@event4u/agent-config 14.13.0 → 14.14.1

package/src/scripts/evolution_lab.ts

@@ -62,6 +62,12 @@ import {
     clone_candidate,
 } from './bench_ab_clone.js';
 import { main as integrity_main } from './bench_ab_integrity.js';
+import {
+    runCascade,
+    CHEAPEST_STAGE,
+    type CascadeResult,
+} from './_lib/evaluation_cascade.js';
+import type { MetricVector } from './_lib/evaluation_vector.js';
 import {
     type CandidateRecord,
     CandidateSchemaError,
@@ -76,6 +82,15 @@ import {
     parseCandidateRecord,
     readCandidateRecord,
 } from './_lib/candidate_record.js';
+import {
+    PROMOTION_EVIDENCE_FIELDS,
+    PromotionEvidenceError,
+    parsePromotionEvidence,
+} from './_lib/promotion_evidence.js';
+import { MERGE_AUTHORITY_ROADMAP, readMergeAuthorityStatus } from './_lib/promotion_capability.js';
+import { assertNotSemanticNoOp, isSemanticNoOp, SemanticNoOpError } from './_lib/semantic_noop.js';
+import { buildRunSpec } from './_lib/experiment_binding.js';
+import { ExperimentDriftError, assertUnchanged, freeze } from './_lib/experiment_freeze.js';
 import {
     RECIPES,
     byteCompare,
@@ -84,6 +99,13 @@ import {
     proposeCandidates,
     serialiseCandidateRecord,
 } from './_lib/candidate_proposer.js';
+import {
+    type RunReport,
+    buildRunReport,
+    parseMetricVectorJson,
+    renderRunReport,
+    roiFigure,
+} from './_lib/evolution_roi.js';
 import {
     BudgetExceededError,
     type DisclosureRecord,
@@ -379,11 +401,11 @@ const USAGE = `usage: evolution_lab <verb> [options]
 
   inspect  [--record FILE]... [--records DIR] [--clones]
   propose  --observations FILE --out DIR [--force]
-  run      --record FILE... [--refresh]
+  run      --record FILE... [--refresh] [--vector FILE]...
            [--trials-per-candidate N] [--estimated-spend-cents N]
   compare  [--verbose]
   explain  [--record FILE [--to STATE]] [--criteria]
-  promote  --record FILE                 (always refuses: blocker merge-authority)
+  promote  --record FILE [--evidence FILE]  (always refuses: blocker merge-authority)
   clean    [--yes]
 
 No verb starts a resident process, a timer, or a watcher.
@@ -615,6 +637,15 @@ function guardAbort(e: unknown): number | undefined {
         );
         return EXIT_GUARD_ABORT;
     }
+    if (e instanceof ExperimentDriftError) {
+        process.stderr.write(
+            `evolution_lab: ABORTED on experiment drift (moved: ${e.changed.join(', ')})\n` +
+                `  ${e.message}\n` +
+                '  The run cloned one record set and would have scored another. Nothing is\n' +
+                '  reported: an ROI figure over a set that moved mid-run is not a comparison.\n',
+        );
+        return EXIT_GUARD_ABORT;
+    }
     if (e instanceof BudgetConfigError) {
         process.stderr.write(`evolution_lab: ABORTED — ${(e as Error).message}\n`);
         return EXIT_GUARD_ABORT;
@@ -698,7 +729,7 @@ function verbRun(argv: readonly string[]): number {
     const flags = parseFlags(
         argv,
         ['refresh'],
-        ['record', 'records', 'trials-per-candidate', 'estimated-spend-cents'],
+        ['record', 'records', 'trials-per-candidate', 'estimated-spend-cents', 'vector'],
     );
     const files: string[] = [...(flags.values.get('record') ?? [])];
     const dir = one(flags, 'records');
@@ -734,8 +765,51 @@ function verbRun(argv: readonly string[]): number {
         }
         throw e;
     }
+    // Evaluation evidence is parsed BEFORE the first clone, for the same reason
+    // the budget guard runs before it: a malformed vector discovered after the
+    // work is a failed run that already spent, and `parseMetricVectorJson`
+    // inherits `buildVector`'s refusal of a vector missing its artifact-count
+    // row, so this is also where that refusal lands.
+    const vectors: MetricVector[] = [];
+    for (const vf of flags.values.get('vector') ?? []) {
+        try {
+            vectors.push(parseMetricVectorJson(fs.readFileSync(vf, 'utf-8'), vf));
+        } catch (e) {
+            return fail(`vector ${vf} rejected — ${(e as Error).message}`);
+        }
+    }
+    // The experiment binding. Frozen HERE, before the first clone, and asserted
+    // again after the loop. The window it closes is real and specific: the loop
+    // below clones from `record`, then RE-READS the same file from disk to
+    // evaluate it, so a record rewritten in between produces a run that cloned
+    // one thing and scored another. Every guard already in this verb fires
+    // before the run starts and never looks again.
+    const ordered = [...files].sort(byteCompare);
+    const readRecord = (f: string): string => {
+        try {
+            return fs.readFileSync(f, 'utf-8');
+        } catch {
+            // Unreadable is a STATE of the record set here, not a reason to
+            // fail: the loop below already reports the specific file with its
+            // own message, and a freeze that pre-empted it would replace a
+            // precise diagnostic with a vaguer one. The marker still moves the
+            // digest, so a record that appears or vanishes mid-run is drift.
+            return '\u0000<unreadable>';
+        }
+    };
+    let frozenSpec;
+    let frozenDigest: string;
+    try {
+        frozenSpec = buildRunSpec(ordered, readRecord);
+        frozenDigest = freeze(frozenSpec);
+    } catch (e) {
+        return fail(`experiment spec could not be built — ${(e as Error).message}`);
+    }
+
     const seen = new Set<string>();
-    for (const f of files.sort(byteCompare)) {
+    const ids: string[] = [];
+    const results: CascadeResult[] = [];
+    for (const f of ordered) {
         let record: CandidateRecord;
         try {
             record = loadRecord(f);
@@ -754,6 +828,108 @@ function verbRun(argv: readonly string[]): number {
             }
             return fail(`candidate ${record.id} failed — ${(e as Error).message}`);
         }
+
+        // EVALUATE. Step 4.1's deterministic prefix, wired here because a
+        // library nothing calls has no coverage — the defect AC-3 and AC-5
+        // were both open on. The record is re-read from disk rather than
+        // reusing `record`, so stage 1 is a real schema gate at this call
+        // site and not a formality over an already-parsed object.
+        let raw: unknown;
+        try {
+            raw = JSON.parse(fs.readFileSync(f, 'utf-8'));
+        } catch (e) {
+            return fail(`${f} unreadable at evaluation — ${(e as Error).message}`);
+        }
+        const result = runCascade({
+            raw,
+            plan: {
+                candidates: files.length,
+                trialsPerCandidate: intFlag(flags, 'trials-per-candidate', 1),
+                estimatedSpendCents: intFlag(flags, 'estimated-spend-cents', 0),
+            },
+            budget: loadRunBudget(),
+            peers: ids,
+            // ONE evidence input, two consumers. `--vector` is the only
+            // measurement flag: step 5.6's run report and step 4.1's cascade
+            // read the same parsed vectors rather than each taking a file of
+            // its own, so a run cannot report an ROI over one set of numbers
+            // while the verdict was decided on another.
+            vector: vectors.find((v) => v.candidate_id === record.id),
+        });
+        ids.push(record.id);
+        results.push(result);
+    }
+
+    // Assert BEFORE the verdicts are rendered, and before the cascade-abort
+    // return below: a drifted run has no verdict worth printing, whichever way
+    // the cascade came out.
+    try {
+        assertUnchanged(frozenDigest, frozenSpec, buildRunSpec(ordered, readRecord));
+    } catch (e) {
+        const aborted = guardAbort(e);
+        if (aborted !== undefined) {
+            return aborted;
+        }
+        throw e;
+    }
+
+    for (const r of results) {
+        if (r.outcome === 'abort') {
+            process.stdout.write(
+                `evolution_lab:cascade · ${r.candidate_id ?? '<unparsed>'} · aborted at ` +
+                    `${r.failed_stage} · family=${r.family} · model_calls=${r.model_calls} · ${r.detail}\n`,
+            );
+        } else if (r.outcome === 'incomplete') {
+            process.stdout.write(
+                `evolution_lab:cascade · ${r.candidate_id} · passed ${r.stages_run.length} stage(s) · ` +
+                    `model_calls=${r.model_calls} · ${r.not_reached} NOT REACHED · ${r.why}\n`,
+            );
+        } else {
+            process.stdout.write(
+                `evolution_lab:cascade · ${r.candidate_id} · passed ${r.stages_run.length} stage(s) · ` +
+                    `model_calls=${r.model_calls} · verdict=${r.verdict.promote ? 'promote' : 'refuse'} · ` +
+                    `${r.verdict.reason}\n`,
+            );
+        }
+    }
+
+    // A cascade abort is a run outcome, not a crash: the run did its job by
+    // refusing. The cheapest stage is named so a reader can see that a stage-1
+    // abort cost nothing.
+    const aborted = results.filter((r) => r.outcome === 'abort');
+    if (aborted.length > 0) {
+        const atCheapest = aborted.filter(
+            (r) => r.outcome === 'abort' && r.failed_stage === CHEAPEST_STAGE,
+        ).length;
+        process.stdout.write(
+            `evolution_lab:cascade · ${aborted.length} of ${results.length} aborted ` +
+                `(${atCheapest} at the cheapest stage, ${CHEAPEST_STAGE}, costing no model call)\n`,
+        );
+        return EXIT_REFUSED;
+    }
+    // STEP 5.6 — the run report, on the ONE path a run completes on.
+    //
+    // Placed after the clone loop and before the only success return, so there
+    // is no completed run without a report. Every other exit from this verb is
+    // an abort (budget) or a failure (unreadable record), and neither is a run
+    // whose ROI could be reported: nothing was cloned and nothing was spent.
+    let report: RunReport;
+    try {
+        report = buildRunReport({
+            // Deterministic and identifying: the candidate ids, in the byte
+            // order the run walked them. Two runs over the same record set
+            // produce the same id, and a run over a different set cannot
+            // borrow another run's report line.
+            run_id: `run:${[...seen].sort(byteCompare).join('+')}`,
+            candidates: files.length,
+            trials_per_candidate: intFlag(flags, 'trials-per-candidate', 1),
+            roi: roiFigure(vectors, intFlag(flags, 'estimated-spend-cents', 0)),
+        });
+    } catch (e) {
+        return fail(`run report rejected — ${(e as Error).message}`);
+    }
+    for (const line of renderRunReport(report)) {
+        process.stdout.write(`${line}\n`);
     }
     return EXIT_OK;
 }
@@ -854,9 +1030,15 @@ function verbExplain(argv: readonly string[]): number {
  * There is no flag, no environment variable and no argument that turns this
  * into a promotion. `--approver` is deliberately NOT a flag: adding one is what
  * would let an unattended run name a human who never approved.
+ *
+ * `--evidence FILE` IS a flag, and it changes nothing about the refusal. It is
+ * how steps 7.1, 7.3, 7.4 and 7.5 are exercised against a refused promotion: the
+ * package is validated FIRST and its finding names the missing field, so an
+ * operator assembling one can see which field is wrong instead of only being
+ * told the blocker is open. Both paths still return {@link EXIT_REFUSED}.
  */
 function verbPromote(argv: readonly string[]): number {
-    const flags = parseFlags(argv, [], ['record']);
+    const flags = parseFlags(argv, [], ['record', 'evidence']);
     const file = one(flags, 'record');
     if (file === undefined) {
         return usageError('promote requires --record FILE');
@@ -867,20 +1049,63 @@ function verbPromote(argv: readonly string[]): number {
     } catch (e) {
         return fail(`${file} rejected — ${(e as Error).message}`);
     }
+
+    // 7.1 / 7.3 / 7.4 / 7.5 — the evidence package, checked BEFORE the governance
+    // refusal so its finding names the missing field rather than being swallowed
+    // by a blocker message the operator cannot act on.
+    const evidenceFile = one(flags, 'evidence');
+    if (evidenceFile === undefined) {
+        process.stderr.write(
+            `evolution_lab: promote REFUSED for ${record.id}\n` +
+                '  evidence package: absent. A promotion carries ONE package with all ' +
+                `${String(PROMOTION_EVIDENCE_FIELDS.length)} fields ` +
+                `(${PROMOTION_EVIDENCE_FIELDS.join(', ')}); pass --evidence FILE.\n`,
+        );
+    } else {
+        try {
+            const evidence = parsePromotionEvidence(JSON.parse(fs.readFileSync(evidenceFile, 'utf-8')));
+            assertNotSemanticNoOp(
+                evidence.candidateId,
+                isSemanticNoOp(
+                    evidence.materialImprovement.baselineText,
+                    evidence.materialImprovement.candidateText,
+                    evidence.materialImprovement.deltaPercent,
+                ),
+            );
+        } catch (e) {
+            if (e instanceof PromotionEvidenceError || e instanceof SemanticNoOpError) {
+                process.stderr.write(
+                    `evolution_lab: promote REFUSED for ${record.id}\n  evidence package: ${e.message}\n`,
+                );
+            } else {
+                return fail(`${evidenceFile} unreadable — ${(e as Error).message}`);
+            }
+        }
+    }
+
     let gate = 'the lifecycle gate did not refuse, which is itself a defect';
     try {
         assertTransition(record.lifecycle, 'promoted');
     } catch (e) {
         gate = (e as Error).message;
     }
+    // READ the status, never assert it. This line said `is OPEN` as a literal,
+    // and on 2026-09-01 the blocker closed as `refused` — at which point the
+    // refusal was still correct and its stated reason was not. Reading keeps the
+    // two from diverging again, and every value the reader can return is a
+    // refusing one, so no branch here can print a grant.
+    const blockerStatus = readMergeAuthorityStatus();
     process.stderr.write(
         `evolution_lab: promote REFUSED for ${record.id}\n` +
             `  lifecycle gate: ${gate}\n` +
-            '  blocker: merge-authority is OPEN on road-to-governed-harness-evolution.\n' +
+            `  blocker: merge-authority reads ${blockerStatus.toUpperCase()} on ` +
+            `${path.basename(MERGE_AUTHORITY_ROADMAP, '.md')}.\n` +
             '    Phases 1-6 are legal because they promote nothing (AI council 2026-08-29,\n' +
-            '    anthropic + openai, 2/2). Phase 7 stays gated: granting merge authority\n' +
-            '    weakens a human-in-the-loop guarantee and refusing it settles ADR-239\n' +
-            '    Decision 3, and both are owner-reserved.\n' +
+            '    anthropic + openai, 2/2). Phase 7 was gated on this blocker; on 2026-09-01\n' +
+            '    the AI council settled ADR-239 Decision 3 in the REFUSING direction, scoped\n' +
+            '    to PREAUTHORIZED authority, and the blocker closed as `refused`. Only\n' +
+            '    `Status: resolved` AND `Disposition: granted` mint the capability, so a\n' +
+            '    refusal keeps this verb shut exactly as an open blocker did.\n' +
             '  Promotion into canonical agent-config remains a named human act performed\n' +
             '  outside this tool. This verb will not perform it.\n',
     );

package/src/scripts/generate_capability_matrix.ts

@@ -72,7 +72,7 @@ interface FnSpec {
     cells: Record<string, string>;
 }
 
-// Each condense.py dispatcher generator → what it emits, for which host(s),
+// Each condense.ts dispatcher generator → what it emits, for which host(s),
 // via which mechanism. Universal generators (symlink fan-out to every host
 // that consumes the artifact) list all consuming hosts explicitly. This is the
 // one place the host×artifact mechanism is asserted; the coverage guard below
@@ -222,10 +222,17 @@ export function render_md(matrix: Record<string, Record<string, string>>): strin
     const lines: string[] = [
         '# Capability matrix — what works on which host',
         '',
-        '> **Generated** by `generate_capability_matrix` — do NOT',
-        '> hand-edit. Derived from the `generate_tools()` projection logic in',
-        '> `condense.py` (each cell traces to a `generate_*` dispatcher call).',
-        '> Drift-checked in CI (`--check`).',
+        '> **Generated — still generated, not hand-maintained prose wearing a',
+        '> generated header.** Emitted by `src/scripts/generate_capability_matrix.ts`;',
+        '> do NOT hand-edit. Derived from the `generate_tools()` projection logic in',
+        '> `src/scripts/condense.ts` (each cell traces to a `generate_*` dispatcher',
+        '> call). Drift-checked in CI (`--check`).',
+        '>',
+        '> Until 2026-09-03 this header named two Python-era generator paths that',
+        '> have not existed since ADR-200 ended that era, so a reader checking the',
+        '> provenance of this table found dead paths and no way to tell whether',
+        '> anything still produced it. They are described rather than reproduced',
+        '> here, so every path this header names resolves.',
         '',
         'Cells: **✅ native** (host consumes the artifact directly — symlink /',
         'native dir) · **🔁 adapter** (projected through a host-specific',
@@ -337,8 +344,8 @@ interface ParsedArgs {
 class _ArgExit extends Error {}
 
 function _argError(msg: string): never {
-    process.stderr.write('usage: generate_capability_matrix.py [-h] [--check] [--quiet]\n');
-    process.stderr.write(`generate_capability_matrix.py: error: ${msg}\n`);
+    process.stderr.write('usage: generate_capability_matrix [-h] [--check] [--quiet]\n');
+    process.stderr.write(`generate_capability_matrix: error: ${msg}\n`);
     process.exitCode = 2;
     throw new _ArgExit();
 }
@@ -347,7 +354,7 @@ function parse_args(argv: string[]): ParsedArgs {
     const out: ParsedArgs = { check: false, quiet: false };
     for (const a of argv) {
         if (a === '-h' || a === '--help') {
-            process.stdout.write('usage: generate_capability_matrix.py [-h] [--check] [--quiet]\n');
+            process.stdout.write('usage: generate_capability_matrix [-h] [--check] [--quiet]\n');
             process.exitCode = 0;
             throw new _ArgExit();
         } else if (a === '--check') {
@@ -383,7 +390,7 @@ export function main(argv: string[] | null = null): number {
     const missing = coverage_guard();
     if (missing.length > 0) {
         process.stderr.write(
-            '❌  generate_capability_matrix: condense.py dispatcher has ' +
+            '❌  generate_capability_matrix: condense.ts dispatcher has ' +
                 `generator(s) not mapped in _FN_SPEC: ${_pyListRepr(missing)}. Add an _FN_SPEC ` +
                 'entry so the matrix stays derived (never silently drift).\n',
         );

package/src/scripts/grade_target_readiness.ts

@@ -7,7 +7,7 @@
  * written in a command's markdown cannot be asserted by anything. So the
  * detection is here and the command invokes it; the command keeps the narrative.
  *
- * THE ANTI-VANITY RULE IS STRUCTURAL, NOT A STYLE NOTE. Ten dimensions are
+ * THE ANTI-VANITY RULE IS STRUCTURAL, NOT A STYLE NOTE. Thirteen dimensions are
  * graded 0 Absent / 1 Present / 2 Enforced-in-CI / 3 Independent-and-diff-scoped,
  * and the verdict is `min` over the FOUR knockout dimensions, reported as
  * `L<n> — bound by <dimension>`. **No aggregate number is ever emitted** — no
@@ -113,6 +113,66 @@ function _ciText(root: string): string {
     return out;
 }
 
+/* -- bounded text corpus, for the Phase 4 dimensions ----------------------- */
+
+/** Directories a target scan must never descend into: cost with no signal. */
+const _SKIP_DIRS = new Set([
+    'node_modules', '.git', 'vendor', 'dist', 'build', 'out', 'coverage',
+    '.next', '.nuxt', '.venv', 'venv', '__pycache__', 'target', '.terraform',
+]);
+/** Extensions that can carry a DNS record, a policy doc or an ops runbook. */
+const _CORPUS_RE = /\.(tf|tfvars|hcl|ya?ml|json|txt|zone|dns|ini|conf|cfg|toml|md|env|example|sh)$/i;
+const _CORPUS_MAX_FILES = 2000;
+const _CORPUS_MAX_BYTES = 256 * 1024;
+
+/**
+ * Read a bounded slice of the target's text, once, for the dimensions that
+ * cannot be answered by a root-level `_exists` probe.
+ *
+ * Three dimensions need to see INSIDE files — a DMARC policy is a string in a
+ * zone file or a Terraform record, not a filename — and the existing probes are
+ * all filename-shaped. The walk is capped in three directions (skip list, file
+ * count, per-file bytes) because an unbounded read of an arbitrary target repo
+ * is a cost this grader has no way to predict.
+ *
+ * Returns the concatenated text AND the relative paths, because a dimension that
+ * says WHERE it saw something is auditable and one that only says "somewhere in
+ * the tree" is not.
+ */
+export function _textCorpus(root: string): { text: string; paths: string[] } {
+    const paths: string[] = [];
+    let text = '';
+    const walk = (dir: string, rel: string): void => {
+        if (paths.length >= _CORPUS_MAX_FILES) return;
+        let entries: fs.Dirent[];
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        } catch {
+            return;
+        }
+        for (const e of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+            if (paths.length >= _CORPUS_MAX_FILES) return;
+            const abs = path.join(dir, e.name);
+            const r = rel === '' ? e.name : `${rel}/${e.name}`;
+            if (e.isDirectory()) {
+                if (_SKIP_DIRS.has(e.name)) continue;
+                walk(abs, r);
+                continue;
+            }
+            if (!_CORPUS_RE.test(e.name)) continue;
+            try {
+                if (fs.statSync(abs).size > _CORPUS_MAX_BYTES) continue;
+                text += `${fs.readFileSync(abs, 'utf-8')}\n`;
+            } catch {
+                continue;
+            }
+            paths.push(r);
+        }
+    };
+    walk(root, '');
+    return { text, paths };
+}
+
 /**
  * Is this a Python-primary target?
  *
@@ -125,7 +185,7 @@ export function isPythonTarget(root: string): boolean {
     return py && !other;
 }
 
-// ── the ten dimensions ─────────────────────────────────────────────────────
+// ── the thirteen dimensions ──
 
 /**
  * Grade one dimension. `ci` decides 1 → 2: a thing that exists is `Present`; a
@@ -149,6 +209,113 @@ function _ciBlocks(ci: string, ...needles: string[]): boolean {
     return !allSoft;
 }
 
+/* -- Phase 4 dimension ladders --------------------------------------------- */
+
+interface Scored {
+    grade: Grade;
+    evidence: string;
+}
+
+/** A runbook, a restore procedure, or a rollback path — and whether CI runs it. */
+function _recovery(corpus: { text: string; paths: string[] }, ci: string): Scored {
+    const namedFile = corpus.paths.some((p) => /(^|\/)(runbook|runbooks|disaster-recovery|dr)([./-]|$)/i.test(p));
+    const procedure = /\b(restore from backup|disaster recovery|rollback plan|pg_restore|pg_dump|restic|velero|RPO|RTO)\b/i.test(corpus.text);
+    const present = namedFile || procedure;
+    const enforced = _ciBlocks(ci, 'restore', 'rollback', 'disaster-recovery', 'backup');
+    // A DRILL is what separates a documented procedure from a proven one. It is
+    // the only honest route to 3 here, because "independent" for recovery means
+    // the restore was actually exercised rather than described.
+    const drill = /\b(restore (drill|test|rehearsal)|recovery drill|game ?day)\b/i.test(corpus.text);
+    const seen: string[] = [
+        ...(namedFile ? ['a runbook or DR document'] : []),
+        ...(procedure ? ['a restore/rollback procedure in the text'] : []),
+        ...(enforced ? ['a blocking CI step naming restore/rollback/backup'] : []),
+        ...(drill ? ['a restore drill'] : []),
+    ];
+    return {
+        grade: _graded(present, enforced, drill),
+        evidence: seen.length > 0 ? seen.join('; ') : 'no runbook, restore procedure or rollback path found',
+    };
+}
+
+/**
+ * SPF, DKIM and DMARC — and the rung that must not be fudged (4.2).
+ *
+ *   0 Absent   — no SPF, DKIM or DMARC RECORD anywhere. Prose about DMARC is
+ *                not a DMARC record; the signal is the record shape.
+ *   1 Present  — SPF and/or DKIM published, OR a DMARC record with `p=none`.
+ *                `p=none` is a MONITORING policy: it requests aggregate reports
+ *                and instructs receivers to take no action on a failing message.
+ *                A domain publishing it is measuring the problem, not preventing
+ *                it, so it is capped here however much else sits alongside it.
+ *   2 Enforced — DMARC `p=quarantine` or `p=reject`, with SPF or DKIM to align
+ *                against. An enforcing policy with nothing to align is a policy
+ *                over no signal, and stays at 1.
+ *   3 Top      — `p=reject` with BOTH SPF and DKIM and an `rua=` reporting
+ *                address, so the enforcement can be observed rather than assumed.
+ */
+function _mailAuthenticity(corpus: { text: string }): Scored {
+    const t = corpus.text;
+    const spf = /v=spf1\b/i.test(t);
+    const dkim = /v=DKIM1\b/i.test(t);
+    const dmarc = /v=DMARC1\b/i.test(t);
+    const policy = /v=DMARC1[^"'\n]*?\bp\s*=\s*(none|quarantine|reject)\b/i.exec(t)?.[1]?.toLowerCase();
+    const rua = /v=DMARC1[^"'\n]*?\brua\s*=/i.test(t);
+    const aligned = spf || dkim;
+    const parts = [
+        spf ? 'SPF published' : 'no SPF record',
+        dkim ? 'DKIM published' : 'no DKIM record',
+        dmarc ? `DMARC published (p=${policy ?? 'unset'})` : 'no DMARC record',
+    ];
+    if (!spf && !dkim && !dmarc) {
+        return { grade: 0, evidence: 'no SPF, DKIM or DMARC record found in the tree' };
+    }
+    if (policy === 'none') {
+        return {
+            grade: 1,
+            evidence:
+                `${parts.join('; ')} — capped at Present: p=none is a monitoring policy and is NOT protection, ` +
+                'because receivers are told to take no action on a message that fails. A domain publishing it ' +
+                'scores below one that enforces.',
+        };
+    }
+    if (policy === 'quarantine' || policy === 'reject') {
+        if (!aligned) {
+            return {
+                grade: 1,
+                evidence: `${parts.join('; ')} — an enforcing policy with neither SPF nor DKIM to align against protects nothing yet`,
+            };
+        }
+        if (policy === 'reject' && spf && dkim && rua) {
+            return { grade: 3, evidence: `${parts.join('; ')} — enforcing, both mechanisms aligned, and reporting to an rua address` };
+        }
+        return { grade: 2, evidence: `${parts.join('; ')} — an enforcing DMARC policy with an aligned mechanism` };
+    }
+    return { grade: 1, evidence: `${parts.join('; ')} — a mail-authenticity record exists, with no enforcing DMARC policy above it` };
+}
+
+/** A privacy notice, a retention rule, a consent mechanism, a deletion path. */
+function _privacyObligations(corpus: { text: string; paths: string[] }, ci: string): Scored {
+    const notice =
+        corpus.paths.some((p) => /(privacy|datenschutz|\bdpa\b|data-processing)/i.test(p)) ||
+        /\b(privacy (policy|notice)|Datenschutzerkl)/i.test(corpus.text);
+    const retention = /\b(retention (policy|period|schedule)|data retention|storage limitation)\b/i.test(corpus.text);
+    const consent = /\b(cookie consent|consent (banner|manager|mode)|cookiebot|usercentrics|klaro|borlabs)\b/i.test(corpus.text);
+    const erasure = /\b(right to erasure|data subject request|DSAR|DSR|account deletion|delete my data)\b/i.test(corpus.text);
+    const enforced = _ciBlocks(ci, 'privacy', 'gdpr', 'retention', 'consent', 'dsar');
+    const seen: string[] = [
+        ...(notice ? ['a privacy notice or DPA'] : []),
+        ...(retention ? ['a retention rule'] : []),
+        ...(consent ? ['a consent mechanism'] : []),
+        ...(erasure ? ['an erasure / data-subject-request path'] : []),
+        ...(enforced ? ['a blocking CI step naming a privacy obligation'] : []),
+    ];
+    return {
+        grade: _graded(notice || retention || consent || erasure, enforced),
+        evidence: seen.length > 0 ? seen.join('; ') : 'no privacy notice, retention rule, consent mechanism or erasure path found',
+    };
+}
+
 export function grade(root: string): Matrix {
     const ci = _ciText(root);
     const hasCi = ci !== '';
@@ -310,6 +477,41 @@ export function grade(root: string): Matrix {
         evidence: 'out of scope by design (see the roadmap exclusion table)',
     });
 
+    // 11. operational recovery — NON-KNOCKOUT
+    //
+    // New dimensions are never knockouts. A knockout added today would re-bind
+    // every existing verdict at L0 on the day it shipped, which changes what the
+    // level MEANS while looking like a change to what it measures.
+    const corpus = _textCorpus(root);
+    const recovery = _recovery(corpus, ci);
+    dims.push({
+        id: 'operational-recovery',
+        label: 'operational recovery',
+        knockout: false,
+        grade: recovery.grade,
+        evidence: recovery.evidence,
+    });
+
+    // 12. mail authenticity — NON-KNOCKOUT, own ladder (4.2)
+    const mail = _mailAuthenticity(corpus);
+    dims.push({
+        id: 'mail-authenticity',
+        label: 'mail authenticity',
+        knockout: false,
+        grade: mail.grade,
+        evidence: mail.evidence,
+    });
+
+    // 13. privacy obligations — NON-KNOCKOUT
+    const privacy = _privacyObligations(corpus, ci);
+    dims.push({
+        id: 'privacy-obligations',
+        label: 'privacy obligations',
+        knockout: false,
+        grade: privacy.grade,
+        evidence: privacy.evidence,
+    });
+
     // ── the verdict: min over knockouts, undetectable binds at L0 ──────────
     const knockouts = dims.filter((d) => d.knockout);
     const undetectable = knockouts.find((d) => d.grade === null);
@@ -440,6 +642,23 @@ export function selfTest(): number {
                 return /%|\/100/.test(out) ? 1 : 0;
             },
         },
+        {
+            name: 'DMARC p=none scores strictly below p=quarantine — monitoring is not protection',
+            expect: 'accept',
+            run: () => {
+                const g = (zone: string): number => {
+                    const d = grade(mk({
+                        'dns/zone.txt': zone,
+                        'dns/spf.txt': '@ IN TXT "v=spf1 include:_spf.example.net -all"\n',
+                        'dns/dkim.txt': 'sel._domainkey IN TXT "v=DKIM1; k=rsa; p=MIIB"\n',
+                    }));
+                    return d.dimensions.find((x) => x.id === 'mail-authenticity')?.grade ?? -1;
+                };
+                const none = g('_dmarc IN TXT "v=DMARC1; p=none; rua=mailto:d@example.com"\n');
+                const quarantine = g('_dmarc IN TXT "v=DMARC1; p=quarantine; rua=mailto:d@example.com"\n');
+                return none === 1 && quarantine === 2 ? 0 : 1;
+            },
+        },
         {
             name: 'rejects a missing target root rather than grading an empty tree',
             expect: 'reject',