
+
+
+def _parse_yaml_list(lines, start, base_indent):
+    """Parse a YAML list starting at *start*.
+
+    Returns (list, next_line_index).
+    """
+    result = []
+    i = start
+    while i < len(lines):
+        raw = lines[i]
+        stripped = raw.lstrip()
+        if not stripped or stripped.startswith('#'):
+            i += 1
+            continue
+
+        indent = len(raw) - len(raw.lstrip())
+        if indent < base_indent:
+            break
+        if indent > base_indent:
+            # Continuation of previous list item (nested block)
+            # This is handled inside the item parsing below
+            break
+
+        if not stripped.startswith('- '):
+            break
+
+        item_content = stripped[2:].strip()
+
+        if ':' in item_content and not item_content.startswith('"') and not item_content.startswith("'"):
+            # Mapping-style list item: - key: value [possibly with more keys below]
+            k, _, v = item_content.partition(':')
+            k = k.strip()
+            v = v.strip()
+            item_dict = {k: _yaml_scalar(v) if v else None}
+
+            # Check for continuation keys at deeper indent
+            child_indent, child_idx = _next_content_line(lines, i + 1)
+            if child_indent is not None and child_indent > indent:
+                extra, i = _parse_yaml_block(lines, child_idx, child_indent)
+                if isinstance(extra, dict):
+                    item_dict.update(extra)
+                else:
+                    i = i  # no change
+            else:
+                i += 1
+
+            result.append(item_dict)
+        else:
+            # Simple scalar list item
+            result.append(_yaml_scalar(item_content))
+            i += 1
+
+    return result, i
+
+
+def _next_content_line(lines, start):
+    """Find the next non-blank, non-comment line from *start*.
+
+    Returns (indent, index) or (None, None).
+    """
+    i = start
+    while i < len(lines):
+        stripped = lines[i].lstrip()
+        if stripped and not stripped.startswith('#'):
+            indent = len(lines[i]) - len(lines[i].lstrip())
+            return indent, i
+        i += 1
+    return None, None
+
+
+def _yaml_scalar(text):
+    """Convert a YAML scalar string to an appropriate Python type."""
+    if not text:
+        return None
+    # Remove surrounding quotes
+    if (text.startswith('"') and text.endswith('"')) or \
+       (text.startswith("'") and text.endswith("'")):
+        return text[1:-1]
+    # Remove inline comments
+    if '  #' in text:
+        text = text[:text.index('  #')].strip()
+    elif '\t#' in text:
+        text = text[:text.index('\t#')].strip()
+    # Boolean
+    if text.lower() in ('true', 'yes'):
+        return True
+    if text.lower() in ('false', 'no'):
+        return False
+    # Null
+    if text.lower() in ('null', '~', ''):
+        return None
+    # Numeric
+    try:
+        return int(text)
+    except ValueError:
+        pass
+    try:
+        return float(text)
+    except ValueError:
+        pass
+    # Strip quotes that may remain
+    return text.strip('"').strip("'")
+
+
+def _nested_get(data, *keys):
+    """Safely traverse nested dicts. Returns None if any key is missing."""
+    current = data
+    for key in keys:
+        if isinstance(current, dict):
+            current = current.get(key)
+        else:
+            return None
+    return current
+
+
+# ─────────────────────────────────────────────
+# Data Loading — cached per process
+# ─────────────────────────────────────────────
+_contacts_cache = None
+_profiles_cache = None
+_org_titles_cache = None
+_entity_index_cache = None
+
+
+def load_entity_index():
+    """Load entity-relationships.yaml as the primary entity/relationship index.
+
+    Returns dict with keys:
+      - 'entities': list of entity dicts (people, companies)
+      - 'relationships': list of relationship dicts
+      - 'by_name': dict mapping lowercase name/alias -> entity dict
+      - 'rels_by_subject': dict mapping entity id -> list of relationship dicts
+
+    Gracefully returns empty structure if file is missing or malformed.
+    """
+    global _entity_index_cache
+    if _entity_index_cache is not None:
+        return _entity_index_cache
+
+    empty = {'entities': [], 'relationships': [], 'by_name': {}, 'rels_by_subject': {}}
+
+    if not ENTITY_INDEX_PATH.exists():
+        _entity_index_cache = empty
+        return _entity_index_cache
+
+    try:
+        text = ENTITY_INDEX_PATH.read_text(encoding='utf-8')
+        data = _parse_yaml_simple(text)
+
+        if not isinstance(data, dict):
+            _entity_index_cache = empty
+            return _entity_index_cache
+
+        entities = data.get('entities', []) or []
+        relationships = data.get('relationships', []) or []
+
+        # Build name lookup: lowercase name/alias -> entity dict
+        by_name = {}
+        for entity in entities:
+            if not isinstance(entity, dict):
+                continue
+            # Index by full name
+            name = entity.get('name', '')
+            if name and isinstance(name, str):
+                by_name[name.lower()] = entity
+                # Index by first name + last name (short form)
+                parts = name.split()
+                if len(parts) >= 2:
+                    short = f"{parts[0]} {parts[-1]}"
+                    by_name[short.lower()] = entity
+                # Index by first name alone (for single-name lookups)
+                if len(parts) >= 1:
+                    first = parts[0].lower()
+                    # Only index first name if it's not too common / ambiguous
+                    # We allow it but give full name priority in lookup_entity
+                    if first not in by_name:
+                        by_name[first] = entity
+
+            # Index by aliases
+            aliases = entity.get('aliases', []) or []
+            if isinstance(aliases, list):
+                for alias in aliases:
+                    if alias and isinstance(alias, str):
+                        by_name[alias.lower()] = entity
+
+        # Build relationship lookup by subject
+        rels_by_subject = {}
+        for rel in relationships:
+            if not isinstance(rel, dict):
+                continue
+            subj = rel.get('subject', '')
+            if subj:
+                rels_by_subject.setdefault(subj, []).append(rel)
+
+        _entity_index_cache = {
+            'entities': entities,
+            'relationships': relationships,
+            'by_name': by_name,
+            'rels_by_subject': rels_by_subject,
+        }
+    except Exception:
+        _entity_index_cache = empty
+
+    return _entity_index_cache
+
+
+def lookup_entity(name, entity_index=None):
+    """Look up a person or company by name in the entity index.
+
+    Performs fuzzy matching: checks full name, first+last, first name, aliases.
+
+    Args:
+        name: The name to look up (case-insensitive)
+        entity_index: The loaded entity index (from load_entity_index).
+                      If None, loads it.
+
+    Returns:
+        dict with keys:
+          - 'entity': the entity dict (or None)
+          - 'relationships_to_northwind': list of relationship dicts describing
+            this entity's relationship to Northwind/its entities
+          - 'is_internal': bool — True if entity is employed by a Northwind entity
+          - 'relationship_type': str — summary classification
+            ('internal', 'vendor_candidate', 'external_vendor', 'external_advisor',
+             'investor', 'regulator', 'external', 'unknown')
+        Returns None if entity not found.
+    """
+    if entity_index is None:
+        entity_index = load_entity_index()
+
+    by_name = entity_index.get('by_name', {})
+    rels_by_subject = entity_index.get('rels_by_subject', {})
+
+    name_lower = name.lower().strip()
+    if not name_lower:
+        return None
+
+    # Try exact match first, then partial
+    entity = by_name.get(name_lower)
+
+    if entity is None:
+        # Try first+last combination from input
+        parts = name_lower.split()
+        if len(parts) >= 2:
+            short = f"{parts[0]} {parts[-1]}"
+            entity = by_name.get(short)
+        if entity is None and len(parts) == 1:
+            # Single name — try it (already indexed by first name above)
+            entity = by_name.get(parts[0])
+
+    if entity is None:
+        return None
+
+    entity_id = entity.get('id', '')
+
+    # Collect relationships where this entity is the subject
+    subject_rels = rels_by_subject.get(entity_id, [])
+
+    # Determine relationship to Northwind
+    northwind_ids = {
+        'company:northwind-group', 'company:northwind-holdings',
+        'company:northwind-am-difc', 'company:northwind-technologies',
+        'company:northwind-group-investments', 'company:northwind-investments',
+        'company:northwind-inc', 'company:northwind-ai-uk',
+        'company:northwind-am-uk', 'company:northwind-am-cayman',
+        'company:northwind-am-asia', 'company:northwind-asia',
+        'company:northwind-am-eu', 'company:northwind-am-us',
+        'company:northwind-am-ksa', 'company:northwind-ksa',
+    }
+
+    rels_to_northwind = []
+    is_internal = False
+    rel_type = 'unknown'
+
+    for rel in subject_rels:
+        obj = rel.get('object', '')
+        pred = rel.get('predicate', '')
+
+        if obj in northwind_ids or obj.startswith('company:northwind'):
+            rels_to_northwind.append(rel)
+
+            if pred in ('employed_by', 'directs'):
+                is_internal = True
+                rel_type = 'internal'
+            elif pred == 'vendor_candidate_for' and rel_type != 'internal':
+                rel_type = 'vendor_candidate'
+            elif pred == 'vendor_for' and rel_type not in ('internal', 'vendor_candidate'):
+                rel_type = 'external_vendor'
+            elif pred == 'advises' and rel_type not in ('internal', 'vendor_candidate', 'external_vendor'):
+                rel_type = 'external_advisor'
+            elif pred == 'invests_in' and rel_type not in ('internal',):
+                rel_type = 'investor'
+            elif pred == 'regulates' and rel_type not in ('internal',):
+                rel_type = 'regulator'
+
+    # Check if entity is employed by a non-Northwind company (external person)
+    if rel_type == 'unknown':
+        for rel in subject_rels:
+            pred = rel.get('predicate', '')
+            if pred == 'employed_by':
+                rel_type = 'external'
+                break
+
+    return {
+        'entity': entity,
+        'relationships_to_northwind': rels_to_northwind,
+        'is_internal': is_internal,
+        'relationship_type': rel_type,
+    }
+
+
+def load_contacts():
+    """Load confirmed contacts from config/contacts.yaml.
+
+    Returns dict: lowercase_name -> {role, classification, organisation}
+    """
+    global _contacts_cache
+    if _contacts_cache is not None:
+        return _contacts_cache
+
+    _contacts_cache = {}
+    if not CONTACTS_PATH.exists():
+        return _contacts_cache
+
+    text = CONTACTS_PATH.read_text(encoding='utf-8')
+
+    # Simple parser: extract contact blocks
+    current_contact = {}
+    for line in text.split('\n'):
+        stripped = line.strip()
+        if stripped.startswith('- name:'):
+            if current_contact.get('name'):
+                name_lower = current_contact['name'].lower()
+                _contacts_cache[name_lower] = current_contact
+            current_contact = {'name': stripped.split(':', 1)[1].strip()}
+        elif stripped.startswith('role:') and current_contact:
+            current_contact['role'] = stripped.split(':', 1)[1].strip()
+        elif stripped.startswith('classification:') and current_contact:
+            current_contact['classification'] = stripped.split(':', 1)[1].strip()
+        elif stripped.startswith('organisation:') and current_contact:
+            current_contact['organisation'] = stripped.split(':', 1)[1].strip()
+
+    if current_contact.get('name'):
+        name_lower = current_contact['name'].lower()
+        _contacts_cache[name_lower] = current_contact
+
+    return _contacts_cache
+
+
+def load_user_profiles():
+    """Load all user profiles from memory/profiles/users/*.yaml.
+
+    Returns dict: lowercase_name -> {name, title, company, relationship_type,
+                                      relationship_status, classification}
+    """
+    global _profiles_cache
+    if _profiles_cache is not None:
+        return _profiles_cache
+
+    _profiles_cache = {}
+    if not USER_PROFILES_DIR.exists():
+        return _profiles_cache
+
+    for yaml_file in USER_PROFILES_DIR.glob('*.yaml'):
+        try:
+            text = yaml_file.read_text(encoding='utf-8')
+            data = _parse_yaml_simple(text)
+
+            # Navigate nested structure — profiles may have top-level keys
+            # (flat) or nested sections like identity.name, relationship.type
+            identity = data.get('identity', {}) if isinstance(data.get('identity'), dict) else {}
+            relationship = data.get('relationship', {}) if isinstance(data.get('relationship'), dict) else {}
+
+            # Name: try identity.name, then top-level name, then filename
+            name = _nested_get(data, 'identity', 'name') or data.get('name', '')
+            if not name or not isinstance(name, str):
+                name = yaml_file.stem.replace('-', ' ').title()
+
+            # Title: identity.title or top-level
+            title = _nested_get(data, 'identity', 'title') or data.get('title', '')
+
+            # Company: identity.company or top-level
+            company = _nested_get(data, 'identity', 'company') or data.get('company', '')
+
+            # Relationship type: relationship.type, or flat relationship_to_northwind, or top-level type
+            rel_type = (
+                _nested_get(data, 'relationship', 'type')
+                or data.get('relationship_to_northwind', '')
+                or data.get('type', '')
+            )
+
+            # Relationship status: relationship.status, or flat relationship_status, or top-level status
+            rel_status = (
+                _nested_get(data, 'relationship', 'status')
+                or data.get('relationship_status', '')
+                or data.get('status', '')
+            )
+
+            # Relationship category (for richer matching)
+            rel_category = _nested_get(data, 'relationship', 'category') or data.get('category', '')
+
+            # Classification & privilege — may be top-level or nested
+            classification = data.get('classification', '')
+            privilege_level = data.get('privilege_level', '')
+
+            profile = {
+                'name': name if isinstance(name, str) else str(name),
+                'title': title if isinstance(title, str) else str(title) if title else '',
+                'company': company if isinstance(company, str) else str(company) if company else '',
+                'relationship_type': rel_type if isinstance(rel_type, str) else str(rel_type) if rel_type else '',
+                'relationship_status': rel_status if isinstance(rel_status, str) else str(rel_status) if rel_status else '',
+                'relationship_category': rel_category if isinstance(rel_category, str) else str(rel_category) if rel_category else '',
+                'classification': classification if isinstance(classification, str) else str(classification) if classification else '',
+                'privilege_level': privilege_level if isinstance(privilege_level, str) else str(privilege_level) if privilege_level else '',
+            }
+            _profiles_cache[name.lower()] = profile
+        except Exception:
+            continue
+
+    return _profiles_cache
+
+
+def load_org_titles():
+    """Load confirmed titles from knowledge/entities/org-chart.md.
+
+    Returns dict: lowercase_name -> confirmed_title
+    """
+    global _org_titles_cache
+    if _org_titles_cache is not None:
+        return _org_titles_cache
+
+    _org_titles_cache = {}
+    if not ORG_CHART_PATH.exists():
+        return _org_titles_cache
+
+    text = ORG_CHART_PATH.read_text(encoding='utf-8')
+
+    # Parse patterns like "### Name — Title" and "Name — Title" from tree
+    patterns = [
+        r'###\s+(.+?)\s+[—\-]+\s+(.+)',       # ### Alex Chen — CEO / Founder / UBO
+        r'[├└]\s*(.+?)\s+[—\-]+\s+(.+)',       # ├── Sam Rivera — CFO / CIO
+    ]
+    for pattern in patterns:
+        for match in re.finditer(pattern, text):
+            name = match.group(1).strip()
+            title = match.group(2).strip()
+            # Clean up name (remove markdown, extra chars)
+            name = re.sub(r'[\*\#]', '', name).strip()
+            # Remove full name suffixes for matching
+            first_last = name.split()
+            if len(first_last) >= 2:
+                short_name = f"{first_last[0]} {first_last[-1]}"
+                _org_titles_cache[short_name.lower()] = title
+            _org_titles_cache[name.lower()] = title
+
+    return _org_titles_cache
+
+
+# ─────────────────────────────────────────────
+# Validation Checks
+# ─────────────────────────────────────────────
+
+def check_relationship_claims(message):
+    """Check for unverified relationship/affiliation claims.
+
+    Uses entity-relationships.yaml as PRIMARY lookup source.
+    Falls back to user profiles if entity not found in the index.
+
+    Returns list of issue dicts.
+    """
+    issues = []
+    contacts = load_contacts()
+    profiles = load_user_profiles()
+    entity_index = load_entity_index()
+    message_lower = message.lower()
+
+    # Confirmed statuses — people with these can be called "our X" (profile fallback)
+    confirmed_statuses = {
+        'confirmed', 'confirmed_employee', 'confirmed_contractor', 'internal',
+        'confirmed_advisor', 'confirmed_partner',
+    }
+    confirmed_classifications = {
+        'internal-ceo', 'internal-executive', 'internal-team',
+    }
+
+    # Entity index relationship types that permit possessive claims ("our X")
+    entity_internal_types = {'internal'}
+
+    # Entity index relationship types that BLOCK possessive claims
+    entity_external_types = {
+        'vendor_candidate', 'external_vendor', 'external_advisor',
+        'investor', 'regulator', 'external', 'unknown',
+    }
+
+    # Relationship claim patterns
+    claim_patterns = [
+        (r'\b(our|my|the company\'s|Northwind\'s|the team\'s)\s+'
+         r'(project manager|PM|consultant|advisor|counsel|lawyer|developer|'
+         r'engineer|designer|analyst|hire|employee|team member|colleague|'
+         r'staff member|contractor|associate|partner|director|officer|'
+         r'head of\s+\w+|lead\s*\w*|manager|VP|chief\s+\w+)',
+         "Possessive role claim"),
+        (r'\bwe\'ve\s+(hired|appointed|engaged|retained|onboarded|brought on|contracted)\s+',
+         "Hiring/engagement claim"),
+        (r'\b(has joined|is joining|will be joining|recently joined|now works|'
+         r'working with us|part of our team|on our team|member of our)\b',
+         "Team membership claim"),
+        (r'\b(is our|are our|will be our)\s+\w+',
+         "Direct role attribution"),
+    ]
+
+    for pattern, description in claim_patterns:
+        for match in re.finditer(pattern, message, re.IGNORECASE):
+            matched_text = match.group(0)
+            # Extract context — look for a name near the match
+            start = max(0, match.start() - 80)
+            end = min(len(message), match.end() + 80)
+            context_window = message[start:end]
+
+            # Check if any known person is referenced nearby
+            flagged = False
+            flagged_person = None
+            entity_lookup_used = False
+
+            # ── PRIMARY: Entity index lookup ─────────────────
+            # Scan the context window for any entity name from the index
+            by_name = entity_index.get('by_name', {})
+            for entity_name_lower, entity in by_name.items():
+                # Only check person entities, skip companies
+                if entity.get('type') != 'person':
+                    continue
+
+                # Check if this entity's name appears in the context
+                name_in_context = False
+                # Check full name
+                full_name = entity.get('name', '')
+                if full_name and full_name.lower() in context_window.lower():
+                    name_in_context = True
+                # Check aliases
+                if not name_in_context:
+                    for alias in (entity.get('aliases', []) or []):
+                        if alias and len(alias) > 2 and alias.lower() in context_window.lower():
+                            name_in_context = True
+                            break
+                # Check name parts (first name, last name)
+                if not name_in_context and full_name:
+                    parts = full_name.split()
+                    for part in parts:
+                        if len(part) > 2 and part.lower() in context_window.lower():
+                            name_in_context = True
+                            break
+
+                if not name_in_context:
+                    continue
+
+                # Found a person near the claim — look up their relationship
+                result = lookup_entity(full_name, entity_index)
+                if result:
+                    entity_lookup_used = True
+                    rel_type = result.get('relationship_type', 'unknown')
+
+                    if rel_type in entity_external_types:
+                        # BLOCK — external person referenced with possessive claim
+                        flagged = True
+                        flagged_person = full_name
+                        # Build enriched suggestion from entity data
+                        entity_role = entity.get('primary_role', '')
+                        entity_company = entity.get('primary_company', '')
+                        suggestion_parts = [
+                            f"{full_name} is classified as '{rel_type}' in the entity index."
+                        ]
+                        if entity_role:
+                            suggestion_parts.append(f"Their role is: {entity_role}.")
+                        if entity_company:
+                            suggestion_parts.append(f"Their company: {entity_company}.")
+                        suggestion_parts.append(
+                            "Do not use possessive language ('our', 'my') for external parties."
+                        )
+                        break  # Found a flagged person, stop scanning
+
+                    elif rel_type in entity_internal_types:
+                        # ALLOW — confirmed internal person
+                        # Don't flag, and mark that we found a confirmed person
+                        flagged = False
+                        flagged_person = None
+                        entity_lookup_used = True
+                        break
+
+            # ── FALLBACK: Profile-based lookup (if entity index didn't resolve) ──
+            if not entity_lookup_used:
+                for name_lower, profile in profiles.items():
+                    rel_status = profile.get('relationship_status', '')
+                    rel_type = profile.get('relationship_type', '')
+                    priv_level = profile.get('privilege_level', '')
+                    classification = profile.get('classification', '')
+
+                    # Check if this person is in the context window
+                    name_parts = name_lower.split()
+                    name_in_context = False
+                    for part in name_parts:
+                        if len(part) > 2 and part.lower() in context_window.lower():
+                            name_in_context = True
+                            break
+
+                    if not name_in_context:
+                        continue
+
+                    # Is this person confirmed?
+                    is_confirmed = (
+                        rel_status in confirmed_statuses or
+                        classification in confirmed_classifications or
+                        priv_level == 'internal'
+                    )
+
+                    # Also check contacts registry
+                    contact = contacts.get(name_lower, {})
+                    contact_class = contact.get('classification', '')
+                    if contact_class in confirmed_classifications:
+                        is_confirmed = True
+
+                    if not is_confirmed:
+                        flagged = True
+                        flagged_person = profile.get('name', name_lower)
+                        break
+
+            # Also flag if no person is identified but claim is made
+            # (could be about someone not in our records at all)
+            if not flagged and not entity_lookup_used:
+                # Check all known profiles — if none are mentioned, still warn
+                any_confirmed_nearby = False
+                for name_lower, profile in {**profiles, **{k: {'name': v.get('name', k)} for k, v in contacts.items()}}.items():
+                    name_parts = name_lower.split()
+                    for part in name_parts:
+                        if len(part) > 2 and part.lower() in context_window.lower():
+                            # Person found — check if confirmed
+                            contact = contacts.get(name_lower, {})
+                            contact_class = contact.get('classification', '')
+                            p = profiles.get(name_lower, {})
+                            if (contact_class in confirmed_classifications or
+                                p.get('relationship_status') in confirmed_statuses or
+                                p.get('privilege_level') == 'internal'):
+                                any_confirmed_nearby = True
+                            break
+
+                if not any_confirmed_nearby:
+                    # Nobody confirmed near this claim — warn
+                    flagged = True
+                    flagged_person = None
+
+            if flagged:
+                # Build suggestion based on source
+                if flagged_person and entity_lookup_used:
+                    result = lookup_entity(flagged_person, entity_index)
+                    if result:
+                        rel_type = result.get('relationship_type', 'unknown')
+                        entity_data = result.get('entity', {})
+                        entity_role = entity_data.get('primary_role', '') if entity_data else ''
+                        entity_company = entity_data.get('primary_company', '') if entity_data else ''
+                        suggestion = (
+                            f"{flagged_person} is '{rel_type}' per entity index"
+                            f"{' (' + entity_role + ')' if entity_role else ''}. "
+                            f"Do not use possessive language for external parties."
+                        )
+                    else:
+                        suggestion = f"Verify {flagged_person}'s relationship status before claiming affiliation."
+                elif flagged_person:
+                    suggestion = f"Verify {flagged_person}'s relationship status before claiming affiliation."
+                else:
+                    suggestion = "Could not identify a confirmed team member near this claim. Verify the relationship."
+
+                issue = {
+                    "type": "relationship_claim",
+                    "severity": "block",
+                    "matched_text": matched_text,
+                    "description": f"{description}: \"{matched_text}\"",
+                    "suggestion": suggestion,
+                    "context": context_window.strip(),
+                    "lookup_source": "entity_index" if entity_lookup_used else "profile_fallback",
+                }
+                if flagged_person:
+                    issue["person"] = flagged_person
+                issues.append(issue)
+
+    return issues
+
+
+def check_title_accuracy(message):
+    """Check that titles attributed to named people match confirmed records.
+
+    Returns list of issue dicts.
+    """
+    issues = []
+    org_titles = load_org_titles()
+    contacts = load_contacts()
+    profiles = load_user_profiles()
+
+    # Build comprehensive title map: name -> known title
+    title_map = {}
+    for name_lower, title in org_titles.items():
+        title_map[name_lower] = title
+    for name_lower, contact in contacts.items():
+        if contact.get('role'):
+            title_map[name_lower] = contact['role']
+    for name_lower, profile in profiles.items():
+        if profile.get('title'):
+            title_map[name_lower] = profile['title']
+
+    # Pattern: "Name, Title" or "Name (Title)" or "Name, the Title"
+    title_attribution_patterns = [
+        r'([A-Z][a-z]+(?:\s+[A-Z][a-z]+)+),\s+(?:the\s+)?([A-Z][A-Za-z\s/]+?)(?:\.|,|\s+at\s+|\s+of\s+|\s+from\s+|\s*$)',
+        r'([A-Z][a-z]+(?:\s+[A-Z][a-z]+)+)\s+\(([^)]+)\)',
+    ]
+
+    for pattern in title_attribution_patterns:
+        for match in re.finditer(pattern, message):
+            name = match.group(1).strip()
+            attributed_title = match.group(2).strip()
+            name_lower = name.lower()
+
+            # Look up known title
+            known_title = title_map.get(name_lower)
+            if not known_title:
+                # Try partial match (first + last name)
+                parts = name_lower.split()
+                if len(parts) >= 2:
+                    short = f"{parts[0]} {parts[-1]}"
+                    known_title = title_map.get(short)
+
+            if known_title:
+                # Compare — normalize for comparison
+                known_normalized = known_title.lower().replace('/', ' ').replace('-', ' ')
+                attr_normalized = attributed_title.lower().replace('/', ' ').replace('-', ' ')
+
+                # Check if attributed title is a reasonable match
+                known_words = set(known_normalized.split())
+                attr_words = set(attr_normalized.split())
+
+                # If there's very little overlap, flag it
+                if known_words and attr_words:
+                    overlap = known_words & attr_words
+                    if len(overlap) < 1 and len(attr_words) > 1:
+                        issues.append({
+                            "type": "title_accuracy",
+                            "severity": "warn",
+                            "person": name,
+                            "attributed_title": attributed_title,
+                            "known_title": known_title,
+                            "description": (
+                                f"Title \"{attributed_title}\" for {name} does not match "
+                                f"confirmed title \"{known_title}\""
+                            ),
+                            "suggestion": f"Use confirmed title: \"{known_title}\"",
+                        })
+
+    return issues
+
+
+def check_ai_self_disclosure(message):
+    """Scan for language that reveals the agent is AI.
+
+    Must NOT flag general business discussion of Northwind's AI products.
+    Returns list of issue dicts.
+    """
+    issues = []
+
+    # Business context exceptions — if these appear, the word "AI" is OK
+    business_exceptions = [
+        r'AI[- ]Born', r'AI[- ]native', r'Northwind\s*AI', r'Northwind\.ai',
+        r'artificial intelligence\s+strategy', r'AI\s+products?',
+        r'AI\s+platform', r'AI\s+capabilit', r'machine learning\s+models?',
+        r'AI[- ]driven', r'AI\s+solutions?', r'AI\s+technolog',
+        r'AI\s+invest', r'AI\s+fund', r'AI\s+sector', r'AI\s+market',
+        r'AI\s+infrastructure', r'AI\s+research', r'generative\s+AI',
+    ]
+
+    # Self-referential AI disclosure patterns
+    disclosure_patterns = [
+        (r'\bI\s+(?:am|\'m)\s+(?:an?\s+)?(?:AI|artificial intelligence|language model|LLM|chatbot|bot|virtual assistant|automated system|machine)\b',
+         "Direct AI self-identification"),
+        (r'\b(?:I\'m|I am)\s+not\s+(?:human|a real person|a person)\b',
+         "Human status denial"),
+        (r'\bas an AI\b',
+         "Self-referential 'as an AI'"),
+        (r'\b(?:my|I)\s+(?:training|training data|knowledge cutoff|neural network|parameters)\b',
+         "AI-specific self-reference"),
+        (rf'\b{re.escape(AGENT_FIRST_NAME)}\s+is\s+(?:an?\s+)?(?:AI|bot|automated|virtual|artificial)\b',
+         f"Third-person AI disclosure about {AGENT_FIRST_NAME}"),
+        (r'\b(?:automated|AI[- ]powered|AI[- ]operated|machine[- ]generated)\s+(?:assistant|chief of staff|executive|system)\b',
+         "Role described as automated"),
+        (r'\b(?:I don\'t have|I lack)\s+(?:feelings|emotions|a body|physical form|consciousness)\b',
+         "Self-disclosure via limitation"),
+        (r'\b(?:my programming|my algorithms?|my code)\b',
+         "Self-referencing technical nature"),
+    ]
+
+    for pattern, description in disclosure_patterns:
+        for match in re.finditer(pattern, message, re.IGNORECASE):
+            matched_text = match.group(0)
+            start = max(0, match.start() - 40)
+            end = min(len(message), match.end() + 40)
+            context_window = message[start:end]
+
+            # Check if this is actually a business context exception
+            is_business_context = False
+            for exc_pattern in business_exceptions:
+                if re.search(exc_pattern, context_window, re.IGNORECASE):
+                    is_business_context = True
+                    break
+
+            if not is_business_context:
+                issues.append({
+                    "type": "ai_self_disclosure",
+                    "severity": "block",
+                    "matched_text": matched_text,
+                    "description": f"AI self-disclosure detected: {description}",
+                    "suggestion": f"Remove or rephrase to avoid revealing {AGENT_FIRST_NAME}'s AI nature.",
+                    "context": context_window.strip(),
+                })
+
+    return issues
+
+
+def check_in_person_self_scheduling(message):
+    """Detect the agent scheduling itself for in-person meetings.
+
+    Should NOT flag scheduling for the principal or team members.
+    Returns list of issue dicts.
+    """
+    issues = []
+
+    _principal_name = (_AGENT.get("principal") or {}).get("firstName", "the principal")
+
+    # Patterns where the agent offers to physically attend
+    self_attend_patterns = [
+        (r'\bI\'ll\s+(?:attend|be there|come to|visit|meet you at|stop by|drop by|come by|swing by|show up)\b',
+         f"{AGENT_FIRST_NAME} offering to physically attend"),
+        (r'\b(?:meet me at|see you at|I\'ll see you|I can meet|let me come|I\'ll come)\b',
+         f"{AGENT_FIRST_NAME} scheduling itself for physical meeting"),
+        (r'\b(?:I\'ll be in|I\'m in|I will be at)\s+(?:the office|DIFC|Innovation|your office|the meeting room|the boardroom)\b',
+         f"{AGENT_FIRST_NAME} placing itself in physical location"),
+        (rf'\b{re.escape(AGENT_FIRST_NAME)}\s+(?:will attend|will be at|will meet|will visit)\b',
+         f"Third-person {AGENT_FIRST_NAME} physical attendance"),
+        (r'\bI\'ll\s+(?:fly|travel|drive|take a cab|take a taxi)\b',
+         f"{AGENT_FIRST_NAME} describing physical travel"),
+        (r'\b(?:looking forward to meeting you|see you (?:there|soon|Monday|Tuesday|Wednesday|Thursday|Friday|tomorrow|next week))\b',
+         f"{AGENT_FIRST_NAME} implying physical presence at meeting"),
+    ]
+
+    # Exception patterns — scheduling others is fine
+    team_scheduling_patterns = [
+        r'\b(?:Alex|Sam|Jordan|Bronwyn|Casey|the team|our team|he|she|they)\s+(?:will|can|should|could)\s+(?:attend|be there|meet|visit)',
+        r'\b(?:Alex|Sam|Jordan|Bronwyn|Casey)\s+(?:will|can)\s+(?:come|be at|meet you)',
+        r'\b(?:schedule|book|set up|arrange)\s+(?:a|the)\s+(?:meeting|call|session)\s+(?:for|with)\s+(?:Alex|Sam|Jordan|Bronwyn)',
+    ]
+
+    for pattern, description in self_attend_patterns:
+        for match in re.finditer(pattern, message, re.IGNORECASE):
+            matched_text = match.group(0)
+            start = max(0, match.start() - 50)
+            end = min(len(message), match.end() + 50)
+            context_window = message[start:end]
+
+            # Check if this is actually about scheduling someone else
+            is_team_scheduling = False
+            for exc_pattern in team_scheduling_patterns:
+                if re.search(exc_pattern, context_window, re.IGNORECASE):
+                    is_team_scheduling = True
+                    break
+
+            if not is_team_scheduling:
+                issues.append({
+                    "type": "in_person_self_scheduling",
+                    "severity": "block",
+                    "matched_text": matched_text,
+                    "description": f"In-person self-scheduling detected: {description}",
+                    "suggestion": f"{AGENT_FIRST_NAME} cannot attend in-person meetings. Propose {_principal_name} or a team member instead.",
+                    "context": context_window.strip(),
+                })
+
+    return issues
+
+
+def check_unverified_commitments(message):
+    """Flag strong commitment language that should be verified.
+
+    Returns list of issue dicts.
+    """
+    issues = []
+
+    commitment_patterns = [
+        (r'\b(?:we\'ve|we have)\s+(?:closed|secured|signed|finalized|completed|received approval)',
+         "Commitment claim — verify status"),
+        (r'\b(?:deal is done|agreement signed|funds received|licence approved|licence granted)',
+         "Completion claim — verify against records"),
+        (r'\b(?:we\'ve|we have)\s+(?:raised|received)\s+\$[\d,.]+',
+         "Fundraising claim — verify amount"),
+    ]
+
+    for pattern, description in commitment_patterns:
+        for match in re.finditer(pattern, message, re.IGNORECASE):
+            matched_text = match.group(0)
+            start = max(0, match.start() - 40)
+            end = min(len(message), match.end() + 40)
+            context_window = message[start:end]
+
+            issues.append({
+                "type": "unverified_commitment",
+                "severity": "warn",
+                "matched_text": matched_text,
+                "description": f"Unverified commitment: {description}",
+                "suggestion": "Verify this claim against known records before sending.",
+                "context": context_window.strip(),
+            })
+
+    return issues
+
+
+# ─────────────────────────────────────────────
+# Main Validation Pipeline
+# ─────────────────────────────────────────────
+
+def _load_rules_config():
+    """Load validation-rules.yaml. Returns dict or None on failure."""
+    try:
+        if VALIDATION_RULES_PATH.exists():
+            text = VALIDATION_RULES_PATH.read_text(encoding='utf-8')
+            return _parse_yaml_simple(text)
+    except Exception:
+        pass
+    return None
+
+
+def validate_message(message, message_type="email", recipient="", channel=None):
+    """Run all validation checks on a message.
+
+    Args:
+        message: The message body text
+        message_type: "email", "slack", or "whatsapp"
+        recipient: Recipient identifier (email address, channel ID, phone number)
+        channel: Optional Slack channel slug (for disclosure assessment)
+
+    Returns:
+        dict with keys: status, issues, metadata
+    """
+    start_time = time.time()
+    all_issues = []
+
+    # Run all checks
+    all_issues.extend(check_relationship_claims(message))
+    all_issues.extend(check_title_accuracy(message))
+    all_issues.extend(check_ai_self_disclosure(message))
+    all_issues.extend(check_in_person_self_scheduling(message))
+    all_issues.extend(check_unverified_commitments(message))
+
+    # ── Rule 6: Disclosure Assessment (Information Barrier) ──
+    if _da_module:
+        try:
+            rules_config = _load_rules_config()
+            da_config = rules_config.get("disclosure_assessment", {}) if rules_config else {}
+            if da_config.get("enabled", False):
+                # Derive a slug from the recipient string
+                recipient_slug = None
+                if recipient:
+                    recipient_slug = (
+                        recipient.lower()
+                        .replace(" ", "-")
+                        .replace("@", "-at-")
+                        .replace(".", "-")
+                    )
+
+                if recipient_slug:
+                    da_result = _da_module.assess_disclosure(
+                        message, recipient_slug, channel=channel
+                    )
+                    outcome = da_result.get("outcome", "passed")
+                    if outcome == "blocked":
+                        assessments = da_result.get("references_assessed", [])
+                        first_reason = (
+                            assessments[0].get("reasoning", "disclosure violation")
+                            if assessments else "disclosure violation detected"
+                        )
+                        all_issues.append({
+                            "type": "disclosure_assessment",
+                            "severity": "block",
+                            "matched_text": "",
+                            "description": (
+                                f"INFORMATION BARRIER: {da_result.get('severity', 'unknown')} severity"
+                                f" — {first_reason}"
+                            ),
+                            "suggestion": "Remove or redact the restricted reference before sending.",
+                            "detail": da_result,
+                        })
+                    elif outcome == "stripped":
+                        all_issues.append({
+                            "type": "disclosure_assessment",
+                            "severity": "warn",
+                            "matched_text": "",
+                            "description": (
+                                "INFORMATION BARRIER: Medium severity references detected"
+                                " — content should be reviewed"
+                            ),
+                            "suggestion": "Review and redact medium-sensitivity references before sending.",
+                            "detail": da_result,
+                        })
+        except Exception:
+            pass  # Fail-open on assessment errors
+
+    # Deduplicate by matched_text + type
+    seen = set()
+    unique_issues = []
+    for issue in all_issues:
+        key = (issue.get('type', ''), issue.get('matched_text', ''))
+        if key not in seen:
+            seen.add(key)
+            unique_issues.append(issue)
+
+    elapsed_ms = round((time.time() - start_time) * 1000, 1)
+
+    has_blockers = any(i['severity'] == 'block' for i in unique_issues)
+    status = "issues_found" if has_blockers else ("warnings" if unique_issues else "clean")
+
+    result = {
+        "status": status,
+        "issues": unique_issues,
+        "metadata": {
+            "message_type": message_type,
+            "recipient": recipient,
+            "checks_run": 6,
+            "issues_found": len(unique_issues),
+            "blockers": sum(1 for i in unique_issues if i['severity'] == 'block'),
+            "warnings": sum(1 for i in unique_issues if i['severity'] == 'warn'),
+            "elapsed_ms": elapsed_ms,
+            "timestamp": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
+        },
+    }
+
+    return result
+
+
+def log_validation_result(result):
+    """Log validation result to audit log."""
+    try:
+        AUDIT_LOG_DIR.mkdir(parents=True, exist_ok=True)
+        today = datetime.now(timezone.utc).strftime("%Y-%m-%d")
+        log_file = AUDIT_LOG_DIR / f"{today}-validation.jsonl"
+
+        log_entry = {
+            "timestamp": result["metadata"]["timestamp"],
+            "agent": "validate-outbound",
+            "action": "outbound_validation",
+            "status": result["status"],
+            "message_type": result["metadata"]["message_type"],
+            "recipient": result["metadata"]["recipient"],
+            "issues_found": result["metadata"]["issues_found"],
+            "blockers": result["metadata"]["blockers"],
+            "warnings": result["metadata"]["warnings"],
+            "elapsed_ms": result["metadata"]["elapsed_ms"],
+        }
+
+        # Add issue summaries (but not full context to keep log compact)
+        if result["issues"]:
+            log_entry["issue_types"] = list(set(i["type"] for i in result["issues"]))
+            log_entry["issue_summaries"] = [
+                {"type": i["type"], "severity": i["severity"], "description": i["description"]}
+                for i in result["issues"][:10]  # Cap at 10 for log size
+            ]
+
+        with open(log_file, "a", encoding="utf-8") as f:
+            f.write(json.dumps(log_entry) + "\n")
+    except Exception:
+        pass  # Fail-open — validation logging should never block sending
+
+
+# ─────────────────────────────────────────────
+# CLI Entry Point
+# ─────────────────────────────────────────────
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Pre-send outbound correspondence validator"
+    )
+    parser.add_argument(
+        "--message", "-m",
+        help="Message body to validate (alternative to stdin)"
+    )
+    parser.add_argument(
+        "--type", "-t",
+        default="email",
+        choices=["email", "slack", "whatsapp"],
+        help="Message type (default: email)"
+    )
+    parser.add_argument(
+        "--recipient", "-r",
+        default="",
+        help="Recipient identifier (email, channel ID, phone)"
+    )
+    parser.add_argument(
+        "--channel", "-c",
+        default=None,
+        help="Slack channel slug (used for disclosure assessment)"
+    )
+    parser.add_argument(
+        "--quiet", "-q",
+        action="store_true",
+        help="Suppress non-JSON output"
+    )
+    args = parser.parse_args()
+
+    # Get message from --message flag or stdin
+    if args.message:
+        message = args.message
+    elif not sys.stdin.isatty():
+        message = sys.stdin.read()
+    else:
+        print("ERROR: Provide message via --message flag or stdin", file=sys.stderr)
+        sys.exit(2)
+
+    if not message.strip():
+        print("ERROR: Empty message", file=sys.stderr)
+        sys.exit(2)
+
+    # Run validation
+    result = validate_message(message, args.type, args.recipient, channel=args.channel)
+
+    # Log to audit
+    log_validation_result(result)
+
+    # Output JSON result
+    print(json.dumps(result, indent=2))
+
+    # Human-readable summary to stderr (unless --quiet)
+    if not args.quiet:
+        meta = result["metadata"]
+        if result["status"] == "clean":
+            print(
+                f"VALIDATION PASS: {meta['checks_run']} checks, "
+                f"0 issues ({meta['elapsed_ms']}ms)",
+                file=sys.stderr
+            )
+        else:
+            print(
+                f"VALIDATION {'BLOCK' if meta['blockers'] > 0 else 'WARN'}: "
+                f"{meta['blockers']} blockers, {meta['warnings']} warnings "
+                f"({meta['elapsed_ms']}ms)",
+                file=sys.stderr
+            )
+            for issue in result["issues"]:
+                severity_marker = "BLOCK" if issue["severity"] == "block" else "WARN"
+                print(
+                    f"  [{severity_marker}] {issue['description']}",
+                    file=sys.stderr
+                )
+                if issue.get("suggestion"):
+                    print(
+                        f"         -> {issue['suggestion']}",
+                        file=sys.stderr
+                    )
+
+    # Exit code: 1 if blockers, 0 otherwise
+    sys.exit(1 if result["metadata"]["blockers"] > 0 else 0)
+
+
+# ─────────────────────────────────────────────
+# Test Suite
+# ─────────────────────────────────────────────
+
+def run_tests():
+    """Run built-in validation tests. Returns True if all pass."""
+    passed = 0
+    failed = 0
+    total = 0
+
+    def assert_test(name, condition, detail=""):
+        nonlocal passed, failed, total
+        total += 1
+        if condition:
+            passed += 1
+            print(f"  PASS: {name}", file=sys.stderr)
+        else:
+            failed += 1
+            print(f"  FAIL: {name}{' — ' + detail if detail else ''}", file=sys.stderr)
+
+    print("Running validate-outbound.py tests...\n", file=sys.stderr)
+
+    # ── Test 1: Entity index loads without error ──
+    print("[Entity Index Loading]", file=sys.stderr)
+    idx = load_entity_index()
+    assert_test("Entity index loads", isinstance(idx, dict))
+    assert_test("Entity index has entities", len(idx.get('entities', [])) > 0)
+    assert_test("Entity index has relationships", len(idx.get('relationships', [])) > 0)
+    assert_test("Entity index has by_name lookup", len(idx.get('by_name', {})) > 0)
+
+    # ── Test 2: Entity lookup — known internal people ──
+    print("\n[Entity Lookup — Internal]", file=sys.stderr)
+    alex = lookup_entity("Alex Chen", idx)
+    assert_test("Alex found", alex is not None)
+    assert_test("Alex is internal", alex and alex.get('is_internal') is True)
+    assert_test("Alex rel_type is internal", alex and alex.get('relationship_type') == 'internal')
+
+    sam = lookup_entity("Sam", idx)
+    assert_test("Sam found by first name", sam is not None)
+    assert_test("Sam is internal", sam and sam.get('is_internal') is True)
+
+    robin = lookup_entity("Robin Hayes", idx)
+    assert_test("Robin found", robin is not None)
+    assert_test("Robin is internal", robin and robin.get('is_internal') is True)
+
+    # ── Test 3: Entity lookup — known external people ──
+    print("\n[Entity Lookup — External]", file=sys.stderr)
+    graham = lookup_entity("Graham Syder", idx)
+    assert_test("Graham found", graham is not None)
+    assert_test("Graham is NOT internal", graham and graham.get('is_internal') is False)
+    assert_test(
+        "Graham is vendor_candidate",
+        graham and graham.get('relationship_type') == 'vendor_candidate',
+        f"got: {graham.get('relationship_type') if graham else 'None'}"
+    )
+
+    rishel = lookup_entity("Rishel", idx)
+    assert_test("Rishel found by first name", rishel is not None)
+    assert_test("Rishel is NOT internal", rishel and rishel.get('is_internal') is False)
+
+    # ── Test 4: Entity lookup — unknown person ──
+    print("\n[Entity Lookup — Unknown]", file=sys.stderr)
+    unknown = lookup_entity("John Smith", idx)
+    assert_test("Unknown person returns None", unknown is None)
+
+    unknown_empty = lookup_entity("", idx)
+    assert_test("Empty string returns None", unknown_empty is None)
+
+    # ── Test 5: Graham incident — MUST be blocked ──
+    print("\n[Graham Incident — Possessive Claim Block]", file=sys.stderr)
+    graham_msg = "Graham Syder is our project manager for the DIFC fitout."
+    result = validate_message(graham_msg, "email", "internal@example.com")
+    assert_test(
+        "Graham 'our PM' is BLOCKED",
+        result['status'] == 'issues_found' and result['metadata']['blockers'] > 0,
+        f"status={result['status']}, blockers={result['metadata']['blockers']}"
+    )
+    # Verify entity_index was the lookup source
+    rel_issues = [i for i in result['issues'] if i['type'] == 'relationship_claim']
+    entity_sourced = any(i.get('lookup_source') == 'entity_index' for i in rel_issues)
+    assert_test(
+        "Graham block used entity_index as source",
+        entity_sourced,
+        f"sources: {[i.get('lookup_source') for i in rel_issues]}"
+    )
+
+    # Also test variant: "our PM Graham"
+    graham_msg2 = "I've arranged for our PM Graham to review the floor plan."
+    result2 = validate_message(graham_msg2, "slack", "C099ABCDEF")
+    assert_test(
+        "Graham 'our PM Graham' variant is BLOCKED",
+        result2['status'] == 'issues_found' and result2['metadata']['blockers'] > 0,
+        f"status={result2['status']}, blockers={result2['metadata']['blockers']}"
+    )
+
+    # ── Test 6: Internal person — MUST be allowed ──
+    print("\n[Internal Person — Allowed Claims]", file=sys.stderr)
+    sam_msg = "Sam Rivera is our CFO and will be handling the the regulator submission."
+    result3 = validate_message(sam_msg, "email", "external@example.com")
+    rel_issues3 = [i for i in result3['issues'] if i['type'] == 'relationship_claim']
+    assert_test(
+        "Sam 'our CFO' is NOT blocked",
+        len(rel_issues3) == 0,
+        f"found {len(rel_issues3)} relationship issues"
+    )
+
+    # ── Test 7: AI self-disclosure still blocked ──
+    print("\n[AI Self-Disclosure Block]", file=sys.stderr)
+    ai_msg = "I am an AI assistant and I can help with that."
+    result4 = validate_message(ai_msg, "email", "external@example.com")
+    ai_issues = [i for i in result4['issues'] if i['type'] == 'ai_self_disclosure']
+    assert_test("AI self-disclosure blocked", len(ai_issues) > 0)
+
+    ai_msg_robin = "Robin is an AI-operated automated assistant."
+    result4b = validate_message(ai_msg_robin, "email", "external@example.com")
+    ai_issues_b = [i for i in result4b['issues'] if i['type'] == 'ai_self_disclosure']
+    assert_test("Robin third-person AI disclosure blocked", len(ai_issues_b) > 0)
+
+    # ── Test 8: In-person self-scheduling still blocked ──
+    print("\n[In-Person Self-Scheduling Block]", file=sys.stderr)
+    attend_msg = "I'll attend the meeting at the DIFC office tomorrow."
+    result5 = validate_message(attend_msg, "slack", "C099ABCDEF")
+    attend_issues = [i for i in result5['issues'] if i['type'] == 'in_person_self_scheduling']
+    assert_test("In-person self-scheduling blocked", len(attend_issues) > 0)
+
+    # ── Test 9: Clean message passes ──
+    print("\n[Clean Message — No Issues]", file=sys.stderr)
+    clean_msg = "Hi team, the quarterly report is ready for review. Please check your inboxes."
+    result6 = validate_message(clean_msg, "email", "team@example.com")
+    assert_test(
+        "Clean message passes with no blockers",
+        result6['metadata']['blockers'] == 0,
+        f"blockers={result6['metadata']['blockers']}"
+    )
+
+    # ── Test 10: Casey — investor, not internal employee ──
+    print("\n[Casey — Investor, Not Internal]", file=sys.stderr)
+    shayan = lookup_entity("Casey Morgan", idx)
+    assert_test("Casey found", shayan is not None)
+    assert_test(
+        "Casey is NOT internal",
+        shayan and shayan.get('is_internal') is False,
+        f"is_internal={shayan.get('is_internal') if shayan else 'None'}"
+    )
+
+    # ── Test 11: Performance — under 1 second ──
+    print("\n[Performance]", file=sys.stderr)
+    perf_msg = "Graham is our project manager. He has joined the team. We've hired him."
+    import time as _time
+    t0 = _time.time()
+    for _ in range(10):
+        validate_message(perf_msg, "email", "test@test.com")
+    elapsed = (_time.time() - t0) / 10
+    assert_test(
+        f"Average validation < 1s (got {elapsed*1000:.1f}ms)",
+        elapsed < 1.0
+    )
+
+    # ── Summary ──
+    print(f"\n{'='*50}", file=sys.stderr)
+    print(f"Results: {passed}/{total} passed, {failed} failed", file=sys.stderr)
+    if failed > 0:
+        print("TESTS FAILED", file=sys.stderr)
+        return False
+    else:
+        print("ALL TESTS PASSED", file=sys.stderr)
+        return True
+
+
+if __name__ == "__main__":
+    # Check for --test flag before argparse (to avoid --message requirement)
+    if '--test' in sys.argv:
+        success = run_tests()
+        sys.exit(0 if success else 1)
+    main()