@connexum/ai-governance 1.0.0-beta.11

package/dist/governance/improvement-recommendations.js

@@ -0,0 +1,171 @@
+"use strict";
+/**
+ * Improvement Recommendations Engine (W1.11 / Trademark axis-1, axis-2, axis-3
+ * remediations of F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12).
+ *
+ * Thomas Layer 0 2026-05-12 (trademark commitment): "anything that brings a
+ * score down will be sent back to the user to help them improve — whether
+ * it's training for humans because they are consistently putting PHI into
+ * it or the actual build of an agent itself. We give criteria."
+ *
+ * Maps findings from each of the three trust-score axes into a unified
+ * Recommendation shape with axis-specific remediation types:
+ *
+ *   Build axis (W1.8)        OWASP Agentic findings -> wire-hook /
+ *                            verify-plugin-integrity / swap-provider /
+ *                            reduce-blast-radius / add-pack-rule
+ *   Runtime axis (W3.4)      regulatory pack denial / approval-required ->
+ *                            add-pack-rule / cite-clause
+ *   Human axis (W3.4)        recurring operator-side drift (e.g. PHI
+ *                            ingestion) -> assign-training
+ *
+ * Pure helpers; no IO. The dashboard layer surfaces these as the "How to
+ * improve your trust score" feature.
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-TRUST-IMPROVEMENT-RECOMMENDATIONS
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAxisRecommendations = buildAxisRecommendations;
+exports.runtimeAxisRecommendations = runtimeAxisRecommendations;
+exports.humanAxisRecommendations = humanAxisRecommendations;
+exports.buildRecommendationSet = buildRecommendationSet;
+const SEVERITY_GAIN = {
+    LOW: 8,
+    MED: 16,
+    HIGH: 32,
+    CRIT: 50,
+};
+function owaspFindingToRecommendation(f, agentId) {
+    // Map OWASP risk classes to specific remediation kinds.
+    let kind = 'add-pack-rule';
+    if (f.risk.startsWith('A01')) {
+        kind = /PreToolUse/.test(f.title) ? 'wire-hook' : 'enable-isolation';
+    }
+    else if (f.risk.startsWith('A02')) {
+        kind = 'wire-hook';
+    }
+    else if (f.risk.startsWith('A03')) {
+        kind = 'wire-hook';
+    }
+    else if (f.risk.startsWith('A04')) {
+        kind = 'reduce-blast-radius';
+    }
+    else if (f.risk.startsWith('A05')) {
+        kind = 'verify-plugin-integrity';
+    }
+    else if (f.risk.startsWith('A06')) {
+        kind = 'swap-provider';
+    }
+    else if (f.risk.startsWith('A07')) {
+        kind = 'verify-plugin-integrity';
+    }
+    else if (f.risk.startsWith('A08')) {
+        kind = 'add-pack-rule';
+    }
+    else if (f.risk.startsWith('A09')) {
+        kind = 'add-pack-rule';
+    }
+    return {
+        axis: 'build',
+        severity: f.severity,
+        kind,
+        headline: f.title,
+        detail: f.detail,
+        actionHint: f.remediation,
+        sourceRef: `owasp:${f.risk}:${agentId}`,
+    };
+}
+/**
+ * Synthesize recommendations from an OWASP scan report (build axis).
+ */
+function buildAxisRecommendations(agentId, scan) {
+    return scan.findings.map((f) => owaspFindingToRecommendation(f, agentId));
+}
+/**
+ * Synthesize recommendations from runtime denials / approval-required events
+ * (runtime axis). Each input -> one Recommendation with add-pack-rule or
+ * cite-regulatory-clause depending on whether a citation is present.
+ */
+function runtimeAxisRecommendations(agentId, findings) {
+    return findings.map((f) => ({
+        axis: 'runtime',
+        severity: f.severity,
+        kind: f.citation ? 'cite-regulatory-clause' : 'add-pack-rule',
+        headline: `Pack ${f.packId} denied ${f.toolName}`,
+        detail: f.reason,
+        actionHint: f.citation
+            ? `Pack ${f.packId} cites ${f.citation}. Review the agent's tool inventory or apply an override (with employee approval) per F-NEW-PRODUCT-PER-AGENT-OVERRIDE-AUTHORITY.`
+            : `Tighten or relax the matching pack rule. See pack:${f.packId}/check:${f.checkId}.`,
+        sourceRef: `runtime:${f.packId}:${f.checkId}:${agentId}`,
+    }));
+}
+const TRAINING_TOPICS = {
+    'phi-ingestion': {
+        topic: 'Handling Protected Health Information (PHI) in AI workflows',
+        trainingId: 'training:hipaa-phi-awareness',
+    },
+    'out-of-scope-prompt': {
+        topic: 'Scope discipline: framing prompts within authorised data classes',
+        trainingId: 'training:prompt-scope-discipline',
+    },
+    'override-abuse': {
+        topic: 'Override authority: when to use, when to escalate',
+        trainingId: 'training:override-discipline',
+    },
+    'repeated-denial-bypass': {
+        topic: 'Working with governance denials: reading the verdict instead of routing around it',
+        trainingId: 'training:working-with-denials',
+    },
+    'low-review-responsiveness': {
+        topic: 'Approval SLA expectations and escalation timing',
+        trainingId: 'training:approval-sla',
+    },
+};
+/**
+ * Synthesize recommendations from operator-side drift findings (human axis).
+ * Each finding -> assign-training Recommendation pointing at a specific
+ * training topic.
+ */
+function humanAxisRecommendations(agentId, findings) {
+    return findings.map((f) => {
+        const topic = TRAINING_TOPICS[f.kind];
+        return {
+            axis: 'human',
+            severity: f.severity,
+            kind: 'assign-training',
+            headline: `Operator ${f.operatorId}: recurring ${f.kind.replace(/-/g, ' ')}${f.windowLabel ? ` over ${f.windowLabel}` : ''}`,
+            detail: `${f.count} occurrence${f.count === 1 ? '' : 's'} of ${f.kind} attributed to ${f.operatorId}.`,
+            actionHint: `Assign training: "${topic.topic}" (${topic.trainingId}) to ${f.operatorId}.`,
+            sourceRef: `human:${f.kind}:${f.operatorId}:${agentId}`,
+        };
+    });
+}
+/**
+ * Bundle recommendations from all three axes into a single RecommendationSet.
+ * The dashboard renders this as the "How to improve your trust score" panel.
+ */
+function buildRecommendationSet(input) {
+    const recommendations = [];
+    if (input.buildScan) {
+        recommendations.push(...buildAxisRecommendations(input.agentId, input.buildScan));
+    }
+    if (input.runtimeFindings) {
+        recommendations.push(...runtimeAxisRecommendations(input.agentId, input.runtimeFindings));
+    }
+    if (input.humanFindings) {
+        recommendations.push(...humanAxisRecommendations(input.agentId, input.humanFindings));
+    }
+    const countsByAxis = { build: 0, runtime: 0, human: 0 };
+    let potential = 0;
+    for (const r of recommendations) {
+        countsByAxis[r.axis] += 1;
+        potential += SEVERITY_GAIN[r.severity];
+    }
+    return {
+        agentId: input.agentId,
+        recommendations,
+        countsByAxis,
+        potentialScoreGain: Math.min(100, potential),
+    };
+}
+//# sourceMappingURL=improvement-recommendations.js.map

package/dist/governance/improvement-recommendations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"improvement-recommendations.js","sourceRoot":"","sources":["../../src/governance/improvement-recommendations.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;AAkFH,4DAKC;AAsBD,gEAeC;AAkDD,4DAgBC;AAMD,wDA+BC;AA7LD,MAAM,aAAa,GAA6B;IAC9C,GAAG,EAAE,CAAC;IACN,GAAG,EAAE,EAAE;IACP,IAAI,EAAE,EAAE;IACR,IAAI,EAAE,EAAE;CACT,CAAC;AAEF,SAAS,4BAA4B,CAAC,CAAe,EAAE,OAAe;IACpE,wDAAwD;IACxD,IAAI,IAAI,GAAuB,eAAe,CAAC;IAC/C,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACvE,CAAC;SAAM,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,IAAI,GAAG,WAAW,CAAC;IACrB,CAAC;SAAM,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,IAAI,GAAG,WAAW,CAAC;IACrB,CAAC;SAAM,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,IAAI,GAAG,qBAAqB,CAAC;IAC/B,CAAC;SAAM,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,IAAI,GAAG,yBAAyB,CAAC;IACnC,CAAC;SAAM,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,IAAI,GAAG,eAAe,CAAC;IACzB,CAAC;SAAM,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,IAAI,GAAG,yBAAyB,CAAC;IACnC,CAAC;SAAM,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,IAAI,GAAG,eAAe,CAAC;IACzB,CAAC;SAAM,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,IAAI,GAAG,eAAe,CAAC;IACzB,CAAC;IAED,OAAO;QACL,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI;QACJ,QAAQ,EAAE,CAAC,CAAC,KAAK;QACjB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,UAAU,EAAE,CAAC,CAAC,WAAW;QACzB,SAAS,EAAE,SAAS,CAAC,CAAC,IAAI,IAAI,OAAO,EAAE;KACxC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,wBAAwB,CACtC,OAAe,EACf,IAAgB;IAEhB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;AAC5E,CAAC;AAiBD;;;;GAIG;AACH,SAAgB,0BAA0B,CACxC,OAAe,EACf,QAA4C;IAE5C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1B,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,eAAe;QAC7D,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,QAAQ,EAAE;QACjD,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,UAAU,EAAE,CAAC,CAAC,QAAQ;YACpB,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC,QAAQ,mIAAmI;YACzK,CAAC,CAAC,qDAAqD,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC,OAAO,GAAG;QACvF,SAAS,EAAE,WAAW,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,EAAE;KACzD,CAAC,CAAC,CAAC;AACN,CAAC;AAsBD,MAAM,eAAe,GAAkE;IACrF,eAAe,EAAE;QACf,KAAK,EAAE,6DAA6D;QACpE,UAAU,EAAE,8BAA8B;KAC3C;IACD,qBAAqB,EAAE;QACrB,KAAK,EAAE,kEAAkE;QACzE,UAAU,EAAE,kCAAkC;KAC/C;IACD,gBAAgB,EAAE;QAChB,KAAK,EAAE,mDAAmD;QAC1D,UAAU,EAAE,8BAA8B;KAC3C;IACD,wBAAwB,EAAE;QACxB,KAAK,EAAE,mFAAmF;QAC1F,UAAU,EAAE,+BAA+B;KAC5C;IACD,2BAA2B,EAAE;QAC3B,KAAK,EAAE,iDAAiD;QACxD,UAAU,EAAE,uBAAuB;KACpC;CACF,CAAC;AAEF;;;;GAIG;AACH,SAAgB,wBAAwB,CACtC,OAAe,EACf,QAA0C;IAE1C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACxB,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO;YACL,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,YAAY,CAAC,CAAC,UAAU,eAAe,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAC5H,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,UAAU,GAAG;YACtG,UAAU,EAAE,qBAAqB,KAAK,CAAC,KAAK,MAAM,KAAK,CAAC,UAAU,QAAQ,CAAC,CAAC,UAAU,GAAG;YACzF,SAAS,EAAE,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,OAAO,EAAE;SACxD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB,CAAC,KAKtC;IACC,MAAM,eAAe,GAAqB,EAAE,CAAC;IAE7C,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,eAAe,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1B,eAAe,CAAC,IAAI,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,eAAe,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,YAAY,GAAuC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC5F,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,SAAS,IAAI,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,eAAe;QACf,YAAY;QACZ,kBAAkB,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC;KAC7C,CAAC;AACJ,CAAC"}

package/dist/governance/improvement-recommendations.test.d.ts

@@ -0,0 +1,11 @@
+/**
+ * RED-GREEN tests for F-NEW-PRODUCT-TRUST-IMPROVEMENT-RECOMMENDATIONS (W1.11).
+ *
+ * Validates the trademark three-axis remediation engine: every score-lowering
+ * finding (build / runtime / human) produces a structured Recommendation
+ * with actionable next-step pointer.
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-TRUST-IMPROVEMENT-RECOMMENDATIONS
+ */
+export {};
+//# sourceMappingURL=improvement-recommendations.test.d.ts.map

package/dist/governance/improvement-recommendations.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"improvement-recommendations.test.d.ts","sourceRoot":"","sources":["../../src/governance/improvement-recommendations.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/governance/improvement-recommendations.test.js

@@ -0,0 +1,213 @@
+"use strict";
+/**
+ * RED-GREEN tests for F-NEW-PRODUCT-TRUST-IMPROVEMENT-RECOMMENDATIONS (W1.11).
+ *
+ * Validates the trademark three-axis remediation engine: every score-lowering
+ * finding (build / runtime / human) produces a structured Recommendation
+ * with actionable next-step pointer.
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-TRUST-IMPROVEMENT-RECOMMENDATIONS
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const assert = __importStar(require("node:assert/strict"));
+const improvement_recommendations_1 = require("./improvement-recommendations");
+const owasp_agentic_scanner_1 = require("./owasp-agentic-scanner");
+const baseManifest = (over = {}) => ({
+    agentId: 'agent-x',
+    tools: [],
+    hooks: { preToolUse: true, postToolUse: true, postResponse: true },
+    llmProvider: 'connexum-proxy/anthropic',
+    pluginIntegrityVerified: true,
+    rateLimitsConfigured: true,
+    declaredApprovalGates: [],
+    declaredForbiddenCapabilities: [],
+    ...over,
+});
+(0, node_test_1.describe)('F-NEW-PRODUCT-TRUST-IMPROVEMENT-RECOMMENDATIONS (W1.11)', () => {
+    (0, node_test_1.it)('build axis: every OWASP finding becomes a build-axis Recommendation', () => {
+        const scan = (0, owasp_agentic_scanner_1.scanAgent)(baseManifest({ tools: ['WebFetch', 'Bash'] }));
+        const recs = (0, improvement_recommendations_1.buildAxisRecommendations)('agent-x', scan);
+        assert.ok(recs.length > 0);
+        assert.ok(recs.every((r) => r.axis === 'build'));
+        assert.ok(recs.every((r) => r.actionHint.length > 0));
+        assert.ok(recs.every((r) => r.sourceRef.startsWith('owasp:')));
+    });
+    (0, node_test_1.it)('build axis: A01 Lethal Trifecta maps to enable-isolation kind', () => {
+        const scan = (0, owasp_agentic_scanner_1.scanAgent)(baseManifest({ tools: ['WebFetch', 'Bash'] }));
+        const recs = (0, improvement_recommendations_1.buildAxisRecommendations)('agent-x', scan);
+        const trifecta = recs.find((r) => /Lethal Trifecta/.test(r.headline));
+        assert.ok(trifecta);
+        assert.equal(trifecta.kind, 'enable-isolation');
+    });
+    (0, node_test_1.it)('build axis: A05 plugin integrity maps to verify-plugin-integrity', () => {
+        const scan = (0, owasp_agentic_scanner_1.scanAgent)(baseManifest({ pluginIntegrityVerified: false }));
+        const recs = (0, improvement_recommendations_1.buildAxisRecommendations)('agent-x', scan);
+        const a05 = recs.find((r) => r.sourceRef.includes('A05'));
+        assert.ok(a05);
+        assert.equal(a05.kind, 'verify-plugin-integrity');
+    });
+    (0, node_test_1.it)('build axis: A06 LLM-not-via-proxy maps to swap-provider', () => {
+        const scan = (0, owasp_agentic_scanner_1.scanAgent)(baseManifest({ llmProvider: 'anthropic/claude-direct' }));
+        const recs = (0, improvement_recommendations_1.buildAxisRecommendations)('agent-x', scan);
+        const a06 = recs.find((r) => r.sourceRef.includes('A06'));
+        assert.ok(a06);
+        assert.equal(a06.kind, 'swap-provider');
+    });
+    (0, node_test_1.it)('runtime axis: regulatory denial with citation maps to cite-regulatory-clause', () => {
+        const recs = (0, improvement_recommendations_1.runtimeAxisRecommendations)('agent-x', [
+            {
+                packId: 'hipaa',
+                checkId: 'phi-recipient',
+                severity: 'CRIT',
+                citation: 'HIPAA 164.502(e)',
+                toolName: 'email_send',
+                reason: 'PHI cannot flow to non-BAA recipient',
+            },
+        ]);
+        assert.equal(recs.length, 1);
+        assert.equal(recs[0].kind, 'cite-regulatory-clause');
+        assert.match(recs[0].actionHint, /HIPAA 164.502\(e\)/);
+        assert.equal(recs[0].axis, 'runtime');
+    });
+    (0, node_test_1.it)('runtime axis: pack denial without citation maps to add-pack-rule', () => {
+        const recs = (0, improvement_recommendations_1.runtimeAxisRecommendations)('agent-x', [
+            {
+                packId: 'company-pack-1',
+                checkId: 'capability:mcp',
+                severity: 'HIGH',
+                toolName: 'mcp__list_resources',
+                reason: 'capability forbidden by org-baseline rule',
+            },
+        ]);
+        assert.equal(recs[0].kind, 'add-pack-rule');
+    });
+    (0, node_test_1.it)('human axis: PHI ingestion maps to assign-training with hipaa-phi-awareness id', () => {
+        const recs = (0, improvement_recommendations_1.humanAxisRecommendations)('agent-x', [
+            {
+                operatorId: 'user-bob',
+                kind: 'phi-ingestion',
+                severity: 'HIGH',
+                count: 7,
+                windowLabel: '30d',
+            },
+        ]);
+        assert.equal(recs.length, 1);
+        assert.equal(recs[0].axis, 'human');
+        assert.equal(recs[0].kind, 'assign-training');
+        assert.match(recs[0].actionHint, /training:hipaa-phi-awareness/);
+        assert.match(recs[0].actionHint, /user-bob/);
+    });
+    (0, node_test_1.it)('human axis: all five drift kinds map to distinct training topics', () => {
+        const kinds = [
+            'phi-ingestion',
+            'out-of-scope-prompt',
+            'override-abuse',
+            'repeated-denial-bypass',
+            'low-review-responsiveness',
+        ];
+        const recs = (0, improvement_recommendations_1.humanAxisRecommendations)('agent-x', kinds.map((k) => ({
+            operatorId: 'user-bob',
+            kind: k,
+            severity: 'MED',
+            count: 1,
+        })));
+        const trainingIds = new Set(recs.map((r) => {
+            const m = r.actionHint.match(/training:[A-Za-z0-9-]+/);
+            return m?.[0] ?? '';
+        }));
+        assert.equal(trainingIds.size, 5);
+    });
+    (0, node_test_1.it)('buildRecommendationSet combines all three axes', () => {
+        const scan = (0, owasp_agentic_scanner_1.scanAgent)(baseManifest({ tools: ['Bash'] }));
+        const set = (0, improvement_recommendations_1.buildRecommendationSet)({
+            agentId: 'agent-x',
+            buildScan: scan,
+            runtimeFindings: [
+                {
+                    packId: 'hipaa',
+                    checkId: 'phi-recipient',
+                    severity: 'CRIT',
+                    citation: 'HIPAA 164.502(e)',
+                    toolName: 'email_send',
+                    reason: 'PHI denied',
+                },
+            ],
+            humanFindings: [
+                { operatorId: 'user-bob', kind: 'phi-ingestion', severity: 'HIGH', count: 5 },
+            ],
+        });
+        assert.ok(set.countsByAxis.build > 0);
+        assert.ok(set.countsByAxis.runtime > 0);
+        assert.ok(set.countsByAxis.human > 0);
+        assert.ok(set.potentialScoreGain > 0);
+        assert.ok(set.potentialScoreGain <= 100);
+    });
+    (0, node_test_1.it)('buildRecommendationSet potentialScoreGain weights by severity', () => {
+        const critOnly = (0, improvement_recommendations_1.buildRecommendationSet)({
+            agentId: 'agent-x',
+            runtimeFindings: [
+                {
+                    packId: 'p1',
+                    checkId: 'x',
+                    severity: 'CRIT',
+                    toolName: 'x',
+                    reason: 'r',
+                },
+            ],
+        });
+        const lowOnly = (0, improvement_recommendations_1.buildRecommendationSet)({
+            agentId: 'agent-x',
+            runtimeFindings: [
+                {
+                    packId: 'p1',
+                    checkId: 'x',
+                    severity: 'LOW',
+                    toolName: 'x',
+                    reason: 'r',
+                },
+            ],
+        });
+        assert.ok(critOnly.potentialScoreGain > lowOnly.potentialScoreGain);
+    });
+    (0, node_test_1.it)('empty input set returns zero counts and gain', () => {
+        const set = (0, improvement_recommendations_1.buildRecommendationSet)({ agentId: 'agent-x' });
+        assert.equal(set.recommendations.length, 0);
+        assert.deepEqual(set.countsByAxis, { build: 0, runtime: 0, human: 0 });
+        assert.equal(set.potentialScoreGain, 0);
+    });
+});
+//# sourceMappingURL=improvement-recommendations.test.js.map

package/dist/governance/improvement-recommendations.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"improvement-recommendations.test.js","sourceRoot":"","sources":["../../src/governance/improvement-recommendations.test.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,yCAAyC;AACzC,2DAA6C;AAE7C,+EAKuC;AACvC,mEAAwE;AAExE,MAAM,YAAY,GAAG,CAAC,OAA+B,EAAE,EAAiB,EAAE,CAAC,CAAC;IAC1E,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,EAAE;IACT,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;IAClE,WAAW,EAAE,0BAA0B;IACvC,uBAAuB,EAAE,IAAI;IAC7B,oBAAoB,EAAE,IAAI;IAC1B,qBAAqB,EAAE,EAAE;IACzB,6BAA6B,EAAE,EAAE;IACjC,GAAG,IAAI;CACR,CAAC,CAAC;AAEH,IAAA,oBAAQ,EAAC,yDAAyD,EAAE,GAAG,EAAE;IACvE,IAAA,cAAE,EAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,IAAI,GAAG,IAAA,iCAAS,EAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,IAAA,sDAAwB,EAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QACtD,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,IAAI,GAAG,IAAA,iCAAS,EAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,IAAA,sDAAwB,EAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,QAAS,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,IAAI,GAAG,IAAA,iCAAS,EAAC,YAAY,CAAC,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,IAAA,sDAAwB,EAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,GAAI,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,IAAI,GAAG,IAAA,iCAAS,EAAC,YAAY,CAAC,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;QACjF,MAAM,IAAI,GAAG,IAAA,sDAAwB,EAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,GAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,MAAM,IAAI,GAAG,IAAA,wDAA0B,EAAC,SAAS,EAAE;YACjD;gBACE,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,eAAe;gBACxB,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,kBAAkB;gBAC5B,QAAQ,EAAE,YAAY;gBACtB,MAAM,EAAE,sCAAsC;aAC/C;SACF,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,IAAI,GAAG,IAAA,wDAA0B,EAAC,SAAS,EAAE;YACjD;gBACE,MAAM,EAAE,gBAAgB;gBACxB,OAAO,EAAE,gBAAgB;gBACzB,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,qBAAqB;gBAC/B,MAAM,EAAE,2CAA2C;aACpD;SACF,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,IAAI,GAAG,IAAA,sDAAwB,EAAC,SAAS,EAAE;YAC/C;gBACE,UAAU,EAAE,UAAU;gBACtB,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC;gBACR,WAAW,EAAE,KAAK;aACnB;SACF,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAC;QACjE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,KAAK,GAAG;YACZ,eAAe;YACf,qBAAqB;YACrB,gBAAgB;YAChB,wBAAwB;YACxB,2BAA2B;SACnB,CAAC;QACX,MAAM,IAAI,GAAG,IAAA,sDAAwB,EACnC,SAAS,EACT,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChB,UAAU,EAAE,UAAU;YACtB,IAAI,EAAE,CAAC;YACP,QAAQ,EAAE,KAAc;YACxB,KAAK,EAAE,CAAC;SACT,CAAC,CAAC,CACJ,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACb,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;YACvD,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC,CAAC,CACH,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,IAAI,GAAG,IAAA,iCAAS,EAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAA,oDAAsB,EAAC;YACjC,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,IAAI;YACf,eAAe,EAAE;gBACf;oBACE,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE,eAAe;oBACxB,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,kBAAkB;oBAC5B,QAAQ,EAAE,YAAY;oBACtB,MAAM,EAAE,YAAY;iBACrB;aACF;YACD,aAAa,EAAE;gBACb,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE;aAC9E;SACF,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,kBAAkB,GAAG,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,kBAAkB,IAAI,GAAG,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,QAAQ,GAAG,IAAA,oDAAsB,EAAC;YACtC,OAAO,EAAE,SAAS;YAClB,eAAe,EAAE;gBACf;oBACE,MAAM,EAAE,IAAI;oBACZ,OAAO,EAAE,GAAG;oBACZ,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,GAAG;oBACb,MAAM,EAAE,GAAG;iBACZ;aACF;SACF,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAA,oDAAsB,EAAC;YACrC,OAAO,EAAE,SAAS;YAClB,eAAe,EAAE;gBACf;oBACE,MAAM,EAAE,IAAI;oBACZ,OAAO,EAAE,GAAG;oBACZ,QAAQ,EAAE,KAAK;oBACf,QAAQ,EAAE,GAAG;oBACb,MAAM,EAAE,GAAG;iBACZ;aACF;SACF,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,GAAG,GAAG,IAAA,oDAAsB,EAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/governance/incident-notifier.d.ts

@@ -0,0 +1,195 @@
+/**
+ * IncidentNotifier -- Compliance-driven incident notification system.
+ *
+ * Manages incident classification, deadline tracking, and notification
+ * delivery for regulatory compliance.
+ *
+ * Regulatory deadlines:
+ *   - DORA: 4 hours for major ICT incidents (Art. 19)
+ *   - GDPR: 72 hours for personal data breaches (Art. 33)
+ *   - HIPAA: 60 days for breach notification (45 CFR 164.404)
+ *   - PCI DSS: Immediate for suspected compromise
+ *   - SOC 2: Per customer SLA (typically 24-72 hours)
+ *
+ * @connexum/ai-governance
+ */
+/**
+ * HL-1: Thrown when the incident notifier finds zero packs loaded and
+ * therefore cannot derive a compliant fallback category list.
+ *
+ * Failing closed here is intentional: an incident notifier with no pack
+ * context should not silently downgrade severity by guessing categories.
+ * The operator must ensure packs are loaded before incidents are classified.
+ *
+ * Reference: W1 directive (Thomas, 2026-04-24): runtime must read from packs,
+ * not from hardcoded lists.
+ */
+export declare class NoPacksLoadedError extends Error {
+    constructor();
+}
+export type IncidentSeverity = 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
+export type IncidentStatus = 'open' | 'investigating' | 'contained' | 'resolved' | 'closed';
+export interface IncidentNotifierConfig {
+    /** Directory for incident records */
+    incidentDir: string;
+    /** Webhook URLs for notifications (keyed by severity) */
+    webhooks?: Record<IncidentSeverity, string[]>;
+    /** Active compliance frameworks (for deadline calculation) */
+    activeFrameworks?: string[];
+    /** Default notification email (for logging, not sending) */
+    notificationEmail?: string;
+    /**
+     * F-NEW-MED-15 (2026-05-02): pack-declared deadlines.
+     * When provided, every framework lookup first consults this map (built
+     * by the caller from packs[] -> incidentPolicy.notificationDeadlineHours).
+     * Falls back to the legacy hardcoded map if the framework is absent.
+     *
+     * Pre-fix: only 6 frameworks (HIPAA/DORA/GDPR/PCI DSS/SOC 2/FERPA) had
+     * wired deadlines. The other 93 packs' declared deadlines were dead
+     * data on this code path. This config closes that gap by pushing the
+     * source-of-truth back to pack metadata.
+     */
+    packDeadlinesByFramework?: Record<string, number>;
+}
+export interface Incident {
+    /** Unique incident ID */
+    id: string;
+    /** Short title */
+    title: string;
+    /** Detailed description */
+    description: string;
+    /** Severity classification */
+    severity: IncidentSeverity;
+    /** Current status */
+    status: IncidentStatus;
+    /** What type of data was affected */
+    dataTypes: string[];
+    /** Estimated number of records affected */
+    recordsAffected: number;
+    /** Which agents were involved */
+    affectedAgents: string[];
+    /** Attack vector or cause */
+    cause: string;
+    /** When discovered */
+    discoveredAt: string;
+    /** When created in the system */
+    createdAt: string;
+    /** Regulatory deadlines (framework -> absolute deadline ISO string) */
+    deadlines: Record<string, string>;
+    /** Notification history */
+    notifications: IncidentNotification[];
+    /** Status change history */
+    timeline: IncidentTimelineEntry[];
+}
+export interface IncidentNotification {
+    timestamp: string;
+    channel: string;
+    recipient: string;
+    status: 'sent' | 'failed' | 'pending';
+    message?: string;
+}
+export interface IncidentTimelineEntry {
+    timestamp: string;
+    action: string;
+    actor: string;
+    detail?: string;
+}
+export interface IncidentClassification {
+    severity: IncidentSeverity;
+    reasons: string[];
+    deadlines: Record<string, {
+        framework: string;
+        hoursFromDiscovery: number;
+        deadline: string;
+    }>;
+    requiresImmediateAction: boolean;
+    /**
+     * W1 residual (2026-04-24): human-readable severity label set derived from
+     * the industries declared by the compliance packs that matched the blocking
+     * categories. These are computed by deriveSeverityLabels() and are NEVER
+     * sourced from hardcoded category strings in this file.
+     *
+     * Examples: 'HEALTHCARE', 'PRIVACY', 'FINANCIAL', 'EDUCATION', 'GOVERNMENT', 'LEGAL'.
+     */
+    severityLabels: string[];
+}
+/**
+ * Derive a set of human-readable severity labels from the pack IDs that
+ * produced blocking-category matches on an incident.
+ *
+ * Each matched pack contributes its declared industries[] to the label
+ * derivation. The result is the union of all labels that any matched pack's
+ * industries trigger via INDUSTRY_LABEL_RULES.
+ *
+ * W1 directive: no category name strings (PHI, PII, GDPR, ...) appear in
+ * this function. The pack's own metadata drives the output.
+ *
+ * @param matchedPackIds - Pack IDs whose categories matched (BLOCK or above).
+ * @param getIndustries  - Lookup function: packId -> industries[]. Supplied
+ *                         by the caller from PackDrivenClassifier.getPackIndustries().
+ */
+export declare function deriveSeverityLabels(matchedPackIds: Iterable<string>, getIndustries: (packId: string) => string[]): Set<string>;
+export declare class IncidentNotifier {
+    private config;
+    private incidents;
+    private incidentFile;
+    constructor(config: IncidentNotifierConfig);
+    /**
+     * Classify an incident based on data types, volume, and cause.
+     */
+    classify(params: {
+        dataTypes: string[];
+        recordsAffected: number;
+        cause: string;
+        affectedAgents: string[];
+    }): IncidentClassification;
+    /**
+     * Create a new incident.
+     */
+    create(params: {
+        title: string;
+        description: string;
+        dataTypes: string[];
+        recordsAffected: number;
+        cause: string;
+        affectedAgents: string[];
+        discoveredAt?: string;
+    }): Incident;
+    /**
+     * Update incident status.
+     */
+    updateStatus(incidentId: string, status: IncidentStatus, actor: string, detail?: string): Incident;
+    /**
+     * Get an incident by ID.
+     */
+    get(incidentId: string): Incident | null;
+    /**
+     * Get all open incidents.
+     */
+    getOpen(): Incident[];
+    /**
+     * Get incidents with approaching or breached deadlines.
+     */
+    getUrgent(withinHours?: number): Incident[];
+    /**
+     * Check if any deadlines have been breached.
+     */
+    getBreachedDeadlines(): Array<{
+        incident: Incident;
+        framework: string;
+        deadline: string;
+    }>;
+    /**
+     * Get incident statistics.
+     */
+    getStats(): {
+        total: number;
+        open: number;
+        bySeverity: Record<IncidentSeverity, number>;
+        breachedDeadlines: number;
+    };
+    private logNotification;
+    private saveIncidents;
+    private loadIncidents;
+}
+//# sourceMappingURL=incident-notifier.d.ts.map

package/dist/governance/incident-notifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"incident-notifier.d.ts","sourceRoot":"","sources":["../../src/governance/incident-notifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AASH;;;;;;;;;;GAUG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;;CAU5C;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEtE,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,eAAe,GAAG,WAAW,GAAG,UAAU,GAAG,QAAQ,CAAC;AAE5F,MAAM,WAAW,sBAAsB;IACrC,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9C,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,QAAQ;IACvB,yBAAyB;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,kBAAkB;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,8BAA8B;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,qBAAqB;IACrB,MAAM,EAAE,cAAc,CAAC;IACvB,qCAAqC;IACrC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,2CAA2C;IAC3C,eAAe,EAAE,MAAM,CAAC;IACxB,iCAAiC;IACjC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,sBAAsB;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,2BAA2B;IAC3B,aAAa,EAAE,oBAAoB,EAAE,CAAC;IACtC,4BAA4B;IAC5B,QAAQ,EAAE,qBAAqB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/F,uBAAuB,EAAE,OAAO,CAAC;IACjC;;;;;;;OAOG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAoID;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,EAChC,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,EAAE,GAC1C,GAAG,CAAC,MAAM,CAAC,CAgBb;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,MAAM,CAAmC;IACjD,OAAO,CAAC,SAAS,CAAoC;IACrD,OAAO,CAAC,YAAY,CAAS;gBAEjB,MAAM,EAAE,sBAAsB;IAc1C;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE;QACf,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,KAAK,EAAE,MAAM,CAAC;QACd,cAAc,EAAE,MAAM,EAAE,CAAC;KAC1B,GAAG,sBAAsB;IAsI1B;;OAEG;IACH,MAAM,CAAC,MAAM,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,KAAK,EAAE,MAAM,CAAC;QACd,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,QAAQ;IA8CZ;;OAEG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ;IAgBlG;;OAEG;IACH,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;IAIxC;;OAEG;IACH,OAAO,IAAI,QAAQ,EAAE;IAKrB;;OAEG;IACH,SAAS,CAAC,WAAW,GAAE,MAAU,GAAG,QAAQ,EAAE;IAQ9C;;OAEG;IACH,oBAAoB,IAAI,KAAK,CAAC;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAe1F;;OAEG;IACH,QAAQ,IAAI;QACV,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAC7C,iBAAiB,EAAE,MAAM,CAAC;KAC3B;IAmBD,OAAO,CAAC,eAAe;IAsBvB,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,aAAa;CAQtB"}