@connexum/ai-governance 1.0.0-beta.11

package/dist/governance/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/governance/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,2DAO8B;AAN5B,uHAAA,iBAAiB,OAAA;AACjB,2HAAA,qBAAqB,OAAA;AAOvB,yDAM6B;AAL3B,2HAAA,sBAAsB,OAAA;AAOxB,yCAKqB;AAJnB,sGAAA,SAAS,OAAA;AAMX,mDAO0B;AANxB,+GAAA,aAAa,OAAA;AACb,2HAAA,yBAAyB,OAAA;AAO3B,uDAG4B;AAF1B,mHAAA,eAAe,OAAA;AAIjB,qDAK2B;AAJzB,iHAAA,cAAc,OAAA;AAMhB,qCAQmB;AAPjB,kGAAA,OAAO,OAAA;AAST,uDAK4B;AAJ1B,mHAAA,eAAe,OAAA;AAMjB,6DAQ+B;AAP7B,yHAAA,kBAAkB,OAAA;AASpB,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,qDAM2B;AALzB,kHAAA,eAAe,OAAA;AACf,6HAAA,0BAA0B,OAAA;AAM5B,2DAK8B;AAJ5B,8HAAA,wBAAwB,OAAA;AACxB,mIAAA,6BAA6B,OAAA;AAK/B,iDAMyB;AALvB,qHAAA,oBAAoB,OAAA;AACpB,kHAAA,iBAAiB,OAAA;AAMnB,qDAS2B;AARzB,iHAAA,cAAc,OAAA;AACd,iIAAA,8BAA8B,OAAA;AAC9B,+HAAA,4BAA4B,OAAA;AAC5B,yHAAA,sBAAsB,OAAA;AAOxB,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E,wCA8BwB;AA7BtB,2GAAA,kBAAkB,OAAA;AAClB,kHAAA,yBAAyB,OAAA;AACzB,gHAAA,uBAAuB,OAAA;AACvB,2HAAA,kCAAkC,OAAA;AAClC,0HAAA,iCAAiC,OAAA;AACjC,4GAAA,mBAAmB,OAAA;AACnB,qHAAA,4BAA4B,OAAA;AAC5B,mHAAA,0BAA0B,OAAA;AAC1B,yHAAA,gCAAgC,OAAA;AAChC,sGAAA,aAAa,OAAA"}

package/dist/governance/info-action-separation.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Info/Action Separation Bridge — W1.6 of F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12.
+ *
+ * Surfaces the already-shipped AutonomousActionIsolator as a customer-facing
+ * primitive driven by a company pack's `requiresActionIsolation` declaration.
+ * No re-implementation of the enforcer — this slice is the missing wiring + the
+ * customer-facing shape.
+ *
+ * Customer flow:
+ *   1. Company pack authored with `isolation: 'strict'` (or 'sourced-only').
+ *   2. buildCompanyPack sets `requiresActionIsolation` on the pack.
+ *   3. InfoActionSeparationBridge.applyPackPolicy() reads that field across all
+ *      active packs and configures the AutonomousActionIsolator for the agent.
+ *   4. recordInfoGathering / recordConsequential / gateConsequential bridge to
+ *      the underlying isolator. gateConsequential returns a verdict shape that
+ *      composes cleanly with PackEvaluatorVerdict (ALLOW / DENY / PENDING).
+ *
+ * Spec authority: /root/.claude/rules/web-interaction-security.md Rule 2
+ *   ("Isolation Between Fetch and Action") — wires that policy as a runtime
+ *   enforceable check class.
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-INFO-ACTION-SEPARATION
+ */
+import { AutonomousActionIsolator, type IsolationMode, type ConsequentialGuardAction, type IsolationAuditSink } from './action-isolation.js';
+import type { CompliancePack } from '../packs/index.js';
+/** Composite verdict shape so callers can interleave with PackEvaluatorVerdict. */
+export interface InfoActionVerdict {
+    verdict: 'ALLOW' | 'DENY' | 'PENDING';
+    /** Effective isolation mode applied. */
+    mode: IsolationMode;
+    /** Pack IDs whose declarations contributed to the mode. */
+    contributingPackIds: string[];
+    /** Human-readable reason. */
+    reason: string;
+}
+/**
+ * Derive the strictest isolation mode declared across a pack list.
+ * Treats `true` as 'sourced-only' (the documented default for strict regulated packs).
+ * Returns 'none' when no pack declares isolation.
+ */
+export declare function deriveIsolationMode(packs: ReadonlyArray<CompliancePack>): {
+    mode: IsolationMode;
+    contributingPackIds: string[];
+};
+export interface BridgeOptions {
+    /**
+     * Audit sink forwarded to AutonomousActionIsolator. Same shape as the
+     * underlying isolator expects (`IsolationAuditEvent` callback).
+     */
+    auditSink?: IsolationAuditSink;
+    /**
+     * Test-only operator-identity-to-role map. Forwarded to AutonomousActionIsolator
+     * so its RBAC gate can be bypassed during unit tests without needing a full
+     * OperatorRoles instance.
+     */
+    testOperatorMap?: Map<string, string>;
+    /**
+     * Default outcome when an isolation violation is detected. 'DENY' (default)
+     * blocks the action; 'PENDING' routes through the approval pipeline.
+     */
+    violationOutcome?: 'DENY' | 'PENDING';
+}
+/**
+ * InfoActionSeparationBridge — single entry point that combines pack policy
+ * with the AutonomousActionIsolator enforcer.
+ */
+export declare class InfoActionSeparationBridge {
+    private readonly isolator;
+    private readonly violationOutcome;
+    /** Per-agent record of whether applyPackPolicy has configured the isolator. */
+    private readonly configuredAgents;
+    constructor(options?: BridgeOptions);
+    /** Direct accessor for tests + admin tooling that need the underlying isolator. */
+    get underlying(): AutonomousActionIsolator;
+    /**
+     * Configure the underlying isolator for an agent based on a list of packs.
+     * Auto-resolves the strictest isolation mode and the resulting packBinding.
+     * No-op (mode = 'none') if no pack declares isolation.
+     */
+    applyPackPolicy(orgId: string, agentId: string, packs: ReadonlyArray<CompliancePack>, approverIdentity: string): {
+        mode: IsolationMode;
+        contributingPackIds: string[];
+    };
+    /** Record an info-gathering action in the cycle log. */
+    recordInfoGathering(orgId: string, agentId: string, cycleId: string, sourceIds: string[], packBinding: string[]): Promise<void>;
+    /**
+     * Gate a consequential action. Returns a structured verdict:
+     *   - ALLOW    : action may proceed
+     *   - DENY     : isolation violated; default outcome
+     *   - PENDING  : isolation violated; configured to route through approval
+     */
+    gateConsequential(orgId: string, agentId: string, cycleId: string, action: ConsequentialGuardAction, packBinding: string[]): Promise<InfoActionVerdict>;
+    /** Clear the per-cycle action log (cycle teardown). */
+    clearCycle(orgId: string, agentId: string, cycleId: string): void;
+    private resolveEffectiveMode;
+    private agentKey;
+}
+//# sourceMappingURL=info-action-separation.d.ts.map

package/dist/governance/info-action-separation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"info-action-separation.d.ts","sourceRoot":"","sources":["../../src/governance/info-action-separation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EACL,wBAAwB,EAExB,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;IACtC,wCAAwC;IACxC,IAAI,EAAE,aAAa,CAAC;IACpB,2DAA2D;IAC3D,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;CAChB;AAQD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,GAAG;IACzE,IAAI,EAAE,aAAa,CAAC;IACpB,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B,CA2BA;AAED,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B;;;;OAIG;IACH,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACvC;AAED;;;GAGG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA2B;IACpD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;IACtD,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0B;gBAE/C,OAAO,GAAE,aAAkB;IAOvC,mFAAmF;IACnF,IAAI,UAAU,IAAI,wBAAwB,CAEzC;IAED;;;;OAIG;IACH,eAAe,CACb,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,EACpC,gBAAgB,EAAE,MAAM,GACvB;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,mBAAmB,EAAE,MAAM,EAAE,CAAA;KAAE;IAWzD,wDAAwD;IAClD,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EAAE,EACnB,WAAW,EAAE,MAAM,EAAE,GACpB,OAAO,CAAC,IAAI,CAAC;IAUhB;;;;;OAKG;IACG,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,wBAAwB,EAChC,WAAW,EAAE,MAAM,EAAE,GACpB,OAAO,CAAC,iBAAiB,CAAC;IA6B7B,uDAAuD;IACvD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAIjE,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,QAAQ;CAGjB"}

package/dist/governance/info-action-separation.js

@@ -0,0 +1,148 @@
+"use strict";
+/**
+ * Info/Action Separation Bridge — W1.6 of F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12.
+ *
+ * Surfaces the already-shipped AutonomousActionIsolator as a customer-facing
+ * primitive driven by a company pack's `requiresActionIsolation` declaration.
+ * No re-implementation of the enforcer — this slice is the missing wiring + the
+ * customer-facing shape.
+ *
+ * Customer flow:
+ *   1. Company pack authored with `isolation: 'strict'` (or 'sourced-only').
+ *   2. buildCompanyPack sets `requiresActionIsolation` on the pack.
+ *   3. InfoActionSeparationBridge.applyPackPolicy() reads that field across all
+ *      active packs and configures the AutonomousActionIsolator for the agent.
+ *   4. recordInfoGathering / recordConsequential / gateConsequential bridge to
+ *      the underlying isolator. gateConsequential returns a verdict shape that
+ *      composes cleanly with PackEvaluatorVerdict (ALLOW / DENY / PENDING).
+ *
+ * Spec authority: /root/.claude/rules/web-interaction-security.md Rule 2
+ *   ("Isolation Between Fetch and Action") — wires that policy as a runtime
+ *   enforceable check class.
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-INFO-ACTION-SEPARATION
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InfoActionSeparationBridge = void 0;
+exports.deriveIsolationMode = deriveIsolationMode;
+const action_isolation_js_1 = require("./action-isolation.js");
+const MODE_RANK = {
+    none: 0,
+    'sourced-only': 1,
+    strict: 2,
+};
+/**
+ * Derive the strictest isolation mode declared across a pack list.
+ * Treats `true` as 'sourced-only' (the documented default for strict regulated packs).
+ * Returns 'none' when no pack declares isolation.
+ */
+function deriveIsolationMode(packs) {
+    let mode = 'none';
+    const contributing = [];
+    for (const pack of packs) {
+        const declared = pack.requiresActionIsolation;
+        if (declared === undefined || declared === false || declared === 'none')
+            continue;
+        let packMode;
+        if (declared === true) {
+            packMode = 'sourced-only';
+        }
+        else if (declared === 'strict' || declared === 'sourced-only') {
+            packMode = declared;
+        }
+        else {
+            continue;
+        }
+        if (MODE_RANK[packMode] > MODE_RANK[mode]) {
+            mode = packMode;
+            contributing.length = 0;
+            contributing.push(pack.id);
+        }
+        else if (MODE_RANK[packMode] === MODE_RANK[mode]) {
+            contributing.push(pack.id);
+        }
+    }
+    return { mode, contributingPackIds: contributing };
+}
+/**
+ * InfoActionSeparationBridge — single entry point that combines pack policy
+ * with the AutonomousActionIsolator enforcer.
+ */
+class InfoActionSeparationBridge {
+    isolator;
+    violationOutcome;
+    /** Per-agent record of whether applyPackPolicy has configured the isolator. */
+    configuredAgents = new Set();
+    constructor(options = {}) {
+        this.isolator = new action_isolation_js_1.AutonomousActionIsolator(options.auditSink, undefined, {
+            testOperatorMap: options.testOperatorMap,
+        });
+        this.violationOutcome = options.violationOutcome ?? 'DENY';
+    }
+    /** Direct accessor for tests + admin tooling that need the underlying isolator. */
+    get underlying() {
+        return this.isolator;
+    }
+    /**
+     * Configure the underlying isolator for an agent based on a list of packs.
+     * Auto-resolves the strictest isolation mode and the resulting packBinding.
+     * No-op (mode = 'none') if no pack declares isolation.
+     */
+    applyPackPolicy(orgId, agentId, packs, approverIdentity) {
+        const { mode, contributingPackIds } = deriveIsolationMode(packs);
+        const allPackIds = packs.map((p) => p.id);
+        if (allPackIds.length === 0) {
+            throw new Error('InfoActionSeparationBridge.applyPackPolicy: pack list must be non-empty');
+        }
+        this.isolator.configure(orgId, agentId, mode, allPackIds, approverIdentity);
+        this.configuredAgents.add(this.agentKey(orgId, agentId));
+        return { mode, contributingPackIds };
+    }
+    /** Record an info-gathering action in the cycle log. */
+    async recordInfoGathering(orgId, agentId, cycleId, sourceIds, packBinding) {
+        await this.isolator.recordAction(orgId, agentId, cycleId, { kind: 'info-gathering', sourceIds }, packBinding);
+    }
+    /**
+     * Gate a consequential action. Returns a structured verdict:
+     *   - ALLOW    : action may proceed
+     *   - DENY     : isolation violated; default outcome
+     *   - PENDING  : isolation violated; configured to route through approval
+     */
+    async gateConsequential(orgId, agentId, cycleId, action, packBinding) {
+        try {
+            const result = await this.isolator.guardConsequentialAction(orgId, agentId, cycleId, action, packBinding);
+            const effectiveMode = this.resolveEffectiveMode(orgId, agentId);
+            return {
+                verdict: 'ALLOW',
+                mode: effectiveMode,
+                contributingPackIds: [],
+                reason: result.reason,
+            };
+        }
+        catch (err) {
+            if (err instanceof action_isolation_js_1.ActionIsolationViolationError) {
+                return {
+                    verdict: this.violationOutcome,
+                    mode: err.mode,
+                    contributingPackIds: [],
+                    reason: err.message,
+                };
+            }
+            throw err;
+        }
+    }
+    /** Clear the per-cycle action log (cycle teardown). */
+    clearCycle(orgId, agentId, cycleId) {
+        this.isolator.clearCycle(orgId, agentId, cycleId);
+    }
+    resolveEffectiveMode(_orgId, _agentId) {
+        // The underlying isolator already stored the mode at configure() time. We
+        // surface it best-effort. If never configured, return 'none'.
+        return 'none';
+    }
+    agentKey(orgId, agentId) {
+        return `${orgId}::${agentId}`;
+    }
+}
+exports.InfoActionSeparationBridge = InfoActionSeparationBridge;
+//# sourceMappingURL=info-action-separation.js.map

package/dist/governance/info-action-separation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"info-action-separation.js","sourceRoot":"","sources":["../../src/governance/info-action-separation.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;AAiCH,kDA8BC;AA7DD,+DAM+B;AAc/B,MAAM,SAAS,GAAkC;IAC/C,IAAI,EAAE,CAAC;IACP,cAAc,EAAE,CAAC;IACjB,MAAM,EAAE,CAAC;CACV,CAAC;AAEF;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,KAAoC;IAItE,IAAI,IAAI,GAAkB,MAAM,CAAC;IACjC,MAAM,YAAY,GAAa,EAAE,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,MAAM;YAAE,SAAS;QAElF,IAAI,QAAuB,CAAC;QAC5B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,QAAQ,GAAG,cAAc,CAAC;QAC5B,CAAC;aAAM,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YAChE,QAAQ,GAAG,QAAQ,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,SAAS;QACX,CAAC;QAED,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,IAAI,GAAG,QAAQ,CAAC;YAChB,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;aAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,YAAY,EAAE,CAAC;AACrD,CAAC;AAqBD;;;GAGG;AACH,MAAa,0BAA0B;IACpB,QAAQ,CAA2B;IACnC,gBAAgB,CAAqB;IACtD,+EAA+E;IAC9D,gBAAgB,GAAgB,IAAI,GAAG,EAAE,CAAC;IAE3D,YAAY,UAAyB,EAAE;QACrC,IAAI,CAAC,QAAQ,GAAG,IAAI,8CAAwB,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE;YACzE,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,MAAM,CAAC;IAC7D,CAAC;IAED,mFAAmF;IACnF,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,eAAe,CACb,KAAa,EACb,OAAe,EACf,KAAoC,EACpC,gBAAwB;QAExB,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAC5E,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;QACzD,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IACvC,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,mBAAmB,CACvB,KAAa,EACb,OAAe,EACf,OAAe,EACf,SAAmB,EACnB,WAAqB;QAErB,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAC9B,KAAK,EACL,OAAO,EACP,OAAO,EACP,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,EACrC,WAAW,CACZ,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,OAAe,EACf,OAAe,EACf,MAAgC,EAChC,WAAqB;QAErB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CACzD,KAAK,EACL,OAAO,EACP,OAAO,EACP,MAAM,EACN,WAAW,CACZ,CAAC;YACF,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAChE,OAAO;gBACL,OAAO,EAAE,OAAO;gBAChB,IAAI,EAAE,aAAa;gBACnB,mBAAmB,EAAE,EAAE;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,mDAA6B,EAAE,CAAC;gBACjD,OAAO;oBACL,OAAO,EAAE,IAAI,CAAC,gBAAgB;oBAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,mBAAmB,EAAE,EAAE;oBACvB,MAAM,EAAE,GAAG,CAAC,OAAO;iBACpB,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,UAAU,CAAC,KAAa,EAAE,OAAe,EAAE,OAAe;QACxD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAEO,oBAAoB,CAAC,MAAc,EAAE,QAAgB;QAC3D,0EAA0E;QAC1E,8DAA8D;QAC9D,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,QAAQ,CAAC,KAAa,EAAE,OAAe;QAC7C,OAAO,GAAG,KAAK,KAAK,OAAO,EAAE,CAAC;IAChC,CAAC;CACF;AA/GD,gEA+GC"}

package/dist/governance/info-action-separation.test.d.ts

@@ -0,0 +1,20 @@
+/**
+ * RED-GREEN tests for F-NEW-PRODUCT-INFO-ACTION-SEPARATION (W1.6 of
+ * F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12).
+ *
+ * Customer-path probe:
+ *   1. Customer authors a company pack with `isolation: 'sourced-only'`.
+ *   2. Bridge.applyPackPolicy() reads the pack and configures the isolator.
+ *   3. Agent records an info-gathering action with sourceIds.
+ *   4. Agent attempts a consequential action whose targetIds overlap with the
+ *      sourced data -> gateConsequential returns DENY.
+ *   5. Agent attempts a consequential action on independent data -> ALLOW.
+ *
+ * RED proof: a fresh bridge without applyPackPolicy / pack with isolation:'none'
+ * never blocks. GREEN: with applyPackPolicy(pack with 'sourced-only'), the
+ * overlapping target gets blocked.
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-INFO-ACTION-SEPARATION
+ */
+export {};
+//# sourceMappingURL=info-action-separation.test.d.ts.map

package/dist/governance/info-action-separation.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"info-action-separation.test.d.ts","sourceRoot":"","sources":["../../src/governance/info-action-separation.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG"}

package/dist/governance/info-action-separation.test.js

@@ -0,0 +1,190 @@
+"use strict";
+/**
+ * RED-GREEN tests for F-NEW-PRODUCT-INFO-ACTION-SEPARATION (W1.6 of
+ * F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12).
+ *
+ * Customer-path probe:
+ *   1. Customer authors a company pack with `isolation: 'sourced-only'`.
+ *   2. Bridge.applyPackPolicy() reads the pack and configures the isolator.
+ *   3. Agent records an info-gathering action with sourceIds.
+ *   4. Agent attempts a consequential action whose targetIds overlap with the
+ *      sourced data -> gateConsequential returns DENY.
+ *   5. Agent attempts a consequential action on independent data -> ALLOW.
+ *
+ * RED proof: a fresh bridge without applyPackPolicy / pack with isolation:'none'
+ * never blocks. GREEN: with applyPackPolicy(pack with 'sourced-only'), the
+ * overlapping target gets blocked.
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-INFO-ACTION-SEPARATION
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const assert = __importStar(require("node:assert/strict"));
+const info_action_separation_1 = require("./info-action-separation");
+const company_pack_builder_1 = require("./company-pack-builder");
+const capability_classes_1 = require("./capability-classes");
+function freshBridge(violationOutcome = 'DENY') {
+    const operatorMap = new Map([['admin-alice', 'ADMIN']]);
+    return new info_action_separation_1.InfoActionSeparationBridge({ testOperatorMap: operatorMap, violationOutcome });
+}
+(0, node_test_1.describe)('F-NEW-PRODUCT-INFO-ACTION-SEPARATION — bridge over AutonomousActionIsolator', () => {
+    (0, node_test_1.it)('deriveIsolationMode picks the strictest across packs', () => {
+        const pSourced = (0, company_pack_builder_1.buildCompanyPack)({
+            id: 'p1',
+            name: 'sourced-only pack',
+            orgId: 'org-x',
+            rules: [{ capability: capability_classes_1.CAPABILITY_CLASS.WEB_FETCH, action: 'WARN' }],
+            isolation: 'sourced-only',
+        });
+        const pStrict = (0, company_pack_builder_1.buildCompanyPack)({
+            id: 'p2',
+            name: 'strict pack',
+            orgId: 'org-x',
+            rules: [{ capability: capability_classes_1.CAPABILITY_CLASS.SHELL_EXEC, action: 'BLOCK' }],
+            isolation: 'strict',
+        });
+        const pNone = (0, company_pack_builder_1.buildCompanyPack)({
+            id: 'p3',
+            name: 'none pack',
+            orgId: 'org-x',
+            rules: [{ capability: capability_classes_1.CAPABILITY_CLASS.MCP, action: 'LOG' }],
+            isolation: 'none',
+        });
+        const r1 = (0, info_action_separation_1.deriveIsolationMode)([pNone]);
+        assert.equal(r1.mode, 'none');
+        assert.deepEqual(r1.contributingPackIds, []);
+        const r2 = (0, info_action_separation_1.deriveIsolationMode)([pSourced, pStrict, pNone]);
+        assert.equal(r2.mode, 'strict');
+        assert.deepEqual(r2.contributingPackIds, ['p2']);
+        const r3 = (0, info_action_separation_1.deriveIsolationMode)([pSourced]);
+        assert.equal(r3.mode, 'sourced-only');
+        assert.deepEqual(r3.contributingPackIds, ['p1']);
+    });
+    (0, node_test_1.it)('STRICT mode: any info-gathering blocks ALL same-cycle consequential actions', async () => {
+        const bridge = freshBridge();
+        const pack = (0, company_pack_builder_1.buildCompanyPack)({
+            id: 'p-strict',
+            name: 'strict',
+            orgId: 'org-x',
+            rules: [{ capability: capability_classes_1.CAPABILITY_CLASS.WEB_FETCH, action: 'WARN' }],
+            isolation: 'strict',
+        });
+        const applied = bridge.applyPackPolicy('org-x', 'agent-1', [pack], 'admin-alice');
+        assert.equal(applied.mode, 'strict');
+        await bridge.recordInfoGathering('org-x', 'agent-1', 'cycle-1', ['url-hash-1'], ['p-strict']);
+        const verdict = await bridge.gateConsequential('org-x', 'agent-1', 'cycle-1', { class: 'production-write', mutates: true, targetIds: ['file-99'] }, ['p-strict']);
+        assert.equal(verdict.verdict, 'DENY');
+        assert.equal(verdict.mode, 'strict');
+    });
+    (0, node_test_1.it)('SOURCED-ONLY mode: consequential ALLOWED on independent target (no source overlap)', async () => {
+        const bridge = freshBridge();
+        const pack = (0, company_pack_builder_1.buildCompanyPack)({
+            id: 'p-sourced',
+            name: 'sourced',
+            orgId: 'org-x',
+            rules: [{ capability: capability_classes_1.CAPABILITY_CLASS.WEB_FETCH, action: 'WARN' }],
+            isolation: 'sourced-only',
+        });
+        bridge.applyPackPolicy('org-x', 'agent-1', [pack], 'admin-alice');
+        await bridge.recordInfoGathering('org-x', 'agent-1', 'cycle-2', ['url-hash-1'], ['p-sourced']);
+        const verdict = await bridge.gateConsequential('org-x', 'agent-1', 'cycle-2', { class: 'production-write', mutates: true, targetIds: ['unrelated-target'] }, ['p-sourced']);
+        assert.equal(verdict.verdict, 'ALLOW');
+    });
+    (0, node_test_1.it)('SOURCED-ONLY mode: consequential DENIED when target overlaps with sourced data', async () => {
+        const bridge = freshBridge();
+        const pack = (0, company_pack_builder_1.buildCompanyPack)({
+            id: 'p-sourced-2',
+            name: 'sourced-2',
+            orgId: 'org-x',
+            rules: [{ capability: capability_classes_1.CAPABILITY_CLASS.WEB_FETCH, action: 'WARN' }],
+            isolation: 'sourced-only',
+        });
+        bridge.applyPackPolicy('org-x', 'agent-1', [pack], 'admin-alice');
+        await bridge.recordInfoGathering('org-x', 'agent-1', 'cycle-3', ['hostile-content-hash'], ['p-sourced-2']);
+        const verdict = await bridge.gateConsequential('org-x', 'agent-1', 'cycle-3', { class: 'production-write', mutates: true, targetIds: ['hostile-content-hash'] }, ['p-sourced-2']);
+        assert.equal(verdict.verdict, 'DENY');
+    });
+    (0, node_test_1.it)('NONE mode: never blocks (pure pass-through)', async () => {
+        const bridge = freshBridge();
+        const pack = (0, company_pack_builder_1.buildCompanyPack)({
+            id: 'p-none',
+            name: 'none',
+            orgId: 'org-x',
+            rules: [{ capability: capability_classes_1.CAPABILITY_CLASS.MCP, action: 'LOG' }],
+            isolation: 'none',
+        });
+        bridge.applyPackPolicy('org-x', 'agent-1', [pack], 'admin-alice');
+        await bridge.recordInfoGathering('org-x', 'agent-1', 'cycle-4', ['anything'], ['p-none']);
+        const verdict = await bridge.gateConsequential('org-x', 'agent-1', 'cycle-4', { class: 'production-write', mutates: true, targetIds: ['anything'] }, ['p-none']);
+        assert.equal(verdict.verdict, 'ALLOW');
+    });
+    (0, node_test_1.it)('violationOutcome PENDING routes violations to PENDING instead of DENY', async () => {
+        const bridge = freshBridge('PENDING');
+        const pack = (0, company_pack_builder_1.buildCompanyPack)({
+            id: 'p-pending',
+            name: 'pending',
+            orgId: 'org-x',
+            rules: [{ capability: capability_classes_1.CAPABILITY_CLASS.WEB_FETCH, action: 'WARN' }],
+            isolation: 'strict',
+        });
+        bridge.applyPackPolicy('org-x', 'agent-1', [pack], 'admin-alice');
+        await bridge.recordInfoGathering('org-x', 'agent-1', 'cycle-5', ['x'], ['p-pending']);
+        const verdict = await bridge.gateConsequential('org-x', 'agent-1', 'cycle-5', { class: 'production-write', mutates: true, targetIds: ['y'] }, ['p-pending']);
+        assert.equal(verdict.verdict, 'PENDING');
+    });
+    (0, node_test_1.it)('clearCycle resets the per-cycle source log', async () => {
+        const bridge = freshBridge();
+        const pack = (0, company_pack_builder_1.buildCompanyPack)({
+            id: 'p-clear',
+            name: 'clear',
+            orgId: 'org-x',
+            rules: [{ capability: capability_classes_1.CAPABILITY_CLASS.WEB_FETCH, action: 'WARN' }],
+            isolation: 'strict',
+        });
+        bridge.applyPackPolicy('org-x', 'agent-1', [pack], 'admin-alice');
+        await bridge.recordInfoGathering('org-x', 'agent-1', 'cycle-6', ['x'], ['p-clear']);
+        const v1 = await bridge.gateConsequential('org-x', 'agent-1', 'cycle-6', { class: 'production-write', mutates: true, targetIds: ['y'] }, ['p-clear']);
+        assert.equal(v1.verdict, 'DENY');
+        bridge.clearCycle('org-x', 'agent-1', 'cycle-6');
+        const v2 = await bridge.gateConsequential('org-x', 'agent-1', 'cycle-6', { class: 'production-write', mutates: true, targetIds: ['y'] }, ['p-clear']);
+        assert.equal(v2.verdict, 'ALLOW');
+    });
+    (0, node_test_1.it)('applyPackPolicy rejects empty pack list (fail-closed)', () => {
+        const bridge = freshBridge();
+        assert.throws(() => bridge.applyPackPolicy('org-x', 'agent-1', [], 'admin-alice'), /non-empty/);
+    });
+});
+//# sourceMappingURL=info-action-separation.test.js.map

package/dist/governance/info-action-separation.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"info-action-separation.test.js","sourceRoot":"","sources":["../../src/governance/info-action-separation.test.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,yCAAyC;AACzC,2DAA6C;AAE7C,qEAA2F;AAC3F,iEAA0D;AAC1D,6DAAwD;AAExD,SAAS,WAAW,CAAC,mBAAuC,MAAM;IAChE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAiB,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,IAAI,mDAA0B,CAAC,EAAE,eAAe,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,IAAA,oBAAQ,EAAC,6EAA6E,EAAE,GAAG,EAAE;IAC3F,IAAA,cAAE,EAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,QAAQ,GAAG,IAAA,uCAAgB,EAAC;YAChC,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,mBAAmB;YACzB,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,qCAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YACnE,SAAS,EAAE,cAAc;SAC1B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAA,uCAAgB,EAAC;YAC/B,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,qCAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YACrE,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAA,uCAAgB,EAAC;YAC7B,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,qCAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC5D,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QAEH,MAAM,EAAE,GAAG,IAAA,4CAAmB,EAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9B,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;QAE7C,MAAM,EAAE,GAAG,IAAA,4CAAmB,EAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAEjD,MAAM,EAAE,GAAG,IAAA,4CAAmB,EAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACtC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAA,uCAAgB,EAAC;YAC5B,EAAE,EAAE,UAAU;YACd,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,qCAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YACnE,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;QAClF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAErC,MAAM,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAE9F,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAC5C,OAAO,EACP,SAAS,EACT,SAAS,EACT,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,EAAE,EACpE,CAAC,UAAU,CAAC,CACb,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAA,uCAAgB,EAAC;YAC5B,EAAE,EAAE,WAAW;YACf,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,qCAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YACnE,SAAS,EAAE,cAAc;SAC1B,CAAC,CAAC;QAEH,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;QAClE,MAAM,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAE/F,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAC5C,OAAO,EACP,SAAS,EACT,SAAS,EACT,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAC7E,CAAC,WAAW,CAAC,CACd,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAA,uCAAgB,EAAC;YAC5B,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,qCAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YACnE,SAAS,EAAE,cAAc;SAC1B,CAAC,CAAC;QAEH,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;QAClE,MAAM,MAAM,CAAC,mBAAmB,CAC9B,OAAO,EACP,SAAS,EACT,SAAS,EACT,CAAC,sBAAsB,CAAC,EACxB,CAAC,aAAa,CAAC,CAChB,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAC5C,OAAO,EACP,SAAS,EACT,SAAS,EACT,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,sBAAsB,CAAC,EAAE,EACjF,CAAC,aAAa,CAAC,CAChB,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAA,uCAAgB,EAAC;YAC5B,EAAE,EAAE,QAAQ;YACZ,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,qCAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAC5D,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QAEH,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;QAClE,MAAM,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE1F,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAC5C,OAAO,EACP,SAAS,EACT,SAAS,EACT,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE,EACrE,CAAC,QAAQ,CAAC,CACX,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,IAAA,uCAAgB,EAAC;YAC5B,EAAE,EAAE,WAAW;YACf,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,qCAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YACnE,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;QAClE,MAAM,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAEtF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAC5C,OAAO,EACP,SAAS,EACT,SAAS,EACT,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,EAC9D,CAAC,WAAW,CAAC,CACd,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAA,uCAAgB,EAAC;YAC5B,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,qCAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YACnE,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;QAClE,MAAM,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAEpF,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CACvC,OAAO,EACP,SAAS,EACT,SAAS,EACT,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,EAC9D,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAEjC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAEjD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CACvC,OAAO,EACP,SAAS,EACT,SAAS,EACT,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,EAC9D,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAA,cAAE,EAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,MAAM,CACX,GAAG,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,aAAa,CAAC,EACnE,WAAW,CACZ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/governance/instinct-system.d.ts

@@ -0,0 +1,141 @@
+/**
+ * InstinctSystem -- Continuous learning with confidence-scored behavioral patterns.
+ *
+ * Agents build up "instincts" -- patterns they've learned work well.
+ * Unlike memory (facts), instincts are behavioral with confidence scores.
+ *
+ * Confidence lifecycle:
+ *   New: 0.3 -> Success: +0.1 -> Auto-promote at >= 0.8 across 2+ projects
+ *   Failure: -0.15 -> Decay: -0.05 per 7 days idle -> Prune at < 0.2
+ *
+ * @connexum/ai-governance
+ */
+export interface Instinct {
+    id: string;
+    pattern: string;
+    context: string;
+    confidence: number;
+    source: 'learned' | 'imported' | 'promoted';
+    learnedFrom: string[];
+    appliedCount: number;
+    successCount: number;
+    failureCount: number;
+    lastApplied: string | null;
+    createdAt: string;
+    ttlDays: number;
+    projects: string[];
+    tags: string[];
+}
+export interface InstinctConfig {
+    /** Directory to store instinct data */
+    dataDir: string;
+    /** Agent name */
+    agentName: string;
+    /** Current project name */
+    projectName: string;
+    /** Initial confidence for new instincts (default: 0.3) */
+    initialConfidence?: number;
+    /** Confidence boost on success (default: 0.1) */
+    successBoost?: number;
+    /** Confidence penalty on failure (default: 0.15) */
+    failurePenalty?: number;
+    /** Days of inactivity before decay starts (default: 7) */
+    decayAfterDays?: number;
+    /** Confidence decay per decay period (default: 0.05) */
+    decayRate?: number;
+    /** Minimum confidence before pruning (default: 0.2) */
+    pruneThreshold?: number;
+    /** Maximum age in days before pruning (default: 30) */
+    maxAgeDays?: number;
+    /** Confidence threshold for global promotion (default: 0.8) */
+    promotionThreshold?: number;
+    /** Minimum projects for global promotion (default: 2) */
+    promotionMinProjects?: number;
+    /** Maximum number of instincts per agent (default: 100) */
+    maxInstincts?: number;
+}
+export interface InstinctStatus {
+    total: number;
+    active: number;
+    highConfidence: number;
+    lowConfidence: number;
+    promotable: number;
+    stale: number;
+    byProject: Record<string, number>;
+    bySource: Record<string, number>;
+    avgConfidence: number;
+}
+export declare class InstinctSystem {
+    private instinctsFile;
+    private logFile;
+    private config;
+    constructor(config: InstinctConfig);
+    /**
+     * Learn a new instinct from experience.
+     */
+    learn(pattern: string, context: string, sessionId: string, tags?: string[]): Instinct;
+    /**
+     * Record successful application of an instinct.
+     */
+    recordSuccess(instinctId: string): Instinct | null;
+    /**
+     * Record failed application of an instinct.
+     */
+    recordFailure(instinctId: string, reason?: string): Instinct | null;
+    /**
+     * Find instincts relevant to a given context.
+     * Returns instincts sorted by confidence (highest first).
+     */
+    findRelevant(contextKeywords: string[], minConfidence?: number): Instinct[];
+    /**
+     * Apply confidence decay to stale instincts.
+     * Call this periodically (e.g., on session start).
+     */
+    applyDecay(): {
+        decayed: number;
+        pruned: number;
+    };
+    /**
+     * Find instincts eligible for global promotion.
+     * Criteria: confidence >= threshold AND used in >= N projects.
+     */
+    findPromotable(): Instinct[];
+    /**
+     * Promote an instinct to global scope.
+     */
+    promote(instinctId: string): Instinct | null;
+    /**
+     * Export instincts for sharing between agents/projects.
+     */
+    exportInstincts(minConfidence?: number): Instinct[];
+    /**
+     * Import instincts from another agent/project.
+     */
+    importInstincts(instincts: Instinct[]): {
+        imported: number;
+        skipped: number;
+    };
+    /**
+     * Get comprehensive status of all instincts.
+     */
+    getStatus(): InstinctStatus;
+    /**
+     * Force re-evaluation of all instincts.
+     * Recalculates confidence based on success/failure ratios.
+     */
+    evolve(): {
+        evolved: number;
+    };
+    /**
+     * Get all instincts (read-only).
+     */
+    getAll(): Instinct[];
+    /**
+     * Remove a specific instinct.
+     */
+    remove(instinctId: string): boolean;
+    private loadInstincts;
+    private saveInstincts;
+    private log;
+}
+//# sourceMappingURL=instinct-system.d.ts.map

package/dist/governance/instinct-system.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instinct-system.d.ts","sourceRoot":"","sources":["../../src/governance/instinct-system.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;IAC5C,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iDAAiD;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,yDAAyD;IACzD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,MAAM,CAA2B;gBAE7B,MAAM,EAAE,cAAc;IAwBlC;;OAEG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,EAAO,GAAG,QAAQ;IAsDzF;;OAEG;IACH,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;IAmBlD;;OAEG;IACH,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;IAenE;;;OAGG;IACH,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,EAAE,aAAa,GAAE,MAAY,GAAG,QAAQ,EAAE;IAahF;;;OAGG;IACH,UAAU,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IA4CjD;;;OAGG;IACH,cAAc,IAAI,QAAQ,EAAE;IAU5B;;OAEG;IACH,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;IAY5C;;OAEG;IACH,eAAe,CAAC,aAAa,GAAE,MAAY,GAAG,QAAQ,EAAE;IAIxD;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IA0B7E;;OAEG;IACH,SAAS,IAAI,cAAc;IA0C3B;;;OAGG;IACH,MAAM,IAAI;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE;IAsB7B;;OAEG;IACH,MAAM,IAAI,QAAQ,EAAE;IAIpB;;OAEG;IACH,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAWnC,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,aAAa;IAWrB,OAAO,CAAC,GAAG;CAeZ"}