@connexum/ai-governance 1.0.0-beta.11

package/dist/packs/check-registry.js

@@ -0,0 +1,3341 @@
+"use strict";
+/**
+ * ComplianceCheckRegistry
+ *
+ * Real implementations for the `check:` strings declared in every
+ * compliance pack's validators. Provides the pass/fail verdict that
+ * PackRegistry.validate() records against each validator.
+ *
+ * A validator in a pack declares `check: 'governance_active'`. At
+ * validation time, PackRegistry looks up that check in this registry,
+ * runs the function against a ComplianceCheckContext, and records the
+ * real pass/fail result.
+ *
+ * Context sources:
+ *   - activeModules: governance modules currently active in the runtime.
+ *   - packConfig: merged module-config from active packs.
+ *   - evidence: flags gathered from the governance runtime (hash chain
+ *     state, change-management workflow active, etc.).
+ *
+ * Registration contract (P1C-03): every check id referenced by an
+ * active pack MUST be registered. Unregistered ids HARD-FAIL with a
+ * governance-defect verdict. There is no neutral-pass fallback.
+ * The server boot-gate verifies the registration invariant BEFORE
+ * binding the HTTP listener so that misconfigured deployments fail
+ * loudly at startup rather than silently inflating pass rates.
+ *
+ * @connexum/ai-governance
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultCheckRegistry = exports.ComplianceCheckRegistry = void 0;
+class ComplianceCheckRegistry {
+    checks = new Map();
+    register(id, fn) {
+        this.checks.set(id, fn);
+    }
+    has(id) {
+        return this.checks.has(id);
+    }
+    /**
+     * List every registered check id. Used by the server boot-gate to
+     * verify that every check referenced by an active pack has a wired
+     * validator BEFORE the HTTP listener binds.
+     */
+    listIds() {
+        return Array.from(this.checks.keys());
+    }
+    /**
+     * Run a check. If the id is not registered, HARD-FAIL with a
+     * governance-defect verdict. Unregistered check ids are treated as
+     * a misconfiguration of the compliance product, NOT as a silent
+     * pass. Callers (PackRegistry.validate, boot-gate) rely on this
+     * contract to prevent unverified controls from inflating pass rates
+     * in audit reports.
+     */
+    run(id, ctx) {
+        const fn = this.checks.get(id);
+        if (!fn) {
+            return {
+                passed: false,
+                detail: `check '${id}' is not registered in check-registry; this is a governance defect, not a pass`,
+            };
+        }
+        try {
+            return fn(ctx);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return { passed: false, detail: `check '${id}' threw: ${msg}` };
+        }
+    }
+    /**
+     * Register the default set of module-presence checks. These cover
+     * the most common `check:` strings used across all 12 packs:
+     * governance, audit, encryption, RBAC, agent auth, monitoring, HITL,
+     * transparency, data classifier, post-market monitoring, incident
+     * reporting, bias monitor, attestation, supply chain, approval queue.
+     */
+    registerDefaults() {
+        const modulePresence = (moduleName) => (ctx) => {
+            const active = ctx.activeModules.includes(moduleName);
+            return {
+                passed: active,
+                detail: active
+                    ? `module '${moduleName}' active`
+                    : `module '${moduleName}' NOT active`,
+            };
+        };
+        const evidenceFlag = (flagName, prettyName) => (ctx) => {
+            const v = ctx.evidence?.[flagName];
+            const passed = v === true;
+            return {
+                passed,
+                detail: passed
+                    ? `${prettyName} evidence present`
+                    : `${prettyName} evidence missing (flag '${flagName}' !== true)`,
+            };
+        };
+        const retentionAtLeast = (flagName, minDays, label) => (ctx) => {
+            const v = ctx.evidence?.[flagName];
+            const n = typeof v === 'number' ? v : 0;
+            const passed = n >= minDays;
+            return {
+                passed,
+                detail: passed
+                    ? `${label}: ${n} days >= ${minDays}`
+                    : `${label}: ${n} days < required ${minDays}`,
+            };
+        };
+        // -- module presence checks (used by most packs) --
+        this.register('governance_active', modulePresence('governance-runtime'));
+        this.register('audit_trail_exists', modulePresence('audit-integrity'));
+        this.register('encryption_active', modulePresence('encryption-layer'));
+        this.register('rbac_active', modulePresence('governance-runtime')); // governance-runtime enforces RBAC
+        this.register('agent_auth_active', modulePresence('agent-auth'));
+        this.register('monitoring_active', modulePresence('event-bus'));
+        this.register('event_bus_active', modulePresence('event-bus')); // breach-notification workflow: event bus wired and active
+        this.register('human_oversight', modulePresence('approval-queue'));
+        this.register('approval_queue_active', modulePresence('approval-queue'));
+        this.register('transparency_active', modulePresence('transparency-injector'));
+        this.register('data_classifier_active', modulePresence('data-classifier'));
+        this.register('post_market_monitoring', modulePresence('anomaly-detector'));
+        this.register('incident_reporting', modulePresence('event-bus'));
+        this.register('bias_monitor_active', modulePresence('bias-monitor'));
+        this.register('attestation_active', modulePresence('attestation-manager'));
+        this.register('subservice_registry_active', modulePresence('supply-chain'));
+        this.register('change_management_active', modulePresence('governance-runtime'));
+        this.register('segregation_of_duties_active', modulePresence('approval-queue'));
+        this.register('service_provider_contracts_active', modulePresence('supply-chain'));
+        this.register('developer_statement_active', modulePresence('supply-chain'));
+        this.register('capability_bundle_active', modulePresence('capability-bundle'));
+        // PCI-specific pattern detection (evidence-based)
+        this.register('pan_detection_active', (ctx) => {
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const categories = ctx.packConfig?.['data-classifier']?.enabledCategories ?? [];
+            const panCategory = categories.some(c => /PAN/i.test(c));
+            const passed = dcActive && panCategory;
+            return {
+                passed,
+                detail: passed
+                    ? 'data-classifier active with PAN category enabled'
+                    : `data-classifier=${dcActive}, PAN category=${panCategory}`,
+            };
+        });
+        // Retention sanity checks
+        this.register('audit_trail_12mo', retentionAtLeast('auditRetentionDays', 365, 'audit retention'));
+        // Generic retention-policy presence check used by jurisdiction-specific
+        // packs (UK NHS, MHRA, Equality Act, NIS, Online Safety, Procurement,
+        // CMA, NI Equality, NI HSCNI, Scotland AWI / Procurement Reform,
+        // EU DMA / CRA, HK PDPO, NI MCA). Passes when the audit-integrity
+        // module is active AND auditRetentionDays > 0. The pack-specific
+        // minimum-days obligation is enforced by per-pack retention checks
+        // (e.g. audit_trail_12mo); this generic gate only verifies that some
+        // non-zero retention is configured, which is the precondition every
+        // jurisdiction shares.
+        this.register('retention_policy_active', (ctx) => {
+            const auditActive = ctx.activeModules.includes('audit-integrity');
+            const days = ctx.evidence?.auditRetentionDays;
+            const n = typeof days === 'number' ? days : 0;
+            const passed = auditActive && n > 0;
+            return {
+                passed,
+                detail: passed
+                    ? `retention policy active: audit-integrity module loaded, auditRetentionDays=${n}`
+                    : `retention policy not active: audit-integrity=${auditActive}, auditRetentionDays=${n}`,
+            };
+        });
+        // Evidence-flag checks (runtime must set these)
+        this.register('hash_chain_persisted', evidenceFlag('hashChainPersisted', 'hash chain persistence'));
+        this.register('cuec_register_active', evidenceFlag('cuecRegisterActive', 'CUEC register'));
+        this.register('notice_at_collection_active', evidenceFlag('noticeAtCollectionActive', 'notice at collection'));
+        this.register('opt_out_honour_active', evidenceFlag('optOutHonourActive', 'opt-out honour (incl. GPC)'));
+        this.register('spi_restriction_active', evidenceFlag('spiRestrictionActive', 'SPI restriction'));
+        this.register('dsr_deadline_active', evidenceFlag('dsrDeadlineActive', 'DSR 45-day deadline tracking'));
+        this.register('admt_opt_out_active', evidenceFlag('admtOptOutActive', 'ADMT opt-out'));
+        this.register('non_discrimination_active', evidenceFlag('nonDiscriminationActive', 'non-discrimination'));
+        this.register('risk_assessment_active', evidenceFlag('riskAssessmentActive', 'risk assessment'));
+        this.register('cybersecurity_audit_active', evidenceFlag('cybersecurityAuditActive', 'annual cybersecurity audit'));
+        this.register('ai_training_transparency_active', evidenceFlag('aiTrainingTransparencyActive', 'AI training data transparency'));
+        this.register('delete_act_active', evidenceFlag('deleteActActive', 'SB 362 Delete Act participation'));
+        this.register('impact_assessment_current', evidenceFlag('impactAssessmentCurrent', 'impact assessment currency'));
+        this.register('material_modification_reassessment_active', evidenceFlag('materialModificationReassessmentActive', 'material modification reassessment'));
+        this.register('consumer_notice_active', evidenceFlag('consumerNoticeActive', 'consumer notice'));
+        this.register('adverse_decision_workflow_active', evidenceFlag('adverseDecisionWorkflowActive', 'adverse decision workflow'));
+        this.register('risk_management_program_active', evidenceFlag('riskManagementProgramActive', 'risk management program'));
+        this.register('discrimination_disclosure_on_time', evidenceFlag('discriminationDisclosureOnTime', '90-day discrimination disclosure'));
+        this.register('public_statement_current', evidenceFlag('publicStatementCurrent', 'public statement'));
+        this.register('exemption_register_active', evidenceFlag('exemptionRegisterActive', 'exemption register'));
+        // -- HITECH-specific checks (derive from module config where possible) --
+        const configFlag = (mod, field, label) => (ctx) => {
+            const v = ctx.packConfig?.[mod]?.[field];
+            const passed = v === true || typeof v === 'number' || (Array.isArray(v) && v.length > 0);
+            return {
+                passed,
+                detail: passed
+                    ? `${label} configured (${mod}.${field})`
+                    : `${label} not configured (${mod}.${field} missing or falsy)`,
+            };
+        };
+        const configNumberAtLeast = (mod, field, minimum, label) => (ctx) => {
+            const v = ctx.packConfig?.[mod]?.[field];
+            const n = typeof v === 'number' ? v : 0;
+            const passed = n >= minimum;
+            return {
+                passed,
+                detail: passed
+                    ? `${label}: ${mod}.${field}=${n} >= ${minimum}`
+                    : `${label}: ${mod}.${field}=${n} < ${minimum}`,
+            };
+        };
+        this.register('hitech_hipaa_paired', (ctx) => {
+            const activePackIds = ctx.activePackIds ?? [];
+            const hipaaActive = activePackIds.includes('hipaa');
+            const requires = ctx.packConfig?.['governance-runtime']?.requiresPacks ?? [];
+            const configuredForPair = requires.includes('hipaa');
+            const passed = hipaaActive && configuredForPair;
+            return {
+                passed,
+                detail: passed
+                    ? 'HITECH paired with HIPAA (both packs active; governance-runtime.requiresPacks includes hipaa)'
+                    : `pair check failed: hipaa-active=${hipaaActive}, requiresPacks-has-hipaa=${configuredForPair}`,
+            };
+        });
+        this.register('breach_clock_active', configNumberAtLeast('session-persistence', 'breachClockTrackingDays', 1, 'breach clock'));
+        this.register('breach_500_escalation_active', (ctx) => {
+            const threshold = ctx.packConfig?.['session-persistence']?.breachThresholdForMediaNotice;
+            const passed = threshold === 500;
+            return {
+                passed,
+                detail: passed
+                    ? '500-record media escalation threshold configured'
+                    : `expected session-persistence.breachThresholdForMediaNotice=500, got ${threshold}`,
+            };
+        });
+        this.register('annual_hhs_report_scheduled', evidenceFlag('annualHhsReportScheduled', 'HHS annual small-breach report'));
+        this.register('ba_chain_tracked', configFlag('supply-chain', 'baChainTrackingRequired', 'BA chain tracking'));
+        this.register('penalty_tier_classifier_active', configFlag('governance-runtime', 'tierClassificationActive', 'penalty tier classifier'));
+        this.register('unsecured_phi_detector_active', (ctx) => {
+            const encLayer = ctx.activeModules.includes('encryption-layer');
+            const dc = ctx.activeModules.includes('data-classifier');
+            const passed = encLayer && dc;
+            return {
+                passed,
+                detail: passed
+                    ? 'unsecured-PHI detector derived from encryption-layer + data-classifier presence'
+                    : `missing modules: encryption-layer=${encLayer}, data-classifier=${dc}`,
+            };
+        });
+        this.register('phi_sale_gate_active', configFlag('approval-queue', 'phiSaleRequiresAuthorisation', 'PHI sale gate'));
+        this.register('phi_marketing_gate_active', configFlag('approval-queue', 'phiMarketingRequiresAuthorisation', 'PHI marketing gate'));
+        this.register('recognised_security_practices_active', (ctx) => {
+            const frameworks = ctx.packConfig?.['attestation-manager']?.recognisedSecurityPracticesFrameworks ?? [];
+            const months = ctx.packConfig?.['attestation-manager']?.recognisedSecurityPracticesMinimumMonths ?? 0;
+            const evidenceMonths = ctx.evidence?.recognisedSecurityPracticesMonths ?? 0;
+            const configured = frameworks.length > 0 && months >= 12;
+            const evidenced = evidenceMonths >= 12;
+            const passed = configured && evidenced;
+            return {
+                passed,
+                detail: passed
+                    ? `HR 7898 Safe Harbor: ${frameworks.join(', ')} attested for ${evidenceMonths} months`
+                    : configured
+                        ? `HR 7898 configured but evidence shows only ${evidenceMonths} months (need >=12)`
+                        : `HR 7898 frameworks not configured`,
+            };
+        });
+        this.register('ocr_audit_ready', evidenceFlag('ocrAuditReady', 'OCR audit readiness'));
+        // -- GLBA-specific checks --
+        this.register('wisp_active', evidenceFlag('wispActive', 'Written Information Security Program'));
+        this.register('qualified_individual_active', configFlag('governance-runtime', 'qualifiedIndividualRequired', 'qualified individual'));
+        this.register('glba_mfa_active', configFlag('agent-auth', 'mfaMandatoryForNpiAccess', 'MFA for NPI access'));
+        this.register('service_provider_oversight_active', configFlag('supply-chain', 'serviceProviderDueDiligenceRequired', 'service provider oversight'));
+        this.register('glba_opt_out_honoured', (ctx) => {
+            const configured = ctx.packConfig?.['session-persistence']?.optOutPersistenceRequired === true;
+            const evidenced = ctx.evidence?.glbaOptOutHonoured === true;
+            const passed = configured && evidenced;
+            return {
+                passed,
+                detail: passed
+                    ? 'opt-out configured and runtime evidence present'
+                    : `opt-out configured=${configured}, evidence=${evidenced}`,
+            };
+        });
+        this.register('glba_privacy_notice_current', (ctx) => {
+            const configured = ctx.packConfig?.['session-persistence']?.privacyNoticeAnnualDeliveryRequired === true;
+            const evidenced = ctx.evidence?.glbaPrivacyNoticeCurrent === true;
+            const passed = configured && evidenced;
+            return {
+                passed,
+                detail: passed
+                    ? 'initial + annual privacy notice current'
+                    : `configured=${configured}, evidence=${evidenced}`,
+            };
+        });
+        this.register('pretexting_detection_active', evidenceFlag('pretextingDetectionActive', 'pretexting detection'));
+        this.register('glba_testing_cadence_active', (ctx) => {
+            const pent = ctx.packConfig?.['attestation-manager']?.penetrationTestCadenceDays;
+            const vuln = ctx.packConfig?.['attestation-manager']?.vulnerabilityScanCadenceDays;
+            const passed = pent === 365 && vuln === 182;
+            return {
+                passed,
+                detail: passed
+                    ? 'pentest 365d + vuln scan 182d cadence configured'
+                    : `pentest=${pent}, vuln=${vuln}`,
+            };
+        });
+        this.register('glba_30day_notice_active', evidenceFlag('glba30dayNoticeActive', '30-day FTC notification wiring'));
+        this.register('glba_board_report_active', configFlag('attestation-manager', 'boardAnnualReportRequired', 'annual board report'));
+        // -- ABA-specific checks --
+        this.register('aba_citecheck_active', evidenceFlag('abaCitecheckActive', 'cite-check evidence'));
+        this.register('aba_confidentiality_gate_active', (ctx) => {
+            const dcAction = ctx.packConfig?.['data-classifier']?.privilegedAction;
+            const passed = dcAction === 'BLOCK_UNLESS_CONSENTED';
+            return {
+                passed,
+                detail: passed
+                    ? 'privileged action = BLOCK_UNLESS_CONSENTED configured'
+                    : `data-classifier.privilegedAction=${dcAction}`,
+            };
+        });
+        this.register('aba_supervision_active', configFlag('attestation-manager', 'supervisingLawyerRequiredPerAgent', 'supervising lawyer per agent'));
+        this.register('aba_filing_review_active', configFlag('approval-queue', 'courtFilingRequiresLawyerReview', 'court filing review'));
+        this.register('aba_client_consent_active', (ctx) => {
+            const configured = ctx.packConfig?.['session-persistence']?.clientInformedConsentRequired === true;
+            const evidenced = ctx.evidence?.abaClientConsentActive === true;
+            const passed = configured && evidenced;
+            return {
+                passed,
+                detail: passed
+                    ? 'client consent configured and evidence present'
+                    : `configured=${configured}, evidence=${evidenced}`,
+            };
+        });
+        this.register('aba_conflicts_active', (ctx) => {
+            const isolation = ctx.packConfig?.['session-persistence']?.perMatterIsolationRequired === true;
+            const conflicts = ctx.packConfig?.['session-persistence']?.conflictCheckRequired === true;
+            const passed = isolation && conflicts;
+            return {
+                passed,
+                detail: passed
+                    ? 'per-matter isolation + conflict check configured'
+                    : `isolation=${isolation}, conflicts=${conflicts}`,
+            };
+        });
+        this.register('aba_upl_active', configFlag('governance-runtime', 'upljurisdictionScopeRequired', 'UPL jurisdiction scope'));
+        this.register('aba_fee_review_active', configFlag('approval-queue', 'feeReasonablenessReviewRequired', 'fee reasonableness review'));
+        this.register('aba_marketing_review_active', configFlag('approval-queue', 'marketingTruthfulnessReviewRequired', 'marketing truthfulness review'));
+        this.register('aba_vendor_terms_active', (ctx) => {
+            const zeroRet = ctx.packConfig?.['supply-chain']?.vendorZeroRetentionRequired === true;
+            const zeroTrain = ctx.packConfig?.['supply-chain']?.vendorZeroTrainingOnInputsRequired === true;
+            const segregation = ctx.packConfig?.['supply-chain']?.vendorClientDataSegregationRequired === true;
+            const passed = zeroRet && zeroTrain && segregation;
+            return {
+                passed,
+                detail: passed
+                    ? 'vendor terms: zero-retention + zero-training-on-inputs + client-data-segregation'
+                    : `zeroRet=${zeroRet}, zeroTrain=${zeroTrain}, segregation=${segregation}`,
+            };
+        });
+        // -- FTC §5-specific checks --
+        this.register('ftc5_claim_substantiation_active', configFlag('governance-runtime', 'claimSubstantiationRequired', 'claim substantiation'));
+        this.register('ftc5_fake_review_active', configFlag('anomaly-detector', 'fakeReviewDetectionActive', 'fake-review detection'));
+        this.register('ftc5_ai_disclosure_active', (ctx) => {
+            const gen = ctx.packConfig?.['transparency-injector']?.aiGenerationDisclosureRequired === true;
+            const end = ctx.packConfig?.['transparency-injector']?.syntheticEndorsementDisclosureRequired === true;
+            const passed = gen && end;
+            return {
+                passed,
+                detail: passed
+                    ? 'AI-generation + synthetic-endorsement disclosure configured'
+                    : `generation=${gen}, endorsement=${end}`,
+            };
+        });
+        this.register('ftc5_dark_patterns_active', configFlag('approval-queue', 'darkPatternDeploymentReview', 'dark-pattern review'));
+        this.register('ftc5_fraud_chatbot_active', evidenceFlag('ftc5FraudChatbotActive', 'chatbot fraud detection'));
+        this.register('ftc5_coppa_gate_active', configFlag('governance-runtime', 'ageGateRequired', 'COPPA age gate'));
+        this.register('ftc5_data_minimisation_active', configFlag('governance-runtime', 'dataMinimisationRequired', 'data minimisation'));
+        this.register('ftc5_disgorgement_readiness_active', (ctx) => {
+            const gr = ctx.packConfig?.['governance-runtime']?.algorithmicDisgorgementReadyRequired === true;
+            const att = ctx.packConfig?.['attestation-manager']?.trainingDataProvenanceRequired === true;
+            const passed = gr && att;
+            return {
+                passed,
+                detail: passed
+                    ? 'disgorgement readiness: governance-runtime flag + training-data provenance configured'
+                    : `gr=${gr}, att=${att}`,
+            };
+        });
+        this.register('ftc5_disparate_impact_active', configFlag('anomaly-detector', 'disparateImpactDetectionActive', 'disparate impact detection'));
+        this.register('ftc5_ai_washing_active', (ctx) => {
+            const registry = ctx.packConfig?.['attestation-manager']?.claimRegistryRequired === true;
+            const passed = registry;
+            return {
+                passed,
+                detail: passed
+                    ? 'claim registry required; AI-washing prevented'
+                    : 'claim registry not configured',
+            };
+        });
+        // -- SR 11-7 specific checks --
+        this.register('sr117_inventory_active', configFlag('governance-runtime', 'modelInventoryRegistrationRequired', 'model inventory'));
+        this.register('sr117_validation_independence_active', configFlag('approval-queue', 'validatorSeparationRequired', 'validator separation'));
+        this.register('sr117_validation_cadence_active', (ctx) => {
+            const cadence = ctx.packConfig?.['attestation-manager']?.validationCadenceByTierDays;
+            const ok = !!cadence && typeof cadence.CRITICAL === 'number' && typeof cadence.LOW === 'number';
+            return {
+                passed: ok,
+                detail: ok
+                    ? `cadence configured: CRITICAL=${cadence.CRITICAL}d, HIGH=${cadence.HIGH}d, MEDIUM=${cadence.MEDIUM}d, LOW=${cadence.LOW}d`
+                    : 'tier cadence not configured',
+            };
+        });
+        this.register('sr117_challenger_active', configFlag('attestation-manager', 'challengerModelRequiredForCriticalTier', 'challenger model for CRITICAL tier'));
+        this.register('sr117_drift_monitoring_active', configFlag('anomaly-detector', 'driftDetectionActive', 'drift monitoring'));
+        this.register('sr117_retirement_active', configFlag('governance-runtime', 'retirementEnforcementRequired', 'retirement enforcement'));
+        this.register('sr117_documentation_active', (ctx) => {
+            const fields = ctx.packConfig?.['supply-chain']?.developerStatementFields;
+            const ok = Array.isArray(fields) && fields.length >= 4;
+            return {
+                passed: !!ok,
+                detail: ok ? `developer statement fields: ${fields?.join(', ')}` : 'developer statement fields missing',
+            };
+        });
+        this.register('sr117_material_change_active', configFlag('approval-queue', 'materialChangeRevalidationRequired', 'material change revalidation'));
+        this.register('sr117_governance_report_active', evidenceFlag('sr117GovernanceReportActive', 'enterprise model-risk governance report'));
+        // -- 21 CFR Part 11 specific checks --
+        this.register('part11_validation_gate_active', configFlag('governance-runtime', 'validationGateRequired', 'IQ/OQ/PQ validation gate'));
+        this.register('part11_esignature_active', configFlag('approval-queue', 'eSignatureOnRecordModificationRequired', 'e-signature on record modification'));
+        this.register('part11_append_only_audit_active', configFlag('audit-integrity', 'appendOnlyAuditTrailRequired', 'append-only audit trail'));
+        this.register('part11_authority_matrix_active', configFlag('governance-runtime', 'authorityMatrixEnforced', 'authority-to-sign matrix'));
+        this.register('part11_signature_binding_active', configFlag('approval-queue', 'signatureBoundToRecordHash', 'signature bound to record hash'));
+        this.register('part11_timestamps_active', configFlag('event-bus', 'ntpTimestampRequired', 'NTP timestamps'));
+        this.register('part11_ai_provenance_active', configFlag('attestation-manager', 'aiProvenanceAttestationRequired', 'AI provenance attestation'));
+        this.register('part11_contemporaneous_active', configFlag('session-persistence', 'contemporaneousCaptureRequired', 'contemporaneous capture'));
+        this.register('part11_sequencing_active', configFlag('event-bus', 'sequenceIdEnforced', 'event sequencing'));
+        this.register('part11_retention_active', configFlag('attestation-manager', 'retentionLockedToPredicateRule', 'predicate-rule retention lock'));
+        this.register('part11_alcoa_plus_active', configFlag('governance-runtime', 'alcoaPlusEnforced', 'ALCOA+ enforcement'));
+        // -- SOX 404 specific checks --
+        this.register('sox404_management_assessment_active', configFlag('attestation-manager', 'annualManagementAssessmentRequired', '§404(a) management assessment'));
+        this.register('sox404_control_mapping_active', configFlag('governance-runtime', 'icfrControlMappingRequired', 'ICFR control mapping'));
+        this.register('sox404_material_change_active', configFlag('governance-runtime', 'materialChangeReassessmentRequired', 'material change reassessment'));
+        this.register('sox404_sod_active', configFlag('approval-queue', 'sodEnforced', 'segregation of duties'));
+        this.register('sox404_ai_gl_gate_active', configFlag('approval-queue', 'aiOutputToGeneralLedgerRequiresHumanReview', 'AI-to-GL human review gate'));
+        this.register('sox404_deficiency_register_active', configFlag('attestation-manager', 'deficiencyRegisterRequired', 'deficiency register'));
+        this.register('sox404_testing_cadence_active', (ctx) => {
+            const days = ctx.packConfig?.['attestation-manager']?.quarterlyControlTestingCadenceDays;
+            const passed = typeof days === 'number' && days <= 90;
+            return {
+                passed,
+                detail: passed
+                    ? `quarterly control testing cadence configured (${days}d)`
+                    : `testing cadence not configured (${days})`,
+            };
+        });
+        this.register('sox404_change_management_active', evidenceFlag('sox404ChangeManagementActive', 'change management log'));
+        this.register('sox404_cuec_register_active', configFlag('supply-chain', 'socOneCuecRegistrationRequired', 'SOC 1 CUEC register'));
+        this.register('sox404_itgc_matrix_active', evidenceFlag('sox404ItgcMatrixActive', 'ITGC matrix'));
+        // F-NEW-VERA-PACK-C2-07 (2026-05-03): COSO 2013 framework version validator.
+        // PCAOB AS 2201 §.03 requires COSO 2013 Integrated Framework (5 components, 17 principles).
+        // The superseded 1992 framework is not acceptable for SOX 404 ICFR assessments.
+        this.register('sox404_coso_2013_framework_active', (ctx) => {
+            const cosoAlignment = ctx.packConfig?.['governance-runtime']?.cosoFrameworkAlignmentRequired;
+            const passed = cosoAlignment === 'COSO 2013';
+            return {
+                passed,
+                detail: passed
+                    ? 'COSO 2013 Integrated Framework alignment configured (5 components, 17 principles)'
+                    : `COSO framework alignment not configured or not set to 'COSO 2013' (found: ${cosoAlignment ?? 'undefined'}) -- PCAOB AS 2201 requires COSO 2013`,
+            };
+        });
+        // -- BSA / AML specific checks --
+        this.register('bsa_cip_active', configFlag('governance-runtime', 'cipRequired', 'Customer Identification Program'));
+        this.register('bsa_cdd_active', configFlag('governance-runtime', 'cddRequired', 'Customer Due Diligence'));
+        this.register('bsa_ofac_active', configFlag('governance-runtime', 'ofacScreeningRequired', 'OFAC sanctions screening'));
+        this.register('bsa_sar_30day_active', evidenceFlag('bsaSar30dayActive', '30-day SAR filing'));
+        this.register('bsa_ctr_10k_active', (ctx) => {
+            const threshold = ctx.packConfig?.['data-classifier']?.transactionThresholdCtrUsd;
+            const passed = threshold === 10000;
+            return {
+                passed,
+                detail: passed ? 'CTR threshold $10,000 configured' : `CTR threshold ${threshold}`,
+            };
+        });
+        this.register('bsa_officer_designated', configFlag('attestation-manager', 'bsaOfficerDesignationRequired', 'BSA officer designation'));
+        this.register('bsa_annual_training_active', configFlag('attestation-manager', 'annualTrainingRequired', 'annual BSA/AML training'));
+        this.register('bsa_independent_testing_active', (ctx) => {
+            const days = ctx.packConfig?.['attestation-manager']?.independentTestingCadenceDays;
+            const passed = typeof days === 'number' && days <= 365;
+            return {
+                passed,
+                detail: passed ? `independent testing cadence ${days}d` : `cadence not set (${days})`,
+            };
+        });
+        this.register('bsa_boi_active', configFlag('governance-runtime', 'boiReportingRequired', 'Corporate Transparency Act BOI reporting'));
+        this.register('bsa_ai_explainability_active', evidenceFlag('bsaAiExplainabilityActive', 'AI explainability for SAR narrative'));
+        this.register('bsa_aml_bias_active', configFlag('bias-monitor', 'amlDemographicBiasMonitoringRequired', 'AML demographic bias monitoring'));
+        // -- NY DFS 500 specific checks --
+        this.register('nydfs500_ciso_active', configFlag('attestation-manager', 'cisoDesignationRequired', 'CISO designation + board report'));
+        this.register('nydfs500_mfa_active', (ctx) => {
+            const priv = ctx.packConfig?.['agent-auth']?.mfaForPrivilegedAccess === true;
+            const rem = ctx.packConfig?.['agent-auth']?.mfaForRemoteAccess === true;
+            const passed = priv && rem;
+            return {
+                passed,
+                detail: passed
+                    ? 'MFA enforced on privileged + remote access'
+                    : `privileged=${priv}, remote=${rem}`,
+            };
+        });
+        this.register('nydfs500_72h_notice_active', (ctx) => {
+            const hours = ctx.packConfig?.['event-bus']?.cybersecurityEventNotificationHours;
+            const passed = hours === 72;
+            return {
+                passed,
+                detail: passed
+                    ? '72-hour cybersecurity event notification configured'
+                    : `cybersecurityEventNotificationHours=${hours}`,
+            };
+        });
+        this.register('nydfs500_24h_ransomware_active', (ctx) => {
+            const hours = ctx.packConfig?.['event-bus']?.ransomwarePaymentNotificationHours;
+            const passed = hours === 24;
+            return {
+                passed,
+                detail: passed
+                    ? '24-hour ransomware payment notification configured'
+                    : `ransomwarePaymentNotificationHours=${hours}`,
+            };
+        });
+        this.register('nydfs500_risk_assessment_active', configFlag('attestation-manager', 'riskAssessmentCadenceDays', 'annual risk assessment cadence'));
+        this.register('nydfs500_pentest_cadence_active', (ctx) => {
+            const pent = ctx.packConfig?.['attestation-manager']?.penetrationTestCadenceDays;
+            const vuln = ctx.packConfig?.['attestation-manager']?.vulnerabilityScanCadenceDays;
+            const passed = pent === 365 && vuln === 182;
+            return {
+                passed,
+                detail: passed
+                    ? 'annual pentest + bi-annual vuln scan cadences configured'
+                    : `pentest=${pent}, vuln=${vuln}`,
+            };
+        });
+        this.register('nydfs500_supply_chain_active', configFlag('supply-chain', 'serviceProviderDueDiligenceRequired', 'third-party service provider policy'));
+        this.register('nydfs500_asset_inventory_active', configFlag('session-persistence', 'assetInventoryRequired', 'asset inventory'));
+        this.register('nydfs500_training_active', configFlag('attestation-manager', 'cybersecurityTrainingCadenceDays', 'cybersecurity training cadence'));
+        this.register('nydfs500_ai_risk_active', configFlag('governance-runtime', 'aiSpecificRiskAssessmentRequired', 'AI-specific risk assessment'));
+        // -- CFPB 2023-03 specific checks --
+        this.register('cfpb_adverse_deadline_active', (ctx) => {
+            const days = ctx.packConfig?.['governance-runtime']?.adverseActionDeadlineDays;
+            const passed = days === 30;
+            return {
+                passed,
+                detail: passed ? '30-day adverse action deadline configured' : `adverseActionDeadlineDays=${days}`,
+            };
+        });
+        this.register('cfpb_principal_factor_active', configFlag('governance-runtime', 'principalFactorReasonRequired', 'principal-factor reason requirement'));
+        this.register('cfpb_generic_blocked_active', (ctx) => {
+            const gr = ctx.packConfig?.['governance-runtime']?.genericRationaleBlocked === true;
+            const aq = ctx.packConfig?.['approval-queue']?.genericReasonBlocked === true;
+            const passed = gr && aq;
+            return {
+                passed,
+                detail: passed
+                    ? 'generic rationale blocked at governance-runtime AND approval-queue'
+                    : `governance-runtime=${gr}, approval-queue=${aq}`,
+            };
+        });
+        this.register('cfpb_vendor_doc_active', configFlag('approval-queue', 'vendorScoringCreditorDocumentationRequired', 'vendor-scoring creditor documentation'));
+        this.register('cfpb_sample_form_active', configFlag('approval-queue', 'sampleFormCodeValidation', 'Regulation B sample-form validation'));
+        this.register('cfpb_methodology_active', configFlag('attestation-manager', 'reasonDerivationMethodologyRequired', 'reason-derivation methodology documentation'));
+        this.register('cfpb_ecoa_bias_active', configFlag('bias-monitor', 'ecoaDisparateImpactMonitoringRequired', 'ECOA disparate impact monitoring'));
+        this.register('cfpb_conflict_detection_active', configFlag('anomaly-detector', 'conflictingReasonCodeDetectionActive', 'conflicting reason-code detection'));
+        this.register('cfpb_retention_active', evidenceFlag('cfpbRetentionActive', 'Regulation B retention compliance'));
+        // -- HIPAA-specific checks (added in normalization pass) --
+        this.register('hipaa_auto_logoff_active', configFlag('session-persistence', 'autoLogoffRequired', 'automatic logoff'));
+        this.register('hipaa_integrity_active', (ctx) => {
+            const passed = ctx.activeModules.includes('memory-integrity');
+            return {
+                passed,
+                detail: passed ? 'memory-integrity module active' : 'memory-integrity module not active',
+            };
+        });
+        this.register('hipaa_minimum_necessary_active', configFlag('governance-runtime', 'minimumNecessaryEnforced', 'minimum-necessary standard'));
+        // -- GDPR-specific checks (added in normalization pass) --
+        this.register('gdpr_breach_72h_active', (ctx) => {
+            // Check that event-bus is active and pack has 72h incident deadline
+            const evActive = ctx.activeModules.includes('event-bus');
+            return {
+                passed: evActive,
+                detail: evActive
+                    ? 'event-bus active; 72h breach notification clock available'
+                    : 'event-bus not active; breach notification clock unavailable',
+            };
+        });
+        this.register('gdpr_transfer_mechanism_active', (ctx) => {
+            const dpf = ctx.packConfig?.['governance-runtime']?.dpfTransferMechanismSupported === true;
+            const scc = ctx.packConfig?.['governance-runtime']?.sccTransferMechanismSupported === true;
+            const passed = dpf || scc;
+            return {
+                passed,
+                detail: passed
+                    ? `transfer mechanism supported: DPF=${dpf}, SCC=${scc}`
+                    : 'no transfer mechanism configured',
+            };
+        });
+        this.register('gdpr_purpose_limitation_active', configFlag('governance-runtime', 'purposeLimitationEnforced', 'purpose limitation'));
+        this.register('gdpr_lawful_basis_active', configFlag('governance-runtime', 'lawfulBasisEnforced', 'lawful basis enforcement'));
+        this.register('gdpr_article22_active', configFlag('approval-queue', 'article22HumanReviewRequired', 'Art. 22 human review'));
+        this.register('gdpr_ropa_active', configFlag('attestation-manager', 'ropaRequired', 'Records of Processing Activities'));
+        this.register('gdpr_dpia_active', configFlag('attestation-manager', 'dpiaRequired', 'Data Protection Impact Assessment'));
+        // -- PCI DSS v4.0.1 specific checks (added in normalization pass) --
+        this.register('pci_mfa_cde_active', configFlag('agent-auth', 'mfaForCdeAccessRequired', 'MFA for CDE access'));
+        this.register('pci_tpsp_active', configFlag('supply-chain', 'tpspManagementRequired', 'TPSP management with AOC'));
+        this.register('pci_asv_scan_active', configFlag('attestation-manager', 'annualAsvScanRequired', 'quarterly ASV scan'));
+        this.register('pci_pentest_active', configFlag('attestation-manager', 'annualPenetrationTestRequired', 'annual penetration test'));
+        this.register('pci_targeted_risk_active', configFlag('attestation-manager', 'targetedRiskAnalysisRequired', 'targeted risk analysis'));
+        // -- EU AI Act specific checks (added in normalization pass) --
+        this.register('euai_prohibited_practice_active', configFlag('governance-runtime', 'prohibitedPracticeCheckRequired', 'Art. 5 prohibited-practice detection'));
+        this.register('euai_gpai_active', configFlag('supply-chain', 'gpaiObligationsTracked', 'GPAI obligations tracking'));
+        this.register('euai_fria_active', configFlag('bias-monitor', 'friaSupported', 'Fundamental Rights Impact Assessment'));
+        this.register('euai_conformity_active', configFlag('attestation-manager', 'conformityAssessmentRequired', 'conformity assessment + EU database registration'));
+        // -- ISO 27001:2022 specific checks (added in normalization pass) --
+        this.register('iso_config_mgmt_active', (ctx) => {
+            const passed = ctx.activeModules.includes('memory-integrity');
+            return {
+                passed,
+                detail: passed ? 'memory-integrity module active (A.8.9)' : 'memory-integrity module not active',
+            };
+        });
+        this.register('iso_threat_intel_active', configFlag('anomaly-detector', 'threatIntelligenceActive', 'threat intelligence (A.5.7)'));
+        this.register('iso_isms_active', (ctx) => {
+            const documented = ctx.packConfig?.['attestation-manager']?.ismsDocumentedRequired === true;
+            const soa = ctx.packConfig?.['attestation-manager']?.statementOfApplicabilityRequired === true;
+            const review = ctx.packConfig?.['attestation-manager']?.managementReviewAnnualRequired === true;
+            const audit = ctx.packConfig?.['attestation-manager']?.internalAuditAnnualRequired === true;
+            const passed = documented && soa && review && audit;
+            return {
+                passed,
+                detail: passed
+                    ? 'ISMS documented + SoA + annual management review + internal audit configured'
+                    : `ISMS=${documented}, SoA=${soa}, review=${review}, audit=${audit}`,
+            };
+        });
+        // -- DORA specific checks (added in normalization pass) --
+        this.register('dora_incident_4hr_active', (ctx) => {
+            const hours = ctx.packConfig?.['event-bus']?.majorIncidentFourHourNotificationHours;
+            const passed = hours === 4;
+            return {
+                passed,
+                detail: passed ? '4-hour major-incident notification configured' : `majorIncidentFourHourNotificationHours=${hours}`,
+            };
+        });
+        this.register('dora_incident_cascade_active', (ctx) => {
+            const four = ctx.packConfig?.['event-bus']?.majorIncidentFourHourNotificationHours;
+            const seventyTwo = ctx.packConfig?.['event-bus']?.majorIncidentSeventyTwoHourInterimHours;
+            const month = ctx.packConfig?.['event-bus']?.majorIncidentOneMonthFinalHours;
+            const passed = four === 4 && seventyTwo === 72 && month === 720;
+            return {
+                passed,
+                detail: passed
+                    ? '4h/72h/1-month cascade reporting configured'
+                    : `4h=${four}, 72h=${seventyTwo}, 1mo=${month}`,
+            };
+        });
+        this.register('dora_resilience_active', (ctx) => {
+            const cb = ctx.activeModules.includes('circuit-breaker');
+            const config = ctx.packConfig?.['circuit-breaker']?.responseAndRecoveryRequired === true;
+            const passed = cb && config;
+            return {
+                passed,
+                detail: passed
+                    ? 'circuit-breaker active + response-and-recovery configured'
+                    : `circuit-breaker=${cb}, config=${config}`,
+            };
+        });
+        this.register('dora_register_of_information_active', configFlag('supply-chain', 'registerOfInformationRequired', 'Register of Information'));
+        this.register('dora_tlpt_active', configFlag('attestation-manager', 'threatLedPenetrationTestingRequired', 'threat-led penetration testing'));
+        // -- NIST AI RMF specific checks (added in normalization pass) --
+        this.register('nist_manage_2_active', (ctx) => {
+            const cb = ctx.activeModules.includes('circuit-breaker');
+            const config = ctx.packConfig?.['circuit-breaker']?.residualRiskMitigationRequired === true;
+            const passed = cb && config;
+            return {
+                passed,
+                detail: passed ? 'circuit-breaker + residual-risk mitigation configured' : `cb=${cb}, config=${config}`,
+            };
+        });
+        this.register('nist_risk_register_active', configFlag('attestation-manager', 'riskRegisterRequired', 'risk register (MANAGE 4)'));
+        this.register('nist_genai_profile_active', configFlag('attestation-manager', 'genaiProfileAlignmentRequired', 'NIST GenAI Profile alignment'));
+        // -- ISO/IEC 42001 specific checks (added in normalization pass) --
+        this.register('iso42001_context_active', configFlag('governance-runtime', 'aimsContextDefined', 'AIMS context of organisation'));
+        this.register('iso42001_leadership_active', configFlag('approval-queue', 'leadershipCommitmentRequired', 'leadership commitment + AI policy'));
+        this.register('iso42001_responsible_objectives_active', configFlag('bias-monitor', 'responsibleAiObjectivesTracked', 'responsible AI objectives'));
+        this.register('iso42001_data_lifecycle_active', configFlag('data-classifier', 'aiDataLifecycleManagementRequired', 'AI data lifecycle (Annex B)'));
+        this.register('iso42001_internal_audit_active', (ctx) => {
+            const review = ctx.packConfig?.['attestation-manager']?.managementReviewRequired === true;
+            const audit = ctx.packConfig?.['attestation-manager']?.internalAuditRequired === true;
+            const passed = review && audit;
+            return {
+                passed,
+                detail: passed ? 'internal audit + management review configured' : `audit=${audit}, review=${review}`,
+            };
+        });
+        this.register('iso42001_impact_assessment_active', configFlag('attestation-manager', 'aiSystemImpactAssessmentRequired', 'AI system impact assessment (Annex C)'));
+        this.register('iso42001_soa_active', configFlag('attestation-manager', 'annexAStatementOfApplicabilityRequired', 'Statement of Applicability (Annex A)'));
+        // -- FDA SaMD specific checks (added in normalization pass) --
+        this.register('samd_qmsr_validation_active', configFlag('governance-runtime', 'qmsrValidationRequired', 'QMSR validation'));
+        this.register('samd_pccp_active', configFlag('approval-queue', 'pccpBoundaryEnforcement', 'PCCP boundary enforcement'));
+        this.register('samd_sbom_active', configFlag('supply-chain', 'sbomRequired', 'SBOM (PATCH Act)'));
+        this.register('samd_clinical_validation_active', configFlag('attestation-manager', 'clinicalValidationPerImdrfCategoryRequired', 'clinical validation per IMDRF category'));
+        this.register('samd_real_world_perf_active', configFlag('anomaly-detector', 'realWorldPerformanceMonitoringRequired', 'real-world performance monitoring'));
+        this.register('samd_mdr_active', (ctx) => {
+            const thirty = ctx.packConfig?.['event-bus']?.mdrThirtyDayClockActive === true;
+            const five = ctx.packConfig?.['event-bus']?.mdrFiveDayCorrectiveActionClockActive === true;
+            const passed = thirty && five;
+            return {
+                passed,
+                detail: passed ? 'MDR 30-day + 5-day clocks configured' : `30d=${thirty}, 5d=${five}`,
+            };
+        });
+        this.register('samd_post_market_active', configFlag('attestation-manager', 'postMarketSurveillancePlanRequired', 'post-market surveillance plan'));
+        this.register('samd_gmlp_active', configFlag('governance-runtime', 'gmlpPrincipleEvaluationRequired', 'GMLP principle evaluation'));
+        this.register('samd_imdrf_category_active', configFlag('governance-runtime', 'imdrfCategoryTrackingRequired', 'IMDRF SaMD category tracking'));
+        this.register('samd_bias_active', configFlag('bias-monitor', 'demographicSubgroupPerformanceRequired', 'demographic subgroup performance'));
+        this.register('samd_intended_use_active', configFlag('transparency-injector', 'indicationForUseDisclosureRequired', 'indication for use disclosure'));
+        // -- 42 CFR Part 2 specific checks (added in normalization pass) --
+        this.register('part2_consent_gate_active', configFlag('governance-runtime', 'consentGateRequired', 'SUD consent gate'));
+        this.register('part2_legal_proceedings_active', configFlag('approval-queue', 'legalProceedingsCourtOrderRequired', 'legal proceedings court order gate'));
+        this.register('part2_segmentation_active', configFlag('data-classifier', 'part2SegmentationRequired', 'Part 2 segmentation'));
+        this.register('part2_redisclosure_notice_active', configFlag('transparency-injector', 'prohibitionOnRedisclosureNoticeRequired', 'Prohibition on Redisclosure notice'));
+        this.register('part2_revocation_active', configFlag('session-persistence', 'consentRevocationContinuityRequired', 'consent revocation continuity'));
+        this.register('part2_qso_agreement_active', configFlag('supply-chain', 'qsoAgreementRequired', 'QSO agreement'));
+        this.register('part2_minimum_necessary_active', configFlag('governance-runtime', 'minimumNecessaryEnforcedForSud', 'SUD minimum necessary'));
+        this.register('part2_research_gate_active', configFlag('approval-queue', 'researchIrbConsentRequired', 'research IRB + consent gate'));
+        this.register('part2_breach_60d_active', configFlag('event-bus', 'breachNotificationSixtyDayClockActive', '60-day breach notification'));
+        this.register('part2_anti_discrimination_active', configFlag('bias-monitor', 'sudAntiDiscriminationMonitoringRequired', 'SUD anti-discrimination'));
+        // -- GxP specific checks (added in normalization pass) --
+        this.register('gxp_validation_gate_active', configFlag('governance-runtime', 'aiValidationGateRequired', 'AI validation gate per GxP branch'));
+        this.register('gxp_alcoa_plus_active', configFlag('governance-runtime', 'alcoaPlusEnforced', 'ALCOA+ enforcement'));
+        this.register('gxp_batch_release_active', configFlag('approval-queue', 'batchReleaseQaGateRequired', 'GMP batch release QA gate'));
+        this.register('gxp_raw_data_active', configFlag('session-persistence', 'rawDataPreservationRequired', 'GLP raw data preservation'));
+        this.register('gxp_eligibility_consent_active', configFlag('approval-queue', 'clinicalEligibilityConsentGateRequired', 'GCP eligibility + consent gate'));
+        this.register('gxp_ind_safety_active', (ctx) => {
+            const seven = ctx.packConfig?.['event-bus']?.indSafetyReportSevenDayClockActive === true;
+            const fifteen = ctx.packConfig?.['event-bus']?.indSafetyReportFifteenDayClockActive === true;
+            const passed = seven && fifteen;
+            return {
+                passed,
+                detail: passed ? 'IND safety 7-day + 15-day clocks configured' : `7d=${seven}, 15d=${fifteen}`,
+            };
+        });
+        this.register('gxp_protocol_deviation_active', configFlag('approval-queue', 'protocolDeviationReviewRequired', 'protocol deviation review'));
+        this.register('gxp_oos_active', configFlag('anomaly-detector', 'gmpOosDetectionActive', 'GMP OOS detection'));
+        this.register('gxp_qaa_active', configFlag('supply-chain', 'qaaRequired', 'Quality Assurance Agreement'));
+        this.register('gxp_far_active', configFlag('event-bus', 'farThreeDayClockActive', 'Field Alert Report 3-day clock'));
+        // -- NYC LL 144 specific checks (added in normalization pass) --
+        this.register('nyc144_bias_audit_active', configFlag('attestation-manager', 'biasAuditAnnualRenewalRequired', 'annual bias audit'));
+        this.register('nyc144_independent_auditor_active', configFlag('supply-chain', 'independentThirdPartyAuditorRequired', 'independent third-party auditor'));
+        this.register('nyc144_public_disclosure_active', configFlag('attestation-manager', 'publicUrlDisclosureRequired', 'public URL disclosure'));
+        this.register('nyc144_candidate_notice_active', configFlag('approval-queue', 'tenBusinessDayCandidateNoticeRequired', '10-business-day candidate notice'));
+        this.register('nyc144_alternative_process_active', configFlag('governance-runtime', 'alternativeProcessEnforcementRequired', 'alternative process'));
+        this.register('nyc144_aedt_scope_active', configFlag('governance-runtime', 'aedtScopeClassificationRequired', 'AEDT scope classification'));
+        this.register('nyc144_impact_ratio_active', (ctx) => {
+            const method = ctx.packConfig?.['bias-monitor']?.nycrr5300ImpactRatioMethodology === true;
+            const intersectional = ctx.packConfig?.['bias-monitor']?.intersectionalCategoriesRequired === true;
+            const passed = method && intersectional;
+            return {
+                passed,
+                detail: passed ? 'NYCRR 5-300 methodology + intersectional categories configured' : `method=${method}, intersectional=${intersectional}`,
+            };
+        });
+        this.register('nyc144_demographic_tagging_active', configFlag('session-persistence', 'nycResidenceTaggingRequired', 'NYC residence tagging'));
+        this.register('nyc144_audit_renewal_active', (ctx) => {
+            const window = ctx.packConfig?.['attestation-manager']?.biasAuditAnnualRenewalWindowDays;
+            const warning = ctx.packConfig?.['attestation-manager']?.biasAuditRenewalEarlyWarningDays;
+            const passed = window === 365 && warning === 60;
+            return {
+                passed,
+                detail: passed ? '365-day renewal with 60-day early warning configured' : `window=${window}, warning=${warning}`,
+            };
+        });
+        this.register('nyc144_record_keeping_active', (ctx) => {
+            const retention = ctx.packConfig?.['session-persistence']?.demographicSignalRetentionDays;
+            const passed = typeof retention === 'number' && retention >= 1095;
+            return {
+                passed,
+                detail: passed ? `demographic signal retention ${retention}d >= 3 years` : `retention=${retention}`,
+            };
+        });
+        // -- EU AI Liability (PLD 2024) specific checks (added in normalization pass) --
+        this.register('pld_documentation_active', configFlag('governance-runtime', 'pldReadyDocumentationGateRequired', 'PLD-ready documentation'));
+        this.register('pld_evidence_disclosure_active', configFlag('attestation-manager', 'pldEvidenceBundleRequired', 'Art. 9 evidence disclosure readiness'));
+        this.register('pld_substantial_modification_active', configFlag('governance-runtime', 'substantialModificationTrackingRequired', 'substantial modification tracking'));
+        this.register('pld_post_market_active', configFlag('attestation-manager', 'postMarketMonitoringEvidenceRequired', 'post-market monitoring evidence'));
+        this.register('pld_economic_operator_active', configFlag('supply-chain', 'economicOperatorLiabilityPositionRequired', 'economic operator liability position'));
+        this.register('pld_latent_defect_active', configFlag('session-persistence', 'tenYearLatentDefectWindowRequired', '10-year latent defect window'));
+        this.register('pld_data_damage_active', configFlag('data-classifier', 'dataDamageTrackingRequired', 'data damage tracking'));
+        this.register('pld_withdrawn_ald_guard_active', configFlag('approval-queue', 'withdrawnAldGuardActive', 'withdrawn ALD guard'));
+        this.register('pld_product_information_active', configFlag('transparency-injector', 'productInformationDisclosureRequired', 'product information disclosure'));
+        this.register('pld_open_source_exception_active', configFlag('governance-runtime', 'openSourceExceptionTrackingRequired', 'open-source exception tracking'));
+        // -- ISO 23894 specific checks (added in normalization pass) --
+        this.register('iso23894_framework_active', configFlag('governance-runtime', 'aiRiskFrameworkRequired', 'AI risk management framework'));
+        this.register('iso23894_process_active', (ctx) => {
+            const framework = ctx.packConfig?.['governance-runtime']?.aiRiskFrameworkRequired === true;
+            const register = ctx.packConfig?.['attestation-manager']?.aiRiskRegisterRequired === true;
+            const passed = framework && register;
+            return {
+                passed,
+                detail: passed ? 'risk framework + register both configured' : `framework=${framework}, register=${register}`,
+            };
+        });
+        this.register('iso23894_risk_register_active', configFlag('attestation-manager', 'aiRiskRegisterRequired', 'AI risk register'));
+        this.register('iso23894_training_data_active', configFlag('data-classifier', 'trainingDataProvenanceRequired', 'training data provenance'));
+        this.register('iso23894_robustness_active', configFlag('anomaly-detector', 'robustnessMonitoringActive', 'robustness monitoring'));
+        this.register('iso23894_human_oversight_active', configFlag('approval-queue', 'humanOversightLevelTracked', 'human oversight level'));
+        this.register('iso23894_transparency_active', configFlag('transparency-injector', 'explainabilityEvidenceRequired', 'explainability evidence'));
+        this.register('iso23894_societal_impact_active', configFlag('attestation-manager', 'societalImpactFieldRequired', 'societal impact field'));
+        this.register('iso23894_risk_treatment_active', configFlag('approval-queue', 'riskTreatmentDecisionRequired', 'risk treatment decision'));
+        this.register('iso23894_monitoring_review_active', configFlag('attestation-manager', 'annualRiskReviewRequired', 'annual risk review'));
+        this.register('iso23894_communication_active', configFlag('event-bus', 'riskCommunicationEventsActive', 'risk communication events'));
+        // -- LGPD specific checks --
+        this.register('lgpd_legal_basis_active', configFlag('governance-runtime', 'lgpdLegalBasisEnforced', 'LGPD legal basis enforcement'));
+        this.register('lgpd_encarregado_active', configFlag('attestation-manager', 'encarregadoDesignationRequired', 'Encarregado designation'));
+        this.register('lgpd_ripd_active', configFlag('attestation-manager', 'ripdRequired', 'RIPD (DPIA)'));
+        this.register('lgpd_dsr_active', (ctx) => {
+            // LGPD requires REVIEW_ADM and REVOCATION_CONSENT specifically (Arts. 20, 18 VI).
+            // When other packs (e.g., CCPA) also configure data-subject-rights, the merged
+            // supportedRights array must include LGPD's required rights.
+            const rights = ctx.packConfig?.['data-subject-rights']?.supportedRights;
+            const hasReviewAdm = Array.isArray(rights) && rights.includes('REVIEW_ADM');
+            const hasRevocation = Array.isArray(rights) && rights.includes('REVOCATION_CONSENT');
+            // OR the LGPD pack's own config flag signals presence
+            const lgpdDsrActive = ctx.activePackIds?.includes('lgpd') ?? false;
+            const passed = lgpdDsrActive || (hasReviewAdm && hasRevocation);
+            return {
+                passed,
+                detail: passed
+                    ? 'LGPD DSR workflow active (REVIEW_ADM + REVOCATION_CONSENT)'
+                    : `review_adm=${hasReviewAdm}, revocation=${hasRevocation}`,
+            };
+        });
+        this.register('lgpd_adm_review_active', configFlag('governance-runtime', 'lgpdAdmReviewRightEnforced', 'Art. 20 ADM review right'));
+        this.register('lgpd_sensitive_data_active', (ctx) => {
+            const action = ctx.packConfig?.['data-classifier']?.sensitivePiiBrAction;
+            const passed = action === 'BLOCK_UNLESS_ART_11_BASIS';
+            return {
+                passed,
+                detail: passed ? 'sensitive PII BR action = BLOCK_UNLESS_ART_11_BASIS' : `action=${action}`,
+            };
+        });
+        this.register('lgpd_child_data_active', configFlag('governance-runtime', 'childSpecificConsentRequired', 'child-specific consent'));
+        this.register('lgpd_transfer_active', configFlag('supply-chain', 'internationalTransferMechanismRequired', 'international transfer mechanism'));
+        this.register('lgpd_breach_notice_active', (ctx) => {
+            const hours = ctx.packConfig?.['event-bus']?.lgpdBreachNotificationHours;
+            const passed = typeof hours === 'number' && hours <= 72;
+            return {
+                passed,
+                detail: passed ? `LGPD breach notification ${hours}h configured` : `hours=${hours}`,
+            };
+        });
+        this.register('lgpd_ropa_active', configFlag('attestation-manager', 'ropaLgpdRequired', 'LGPD Records of Processing Activities'));
+        this.register('lgpd_non_discrimination_active', configFlag('bias-monitor', 'lgpdNonDiscriminationActive', 'LGPD non-discrimination'));
+        // -- PIPL specific checks --
+        this.register('pipl_legal_basis_active', configFlag('governance-runtime', 'piplLegalBasisEnforced', 'PIPL Art. 13 legal basis'));
+        this.register('pipl_separate_consent_active', configFlag('approval-queue', 'separateConsentRequired', 'separate consent for sensitive / CBDT / ADM'));
+        this.register('pipl_pipo_active', configFlag('attestation-manager', 'pipoDesignationRequired', 'PIPO designation'));
+        this.register('pipl_adm_active', configFlag('governance-runtime', 'piplAdmExplanationRightEnforced', 'Art. 24 ADM right'));
+        this.register('pipl_cbdt_active', configFlag('supply-chain', 'cbdtMechanismRequired', 'cross-border data transfer mechanism'));
+        this.register('pipl_genai_active', configFlag('attestation-manager', 'cacGenaiRegistrationRequired', 'CAC GenAI registration'));
+        this.register('pipl_important_data_active', (ctx) => {
+            const action = ctx.packConfig?.['data-classifier']?.importantDataAction;
+            const passed = action === 'BLOCK_CBDT_WITHOUT_ASSESSMENT';
+            return {
+                passed,
+                detail: passed ? 'Important Data CBDT gating configured' : `action=${action}`,
+            };
+        });
+        this.register('pipl_child_data_active', configFlag('governance-runtime', 'childSpecificConsentRequired', 'child-specific consent (PIPL Art. 31)'));
+        this.register('pipl_dsr_active', (ctx) => {
+            const lgpdActive = ctx.activePackIds?.includes('pipl') ?? false;
+            return {
+                passed: lgpdActive,
+                detail: lgpdActive ? 'PIPL pack active; DSR workflow supported' : 'PIPL pack not active',
+            };
+        });
+        this.register('pipl_breach_notice_active', (ctx) => {
+            const hours = ctx.packConfig?.['event-bus']?.piplBreachNotificationHours;
+            const passed = typeof hours === 'number' && hours <= 72;
+            return {
+                passed,
+                detail: passed ? `PIPL breach notice ${hours}h` : `hours=${hours}`,
+            };
+        });
+        this.register('pipl_fairness_active', configFlag('bias-monitor', 'piplFairnessMonitoringRequired', 'PIPL Art. 24 fairness'));
+        // -- PIPEDA specific checks --
+        this.register('pipeda_consent_active', configFlag('governance-runtime', 'meaningfulConsentRequired', 'meaningful consent (Principle 3)'));
+        this.register('pipeda_collection_limiting_active', (ctx) => {
+            const passed = ctx.activeModules.includes('data-classifier');
+            return {
+                passed,
+                detail: passed ? 'data-classifier active (Principle 4 limiting)' : 'data-classifier missing',
+            };
+        });
+        this.register('pipeda_accountability_active', (ctx) => {
+            const program = ctx.packConfig?.['attestation-manager']?.privacyManagementProgramRequired === true;
+            const individual = ctx.packConfig?.['attestation-manager']?.accountableIndividualRequired === true;
+            const passed = program && individual;
+            return {
+                passed,
+                detail: passed ? 'PMP + accountable individual configured' : `pmp=${program}, indiv=${individual}`,
+            };
+        });
+        this.register('pipeda_rrosh_breach_active', configFlag('event-bus', 'rroshBreachNotificationActive', 'RROSH breach notification'));
+        this.register('pipeda_breach_log_active', (ctx) => {
+            const days = ctx.packConfig?.['attestation-manager']?.breachLogRetentionDays;
+            const passed = typeof days === 'number' && days >= 730;
+            return {
+                passed,
+                detail: passed ? `breach log retention ${days}d >= 24mo` : `days=${days}`,
+            };
+        });
+        this.register('quebec_law25_adm_active', configFlag('transparency-injector', 'quebecLaw25AdmInformationRequired', 'Quebec Law 25 s. 12.1 ADM info'));
+        this.register('quebec_law25_pia_active', configFlag('attestation-manager', 'quebecPiaRequired', 'Quebec Law 25 s. 3.3 PIA'));
+        // -- ca-qc-law25 dedicated checks (F-NEW-VERA-PACK-FINAL-006, 2026-05-03) --
+        // These are ca-qc-law25 namespace equivalents of the borrowed pipeda_* checks.
+        // They read the same module config keys but are registered under the ca_qc_law25_*
+        // namespace so that the ca-qc-law25 pack's validators are self-contained and
+        // not dependent on ca-pipeda's namespace. ca-pipeda retains its pipeda_* checks.
+        this.register('ca_qc_law25_consent_active', configFlag('governance-runtime', 'meaningfulConsentRequired', 'Quebec meaningful consent (Law 25 enhanced standard)'));
+        this.register('ca_qc_law25_high_risk_review_active', (ctx) => {
+            const pia = ctx.packConfig?.['attestation-manager']?.quebecPiaRequired === true;
+            const hrr = ctx.packConfig?.['governance-runtime']?.quebecLaw25HighRiskReviewRequired === true;
+            const passed = pia && hrr;
+            return {
+                passed,
+                detail: passed ? 'Quebec PIA required + high-risk review gate configured' : `quebecPia=${pia}, highRiskReview=${hrr}`,
+            };
+        });
+        this.register('ca_qc_law25_breach_log_active', (ctx) => {
+            const days = ctx.packConfig?.['attestation-manager']?.breachLogRetentionDays;
+            const passed = typeof days === 'number' && days >= 730;
+            return {
+                passed,
+                detail: passed ? `CAI breach log retention ${days}d >= 24mo` : `days=${days} (CAI requires 24-month minimum)`,
+            };
+        });
+        this.register('ca_qc_law25_dsr_active', (ctx) => {
+            const active = ctx.activePackIds?.includes('ca-qc-law25') ?? false;
+            const rights = ctx.packConfig?.['data-subject-rights']?.supportedRights;
+            const hasQcRights = Array.isArray(rights) && ['PORTABILITY', 'ADM_INFORMATION', 'HUMAN_REVIEW_OF_ADM'].every((r) => rights.includes(r));
+            const passed = active && hasQcRights;
+            return {
+                passed,
+                detail: passed
+                    ? 'ca-qc-law25 active; DSR workflow includes PORTABILITY + ADM_INFORMATION + HUMAN_REVIEW_OF_ADM'
+                    : `active=${active}, qcRights=${hasQcRights} (missing portability/adm/human-review-of-adm)`,
+            };
+        });
+        this.register('ca_qc_law25_cross_border_active', (ctx) => {
+            const safeguards = ctx.packConfig?.['supply-chain']?.crossBorderSafeguardsRequired === true;
+            const undertaking = ctx.packConfig?.['supply-chain']?.quebecCrossBorderConfidentialityUndertakingRequired === true;
+            const passed = safeguards && undertaking;
+            return {
+                passed,
+                detail: passed ? 'Cross-border safeguards + Quebec confidentiality undertaking configured' : `safeguards=${safeguards}, undertaking=${undertaking}`,
+            };
+        });
+        this.register('ca_qc_law25_breach_notification_active', configFlag('event-bus', 'caiBreachNotificationActive', 'CAI breach notification (Quebec Law 25)'));
+        this.register('pipeda_dsr_active', (ctx) => {
+            // Accept legacy 'pipeda' id or either X2-split id (ca-pipeda, ca-qc-law25)
+            const pipedaActive = (ctx.activePackIds?.includes('pipeda') || ctx.activePackIds?.includes('ca-pipeda') || ctx.activePackIds?.includes('ca-qc-law25')) ?? false;
+            return {
+                passed: pipedaActive,
+                detail: pipedaActive ? 'PIPEDA / CA privacy pack active; DSR workflow supported' : 'No PIPEDA or CA privacy pack active',
+            };
+        });
+        this.register('pipeda_cross_border_active', configFlag('supply-chain', 'crossBorderSafeguardsRequired', 'cross-border safeguards'));
+        this.register('pipeda_withdrawn_c27_guard_active', configFlag('approval-queue', 'withdrawnCppaAidaGuardActive', 'withdrawn CPPA/AIDA guard'));
+        // -- BIPA (Illinois 740 ILCS 14/) specific checks (P1C-03 remediation) --
+        // Every BIPA validator is derived from declared pack config so the
+        // check result reflects what the governance runtime is actually
+        // configured to enforce. There is NO evidence-flag fallback; the
+        // result is a direct read of module configuration committed by the
+        // pack (or merged from another active pack).
+        this.register('bipa_consent_active', (ctx) => {
+            const writtenConsent = ctx.packConfig?.['governance-runtime']?.writtenConsentRequired === true;
+            const biometricAction = ctx.packConfig?.['data-classifier']?.biometricAction;
+            const blockAction = biometricAction === 'BLOCK_WITHOUT_CONSENT';
+            const passed = writtenConsent && blockAction;
+            return {
+                passed,
+                detail: passed
+                    ? 'written consent required + data-classifier blocks biometric collection without consent (740 ILCS 14/15(b))'
+                    : `writtenConsentRequired=${writtenConsent}, data-classifier.biometricAction=${String(biometricAction)} (expected BLOCK_WITHOUT_CONSENT)`,
+            };
+        });
+        this.register('bipa_policy_active', (ctx) => {
+            const publicPolicy = ctx.packConfig?.['attestation-manager']?.publicPolicyRequired === true;
+            const retention = ctx.packConfig?.['attestation-manager']?.retentionScheduleRequired === true;
+            const destruction = ctx.packConfig?.['attestation-manager']?.destructionGuidelinesRequired === true;
+            const passed = publicPolicy && retention && destruction;
+            return {
+                passed,
+                detail: passed
+                    ? 'public written policy + retention schedule + destruction guidelines attested (740 ILCS 14/15(a))'
+                    : `publicPolicyRequired=${publicPolicy}, retentionScheduleRequired=${retention}, destructionGuidelinesRequired=${destruction}`,
+            };
+        });
+        this.register('bipa_no_sale_active', (ctx) => {
+            const sale = ctx.packConfig?.['supply-chain']?.biometricSaleProhibited === true;
+            const lease = ctx.packConfig?.['supply-chain']?.biometricLeaseProhibited === true;
+            const trade = ctx.packConfig?.['supply-chain']?.biometricTradeProhibited === true;
+            const profit = ctx.packConfig?.['supply-chain']?.biometricProfitProhibited === true;
+            const passed = sale && lease && trade && profit;
+            return {
+                passed,
+                detail: passed
+                    ? 'biometric sale / lease / trade / profit all prohibited in supply-chain (740 ILCS 14/15(c))'
+                    : `sale=${sale}, lease=${lease}, trade=${trade}, profit=${profit}`,
+            };
+        });
+        this.register('bipa_disclosure_consent_active', configFlag('approval-queue', 'disclosureRequiresSubjectConsent', 'disclosure requires subject consent (740 ILCS 14/15(d))'));
+        this.register('bipa_retention_schedule_active', (ctx) => {
+            const schedule = ctx.packConfig?.['session-persistence']?.perSubjectRetentionScheduleRequired === true;
+            const destroyOnMaturity = ctx.packConfig?.['session-persistence']?.destructionOnScheduleMaturityRequired === true;
+            const passed = schedule && destroyOnMaturity;
+            return {
+                passed,
+                detail: passed
+                    ? 'per-subject retention schedule + destruction on maturity configured (740 ILCS 14/15(a))'
+                    : `perSubjectRetentionScheduleRequired=${schedule}, destructionOnScheduleMaturityRequired=${destroyOnMaturity}`,
+            };
+        });
+        this.register('bipa_per_person_active', configFlag('event-bus', 'perPersonViolationAggregation', 'per-person violation aggregation (post-SB 2979, 740 ILCS 14/20)'));
+        this.register('bipa_extraterritorial_active', configFlag('governance-runtime', 'extraterritorialIlSubjectCheck', 'extraterritorial IL-subject check on collection'));
+        this.register('bipa_deletion_active', (ctx) => {
+            const supported = ctx.packConfig?.['data-subject-rights']?.biometricDeletionSupported === true;
+            const dsrActive = ctx.activeModules.includes('data-subject-rights');
+            const passed = supported && dsrActive;
+            return {
+                passed,
+                detail: passed
+                    ? 'data-subject-rights module active with biometric deletion supported (Rosenbach v. Six Flags)'
+                    : `dsrActive=${dsrActive}, biometricDeletionSupported=${supported}`,
+            };
+        });
+        // -- MiFID II specific checks --
+        this.register('mifid2_best_execution_active', configFlag('governance-runtime', 'bestExecutionPolicyEnforced', 'best execution policy'));
+        this.register('mifid2_suitability_active', configFlag('session-persistence', 'perClientSuitabilityRequired', 'per-client suitability'));
+        this.register('mifid2_product_governance_active', configFlag('governance-runtime', 'targetMarketDistributionControlRequired', 'target market distribution control'));
+        this.register('mifid2_algo_kill_switch_active', configFlag('circuit-breaker', 'killSwitchRequired', 'algo trading kill-switch'));
+        this.register('mifid2_algo_self_assessment_active', configFlag('approval-queue', 'algoTradingAnnualSelfAssessmentRequired', 'algo trading self-assessment'));
+        this.register('mifid2_record_retention_active', (ctx) => {
+            const days = ctx.packConfig?.['audit-integrity']?.mifid2RetentionDays;
+            // 5 years = 1825 days; accept if audit-integrity active and retention configured >= 1825 OR default-registry pass
+            const auditActive = ctx.activeModules.includes('audit-integrity');
+            const passed = auditActive;
+            return {
+                passed,
+                detail: passed
+                    ? 'audit-integrity active; MiFID II 5-year record retention supported'
+                    : 'audit-integrity module not active',
+            };
+        });
+        this.register('mifid2_transaction_reporting_active', configFlag('event-bus', 'transactionReportingStreamRequired', 'MiFIR transaction reporting stream'));
+        this.register('mifid2_ai_disclosure_active', configFlag('transparency-injector', 'aiAdviceDisclosureRequired', 'AI advice disclosure'));
+        this.register('mifid2_suitability_bias_active', configFlag('bias-monitor', 'suitabilityAssessmentBiasMonitoringRequired', 'suitability bias monitoring'));
+        // -- NAIC MDL-668 specific checks --
+        this.register('naic_isp_active', evidenceFlag('naicIspActive', 'NAIC Information Security Program'));
+        this.register('naic_72h_notification_active', (ctx) => {
+            const hours = ctx.packConfig?.['event-bus']?.cybersecurityEventNotificationHours;
+            const passed = hours === 72;
+            return {
+                passed,
+                detail: passed ? '72-hour cybersecurity event notification configured' : `cybersecurityEventNotificationHours=${hours}`,
+            };
+        });
+        this.register('naic_tpsp_oversight_active', configFlag('supply-chain', 'tpspContractualSafeguardsRequired', 'TPSP contractual safeguards'));
+        this.register('naic_board_certification_active', configFlag('attestation-manager', 'boardAnnualCertificationRequired', 'NAIC board annual certification'));
+        this.register('naic_mfa_active', configFlag('governance-runtime', 'mfaForNpiAccessRequired', 'MFA for NPI access'));
+        this.register('naic_ai_bias_active', configFlag('bias-monitor', 'insuranceAiBiasTestingRequired', 'insurance AI bias testing'));
+        this.register('naic_adverse_action_active', configFlag('approval-queue', 'adverseAiDecisionHumanReviewRequired', 'adverse AI decision review'));
+        this.register('naic_vendor_ai_accountability_active', configFlag('supply-chain', 'vendorAiAccountabilityRequired', 'vendor AI accountability'));
+        // -- FRCP 26 specific checks --
+        this.register('frcp26_legal_hold_active', (ctx) => {
+            const legalHold = ctx.packConfig?.['governance-runtime']?.legalHoldWorkflowRequired === true;
+            const autoDelete = ctx.packConfig?.['governance-runtime']?.autoDeleteSuspensionRequired === true;
+            const passed = legalHold && autoDelete;
+            return {
+                passed,
+                detail: passed ? 'legal hold workflow + auto-delete suspension configured' : `legalHold=${legalHold}, autoDelete=${autoDelete}`,
+            };
+        });
+        this.register('frcp26_privilege_screen_active', (ctx) => {
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const action = ctx.packConfig?.['data-classifier']?.privilegedAction;
+            const passed = dcActive && action === 'BLOCK_UNLESS_CONSENTED';
+            return {
+                passed,
+                detail: passed ? 'privilege screen active with BLOCK_UNLESS_CONSENTED' : `dcActive=${dcActive}, action=${action}`,
+            };
+        });
+        this.register('frcp26_proportionality_active', configFlag('governance-runtime', 'proportionalityEnforced', 'FRCP 26 proportionality'));
+        this.register('frcp26_attorney_review_active', configFlag('approval-queue', 'preProductionAttorneyReviewRequired', 'pre-production attorney review'));
+        this.register('frcp26_methodology_disclosure_active', configFlag('transparency-injector', 'aiReviewMethodologyDisclosureRequired', 'AI review methodology disclosure'));
+        this.register('frcp26_defensible_collection_active', configFlag('attestation-manager', 'defensibleCollectionMethodologyRequired', 'defensible collection methodology'));
+        // -- FOIA specific checks --
+        this.register('foia_response_clock_active', (ctx) => {
+            const days = ctx.packConfig?.['governance-runtime']?.foiaResponseDeadlineBusinessDays;
+            const passed = days === 20;
+            return {
+                passed,
+                detail: passed ? '20-business-day FOIA response clock configured' : `foiaResponseDeadlineBusinessDays=${days}`,
+            };
+        });
+        this.register('foia_exemption_screen_active', (ctx) => {
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const action = ctx.packConfig?.['data-classifier']?.exemptAction;
+            const passed = dcActive && !!action;
+            return {
+                passed,
+                detail: passed ? `exemption screen active (action=${action})` : `dcActive=${dcActive}, no exemptAction`,
+            };
+        });
+        this.register('foia_vaughn_review_active', configFlag('approval-queue', 'exemptionDecisionHumanReviewRequired', 'Vaughn index exemption review'));
+        this.register('foia_proactive_disclosure_active', configFlag('transparency-injector', 'proactiveDisclosureRequired', 'proactive disclosure'));
+        this.register('foia_annual_report_active', configFlag('attestation-manager', 'annualFoiaReportRequired', 'annual FOIA report'));
+        // -- LPO 2024 specific checks --
+        this.register('lpo2024_client_disclosure_active', configFlag('transparency-injector', 'aiUseClientDisclosureRequired', 'LPO 2024 client AI disclosure'));
+        this.register('lpo2024_supervision_active', configFlag('approval-queue', 'practitionerReviewBeforeDeliveryRequired', 'practitioner review before delivery'));
+        this.register('lpo2024_confidentiality_gate_active', (ctx) => {
+            const dcAction = ctx.packConfig?.['data-classifier']?.privilegedAction;
+            const clientAction = ctx.packConfig?.['data-classifier']?.clientConfidentialAction;
+            const passed = dcAction === 'BLOCK_UNLESS_CONSENTED' || clientAction === 'BLOCK_UNLESS_DPA_IN_PLACE';
+            return {
+                passed,
+                detail: passed ? 'confidentiality gate configured' : `privilegedAction=${dcAction}, clientConfidentialAction=${clientAction}`,
+            };
+        });
+        this.register('lpo2024_vendor_dpa_active', configFlag('supply-chain', 'vendorDpaRequired', 'LPO 2024 vendor DPA requirement'));
+        this.register('lpo2024_cite_check_active', configFlag('approval-queue', 'citeCheckRequired', 'LPO 2024 citation check'));
+        this.register('lpo2024_billing_transparency_active', configFlag('transparency-injector', 'billingTransparencyRequired', 'billing transparency'));
+        this.register('lpo2024_per_matter_isolation_active', configFlag('session-persistence', 'perMatterIsolationRequired', 'per-matter isolation'));
+        // -- APPI (Japan) specific checks --
+        this.register('appi_purpose_specification_active', (ctx) => {
+            const spec = ctx.packConfig?.['governance-runtime']?.purposeSpecificationEnforced === true;
+            const limit = ctx.packConfig?.['governance-runtime']?.purposeLimitationEnforced === true;
+            const passed = spec && limit;
+            return {
+                passed,
+                detail: passed ? 'purpose specification + limitation enforced' : `spec=${spec}, limitation=${limit}`,
+            };
+        });
+        this.register('appi_sensitive_data_gate_active', (ctx) => {
+            const action = ctx.packConfig?.['data-classifier']?.sensitiveAction;
+            const passed = action === 'BLOCK_UNLESS_EXPLICIT_CONSENT';
+            return {
+                passed,
+                detail: passed ? 'sensitive personal info action = BLOCK_UNLESS_EXPLICIT_CONSENT' : `sensitiveAction=${action}`,
+            };
+        });
+        this.register('appi_cross_border_active', configFlag('supply-chain', 'crossBorderEquivalentProtectionConfirmationRequired', 'APPI cross-border transfer'));
+        this.register('appi_breach_notification_active', (ctx) => {
+            const days = ctx.packConfig?.['event-bus']?.ppcBreachNotificationBusinessDays;
+            const passed = typeof days === 'number' && days <= 5;
+            return {
+                passed,
+                detail: passed ? `APPI PPC notification ${days} business days configured` : `ppcBreachNotificationBusinessDays=${days}`,
+            };
+        });
+        this.register('appi_third_party_records_active', (ctx) => {
+            const days = ctx.packConfig?.['supply-chain']?.thirdPartyProvisionRecordRetentionDays;
+            const passed = typeof days === 'number' && days >= 1095;
+            return {
+                passed,
+                detail: passed ? `APPI third-party provision records ${days}d >= 3 years` : `days=${days}`,
+            };
+        });
+        this.register('appi_dsr_active', (ctx) => {
+            const appiActive = ctx.activePackIds?.includes('appi') ?? false;
+            return {
+                passed: appiActive,
+                detail: appiActive ? 'APPI pack active; DSR workflow supported (Arts. 32-39)' : 'APPI pack not active',
+            };
+        });
+        this.register('appi_adm_explanation_active', configFlag('governance-runtime', 'admExplanationRightEnforced', 'APPI ADM explanation right'));
+        // -- COPPA specific checks (P4, 2026-04-24) --
+        this.register('coppa_parental_consent_gate_active', configFlag('governance-runtime', 'coppaParentalConsentGateEnabled', 'COPPA parental consent gate'));
+        this.register('coppa_no_training_on_child_inputs', configFlag('supply-chain', 'vendorNoTrainingOnChildInputsRequired', 'COPPA no-training-on-child-inputs attestation'));
+        this.register('coppa_persistent_id_block_active', (ctx) => {
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const under13Action = ctx.packConfig?.['data-classifier']?.under13Action;
+            const passed = dcActive && under13Action === 'BLOCK';
+            return {
+                passed,
+                detail: passed
+                    ? 'COPPA persistent-id block: data-classifier active with UNDER_13_USER action=BLOCK (16 CFR 312.2)'
+                    : `dcActive=${dcActive}, under13Action=${under13Action}`,
+            };
+        });
+        this.register('coppa_child_data_retention_limit', (ctx) => {
+            const days = ctx.packConfig?.['session-persistence']?.childRetentionDays;
+            const n = typeof days === 'number' ? days : Infinity;
+            const passed = n <= 90;
+            return {
+                passed,
+                detail: passed
+                    ? `COPPA child retention ${n}d <= 90 days (16 CFR 312.10)`
+                    : `childRetentionDays=${n} exceeds 90-day limit`,
+            };
+        });
+        this.register('coppa_privacy_notice_active', configFlag('attestation-manager', 'privacyNoticeActive', 'COPPA privacy notice to parents'));
+        this.register('coppa_parental_access_rights', configFlag('approval-queue', 'parentalDsrEnabled', 'COPPA parental DSR (access/delete)'));
+        this.register('coppa_vendor_agreement', configFlag('supply-chain', 'vendorCoppaAgreementOnFile', 'COPPA vendor agreement on file'));
+        // -- Common Rule specific checks (P4, 2026-04-24) --
+        this.register('common_rule_irb_approval_gate', configFlag('governance-runtime', 'irbApprovalRequired', 'Common Rule IRB approval gate'));
+        this.register('common_rule_consent_verification', configFlag('governance-runtime', 'consentVerificationEnabled', 'Common Rule consent verification'));
+        this.register('common_rule_withdrawn_consent_block', configFlag('governance-runtime', 'withdrawnConsentExclusionActive', 'Common Rule withdrawn-consent exclusion'));
+        this.register('common_rule_dua_required', configFlag('supply-chain', 'duaRequired', 'Common Rule DUA required'));
+        this.register('common_rule_subpart_d_gate', configFlag('governance-runtime', 'subpartDGateEnabled', 'Common Rule Subpart D dual-consent gate'));
+        this.register('common_rule_coc_block', configFlag('supply-chain', 'cocProtectionEnabled', 'Common Rule CoC block (42 USC 241(d))'));
+        this.register('common_rule_subpart_c_gate', configFlag('governance-runtime', 'subpartCGateEnabled', 'Common Rule Subpart C prisoner gate'));
+        // -- Title IX specific checks (P4, 2026-04-24) --
+        this.register('title_ix_investigation_block', configFlag('governance-runtime', 'investigationRecordBlockEnabled', 'Title IX investigation record block'));
+        this.register('title_ix_retaliation_guard', configFlag('governance-runtime', 'retaliationGuardEnabled', 'Title IX retaliation guard'));
+        this.register('title_ix_coordinator_routing', configFlag('governance-runtime', 'coordinatorRoutingEnabled', 'Title IX Coordinator routing'));
+        this.register('title_ix_no_training_on_protected_class', configFlag('governance-runtime', 'providerSexDataTrainingProhibited', 'Title IX no-training-on-sex-data attestation'));
+        this.register('title_ix_admissions_audit_trail', (ctx) => {
+            const auditEnabled = ctx.packConfig?.['attestation-manager']?.admissionsAuditEnabled === true;
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const passed = auditEnabled && dcActive;
+            return {
+                passed,
+                detail: passed
+                    ? 'Title IX admissions audit trail: attestation-manager.admissionsAuditEnabled + data-classifier active (34 CFR 106.21)'
+                    : `admissionsAuditEnabled=${auditEnabled}, data-classifier=${dcActive}`,
+            };
+        });
+        this.register('title_ix_pregnancy_accommodation_gate', configFlag('governance-runtime', 'pregnancyAccommodationGateEnabled', 'Title IX pregnancy accommodation gate'));
+        this.register('title_ix_record_retention', (ctx) => {
+            const retentionYears = ctx.packConfig?.['attestation-manager']?.titleIxRecordRetentionYears;
+            const passed = retentionYears === 7;
+            return {
+                passed,
+                detail: passed
+                    ? 'Title IX record retention = 7 years (34 CFR 106.45(b)(10))'
+                    : `titleIxRecordRetentionYears=${retentionYears} (expected 7)`,
+            };
+        });
+        // -- NIH Data Sharing specific checks (P4, 2026-04-24) --
+        this.register('nih_dms_dmsp_scope_check', configFlag('governance-runtime', 'dmspApprovalRequired', 'NIH DMS DMSP scope check'));
+        this.register('nih_dms_controlled_access_dac_gate', configFlag('governance-runtime', 'dacApprovalRequired', 'NIH DMS controlled-access DAC gate'));
+        this.register('nih_dms_coc_block', configFlag('supply-chain', 'cocProtectionEnabled', 'NIH DMS CoC block (42 USC 241(d))'));
+        this.register('nih_dms_no_training_on_research_data', configFlag('supply-chain', 'providerTrainingProhibitionAttested', 'NIH DMS no-training-on-research-data attestation'));
+        this.register('nih_dms_genomic_identifiable_block', configFlag('governance-runtime', 'genomicIdentifiableBlockEnabled', 'NIH DMS genomic identifiable link block'));
+        this.register('nih_dms_fisma_security_baseline', configFlag('supply-chain', 'fismaModerateRequiredForControlledAccess', 'NIH DMS FISMA Moderate baseline for controlled-access systems'));
+        // -- Florida Student Privacy specific checks (P4, 2026-04-24) --
+        this.register('fl_student_no_behavioral_profiling', configFlag('governance-runtime', 'behavioralProfilingBlockEnabled', 'FL student behavioral profiling block'));
+        this.register('fl_student_no_targeted_advertising', configFlag('governance-runtime', 'targetedAdvertisingBlockEnabled', 'FL student targeted advertising block'));
+        this.register('fl_student_parental_consent_gate', configFlag('governance-runtime', 'parentalConsentGateEnabled', 'FL student parental consent gate (HB 3/Section 1014)'));
+        this.register('fl_student_vendor_listing_check', configFlag('supply-chain', 'vendorListingVerificationEnabled', 'FL student vendor listing verification'));
+        this.register('fl_student_no_data_sale', configFlag('supply-chain', 'providerNoSaleAttested', 'FL student no-data-sale attestation'));
+        this.register('fl_student_fipa_breach_clock', (ctx) => {
+            const days = ctx.packConfig?.['session-persistence']?.fipaBreachClockDays;
+            const passed = days === 30;
+            return {
+                passed,
+                detail: passed
+                    ? 'FIPA 30-day breach clock configured (Florida Statute Section 501.171)'
+                    : `fipaBreachClockDays=${days} (expected 30)`,
+            };
+        });
+        this.register('fl_student_deletion_on_termination', (ctx) => {
+            const days = ctx.packConfig?.['supply-chain']?.deletionOnTerminationDays;
+            const n = typeof days === 'number' ? days : Infinity;
+            const passed = n <= 30;
+            return {
+                passed,
+                detail: passed
+                    ? `FL student deletion-on-termination ${n}d <= 30 days (Florida Statute Section 1002.222)`
+                    : `deletionOnTerminationDays=${n} exceeds 30-day limit`,
+            };
+        });
+        // -- FERPA specific checks --
+        this.register('ferpa_prior_consent_active', configFlag('governance-runtime', 'priorWrittenConsentRequired', 'FERPA prior written consent'));
+        this.register('ferpa_school_official_agreement_active', configFlag('supply-chain', 'vendorSchoolOfficialAgreementRequired', 'FERPA school-official exception agreement'));
+        this.register('ferpa_coppa_gate_active', configFlag('governance-runtime', 'coppaAgeGateRequired', 'COPPA age gate'));
+        this.register('ferpa_education_record_classifier_active', (ctx) => {
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const action = ctx.packConfig?.['data-classifier']?.educationRecordAction;
+            const passed = dcActive && !!action;
+            return {
+                passed,
+                detail: passed ? `education record classifier active (action=${action})` : `dcActive=${dcActive}, no educationRecordAction`,
+            };
+        });
+        this.register('ferpa_dsr_active', (ctx) => {
+            const ferpaActive = ctx.activePackIds?.includes('ferpa') ?? false;
+            return {
+                passed: ferpaActive,
+                detail: ferpaActive ? 'FERPA pack active; student/parent rights workflow supported' : 'FERPA pack not active',
+            };
+        });
+        this.register('ferpa_annual_notice_active', configFlag('attestation-manager', 'annualFerpaNoticeRequired', 'FERPA annual notice of rights'));
+        // -- FedRAMP specific checks --
+        this.register('fedramp_piv_mfa_active', (ctx) => {
+            const pivCac = ctx.packConfig?.['agent-auth']?.pivCacOrEquivalentRequired === true;
+            const mfa = ctx.packConfig?.['agent-auth']?.mfaForAllPrivilegedAccess === true;
+            const passed = pivCac && mfa;
+            return {
+                passed,
+                detail: passed ? 'PIV/CAC + MFA configured' : `pivCac=${pivCac}, mfa=${mfa}`,
+            };
+        });
+        this.register('fedramp_conmon_active', (ctx) => {
+            const stream = ctx.packConfig?.['event-bus']?.continuousMonitoringStreamRequired === true;
+            const monthly = ctx.packConfig?.['event-bus']?.monthlyVulnerabilityScanningRequired === true;
+            const passed = stream && monthly;
+            return {
+                passed,
+                detail: passed ? 'ConMon stream + monthly scanning configured' : `stream=${stream}, monthly=${monthly}`,
+            };
+        });
+        this.register('fedramp_supply_chain_active', (ctx) => {
+            const marketplace = ctx.packConfig?.['supply-chain']?.fedrampMarketplaceVerificationRequired === true;
+            const scRm = ctx.packConfig?.['supply-chain']?.supplyChainRiskManagementRequired === true;
+            const passed = marketplace && scRm;
+            return {
+                passed,
+                detail: passed ? 'FedRAMP marketplace + supply chain risk management configured' : `marketplace=${marketplace}, scRm=${scRm}`,
+            };
+        });
+        this.register('fedramp_poam_active', configFlag('attestation-manager', 'poamManagementRequired', 'FedRAMP POA&M'));
+        this.register('fedramp_annual_pentest_active', configFlag('attestation-manager', 'annualPenetrationTestRequired', 'FedRAMP annual penetration test'));
+        // -- StateRAMP specific checks --
+        this.register('stateramp_mfa_active', configFlag('agent-auth', 'mfaForAllStateAccess', 'StateRAMP MFA'));
+        this.register('stateramp_conmon_active', (ctx) => {
+            const conmon = ctx.packConfig?.['event-bus']?.continuousMonitoringRequired === true;
+            const monthly = ctx.packConfig?.['event-bus']?.monthlyConMonReportingRequired === true;
+            const passed = conmon && monthly;
+            return {
+                passed,
+                detail: passed ? 'StateRAMP ConMon + monthly reporting configured' : `conmon=${conmon}, monthly=${monthly}`,
+            };
+        });
+        this.register('stateramp_supply_chain_active', (ctx) => {
+            const marketplace = ctx.packConfig?.['supply-chain']?.staterampMarketplaceVerificationRequired === true;
+            const fedrampRecip = ctx.packConfig?.['supply-chain']?.fedrampReciprocityCheckRequired === true;
+            const passed = marketplace || fedrampRecip;
+            return {
+                passed,
+                detail: passed ? 'StateRAMP/FedRAMP marketplace verification configured' : `marketplace=${marketplace}, fedrampRecip=${fedrampRecip}`,
+            };
+        });
+        this.register('stateramp_annual_pentest_active', configFlag('attestation-manager', 'annualPenetrationTestRequired', 'StateRAMP annual pentest'));
+        // -- CJIS specific checks --
+        this.register('cjis_advanced_auth_active', (ctx) => {
+            const aa = ctx.packConfig?.['agent-auth']?.advancedAuthenticationRequired === true;
+            const mfa = ctx.packConfig?.['agent-auth']?.mfaForRemoteOrNonPhysicallySecureAccess === true;
+            const passed = aa && mfa;
+            return {
+                passed,
+                detail: passed ? 'CJIS Advanced Authentication + MFA configured' : `aa=${aa}, mfa=${mfa}`,
+            };
+        });
+        this.register('cjis_incident_1hr_active', (ctx) => {
+            const oneHour = ctx.packConfig?.['event-bus']?.cjisBreachOneHourNotificationRequired === true;
+            const passed = oneHour;
+            return {
+                passed,
+                detail: passed ? '1-hour CJIS breach notification configured' : 'cjisBreachOneHourNotificationRequired not set',
+            };
+        });
+        this.register('cjis_iea_active', configFlag('supply-chain', 'informationExchangeAgreementRequired', 'CJIS Information Exchange Agreement'));
+        this.register('cjis_security_training_active', (ctx) => {
+            const cadence = ctx.packConfig?.['attestation-manager']?.securityAwarenessTrainingCadenceDays;
+            const passed = typeof cadence === 'number' && cadence <= 730;
+            return {
+                passed,
+                detail: passed ? `CJIS security training cadence ${cadence}d (<= 730 days / 2 years)` : `cadence=${cadence}`,
+            };
+        });
+        // -- CMMC 2.0 specific checks --
+        this.register('cmmc2_mfa_active', configFlag('agent-auth', 'mfaForCuiSystemAccessRequired', 'CMMC 2.0 MFA for CUI'));
+        this.register('cmmc2_dfars_incident_active', (ctx) => {
+            const notif = ctx.packConfig?.['event-bus']?.cuiBreachNotificationRequired === true;
+            const passed = notif;
+            return {
+                passed,
+                detail: passed ? 'DFARS 252.204-7012 72-hour CUI breach notification configured' : 'cuiBreachNotificationRequired not set',
+            };
+        });
+        this.register('cmmc2_csp_fedramp_active', configFlag('supply-chain', 'externalCspFedrampModerateRequired', 'external CSP FedRAMP Moderate'));
+        this.register('cmmc2_ssp_active', configFlag('governance-runtime', 'sspBoundaryDocumentationRequired', 'CMMC SSP boundary documentation'));
+        // -- RESPA specific checks (MORTGAGE-PACKS-01, 2026-04-22) --
+        this.register('respa_referral_steering_block_active', (ctx) => {
+            const steeringBlock = ctx.packConfig?.['governance-runtime']?.respaReferralSteeringBlockRequired === true;
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const passed = steeringBlock && dcActive;
+            return {
+                passed,
+                detail: passed
+                    ? 'RESPA referral-steering block active: governance-runtime + data-classifier (12 USC §2607)'
+                    : `steeringBlock=${steeringBlock}, data-classifier=${dcActive}`,
+            };
+        });
+        this.register('respa_escrow_balance_block_active', configFlag('governance-runtime', 'escrowBalanceLlmEgressBlockRequired', 'RESPA escrow-balance LLM egress block'));
+        this.register('respa_lo_estimate_human_review_active', (ctx) => {
+            const loGate = ctx.packConfig?.['approval-queue']?.loanEstimateRequiresHumanReview === true;
+            const cdGate = ctx.packConfig?.['approval-queue']?.closingDisclosureRequiresHumanReview === true;
+            const passed = loGate && cdGate;
+            return {
+                passed,
+                detail: passed
+                    ? 'LE + CD both require human review (RESPA §4; TRID 12 CFR §1026.19)'
+                    : `loGate=${loGate}, cdGate=${cdGate}`,
+            };
+        });
+        this.register('respa_qwr_clock_active', (ctx) => {
+            const ack = ctx.packConfig?.['event-bus']?.qwrAcknowledgmentBusinessDays;
+            const sub = ctx.packConfig?.['event-bus']?.qwrSubstantiveResponseBusinessDays;
+            const passed = ack === 5 && sub === 30;
+            return {
+                passed,
+                detail: passed
+                    ? 'QWR 5-day acknowledgment + 30-day substantive response clocks configured (12 CFR §1024.36)'
+                    : `ack=${ack}, sub=${sub}`,
+            };
+        });
+        this.register('respa_settlement_provider_registry_active', configFlag('supply-chain', 'settlementServiceProviderRegistryRequired', 'RESPA settlement provider registry'));
+        this.register('respa_referral_anomaly_active', (ctx) => {
+            const pattern = ctx.packConfig?.['anomaly-detector']?.referralPatternDetectionActive === true;
+            const freq = ctx.packConfig?.['anomaly-detector']?.steeringSignalFrequencyMonitoringActive === true;
+            const passed = pattern && freq;
+            return {
+                passed,
+                detail: passed ? 'RESPA referral-pattern + steering-frequency anomaly detection active' : `pattern=${pattern}, freq=${freq}`,
+            };
+        });
+        this.register('respa_escrow_aggregate_accounting_active', configFlag('attestation-manager', 'escrowAccountAggregateAccountingAttestationRequired', 'RESPA escrow aggregate accounting attestation'));
+        this.register('respa_disclosure_injection_active', configFlag('transparency-injector', 'aiSettlementRecommendationDisclosureRequired', 'RESPA AI-settlement-recommendation disclosure'));
+        // -- HMDA specific checks (MORTGAGE-PACKS-01, 2026-04-22) --
+        this.register('hmda_gmi_credit_decision_block_active', (ctx) => {
+            const gmiBlock = ctx.packConfig?.['governance-runtime']?.gmiLlmEgressBlockInCreditDecisionContext === true;
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const passed = gmiBlock && dcActive;
+            return {
+                passed,
+                detail: passed
+                    ? 'GMI fields blocked from credit-decision LLM context (12 CFR §1003.4; Reg B §1002.6)'
+                    : `gmiBlock=${gmiBlock}, data-classifier=${dcActive}`,
+            };
+        });
+        this.register('hmda_lar_aggregation_only_active', configFlag('governance-runtime', 'hmdaLarEntryLlmEgressRequiresAggregationOnly', 'HMDA LAR aggregation-only egress'));
+        this.register('hmda_annual_lar_attestation_active', (ctx) => {
+            const att = ctx.packConfig?.['attestation-manager']?.annualLarSubmissionAttestationRequired === true;
+            const officer = ctx.packConfig?.['attestation-manager']?.certifyingOfficerDesignationRequired === true;
+            const passed = att && officer;
+            return {
+                passed,
+                detail: passed
+                    ? 'Annual LAR attestation + certifying officer designation configured (12 CFR §1003.5(a))'
+                    : `att=${att}, officer=${officer}`,
+            };
+        });
+        this.register('hmda_proxy_detection_active', (ctx) => {
+            const zip = ctx.packConfig?.['anomaly-detector']?.zipCodeProxyDetectionActive === true;
+            const surname = ctx.packConfig?.['anomaly-detector']?.surnameProxyDetectionActive === true;
+            const passed = zip && surname;
+            return {
+                passed,
+                detail: passed ? 'zip-code + surname proxy detection active (HMDA/Reg B)' : `zip=${zip}, surname=${surname}`,
+            };
+        });
+        this.register('hmda_lar_state_persistence_active', configFlag('session-persistence', 'perApplicationHmdaStateRequired', 'per-application HMDA LAR state'));
+        this.register('hmda_quarterly_large_filer_active', configFlag('event-bus', 'hmdaQuarterlyLarDeadlineActive', 'HMDA quarterly large-filer clock'));
+        // -- TILA-TRID specific checks (MORTGAGE-PACKS-01, 2026-04-22) --
+        this.register('tila_trid_apr_llm_block_active', (ctx) => {
+            const aprBlock = ctx.packConfig?.['governance-runtime']?.aprLlmComputationBlocked === true;
+            const fcBlock = ctx.packConfig?.['governance-runtime']?.financeChargeLlmComputationBlocked === true;
+            const afBlock = ctx.packConfig?.['governance-runtime']?.amountFinancedLlmComputationBlocked === true;
+            const passed = aprBlock && fcBlock && afBlock;
+            return {
+                passed,
+                detail: passed
+                    ? 'APR + finance charge + amount financed LLM computation blocked (15 USC §1638; 12 CFR §1026.38)'
+                    : `apr=${aprBlock}, fc=${fcBlock}, af=${afBlock}`,
+            };
+        });
+        this.register('tila_trid_le_clock_active', (ctx) => {
+            const days = ctx.packConfig?.['governance-runtime']?.tridLeDeliveryBusinessDays;
+            const passed = days === 3;
+            return {
+                passed,
+                detail: passed ? 'TRID LE 3-business-day delivery clock configured (12 CFR §1026.19(a)(1)(i))' : `tridLeDeliveryBusinessDays=${days}`,
+            };
+        });
+        this.register('tila_trid_cd_clock_active', (ctx) => {
+            const days = ctx.packConfig?.['governance-runtime']?.tridCdPreConsummationBusinessDays;
+            const passed = days === 3;
+            return {
+                passed,
+                detail: passed ? 'TRID CD 3-business-day pre-consummation clock configured (12 CFR §1026.19(f)(1)(ii))' : `tridCdPreConsummationBusinessDays=${days}`,
+            };
+        });
+        this.register('tila_trid_human_apr_verification_active', configFlag('approval-queue', 'aprVerificationRequiresHumanReview', 'TRID human APR verification'));
+        this.register('tila_trid_changed_circumstance_active', configFlag('event-bus', 'changedCircumstanceReDisclosureClockActive', 'TRID changed-circumstance re-disclosure clock'));
+        this.register('tila_trid_rescission_clock_active', configFlag('event-bus', 'rescissionClockActive', 'TILA rescission clock (12 CFR §1026.23)'));
+        this.register('tila_trid_arm_disclosure_active', configFlag('governance-runtime', 'armDisclosureGateRequired', 'TILA ARM disclosure gate'));
+        this.register('tila_trid_heloc_disclosure_active', configFlag('governance-runtime', 'helocDisclosureGateRequired', 'TILA HELOC disclosure gate'));
+        this.register('tila_trid_advertising_active', configFlag('anomaly-detector', 'advertisingRuleViolationDetectionActive', 'TILA advertising rule detection'));
+        // -- us-trid standalone checks (X3 split 2026-04-24) --
+        this.register('us_trid_apr_llm_block_active', (ctx) => {
+            const aprBlock = ctx.packConfig?.['governance-runtime']?.aprLlmComputationBlocked === true;
+            const fcBlock = ctx.packConfig?.['governance-runtime']?.financeChargeLlmComputationBlocked === true;
+            const afBlock = ctx.packConfig?.['governance-runtime']?.amountFinancedLlmComputationBlocked === true;
+            const passed = aprBlock && fcBlock && afBlock;
+            return {
+                passed,
+                detail: passed
+                    ? 'TRID APR + finance charge + amount financed LLM compute blocked (12 CFR §1026.37-38)'
+                    : `apr=${aprBlock}, fc=${fcBlock}, af=${afBlock}`,
+            };
+        });
+        this.register('us_trid_le_clock_active', (ctx) => {
+            const days = ctx.packConfig?.['governance-runtime']?.tridLeDeliveryBusinessDays;
+            const passed = days === 3;
+            return {
+                passed,
+                detail: passed ? 'TRID LE 3-business-day delivery clock configured (12 CFR §1026.19(e))' : `tridLeDeliveryBusinessDays=${days}`,
+            };
+        });
+        this.register('us_trid_cd_clock_active', (ctx) => {
+            const days = ctx.packConfig?.['governance-runtime']?.tridCdPreConsummationBusinessDays;
+            const passed = days === 3;
+            return {
+                passed,
+                detail: passed ? 'TRID CD 3-business-day pre-consummation clock configured (12 CFR §1026.19(f))' : `tridCdPreConsummationBusinessDays=${days}`,
+            };
+        });
+        this.register('us_trid_human_apr_verification_active', configFlag('approval-queue', 'aprVerificationRequiresHumanReview', 'TRID human APR verification gate'));
+        this.register('us_trid_changed_circumstance_active', configFlag('event-bus', 'changedCircumstanceReDisclosureClockActive', 'TRID changed-circumstance re-disclosure clock'));
+        // -- us-tila standalone checks (X3 split 2026-04-24) --
+        this.register('us_tila_atr_llm_block_active', (ctx) => {
+            const block = ctx.packConfig?.['governance-runtime']?.atrQmLlmDeterminationBlocked === true;
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const passed = block && dcActive;
+            return {
+                passed,
+                detail: passed
+                    ? 'ATR/QM LLM determination blocked; licensed human underwriter required (12 CFR §1026.43(c))'
+                    : `atrBlock=${block}, data-classifier=${dcActive}`,
+            };
+        });
+        this.register('us_tila_rescission_clock_active', (ctx) => {
+            const active = ctx.packConfig?.['event-bus']?.rescissionClockActive === true;
+            const days = ctx.packConfig?.['event-bus']?.rescissionBusinessDays;
+            const passed = active && days === 3;
+            return {
+                passed,
+                detail: passed ? 'TILA rescission 3-business-day clock active (12 CFR §1026.23)' : `active=${active}, days=${days}`,
+            };
+        });
+        this.register('us_tila_advertising_active', configFlag('anomaly-detector', 'advertisingRuleViolationDetectionActive', 'TILA advertising trigger-term detection (§§1026.16, 1026.24)'));
+        this.register('us_tila_arm_disclosure_active', configFlag('governance-runtime', 'armDisclosureGateRequired', 'TILA ARM disclosure gate (§1026.19(b), §1026.20(d))'));
+        this.register('us_tila_heloc_disclosure_active', configFlag('governance-runtime', 'helocDisclosureGateRequired', 'TILA HELOC disclosure gate (§1026.40)'));
+        // -- ECOA standalone specific checks (MORTGAGE-PACKS-01, 2026-04-22) --
+        this.register('ecoa_prohibited_basis_block_active', (ctx) => {
+            const block = ctx.packConfig?.['governance-runtime']?.ecoaProhibitedBasisLlmBlockRequired === true;
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const passed = block && dcActive;
+            return {
+                passed,
+                detail: passed
+                    ? 'ECOA prohibited-basis LLM block active (15 USC §1691(a); Reg B 12 CFR §1002.4)'
+                    : `block=${block}, data-classifier=${dcActive}`,
+            };
+        });
+        this.register('ecoa_named_reviewer_required_active', (ctx) => {
+            const named = ctx.packConfig?.['approval-queue']?.adverseActionRequiresNamedReviewer === true;
+            const passed = named;
+            return {
+                passed,
+                detail: passed ? 'Named reviewer required on every adverse action (Reg B 12 CFR §1002.9)' : 'adverseActionRequiresNamedReviewer not configured',
+            };
+        });
+        this.register('ecoa_proxy_detection_active', (ctx) => {
+            const proxy = ctx.packConfig?.['anomaly-detector']?.proxyDiscriminationDetectionActive === true;
+            const passed = proxy;
+            return {
+                passed,
+                detail: passed ? 'Proxy discrimination detection active (Reg B 12 CFR §1002.6)' : 'proxyDiscriminationDetectionActive not configured',
+            };
+        });
+        this.register('ecoa_appraisal_delivery_active', (ctx) => {
+            const days = ctx.packConfig?.['governance-runtime']?.appraisalDeliveryBusinessDays;
+            const passed = days === 3;
+            return {
+                passed,
+                detail: passed ? 'Appraisal 3-business-day delivery clock configured (Reg B 12 CFR §1002.14(a)(1))' : `appraisalDeliveryBusinessDays=${days}`,
+            };
+        });
+        this.register('ecoa_retention_active', (ctx) => {
+            // Check evidence flag for 25-month retention compliance (Reg B 12 CFR §1002.12(b)(3)).
+            // Runtime sets ecoaRetentionDays to the configured audit log retention days.
+            const days = ctx.evidence?.ecoaRetentionDays;
+            const passed = typeof days === 'number' && days >= 760;
+            return {
+                passed,
+                detail: passed ? `ECOA retention ${days}d >= 25 months (Reg B 12 CFR §1002.12(b)(3))` : `ecoaRetentionDays=${days} (need >= 760)`,
+            };
+        });
+        // -- FCRA specific checks (MORTGAGE-PACKS-01, 2026-04-22) --
+        this.register('fcra_permissible_purpose_active', (ctx) => {
+            const purposeRequired = ctx.packConfig?.['governance-runtime']?.consumerReportPermissiblePurposeRequired === true;
+            const purposes = ctx.packConfig?.['governance-runtime']?.permissiblePurposes;
+            const passed = purposeRequired && Array.isArray(purposes) && purposes.length >= 5;
+            return {
+                passed,
+                detail: passed
+                    ? `FCRA permissible-purpose gate active with ${purposes.length} declared purposes (15 USC §1681b)`
+                    : `purposeRequired=${purposeRequired}, purposeCount=${Array.isArray(purposes) ? purposes.length : 0}`,
+            };
+        });
+        this.register('fcra_cross_vendor_block_active', configFlag('governance-runtime', 'crossVendorConsumerReportBlockWithoutPurposeChain', 'FCRA cross-vendor consumer-report block'));
+        this.register('fcra_615_adverse_action_active', (ctx) => {
+            const noticeRequired = ctx.packConfig?.['governance-runtime']?.adverseActionNoticeRequired === true;
+            const craDisclosure = ctx.packConfig?.['approval-queue']?.craIdentityDisclosureOnAdverseAction === true;
+            const passed = noticeRequired && craDisclosure;
+            return {
+                passed,
+                detail: passed
+                    ? 'FCRA §615 adverse-action notice + CRA disclosure configured (15 USC §1681m(a))'
+                    : `noticeRequired=${noticeRequired}, craDisclosure=${craDisclosure}`,
+            };
+        });
+        this.register('fcra_dispute_workflow_active', configFlag('approval-queue', 'disputeReinvestigationGateRequired', 'FCRA §611 dispute reinvestigation gate'));
+        this.register('fcra_furnisher_accuracy_active', configFlag('attestation-manager', 'section623ComplianceProgramRequired', 'FCRA §623 furnisher accuracy program'));
+        this.register('fcra_purpose_evasion_detection_active', configFlag('anomaly-detector', 'permissiblePurposeEvasionDetectionActive', 'FCRA permissible-purpose evasion detection'));
+        this.register('fcra_consumer_disclosure_active', configFlag('transparency-injector', 'section615AdverseActionCraDisclosureRequired', 'FCRA §615 consumer disclosure injection'));
+        // -----------------------------------------------------------------------
+        // W1-BEHAVIORAL: Behavioral validators (48 pack-scoped checks)
+        //
+        // Each check constructs a sample input known to match one of the pack's
+        // declared scan categories, runs it through the live PackDrivenClassifier,
+        // and asserts the declared category action fires.
+        //
+        // Registered as pack-scoped checks so they appear in compliance reports
+        // under each pack's validator list.
+        //
+        // Evidence contract: the runtime sets evidence.packClassifierInstance to the
+        // live PackDrivenClassifier instance (or a factory function) so these checks
+        // have access to a classifier to evaluate against.
+        // -----------------------------------------------------------------------
+        const runBehavioralCheck = (packId, categoryId, sampleInput, expectedAction) => (ctx) => {
+            // Resolve classifier from evidence
+            const classifierSource = ctx.evidence?.['packClassifierInstance'];
+            if (!classifierSource) {
+                return {
+                    passed: false,
+                    detail: `behavioral validator for ${packId}.${categoryId}: packClassifierInstance not set in evidence; runtime must inject the PackDrivenClassifier`,
+                };
+            }
+            // Accept both a direct classifier object and a factory function
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const classifier = typeof classifierSource === 'function'
+                ? classifierSource()
+                : classifierSource;
+            // The classifier must expose evaluate() matching PackDrivenClassifier shape
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const c = classifier;
+            if (typeof c?.evaluate !== 'function') {
+                return {
+                    passed: false,
+                    detail: `behavioral validator for ${packId}.${categoryId}: packClassifierInstance does not expose evaluate()`,
+                };
+            }
+            try {
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                const decision = c.evaluate(sampleInput, { activePackIds: [packId] });
+                const matched = (decision?.matched ?? []);
+                const hit = matched.find((m) => m.packId === packId && m.categoryId === categoryId);
+                if (!hit) {
+                    return {
+                        passed: false,
+                        detail: `behavioral validator FAILED: ${packId}.${categoryId} did not fire for sample input "${sampleInput.slice(0, 60)}"`,
+                    };
+                }
+                const actionMatch = hit.action.toUpperCase() === expectedAction.toUpperCase();
+                return {
+                    passed: actionMatch,
+                    detail: actionMatch
+                        ? `behavioral validator PASSED: ${packId}.${categoryId} fired action=${hit.action} as expected`
+                        : `behavioral validator MISMATCH: ${packId}.${categoryId} fired action=${hit.action}, expected ${expectedAction}`,
+                };
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                return { passed: false, detail: `behavioral validator threw: ${msg}` };
+            }
+        };
+        // HIPAA: PHI (SSN pattern)
+        this.register('behavioralValidator_hipaa', runBehavioralCheck('hipaa', 'PHI', 'Patient SSN: 123-45-6789', 'BLOCK'));
+        // HITECH: PHI
+        this.register('behavioralValidator_hitech', runBehavioralCheck('hitech', 'PHI', 'Patient SSN: 123-45-6789', 'BLOCK'));
+        // FERPA: EDUCATION_RECORD
+        this.register('behavioralValidator_ferpa', runBehavioralCheck('ferpa', 'EDUCATION_RECORD', 'Student ID: STU123456 GPA: 3.8 transcript from Fall 2025', 'BLOCK'));
+        // SOC 2: CREDENTIALS
+        this.register('behavioralValidator_soc2', runBehavioralCheck('soc2', 'CREDENTIALS', 'API_KEY=sk-prod-abc123xyz password=secret123', 'BLOCK'));
+        // SOC 1: CREDENTIALS
+        this.register('behavioralValidator_soc1', runBehavioralCheck('soc1', 'CREDENTIALS', 'API_KEY=sk-prod-abc123xyz password=secret123', 'BLOCK'));
+        // SOC 1: CONTROL_DEFICIENCY (ICFR) -- categoryActions.CONTROL_DEFICIENCY = WARN per soc1.ts
+        this.register('behavioralValidator_soc1_icfr', runBehavioralCheck('soc1', 'CONTROL_DEFICIENCY', 'Material weakness identified in revenue-recognition control', 'WARN'));
+        // SOC 1: ICFR_TEST_FAILURE (SSAE 18 AT-C 320 -- test of operating effectiveness failed)
+        // categoryActions.ICFR_TEST_FAILURE = WARN per soc1.ts
+        this.register('behavioralValidator_soc1_icfr_test_failure', runBehavioralCheck('soc1', 'ICFR_TEST_FAILURE', 'Test of operating effectiveness failed for general-IT controls.', 'WARN'));
+        // SOC 1: SOX_404_EVIDENCE (Sarbanes-Oxley §404 ICFR attestation evidence)
+        // categoryActions.SOX_404_EVIDENCE = LOG per soc1.ts
+        this.register('behavioralValidator_soc1_sox_404', runBehavioralCheck('soc1', 'SOX_404_EVIDENCE', 'SOX Section 404 evidence requested for FY2026 audit.', 'LOG'));
+        // ISO 27001: PII
+        this.register('behavioralValidator_iso27001', runBehavioralCheck('iso27001', 'PII', 'User email: jane.doe@example.com', 'WARN'));
+        // GDPR: SPECIAL_CATEGORY
+        this.register('behavioralValidator_gdpr', runBehavioralCheck('gdpr', 'SPECIAL_CATEGORY', 'Patient is HIV positive, religion: Muslim', 'BLOCK'));
+        // PCI DSS: PAN (Luhn-valid Visa PAN, payment context) -- must BLOCK
+        this.register('behavioralValidator_pci_dss', runBehavioralCheck('pci-dss', 'PAN', 'Card number 4111111111111111 expires 12/26', 'BLOCK'));
+        // PCI DSS: TRACK_DATA (track-2 sentinel pattern) -- must BLOCK
+        this.register('behavioralValidator_pci_dss_track', runBehavioralCheck('pci-dss', 'TRACK_DATA', ';4111111111111111=26122015432112345?', 'BLOCK'));
+        // PCI DSS: CVV (cvv label with 3-digit code) -- must BLOCK
+        this.register('behavioralValidator_pci_dss_cvv', runBehavioralCheck('pci-dss', 'CVV', 'cvv: 123', 'BLOCK'));
+        // DORA: CREDENTIALS
+        this.register('behavioralValidator_dora', runBehavioralCheck('dora', 'CREDENTIALS', 'API_KEY=sk-prod-abc123xyz password=secret123', 'BLOCK'));
+        // EU AI Act: BIOMETRIC_IDENTIFIER
+        this.register('behavioralValidator_eu_ai_act', runBehavioralCheck('eu-ai-act', 'BIOMETRIC_IDENTIFIER', 'Biometric ID: fingerprint hash abc123def456', 'BLOCK'));
+        // 42 CFR Part 2 (part2): SUD_RECORD
+        this.register('behavioralValidator_part2', runBehavioralCheck('part2', 'SUD_RECORD', 'SUD treatment record for patient ID 78432', 'BLOCK'));
+        // Colorado AI Act: PII
+        this.register('behavioralValidator_colorado_ai', runBehavioralCheck('colorado-ai', 'PII', 'User email: jane.doe@example.com', 'WARN'));
+        // NIST AI RMF: CREDENTIALS
+        this.register('behavioralValidator_nist_ai_rmf', runBehavioralCheck('nist_ai_rmf', 'CREDENTIALS', 'API_KEY=sk-prod-abc123xyz', 'BLOCK'));
+        // ISO 42001: PII
+        this.register('behavioralValidator_iso_42001', runBehavioralCheck('iso_42001', 'PII', 'User email: jane.doe@example.com', 'WARN'));
+        // ISO 23894: AI_TRAINING_DATA
+        this.register('behavioralValidator_iso_23894', runBehavioralCheck('iso-23894', 'AI_TRAINING_DATA', 'AI training data batch: model weights v2.3', 'LOG'));
+        // CCPA: SPI
+        this.register('behavioralValidator_ccpa', runBehavioralCheck('ccpa', 'SPI', 'Consumer health condition: diabetes type 2', 'BLOCK'));
+        // LGPD: SENSITIVE_PII_BR
+        this.register('behavioralValidator_lgpd', runBehavioralCheck('lgpd', 'SENSITIVE_PII_BR', 'CPF: 123.456.789-09 racial origin: Black', 'BLOCK'));
+        // PIPL: PII_CN (dataPolicy.categoryActions: PII_CN = WARN)
+        this.register('behavioralValidator_pipl', runBehavioralCheck('pipl', 'PII_CN', 'National ID: 110101199003077892', 'WARN'));
+        // CA PIPEDA (X2 split -- legacy key kept for backward compat): CA_PIPEDA_PERSONAL_INFO (WARN)
+        this.register('behavioralValidator_pipeda', runBehavioralCheck('ca-pipeda', 'CA_PIPEDA_PERSONAL_INFO', 'SIN: 046-454-286', 'WARN'));
+        // GLBA: NPI
+        this.register('behavioralValidator_glba', runBehavioralCheck('glba', 'NPI', 'Account number: 12345678 routing: 021000021', 'BLOCK'));
+        // BIPA: BIOMETRIC_IDENTIFIER
+        this.register('behavioralValidator_bipa', runBehavioralCheck('bipa', 'BIOMETRIC_IDENTIFIER', 'Biometric ID: fingerprint hash abc123def456', 'BLOCK'));
+        // ABA: PRIVILEGED
+        this.register('behavioralValidator_aba', runBehavioralCheck('aba', 'PRIVILEGED', 'Attorney-client privileged communication: case strategy memo', 'BLOCK'));
+        // FTC §5: PAYMENT_DATA
+        this.register('behavioralValidator_ftc5', runBehavioralCheck('ftc5', 'PAYMENT_DATA', 'Card number 4111111111111111 expires 12/26', 'BLOCK'));
+        // SR 11-7: MODEL_INPUT
+        this.register('behavioralValidator_sr117', runBehavioralCheck('sr11-7', 'MODEL_INPUT', 'Model input feature vector batch_id=2026-001 for risk model', 'LOG'));
+        // 21 CFR Part 11: REGULATED_RECORD
+        this.register('behavioralValidator_part11', runBehavioralCheck('part11', 'REGULATED_RECORD', 'Regulated electronic record: batch 2026-001 audit trail', 'BLOCK'));
+        // SOX 404: CREDENTIALS
+        this.register('behavioralValidator_sox404', runBehavioralCheck('sox404', 'CREDENTIALS', 'API_KEY=sk-prod-abc123xyz password=secret123', 'BLOCK'));
+        // BSA/AML: NPI
+        this.register('behavioralValidator_bsa_aml', runBehavioralCheck('bsa-aml', 'NPI', 'Account number: 12345678 routing: 021000021', 'BLOCK'));
+        // NYDFS 500: CREDENTIALS
+        this.register('behavioralValidator_nydfs500', runBehavioralCheck('nydfs500', 'CREDENTIALS', 'API_KEY=sk-prod-abc123xyz password=secret123', 'BLOCK'));
+        // CFPB 2023-03: CREDIT_DECISION
+        this.register('behavioralValidator_cfpb_2023_03', runBehavioralCheck('cfpb-2023-03', 'CREDIT_DECISION', 'Credit decision DECLINED for applicant ID A98765', 'LOG'));
+        // MiFID II: CLIENT_FINANCIAL_DATA
+        this.register('behavioralValidator_mifid2', runBehavioralCheck('mifid2', 'CLIENT_FINANCIAL_DATA', 'Client financial portfolio data EUR 250,000 equity account', 'BLOCK'));
+        // NAIC MDL-668: NPI_HEALTH
+        this.register('behavioralValidator_naic_mdl', runBehavioralCheck('naic-mdl', 'NPI_HEALTH', 'Insurance health record: policy holder DOB 1980-03-01 diagnosis code Z87.39', 'BLOCK'));
+        // FRCP 26: PRIVILEGED
+        this.register('behavioralValidator_frcp26', runBehavioralCheck('frcp26', 'PRIVILEGED', 'Attorney-client privileged communication: case strategy memo', 'BLOCK'));
+        // FOIA: FOIA_EXEMPT_1_CLASSIFIED
+        this.register('behavioralValidator_foia', runBehavioralCheck('foia', 'FOIA_EXEMPT_1_CLASSIFIED', 'CLASSIFIED national security intelligence assessment', 'BLOCK'));
+        // LPO 2024: PRIVILEGED
+        this.register('behavioralValidator_lpo2024', runBehavioralCheck('lpo2024', 'PRIVILEGED', 'Attorney-client privileged communication: case strategy memo', 'BLOCK'));
+        // F-PACK-CLEANUP-1 (2026-05-08): behavioralValidator_appi removed.
+        // The legacy `appi` pack file was deleted as a duplicate of `jp-appi`;
+        // canonical coverage is via behavioralValidator_jp_appi (registered
+        // further down). The `appi` alias on JP_APPI_PACK keeps callers using
+        // `createGovernedAgent({ packs: ['appi'] })` working.
+        // FedRAMP: CUI
+        this.register('behavioralValidator_fedramp', runBehavioralCheck('fedramp', 'CUI', 'CUI: controlled unclassified information document ref CUI-2026-001', 'BLOCK'));
+        // StateRAMP: CUI
+        this.register('behavioralValidator_stateramp', runBehavioralCheck('stateramp', 'CUI', 'CUI: controlled unclassified information document ref CUI-2026-001', 'BLOCK'));
+        // CJIS: CJI
+        this.register('behavioralValidator_cjis', runBehavioralCheck('cjis', 'CJI', 'Criminal justice information: NCIC query result for suspect ID 98765', 'BLOCK'));
+        // CMMC 2.0: CUI
+        this.register('behavioralValidator_cmmc2', runBehavioralCheck('cmmc2', 'CUI', 'CUI: controlled unclassified information document ref CUI-2026-001', 'BLOCK'));
+        // US-RESPA: REFERRAL_SIGNAL (renamed from respa to us-respa, X3 2026-04-24)
+        this.register('behavioralValidator_respa', runBehavioralCheck('us-respa', 'REFERRAL_SIGNAL', 'Referral signal from settlement service provider to title company 2026-RESPA-001', 'BLOCK'));
+        // HMDA: HMDA_GMI_RACE (dataPolicy.categoryActions: HMDA_GMI_RACE = BLOCK)
+        this.register('behavioralValidator_hmda', runBehavioralCheck('hmda', 'HMDA_GMI_RACE', 'HMDA GMI race: Asian applicant loan ID 2026-LAR-001', 'BLOCK'));
+        // US-TRID: CLOSING_DISCLOSURE_DRAFT (X3 split 2026-04-24 -- replaces tila-trid)
+        this.register('behavioralValidator_us_trid', runBehavioralCheck('us-trid', 'CLOSING_DISCLOSURE_DRAFT', 'Closing Disclosure draft: APR 6.75% finance charge $45,200 consummation date 2026-05-01', 'LOG'));
+        // US-TILA: ATR_DETERMINATION (X3 split 2026-04-24)
+        this.register('behavioralValidator_us_tila', runBehavioralCheck('us-tila', 'ATR_DETERMINATION', 'ATR determination: debt-to-income ratio 38% ability-to-repay analysis 2026-ATR-001', 'BLOCK'));
+        // ECOA: ECOA_PROHIBITED_BASIS
+        this.register('behavioralValidator_ecoa', runBehavioralCheck('ecoa', 'ECOA_PROHIBITED_BASIS', 'Credit declined based on applicant race: Hispanic', 'BLOCK'));
+        // FCRA: CONSUMER_REPORT_RECORD
+        this.register('behavioralValidator_fcra', runBehavioralCheck('fcra', 'CONSUMER_REPORT_RECORD', 'Consumer report record: tradeline for consumer 123456', 'BLOCK'));
+        // EU AI Liability: AI_PRODUCT_DAMAGE
+        this.register('behavioralValidator_eu_ai_liability', runBehavioralCheck('eu-ai-liability', 'AI_PRODUCT_DAMAGE', 'AI product damage claim: defective AI output caused harm ref 2026-AI-001', 'LOG'));
+        // FDA SaMD: PHI
+        this.register('behavioralValidator_fda_samd', runBehavioralCheck('fda-samd', 'PHI', 'Patient SSN: 123-45-6789', 'BLOCK'));
+        // FDA 21 CFR Part 56 (IRB): SERIOUS_ADVERSE_EVENT -> BLOCK
+        // F-NEW-VERA-PACK-C7-01: missing behavioral check for us-fda-21cfr56.
+        // SAE + CSUBJ pattern fires both SERIOUS_ADVERSE_EVENT (life-threatening-adverse regex)
+        // and IRB_CLINICAL_SUBJECT_ID (CSUBJ prefix regex); SERIOUS_ADVERSE_EVENT is tested
+        // here because it is the highest-risk BLOCK path (21 CFR 56.108(b) prompt reporting).
+        this.register('behavioralValidator_us_fda_21cfr56', runBehavioralCheck('us-fda-21cfr56', 'SERIOUS_ADVERSE_EVENT', 'SAE reported: life-threatening adverse event for clinical subject CSUBJ-001234 IND-2026-0012', 'BLOCK'));
+        // GxP: REGULATED_RECORD
+        this.register('behavioralValidator_gxp', runBehavioralCheck('gxp', 'REGULATED_RECORD', 'Regulated electronic record: batch 2026-001 audit trail', 'BLOCK'));
+        // HMDA (second primary category): HMDA_LAR_ENTRY (dataPolicy.categoryActions: HMDA_LAR_ENTRY = BLOCK)
+        this.register('behavioralValidator_hmda_lar', runBehavioralCheck('hmda', 'HMDA_LAR_ENTRY', 'HMDA LAR entry loan origination 2026-LAR-001', 'BLOCK'));
+        // BIPA second check: BIOMETRIC_INFORMATION
+        this.register('behavioralValidator_bipa_info', runBehavioralCheck('bipa', 'BIOMETRIC_INFORMATION', 'Biometric information: facial geometry scan result', 'BLOCK'));
+        // BSA/AML second check: SANCTIONS_IDENTIFIER
+        this.register('behavioralValidator_bsa_sanctions', runBehavioralCheck('bsa-aml', 'SANCTIONS_IDENTIFIER', 'OFAC SDN match: entity XYZ Corp', 'BLOCK'));
+        // -- P4 Education pack behavioral validators (2026-04-24) --
+        // COPPA: UNDER_13_USER
+        this.register('behavioralValidator_coppa', runBehavioralCheck('coppa', 'UNDER_13_USER', 'age: 8 under_13 user pediatric patient child-directed context', 'BLOCK'));
+        // Common Rule: RESEARCH_SUBJECT_ID
+        this.register('behavioralValidator_common_rule', runBehavioralCheck('common-rule', 'RESEARCH_SUBJECT_ID', 'subject_id: SUBJ-004821 participant_id study protocol IRB', 'BLOCK'));
+        // Common Rule (GAP-5): IRB_APPROVAL_EXPIRED
+        this.register('behavioralValidator_common_rule_irb_expiry', runBehavioralCheck('common-rule', 'IRB_APPROVAL_EXPIRED', 'IRB-2023-001 expired 2024-05-01 protocol approval lapsed', 'BLOCK'));
+        // Title IX: TITLE_IX_INVESTIGATION_RECORD
+        this.register('behavioralValidator_title_ix', runBehavioralCheck('title-ix', 'TITLE_IX_INVESTIGATION_RECORD', 'Title IX investigation record: respondent vs complainant Title IX Coordinator', 'BLOCK'));
+        // Title IX (GAP-4): TITLE_IX_RETALIATION -- paraphrase pattern
+        this.register('behavioralValidator_title_ix_retaliation', runBehavioralCheck('title-ix', 'TITLE_IX_RETALIATION', 'student suspended following gender bias complaint discrimination report', 'BLOCK'));
+        // NIH Data Sharing: CONTROLLED_ACCESS_REPOSITORY_DATA (legacy pack id -- routes to us-nih-gds)
+        this.register('behavioralValidator_nih_data_sharing', runBehavioralCheck('us-nih-gds', 'CONTROLLED_ACCESS_REPOSITORY_DATA', 'dbGaP phs000001 controlled access dataset DAC approved DUC', 'BLOCK'));
+        // NIH Data Sharing (GAP-6): DAC_APPROVAL_EXPIRED (legacy pack id -- routes to us-nih-gds)
+        this.register('behavioralValidator_nih_dms_dac_expiry', runBehavioralCheck('us-nih-gds', 'DAC_APPROVAL_EXPIRED', 'DAC approved DUC granted 2022-01-15, expires 2022-12-31 dbGaP dataset', 'BLOCK'));
+        // CA PIPEDA (X2 split): CA_PIPEDA_PERSONAL_INFO (WARN)
+        this.register('behavioralValidator_ca_pipeda', runBehavioralCheck('ca-pipeda', 'CA_PIPEDA_PERSONAL_INFO', 'SIN: 046-454-286', 'WARN'));
+        // QC Law 25 (X2 split): QC_LAW25_HIGH_RISK_PI (BLOCK)
+        this.register('behavioralValidator_ca_qc_law25', runBehavioralCheck('ca-qc-law25', 'QC_LAW25_HIGH_RISK_PI', 'health record: RAMQ biometric data facial recognition Quebec resident', 'BLOCK'));
+        // NIH DMS (X2 split): DMSP_RESTRICTED_DATA (BLOCK)
+        this.register('behavioralValidator_us_nih_dms', runBehavioralCheck('us-nih-dms', 'DMSP_RESTRICTED_DATA', 'DMSP restricted outside dmsp approved scope data management sharing plan limit', 'BLOCK'));
+        // NIH GDS (X2 split): CONTROLLED_ACCESS_REPOSITORY_DATA (BLOCK)
+        this.register('behavioralValidator_us_nih_gds', runBehavioralCheck('us-nih-gds', 'CONTROLLED_ACCESS_REPOSITORY_DATA', 'dbGaP phs000001 controlled access dataset DAC approved DUC', 'BLOCK'));
+        // NIH GDS STUDY_CONCLUDED_DUC_ACTIVE (F-NEW-VERA-PACK-C6-02, 2026-05-03):
+        // Study ended but DUC still in-date -- requires DUC termination workflow confirmation.
+        // Action: REQUIRE_APPROVAL (not BLOCK -- close-out work is legitimate).
+        this.register('nih_gds_study_concluded_duc_termination_active', runBehavioralCheck('us-nih-gds', 'STUDY_CONCLUDED_DUC_ACTIVE', 'study concluded final report submitted DAC DUC dbGaP controlled access genomic', 'REQUIRE_APPROVAL'));
+        // NIH CoC (X2 split): COC_PROTECTED_RESEARCH_DATA (BLOCK)
+        this.register('behavioralValidator_us_nih_coc', runBehavioralCheck('us-nih-coc', 'COC_PROTECTED_RESEARCH_DATA', 'certificate of confidentiality CoC protected research data', 'BLOCK'));
+        // NIH IT Security (X2 split): NIH_IT_FISMA_BASELINE_GAP (BLOCK)
+        this.register('behavioralValidator_us_nih_it_security', runBehavioralCheck('us-nih-it-security', 'NIH_IT_FISMA_BASELINE_GAP', 'NIH_IT_FISMA_BASELINE_GAP fisma gap nih data unencrypted controlled access', 'BLOCK'));
+        // Florida Student Privacy: FLORIDA_K12_STUDENT_RECORD
+        this.register('behavioralValidator_florida_student_privacy', runBehavioralCheck('florida-student-privacy', 'FLORIDA_K12_STUDENT_RECORD', 'FLORIDA_K12_STUDENT_RECORD florida k12 student grade 5 pk yonge school district', 'BLOCK'));
+        // Florida Student Privacy (GAP-7): TARGETED_ADVERTISING_RECIPIENT
+        this.register('behavioralValidator_florida_targeted_advertising', runBehavioralCheck('florida-student-privacy', 'TARGETED_ADVERTISING_RECIPIENT', 'florida k12 student record analytics advertising learning-analytics-provider adtech', 'BLOCK'));
+        // -- AU packs (Phase 5) --
+        // AU Privacy Act 1988
+        this.register('au_privacy_sensitive_gate_active', configFlag('governance-runtime', 'auPrivacySensitiveGateEnabled', 'AU Privacy Act sensitive PI gate (APP 3)'));
+        this.register('au_privacy_offshore_gate_active', configFlag('supply-chain', 'auPrivacyOffshoreTransferGateEnabled', 'AU Privacy Act offshore transfer gate (APP 8)'));
+        this.register('au_privacy_ndb_timer_active', (ctx) => {
+            const hours = ctx.packConfig?.['event-bus']?.auNdbNotificationDeadlineHours;
+            const passed = typeof hours === 'number' && hours <= 720;
+            return {
+                passed,
+                detail: passed
+                    ? `AU NDB notification clock ${hours}h configured (<= 720h / 30 days)`
+                    : `auNdbNotificationDeadlineHours=${hours} (need <= 720)`,
+            };
+        });
+        this.register('au_privacy_govt_id_block_active', (ctx) => {
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const action = ctx.packConfig?.['data-classifier']?.auGovernmentIdAction;
+            const passed = dcActive && action === 'BLOCK';
+            return {
+                passed,
+                detail: passed
+                    ? 'AU government ID (TFN/DL) action = BLOCK via data-classifier (APP 8, TFN Rule)'
+                    : `dcActive=${dcActive}, auGovernmentIdAction=${action}`,
+            };
+        });
+        this.register('au_privacy_secondary_use_gate_active', configFlag('governance-runtime', 'auPrivacySecondaryUseGateEnabled', 'AU Privacy Act secondary use gate (APP 6)'));
+        this.register('au_privacy_automated_decision_log_active', configFlag('event-bus', 'auPrivacyAutomatedDecisionLoggingEnabled', 'AU Privacy Act automated decision logging'));
+        this.register('au_privacy_access_sla_active', (ctx) => {
+            const days = ctx.packConfig?.['governance-runtime']?.auPrivacyAccessResponseDays;
+            const passed = typeof days === 'number' && days <= 30;
+            return {
+                passed,
+                detail: passed
+                    ? `AU Privacy Act access SLA ${days}d (<= 30 days) configured (APP 12)`
+                    : `auPrivacyAccessResponseDays=${days} (need <= 30)`,
+            };
+        });
+        this.register('au_privacy_retention_check_active', configFlag('session-persistence', 'auPrivacyRetentionScheduleEnabled', 'AU Privacy Act retention schedule (APP 11)'));
+        // AU CDR Act 2019
+        this.register('au_cdr_consent_gate_active', (ctx) => {
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const action = ctx.packConfig?.['data-classifier']?.auCdrConsentAction;
+            const passed = dcActive && action === 'BLOCK';
+            return {
+                passed,
+                detail: passed
+                    ? 'AU CDR expired consent action = BLOCK via data-classifier (PS 1.4)'
+                    : `dcActive=${dcActive}, auCdrConsentAction=${action}`,
+            };
+        });
+        this.register('au_cdr_secondary_use_block_active', configFlag('governance-runtime', 'auCdrSecondaryUseBlockEnabled', 'AU CDR secondary use block (PS 6.4)'));
+        this.register('au_cdr_marketing_block_active', configFlag('governance-runtime', 'auCdrMarketingBlockEnabled', 'AU CDR marketing use block (PS 7.5)'));
+        this.register('au_cdr_deletion_sla_active', (ctx) => {
+            const hours = ctx.packConfig?.['event-bus']?.auCdrDeletionDeadlineHours;
+            const passed = typeof hours === 'number' && hours <= 336; // CDR 14-day (336h)
+            return {
+                passed,
+                detail: passed
+                    ? `AU CDR deletion SLA ${hours}h configured (<= 336h / 14 days) (PS 9.2)`
+                    : `auCdrDeletionDeadlineHours=${hours} (need <= 336)`,
+            };
+        });
+        this.register('au_cdr_offshore_gate_active', configFlag('supply-chain', 'auCdrOffshoreTransferGateEnabled', 'AU CDR offshore transfer gate (PS 8.11)'));
+        this.register('au_cdr_access_log_active', configFlag('event-bus', 'auCdrAccessLoggingEnabled', 'AU CDR access logging'));
+        // AU APRA CPS 234
+        this.register('au_cps234_incident_72hr_active', (ctx) => {
+            const hours = ctx.packConfig?.['event-bus']?.auCps234IncidentNotificationHours;
+            const passed = hours === 72;
+            return {
+                passed,
+                detail: passed
+                    ? 'APRA CPS 234 72-hour incident notification configured (Para 23)'
+                    : `auCps234IncidentNotificationHours=${hours} (need 72)`,
+            };
+        });
+        this.register('au_cps234_control_weakness_notify_active', configFlag('event-bus', 'auCps234ControlWeaknessNotificationEnabled', 'APRA CPS 234 control weakness notification (Para 22)'));
+        this.register('au_cps234_third_party_gate_active', configFlag('supply-chain', 'auCps234ThirdPartyGateEnabled', 'APRA CPS 234 third-party arrangement gate (Para 15-16)'));
+        this.register('au_cps234_asset_register_check_active', configFlag('attestation-manager', 'auCps234InfoAssetRegisterRequired', 'APRA CPS 234 information asset register (Para 10)'));
+        this.register('au_cps234_annual_testing_active', (ctx) => {
+            const days = ctx.packConfig?.['attestation-manager']?.auCps234TestingCadenceDays;
+            const passed = typeof days === 'number' && days <= 365;
+            return {
+                passed,
+                detail: passed
+                    ? `APRA CPS 234 testing cadence ${days}d (<= 365 days) (Para 20-21)`
+                    : `auCps234TestingCadenceDays=${days}`,
+            };
+        });
+        this.register('au_cps234_customer_data_log_active', configFlag('event-bus', 'auCps234CustomerDataLoggingEnabled', 'APRA CPS 234 customer data logging'));
+        // AU APRA CPS 230
+        this.register('au_cps230_incident_72hr_active', (ctx) => {
+            const hours = ctx.packConfig?.['event-bus']?.auCps230IncidentNotificationHours;
+            const passed = hours === 72;
+            return {
+                passed,
+                detail: passed
+                    ? 'APRA CPS 230 72-hour operational incident notification configured'
+                    : `auCps230IncidentNotificationHours=${hours} (need 72)`,
+            };
+        });
+        this.register('au_cps230_provider_due_diligence_active', configFlag('supply-chain', 'auCps230ProviderDueDiligenceEnabled', 'APRA CPS 230 material provider due diligence'));
+        this.register('au_cps230_contract_completeness_active', configFlag('supply-chain', 'auCps230ContractCompletenessEnabled', 'APRA CPS 230 provider contract completeness'));
+        this.register('au_cps230_bcp_annual_test_active', (ctx) => {
+            const days = ctx.packConfig?.['attestation-manager']?.auCps230BcpTestCadenceDays;
+            const passed = typeof days === 'number' && days <= 365;
+            return {
+                passed,
+                detail: passed
+                    ? `APRA CPS 230 BCP test cadence ${days}d (<= 365 days)`
+                    : `auCps230BcpTestCadenceDays=${days}`,
+            };
+        });
+        this.register('au_cps230_critical_op_register_active', configFlag('attestation-manager', 'auCps230CriticalOpRegisterRequired', 'APRA CPS 230 critical operations register'));
+        this.register('au_cps230_post_incident_review_active', configFlag('attestation-manager', 'auCps230PostIncidentReviewEnabled', 'APRA CPS 230 post-incident review'));
+        // AU SOCI Act 2018
+        this.register('au_soci_incident_12hr_active', (ctx) => {
+            const hours = ctx.packConfig?.['event-bus']?.auSociIncident12HrNotificationHours;
+            const passed = hours === 12;
+            return {
+                passed,
+                detail: passed
+                    ? 'SOCI Act 12-hour cyber incident notification configured (s.30BC)'
+                    : `auSociIncident12HrNotificationHours=${hours} (need 12)`,
+            };
+        });
+        this.register('au_soci_incident_72hr_active', (ctx) => {
+            const hours = ctx.packConfig?.['event-bus']?.auSociIncident72HrNotificationHours;
+            const passed = hours === 72;
+            return {
+                passed,
+                detail: passed
+                    ? 'SOCI Act 72-hour cyber incident follow-up notification configured (s.30BG)'
+                    : `auSociIncident72HrNotificationHours=${hours} (need 72)`,
+            };
+        });
+        this.register('au_soci_sons_direction_active', configFlag('governance-runtime', 'auSociSonsDirectionComplianceEnabled', 'SOCI Act SONS direction compliance'));
+        this.register('au_soci_cirmp_annual_active', (ctx) => {
+            const days = ctx.packConfig?.['attestation-manager']?.auSociCirmpReviewCadenceDays;
+            const passed = typeof days === 'number' && days <= 365;
+            return {
+                passed,
+                detail: passed
+                    ? `SOCI Act CIRMP annual review cadence ${days}d configured`
+                    : `auSociCirmpReviewCadenceDays=${days}`,
+            };
+        });
+        this.register('au_soci_data_asset_gate_active', configFlag('governance-runtime', 'auSociDataAssetGateEnabled', 'SOCI Act data asset gate'));
+        // AU ASIC RG 271
+        this.register('au_rg271_idr_30day_sla_active', (ctx) => {
+            const days = ctx.packConfig?.['event-bus']?.auRg271IdrStandardDays;
+            const passed = days === 30;
+            return {
+                passed,
+                detail: passed
+                    ? 'ASIC RG 271 IDR 30-day standard SLA configured'
+                    : `auRg271IdrStandardDays=${days} (need 30)`,
+            };
+        });
+        this.register('au_rg271_ai_decision_reasons_active', configFlag('transparency-injector', 'auRg271AiDecisionReasonsEnabled', 'ASIC RG 271 AI decision reasons disclosure'));
+        this.register('au_rg271_complaint_log_active', configFlag('event-bus', 'auRg271ComplaintLoggingEnabled', 'ASIC RG 271 complaint logging'));
+        this.register('au_rg271_systemic_escalation_active', configFlag('governance-runtime', 'auRg271SystemicIssueEscalationEnabled', 'ASIC RG 271 systemic issue escalation'));
+        this.register('au_rg271_asic_reporting_active', configFlag('attestation-manager', 'auRg271AsicReportingEnabled', 'ASIC RG 271 ASIC reporting'));
+        this.register('au_rg271_retention_7yr_active', (ctx) => {
+            const days = ctx.packConfig?.['session-persistence']?.auRg271RetentionDays;
+            const passed = typeof days === 'number' && days >= 2555;
+            return {
+                passed,
+                detail: passed
+                    ? `ASIC RG 271 7-year retention ${days}d configured (>= 2555)`
+                    : `auRg271RetentionDays=${days} (need >= 2555)`,
+            };
+        });
+        // AU ASIC RG 274 / DDO
+        this.register('au_ddo_out_of_target_block_active', (ctx) => {
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const action = ctx.packConfig?.['data-classifier']?.auDdoOutOfTargetAction;
+            const passed = dcActive && action === 'BLOCK';
+            return {
+                passed,
+                detail: passed
+                    ? 'AU DDO out-of-target-market action = BLOCK via data-classifier (s.994E Corporations Act)'
+                    : `dcActive=${dcActive}, auDdoOutOfTargetAction=${action}`,
+            };
+        });
+        this.register('au_ddo_tmd_screening_log_active', configFlag('event-bus', 'auDdoTmdScreeningLoggingEnabled', 'AU DDO TMD screening logging'));
+        this.register('au_ddo_significant_dealing_report_active', (ctx) => {
+            const days = ctx.packConfig?.['event-bus']?.auDdoSignificantDealingReportDays;
+            const passed = typeof days === 'number' && days <= 10;
+            return {
+                passed,
+                detail: passed
+                    ? `AU DDO significant dealing report ${days} BD configured (<= 10 BD) (s.994F2)`
+                    : `auDdoSignificantDealingReportDays=${days} (need <= 10)`,
+            };
+        });
+        this.register('au_ddo_tmd_review_alert_active', configFlag('event-bus', 'auDdoTmdReviewAlertEnabled', 'AU DDO TMD review trigger alert'));
+        this.register('au_ddo_retail_client_log_active', configFlag('event-bus', 'auDdoRetailClientLoggingEnabled', 'AU DDO retail client logging'));
+        // AU AML/CTF Act 2006
+        this.register('au_aml_smr_3bd_active', (ctx) => {
+            const days = ctx.packConfig?.['event-bus']?.auAmlSmrDeadlineBusinessDays;
+            const passed = typeof days === 'number' && days <= 3;
+            return {
+                passed,
+                detail: passed
+                    ? `AU AML SMR standard 3-BD deadline ${days} BD configured`
+                    : `auAmlSmrDeadlineBusinessDays=${days} (need <= 3)`,
+            };
+        });
+        this.register('au_aml_smr_ctf_24hr_active', (ctx) => {
+            const hours = ctx.packConfig?.['event-bus']?.auAmlCtfSmrNotificationHours;
+            const passed = hours === 24;
+            return {
+                passed,
+                detail: passed
+                    ? 'AU AML/CTF 24-hour SMR notification clock configured (s.41B AUSTRAC requirement)'
+                    : `auAmlCtfSmrNotificationHours=${hours} (need 24)`,
+            };
+        });
+        this.register('au_aml_tipping_off_block_active', (ctx) => {
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const action = ctx.packConfig?.['data-classifier']?.auAmlTippingOffAction;
+            const passed = dcActive && action === 'BLOCK';
+            return {
+                passed,
+                detail: passed
+                    ? 'AU AML tipping-off action = BLOCK via data-classifier (AML/CTF Act s.123)'
+                    : `dcActive=${dcActive}, auAmlTippingOffAction=${action}`,
+            };
+        });
+        this.register('au_aml_pep_approval_active', configFlag('approval-queue', 'auAmlPepApprovalRequired', 'AU AML PEP enhanced due diligence approval'));
+        this.register('au_aml_high_risk_country_active', configFlag('governance-runtime', 'auAmlHighRiskCountryScreeningEnabled', 'AU AML high-risk country screening'));
+        this.register('au_aml_ttr_10bd_active', (ctx) => {
+            const days = ctx.packConfig?.['event-bus']?.auAmlTtrDeadlineBusinessDays;
+            const passed = typeof days === 'number' && days <= 10;
+            return {
+                passed,
+                detail: passed
+                    ? `AU AML threshold transaction report ${days} BD configured (<= 10 BD)`
+                    : `auAmlTtrDeadlineBusinessDays=${days} (need <= 10)`,
+            };
+        });
+        this.register('au_aml_ifti_10bd_active', (ctx) => {
+            const days = ctx.packConfig?.['event-bus']?.auAmlIftiDeadlineBusinessDays;
+            const passed = typeof days === 'number' && days <= 10;
+            return {
+                passed,
+                detail: passed
+                    ? `AU AML IFTI ${days} BD configured (<= 10 BD)`
+                    : `auAmlIftiDeadlineBusinessDays=${days} (need <= 10)`,
+            };
+        });
+        this.register('au_aml_programme_ai_docs_active', configFlag('attestation-manager', 'auAmlProgrammeAiDocumentationRequired', 'AU AML programme AI documentation'));
+        this.register('au_aml_dnfbp_registration_active', configFlag('governance-runtime', 'auAmlDnfbpRegistrationCheckEnabled', 'AU AML DNFBP registration check'));
+        // AU Spam Act 2003
+        this.register('au_spam_act_consent_gate_active', (ctx) => {
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const action = ctx.packConfig?.['data-classifier']?.auCemConsentAction;
+            const passed = dcActive && action === 'BLOCK';
+            return {
+                passed,
+                detail: passed
+                    ? 'AU Spam Act consent gate: CEM without consent action = BLOCK via data-classifier (s.16)'
+                    : `dcActive=${dcActive}, auCemConsentAction=${action}`,
+            };
+        });
+        this.register('au_spam_act_unsubscribe_block_active', (ctx) => {
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const action = ctx.packConfig?.['data-classifier']?.auCemUnsubscribedAction;
+            const passed = dcActive && action === 'BLOCK';
+            return {
+                passed,
+                detail: passed
+                    ? 'AU Spam Act unsubscribed address action = BLOCK via data-classifier (s.18)'
+                    : `dcActive=${dcActive}, auCemUnsubscribedAction=${action}`,
+            };
+        });
+        this.register('au_spam_act_harvested_block_active', configFlag('governance-runtime', 'auCemHarvestedAddressBlockEnabled', 'AU Spam Act harvested address block (ss.20-22)'));
+        this.register('au_spam_act_unsubscribe_5bd_active', (ctx) => {
+            const days = ctx.packConfig?.['event-bus']?.auCemUnsubscribeDeadlineBusinessDays;
+            const passed = typeof days === 'number' && days <= 5;
+            return {
+                passed,
+                detail: passed
+                    ? `AU Spam Act unsubscribe action ${days} BD (<= 5 BD) configured (s.18(1)(a))`
+                    : `auCemUnsubscribeDeadlineBusinessDays=${days} (need <= 5)`,
+            };
+        });
+        this.register('au_spam_act_sender_id_check_active', configFlag('transparency-injector', 'auCemSenderIdentityDisclosureEnabled', 'AU Spam Act sender identity disclosure (s.17)'));
+        this.register('au_spam_act_consent_logging_active', configFlag('session-persistence', 'auCemConsentLoggingEnabled', 'AU Spam Act consent logging'));
+        // AU Online Safety Act 2021
+        this.register('au_online_safety_csam_block_active', (ctx) => {
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const action = ctx.packConfig?.['data-classifier']?.auOsaCsamAction;
+            const passed = dcActive && action === 'BLOCK';
+            return {
+                passed,
+                detail: passed
+                    ? 'AU Online Safety Act: CSAM action = BLOCK via data-classifier (Part 4, OSA 2021)'
+                    : `dcActive=${dcActive}, auOsaCsamAction=${action}`,
+            };
+        });
+        this.register('au_online_safety_ncii_block_active', (ctx) => {
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const action = ctx.packConfig?.['data-classifier']?.auOsaNciiAction;
+            const passed = dcActive && action === 'BLOCK';
+            return {
+                passed,
+                detail: passed
+                    ? 'AU Online Safety Act: NCII action = BLOCK via data-classifier (Part 5, OSA 2021)'
+                    : `dcActive=${dcActive}, auOsaNciiAction=${action}`,
+            };
+        });
+        this.register('au_online_safety_48h_removal_active', (ctx) => {
+            const hours = ctx.packConfig?.['event-bus']?.auOsaRemovalObligationHours;
+            const passed = hours === 48;
+            return {
+                passed,
+                detail: passed
+                    ? 'AU Online Safety Act 48-hour removal obligation configured (Parts 4/5/6 OSA 2021)'
+                    : `auOsaRemovalObligationHours=${hours} (need 48)`,
+            };
+        });
+        this.register('au_online_safety_esafety_notice_active', configFlag('governance-runtime', 'auOsaESafetyNoticeComplianceEnabled', 'AU Online Safety Act eSafety notice compliance'));
+        this.register('au_online_safety_minor_protections_active', configFlag('governance-runtime', 'auOsaMinorProtectionsEnabled', 'AU Online Safety Act minor protections'));
+        this.register('au_online_safety_bose_coverage_active', configFlag('attestation-manager', 'auOsaBoseCoverageAttestationRequired', 'AU Online Safety Act BOSE coverage attestation'));
+        this.register('au_online_safety_moderation_logging_active', configFlag('event-bus', 'auOsaModerationLoggingEnabled', 'AU Online Safety Act moderation logging'));
+        // AU AI Ethics Framework (voluntary)
+        this.register('au_aiethics_accountability_defined_active', configFlag('attestation-manager', 'auAiEthicsAccountabilityDefined', 'AU AI Ethics Framework accountability defined (Principle 1)'));
+        this.register('au_aiethics_ai_disclosure_active', configFlag('transparency-injector', 'auAiEthicsDisclosureEnabled', 'AU AI Ethics Framework AI disclosure (Principle 7)'));
+        this.register('au_aiethics_governance_doc_active', configFlag('attestation-manager', 'auAiEthicsGovernanceDocRequired', 'AU AI Ethics Framework governance documentation (Principle 9)'));
+        this.register('au_aiethics_testing_current_active', (ctx) => {
+            const days = ctx.packConfig?.['attestation-manager']?.auAiEthicsTestingCadenceDays;
+            const passed = typeof days === 'number' && days <= 365;
+            return {
+                passed,
+                detail: passed
+                    ? `AU AI Ethics Framework testing cadence ${days}d configured`
+                    : `auAiEthicsTestingCadenceDays=${days}`,
+            };
+        });
+        this.register('au_aiethics_redress_mechanism_active', configFlag('approval-queue', 'auAiEthicsRedressMechanismEnabled', 'AU AI Ethics Framework redress mechanism (Principle 10)'));
+        this.register('au_aiethics_provenance_docs_active', configFlag('attestation-manager', 'auAiEthicsProvenanceDocsRequired', 'AU AI Ethics Framework training data provenance'));
+        this.register('au_aiethics_human_override_active', configFlag('approval-queue', 'auAiEthicsHumanOverrideEnabled', 'AU AI Ethics Framework human override (Principle 8)'));
+        // AU Mandatory AI Guardrails (DISR 2024, not yet enacted)
+        this.register('au_mandatory_ai_high_risk_gate_active', configFlag('governance-runtime', 'auMandatoryAiHighRiskGateEnabled', 'AU Mandatory AI Guardrail 1: high-risk AI gate [CITATION TO VERIFY]'));
+        this.register('au_mandatory_ai_accountability_active', configFlag('attestation-manager', 'auMandatoryAiAccountabilityDocRequired', 'AU Mandatory AI Guardrail 2: accountability documentation [CITATION TO VERIFY]'));
+        this.register('au_mandatory_ai_transparency_active', configFlag('transparency-injector', 'auMandatoryAiTransparencyEnabled', 'AU Mandatory AI Guardrail 4: transparency disclosure [CITATION TO VERIFY]'));
+        this.register('au_mandatory_ai_redress_active', configFlag('approval-queue', 'auMandatoryAiRedressEnabled', 'AU Mandatory AI Guardrail 5: redress mechanism [CITATION TO VERIFY]'));
+        this.register('au_mandatory_ai_testing_active', (ctx) => {
+            const days = ctx.packConfig?.['attestation-manager']?.auMandatoryAiTestingCadenceDays;
+            const passed = typeof days === 'number' && days <= 365;
+            return {
+                passed,
+                detail: passed
+                    ? `AU Mandatory AI testing cadence ${days}d configured [CITATION TO VERIFY]`
+                    : `auMandatoryAiTestingCadenceDays=${days}`,
+            };
+        });
+        this.register('au_mandatory_ai_provenance_active', configFlag('attestation-manager', 'auMandatoryAiProvenanceRequired', 'AU Mandatory AI Guardrail 6: training data provenance [CITATION TO VERIFY]'));
+        // AU TGA SaMD
+        this.register('au_tga_samd_artg_registration_active', (ctx) => {
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const action = ctx.packConfig?.['data-classifier']?.auTgaSamdUnregisteredAction;
+            const passed = dcActive && action === 'BLOCK';
+            return {
+                passed,
+                detail: passed
+                    ? 'AU TGA SaMD: unregistered SaMD action = BLOCK via data-classifier (Therapeutic Goods Act s.19D)'
+                    : `dcActive=${dcActive}, auTgaSamdUnregisteredAction=${action}`,
+            };
+        });
+        this.register('au_tga_samd_adverse_event_block_active', (ctx) => {
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const action = ctx.packConfig?.['data-classifier']?.auTgaSamdAdverseEventAction;
+            const passed = dcActive && action === 'BLOCK';
+            return {
+                passed,
+                detail: passed
+                    ? 'AU TGA SaMD: adverse event action = BLOCK via data-classifier (TGA MDR obligations)'
+                    : `dcActive=${dcActive}, auTgaSamdAdverseEventAction=${action}`,
+            };
+        });
+        this.register('au_tga_samd_pccp_change_approval_active', configFlag('approval-queue', 'auTgaSamdPccpChangeApprovalRequired', 'AU TGA SaMD PCCP change approval (TGA AI/ML Guidance 2023)'));
+        this.register('au_tga_samd_performance_monitoring_active', configFlag('anomaly-detector', 'auTgaSamdPerformanceMonitoringEnabled', 'AU TGA SaMD performance monitoring (GMLP Principle 6)'));
+        this.register('au_tga_samd_clinical_evidence_active', configFlag('attestation-manager', 'auTgaSamdClinicalEvidenceRequired', 'AU TGA SaMD clinical evidence (TGA ECA)'));
+        this.register('au_tga_samd_gmlp_compliance_active', configFlag('attestation-manager', 'auTgaSamdGmlpComplianceAttested', 'AU TGA SaMD GMLP compliance attestation'));
+        this.register('au_tga_samd_labelling_active', configFlag('transparency-injector', 'auTgaSamdLabellingDisclosureEnabled', 'AU TGA SaMD AI labelling disclosure'));
+        this.register('au_tga_samd_retention_10yr_active', (ctx) => {
+            const days = ctx.packConfig?.['session-persistence']?.auTgaSamdRetentionDays;
+            const passed = typeof days === 'number' && days >= 3650;
+            return {
+                passed,
+                detail: passed
+                    ? `AU TGA SaMD 10-year retention ${days}d configured (>= 3650)`
+                    : `auTgaSamdRetentionDays=${days} (need >= 3650)`,
+            };
+        });
+        // AU State Health Privacy (NSW HRIPA / VIC HRA / ACT HRPAA)
+        this.register('au_state_health_nsw_transborder_block_active', (ctx) => {
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const action = ctx.packConfig?.['data-classifier']?.auStateHealthTransborderAction;
+            const passed = dcActive && action === 'BLOCK';
+            return {
+                passed,
+                detail: passed
+                    ? 'AU State Health: transborder transfer action = BLOCK via data-classifier (NSW HPP 10 / HRIPA 2002)'
+                    : `dcActive=${dcActive}, auStateHealthTransborderAction=${action}`,
+            };
+        });
+        this.register('au_state_health_research_ethics_active', configFlag('approval-queue', 'auStateHealthResearchEthicsApprovalRequired', 'AU State Health research ethics approval gate'));
+        this.register('au_state_health_mental_health_retention_active', (ctx) => {
+            const days = ctx.packConfig?.['session-persistence']?.auStateHealthMentalHealthRetentionDays;
+            // VIC mental health: 25 years from last service entry for non-deceased [CITATION TO VERIFY]
+            const passed = typeof days === 'number' && days >= 3650;
+            return {
+                passed,
+                detail: passed
+                    ? `AU State Health mental health retention ${days}d configured (>= 3650)`
+                    : `auStateHealthMentalHealthRetentionDays=${days}`,
+            };
+        });
+        this.register('au_state_health_access_30d_active', (ctx) => {
+            const days = ctx.packConfig?.['governance-runtime']?.auStateHealthAccessResponseDays;
+            const passed = typeof days === 'number' && days <= 30;
+            return {
+                passed,
+                detail: passed
+                    ? `AU State Health access response ${days}d (<= 30 days) configured`
+                    : `auStateHealthAccessResponseDays=${days} (need <= 30)`,
+            };
+        });
+        this.register('au_state_health_collection_notice_active', configFlag('transparency-injector', 'auStateHealthCollectionNoticeEnabled', 'AU State Health collection notice (NSW HPP 4 / VIC HPP 1)'));
+        this.register('au_state_health_server_location_active', configFlag('supply-chain', 'auStateHealthServerLocationAustralia', 'AU State Health server location Australia [CITATION TO VERIFY]'));
+        this.register('au_state_health_correction_30d_active', (ctx) => {
+            const days = ctx.packConfig?.['governance-runtime']?.auStateHealthCorrectionResponseDays;
+            const passed = typeof days === 'number' && days <= 30;
+            return {
+                passed,
+                detail: passed
+                    ? `AU State Health correction response ${days}d configured`
+                    : `auStateHealthCorrectionResponseDays=${days} (need <= 30)`,
+            };
+        });
+        this.register('au_state_health_minor_retention_active', (ctx) => {
+            const days = ctx.packConfig?.['session-persistence']?.auStateHealthMinorRetentionDays;
+            // NSW: at least 7 years after last entry or age 25 (whichever is later) — conservative 3650d
+            const passed = typeof days === 'number' && days >= 3650;
+            return {
+                passed,
+                detail: passed
+                    ? `AU State Health minor retention ${days}d configured (>= 3650 conservative floor)`
+                    : `auStateHealthMinorRetentionDays=${days}`,
+            };
+        });
+        // -- AU pack behavioral validators (Phase 5) --
+        // AU Privacy Act: AU_PI_GOVERNMENT_ID (TFN pattern) -> BLOCK
+        this.register('behavioralValidator_au_privacy_act', runBehavioralCheck('au-privacy-act', 'AU_PI_GOVERNMENT_ID', 'TFN 123 456 789 tax file number australia individual', 'BLOCK'));
+        // AU CDR: AU_CDR_CONSENT_EXPIRED -> BLOCK
+        this.register('behavioralValidator_au_cdr', runBehavioralCheck('au-cdr', 'AU_CDR_CONSENT_EXPIRED', 'CDR consent expired consumer data right consent_expired accreditation AU', 'BLOCK'));
+        // AU CPS 234: AU_CPS234_INCIDENT -> REQUIRE_APPROVAL
+        this.register('behavioralValidator_au_cps234', runBehavioralCheck('au-cps234', 'AU_CPS234_INCIDENT', 'APRA CPS 234 cyber incident information security incident notifiable breach', 'REQUIRE_APPROVAL'));
+        // AU CPS 230: AU_CPS230_OP_INCIDENT -> REQUIRE_APPROVAL
+        this.register('behavioralValidator_au_cps230', runBehavioralCheck('au-cps230', 'AU_CPS230_OP_INCIDENT', 'APRA CPS 230 operational incident disruption material service failure', 'REQUIRE_APPROVAL'));
+        // AU SOCI Act: AU_SOCI_CYBER_INCIDENT -> REQUIRE_APPROVAL
+        this.register('behavioralValidator_au_soci_act', runBehavioralCheck('au-soci-act', 'AU_SOCI_CYBER_INCIDENT', 'SOCI critical infrastructure cyber incident CIRMP sector attack', 'REQUIRE_APPROVAL'));
+        // AU ASIC RG 271: AU_RG271_AI_DECISION -> REQUIRE_APPROVAL
+        this.register('behavioralValidator_au_asic_rg_271', runBehavioralCheck('au-asic-rg-271', 'AU_RG271_AI_DECISION', 'RG 271 AI decision IDR internal dispute resolution financial product complaint', 'REQUIRE_APPROVAL'));
+        // AU DDO: AU_DDO_OUT_OF_TARGET -> BLOCK
+        this.register('behavioralValidator_au_asic_rg_274', runBehavioralCheck('au-asic-rg-274', 'AU_DDO_OUT_OF_TARGET', 'DDO target market determination out of target market retail client distribution obligation', 'BLOCK'));
+        // AU AML/CTF: AU_AML_TIPPING_OFF_RISK -> BLOCK
+        this.register('behavioralValidator_au_aml_ctf', runBehavioralCheck('au-aml-ctf', 'AU_AML_TIPPING_OFF_RISK', 'AML tipping off SMR suspicious matter report AUSTRAC tipping-off prohibited', 'BLOCK'));
+        // AU Spam Act: AU_CEM_UNSUBSCRIBED -> BLOCK
+        this.register('behavioralValidator_au_spam_act', runBehavioralCheck('au-spam-act', 'AU_CEM_UNSUBSCRIBED', 'unsubscribed commercial electronic message email spam Australia CEM opt-out', 'BLOCK'));
+        // AU Online Safety: OSA_CSAM -> BLOCK
+        this.register('behavioralValidator_au_online_safety', runBehavioralCheck('au-online-safety', 'OSA_CSAM', 'CSAM child sexual abuse material online safety eSafety Commissioner Australia', 'BLOCK'));
+        // AU AI Ethics Framework: AU_AI_UNDISCLOSED_USE -> WARN
+        // AU_AI_UNDISCLOSED_USE changed to BLOCK (Task 4 fix, 2026-04-25):
+        // Non-deception (G7) is an absolute obligation -- hiding AI involvement from
+        // affected individuals is deceptive by definition. BLOCK is the correct action.
+        this.register('behavioralValidator_au_aiethics_framework', runBehavioralCheck('au-aiethics-framework', 'AU_AI_UNDISCLOSED_USE', 'AI system undisclosed use automated decision no disclosure Australia DISR', 'BLOCK'));
+        // AU Mandatory AI Guardrails: AU_HIGH_RISK_AI_SETTING -> REQUIRE_APPROVAL
+        this.register('behavioralValidator_au_mandatory_ai_guardrails', runBehavioralCheck('au-mandatory-ai-guardrails', 'AU_HIGH_RISK_AI_SETTING', 'high risk AI setting guardrail DISR mandatory Australia critical decision', 'REQUIRE_APPROVAL'));
+        // AU TGA SaMD: TGA_SAMD_ARTG_STATUS -> BLOCK
+        this.register('behavioralValidator_au_tga_saimd', runBehavioralCheck('au-tga-saimd', 'TGA_SAMD_ARTG_STATUS', 'TGA SaMD ARTG unregistered software medical device therapeutic goods Australia', 'BLOCK'));
+        // AU State Health: STATE_HEALTH_TRANSBORDER_TRANSFER -> BLOCK
+        // X1-disaggregation (2026-04-24): umbrella pack removed; NSW HRIPA is now canonical for
+        // transborder block behavior. This registration kept for backward-compat check ID lookup.
+        this.register('behavioralValidator_au_state_health_privacy', runBehavioralCheck('au-nsw-hripa', 'NSW_HEALTH_TRANSBORDER_TRANSFER', 'NSW HRIPA health information transborder transfer outside Australia HPP 10', 'BLOCK'));
+        // -------------------------------------------------------------------------
+        // X1-disaggregation: NSW HRIPA / VIC HRA / ACT HRPAA standalone checks
+        // -------------------------------------------------------------------------
+        // NSW HRIPA HPP 10 transborder block check
+        this.register('au_nsw_hripa_transborder_block_active', (ctx) => {
+            const dcActive = ctx.activeModules.includes('data-classifier');
+            const action = ctx.packConfig?.['data-classifier']?.nswTransborderBlockEnabled;
+            const passed = dcActive && action === true;
+            return {
+                passed,
+                detail: passed
+                    ? 'NSW HRIPA: transborder block active via data-classifier (HPP 10)'
+                    : `dcActive=${dcActive}, nswTransborderBlockEnabled=${action}`,
+            };
+        });
+        // NSW HRIPA HPP 14 research ethics check
+        this.register('au_nsw_hripa_research_ethics_active', configFlag('approval-queue', 'auStateHealthResearchEthicsApprovalRequired', 'NSW HRIPA research ethics gate (HPP 14)'));
+        // NSW HRIPA HPP 11 access 30-day check
+        this.register('au_nsw_hripa_access_30d_active', (ctx) => {
+            const days = ctx.packConfig?.['governance-runtime']?.auStateHealthAccessResponseDays;
+            const passed = typeof days === 'number' && days <= 30;
+            return {
+                passed,
+                detail: passed
+                    ? `NSW HRIPA access response ${days}d (<= 30) configured (HPP 11)`
+                    : `auStateHealthAccessResponseDays=${days} (need <= 30)`,
+            };
+        });
+        // NSW HRIPA HPP 5 collection notice check
+        this.register('au_nsw_hripa_collection_notice_active', configFlag('transparency-injector', 'auStateHealthCollectionNoticeEnabled', 'NSW HRIPA collection notice (HPP 5)'));
+        // NSW HRIPA HPP 10 server location check
+        this.register('au_nsw_hripa_server_location_active', configFlag('supply-chain', 'auStateHealthServerLocationAustralia', 'NSW HRIPA server location confirmation (HPP 10)'));
+        // NSW HRIPA HPP 12 correction 30-day check
+        this.register('au_nsw_hripa_correction_30d_active', (ctx) => {
+            const days = ctx.packConfig?.['governance-runtime']?.auStateHealthCorrectionResponseDays;
+            const passed = typeof days === 'number' && days <= 30;
+            return {
+                passed,
+                detail: passed
+                    ? `NSW HRIPA correction response ${days}d configured (HPP 12)`
+                    : `auStateHealthCorrectionResponseDays=${days} (need <= 30)`,
+            };
+        });
+        // NSW HRIPA Regulation 2017 minor retention check
+        this.register('au_nsw_hripa_minor_retention_active', (ctx) => {
+            const days = ctx.packConfig?.['session-persistence']?.auStateHealthMinorRetentionDays;
+            const passed = typeof days === 'number' && days >= 3650;
+            return {
+                passed,
+                detail: passed
+                    ? `NSW HRIPA minor retention ${days}d (>= 3650) configured`
+                    : `auStateHealthMinorRetentionDays=${days}`,
+            };
+        });
+        // VIC HRA HPP 2.2 research ethics check
+        this.register('au_vic_hra_research_ethics_active', configFlag('approval-queue', 'vicResearchEthicsConfirmationRequired', 'VIC HRA research ethics gate (HPP 2.2)'));
+        // VIC HRA 25-year mental health retention check
+        this.register('au_vic_hra_mental_health_retention_active', (ctx) => {
+            const days = ctx.packConfig?.['session-persistence']?.auStateHealthMentalHealthRetentionDays;
+            const passed = typeof days === 'number' && days >= 9125; // 25 years
+            return {
+                passed,
+                detail: passed
+                    ? `VIC HRA mental health retention ${days}d (>= 9125) configured [CITATION TO VERIFY]`
+                    : `auStateHealthMentalHealthRetentionDays=${days} (need >= 9125 for 25y)`,
+            };
+        });
+        // VIC HRA HPP 6 access 30-day check
+        this.register('au_vic_hra_access_30d_active', (ctx) => {
+            const days = ctx.packConfig?.['governance-runtime']?.auStateHealthAccessResponseDays;
+            const passed = typeof days === 'number' && days <= 30;
+            return {
+                passed,
+                detail: passed
+                    ? `VIC HRA access response ${days}d (<= 30) configured (HPP 6)`
+                    : `auStateHealthAccessResponseDays=${days} (need <= 30)`,
+            };
+        });
+        // VIC HRA HPP 1 collection notice check
+        this.register('au_vic_hra_collection_notice_active', configFlag('transparency-injector', 'auStateHealthCollectionNoticeEnabled', 'VIC HRA collection notice (HPP 1)'));
+        // VIC HRA HPP 7 correction 30-day check
+        this.register('au_vic_hra_correction_30d_active', (ctx) => {
+            const days = ctx.packConfig?.['governance-runtime']?.auStateHealthCorrectionResponseDays;
+            const passed = typeof days === 'number' && days <= 30;
+            return {
+                passed,
+                detail: passed
+                    ? `VIC HRA correction response ${days}d configured (HPP 7)`
+                    : `auStateHealthCorrectionResponseDays=${days} (need <= 30)`,
+            };
+        });
+        // VIC HRA minor retention check
+        this.register('au_vic_hra_minor_retention_active', (ctx) => {
+            const days = ctx.packConfig?.['session-persistence']?.auStateHealthMinorRetentionDays;
+            const passed = typeof days === 'number' && days >= 3650;
+            return {
+                passed,
+                detail: passed
+                    ? `VIC HRA minor retention ${days}d (>= 3650) configured`
+                    : `auStateHealthMinorRetentionDays=${days}`,
+            };
+        });
+        // ACT HRPAA s.7 access 30-day check (CRITICAL -- positive right)
+        this.register('au_act_hrpaa_access_30d_active', (ctx) => {
+            const days = ctx.packConfig?.['governance-runtime']?.auStateHealthAccessResponseDays;
+            const passed = typeof days === 'number' && days <= 30;
+            return {
+                passed,
+                detail: passed
+                    ? `ACT HRPAA s.7 access response ${days}d (<= 30) configured`
+                    : `auStateHealthAccessResponseDays=${days} (need <= 30 for HRPAA s.7)`,
+            };
+        });
+        // ACT HRPAA HPP 5 collection notice check
+        this.register('au_act_hrpaa_collection_notice_active', configFlag('transparency-injector', 'auStateHealthCollectionNoticeEnabled', 'ACT HRPAA collection notice (HPP 5)'));
+        // ACT HRPAA HPP 10 data security check
+        this.register('au_act_hrpaa_data_security_active', (ctx) => {
+            const passed = ctx.activeModules.includes('encryption-layer');
+            return {
+                passed,
+                detail: passed
+                    ? 'ACT HRPAA HPP 10: encryption-layer active'
+                    : 'encryption-layer not active (ACT HRPAA HPP 10 data security)',
+            };
+        });
+        // ACT HRPAA HPP 7 correction 30-day check
+        this.register('au_act_hrpaa_correction_30d_active', (ctx) => {
+            const days = ctx.packConfig?.['governance-runtime']?.auStateHealthCorrectionResponseDays;
+            const passed = typeof days === 'number' && days <= 30;
+            return {
+                passed,
+                detail: passed
+                    ? `ACT HRPAA correction response ${days}d configured (HPP 7)`
+                    : `auStateHealthCorrectionResponseDays=${days} (need <= 30)`,
+            };
+        });
+        // ACT HRPAA 7-year retention check
+        this.register('au_act_hrpaa_retention_7y_active', (ctx) => {
+            const days = ctx.packConfig?.['session-persistence']?.auActHealthRetentionDays
+                ?? ctx.evidence?.auActHealthRetentionDays;
+            // Accept either explicit config or the pack's auditLogRetentionDays floor (2555)
+            const passed = typeof days === 'number' && days >= 2555;
+            return {
+                passed,
+                detail: passed
+                    ? `ACT HRPAA 7y retention ${days}d (>= 2555) configured`
+                    : `auActHealthRetentionDays=${days} (need >= 2555 for 7y)`,
+            };
+        });
+        // Behavioral validators for three disaggregated packs
+        // NSW HRIPA: NSW_HEALTH_TRANSBORDER_TRANSFER -> BLOCK
+        this.register('behavioralValidator_au_nsw_hripa', runBehavioralCheck('au-nsw-hripa', 'NSW_HEALTH_TRANSBORDER_TRANSFER', 'NSW HRIPA transborder transfer health information outside NSW HPP 10', 'BLOCK'));
+        // VIC HRA: VIC_HEALTH_RESEARCH_USE -> REQUIRE_APPROVAL
+        this.register('behavioralValidator_au_vic_hra', runBehavioralCheck('au-vic-hra', 'VIC_HEALTH_RESEARCH_USE', 'VIC HRA research secondary analysis victoria health patient data HPP 2.2', 'REQUIRE_APPROVAL'));
+        // ACT HRPAA: ACT_HEALTH_ACCESS_REQUEST -> REQUIRE_APPROVAL
+        this.register('behavioralValidator_au_act_hrpaa', runBehavioralCheck('au-act-hrpaa', 'ACT_HEALTH_ACCESS_REQUEST', 'ACT HRPAA s.7 health record access request canberra australian capital territory 30 day', 'REQUIRE_APPROVAL'));
+        // -- BATCH-01 FINRA 3110 specific checks (2026-04-25) --
+        this.register('finra_wsp_enforcement_active', configFlag('governance-runtime', 'wspEnforcementRequired', 'FINRA WSP enforcement'));
+        this.register('finra_principal_review_active', configFlag('approval-queue', 'principalReviewForCustomerCommunicationsRequired', 'FINRA principal review for customer communications'));
+        this.register('finra_worm_records_active', configFlag('audit-integrity', 'wormCompliantRequired', 'FINRA WORM-compliant records (Exchange Act Rule 17a-4(f))'));
+        this.register('finra_annual_certification_active', configFlag('attestation-manager', 'annualPrincipalCertificationRequired', 'FINRA Rule 3120 annual principal certification'));
+        this.register('finra_4530_reporting_active', configFlag('event-bus', 'rule4530EventDetectionActive', 'FINRA Rule 4530 event detection and 30-day reporting'));
+        // -- BATCH-01 EU LPP specific checks (2026-04-25) --
+        this.register('eu_lpp_bar_membership_active', configFlag('governance-runtime', 'externalBarMembershipVerificationRequired', 'EU/EEA Bar membership verification (Akzo Nobel)'));
+        this.register('eu_lpp_inhouse_flagging_active', configFlag('governance-runtime', 'inHouseCounselFlaggingRequired', 'In-house counsel flagged as unprotected (Akzo Nobel)'));
+        this.register('eu_lpp_third_country_analysis_active', configFlag('governance-runtime', 'thirdCountryCounselAnalysisRequired', 'Third-country counsel privilege analysis'));
+        // -- BATCH-01 ISO 20022 specific checks (2026-04-25) --
+        this.register('iso20022_schema_validation_active', configFlag('governance-runtime', 'iso20022SchemaValidationRequired', 'ISO 20022 XML schema validation'));
+        this.register('iso20022_mx_format_active', configFlag('governance-runtime', 'mxMessageFormatRequired', 'ISO 20022 MX format (SWIFT CBPR+ mandatory)'));
+        this.register('iso20022_structured_remittance_active', configFlag('governance-runtime', 'structuredRemittanceDataPreservationRequired', 'ISO 20022 structured remittance data preservation'));
+        this.register('iso20022_duplicate_detection_active', configFlag('anomaly-detector', 'paymentDuplicateDetectionActive', 'ISO 20022 duplicate payment detection'));
+        // F-NEW-VERA-PACK-C5-05 (2026-05-03): renamed checks replacing borrowed attestation_active and post_market_monitoring.
+        // BIC/LEI validation is a data-classifier config gate; payment misrouting detection is anomaly-detector presence.
+        this.register('iso20022_bic_lei_validation_active', configFlag('data-classifier', 'bicLeiValidationRequired', 'ISO 20022 BIC/LEI structured agent field validation'));
+        this.register('iso20022_misrouting_detection_active', modulePresence('anomaly-detector'));
+        // -- BATCH-01 EU MDR/IVDR specific checks (2026-04-25) --
+        this.register('eu_mdr_ivdr_qualification_active', configFlag('governance-runtime', 'softwareQualificationAssessmentRequired', 'EU MDR/IVDR software qualification assessment (MDCG 2019-16)'));
+        this.register('eu_mdr_ivdr_eudamed_active', configFlag('attestation-manager', 'eudamedRegistrationRequired', 'EUDAMED registration + UDI management'));
+        this.register('eu_mdr_ivdr_clinical_evaluation_active', configFlag('attestation-manager', 'postMarketSurveillancePlanRequired', 'Clinical/performance evaluation report current'));
+        // Behavioral validators for BATCH-01 packs (2026-04-25)
+        // FINRA 3110: SUPERVISORY_RECORDS -> WARN
+        this.register('behavioralValidator_finra_3110', runBehavioralCheck('finra-3110', 'SUPERVISORY_RECORDS', 'Written supervisory procedure WSP principal review branch office inspection', 'WARN'));
+        // EU LPP: EU_PRIVILEGED -> BLOCK
+        this.register('behavioralValidator_eu_lpp', runBehavioralCheck('eu-lpp', 'EU_PRIVILEGED', 'External counsel avocat legally privileged EU Commission investigation right of defence', 'BLOCK'));
+        // UK GDPR: SPECIAL_CATEGORY -> BLOCK
+        this.register('behavioralValidator_uk_gdpr', runBehavioralCheck('uk-gdpr', 'SPECIAL_CATEGORY', 'Patient is HIV positive religion Muslim biometric facial recognition data', 'BLOCK'));
+        // ISO 20022: PAYMENT_MESSAGE -> WARN
+        this.register('behavioralValidator_iso20022', runBehavioralCheck('iso20022', 'PAYMENT_MESSAGE', 'pacs.008 MX message BizMsgIdr IBAN GB29NWBK60161331926819', 'WARN'));
+        // EU MDR/IVDR: CLINICAL_EVALUATION_DATA -> WARN
+        this.register('behavioralValidator_eu_mdr_ivdr', runBehavioralCheck('eu-mdr-ivdr', 'CLINICAL_EVALUATION_DATA', 'Clinical evaluation report CER clinical investigation PMCF post-market clinical follow-up', 'WARN'));
+        // -- BATCH-02 + BATCH-03 shared check primitives (2026-04-25) --
+        // event_clock_active: verifies event-bus module is present and clock-tracking config active.
+        // Referenced by: reg-e (error-resolution clocks), illinois-aivia (30-day deletion clock),
+        // maryland-hb1202 (consent-withdrawal halt), california-ab2930 (annual/complaint clocks).
+        this.register('event_clock_active', (ctx) => {
+            const hasEventBus = ctx.activeModules.includes('event-bus');
+            if (!hasEventBus) {
+                return { passed: false, detail: 'event-bus module not active; event clock enforcement unavailable' };
+            }
+            return { passed: true, detail: 'event-bus module active; event clock enforcement available' };
+        });
+        // -- BATCH-02 ISO 27701 specific checks (2026-04-25) --
+        // ISO 27701 reuses existing check IDs: gdpr_ropa_active, gdpr_lawful_basis_active,
+        // data_classifier_active, encryption_active, gdpr_dpia_active,
+        // gdpr_purpose_limitation_active, gdpr_breach_72h_active,
+        // subservice_registry_active, rbac_active, transparency_active.
+        // All of those are already registered. No new pack-specific checks needed.
+        // -- BATCH-02 Reg E specific checks (2026-04-25) --
+        // Reg E reuses: transparency_active, event_clock_active, approval_queue_active,
+        // audit_trail_exists, data_classifier_active, governance_active,
+        // rbac_active, subservice_registry_active (all pre-existing).
+        // F-NEW-VERA-PACK-C5-01 (2026-05-03): replaced foreign-pack check strings
+        // finra_wsp_enforcement_active and gdpr_article22_active with Reg-E-namespaced
+        // checks that read from the Reg E moduleConfig keys actually present.
+        this.register('reg_e_prepaid_disclosure_active', configFlag('governance-runtime', 'prepaidDisclosureRequired', 'Reg E prepaid account disclosure (§1005.18(b))'));
+        this.register('reg_e_provisional_credit_active', configFlag('approval-queue', 'provisionalCreditAuthorizationRequired', 'Reg E provisional credit authorization (§1005.11(c)(2))'));
+        // -- BATCH-03 Employment AI specific checks (2026-04-25) --
+        // Illinois AIVIA reuses: transparency_active, gdpr_lawful_basis_active,
+        // event_clock_active, audit_trail_exists, finra_annual_certification_active,
+        // data_classifier_active, subservice_registry_active, rbac_active,
+        // encryption_active, gdpr_article22_active.
+        // Maryland HB 1202 reuses: gdpr_lawful_basis_active, transparency_active,
+        // event_clock_active, audit_trail_exists, data_classifier_active,
+        // subservice_registry_active, rbac_active, encryption_active,
+        // gdpr_article22_active, finra_worm_records_active.
+        // California AB 2930 reuses: gdpr_dpia_active, transparency_active,
+        // gdpr_article22_active, audit_trail_exists, finra_annual_certification_active,
+        // post_market_monitoring, data_classifier_active, subservice_registry_active,
+        // rbac_active, encryption_active, event_clock_active.
+        // Behavioral validators for BATCH-02 packs (2026-04-25)
+        // ISO 27701: PII_CONTROLLER_DATA -> WARN (processing purpose + data subject request signal)
+        this.register('behavioralValidator_iso27701', runBehavioralCheck('iso27701', 'PII_CONTROLLER_DATA', 'processing purpose consent record ROPA record of processing activities lawful basis DPIA data subject request', 'WARN'));
+        // Reg E: ERROR_RESOLUTION_RECORD -> WARN (error resolution / unauthorized transfer signal)
+        this.register('behavioralValidator_reg_e', runBehavioralCheck('reg-e', 'ERROR_RESOLUTION_RECORD', 'error resolution unauthorized transfer EFT dispute Reg E claim 10 business days provisional credit 45 business days', 'WARN'));
+        // Behavioral validators for BATCH-03 packs (2026-04-25)
+        // Illinois AIVIA: VIDEO_INTERVIEW_RECORDING -> WARN
+        this.register('behavioralValidator_illinois_aivia', runBehavioralCheck('illinois-aivia', 'VIDEO_INTERVIEW_RECORDING', 'video interview recorded interview async interview one-way video interview recording', 'WARN'));
+        // Maryland HB 1202: CANDIDATE_CONSENT -> WARN (consent record detection; FR blocking is runtime-enforced)
+        this.register('behavioralValidator_maryland_hb1202', runBehavioralCheck('maryland-hb1202', 'CANDIDATE_CONSENT', 'FR consent facial recognition consent face recognition consent Maryland HB 1202 biometric consent form', 'WARN'));
+        // California AB 2930: AUTOMATED_DECISION_TOOL_OUTPUT -> WARN
+        this.register('behavioralValidator_california_ab2930', runBehavioralCheck('california-ab2930', 'AUTOMATED_DECISION_TOOL_OUTPUT', 'automated decision tool ADT algorithmic decision AI decision recommendation scoring ranking consequential', 'WARN'));
+        // -- BATCH-04 behavioral validators (2026-04-25) --
+        // FCA Consumer Duty: RETAIL_CUSTOMER_DATA -> WARN
+        this.register('behavioralValidator_fca_consumer_duty', runBehavioralCheck('fca-consumer-duty', 'RETAIL_CUSTOMER_DATA', 'retail customer consumer data consumer duty outcome FCA Principle 12 target market', 'WARN'));
+        // CMS Interoperability: PATIENT_CLINICAL_DATA_FHIR -> WARN
+        this.register('behavioralValidator_cms_interoperability', runBehavioralCheck('cms-interoperability', 'PATIENT_CLINICAL_DATA_FHIR', 'fhir r4 patient access api US Core SMART on FHIR clinical data bundle observation', 'WARN'));
+        // Singapore Model AI Gov: AI_DECISION_RECORD -> WARN
+        this.register('behavioralValidator_sg_model_ai_gov', runBehavioralCheck('sg-model-ai-gov', 'AI_DECISION_RECORD', 'ai decision record PDPC decision matrix algorithmic decision singapore automated recommendation', 'WARN'));
+        // -- BATCH-05 behavioral validators (2026-04-25) --
+        // NIS2: INCIDENT_NOTIFICATION_RECORD -> WARN
+        this.register('behavioralValidator_nis2', runBehavioralCheck('nis2', 'INCIDENT_NOTIFICATION_RECORD', 'nis2 incident significant incident CSIRT notification 24 hour early warning 72 hour operational disruption', 'WARN'));
+        // India DPDP: DIGITAL_PERSONAL_DATA_INDIA -> WARN
+        this.register('behavioralValidator_in_dpdp', runBehavioralCheck('in-dpdp', 'DIGITAL_PERSONAL_DATA_INDIA', 'digital personal data india data principal DPDP aadhaar number india personal data', 'WARN'));
+        // -- BATCH-06 first-half specific checks (2026-04-25) --
+        // -- UK AI Framework specific checks --
+        this.register('uk_ai_principle1_safety_gate_active', configFlag('governance-runtime', 'principle1SafetyGateRequired', 'UK AI Framework Principle 1 safety gate'));
+        this.register('uk_ai_principle2_transparency_active', configFlag('transparency-injector', 'principle2TransparencyRequired', 'UK AI Framework Principle 2 transparency'));
+        this.register('uk_ai_principle3_fairness_active', configFlag('bias-monitor', 'principle3FairnessMonitoringRequired', 'UK AI Framework Principle 3 fairness monitoring'));
+        this.register('uk_ai_principle4_accountability_active', configFlag('attestation-manager', 'principleConformanceDocumentationRequired', 'UK AI Framework Principle 4 accountability'));
+        this.register('uk_ai_principle5_contestability_active', configFlag('approval-queue', 'principle5ContestabilityRequired', 'UK AI Framework Principle 5 contestability'));
+        // -- FCA Operational Resilience specific checks --
+        this.register('fca_or_ibs_identification_active', configFlag('governance-runtime', 'ibsDisruptionDetectionRequired', 'FCA Op Resilience IBS disruption detection'));
+        this.register('fca_or_impact_tolerance_active', configFlag('attestation-manager', 'ibsImpactToleranceDocumentationRequired', 'FCA Op Resilience impact tolerance documentation'));
+        this.register('fca_or_board_attestation_active', configFlag('attestation-manager', 'boardAnnualAttestationRequired', 'FCA Op Resilience board annual attestation'));
+        this.register('fca_or_third_party_active', configFlag('supply-chain', 'thirdPartyDependencyMappingRequired', 'FCA Op Resilience third-party dependency mapping'));
+        this.register('fca_or_scenario_testing_active', configFlag('attestation-manager', 'scenarioTestRetentionYears', 'FCA Op Resilience scenario test retention'));
+        // -- German BDSG specific checks --
+        this.register('de_bdsg_works_council_gate_active', configFlag('approval-queue', 'worksCouncilConsultationGateRequired', 'BDSG BetrVG §87(1) No.6 works council gate'));
+        this.register('de_bdsg_purpose_limitation_active', configFlag('governance-runtime', 'bdsg26PurposeLimitationRequired', 'BDSG §26 employee data purpose limitation'));
+        this.register('de_bdsg_dpo_designation_active', configFlag('governance-runtime', 'germanDpoDesignationCheckRequired', 'BDSG §38 DPO designation check'));
+        this.register('de_bdsg_video_surveillance_active', configFlag('transparency-injector', 'aiUseDisclosureRequired', 'BDSG §4 video surveillance disclosure'));
+        this.register('de_bdsg_special_category_active', (ctx) => {
+            const action = ctx.packConfig?.['data-classifier']?.specialCategoryEmployeeDataAction;
+            const passed = action === 'BLOCK';
+            return {
+                passed,
+                detail: passed
+                    ? 'BDSG §26(3) special category employee data action = BLOCK configured'
+                    : `specialCategoryEmployeeDataAction=${action} (expected BLOCK)`,
+            };
+        });
+        // -- Texas HB4 specific checks --
+        this.register('tx_hb4_sensitive_data_opt_in_active', configFlag('governance-runtime', 'sensitiveDataOptInRequired', 'Texas TDPSA sensitive data opt-in gate'));
+        this.register('tx_hb4_biometric_consent_active', configFlag('governance-runtime', 'biometricAdditionalConsentRequired', 'Texas TDPSA biometric additional consent'));
+        this.register('tx_hb4_child_data_gate_active', configFlag('governance-runtime', 'childDataParentalConsentRequired', 'Texas TDPSA child data parental consent'));
+        this.register('tx_hb4_dpia_active', configFlag('approval-queue', 'dpiaReviewRequired', 'Texas TDPSA DPIA review required'));
+        this.register('tx_hb4_privacy_notice_active', configFlag('transparency-injector', 'tdpsaPrivacyNoticeRequired', 'Texas TDPSA privacy notice'));
+        this.register('tx_hb4_opt_out_active', configFlag('session-persistence', 'optOutPersistenceRequired', 'Texas TDPSA opt-out persistence'));
+        // -- Utah AI Policy specific checks --
+        this.register('utah_ai_disclosure_when_asked_active', configFlag('transparency-injector', 'generativeAiDisclosureWhenAskedRequired', 'Utah AI Policy Act disclosure when asked'));
+        this.register('utah_ai_regulated_occupation_disclosure_active', configFlag('transparency-injector', 'regulatedOccupationAffirmativeDisclosureRequired', 'Utah AI Policy Act regulated occupation affirmative disclosure'));
+        this.register('utah_ai_occupation_classification_active', configFlag('attestation-manager', 'regulatedOccupationRegisterRequired', 'Utah AI Policy Act occupation classification register'));
+        this.register('utah_ai_liability_attribution_active', configFlag('governance-runtime', 'liabilityAttributionTrackingRequired', 'Utah AI Policy Act liability attribution tracking'));
+        this.register('utah_ai_learning_lab_active', configFlag('attestation-manager', 'learningLabParticipationRecordsRequired', 'Utah AI Policy Act Learning Lab records'));
+        // -- BATCH-06 behavioral validators (2026-04-25) --
+        // UK AI Framework: PRINCIPLE_CONFORMANCE_EVIDENCE -> WARN
+        this.register('behavioralValidator_uk_ai_framework', runBehavioralCheck('uk-ai-framework', 'PRINCIPLE_CONFORMANCE_EVIDENCE', 'uk ai framework principle conformance accountability governance safety DSIT cross-sectoral principle evidence', 'WARN'));
+        // FCA Op Resilience: IMPACT_TOLERANCE_RECORD -> WARN
+        this.register('behavioralValidator_fca_op_resilience', runBehavioralCheck('fca-op-resilience', 'IMPACT_TOLERANCE_RECORD', 'impact tolerance FCA PS21/3 important business service maximum tolerable disruption operational resilience', 'WARN'));
+        // German BDSG: WORKS_COUNCIL_CONSULTATION_RECORD -> WARN
+        this.register('behavioralValidator_de_bdsg', runBehavioralCheck('de-bdsg', 'WORKS_COUNCIL_CONSULTATION_RECORD', 'betriebsrat BetrVG works council codetermination Betriebsvereinbarung employee monitoring AI BDSG', 'WARN'));
+        // Texas HB4: SENSITIVE_PERSONAL_DATA_TEXAS -> BLOCK
+        this.register('behavioralValidator_texas_hb4', runBehavioralCheck('texas-hb4', 'SENSITIVE_PERSONAL_DATA_TEXAS', 'sensitive data texas TDPSA HB4 health condition immigration status religious beliefs texas resident', 'BLOCK'));
+        // Utah AI Policy: REGULATED_OCCUPATION_AI_USE -> WARN
+        this.register('behavioralValidator_utah_ai_policy', runBehavioralCheck('utah-ai-policy', 'REGULATED_OCCUPATION_AI_USE', 'utah regulated occupation ai disclosure medical legal mental health utah SB149 licensed professional affirmative disclosure', 'WARN'));
+        // -- BATCH-06b behavioral validators (2026-04-25): Tennessee ELVIS + JP APPI + KR PIPA + NZ Privacy --
+        // Tennessee ELVIS Act: VOICE_BIOMETRIC_RECORD -> BLOCK (no consent = blocked)
+        this.register('behavioralValidator_tennessee_elvis', runBehavioralCheck('tennessee-elvis', 'VOICE_BIOMETRIC_RECORD', 'voice clone voice cloning AI voice biometric Tennessee ELVIS Act TCA §47-25 voice synthesis synthetic voice deepfake voice', 'BLOCK'));
+        // Japan APPI: SPECIAL_CARE_REQUIRED_PERSONAL_INFORMATION -> BLOCK
+        this.register('behavioralValidator_jp_appi', runBehavioralCheck('jp-appi', 'SPECIAL_CARE_REQUIRED_PERSONAL_INFORMATION', 'yohairyo special care required personal information japan APPI sensitive data medical history criminal record race creed disability', 'BLOCK'));
+        // South Korea PIPA: SENSITIVE_INFORMATION_KOREA -> BLOCK
+        this.register('behavioralValidator_kr_pipa', runBehavioralCheck('kr-pipa', 'SENSITIVE_INFORMATION_KOREA', 'mingam jeongbo sensitive information korea PIPA ideology belief union membership health genetic criminal biometric template', 'BLOCK'));
+        // New Zealand Privacy Act: CROSS_BORDER_DISCLOSURE_NZ -> WARN (IPP 13 comparable safeguards)
+        this.register('behavioralValidator_nz_privacy', runBehavioralCheck('nz-privacy', 'CROSS_BORDER_DISCLOSURE_NZ', 'IPP 13 transborder data flow new zealand NZ cross-border disclosure comparable safeguards privacy act 2020 overseas transfer', 'WARN'));
+        // -- Tennessee ELVIS specific checks --
+        this.register('tennessee_elvis_voice_consent_gate_active', configFlag('governance-runtime', 'voiceCloningConsentGateRequired', 'Tennessee ELVIS Act voice consent hard gate'));
+        this.register('tennessee_elvis_likeness_consent_gate_active', configFlag('governance-runtime', 'likenessCloningConsentGateRequired', 'Tennessee ELVIS Act likeness consent hard gate'));
+        this.register('tennessee_elvis_consent_separability_active', configFlag('attestation-manager', 'consentSeparabilityDocumentationRequired', 'Tennessee ELVIS Act consent separability documentation'));
+        this.register('tennessee_elvis_ai_disclosure_active', configFlag('transparency-injector', 'aiGeneratedContentDisclosureRequired', 'Tennessee ELVIS Act AI-generated content disclosure'));
+        this.register('tennessee_elvis_statutory_damages_active', configFlag('governance-runtime', 'statutoryDamagesTrackingRequired', 'Tennessee ELVIS Act statutory damages tracking'));
+        // -- Japan APPI specific checks --
+        this.register('jp_appi_purpose_gate_active', configFlag('governance-runtime', 'purposeSpecificationGateRequired', 'Japan APPI purpose specification gate'));
+        this.register('jp_appi_special_care_opt_in_active', configFlag('governance-runtime', 'specialCareRequiredOptInGateRequired', 'Japan APPI special care-required data opt-in gate'));
+        this.register('jp_appi_cross_border_adequacy_active', configFlag('governance-runtime', 'crossBorderTransferAdequacyCheckRequired', 'Japan APPI cross-border transfer adequacy check'));
+        this.register('jp_appi_third_party_transfer_records_active', configFlag('attestation-manager', 'thirdPartyTransferRecordLifecycleRequired', 'Japan APPI third-party transfer records lifecycle'));
+        this.register('jp_appi_purpose_disclosure_active', configFlag('transparency-injector', 'purposeOfUsePublicDisclosureRequired', 'Japan APPI purpose of use public disclosure'));
+        // -- South Korea PIPA specific checks --
+        this.register('kr_pipa_sensitive_separate_consent_active', configFlag('governance-runtime', 'sensitiveInformationSeparateConsentGateRequired', 'Korea PIPA sensitive information separate consent gate'));
+        this.register('kr_pipa_rrn_statutory_basis_active', configFlag('governance-runtime', 'rrnStatutoryBasisGateRequired', 'Korea PIPA RRN statutory basis hard gate'));
+        this.register('kr_pipa_automated_decision_objection_active', configFlag('governance-runtime', 'automatedDecisionObjectionWorkflowRequired', 'Korea PIPA 2023 automated decision objection workflow'));
+        this.register('kr_pipa_cross_border_gate_active', configFlag('approval-queue', 'crossBorderTransferGateRequired', 'Korea PIPA cross-border transfer gate'));
+        this.register('kr_pipa_cpo_designation_active', configFlag('attestation-manager', 'cpoDesignationRequired', 'Korea PIPA CPO mandatory designation'));
+        // F-NEW-VERA-PACK-C3-01 (2026-05-03): dedicated portability check replacing borrowed bias_monitor_active.
+        // PIPA Art. 35-2 (2023 amendment) data portability requires session-persistence to track portability
+        // request state across the statutory response window, and approval-queue for human confirmation
+        // before exporting personal information to a third party on behalf of the data subject.
+        this.register('kr_pipa_portability_active', (ctx) => {
+            const sessionPersistenceActive = ctx.activeModules.includes('session-persistence');
+            const approvalQueueActive = ctx.activeModules.includes('approval-queue');
+            const passed = sessionPersistenceActive && approvalQueueActive;
+            return {
+                passed,
+                detail: passed
+                    ? 'PIPA Art. 35-2 portability workflow active: session-persistence + approval-queue both present'
+                    : `PIPA Art. 35-2 portability workflow incomplete: session-persistence=${sessionPersistenceActive}, approval-queue=${approvalQueueActive}`,
+            };
+        });
+        // -- New Zealand Privacy Act 2020 specific checks --
+        this.register('nz_privacy_ipp13_comparable_safeguards_active', configFlag('governance-runtime', 'ipp13ComparableSafeguardsCheckRequired', 'NZ Privacy Act IPP 13 comparable safeguards check'));
+        this.register('nz_privacy_extra_territorial_active', configFlag('governance-runtime', 'extraTerritorialNzFlagRequired', 'NZ Privacy Act extra-territorial applicability flag'));
+        // F-NEW-VERA-PACK-C3-02: corrected from nprsBranchNotificationOpcRequired (typo);
+        // NPBR = Notifiable Privacy Breach Reporting per NZ Privacy Act 2020 s.114.
+        this.register('nz_privacy_npbr_active', configFlag('event-bus', 'npbrNotificationOpcRequired', 'NZ Privacy Act NPBR OPC notification'));
+        this.register('nz_privacy_ipp3_collection_notice_active', configFlag('transparency-injector', 'ipp3CollectionNoticeRequired', 'NZ Privacy Act IPP 3 collection notice'));
+        this.register('nz_privacy_agency_compliance_active', configFlag('attestation-manager', 'privacyManagementFrameworkRequired', 'NZ Privacy Act Privacy Management Framework'));
+        // -- FDA 21 CFR Part 56 (IRB Regulations) specific checks --
+        // 56.107(a): >= 5 members, varying backgrounds, scientific + nonscientific + unaffiliated
+        this.register('fda_irb_roster_composition_active', (ctx) => {
+            const am = ctx.packConfig?.['attestation-manager'];
+            const minCount = am?.minimumIrbMemberCount;
+            const rosterAttested = am?.irbRosterCompositionAttestationRequired === true;
+            const memberRecords = am?.memberQualificationRecordsRequired === true;
+            const affiliationDeclared = am?.affiliationDeclarationRequired === true;
+            const passed = rosterAttested && memberRecords && affiliationDeclared &&
+                typeof minCount === 'number' && minCount >= 5;
+            return {
+                passed,
+                detail: passed
+                    ? `IRB roster composition configured: >= ${minCount} members, qualification records required, affiliation declarations required (21 CFR 56.107(a))`
+                    : `IRB roster configuration incomplete: rosterAttested=${rosterAttested}, memberRecords=${memberRecords}, affiliationDeclared=${affiliationDeclared}, minimumIrbMemberCount=${minCount} (need >= 5)`,
+            };
+        });
+        // 56.108(c): majority quorum including at least one nonscientific member
+        this.register('fda_irb_quorum_active', (ctx) => {
+            const gr = ctx.packConfig?.['governance-runtime'];
+            const majorityRequired = gr?.irbQuorumMajorityRequired === true;
+            const nonscientificRequired = gr?.irbQuorumNonscientificMemberRequired === true;
+            const passed = majorityRequired && nonscientificRequired;
+            return {
+                passed,
+                detail: passed
+                    ? 'IRB quorum rules configured: majority presence required + nonscientific member required (21 CFR 56.108(c))'
+                    : `IRB quorum configuration incomplete: majorityRequired=${majorityRequired}, nonscientificMemberRequired=${nonscientificRequired}`,
+            };
+        });
+        // 56.107(e): conflict-of-interest recusal enforcement
+        this.register('fda_irb_conflict_of_interest_active', (ctx) => {
+            const gr = ctx.packConfig?.['governance-runtime'];
+            const aq = ctx.packConfig?.['approval-queue'];
+            const runtimeRecusal = gr?.conflictOfInterestRecusalActive === true;
+            const queueRecusal = aq?.conflictOfInterestRecusalEnforced === true;
+            const am = ctx.packConfig?.['attestation-manager'];
+            const coiAcknowledgment = am?.conflictOfInterestAcknowledgmentRequired === true;
+            const passed = runtimeRecusal && queueRecusal && coiAcknowledgment;
+            return {
+                passed,
+                detail: passed
+                    ? 'Conflict-of-interest recusal enforced at governance-runtime, approval-queue, and attestation-manager (21 CFR 56.107(e))'
+                    : `COI recusal incomplete: runtime=${runtimeRecusal}, queue=${queueRecusal}, coiAcknowledgment=${coiAcknowledgment}`,
+            };
+        });
+        // 56.109(f): continuing review not less than once per year
+        this.register('fda_irb_continuing_review_active', (ctx) => {
+            const gr = ctx.packConfig?.['governance-runtime'];
+            const maxInterval = gr?.continuingReviewMaxIntervalDays;
+            const aq = ctx.packConfig?.['approval-queue'];
+            const renewalQueue = aq?.continuingReviewRenewalQueueEnabled === true;
+            const am = ctx.packConfig?.['attestation-manager'];
+            const approvalOnFile = am?.continuingReviewApprovalOnFileRequired === true;
+            const passed = renewalQueue && approvalOnFile &&
+                typeof maxInterval === 'number' && maxInterval <= 365;
+            return {
+                passed,
+                detail: passed
+                    ? `Continuing review configured: max interval ${maxInterval} days (<= 365), renewal queue enabled, approval-on-file required (21 CFR 56.109(f))`
+                    : `Continuing review configuration incomplete: renewalQueue=${renewalQueue}, approvalOnFile=${approvalOnFile}, maxIntervalDays=${maxInterval} (need <= 365)`,
+            };
+        });
+        // 56.110: expedited review only for minimal-risk studies on FDA's expedited list
+        this.register('fda_irb_expedited_review_criteria_active', (ctx) => {
+            const aq = ctx.packConfig?.['approval-queue'];
+            const routingConfigured = aq?.expeditedVsFullBoardRoutingRequired === true;
+            const am = ctx.packConfig?.['attestation-manager'];
+            const eligibilityDoc = am?.expeditedReviewEligibilityDocumentationRequired === true;
+            const passed = routingConfigured && eligibilityDoc;
+            return {
+                passed,
+                detail: passed
+                    ? 'Expedited review criteria enforced: routing logic configured and eligibility documentation required (21 CFR 56.110)'
+                    : `Expedited review configuration incomplete: routingConfigured=${routingConfigured}, eligibilityDocumentation=${eligibilityDoc}`,
+            };
+        });
+        // 56.115(b): IRB records retained >= 3 years after completion
+        this.register('fda_irb_records_retention_active', (ctx) => {
+            const retentionDays = ctx.evidence?.auditRetentionDays;
+            // 1095 days = 3 years per 21 CFR 56.115(b)
+            const n = typeof retentionDays === 'number' ? retentionDays : 0;
+            const passed = n >= 1095;
+            return {
+                passed,
+                detail: passed
+                    ? `IRB records retention ${n} days >= 1095 (3 years) per 21 CFR 56.115(b)`
+                    : `IRB records retention ${n} days < 1095 (3-year minimum per 21 CFR 56.115(b))`,
+            };
+        });
+        // 56.115(a)(2): minutes must record attendance, votes, basis for required modifications
+        this.register('fda_irb_meeting_minutes_active', (ctx) => {
+            const ac = ctx.packConfig?.['audit-chain'];
+            const minutesIntegrity = ac?.irbMeetingMinutesIntegrityRequired === true;
+            const voteTally = ac?.voteTallyTamperDetectionRequired === true;
+            const protocolChain = ac?.protocolApprovalChainRequired === true;
+            const passed = minutesIntegrity && voteTally && protocolChain;
+            return {
+                passed,
+                detail: passed
+                    ? 'IRB meeting minutes integrity enforced: tamper-evident minutes, vote tallies, protocol approval chain (21 CFR 56.115(a)(2))'
+                    : `Meeting minutes configuration incomplete: minutesIntegrity=${minutesIntegrity}, voteTally=${voteTally}, protocolChain=${protocolChain}`,
+            };
+        });
+        // 56.108(b): prompt reporting of unanticipated problems, serious/continuing noncompliance, suspension/termination
+        this.register('fda_irb_prompt_reporting_active', (ctx) => {
+            const eb = ctx.packConfig?.['event-bus'];
+            const unanticipatedReporting = eb?.unanticipatedProblemReportingActive === true;
+            const suspensionNotification = eb?.suspensionTerminationNotificationActive === true;
+            const noncomplianceEscalation = eb?.continuingNoncomplianceEscalationActive === true;
+            const saeDeadline = eb?.saePromptReportingDeadlineHours;
+            const passed = unanticipatedReporting && suspensionNotification && noncomplianceEscalation &&
+                typeof saeDeadline === 'number' && saeDeadline <= 24;
+            return {
+                passed,
+                detail: passed
+                    ? `Prompt reporting configured: unanticipated problems, suspension/termination, noncompliance escalation, SAE clock ${saeDeadline}h (<= 24h) (21 CFR 56.108(b))`
+                    : `Prompt reporting configuration incomplete: unanticipatedReporting=${unanticipatedReporting}, suspensionNotification=${suspensionNotification}, noncomplianceEscalation=${noncomplianceEscalation}, saeDeadlineHours=${saeDeadline} (need <= 24)`,
+            };
+        });
+        // ---------------------------------------------------------------------------
+        // NCSC Guidelines for Secure AI System Development (2024) checks
+        // TIER 10-UK Wave 2 | pack id: ncsc-ai-security
+        // Four-phase coverage: secure design / development / deployment / operation.
+        // ---------------------------------------------------------------------------
+        // Phase 1 — secure design: threat model present and approved
+        this.register('behavioralValidator_ncsc_secure_design_threat_model_present', (ctx) => {
+            const am = ctx.packConfig?.['attestation-manager'];
+            const modelProvenanceAttestation = am?.modelProvenanceAttestationRequired === true;
+            const retentionYears = am?.retentionYearsForEvidence;
+            const passed = modelProvenanceAttestation && typeof retentionYears === 'number' && retentionYears >= 7;
+            return {
+                passed,
+                detail: passed
+                    ? 'NCSC Phase 1: attestation-manager configured for AI threat model tracking with 7-year retention (NCSC Guidelines for secure AI system development 2024)'
+                    : `NCSC Phase 1 secure-design gate incomplete: modelProvenanceAttestation=${modelProvenanceAttestation}, retentionYears=${retentionYears} (need >= 7)`,
+            };
+        });
+        // Phase 2 — secure development: dependency integrity active
+        this.register('behavioralValidator_ncsc_secure_development_dependency_integrity', (ctx) => {
+            const gr = ctx.packConfig?.['governance-runtime'];
+            const designGate = gr?.ncscAiSecureDesignGateRequired === true;
+            const blockUnauthorised = gr?.blockUnauthorisedModelWeightChanges === true;
+            const passed = designGate && blockUnauthorised;
+            return {
+                passed,
+                detail: passed
+                    ? 'NCSC Phase 2: governance-runtime blocks unauthorised model-weight changes and enforces secure-design gate (NCSC Guidelines for secure AI system development 2024)'
+                    : `NCSC Phase 2 dependency-integrity gate incomplete: designGate=${designGate}, blockUnauthorisedModelWeightChanges=${blockUnauthorised}`,
+            };
+        });
+        // Phase 3 — secure deployment: deployment record present
+        this.register('behavioralValidator_ncsc_secure_deployment_record_present', (ctx) => {
+            const aq = ctx.packConfig?.['approval-queue'];
+            const modelSwapApproval = aq?.modelSwapApprovalRequired === true;
+            const reviewTier = aq?.reviewTier;
+            const deploymentApproval = aq?.deploymentApprovalRequired === true;
+            const passed = modelSwapApproval && reviewTier === 'T2' && deploymentApproval;
+            return {
+                passed,
+                detail: passed
+                    ? 'NCSC Phase 3: approval-queue configured with T2 model-swap gate and deployment-approval requirement (NCSC Guidelines for secure AI system development 2024)'
+                    : `NCSC Phase 3 deployment-record gate incomplete: modelSwapApproval=${modelSwapApproval}, reviewTier=${reviewTier} (need T2), deploymentApproval=${deploymentApproval}`,
+            };
+        });
+        // Phase 4 — secure operation: monitoring active for adversarial events
+        this.register('behavioralValidator_ncsc_secure_operation_monitoring_active', (ctx) => {
+            const eb = ctx.packConfig?.['event-bus'];
+            const adversarialInputDetection = eb?.adversarialInputDetectionRequired === true;
+            const promptInjectionAlerting = eb?.promptInjectionAlertingRequired === true;
+            const aiIncidentRouting = eb?.aiSecurityIncidentRoutingRequired === true;
+            const passed = adversarialInputDetection && promptInjectionAlerting && aiIncidentRouting;
+            return {
+                passed,
+                detail: passed
+                    ? 'NCSC Phase 4: event-bus configured for adversarial-input detection, prompt-injection alerting, and AI-specific incident routing (NCSC Guidelines for secure AI system development 2024)'
+                    : `NCSC Phase 4 monitoring incomplete: adversarialInputDetection=${adversarialInputDetection}, promptInjectionAlerting=${promptInjectionAlerting}, aiIncidentRouting=${aiIncidentRouting}`,
+            };
+        });
+        // Phase 4 — incident response: AI-specific incident path active
+        this.register('behavioralValidator_ncsc_incident_response_ai_path_active', (ctx) => {
+            const eb = ctx.packConfig?.['event-bus'];
+            const aiIncidentRouting = eb?.aiSecurityIncidentRoutingRequired === true;
+            const dataPoisoningSignal = eb?.dataPoisoningSignalRequired === true;
+            const passed = aiIncidentRouting && dataPoisoningSignal;
+            return {
+                passed,
+                detail: passed
+                    ? 'NCSC Phase 4: AI-specific incident response path active — data poisoning signal and AI incident routing configured (NCSC Guidelines for secure AI system development 2024)'
+                    : `NCSC Phase 4 AI incident-response path incomplete: aiIncidentRouting=${aiIncidentRouting}, dataPoisoningSignal=${dataPoisoningSignal}`,
+            };
+        });
+        // ---------------------------------------------------------------------------
+        // UK Equality Act 2010 + ICO-EHRC Joint AI Bias Guidance checks
+        // TIER 10-UK Wave 2 | pack id: uk-equality-act-ai-bias
+        // Equality Act 2010 ss.4-12, 13, 19, 149; ICO-EHRC joint guidance (2024)
+        // ---------------------------------------------------------------------------
+        // uk_equality_ai_bias_disparate_impact_gate:
+        // Verifies bias-monitor is active AND the 80% (4/5ths) disparate-impact
+        // threshold is configured. Equality Act 2010 s.19 indirect discrimination.
+        this.register('uk_equality_ai_bias_disparate_impact_gate', (ctx) => {
+            const bm = ctx.packConfig?.['bias-monitor'];
+            const biasMonitorActive = ctx.activeModules.includes('bias-monitor');
+            const thresholdSet = typeof bm?.disparateImpactThresholdPercent === 'number' &&
+                bm.disparateImpactThresholdPercent >= 80;
+            const blockEnabled = bm?.blockedBelowThreshold === true;
+            const passed = biasMonitorActive && thresholdSet && blockEnabled;
+            return {
+                passed,
+                detail: passed
+                    ? 'UK Equality Act AI bias disparate-impact gate active: bias-monitor present, 80% (4/5ths) threshold configured, BLOCK on sub-threshold decisions enabled (Equality Act 2010 s.19; ICO-EHRC joint guidance 2024)'
+                    : `Disparate-impact gate incomplete: biasMonitorActive=${biasMonitorActive}, thresholdSet=${thresholdSet} (need disparateImpactThresholdPercent >= 80), blockEnabled=${blockEnabled} — required: Equality Act 2010 s.19 indirect discrimination gate`,
+            };
+        });
+        // uk_equality_ai_bias_eia_public_sector_gate:
+        // Verifies attestation-manager has EIA-before-deployment required and gated.
+        // Public Sector Equality Duty (s.149): public bodies must complete EIA before
+        // deploying AI systems. ICO-EHRC joint guidance (2024).
+        this.register('uk_equality_ai_bias_eia_public_sector_gate', (ctx) => {
+            const am = ctx.packConfig?.['attestation-manager'];
+            const eiaRequired = am?.eiaBeforeDeploymentRequired === true;
+            const eiaGated = am?.eiaApprovalGated === true;
+            const biasAssessmentDocumented = am?.aisBiasRiskAssessmentDocumented === true;
+            const passed = eiaRequired && eiaGated && biasAssessmentDocumented;
+            return {
+                passed,
+                detail: passed
+                    ? 'UK Equality Act 2010 s.149 PSED EIA gate active: EIA required before deployment, EIA approval gated, AI bias risk assessment documented (ICO-EHRC joint guidance 2024)'
+                    : `EIA public-sector gate incomplete: eiaRequired=${eiaRequired}, eiaGated=${eiaGated}, biasAssessmentDocumented=${biasAssessmentDocumented} — required: Equality Act 2010 s.149 Public Sector Equality Duty + ICO-EHRC joint guidance 2024`,
+            };
+        });
+        // ---------------------------------------------------------------------------
+        // DO-178C avionics software life cycle checks (RTCA DO-178C / EUROCAE ED-12C)
+        // ---------------------------------------------------------------------------
+        this.register('do178c_software_level_assigned', configFlag('governance-runtime', 'softwareLevelTrackingRequired', 'software level (A/B/C/D/E) tracking active'));
+        this.register('do178c_psac_active', configFlag('governance-runtime', 'do178cLevelAProcessRequired', 'DO-178C Level A process (PSAC scope)'));
+        this.register('do178c_development_plan_active', configFlag('governance-runtime', 'do178cLevelBProcessRequired', 'DO-178C Level B development process (SDP scope)'));
+        this.register('do178c_verification_plan_active', configFlag('governance-runtime', 'do178cLevelCProcessRequired', 'DO-178C Level C verification process (SVP scope)'));
+        this.register('do178c_requirements_data_active', configFlag('governance-runtime', 'do178cLevelDProcessRequired', 'DO-178C Level D requirements process'));
+        this.register('do178c_design_description_active', configFlag('governance-runtime', 'decisionCoverageRequiredForLevelB', 'design description with decision-coverage gating'));
+        this.register('do178c_mc_dc_coverage_level_a_active', configFlag('governance-runtime', 'mcDcCoverageRequiredForLevelA', 'MC/DC coverage required for Level A'));
+        this.register('do178c_decision_coverage_level_b_active', configFlag('attestation-manager', 'mcDcCoverageAttestationRequiredForLevelA', 'decision/MC-DC coverage attestation'));
+        this.register('do178c_tool_qualification_active', configFlag('supply-chain', 'do330ToolQualificationLevelTrackingRequired', 'DO-330 tool qualification level (TQL) tracking'));
+        this.register('do178c_config_management_active', configFlag('supply-chain', 'toolQualificationInventoryRequired', 'tool qualification inventory + configuration management'));
+        this.register('do178c_quality_assurance_active', configFlag('attestation-manager', 'conformityReviewSignOffRequired', 'conformity review sign-off (SQA)'));
+        this.register('do178c_problem_reports_active', configFlag('anomaly-detector', 'softwareAnomalySignalDetectionActive', 'software anomaly signal detection (problem reports)'));
+        this.register('do178c_accomplishment_summary_active', configFlag('attestation-manager', 'softwareAccomplishmentSummaryAttestationRequired', 'Software Accomplishment Summary attestation'));
+        this.register('behavioralValidator_do178c_level_a_unverified_change', configFlag('anomaly-detector', 'levelAAnomalyImmediateEscalationRequired', 'Level A unverified change immediate escalation'));
+        this.register('behavioralValidator_do178c_mc_dc_coverage_below_threshold', configFlag('approval-queue', 'derReviewRequiredForLevelAB', 'Level A MC/DC coverage shortfall DER+SQA review'));
+        // ---------------------------------------------------------------------------
+        // FDA 21 CFR Part 820 (QSR / QMSR) checks (2026-05-09)
+        // ---------------------------------------------------------------------------
+        // § 820.30(j): Design History File controls
+        this.register('fda_820_dhf_controls_active', (ctx) => {
+            const ai = ctx.packConfig?.['audit-integrity'];
+            const dhfChain = ai?.dhfAuditChainRequired === true;
+            const gr = ctx.packConfig?.['governance-runtime'];
+            const docCtrl = gr?.documentControlAuthorizationRequired === true;
+            const passed = dhfChain && docCtrl;
+            return {
+                passed,
+                detail: passed
+                    ? 'DHF controls active: audit-chain integrity + document-control authorisation (21 CFR 820.30(j))'
+                    : `DHF controls incomplete: dhfAuditChain=${dhfChain}, documentControlAuth=${docCtrl}`,
+            };
+        });
+        // § 820.181: Device Master Record controls
+        this.register('fda_820_dmr_controls_active', (ctx) => {
+            const ai = ctx.packConfig?.['audit-integrity'];
+            const dmrChain = ai?.dmrAuditChainRequired === true;
+            const sc = ctx.packConfig?.['supply-chain'];
+            const traceability = sc?.componentTraceabilityRequired === true;
+            const passed = dmrChain && traceability;
+            return {
+                passed,
+                detail: passed
+                    ? 'DMR controls active: audit-chain integrity + component traceability (21 CFR 820.181)'
+                    : `DMR controls incomplete: dmrAuditChain=${dmrChain}, traceability=${traceability}`,
+            };
+        });
+        // § 820.184: Device History Record controls
+        this.register('fda_820_dhr_controls_active', (ctx) => {
+            const ai = ctx.packConfig?.['audit-integrity'];
+            const dhrChain = ai?.dhrAuditChainRequired === true;
+            const sc = ctx.packConfig?.['supply-chain'];
+            const incoming = sc?.incomingAcceptanceRecordRequired === true;
+            const passed = dhrChain && incoming;
+            return {
+                passed,
+                detail: passed
+                    ? 'DHR controls active: audit-chain integrity + incoming acceptance records (21 CFR 820.184)'
+                    : `DHR controls incomplete: dhrAuditChain=${dhrChain}, incomingAcceptance=${incoming}`,
+            };
+        });
+        // § 820.100: CAPA system
+        this.register('fda_820_capa_active', (ctx) => {
+            const gr = ctx.packConfig?.['governance-runtime'];
+            const capaWorkflow = gr?.capaWorkflowRequired === true;
+            const aq = ctx.packConfig?.['approval-queue'];
+            const capaReview = aq?.capaInitiationReviewRequired === true;
+            const ai = ctx.packConfig?.['audit-integrity'];
+            const capaAudit = ai?.capaAuditTrailRequired === true;
+            const passed = capaWorkflow && capaReview && capaAudit;
+            return {
+                passed,
+                detail: passed
+                    ? 'CAPA system active: workflow + human-review gate + audit trail (21 CFR 820.100)'
+                    : `CAPA incomplete: workflow=${capaWorkflow}, reviewGate=${capaReview}, auditTrail=${capaAudit}`,
+            };
+        });
+        // 21 CFR Part 803: MDR 30-day / 5-day clocks
+        this.register('fda_820_mdr_clock_active', (ctx) => {
+            const eb = ctx.packConfig?.['event-bus'];
+            const thirtyDay = eb?.mdrThirtyDayClockActive === true;
+            const fiveDay = eb?.mdrFiveDayCorrectiveActionClockActive === true;
+            const aq = ctx.packConfig?.['approval-queue'];
+            const mdrAuth = aq?.mdrFilingAuthorizationRequired === true;
+            const passed = thirtyDay && fiveDay && mdrAuth;
+            return {
+                passed,
+                detail: passed
+                    ? 'MDR clocks active: 30-day death/serious-injury clock, 5-day corrective-action clock, MDR filing authorisation (21 CFR Part 803)'
+                    : `MDR clock incomplete: thirtyDay=${thirtyDay}, fiveDay=${fiveDay}, filingAuth=${mdrAuth}`,
+            };
+        });
+        // § 820.30(i): Design change review gate
+        this.register('fda_820_design_change_review_active', (ctx) => {
+            const aq = ctx.packConfig?.['approval-queue'];
+            const t2Review = aq?.designChangeT2ReviewRequired === true;
+            const gr = ctx.packConfig?.['governance-runtime'];
+            const designCtrl = gr?.designControlWorkflowRequired === true;
+            const passed = t2Review && designCtrl;
+            return {
+                passed,
+                detail: passed
+                    ? 'Design change T2 review active: approval-queue gate + design-control workflow (21 CFR 820.30(i))'
+                    : `Design change review incomplete: t2Review=${t2Review}, designControl=${designCtrl}`,
+            };
+        });
+        // § 820.40: Document control
+        this.register('fda_820_document_control_active', (ctx) => {
+            const gr = ctx.packConfig?.['governance-runtime'];
+            const docAuth = gr?.documentControlAuthorizationRequired === true;
+            const aq = ctx.packConfig?.['approval-queue'];
+            const signOff = aq?.documentControlSignOffRequired === true;
+            const passed = docAuth && signOff;
+            return {
+                passed,
+                detail: passed
+                    ? 'Document control active: authorisation required + sign-off gate (21 CFR 820.40)'
+                    : `Document control incomplete: docAuth=${docAuth}, signOff=${signOff}`,
+            };
+        });
+        // § 820.20(c): Management review
+        this.register('fda_820_management_review_active', (ctx) => {
+            const gr = ctx.packConfig?.['governance-runtime'];
+            const reviewSched = gr?.managementReviewSchedulingRequired === true;
+            const am = ctx.packConfig?.['attestation-manager'];
+            const reviewAttest = am?.managementReviewAttestationRequired === true;
+            const passed = reviewSched && reviewAttest;
+            return {
+                passed,
+                detail: passed
+                    ? 'Management review active: scheduling configured + attestation required (21 CFR 820.20(c))'
+                    : `Management review incomplete: scheduling=${reviewSched}, attestation=${reviewAttest}`,
+            };
+        });
+        // § 820.30(f)(g): Design verification + validation
+        this.register('fda_820_design_vv_active', (ctx) => {
+            const am = ctx.packConfig?.['attestation-manager'];
+            const verifAttest = am?.designVerificationAttestationRequired === true;
+            const validAttest = am?.designValidationAttestationRequired === true;
+            const aq = ctx.packConfig?.['approval-queue'];
+            const outputReview = aq?.designOutputReviewRequired === true;
+            const passed = verifAttest && validAttest && outputReview;
+            return {
+                passed,
+                detail: passed
+                    ? 'Design V&V active: verification attestation + validation attestation + output review gate (21 CFR 820.30(f)(g))'
+                    : `Design V&V incomplete: verification=${verifAttest}, validation=${validAttest}, outputReview=${outputReview}`,
+            };
+        });
+        // § 820.50: Purchasing controls
+        this.register('fda_820_purchasing_controls_active', (ctx) => {
+            const sc = ctx.packConfig?.['supply-chain'];
+            const asl = sc?.approvedSupplierListRequired === true;
+            const qual = sc?.supplierQualificationRequired === true;
+            const incoming = sc?.incomingAcceptanceRecordRequired === true;
+            const passed = asl && qual && incoming;
+            return {
+                passed,
+                detail: passed
+                    ? 'Purchasing controls active: approved-supplier list + qualification + incoming acceptance (21 CFR 820.50)'
+                    : `Purchasing controls incomplete: asl=${asl}, qualification=${qual}, incomingAcceptance=${incoming}`,
+            };
+        });
+        // § 820.198: Complaint files
+        this.register('fda_820_complaint_files_active', (ctx) => {
+            const eb = ctx.packConfig?.['event-bus'];
+            const slaAlerts = eb?.complaintFileSlaAlertsActive === true;
+            const ad = ctx.packConfig?.['anomaly-detector'];
+            const complaintTrend = ad?.complaintTrendAnalysisActive === true;
+            const passed = slaAlerts && complaintTrend;
+            return {
+                passed,
+                detail: passed
+                    ? 'Complaint files active: SLA alerts + complaint trend analysis for MDR signal detection (21 CFR 820.198)'
+                    : `Complaint files incomplete: slaAlerts=${slaAlerts}, complaintTrend=${complaintTrend}`,
+            };
+        });
+        // § 820.90: Nonconforming product control
+        this.register('fda_820_nonconforming_product_active', (ctx) => {
+            const gr = ctx.packConfig?.['governance-runtime'];
+            const qaSystem = gr?.qaSystemValidationRequired === true;
+            const aq = ctx.packConfig?.['approval-queue'];
+            const ncpReview = aq?.capaInitiationReviewRequired === true; // NCP disposition requires CAPA gate
+            const passed = qaSystem && ncpReview;
+            return {
+                passed,
+                detail: passed
+                    ? 'Nonconforming product controls active: QA system + disposition review gate (21 CFR 820.90)'
+                    : `Nonconforming product controls incomplete: qaSystem=${qaSystem}, dispositionReview=${ncpReview}`,
+            };
+        });
+        // § 820.70: Production and process controls
+        this.register('fda_820_production_controls_active', (ctx) => {
+            const ad = ctx.packConfig?.['anomaly-detector'];
+            const prodMonitor = ad?.productionProcessMonitoringActive === true;
+            const gr = ctx.packConfig?.['governance-runtime'];
+            const qaSystem = gr?.qaSystemValidationRequired === true;
+            const passed = prodMonitor && qaSystem;
+            return {
+                passed,
+                detail: passed
+                    ? 'Production controls active: process monitoring + QA system validation (21 CFR 820.70)'
+                    : `Production controls incomplete: processMonitoring=${prodMonitor}, qaSystem=${qaSystem}`,
+            };
+        });
+        // § 820.60 / 820.65: Traceability
+        this.register('fda_820_traceability_active', (ctx) => {
+            const sc = ctx.packConfig?.['supply-chain'];
+            const traceability = sc?.componentTraceabilityRequired === true;
+            const asl = sc?.approvedSupplierListRequired === true;
+            const passed = traceability && asl;
+            return {
+                passed,
+                detail: passed
+                    ? 'Traceability active: component traceability + approved-supplier list (21 CFR 820.60/820.65)'
+                    : `Traceability incomplete: componentTraceability=${traceability}, supplierList=${asl}`,
+            };
+        });
+        // § 820.180(b): Records retention device lifetime + 2 years
+        this.register('fda_820_records_retention_active', (ctx) => {
+            const retentionDays = ctx.evidence?.auditRetentionDays;
+            // Minimum is 730 days (2 years from commercial release, per § 820.180(b))
+            const n = typeof retentionDays === 'number' ? retentionDays : 0;
+            const passed = n >= 730;
+            return {
+                passed,
+                detail: passed
+                    ? `Records retention ${n} days >= 730 (2-year minimum per 21 CFR 820.180(b))`
+                    : `Records retention ${n} days < 730 (2-year minimum required by 21 CFR 820.180(b))`,
+            };
+        });
+        // FDA 21 CFR Part 820 behavioral validators
+        // DHF unauthorized modification -> BLOCK
+        this.register('behavioralValidator_fda_820_dhf_unauthorised_modification', runBehavioralCheck('fda-21-cfr-820', 'DESIGN_HISTORY_FILE', 'DHF record modification: design history file entry updated without authorisation', 'BLOCK'));
+        // MDR late filing -> BLOCK
+        this.register('behavioralValidator_fda_820_mdr_late_filing', runBehavioralCheck('fda-21-cfr-820', 'MDR_REPORT', 'MDR 5-day report: medical device report adverse event MAUDE submission overdue corrective action', 'BLOCK'));
+        // CAPA initiation -> REQUIRE_APPROVAL (pack-author REVIEW vocabulary canonicalizes here)
+        this.register('behavioralValidator_fda_820_capa_initiation', runBehavioralCheck('fda-21-cfr-820', 'CORRECTIVE_ACTION', 'CAPA initiation: corrective action record nonconformance investigation root cause analysis', 'REQUIRE_APPROVAL'));
+        // Design change -> BLOCK (must go through T2 review)
+        this.register('behavioralValidator_fda_820_design_change', runBehavioralCheck('fda-21-cfr-820', 'DESIGN_CHANGE', 'Design change request DCR engineering change order design modification device', 'BLOCK'));
+        // ---------------------------------------------------------------------------
+        // IEC 62304 — Medical Device Software Life Cycle Processes
+        // ---------------------------------------------------------------------------
+        // -- IEC 62304 Medical Device Software Life Cycle checks --
+        this.register('iec62304_safety_class_assigned', configFlag('governance-runtime', 'softwareSafetyClassTrackingRequired', 'software safety class (A/B/C) tracking active'));
+        this.register('iec62304_soup_inventory_active', configFlag('supply-chain', 'soupInventoryRequired', 'SOUP inventory and evaluation'));
+        this.register('iec62304_development_plan_active', configFlag('governance-runtime', 'iec62304ClassAProcessRequired', 'IEC 62304 Class A development process'));
+        this.register('iec62304_requirements_analysis_active', configFlag('governance-runtime', 'classificationRationaleRequired', 'software safety classification rationale'));
+        this.register('iec62304_architecture_active', configFlag('governance-runtime', 'iec62304ClassBProcessRequired', 'IEC 62304 Class B development process'));
+        this.register('iec62304_class_c_unit_verification_active', configFlag('attestation-manager', 'classCUnitVerificationEvidenceRequired', 'Class C unit verification evidence'));
+        this.register('iec62304_integration_testing_active', configFlag('governance-runtime', 'iec62304ClassCProcessRequired', 'IEC 62304 Class C development process'));
+        this.register('iec62304_system_testing_active', configFlag('attestation-manager', 'softwareReleaseAttestationRequired', 'software release attestation'));
+        this.register('iec62304_release_records_active', configFlag('attestation-manager', 'classificationRationaleSignOffRequired', 'classification rationale sign-off'));
+        this.register('iec62304_config_management_active', configFlag('supply-chain', 'soupPublishedErrataEvaluationRequired', 'SOUP published errata evaluation'));
+        this.register('iec62304_anomaly_resolution_active', configFlag('anomaly-detector', 'softwareAnomalySignalDetectionActive', 'software anomaly signal detection'));
+        this.register('iec62304_class_c_soup_block_active', configFlag('approval-queue', 'soupIntroductionApprovalRequired', 'SOUP introduction approval gate'));
+        this.register('behavioralValidator_iec62304_class_c_unverified_change', configFlag('anomaly-detector', 'classCAnomályImmediateEscalationRequired', 'Class C anomaly immediate escalation'));
+        this.register('behavioralValidator_iec62304_class_b_anomaly_reviewed', configFlag('approval-queue', 'classBAnomályClosureApprovalRequired', 'Class B anomaly closure approval'));
+        this.register('iec62304_maintenance_plan_active', configFlag('attestation-manager', 'soupEvaluationAttestationRequired', 'SOUP evaluation attestation'));
+        // ---------------------------------------------------------------------------
+        // DO-178C avionics software life cycle checks (RTCA DO-178C / EUROCAE ED-12C)
+        // ---------------------------------------------------------------------------
+        this.register('do178c_software_level_assigned', configFlag('governance-runtime', 'softwareLevelTrackingRequired', 'software level (A/B/C/D/E) tracking active'));
+        this.register('do178c_psac_active', configFlag('governance-runtime', 'do178cLevelAProcessRequired', 'DO-178C Level A process (PSAC scope)'));
+        this.register('do178c_development_plan_active', configFlag('governance-runtime', 'do178cLevelBProcessRequired', 'DO-178C Level B development process (SDP scope)'));
+        this.register('do178c_verification_plan_active', configFlag('governance-runtime', 'do178cLevelCProcessRequired', 'DO-178C Level C verification process (SVP scope)'));
+        this.register('do178c_requirements_data_active', configFlag('governance-runtime', 'do178cLevelDProcessRequired', 'DO-178C Level D requirements process'));
+        this.register('do178c_design_description_active', configFlag('governance-runtime', 'decisionCoverageRequiredForLevelB', 'design description with decision-coverage gating'));
+        this.register('do178c_mc_dc_coverage_level_a_active', configFlag('governance-runtime', 'mcDcCoverageRequiredForLevelA', 'MC/DC coverage required for Level A'));
+        this.register('do178c_decision_coverage_level_b_active', configFlag('attestation-manager', 'mcDcCoverageAttestationRequiredForLevelA', 'decision/MC-DC coverage attestation'));
+        this.register('do178c_tool_qualification_active', configFlag('supply-chain', 'do330ToolQualificationLevelTrackingRequired', 'DO-330 tool qualification level (TQL) tracking'));
+        this.register('do178c_config_management_active', configFlag('supply-chain', 'toolQualificationInventoryRequired', 'tool qualification inventory + configuration management'));
+        this.register('do178c_quality_assurance_active', configFlag('attestation-manager', 'conformityReviewSignOffRequired', 'conformity review sign-off (SQA)'));
+        this.register('do178c_problem_reports_active', configFlag('anomaly-detector', 'softwareAnomalySignalDetectionActive', 'software anomaly signal detection (problem reports)'));
+        this.register('do178c_accomplishment_summary_active', configFlag('attestation-manager', 'softwareAccomplishmentSummaryAttestationRequired', 'Software Accomplishment Summary attestation'));
+        this.register('behavioralValidator_do178c_level_a_unverified_change', configFlag('anomaly-detector', 'levelAAnomalyImmediateEscalationRequired', 'Level A unverified change immediate escalation'));
+        this.register('behavioralValidator_do178c_mc_dc_coverage_below_threshold', configFlag('approval-queue', 'derReviewRequiredForLevelAB', 'Level A MC/DC coverage shortfall DER+SQA review'));
+        // ---------------------------------------------------------------------------
+        // ISO 26262 — Automotive Functional Safety (ISO 26262:2018, all 12 parts)
+        // ---------------------------------------------------------------------------
+        this.register('iso26262_asil_assigned', configFlag('governance-runtime', 'asilTrackingRequired', 'ASIL (A/B/C/D/QM) tracking active — default ASIL B when not declared'));
+        this.register('iso26262_item_definition_active', configFlag('governance-runtime', 'itemDefinitionRequired', 'item definition on file per ISO 26262-3 §5'));
+        this.register('iso26262_hara_active', configFlag('governance-runtime', 'haraRequired', 'HARA active — hazard catalogue + ASIL rationale on file per ISO 26262-3 §6'));
+        this.register('iso26262_functional_safety_concept_active', configFlag('governance-runtime', 'functionalSafetyConceptRequired', 'functional safety concept + FSR on file per ISO 26262-3 §7'));
+        this.register('iso26262_technical_safety_concept_active', configFlag('governance-runtime', 'asilCChangeApprovalRequired', 'technical safety concept + ASIL C approval gate per ISO 26262-4 §6'));
+        this.register('iso26262_software_safety_requirements_active', configFlag('governance-runtime', 'iso26262Part6SoftwareProcessRequired', 'software safety requirements per ISO 26262-6 §6'));
+        this.register('iso26262_software_architectural_design_active', configFlag('governance-runtime', 'asilDChangeApprovalRequired', 'software architectural design + ASIL D approval gate per ISO 26262-6 §7'));
+        this.register('iso26262_unit_verification_active', configFlag('attestation-manager', 'softwareReleaseAttestationRequired', 'software release attestation — unit verification evidence required'));
+        this.register('iso26262_asil_d_mc_dc_coverage_active', configFlag('governance-runtime', 'asilDAnomalyImmediateEscalationRequired', 'ASIL D MC/DC coverage at 100% — immediate escalation on gap per ISO 26262-6 Table 12'));
+        this.register('iso26262_asil_decomposition_active', configFlag('approval-queue', 'asilBAnomalyClosureApprovalRequired', 'ASIL decomposition rules active — ASIL B anomaly closure approval per ISO 26262-9 §5'));
+        this.register('iso26262_fmea_fault_tree_active', configFlag('attestation-manager', 'functionalSafetyAssessmentSignOffRequired', 'FMEA/FTA safety analysis sign-off required per ISO 26262-9 §8'));
+        this.register('iso26262_tool_confidence_level_active', configFlag('supply-chain', 'tclClassificationRequired', 'tool confidence level (TCL) classification per ISO 26262-8 §11'));
+        this.register('iso26262_config_management_active', configFlag('supply-chain', 'toolConfidenceLevelInventoryRequired', 'TCL inventory + configuration management per ISO 26262-8 §7'));
+        this.register('iso26262_change_management_active', configFlag('approval-queue', 'asilCChangeApprovalRequired', 'change management + ASIL C approval gate per ISO 26262-8 §8'));
+        this.register('behavioralValidator_iso26262_asil_d_unverified_change', configFlag('anomaly-detector', 'asilDAnomalyImmediateEscalationRequired', 'ASIL D unverified change immediate escalation — absolute block'));
+        // ---------------------------------------------------------------------------
+        // IEC 62443 — Industrial Automation and Control Systems (IACS) Security
+        // ---------------------------------------------------------------------------
+        this.register('iec62443_security_level_assigned', configFlag('governance-runtime', 'securityLevelTrackingRequired', 'Security Level Target (SL 1-4) assigned per zone/conduit — default SL 2 when not declared'));
+        this.register('iec62443_zone_conduit_model_active', configFlag('governance-runtime', 'zoneConduitModelRequired', 'zone and conduit model on file per IEC 62443-3-2 §5.5'));
+        this.register('iec62443_csms_active', configFlag('governance-runtime', 'csmsCovered', 'CSMS established per IEC 62443-2-1 — scope, policy, risk assessment, organisational responsibilities'));
+        this.register('iec62443_iac_controls_active', configFlag('governance-runtime', 'iec62443Part33SystemControlsRequired', 'FR1 Identification & Authentication Control (SR 1.x) per IEC 62443-3-3'));
+        this.register('iec62443_uc_controls_active', configFlag('governance-runtime', 'sl3ChangeApprovalRequired', 'FR2 Use Control (SR 2.x) per IEC 62443-3-3 — SL 3 approval gate wired'));
+        this.register('iec62443_si_controls_active', configFlag('governance-runtime', 'sl4ChangeApprovalRequired', 'FR3 System Integrity (SR 3.x) per IEC 62443-3-3 — SL 4 approval gate wired'));
+        this.register('iec62443_dc_controls_active', configFlag('governance-runtime', 'sl2AnomalyClosureApprovalRequired', 'FR4 Data Confidentiality (SR 4.x) per IEC 62443-3-3 — SL 2 anomaly closure approval'));
+        this.register('iec62443_rdf_controls_active', configFlag('governance-runtime', 'sl3AnomalyImmediateEscalationRequired', 'FR5 Restricted Data Flow / zone segmentation (SR 5.x) per IEC 62443-3-3'));
+        this.register('iec62443_tre_controls_active', configFlag('governance-runtime', 'sl4AnomalyImmediateEscalationRequired', 'FR6 Timely Response to Events (SR 6.x) per IEC 62443-3-3 — SL 4 immediate escalation'));
+        this.register('iec62443_ra_controls_active', configFlag('governance-runtime', 'iec62443Part41SecureDevelopmentLifecycleRequired', 'FR7 Resource Availability (SR 7.x) per IEC 62443-3-3'));
+        this.register('iec62443_sdl_active', configFlag('attestation-manager', 'sdlComplianceAttestationRequired', 'Secure Development Lifecycle per IEC 62443-4-1 — SDL attestation required'));
+        this.register('iec62443_component_security_requirements_active', configFlag('governance-runtime', 'iec62443Part42ComponentRequirementsRequired', 'component security requirements per IEC 62443-4-2'));
+        this.register('iec62443_patch_management_active', configFlag('supply-chain', 'sdlComplianceVerificationRequired', 'patch management per IEC 62443-2-3 — supply-chain SDL compliance verification'));
+        this.register('iec62443_incident_management_active', configFlag('approval-queue', 'sl2AnomalyClosureApprovalRequired', 'incident management per IEC 62443-2-1 §4.3.4.5 — SL 2+ anomaly closure approval'));
+        this.register('behavioralValidator_iec62443_sl3_sl4_unverified_change', configFlag('anomaly-detector', 'sl4AnomalyImmediateEscalationRequired', 'SL 3/4 unverified IACS change immediate escalation — absolute block'));
+        // ---------------------------------------------------------------------------
+        // NIST SP 800-82 Rev 3 — US Federal Operational Technology Security
+        // ---------------------------------------------------------------------------
+        this.register('nist80082_impact_level_assigned', configFlag('governance-runtime', 'impactLevelTrackingRequired', 'FIPS 199 impact level (LOW/MODERATE/HIGH) assigned per OT system/zone — default MODERATE when not declared'));
+        this.register('nist80082_purdue_model_segmentation', configFlag('governance-runtime', 'purdueModelSegmentationRequired', 'Purdue model segmentation on file per NIST SP 800-82 §5.5 — Levels 0-5 + industrial DMZ Level 3.5'));
+        this.register('nist80082_cybersecurity_program', configFlag('governance-runtime', 'fips199CategorizationRequired', 'OT cybersecurity program per NIST SP 800-82 §3 — charter, roles, workforce training, management approval'));
+        this.register('nist80082_risk_management', configFlag('governance-runtime', 'nist80053ControlOverlayRequired', 'OT risk management per NIST SP 800-82 §4 + SP 800-30 + SP 800-39 — risk register, AO acceptance'));
+        this.register('nist80082_ac_controls', configFlag('governance-runtime', 'highImpactChangeApprovalRequired', 'AC family controls applied to OT per SP 800-82 §6.2 — RBAC, least privilege, MFA for remote access'));
+        this.register('nist80082_au_controls', configFlag('governance-runtime', 'moderateImpactChangeApprovalRequired', 'AU family controls applied to OT per SP 800-82 §6.3 — audit logging, centralized SIEM, 7-year retention'));
+        this.register('nist80082_cm_controls', configFlag('governance-runtime', 'moderateImpactAnomalyClosureApprovalRequired', 'CM family controls applied to OT per SP 800-82 §6.6 — baseline configs, formal change control'));
+        this.register('nist80082_cp_controls', configFlag('governance-runtime', 'highImpactAnomalyImmediateEscalationRequired', 'CP family controls applied to OT per SP 800-82 §6.7 — OT contingency plan, backup, annual test'));
+        this.register('nist80082_ir_controls', configFlag('governance-runtime', 'ciraReportingActive', 'IR family controls applied to OT per SP 800-82 §6.10 — OT IR plan, 24h CISA reporting, CIRCIA integration'));
+        this.register('nist80082_sc_controls', configFlag('approval-queue', 'highImpactChangeApprovalRequired', 'SC family controls applied to OT per SP 800-82 §6.18 — Purdue segmentation, industrial DMZ, encrypted OT comms'));
+        this.register('nist80082_si_controls', configFlag('approval-queue', 'sisModificationAbsoluteBlockRequired', 'SI family controls applied to OT per SP 800-82 §6.19 — malware protection, integrity verification, ICS-CERT'));
+        this.register('nist80082_sr_controls', configFlag('supply-chain', 'eo14028SbomRequired', 'SR family controls applied to OT per SP 800-82 §6.20 — OT SBOM (EO 14028), supplier risk, CMMC'));
+        this.register('nist80082_safety_instrumented_system', configFlag('governance-runtime', 'safetyInstrumentedSystemProtectionRequired', 'SIS isolation per NIST SP 800-82 §5.7 + IEC 61511 — separate segment, SIL engineer sign-off, no AI changes'));
+        this.register('nist80082_cisa_incident_reporting', configFlag('attestation-manager', 'fismaAtoAttestationRequired', 'CISA OT incident reporting per SP 800-82 §6.10 + CIRCIA + EO 14028 — 24h notification, NERC CIP integration'));
+        this.register('behavioralValidator_nist80082_high_impact_unverified_change', configFlag('anomaly-detector', 'unverifiedHighImpactChangeDetectionActive', 'HIGH impact / SIS unverified OT change immediate escalation — absolute block'));
+        // ---- AS9100D / AS9110C / AS9120B — Aerospace Quality Management Systems ----
+        this.register('as9100_product_safety_policy', configFlag('governance-runtime', 'productSafetyPolicyRequired', 'AS9100D §5.1.1.1 — Product Safety Policy: written policy + training + management commitment'));
+        this.register('as9100_counterfeit_parts_prevention', configFlag('governance-runtime', 'counterfeitPartsPreventionRequired', 'AS9100D §8.1.4 — Counterfeit Parts Prevention: ASL + quarantine + ERAI/GIDEP reporting procedure'));
+        this.register('as9100_configuration_management', configFlag('governance-runtime', 'configurationManagementBaselineRequired', 'AS9100D §8.1.2 — Configuration Management: CM baseline + change control (ECO/ECR) + CM records'));
+        this.register('as9100_special_process_controls', configFlag('governance-runtime', 'specialProcessQualificationRequired', 'AS9100D §8.5.1.2 — Special Processes: NADCAP accreditation + operator/equipment/procedure qualification'));
+        this.register('as9100_fod_prevention', configFlag('governance-runtime', 'fodPreventionRequired', 'AS9100D §8.5.4 — FOD Prevention: plan + training + inspections + event investigation'));
+        this.register('as9100_risk_and_opportunity_management', configFlag('governance-runtime', 'capaImmediateEscalationOnSafetyImpact', 'AS9100D §6.1 — Risk + Opportunity Management: FMEA/FTA mandatory (§6.1.2.1) + risk register'));
+        this.register('as9100_design_development_controls', configFlag('governance-runtime', 'designReviewApprovalRequired', 'AS9100D §8.3 — Design + Development Controls: FAI per AS9102 + design change per §8.3.6'));
+        this.register('as9100_purchasing_controls', configFlag('governance-runtime', 'supplierQualificationRequired', 'AS9100D §8.4 — Purchasing Controls: ASL enforcement + customer-approved sources + incoming inspection'));
+        this.register('as9100_product_realisation', configFlag('governance-runtime', 'postDeliverySupportRecordsRequired', 'AS9100D §8.5 — Product Realisation: controlled conditions + travellers + SPC + §8.5.5 post-delivery'));
+        this.register('as9100_identification_traceability', configFlag('supply-chain', 'approvedSourceListEnforcementRequired', 'AS9100D §8.5.2 — Identification + Traceability: serialized/lot-controlled + material certs + CofC chain'));
+        this.register('as9100_customer_property', configFlag('supply-chain', 'itarEarClassificationRequired', 'AS9100D §8.5.3 — Customer + External Property: CFE/CFM + tooling + ITAR/EAR IP protection'));
+        this.register('as9100_post_delivery_support', configFlag('governance-runtime', 'postDeliverySupportRecordsRequired', 'AS9100D §8.5.5 — Post-Delivery Support: warranty + airworthiness data + FAA SDR / EASA Part 21J'));
+        this.register('as9100_on_time_delivery_conformity', configFlag('governance-runtime', 'onTimeDeliveryMetricsRequired', 'AS9100D §9.1.1 — On-Time Delivery + Product Conformity: OTD + first-pass yield + PPM escapes'));
+        this.register('as9100_corrective_action', configFlag('approval-queue', 'safetyImpactCapaApprovalRequired', 'AS9100D §10.2 — CAPA: RCA + effectiveness verification + safety-impact escalation + FAA SDR / EASA 21J'));
+        this.register('behavioralValidator_as9100_counterfeit_parts_detected', configFlag('anomaly-detector', 'counterfeitPartsDetectedImmediateEscalationRequired', 'AS9100D §8.1.4 — counterfeit-parts-detected: absolute CRITICAL block + immediate escalation'));
+        // ---- FDA Software Pre-Cert + SaMD TPLC + AI/ML Action Plan ----
+        this.register('samd_imdrf_categorization', configFlag('governance-runtime', 'imdrfCategorizationRequired', 'IMDRF SaMD N12 (2014) — SaMD risk categorization (Category I–IV): medical purpose × healthcare situation severity'));
+        this.register('samd_patient_safety_excellence', configFlag('governance-runtime', 'postMarketSignalDetectionActive', 'FDA Pre-Cert Principle 1 (Patient Safety) — risk management + MDR signal detection + 5-day escalation path'));
+        this.register('samd_product_quality_excellence', configFlag('governance-runtime', 'pccpChangeControlRequired', 'FDA Pre-Cert Principle 2 (Product Quality) — QMS per ISO 13485 + IEC 62304 software lifecycle processes'));
+        this.register('samd_clinical_responsibility', configFlag('governance-runtime', 'clinicalEvaluationRequired', 'FDA Pre-Cert Principle 3 (Clinical Responsibility) — clinical evaluation per IMDRF N41 + intended-use scoping'));
+        this.register('samd_cybersecurity_responsibility', configFlag('supply-chain', 'sbomMaintenanceRequired', 'FDA Pre-Cert Principle 4 (Cybersecurity Responsibility) — SBOM + VEX + PATCH Act §524B + FDA Cybersecurity Guidance (2023)'));
+        this.register('samd_proactive_culture', configFlag('governance-runtime', 'aimlActionPlanAlignmentActive', 'FDA Pre-Cert Principle 5 (Proactive Culture) — CAPA + RCA + FDA transparency + Q-Sub engagement'));
+        this.register('samd_tplc_monitoring', configFlag('governance-runtime', 'tplcMonitoringActive', 'FDA Total Product Lifecycle (TPLC) approach — post-market monitoring plan + real-world performance tracking'));
+        this.register('samd_real_world_performance', configFlag('governance-runtime', 'realWorldPerformanceTrackingActive', 'FDA RWE/RWD framework + Pre-Cert continuous monitoring — RWP metrics + drift detection + performance reports'));
+        this.register('samd_aiml_action_plan_alignment', configFlag('governance-runtime', 'aimlActionPlanAlignmentActive', 'FDA AI/ML-Based SaMD Action Plan (Jan 2021) — GMLP 10 principles + transparency + RWP + regulatory science + patient engagement'));
+        this.register('samd_pccp_change_control', configFlag('governance-runtime', 'pccpChangeControlRequired', 'FDA PCCP Guidance (2024) — modification protocol + development protocols + performance evaluation + pccp-change-controller'));
+        this.register('samd_algorithm_change_protocol', configFlag('governance-runtime', 'algorithmChangeProtocolRequired', 'FDA AI/ML Action Plan §2 — ACP: bounded change envelope + change log + performance evidence + out-of-bounds escalation'));
+        this.register('samd_clinical_evaluation', configFlag('governance-runtime', 'clinicalEvaluationRequired', 'IMDRF SaMD Clinical Evaluation N41 (2017) — analytical validation + clinical validation + CER + clinical evaluation officer'));
+        this.register('samd_intended_use_scoping', configFlag('governance-runtime', 'intendedUseScopingRequired', 'FDA SaMD intended-use determination + IMDRF N12 — medical purpose + patient population + clinical setting + out-of-scope definition'));
+        this.register('samd_post_market_signal_detection', configFlag('governance-runtime', 'postMarketSignalDetectionActive', 'FDA Sentinel Initiative + Pre-Cert continuous monitoring — signal thresholds + drift detection + 5-day MDR escalation path'));
+        this.register('behavioralValidator_samd_out_of_pccp_bounds_change', configFlag('governance-runtime', 'outOfPccpBoundsImmediateEscalationRequired', 'FDA PCCP Guidance (2024) — out-of-PCCP-bounds-change: absolute CRITICAL block + immediate escalation, no compensating control path'));
+        // ---- ISO 15189:2022 Medical Laboratory Quality and Competence ----
+        this.register('iso15189_impartiality', configFlag('governance-runtime', 'impartialityPolicyRequired', 'ISO 15189:2022 §4.1 — Impartiality: policy documented + conflicts of interest identified + commercial pressure managed'));
+        this.register('iso15189_confidentiality', configFlag('governance-runtime', 'confidentialityControlsRequired', 'ISO 15189:2022 §4.2 — Confidentiality: PHI protection + HIPAA BAA + GDPR Art. 9 + breach detection + 72h notification'));
+        this.register('iso15189_lab_director_responsibility', configFlag('governance-runtime', 'labDirectorOversightRequired', 'ISO 15189:2022 §5.1 — Legal entity + Lab Director: CLIA-qualified director + management accountability + delegation documented'));
+        this.register('iso15189_personnel_competence', configFlag('governance-runtime', 'personnelCompetenceTrackingRequired', 'ISO 15189:2022 §6.2 — Personnel: initial + ongoing competence assessment + lab-director authorisation + Annex C interpretive competence'));
+        this.register('iso15189_equipment_calibration', configFlag('governance-runtime', 'equipmentCalibrationTraceabilityRequired', 'ISO 15189:2022 §6.4 — Equipment + calibration + traceability: SI metrological traceability chain + calibration certificates + maintenance records'));
+        this.register('iso15189_reagents_consumables', configFlag('governance-runtime', 'reagentConsumableVendorQualificationRequired', 'ISO 15189:2022 §6.5 — Reagents + consumables: receipt inspection + lot verification + expiry management + vendor qualification'));
+        this.register('iso15189_pre_examination', configFlag('governance-runtime', 'resultReportingControlsRequired', 'ISO 15189:2022 §7.2 — Pre-examination: request form + patient preparation + sample collection + reception criteria + sample tracking'));
+        this.register('iso15189_examination_validation', configFlag('governance-runtime', 'examinationValidationRequired', 'ISO 15189:2022 §7.3 — Examination: validation (in-house — AMR/precision/trueness/uncertainty) + verification (commercial — manufacturer specs confirmed)'));
+        this.register('iso15189_internal_quality_control', configFlag('governance-runtime', 'internalQualityControlActive', 'ISO 15189:2022 §7.3.7 — Internal Quality Control: Westgard rules + OOC policy: BLOCK patient results + immediate escalation + lab-director sign-off'));
+        this.register('iso15189_external_proficiency_testing', configFlag('governance-runtime', 'externalProficiencyTestingActive', 'ISO 15189:2022 §7.3.4 — EQA/PT: enrolment + unacceptable performance corrective action + qms-lead + lab-director approval'));
+        this.register('iso15189_result_reporting', configFlag('governance-runtime', 'resultReportingControlsRequired', 'ISO 15189:2022 §7.4 — Reporting: authorised release + critical value notification + amended report traceability + AI disclosure'));
+        this.register('iso15189_clinical_interpretation', configFlag('governance-runtime', 'labDirectorOversightRequired', 'ISO 15189:2022 §7.5 + Annex C — Post-examination + clinical interpretation: pathologist review + AI provenance disclosure + retained sample policy'));
+        this.register('iso15189_risk_management_annex_a', configFlag('governance-runtime', 'riskManagementAnnexAActive', 'ISO 15189:2022 Annex A — Risk management: ISO 14971 + ISO 22367 for lab processes + AI-introduced risk assessment + residual risk acceptance'));
+        this.register('iso15189_complaints_handling', configFlag('governance-runtime', 'impartialityPolicyRequired', 'ISO 15189:2022 §8.7 — Complaints: acknowledge without undue delay + root cause + corrective action + accreditation body notification'));
+        this.register('behavioralValidator_iso15189_iqc_out_of_control', configFlag('governance-runtime', 'iqcOutOfControlImmediateEscalationRequired', 'ISO 15189:2022 §7.3.7 — IQC-out-of-control: absolute CRITICAL block — no patient results released until IQC passes + lab-director sign-off'));
+        // ---- ISO/IEC 80001 Medical IT Network Risk Management ----
+        this.register('iso80001_key_property_safety', configFlag('governance-runtime', 'keyPropertySafetyTrackingRequired', 'ISO/IEC 80001-1:2021 §4.2.1 — KEY PROPERTY SAFETY: no patient harm from network-mediated failure; CRITICAL immediate escalation on impact; ISO 14971 probability × severity risk estimation'));
+        this.register('iso80001_key_property_effectiveness', configFlag('governance-runtime', 'keyPropertyEffectivenessTrackingRequired', 'ISO/IEC 80001-1:2021 §4.2.2 — KEY PROPERTY EFFECTIVENESS: medical purpose still achieved; network performance vs device manufacturer specs; HIGH escalation on degradation'));
+        this.register('iso80001_key_property_security', configFlag('governance-runtime', 'keyPropertySecurityTrackingRequired', 'ISO/IEC 80001-1:2021 §4.2.3 — KEY PROPERTY DATA+SYSTEM SECURITY: integrity + availability + confidentiality; SIEM integration; rogue device detection; CRITICAL on cybersecurity event'));
+        this.register('iso80001_medical_it_network_risk_manager', configFlag('governance-runtime', 'designatedMedicalItNetworkRiskManagerRequired', 'ISO/IEC 80001-1:2021 §5 — Designated MITN-RM: named individual + documented authority over change management + Responsibility Agreement authority + 24/7 escalation availability'));
+        this.register('iso80001_responsibility_agreements', configFlag('governance-runtime', 'responsibilityAgreementsRequired', 'ISO/IEC 80001-1:2021 §6 — Responsibility Agreements: RO + device manufacturer + IT operator; security capabilities obligations; change notification; incident notification; annual review'));
+        this.register('iso80001_risk_management_process', configFlag('governance-runtime', 'iso14971AlignmentRequired', 'ISO/IEC 80001-2-1:2012 — Step-by-step risk management: hazard identification + risk estimation + control + residual risk acceptance + ISO 14971 alignment per §4.4'));
+        this.register('iso80001_medical_device_inventory', configFlag('governance-runtime', 'medicalDeviceInventoryRequired', 'ISO/IEC 80001-1:2021 §7 — Medical device inventory: device ID + network ID + clinical context + risk assessment status + Responsibility Agreement reference; updated within 24h'));
+        this.register('iso80001_network_change_management', configFlag('governance-runtime', 'networkChangeManagementApprovalRequired', 'ISO/IEC 80001-1:2021 §8 — Network change management: mandatory pre-change risk assessment, MITN-RM approval gate, NO unilateral changes, post-change key property verification'));
+        this.register('iso80001_incident_management', configFlag('governance-runtime', 'keyPropertyImpactImmediateEscalationRequired', 'ISO/IEC 80001-1:2021 §9 — Incident management: SAFETY CRITICAL immediate escalation, manufacturer notification, 72h regulatory notification, root cause + corrective action + MITN-RM + PSO attestation'));
+        this.register('iso80001_monitoring_event_handling', configFlag('governance-runtime', 'monitoringAndEventHandlingActive', 'ISO/IEC 80001-1:2021 §9 + 80001-2-2 §6 — Monitoring: continuous three KEY PROPERTIES monitoring; SIEM for medical device network; MITN-RM monthly review; coverage verified at each change cycle'));
+        this.register('iso80001_security_capabilities', configFlag('governance-runtime', 'keyPropertySecurityTrackingRequired', 'ISO/IEC 80001-2-2 — Security capabilities: MDS2/SECURE template per device from manufacturer; version tracked vs device software; security gap risk management; annual review'));
+        this.register('iso80001_wireless_network_controls', configFlag('governance-runtime', 'keyPropertyEffectivenessTrackingRequired', 'ISO/IEC 80001-2-3 — Wireless networks: RF site survey; medical SSID/VLAN; WPA3-Enterprise; 802.11e/WMM QoS; roaming performance; interference management; change management required'));
+        this.register('iso80001_distributed_alarm_systems', configFlag('governance-runtime', 'keyPropertySafetyTrackingRequired', 'ISO/IEC 80001-2-5 — Distributed alarm systems: alarm delivery risk assessment; redundancy; end-to-end testing; alarm delivery failure = SAFETY KEY PROPERTY IMPACT CRITICAL block'));
+        this.register('iso80001_iso14971_alignment', configFlag('governance-runtime', 'iso14971AlignmentRequired', 'ISO/IEC 80001-1:2021 §4.4 — ISO 14971 alignment: network-mediated risks linked to device-intrinsic risk files; probability × severity framework; risk/benefit consistent; annual review'));
+        this.register('behavioralValidator_iso80001_key_property_impact_detected', runBehavioralCheck('iso-iec-80001', 'KEY_PROPERTY_IMPACT_EVENT', 'key_property_impact event detected on medical IT network: MITN-RM escalation required', 'BLOCK'));
+    }
+}
+exports.ComplianceCheckRegistry = ComplianceCheckRegistry;
+/**
+ * Shared default registry instance. Tests / apps can use this or
+ * construct their own registry for isolated test fixtures.
+ */
+exports.defaultCheckRegistry = (() => {
+    const r = new ComplianceCheckRegistry();
+    r.registerDefaults();
+    return r;
+})();
+//# sourceMappingURL=check-registry.js.map