@complior/engine 0.9.0

package/src/domain/supply-chain/supply-chain.test.ts

@@ -0,0 +1,211 @@
+import { describe, it, expect } from 'vitest';
+import { REGISTRY_CARDS, findRegistryCard, findRegistryCardsByProvider, REGISTRY_SLUG_PATTERN, isGpaiSystemic, getProviderName } from '../../data/registry-cards.js';
+import { analyzeSupplyChain, SUPPLY_CHAIN_OBLIGATIONS } from './dependency-analyzer.js';
+import type { ParsedDependency } from '../scanner/layers/layer3-parsers.js';
+
+// --- Registry Cards Tests ---
+
+describe('RegistryToolCards', () => {
+  it('contains 10 registry cards', () => {
+    expect(REGISTRY_CARDS).toHaveLength(10);
+  });
+
+  it('all cards have required fields', () => {
+    for (const card of REGISTRY_CARDS) {
+      expect(card.slug).toBeTruthy();
+      expect(card.name).toBeTruthy();
+      expect(card.provider.name).toBeTruthy();
+      expect(card.capabilities!.length).toBeGreaterThan(0);
+      expect(card.assessments?.['eu-ai-act']?.training_cutoff).toBeTruthy();
+      expect(card.assessments?.['eu-ai-act']?.license).toBeTruthy();
+      expect(card.assessments?.['eu-ai-act']?.limitations!.length).toBeGreaterThan(0);
+      expect(card.assessments?.['eu-ai-act']?.known_risks!.length).toBeGreaterThan(0);
+      expect(card.assessments?.['eu-ai-act']?.risk_reasoning).toBeTruthy();
+    }
+  });
+
+  it('findRegistryCard returns card by slug', () => {
+    const card = findRegistryCard('gpt-4o');
+    expect(card).toBeDefined();
+    expect(card!.name).toBe('GPT-4o');
+    expect(card!.provider.name).toBe('OpenAI');
+  });
+
+  it('findRegistryCard returns undefined for unknown slug', () => {
+    expect(findRegistryCard('nonexistent-model')).toBeUndefined();
+  });
+
+  it('findRegistryCardsByProvider filters correctly', () => {
+    const anthropicCards = findRegistryCardsByProvider('Anthropic');
+    expect(anthropicCards).toHaveLength(2);
+    for (const card of anthropicCards) {
+      expect(card.provider.name).toBe('Anthropic');
+    }
+  });
+
+  it('REGISTRY_SLUG_PATTERN matches known model slugs', () => {
+    const text = 'Using gpt-4o and claude-sonnet-4 models';
+    const matches = [...text.matchAll(new RegExp(REGISTRY_SLUG_PATTERN.source, 'g'))].map((m) => m[0]);
+    expect(matches).toContain('gpt-4o');
+    expect(matches).toContain('claude-sonnet-4');
+  });
+
+  it('REGISTRY_SLUG_PATTERN does not false-positive on embedded substrings', () => {
+    const text = 'ratio1 protocol1 foo1bar';
+    const matches = [...text.matchAll(new RegExp(REGISTRY_SLUG_PATTERN.source, 'g'))];
+    expect(matches).toHaveLength(0);
+  });
+
+  it('REGISTRY_SLUG_PATTERN is derived from REGISTRY_CARDS data', () => {
+    for (const card of REGISTRY_CARDS) {
+      const text = `model: ${card.slug}`;
+      const matches = [...text.matchAll(new RegExp(REGISTRY_SLUG_PATTERN.source, 'g'))].map((m) => m[0]);
+      expect(matches).toContain(card.slug);
+    }
+  });
+
+  it('isGpaiSystemic correctly identifies systemic risk', () => {
+    const gpt4o = findRegistryCard('gpt-4o')!;
+    expect(isGpaiSystemic(gpt4o)).toBe(true);
+
+    const gpt4oMini = findRegistryCard('gpt-4o-mini')!;
+    expect(isGpaiSystemic(gpt4oMini)).toBe(false);
+  });
+
+  it('getProviderName extracts provider name', () => {
+    const card = findRegistryCard('gpt-4o')!;
+    expect(getProviderName(card)).toBe('OpenAI');
+
+    const mistral = findRegistryCard('mistral-large')!;
+    expect(getProviderName(mistral)).toBe('Mistral AI');
+  });
+});
+
+// --- Analyzer Tests ---
+
+describe('analyzeSupplyChain', () => {
+  it('returns zero risk for empty dependencies', () => {
+    const report = analyzeSupplyChain('/test', [], []);
+    expect(report.totalDependencies).toBe(0);
+    expect(report.aiSdkCount).toBe(0);
+    expect(report.bannedCount).toBe(0);
+    expect(report.risks).toHaveLength(0);
+    expect(report.riskScore).toBe(0);
+  });
+
+  it('detects banned packages as critical risk', () => {
+    const deps: ParsedDependency[] = [
+      { name: 'clearview-ai', version: '1.0.0', ecosystem: 'npm' },
+    ];
+    const report = analyzeSupplyChain('/test', deps, []);
+    expect(report.bannedCount).toBe(1);
+    expect(report.risks.length).toBeGreaterThanOrEqual(1);
+    const bannedRisk = report.risks.find((r) => r.type === 'banned-package');
+    expect(bannedRisk).toBeDefined();
+    expect(bannedRisk!.severity).toBe('critical');
+    expect(bannedRisk!.articleRef).toBe('Art.5');
+  });
+
+  it('counts AI SDK packages', () => {
+    const deps: ParsedDependency[] = [
+      { name: 'openai', version: '4.0.0', ecosystem: 'npm' },
+      { name: '@anthropic-ai/sdk', version: '1.0.0', ecosystem: 'npm' },
+      { name: 'express', version: '4.18.0', ecosystem: 'npm' },
+    ];
+    const report = analyzeSupplyChain('/test', deps, []);
+    expect(report.aiSdkCount).toBe(2);
+    expect(report.totalDependencies).toBe(3);
+  });
+
+  it('flags missing bias testing when AI SDKs present', () => {
+    const deps: ParsedDependency[] = [
+      { name: 'openai', version: '4.0.0', ecosystem: 'npm' },
+    ];
+    const report = analyzeSupplyChain('/test', deps, []);
+    const biasRisk = report.risks.find((r) => r.type === 'missing-bias-testing');
+    expect(biasRisk).toBeDefined();
+    expect(biasRisk!.severity).toBe('medium');
+  });
+
+  it('no bias testing warning when bias package present', () => {
+    const deps: ParsedDependency[] = [
+      { name: 'openai', version: '4.0.0', ecosystem: 'npm' },
+      { name: 'fairlearn', version: '0.9.0', ecosystem: 'pip' },
+    ];
+    const report = analyzeSupplyChain('/test', deps, []);
+    const biasRisk = report.risks.find((r) => r.type === 'missing-bias-testing');
+    expect(biasRisk).toBeUndefined();
+  });
+
+  it('matches detected models to cards', () => {
+    const report = analyzeSupplyChain('/test', [], ['gpt-4o', 'claude-sonnet-4']);
+    expect(report.registryCards).toHaveLength(2);
+    expect(report.detectedModels).toEqual(['gpt-4o', 'claude-sonnet-4']);
+  });
+
+  it('flags GPAI systemic models as high risk', () => {
+    const report = analyzeSupplyChain('/test', [], ['gpt-4o']);
+    const systemicRisk = report.risks.find((r) => r.type === 'gpai-systemic');
+    expect(systemicRisk).toBeDefined();
+    expect(systemicRisk!.severity).toBe('high');
+    expect(systemicRisk!.articleRef).toBe('Art.51');
+  });
+
+  it('computes risk score correctly (capped at 100)', () => {
+    // 5 banned packages = 5 × 25 = 125 → capped at 100
+    const deps: ParsedDependency[] = [
+      { name: 'clearview-ai', version: '1.0', ecosystem: 'npm' },
+      { name: 'social-credit-score', version: '1.0', ecosystem: 'npm' },
+      { name: 'predictive-policing', version: '1.0', ecosystem: 'npm' },
+      { name: 'emotion-recognition', version: '1.0', ecosystem: 'npm' },
+      { name: 'subliminal-ai', version: '1.0', ecosystem: 'npm' },
+    ];
+    const report = analyzeSupplyChain('/test', deps, []);
+    expect(report.riskScore).toBe(100);
+  });
+
+  it('flags AI SDKs without registry cards', () => {
+    const deps: ParsedDependency[] = [
+      { name: 'replicate', version: '1.0.0', ecosystem: 'npm' },
+    ];
+    const report = analyzeSupplyChain('/test', deps, []);
+    const noCardRisk = report.risks.find((r) => r.type === 'ai-sdk-no-card');
+    expect(noCardRisk).toBeDefined();
+    expect(noCardRisk!.severity).toBe('low');
+    expect(noCardRisk!.packageName).toBe('replicate');
+  });
+});
+
+// --- Integration Tests ---
+
+describe('SupplyChain integration', () => {
+  it('report is frozen', () => {
+    const report = analyzeSupplyChain('/test', [], []);
+    expect(Object.isFrozen(report)).toBe(true);
+  });
+
+  it('obligation refs include OBL-026', () => {
+    const report = analyzeSupplyChain('/test', [], []);
+    expect(report.obligationRefs).toContain('OBL-026');
+    expect(report.obligationRefs).toContain('OBL-005');
+  });
+
+  it('report has valid structure', () => {
+    const deps: ParsedDependency[] = [
+      { name: 'openai', version: '4.0.0', ecosystem: 'npm' },
+    ];
+    const report = analyzeSupplyChain('/test', deps, ['gpt-4o']);
+    expect(report.projectPath).toBe('/test');
+    expect(report.timestamp).toBeTruthy();
+    expect(typeof report.duration).toBe('number');
+    expect(report.totalDependencies).toBe(1);
+    expect(report.aiSdkCount).toBe(1);
+    expect(report.registryCards.length).toBeGreaterThan(0);
+    expect(report.riskScore).toBeGreaterThanOrEqual(0);
+    expect(report.riskScore).toBeLessThanOrEqual(100);
+  });
+
+  it('SUPPLY_CHAIN_OBLIGATIONS is correct', () => {
+    expect(SUPPLY_CHAIN_OBLIGATIONS).toEqual(['OBL-026', 'OBL-005']);
+  });
+});

package/src/domain/supply-chain/types.ts

@@ -0,0 +1,32 @@
+import type { RegistryToolCard } from '../../data/registry-cards.js';
+
+export type SupplyChainRiskType =
+  | 'banned-package'
+  | 'ai-sdk-no-card'
+  | 'missing-bias-testing'
+  | 'gpai-systemic';
+
+export interface SupplyChainRisk {
+  readonly type: SupplyChainRiskType;
+  readonly severity: 'critical' | 'high' | 'medium' | 'low';
+  readonly packageName: string;
+  readonly packageVersion: string;
+  readonly ecosystem: string;
+  readonly description: string;
+  readonly articleRef: string;
+  readonly obligationId: string;
+}
+
+export interface SupplyChainReport {
+  readonly projectPath: string;
+  readonly timestamp: string;
+  readonly duration: number;
+  readonly totalDependencies: number;
+  readonly aiSdkCount: number;
+  readonly bannedCount: number;
+  readonly risks: readonly SupplyChainRisk[];
+  readonly riskScore: number;
+  readonly detectedModels: readonly string[];
+  readonly registryCards: readonly RegistryToolCard[];
+  readonly obligationRefs: readonly string[];
+}

package/src/domain/whatif/config-fixer.ts

@@ -0,0 +1,187 @@
+import type { OnboardingProfile } from '../../onboarding/profile.js';
+
+export interface GeneratedConfig {
+  readonly type: 'docker-compose' | 'env' | 'ci-cd';
+  readonly filename: string;
+  readonly content: string;
+  readonly description: string;
+  readonly changes: readonly string[];
+}
+
+export const generateDockerCompose = (profile: OnboardingProfile): GeneratedConfig => {
+  const services: string[] = [];
+  const changes: string[] = [];
+
+  services.push(`  app:
+    build: .
+    ports:
+      - "3000:3000"
+    environment:
+      - AI_DISCLOSURE_ENABLED=true
+      - AUDIT_LOG_ENABLED=true
+      - COMPLIANCE_MODE=strict
+    depends_on:
+      - audit-db`);
+  changes.push('App service with compliance environment variables');
+
+  services.push(`  audit-db:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_DB: complior_audit
+      POSTGRES_PASSWORD: \${AUDIT_DB_PASSWORD}
+    volumes:
+      - audit-data:/var/lib/postgresql/data`);
+  changes.push('Audit trail database (PostgreSQL)');
+
+  if (profile.computed.riskLevel === 'high') {
+    services.push(`  monitoring:
+    image: prom/prometheus:latest
+    ports:
+      - "9090:9090"
+    volumes:
+      - ./prometheus.yml:/etc/prometheus/prometheus.yml`);
+    changes.push('Monitoring service (Prometheus) for high-risk AI');
+  }
+
+  const content = `# Compliance-enhanced Docker Compose
+# Generated by Complior for ${profile.business.domain} domain (${profile.computed.riskLevel} risk)
+
+version: "3.9"
+
+services:
+${services.join('\n\n')}
+
+volumes:
+  audit-data:
+`;
+
+  return Object.freeze({
+    type: 'docker-compose',
+    filename: 'docker-compose.compliance.yml',
+    content,
+    description: `Docker Compose with compliance services for ${profile.computed.riskLevel} risk ${profile.business.domain} project`,
+    changes,
+  });
+};
+
+export const generateEnvExample = (profile: OnboardingProfile): GeneratedConfig => {
+  const lines: string[] = [
+    '# Compliance Environment Variables',
+    `# Generated by Complior for ${profile.business.domain} domain`,
+    '',
+    '# === AI Disclosure (Art. 50) ===',
+    'AI_DISCLOSURE_ENABLED=true',
+    'AI_DISCLOSURE_TEXT="This service uses artificial intelligence"',
+    '',
+    '# === Audit Logging (Art. 12) ===',
+    'AUDIT_LOG_ENABLED=true',
+    'AUDIT_LOG_RETENTION_DAYS=365',
+    'AUDIT_DB_PASSWORD=changeme',
+    '',
+    '# === Human Oversight (Art. 14) ===',
+    'HUMAN_ESCALATION_ENABLED=true',
+    'HUMAN_ESCALATION_THRESHOLD=0.7',
+  ];
+
+  const changes: string[] = ['AI disclosure toggle', 'Audit logging config', 'Human oversight threshold'];
+
+  if (profile.computed.riskLevel === 'high') {
+    lines.push(
+      '',
+      '# === High-Risk Monitoring (Art. 9) ===',
+      'MONITORING_ENDPOINT=http://localhost:9090',
+      'BIAS_TESTING_ENABLED=true',
+      'BIAS_TESTING_SCHEDULE=weekly',
+    );
+    changes.push('Monitoring endpoint', 'Bias testing schedule');
+  }
+
+  if (profile.data.types.includes('personal') || profile.data.types.includes('health')) {
+    lines.push(
+      '',
+      '# === Data Protection ===',
+      'DATA_RETENTION_DAYS=90',
+      'DATA_ENCRYPTION_AT_REST=true',
+      'DATA_ANONYMIZATION_ENABLED=true',
+    );
+    changes.push('Data protection settings');
+  }
+
+  return Object.freeze({
+    type: 'env',
+    filename: '.env.compliance.example',
+    content: lines.join('\n') + '\n',
+    description: 'Compliance environment variables with defaults',
+    changes,
+  });
+};
+
+export const generateCIWorkflow = (profile: OnboardingProfile): GeneratedConfig => {
+  const changes: string[] = ['Pre-push compliance scan', 'Weekly audit report'];
+
+  const content = `# Compliance CI/CD Workflow
+# Generated by Complior
+
+name: Compliance Check
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 9 * * 1'  # Weekly Monday 9am
+
+jobs:
+  compliance-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Complior
+        run: npm install -g complior
+
+      - name: Run Compliance Scan
+        run: complior scan --ci --threshold ${profile.computed.riskLevel === 'high' ? 70 : 50} --sarif results.sarif
+
+      - name: Upload SARIF
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif
+
+  weekly-audit:
+    if: github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Complior
+        run: npm install -g complior
+
+      - name: Generate Audit Report
+        run: complior scan --ci --json > audit-report.json
+
+      - name: Upload Report
+        uses: actions/upload-artifact@v4
+        with:
+          name: compliance-audit-\${{ github.run_number }}
+          path: audit-report.json
+`;
+
+  return Object.freeze({
+    type: 'ci-cd',
+    filename: '.github/workflows/compliance-check.yml',
+    content,
+    description: 'GitHub Actions workflow for compliance scanning and weekly audits',
+    changes,
+  });
+};
+
+export const generateAllConfigs = (profile: OnboardingProfile): readonly GeneratedConfig[] => {
+  return [
+    generateDockerCompose(profile),
+    generateEnvExample(profile),
+    generateCIWorkflow(profile),
+  ];
+};

package/src/domain/whatif/index.ts

@@ -0,0 +1,6 @@
+export { generateDockerCompose, generateEnvExample, generateCIWorkflow, generateAllConfigs } from './config-fixer.js';
+export type { GeneratedConfig } from './config-fixer.js';
+export { analyzeScenario } from './scenario-engine.js';
+export type { ScenarioType, WhatIfRequest, WhatIfResult } from './scenario-engine.js';
+export { simulateActions } from './simulate-actions.js';
+export type { SimulationAction, SimulationInput, SimulatedActionResult, SimulationResult } from './simulate-actions.js';

package/src/domain/whatif/scenario-engine.ts

@@ -0,0 +1,121 @@
+import type { OnboardingProfile } from '../../onboarding/profile.js';
+import type { ScoreBreakdown } from '../../types/common.types.js';
+
+export type ScenarioType = 'jurisdiction' | 'tool' | 'risk_level';
+
+export interface WhatIfRequest {
+  readonly type: ScenarioType;
+  readonly params: Record<string, string>;
+  readonly currentProfile: OnboardingProfile;
+  readonly currentScore: ScoreBreakdown;
+}
+
+export interface WhatIfResult {
+  readonly scenario: string;
+  readonly scoreDelta: number;
+  readonly projectedScore: number;
+  readonly newObligations: readonly string[];
+  readonly removedObligations: readonly string[];
+  readonly effort: {
+    readonly estimatedWeeks: number;
+    readonly keyTasks: readonly string[];
+  };
+  readonly recommendation: string;
+}
+
+const JURISDICTION_OBLIGATIONS: Record<string, { count: number; names: readonly string[] }> = {
+  UK: { count: 17, names: ['UK AI Safety registration', 'DSIT transparency guidance', 'Post-market monitoring (UK)'] },
+  US: { count: 8, names: ['State-level disclosure', 'FTC AI guidelines', 'Algorithmic accountability'] },
+  'US-CO': { count: 5, names: ['Colorado SB 205 disclosure', 'High-risk AI notice', 'Impact assessment'] },
+  'US-TX': { count: 4, names: ['Texas TRAIGA disclosure', 'AI inventory', 'Consumer notification'] },
+  KR: { count: 6, names: ['Korea AI Basic Act registration', 'Disclosure requirements', 'Risk assessment'] },
+};
+
+const TOOL_IMPACTS: Record<string, { scoreDelta: number; obligations: readonly string[] }> = {
+  whisper: { scoreDelta: -5, obligations: ['Audio data retention', 'Consent for audio', 'Transcription accuracy'] },
+  'dall-e': { scoreDelta: -8, obligations: ['Art. 50.2 content marking', 'C2PA metadata', 'Deepfake labeling'] },
+  elevenlabs: { scoreDelta: -10, obligations: ['Art. 50.4 deepfake disclosure', 'Voice cloning consent', 'Content marking'] },
+  stable_diffusion: { scoreDelta: -7, obligations: ['Content marking', 'Model card', 'GPAI transparency'] },
+  midjourney: { scoreDelta: -6, obligations: ['Art. 50.2 image marking', 'Watermark', 'Provenance metadata'] },
+};
+
+const RISK_LEVEL_CHANGES: Record<string, { scoreDelta: number; addedObligations: number; keyChanges: readonly string[] }> = {
+  'limited_to_high': { scoreDelta: -20, addedObligations: 25, keyChanges: ['Conformity assessment required', 'FRIA mandatory', 'Bias testing', 'QMS documentation', 'Post-market monitoring'] },
+  'minimal_to_limited': { scoreDelta: -10, addedObligations: 12, keyChanges: ['Art. 50 transparency', 'Disclosure to users', 'Content marking'] },
+  'high_to_limited': { scoreDelta: 15, addedObligations: -20, keyChanges: ['Conformity assessment no longer required', 'Reduced documentation', 'Simplified monitoring'] },
+  'limited_to_minimal': { scoreDelta: 8, addedObligations: -10, keyChanges: ['Minimal obligations only', 'No disclosure required'] },
+};
+
+export const analyzeScenario = (request: WhatIfRequest): WhatIfResult => {
+  const { type, params, currentProfile, currentScore } = request;
+  const baseScore = currentScore.totalScore;
+
+  if (type === 'jurisdiction') {
+    const newJurisdiction = params['jurisdiction'] ?? 'UK';
+    const impact = JURISDICTION_OBLIGATIONS[newJurisdiction] ?? { count: 5, names: ['Additional local requirements'] };
+    const scoreDelta = -Math.round(impact.count * 0.8);
+
+    return {
+      scenario: `Jurisdiction expansion: ${currentProfile.jurisdiction.primary} → ${currentProfile.jurisdiction.primary} + ${newJurisdiction}`,
+      scoreDelta,
+      projectedScore: Math.max(0, baseScore + scoreDelta),
+      newObligations: impact.names,
+      removedObligations: [],
+      effort: {
+        estimatedWeeks: Math.ceil(impact.count / 5),
+        keyTasks: impact.names.slice(0, 3),
+      },
+      recommendation: `Adding ${newJurisdiction} jurisdiction adds ~${impact.count} obligations. Estimated ${Math.ceil(impact.count / 5)} weeks for compliance.`,
+    };
+  }
+
+  if (type === 'tool') {
+    const toolName = params['tool']?.toLowerCase() ?? '';
+    const impact = TOOL_IMPACTS[toolName] ?? { scoreDelta: -3, obligations: ['Review compliance requirements for new tool'] };
+
+    return {
+      scenario: `Add AI tool: ${params['tool'] ?? 'unknown'}`,
+      scoreDelta: impact.scoreDelta,
+      projectedScore: Math.max(0, baseScore + impact.scoreDelta),
+      newObligations: impact.obligations,
+      removedObligations: [],
+      effort: {
+        estimatedWeeks: Math.ceil(impact.obligations.length / 2),
+        keyTasks: impact.obligations.slice(0, 3),
+      },
+      recommendation: `Adding ${params['tool'] ?? 'this tool'} requires ${impact.obligations.length} additional compliance measures.`,
+    };
+  }
+
+  if (type === 'risk_level') {
+    const from = currentProfile.computed.riskLevel;
+    const to = params['level'] ?? 'high';
+    const key = `${from}_to_${to}`;
+    const impact = RISK_LEVEL_CHANGES[key] ?? { scoreDelta: -10, addedObligations: 10, keyChanges: ['Review all obligations for new risk level'] };
+
+    return {
+      scenario: `Risk level change: ${from} → ${to}`,
+      scoreDelta: impact.scoreDelta,
+      projectedScore: Math.max(0, Math.min(100, baseScore + impact.scoreDelta)),
+      newObligations: impact.keyChanges.filter((_, i) => impact.addedObligations > 0 ? true : i >= Math.abs(impact.addedObligations)),
+      removedObligations: impact.addedObligations < 0 ? impact.keyChanges.slice(0, Math.abs(impact.addedObligations)) : [],
+      effort: {
+        estimatedWeeks: Math.abs(impact.addedObligations) > 15 ? 6 : 3,
+        keyTasks: impact.keyChanges.slice(0, 3),
+      },
+      recommendation: impact.scoreDelta < 0
+        ? `Upgrading to ${to} risk adds ${Math.abs(impact.addedObligations)} obligations. Score impact: ${impact.scoreDelta} points.`
+        : `Downgrading to ${to} risk removes ${Math.abs(impact.addedObligations)} obligations. Score improvement: +${impact.scoreDelta} points.`,
+    };
+  }
+
+  return {
+    scenario: 'Unknown scenario type',
+    scoreDelta: 0,
+    projectedScore: baseScore,
+    newObligations: [],
+    removedObligations: [],
+    effort: { estimatedWeeks: 0, keyTasks: [] },
+    recommendation: 'Unknown scenario type. Use "jurisdiction", "tool", or "risk_level".',
+  };
+};