@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/governance/improvement-recommendations.test.js

@@ -0,0 +1,178 @@
+/**
+ * RED-GREEN tests for F-NEW-PRODUCT-TRUST-IMPROVEMENT-RECOMMENDATIONS (W1.11).
+ *
+ * Validates the trademark three-axis remediation engine: every score-lowering
+ * finding (build / runtime / human) produces a structured Recommendation
+ * with actionable next-step pointer.
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-TRUST-IMPROVEMENT-RECOMMENDATIONS
+ */
+import { describe, it } from 'node:test';
+import * as assert from 'node:assert/strict';
+import { buildAxisRecommendations, runtimeAxisRecommendations, humanAxisRecommendations, buildRecommendationSet, } from './improvement-recommendations.js';
+import { scanAgent } from './owasp-agentic-scanner.js';
+const baseManifest = (over = {}) => ({
+    agentId: 'agent-x',
+    tools: [],
+    hooks: { preToolUse: true, postToolUse: true, postResponse: true },
+    llmProvider: 'connexum-proxy/anthropic',
+    pluginIntegrityVerified: true,
+    rateLimitsConfigured: true,
+    declaredApprovalGates: [],
+    declaredForbiddenCapabilities: [],
+    ...over,
+});
+describe('F-NEW-PRODUCT-TRUST-IMPROVEMENT-RECOMMENDATIONS (W1.11)', () => {
+    it('build axis: every OWASP finding becomes a build-axis Recommendation', () => {
+        const scan = scanAgent(baseManifest({ tools: ['WebFetch', 'Bash'] }));
+        const recs = buildAxisRecommendations('agent-x', scan);
+        assert.ok(recs.length > 0);
+        assert.ok(recs.every((r) => r.axis === 'build'));
+        assert.ok(recs.every((r) => r.actionHint.length > 0));
+        assert.ok(recs.every((r) => r.sourceRef.startsWith('owasp:')));
+    });
+    it('build axis: A01 Lethal Trifecta maps to enable-isolation kind', () => {
+        const scan = scanAgent(baseManifest({ tools: ['WebFetch', 'Bash'] }));
+        const recs = buildAxisRecommendations('agent-x', scan);
+        const trifecta = recs.find((r) => /Lethal Trifecta/.test(r.headline));
+        assert.ok(trifecta);
+        assert.equal(trifecta.kind, 'enable-isolation');
+    });
+    it('build axis: A05 plugin integrity maps to verify-plugin-integrity', () => {
+        const scan = scanAgent(baseManifest({ pluginIntegrityVerified: false }));
+        const recs = buildAxisRecommendations('agent-x', scan);
+        const a05 = recs.find((r) => r.sourceRef.includes('A05'));
+        assert.ok(a05);
+        assert.equal(a05.kind, 'verify-plugin-integrity');
+    });
+    it('build axis: A06 LLM-not-via-proxy maps to swap-provider', () => {
+        const scan = scanAgent(baseManifest({ llmProvider: 'anthropic/claude-direct' }));
+        const recs = buildAxisRecommendations('agent-x', scan);
+        const a06 = recs.find((r) => r.sourceRef.includes('A06'));
+        assert.ok(a06);
+        assert.equal(a06.kind, 'swap-provider');
+    });
+    it('runtime axis: regulatory denial with citation maps to cite-regulatory-clause', () => {
+        const recs = runtimeAxisRecommendations('agent-x', [
+            {
+                packId: 'hipaa',
+                checkId: 'phi-recipient',
+                severity: 'CRIT',
+                citation: 'HIPAA 164.502(e)',
+                toolName: 'email_send',
+                reason: 'PHI cannot flow to non-BAA recipient',
+            },
+        ]);
+        assert.equal(recs.length, 1);
+        assert.equal(recs[0].kind, 'cite-regulatory-clause');
+        assert.match(recs[0].actionHint, /HIPAA 164.502\(e\)/);
+        assert.equal(recs[0].axis, 'runtime');
+    });
+    it('runtime axis: pack denial without citation maps to add-pack-rule', () => {
+        const recs = runtimeAxisRecommendations('agent-x', [
+            {
+                packId: 'company-pack-1',
+                checkId: 'capability:mcp',
+                severity: 'HIGH',
+                toolName: 'mcp__list_resources',
+                reason: 'capability forbidden by org-baseline rule',
+            },
+        ]);
+        assert.equal(recs[0].kind, 'add-pack-rule');
+    });
+    it('human axis: PHI ingestion maps to assign-training with hipaa-phi-awareness id', () => {
+        const recs = humanAxisRecommendations('agent-x', [
+            {
+                operatorId: 'user-bob',
+                kind: 'phi-ingestion',
+                severity: 'HIGH',
+                count: 7,
+                windowLabel: '30d',
+            },
+        ]);
+        assert.equal(recs.length, 1);
+        assert.equal(recs[0].axis, 'human');
+        assert.equal(recs[0].kind, 'assign-training');
+        assert.match(recs[0].actionHint, /training:hipaa-phi-awareness/);
+        assert.match(recs[0].actionHint, /user-bob/);
+    });
+    it('human axis: all five drift kinds map to distinct training topics', () => {
+        const kinds = [
+            'phi-ingestion',
+            'out-of-scope-prompt',
+            'override-abuse',
+            'repeated-denial-bypass',
+            'low-review-responsiveness',
+        ];
+        const recs = humanAxisRecommendations('agent-x', kinds.map((k) => ({
+            operatorId: 'user-bob',
+            kind: k,
+            severity: 'MED',
+            count: 1,
+        })));
+        const trainingIds = new Set(recs.map((r) => {
+            const m = r.actionHint.match(/training:[A-Za-z0-9-]+/);
+            return m?.[0] ?? '';
+        }));
+        assert.equal(trainingIds.size, 5);
+    });
+    it('buildRecommendationSet combines all three axes', () => {
+        const scan = scanAgent(baseManifest({ tools: ['Bash'] }));
+        const set = buildRecommendationSet({
+            agentId: 'agent-x',
+            buildScan: scan,
+            runtimeFindings: [
+                {
+                    packId: 'hipaa',
+                    checkId: 'phi-recipient',
+                    severity: 'CRIT',
+                    citation: 'HIPAA 164.502(e)',
+                    toolName: 'email_send',
+                    reason: 'PHI denied',
+                },
+            ],
+            humanFindings: [
+                { operatorId: 'user-bob', kind: 'phi-ingestion', severity: 'HIGH', count: 5 },
+            ],
+        });
+        assert.ok(set.countsByAxis.build > 0);
+        assert.ok(set.countsByAxis.runtime > 0);
+        assert.ok(set.countsByAxis.human > 0);
+        assert.ok(set.potentialScoreGain > 0);
+        assert.ok(set.potentialScoreGain <= 100);
+    });
+    it('buildRecommendationSet potentialScoreGain weights by severity', () => {
+        const critOnly = buildRecommendationSet({
+            agentId: 'agent-x',
+            runtimeFindings: [
+                {
+                    packId: 'p1',
+                    checkId: 'x',
+                    severity: 'CRIT',
+                    toolName: 'x',
+                    reason: 'r',
+                },
+            ],
+        });
+        const lowOnly = buildRecommendationSet({
+            agentId: 'agent-x',
+            runtimeFindings: [
+                {
+                    packId: 'p1',
+                    checkId: 'x',
+                    severity: 'LOW',
+                    toolName: 'x',
+                    reason: 'r',
+                },
+            ],
+        });
+        assert.ok(critOnly.potentialScoreGain > lowOnly.potentialScoreGain);
+    });
+    it('empty input set returns zero counts and gain', () => {
+        const set = buildRecommendationSet({ agentId: 'agent-x' });
+        assert.equal(set.recommendations.length, 0);
+        assert.deepEqual(set.countsByAxis, { build: 0, runtime: 0, human: 0 });
+        assert.equal(set.potentialScoreGain, 0);
+    });
+});
+//# sourceMappingURL=improvement-recommendations.test.js.map

package/dist/esm/governance/improvement-recommendations.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"improvement-recommendations.test.js","sourceRoot":"","sources":["../../../src/governance/improvement-recommendations.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAC;AAE7C,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,SAAS,EAAsB,MAAM,yBAAyB,CAAC;AAExE,MAAM,YAAY,GAAG,CAAC,OAA+B,EAAE,EAAiB,EAAE,CAAC,CAAC;IAC1E,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,EAAE;IACT,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;IAClE,WAAW,EAAE,0BAA0B;IACvC,uBAAuB,EAAE,IAAI;IAC7B,oBAAoB,EAAE,IAAI;IAC1B,qBAAqB,EAAE,EAAE;IACzB,6BAA6B,EAAE,EAAE;IACjC,GAAG,IAAI;CACR,CAAC,CAAC;AAEH,QAAQ,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACvE,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,wBAAwB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QACtD,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,wBAAwB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,QAAS,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,CAAC,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,wBAAwB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,GAAI,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;QACjF,MAAM,IAAI,GAAG,wBAAwB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,GAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,MAAM,IAAI,GAAG,0BAA0B,CAAC,SAAS,EAAE;YACjD;gBACE,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,eAAe;gBACxB,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,kBAAkB;gBAC5B,QAAQ,EAAE,YAAY;gBACtB,MAAM,EAAE,sCAAsC;aAC/C;SACF,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,IAAI,GAAG,0BAA0B,CAAC,SAAS,EAAE;YACjD;gBACE,MAAM,EAAE,gBAAgB;gBACxB,OAAO,EAAE,gBAAgB;gBACzB,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,qBAAqB;gBAC/B,MAAM,EAAE,2CAA2C;aACpD;SACF,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,IAAI,GAAG,wBAAwB,CAAC,SAAS,EAAE;YAC/C;gBACE,UAAU,EAAE,UAAU;gBACtB,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC;gBACR,WAAW,EAAE,KAAK;aACnB;SACF,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC;QACjE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,KAAK,GAAG;YACZ,eAAe;YACf,qBAAqB;YACrB,gBAAgB;YAChB,wBAAwB;YACxB,2BAA2B;SACnB,CAAC;QACX,MAAM,IAAI,GAAG,wBAAwB,CACnC,SAAS,EACT,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChB,UAAU,EAAE,UAAU;YACtB,IAAI,EAAE,CAAC;YACP,QAAQ,EAAE,KAAc;YACxB,KAAK,EAAE,CAAC;SACT,CAAC,CAAC,CACJ,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACb,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;YACvD,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CACH,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,sBAAsB,CAAC;YACjC,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,IAAI;YACf,eAAe,EAAE;gBACf;oBACE,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE,eAAe;oBACxB,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,kBAAkB;oBAC5B,QAAQ,EAAE,YAAY;oBACtB,MAAM,EAAE,YAAY;iBACrB;aACF;YACD,aAAa,EAAE;gBACb,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE;aAC9E;SACF,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,kBAAkB,GAAG,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,kBAAkB,IAAI,GAAG,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,QAAQ,GAAG,sBAAsB,CAAC;YACtC,OAAO,EAAE,SAAS;YAClB,eAAe,EAAE;gBACf;oBACE,MAAM,EAAE,IAAI;oBACZ,OAAO,EAAE,GAAG;oBACZ,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,GAAG;oBACb,MAAM,EAAE,GAAG;iBACZ;aACF;SACF,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,sBAAsB,CAAC;YACrC,OAAO,EAAE,SAAS;YAClB,eAAe,EAAE;gBACf;oBACE,MAAM,EAAE,IAAI;oBACZ,OAAO,EAAE,GAAG;oBACZ,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,GAAG;oBACb,MAAM,EAAE,GAAG;iBACZ;aACF;SACF,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,GAAG,GAAG,sBAAsB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/esm/governance/incident-notifier.js

@@ -0,0 +1,488 @@
+/**
+ * IncidentNotifier -- Compliance-driven incident notification system.
+ *
+ * Manages incident classification, deadline tracking, and notification
+ * delivery for regulatory compliance.
+ *
+ * Regulatory deadlines:
+ *   - DORA: 4 hours for major ICT incidents (Art. 19)
+ *   - GDPR: 72 hours for personal data breaches (Art. 33)
+ *   - HIPAA: 60 days for breach notification (45 CFR 164.404)
+ *   - PCI DSS: Immediate for suspected compromise
+ *   - SOC 2: Per customer SLA (typically 24-72 hours)
+ *
+ * @connexum/ai-governance
+ */
+import * as crypto from 'crypto';
+import { ensureDir, appendJsonl, saveJson, loadJson } from '../util/fs.js';
+import { createLogger } from '../util/log.js';
+import * as path from 'path';
+const log = createLogger('incident-notifier');
+/**
+ * HL-1: Thrown when the incident notifier finds zero packs loaded and
+ * therefore cannot derive a compliant fallback category list.
+ *
+ * Failing closed here is intentional: an incident notifier with no pack
+ * context should not silently downgrade severity by guessing categories.
+ * The operator must ensure packs are loaded before incidents are classified.
+ *
+ * Reference: W1 directive (Thomas, 2026-04-24): runtime must read from packs,
+ * not from hardcoded lists.
+ */
+export class NoPacksLoadedError extends Error {
+    constructor() {
+        super('IncidentNotifier: no compliance packs are loaded in the PackDrivenClassifier registry. ' +
+            'Cannot derive blocking category list for severity classification. ' +
+            'Ensure packs are loaded via PackDrivenClassifier.loadFromPacks() before classifying incidents. ' +
+            '(HL-1: hardcoded fallback removed; fail-closed policy.)');
+        this.name = 'NoPacksLoadedError';
+    }
+}
+/**
+ * Deadline rules per framework (hours from discovery).
+ *
+ * F-NEW-MED-15 (2026-05-02): pre-fix this was a hardcoded map of 6
+ * frameworks while every pack declares its own
+ * `incidentPolicy.notificationDeadlineHours`. Only HIPAA/DORA/GDPR/PCI
+ * DSS/SOC 2/FERPA had wired deadlines; the other 93 packs' declared
+ * deadlines were dead data on this code path.
+ *
+ * Now derived from PackDrivenClassifier registry at lookup time. The
+ * legacy values below remain only as a hard fallback for packs that
+ * are not in the registry (e.g., test stubs without a registered pack
+ * binding). Real customer code paths read from pack metadata.
+ */
+const LEGACY_DEADLINE_RULES = {
+    dora: 4,
+    'pci-dss': 1,
+    'soc2': 24,
+    gdpr: 72,
+    hipaa: 1440,
+    ferpa: 720,
+};
+/**
+ * Resolve a framework's notification deadline in hours.
+ *
+ * Resolution order:
+ *   1. Caller-supplied packDeadlinesByFramework (built from
+ *      pack.incidentPolicy.notificationDeadlineHours by the gov-server)
+ *   2. Legacy hardcoded map (backward-compat for the 6 originally-wired
+ *      frameworks: dora/pci-dss/soc2/gdpr/hipaa/ferpa)
+ *   3. undefined (caller should treat as "no deadline")
+ *
+ * Method on the class to access the per-instance config.
+ */
+function resolveDeadlineHoursFor(framework, packDeadlines) {
+    const key = framework.toLowerCase();
+    if (packDeadlines && typeof packDeadlines[key] === 'number' && packDeadlines[key] > 0) {
+        return packDeadlines[key];
+    }
+    return LEGACY_DEADLINE_RULES[key];
+}
+// ---------------------------------------------------------------------------
+// W1 residual: industry-tag to severity-label derivation
+//
+// Severity labels are derived from CompliancePack.industries[] at incident
+// classification time. No category strings (PHI, PII, GDPR, etc.) appear
+// here -- all classification is driven by the pack registry.
+//
+// Maps each industry tag substring (lowercase) to one or more severity label
+// buckets. The match is prefix/contains so that e.g. 'health-it' and
+// 'telehealth' both map to HEALTHCARE.
+// ---------------------------------------------------------------------------
+/**
+ * Each entry: [industryTagSubstring, severityLabel].
+ * Evaluated in order; a single industry tag can trigger multiple labels.
+ * Substrings are matched case-insensitively against the pack's declared
+ * industries array entries.
+ */
+const INDUSTRY_LABEL_RULES = [
+    // Healthcare
+    ['healthcare', 'HEALTHCARE'],
+    ['health-it', 'HEALTHCARE'],
+    ['telehealth', 'HEALTHCARE'],
+    ['pharma', 'HEALTHCARE'],
+    ['clinical-research', 'HEALTHCARE'],
+    ['ehr-vendor', 'HEALTHCARE'],
+    ['biotech', 'HEALTHCARE'],
+    ['medical', 'HEALTHCARE'],
+    ['business-associates', 'HEALTHCARE'],
+    // Education
+    ['edtech', 'EDUCATION'],
+    ['education', 'EDUCATION'],
+    ['k12', 'EDUCATION'],
+    ['higher-education', 'EDUCATION'],
+    ['learning-management', 'EDUCATION'],
+    ['student-information', 'EDUCATION'],
+    // Financial
+    ['banking', 'FINANCIAL'],
+    ['bank', 'FINANCIAL'],
+    ['fintech', 'FINANCIAL'],
+    ['payments', 'FINANCIAL'],
+    ['insurance', 'FINANCIAL'],
+    ['mortgage', 'FINANCIAL'],
+    ['credit', 'FINANCIAL'],
+    ['investment', 'FINANCIAL'],
+    ['broker-dealer', 'FINANCIAL'],
+    ['asset-management', 'FINANCIAL'],
+    ['clearing-house', 'FINANCIAL'],
+    ['finance', 'FINANCIAL'],
+    ['money-transmitter', 'FINANCIAL'],
+    ['virtual-currency', 'FINANCIAL'],
+    ['ecommerce', 'FINANCIAL'],
+    ['trading', 'FINANCIAL'],
+    ['crypto', 'FINANCIAL'],
+    // Government / Defense
+    ['government', 'GOVERNMENT'],
+    ['federal', 'GOVERNMENT'],
+    ['govtech', 'GOVERNMENT'],
+    ['law-enforcement', 'GOVERNMENT'],
+    ['defense', 'GOVERNMENT'],
+    ['public-safety', 'GOVERNMENT'],
+    ['courts', 'GOVERNMENT'],
+    ['corrections', 'GOVERNMENT'],
+    ['criminal-justice', 'GOVERNMENT'],
+    ['aerospace', 'GOVERNMENT'],
+    ['government-contractor', 'GOVERNMENT'],
+    // Legal
+    ['legal', 'LEGAL'],
+    ['law-firm', 'LEGAL'],
+    ['ediscovery', 'LEGAL'],
+    ['legal-ops', 'LEGAL'],
+    ['legal-tech', 'LEGAL'],
+    // Privacy (packs that apply cross-industry for privacy regulation)
+    ['all-eu', 'PRIVACY'],
+    ['all-ca', 'PRIVACY'],
+    ['adtech', 'PRIVACY'],
+    ['hr-tech', 'PRIVACY'],
+    ['any-collecting-biometric', 'PRIVACY'],
+    ['biometric', 'PRIVACY'],
+    ['consumer-reporting-agency', 'PRIVACY'],
+    ['tenant-screening', 'PRIVACY'],
+    ['employer', 'PRIVACY'],
+];
+/**
+ * Derive a set of human-readable severity labels from the pack IDs that
+ * produced blocking-category matches on an incident.
+ *
+ * Each matched pack contributes its declared industries[] to the label
+ * derivation. The result is the union of all labels that any matched pack's
+ * industries trigger via INDUSTRY_LABEL_RULES.
+ *
+ * W1 directive: no category name strings (PHI, PII, GDPR, ...) appear in
+ * this function. The pack's own metadata drives the output.
+ *
+ * @param matchedPackIds - Pack IDs whose categories matched (BLOCK or above).
+ * @param getIndustries  - Lookup function: packId -> industries[]. Supplied
+ *                         by the caller from PackDrivenClassifier.getPackIndustries().
+ */
+export function deriveSeverityLabels(matchedPackIds, getIndustries) {
+    const labels = new Set();
+    for (const packId of matchedPackIds) {
+        const industries = getIndustries(packId);
+        for (const industry of industries) {
+            const lower = industry.toLowerCase();
+            for (const [tag, label] of INDUSTRY_LABEL_RULES) {
+                if (lower.includes(tag)) {
+                    labels.add(label);
+                }
+            }
+        }
+    }
+    return labels;
+}
+export class IncidentNotifier {
+    config;
+    incidents = new Map();
+    incidentFile;
+    constructor(config) {
+        this.config = {
+            webhooks: { CRITICAL: [], HIGH: [], MEDIUM: [], LOW: [] },
+            activeFrameworks: [],
+            notificationEmail: '',
+            packDeadlinesByFramework: {},
+            ...config,
+        };
+        ensureDir(config.incidentDir);
+        this.incidentFile = path.join(config.incidentDir, 'incidents.json');
+        this.loadIncidents();
+    }
+    /**
+     * Classify an incident based on data types, volume, and cause.
+     */
+    classify(params) {
+        const reasons = [];
+        let severity = 'LOW';
+        // Data type escalation.
+        // W1: Instead of hardcoding 'PHI', consult the PackDrivenClassifier registry to
+        // determine which category IDs are declared by active packs with BLOCK action.
+        // Fallback to structural heuristics when no packs are loaded.
+        const { getGlobalClassifier } = require('../classification/pack-driven-classifier');
+        const pdClassifier = getGlobalClassifier();
+        // Build blockingEntries (category + pack pairs) so we can derive severity labels
+        // from the packs that contributed BLOCK-level categories.
+        const blockingEntries = pdClassifier.listRegisteredEntries().filter(e => e.action === 'BLOCK');
+        const blockingCategories = new Set(blockingEntries.map(e => e.categoryId.toUpperCase()));
+        // HL-1: If no packs are loaded, fail closed with NoPacksLoadedError.
+        // Hardcoded fallback list removed per W1 directive (Thomas, 2026-04-24):
+        // the runtime must read from packs, not from hardcoded constants.
+        // If blockingCategories is empty here, it signals a configuration error
+        // (packs were not loaded before the incident notifier was called), not a
+        // situation that should be silently papered over with hardcoded strings.
+        if (blockingCategories.size === 0) {
+            throw new NoPacksLoadedError();
+        }
+        // W1 residual (2026-04-24): hasPHI is now purely pack-driven.
+        // Any category that a loaded pack declared with BLOCK action counts as PHI-tier.
+        // Hardcoded category name strings removed per W1 directive; pack registry drives all detection.
+        const hasPHI = params.dataTypes.some(d => blockingCategories.has(d.toUpperCase()));
+        // W1 residual (2026-04-24): hasPII is now pack-driven via WARN-or-above categories.
+        // Any category that a loaded pack declared with WARN or stricter action counts as
+        // PII-tier (lower severity than BLOCK). Hardcoded category name strings removed per W1 directive.
+        const warnOrAboveCategories = new Set(pdClassifier.listCategoriesByMinAction('WARN').map(e => e.categoryId.toUpperCase()));
+        const hasPII = params.dataTypes.some(d => warnOrAboveCategories.has(d.toUpperCase()));
+        // W1 residual: collect pack IDs whose BLOCK categories matched the incident's
+        // data types. These are used to derive the human-readable severity label set
+        // via the pack's declared industries[].
+        const matchedPackIds = new Set();
+        for (const dataType of params.dataTypes) {
+            for (const entry of blockingEntries) {
+                if (entry.categoryId.toUpperCase() === dataType.toUpperCase()) {
+                    matchedPackIds.add(entry.packId);
+                }
+            }
+        }
+        // Also include packs whose WARN-or-above categories matched, so PII-type
+        // packs (GDPR, CCPA etc.) contribute their labels even when action < BLOCK.
+        const warnOrAboveEntries = pdClassifier.listCategoriesByMinAction('WARN');
+        for (const dataType of params.dataTypes) {
+            for (const entry of warnOrAboveEntries) {
+                if (entry.categoryId.toUpperCase() === dataType.toUpperCase()) {
+                    matchedPackIds.add(entry.packId);
+                }
+            }
+        }
+        const severityLabelSet = deriveSeverityLabels(matchedPackIds, (packId) => pdClassifier.getPackIndustries(packId));
+        const hasPAN = params.dataTypes.some(d => ['PAN', 'CREDIT_CARD', 'PCI'].includes(d.toUpperCase()));
+        const hasCredentials = params.dataTypes.some(d => ['CREDENTIALS', 'API_KEY', 'SECRET'].includes(d.toUpperCase()));
+        if (hasPHI) {
+            severity = 'CRITICAL';
+            reasons.push('Protected Health Information (PHI) involved');
+        }
+        if (hasPAN) {
+            severity = 'CRITICAL';
+            reasons.push('Payment card data (PAN) involved');
+        }
+        if (hasCredentials) {
+            severity = severity === 'CRITICAL' ? 'CRITICAL' : 'HIGH';
+            reasons.push('Credentials or API keys exposed');
+        }
+        if (hasPII) {
+            severity = severity === 'LOW' ? 'MEDIUM' : severity;
+            reasons.push('Personal Identifiable Information (PII) involved');
+        }
+        // Volume escalation
+        if (params.recordsAffected > 500) {
+            if (severity === 'LOW')
+                severity = 'MEDIUM';
+            if (severity === 'MEDIUM')
+                severity = 'HIGH';
+            reasons.push(`High volume: ${params.recordsAffected} records affected`);
+        }
+        if (params.recordsAffected > 5000) {
+            severity = 'CRITICAL';
+            reasons.push(`Mass breach: ${params.recordsAffected} records affected`);
+        }
+        // Cause escalation
+        const maliciousCauses = ['attack', 'exploit', 'injection', 'unauthorized', 'tamper', 'exfiltration'];
+        if (maliciousCauses.some(c => params.cause.toLowerCase().includes(c))) {
+            if (severity === 'LOW')
+                severity = 'HIGH';
+            reasons.push(`Potentially malicious cause: ${params.cause}`);
+        }
+        // Multi-agent escalation
+        if (params.affectedAgents.length > 3) {
+            if (severity === 'LOW')
+                severity = 'MEDIUM';
+            reasons.push(`Multiple agents affected: ${params.affectedAgents.length}`);
+        }
+        // Calculate deadlines
+        const now = new Date();
+        const deadlines = {};
+        for (const framework of this.config.activeFrameworks) {
+            const hours = resolveDeadlineHoursFor(framework, this.config.packDeadlinesByFramework);
+            if (hours !== undefined) {
+                const deadline = new Date(now.getTime() + hours * 3600000);
+                deadlines[framework] = {
+                    framework,
+                    hoursFromDiscovery: hours,
+                    deadline: deadline.toISOString(),
+                };
+            }
+        }
+        return {
+            severity,
+            reasons,
+            deadlines,
+            requiresImmediateAction: severity === 'CRITICAL' || Object.keys(deadlines).some(k => {
+                const h = resolveDeadlineHoursFor(k, this.config.packDeadlinesByFramework);
+                return h !== undefined && h <= 4;
+            }),
+            // W1 residual: labels derived from pack.industries, not from hardcoded strings.
+            severityLabels: Array.from(severityLabelSet),
+        };
+    }
+    /**
+     * Create a new incident.
+     */
+    create(params) {
+        const classification = this.classify(params);
+        const now = new Date().toISOString();
+        const incident = {
+            id: `INC-${Date.now()}-${crypto.randomBytes(3).toString('hex')}`,
+            title: params.title,
+            description: params.description,
+            severity: classification.severity,
+            status: 'open',
+            dataTypes: params.dataTypes,
+            recordsAffected: params.recordsAffected,
+            affectedAgents: params.affectedAgents,
+            cause: params.cause,
+            discoveredAt: params.discoveredAt || now,
+            createdAt: now,
+            deadlines: {},
+            notifications: [],
+            timeline: [{
+                    timestamp: now,
+                    action: 'created',
+                    actor: 'system',
+                    detail: `Severity: ${classification.severity}. ${classification.reasons.join('; ')}`,
+                }],
+        };
+        // Set deadlines
+        for (const [framework, dl] of Object.entries(classification.deadlines)) {
+            incident.deadlines[framework] = dl.deadline;
+        }
+        this.incidents.set(incident.id, incident);
+        this.saveIncidents();
+        log.warn(`Incident created: ${incident.id} [${incident.severity}] ${incident.title}`, {
+            severity: incident.severity,
+            dataTypes: incident.dataTypes,
+            deadlines: incident.deadlines,
+        });
+        // Log notification record
+        this.logNotification(incident.id, 'system-log', 'audit-trail', 'sent');
+        return incident;
+    }
+    /**
+     * Update incident status.
+     */
+    updateStatus(incidentId, status, actor, detail) {
+        const incident = this.incidents.get(incidentId);
+        if (!incident)
+            throw new Error(`Incident ${incidentId} not found`);
+        incident.status = status;
+        incident.timeline.push({
+            timestamp: new Date().toISOString(),
+            action: `status_change:${status}`,
+            actor,
+            detail,
+        });
+        this.saveIncidents();
+        return incident;
+    }
+    /**
+     * Get an incident by ID.
+     */
+    get(incidentId) {
+        return this.incidents.get(incidentId) || null;
+    }
+    /**
+     * Get all open incidents.
+     */
+    getOpen() {
+        return Array.from(this.incidents.values())
+            .filter(i => i.status !== 'closed' && i.status !== 'resolved');
+    }
+    /**
+     * Get incidents with approaching or breached deadlines.
+     */
+    getUrgent(withinHours = 4) {
+        const cutoff = new Date(Date.now() + withinHours * 3600000).toISOString();
+        return this.getOpen().filter(incident => {
+            return Object.values(incident.deadlines).some(deadline => deadline <= cutoff);
+        });
+    }
+    /**
+     * Check if any deadlines have been breached.
+     */
+    getBreachedDeadlines() {
+        const now = new Date().toISOString();
+        const breached = [];
+        for (const incident of this.getOpen()) {
+            for (const [framework, deadline] of Object.entries(incident.deadlines)) {
+                if (deadline < now) {
+                    breached.push({ incident, framework, deadline });
+                }
+            }
+        }
+        return breached;
+    }
+    /**
+     * Get incident statistics.
+     */
+    getStats() {
+        const all = Array.from(this.incidents.values());
+        const open = all.filter(i => i.status !== 'closed' && i.status !== 'resolved');
+        return {
+            total: all.length,
+            open: open.length,
+            bySeverity: {
+                CRITICAL: all.filter(i => i.severity === 'CRITICAL').length,
+                HIGH: all.filter(i => i.severity === 'HIGH').length,
+                MEDIUM: all.filter(i => i.severity === 'MEDIUM').length,
+                LOW: all.filter(i => i.severity === 'LOW').length,
+            },
+            breachedDeadlines: this.getBreachedDeadlines().length,
+        };
+    }
+    // --- Private ---
+    logNotification(incidentId, channel, recipient, status) {
+        const incident = this.incidents.get(incidentId);
+        if (!incident)
+            return;
+        incident.notifications.push({
+            timestamp: new Date().toISOString(),
+            channel,
+            recipient,
+            status,
+        });
+        // Also log to JSONL for audit trail
+        const logFile = path.join(this.config.incidentDir, 'notifications.jsonl');
+        appendJsonl(logFile, {
+            timestamp: new Date().toISOString(),
+            incidentId,
+            channel,
+            recipient,
+            status,
+        });
+    }
+    saveIncidents() {
+        try {
+            const data = Array.from(this.incidents.values());
+            saveJson(this.incidentFile, data);
+        }
+        catch (err) {
+            log.critical(`Failed to save incidents: ${err.message}`);
+        }
+    }
+    loadIncidents() {
+        const data = loadJson(this.incidentFile);
+        if (data && Array.isArray(data)) {
+            for (const incident of data) {
+                this.incidents.set(incident.id, incident);
+            }
+        }
+    }
+}
+//# sourceMappingURL=incident-notifier.js.map