@getvda/test-suite 0.1.0

package/dist/impact.js

@@ -0,0 +1,125 @@
+/**
+ * Deterministic impact analysis (3d).
+ *
+ * Given a governance change, answer — from the data ACP actually has — which
+ * files, environments, agents, capabilities, and journeys it affects. Same input
+ * → same output; no heuristics in the counts.
+ *
+ * HONESTY about data sources: ACP can read environments/agents from governance
+ * frontmatter and from an ACP-maintained environment registry. It CANNOT yet
+ * read live admitted-agent facts from Onboarding — that skill does not exist on
+ * Onboarding's live card (verified 2026-07-18). So when the agent list is derived
+ * only from frontmatter, impact says so and marks the result incomplete, rather
+ * than implying it enumerated the real fleet.
+ *
+ * Shaped for the Phase-4 human approver, same as the honest diff.
+ */
+import { GOVERNANCE_FILE_NAMES, presentFiles, } from '@getvda/governance-schema';
+function environmentsOf(set) {
+    const envs = new Set();
+    for (const name of GOVERNANCE_FILE_NAMES) {
+        const env = set.files[name]?.parsed.frontmatter.environment;
+        if (typeof env === 'string' && env)
+            envs.add(env);
+    }
+    return envs;
+}
+function agentsFromFrontmatter(set) {
+    const agents = new Set();
+    for (const name of GOVERNANCE_FILE_NAMES) {
+        const agent = set.files[name]?.parsed.frontmatter.agent;
+        if (typeof agent === 'string' && agent)
+            agents.add(agent);
+    }
+    return agents;
+}
+function capabilityNames(set) {
+    const skill = set.files['SKILL.md'];
+    return new Map((skill?.parsed.capabilities ?? []).map((c) => [c.capability, c.conditions]));
+}
+function sameConditions(a, b) {
+    if (a.length !== b.length)
+        return false;
+    const bs = new Set(b);
+    return a.every((x) => bs.has(x));
+}
+export function computeImpact(before, after, diff, registry) {
+    const notes = [];
+    const changedFiles = diff.files.map((f) => f.file);
+    const environments = [...new Set([...environmentsOf(before), ...environmentsOf(after)])].sort();
+    // Capabilities affected: added, removed, or whose conditions changed.
+    const beforeCaps = capabilityNames(before);
+    const afterCaps = capabilityNames(after);
+    const affectedCaps = new Set();
+    for (const [name, conds] of afterCaps) {
+        const prev = beforeCaps.get(name);
+        if (prev === undefined || !sameConditions(prev, conds))
+            affectedCaps.add(name);
+    }
+    for (const name of beforeCaps.keys()) {
+        if (!afterCaps.has(name))
+            affectedCaps.add(name);
+    }
+    // Clause impact — deterministic deltas across the SOP fingerprint.
+    const bSop = before.files['SOP.md']?.fingerprint;
+    const aSop = after.files['SOP.md']?.fingerprint;
+    const clauseImpact = {
+        mustDelta: (aSop?.mustCount ?? 0) - (bSop?.mustCount ?? 0),
+        mustNotDelta: (aSop?.mustNotCount ?? 0) - (bSop?.mustNotCount ?? 0),
+        citationsChanged: [...diff.summary.citationsDropped, ...diff.summary.citationsAdded].sort(),
+    };
+    // Agents — registry first, else frontmatter (incomplete), else none.
+    const agents = resolveAgents(environments, after, before, registry, notes);
+    // Journeys — only from the registry; otherwise honestly undetermined.
+    let journeys = 'undetermined';
+    if (registry) {
+        const js = new Set();
+        for (const env of environments) {
+            const entry = registry.environments.find((e) => e.id === env);
+            for (const j of entry?.journeys ?? [])
+                js.add(j);
+        }
+        journeys = js.size ? [...js].sort() : 'undetermined';
+    }
+    else {
+        notes.push('Journeys undetermined: no environment registry provided.');
+    }
+    return {
+        changedFiles,
+        environments,
+        agents,
+        capabilitiesAffected: [...affectedCaps].sort(),
+        clauseImpact,
+        journeys,
+        notes,
+    };
+}
+function resolveAgents(environments, after, before, registry, notes) {
+    if (registry) {
+        const agents = new Set();
+        let coveredAll = true;
+        for (const env of environments) {
+            const entry = registry.environments.find((e) => e.id === env);
+            if (!entry) {
+                coveredAll = false;
+                continue;
+            }
+            for (const a of entry.agents)
+                agents.add(a);
+        }
+        if (!coveredAll) {
+            notes.push('Some affected environments are not in the registry; agent list may be incomplete.');
+        }
+        return { agents: [...agents].sort(), source: 'registry', complete: coveredAll };
+    }
+    const fromFm = new Set([...agentsFromFrontmatter(after), ...agentsFromFrontmatter(before)]);
+    if (fromFm.size > 0) {
+        notes.push('Agent list derived from governance frontmatter and may be incomplete: Onboarding admitted-agent facts are not yet available (Phase 2–6 staged, verified 2026-07-18).');
+        return { agents: [...fromFm].sort(), source: 'frontmatter', complete: false };
+    }
+    notes.push('Affected agents unknown: no environment registry, and no agent named in governance frontmatter. ' +
+        'Onboarding admitted-agent facts not yet available.');
+    void presentFiles; // reserved for future per-file agent attribution
+    return { agents: [], source: 'none', complete: false };
+}
+//# sourceMappingURL=impact.js.map

package/dist/impact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"impact.js","sourceRoot":"","sources":["../src/impact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,qBAAqB,EACrB,YAAY,GAGb,MAAM,2BAA2B,CAAC;AAoCnC,SAAS,cAAc,CAAC,GAAkB;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC;QAC5D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAkB;IAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC;QACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,GAAkB;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACpC,OAAO,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,cAAc,CAAC,CAAoB,EAAE,CAAoB;IAChE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACtB,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,MAAqB,EACrB,KAAoB,EACpB,IAAoB,EACpB,QAA8B;IAE9B,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEnD,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAEhG,sEAAsE;IACtE,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAED,mEAAmE;IACnE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChD,MAAM,YAAY,GAAG;QACnB,SAAS,EAAE,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,CAAC;QAC1D,YAAY,EAAE,CAAC,IAAI,EAAE,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,IAAI,CAAC,CAAC;QACnE,gBAAgB,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE;KAC5F,CAAC;IAEF,qEAAqE;IACrE,MAAM,MAAM,GAAG,aAAa,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE3E,sEAAsE;IACtE,IAAI,QAAQ,GAAuC,cAAc,CAAC;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;YAC9D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,QAAQ,IAAI,EAAE;gBAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,QAAQ,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACzE,CAAC;IAED,OAAO;QACL,YAAY;QACZ,YAAY;QACZ,MAAM;QACN,oBAAoB,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE;QAC9C,YAAY;QACZ,QAAQ;QACR,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,YAA+B,EAC/B,KAAoB,EACpB,MAAqB,EACrB,QAAyC,EACzC,KAAe;IAEf,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,IAAI,UAAU,GAAG,IAAI,CAAC;QACtB,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;YAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,UAAU,GAAG,KAAK,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CACR,mFAAmF,CACpF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IAClF,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,qBAAqB,CAAC,KAAK,CAAC,EAAE,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5F,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CACR,sKAAsK,CACvK,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,IAAI,CACR,kGAAkG;QAChG,oDAAoD,CACvD,CAAC;IACF,KAAK,YAAY,CAAC,CAAC,iDAAiD;IACpE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACzD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @getvda/test-suite — the ACP governance CI test suite.
+ *
+ * Provider-free (schema + guard only). One machine-readable TestSuiteResult, one
+ * human renderer over it. Invocable as a step in the customer's own CI via the
+ * `acp-test` CLI (see cli.ts) or embedded via `runTestSuite`.
+ */
+export { runTestSuite, type RunSuiteInput, type RunSuiteOptions } from './suite.js';
+export { statusOf, type StepId, type StepResult, type StepStatus, type SuiteFinding, type FindingSeverity, type TestSuiteMeta, type TestSuiteResult, } from './types.js';
+export { runScenarios, type ScenarioPolicy } from './scenarios.js';
+export { computeImpact, type ImpactAnalysis, type AffectedAgents, type EnvironmentRegistry, type EnvironmentRegistryEntry, } from './impact.js';
+export { onboardingSandboxStub, type SandboxEvaluator, type SandboxContext, type SandboxResult, type SandboxStatus, } from './sandbox.js';
+export { renderSuiteForHuman, toJson } from './render.js';
+export { judgeCondition, judgeConditions, type ConditionVerdict } from './condition.js';
+export { TRAILER_KEY, describeProof, formatSignoffTrailer, parseSignoffTrailers, toSignOffs, type SignoffProof, type TrailerSignoff, } from './signoff-trailer.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAEpF,OAAO,EACL,QAAQ,EACR,KAAK,MAAM,EACX,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,eAAe,GACrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EACL,aAAa,EACb,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACxF,OAAO,EACL,WAAW,EACX,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,UAAU,EACV,KAAK,YAAY,EACjB,KAAK,cAAc,GACpB,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -0,0 +1,16 @@
+/**
+ * @getvda/test-suite — the ACP governance CI test suite.
+ *
+ * Provider-free (schema + guard only). One machine-readable TestSuiteResult, one
+ * human renderer over it. Invocable as a step in the customer's own CI via the
+ * `acp-test` CLI (see cli.ts) or embedded via `runTestSuite`.
+ */
+export { runTestSuite } from './suite.js';
+export { statusOf, } from './types.js';
+export { runScenarios } from './scenarios.js';
+export { computeImpact, } from './impact.js';
+export { onboardingSandboxStub, } from './sandbox.js';
+export { renderSuiteForHuman, toJson } from './render.js';
+export { judgeCondition, judgeConditions } from './condition.js';
+export { TRAILER_KEY, describeProof, formatSignoffTrailer, parseSignoffTrailers, toSignOffs, } from './signoff-trailer.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAA4C,MAAM,YAAY,CAAC;AAEpF,OAAO,EACL,QAAQ,GAQT,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,YAAY,EAAuB,MAAM,gBAAgB,CAAC;AACnE,OAAO,EACL,aAAa,GAKd,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,GAKtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAyB,MAAM,gBAAgB,CAAC;AACxF,OAAO,EACL,WAAW,EACX,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,UAAU,GAGX,MAAM,sBAAsB,CAAC"}

package/dist/render.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The ONE renderer over TestSuiteResult.
+ *
+ * The machine-readable output is the TestSuiteResult itself (JSON). This is the
+ * single human renderer over that same object — the verdict a human reads and the
+ * verdict a machine reads come from ONE result, and this is the ONLY code that
+ * turns it into prose. No second renderer, no divergent "did it pass" logic.
+ *
+ * Reuses the Compliance Guard's human diff renderer for the diff section, so even
+ * the change description has a single implementation.
+ */
+import type { TestSuiteResult } from './types.js';
+/** Machine-readable output: the result as canonical JSON. */
+export declare function toJson(result: TestSuiteResult): string;
+/** Human-readable summary for the CI log and the Phase-4 approver surface. */
+export declare function renderSuiteForHuman(result: TestSuiteResult): string;
+//# sourceMappingURL=render.d.ts.map

package/dist/render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAc,eAAe,EAAE,MAAM,YAAY,CAAC;AAW9D,6DAA6D;AAC7D,wBAAgB,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAEtD;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CA4BnE"}

package/dist/render.js

@@ -0,0 +1,65 @@
+/**
+ * The ONE renderer over TestSuiteResult.
+ *
+ * The machine-readable output is the TestSuiteResult itself (JSON). This is the
+ * single human renderer over that same object — the verdict a human reads and the
+ * verdict a machine reads come from ONE result, and this is the ONLY code that
+ * turns it into prose. No second renderer, no divergent "did it pass" logic.
+ *
+ * Reuses the Compliance Guard's human diff renderer for the diff section, so even
+ * the change description has a single implementation.
+ */
+import { renderDiffForHuman } from '@getvda/compliance-guard';
+const STATUS_MARK = {
+    pass: '✓ PASS',
+    fail: '✗ FAIL',
+    warn: '! WARN',
+    skip: '– SKIP',
+    info: 'ℹ INFO',
+};
+/** Machine-readable output: the result as canonical JSON. */
+export function toJson(result) {
+    return JSON.stringify(result, null, 2);
+}
+/** Human-readable summary for the CI log and the Phase-4 approver surface. */
+export function renderSuiteForHuman(result) {
+    const lines = [];
+    lines.push(result.ok ? '✓ ACP governance test suite: PASSED' : '✗ ACP governance test suite: FAILED');
+    lines.push(`contract ${result.meta.contractVersion} · source ${result.meta.source}`);
+    lines.push('');
+    for (const step of result.steps) {
+        lines.push(`${STATUS_MARK[step.status]}  ${step.title}`);
+        for (const f of step.findings) {
+            const tag = f.severity === 'error' ? '✗' : f.severity === 'warning' ? '!' : '·';
+            const heur = f.heuristic ? ' (heuristic)' : '';
+            const where = f.file ? ` [${f.file}]` : '';
+            lines.push(`     ${tag}${where} ${f.message}${heur}`);
+            if (f.detail)
+                lines.push(`         ${f.detail}`);
+        }
+    }
+    lines.push('');
+    lines.push('── What changed (meaning) ──');
+    lines.push(renderDiffForHuman(result.diff));
+    lines.push('');
+    lines.push('── Impact ──');
+    lines.push(renderImpact(result.impact));
+    return lines.join('\n');
+}
+function renderImpact(impact) {
+    const lines = [];
+    lines.push(`Files:        ${impact.changedFiles.join(', ') || '(none)'}`);
+    lines.push(`Environments: ${impact.environments.join(', ') || '(none named)'}`);
+    const agentNote = impact.agents.complete ? '' : ' (may be incomplete)';
+    lines.push(`Agents:       ${impact.agents.agents.join(', ') || 'unknown'} — from ${impact.agents.source}${agentNote}`);
+    if (impact.capabilitiesAffected.length) {
+        lines.push(`Capabilities: ${impact.capabilitiesAffected.join(', ')}`);
+    }
+    lines.push(`Clauses:      MUST ${signed(impact.clauseImpact.mustDelta)}, MUST NOT ${signed(impact.clauseImpact.mustNotDelta)}`);
+    lines.push(`Journeys:     ${impact.journeys === 'undetermined' ? 'undetermined' : impact.journeys.join(', ')}`);
+    return lines.join('\n');
+}
+function signed(n) {
+    return n > 0 ? `+${n}` : String(n);
+}
+//# sourceMappingURL=render.js.map

package/dist/render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAI9D,MAAM,WAAW,GAA+B;IAC9C,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,QAAQ;CACf,CAAC;AAEF,6DAA6D;AAC7D,MAAM,UAAU,MAAM,CAAC,MAAuB;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CAAC,MAAuB;IACzD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,qCAAqC,CAC1F,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,IAAI,CAAC,eAAe,aAAa,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACrF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACzD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAChF,MAAM,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,QAAQ,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAExC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,MAAsB;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC1E,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC;IACvE,KAAK,CAAC,IAAI,CACR,iBAAiB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,WAAW,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,CAC3G,CAAC;IACF,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,KAAK,CAAC,IAAI,CACR,sBAAsB,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,cAAc,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,CACpH,CAAC;IACF,KAAK,CAAC,IAAI,CACR,iBAAiB,MAAM,CAAC,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpG,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC"}

package/dist/sandbox.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The agent-behavioral sandbox seam (3c, delegated).
+ *
+ * A DIFFERENT check from ACP's own governance-level scenarios: "does this change
+ * break an ADMITTED AGENT's runtime decisions?" That needs an agent sandbox —
+ * Onboarding's Phase 5. Which, verified on Onboarding's live card on 2026-07-18,
+ * is STAGED / pass-through: `admit_agent` documents phases 2–6 as not executing
+ * live evaluation ("Do not rely on it as current capability"). It seals a
+ * not_implemented agent_action; it does not run scenarios.
+ *
+ * So ACP ships the SEAM and an HONEST stub that reports `not_available` — never a
+ * fake pass. When Onboarding's sandbox goes live, drop in a real evaluator here;
+ * nothing else in the suite changes.
+ */
+export type SandboxStatus = 'not_available' | 'passed' | 'failed';
+export interface SandboxResult {
+    readonly status: SandboxStatus;
+    /** Present only when status is passed/failed. */
+    readonly passRate?: number;
+    readonly reason: string;
+    readonly provider: string;
+}
+export interface SandboxContext {
+    readonly environment?: string;
+    readonly changedFiles: readonly string[];
+}
+export interface SandboxEvaluator {
+    evaluate(ctx: SandboxContext): Promise<SandboxResult>;
+}
+/** The honest stub — reports the real state of Onboarding Phase 5. */
+export declare const onboardingSandboxStub: SandboxEvaluator;
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,aAAa,GAAG,eAAe,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAElE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACvD;AAED,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,EAAE,gBAYnC,CAAC"}

package/dist/sandbox.js

@@ -0,0 +1,28 @@
+/**
+ * The agent-behavioral sandbox seam (3c, delegated).
+ *
+ * A DIFFERENT check from ACP's own governance-level scenarios: "does this change
+ * break an ADMITTED AGENT's runtime decisions?" That needs an agent sandbox —
+ * Onboarding's Phase 5. Which, verified on Onboarding's live card on 2026-07-18,
+ * is STAGED / pass-through: `admit_agent` documents phases 2–6 as not executing
+ * live evaluation ("Do not rely on it as current capability"). It seals a
+ * not_implemented agent_action; it does not run scenarios.
+ *
+ * So ACP ships the SEAM and an HONEST stub that reports `not_available` — never a
+ * fake pass. When Onboarding's sandbox goes live, drop in a real evaluator here;
+ * nothing else in the suite changes.
+ */
+/** The honest stub — reports the real state of Onboarding Phase 5. */
+export const onboardingSandboxStub = {
+    async evaluate() {
+        return {
+            status: 'not_available',
+            reason: 'Onboarding Phase 5 adversarial sandbox is staged/pass-through (verified 2026-07-18): ' +
+                'it seals a not_implemented agent_action and does not run scenarios. Agent-behavioral ' +
+                'eval is therefore not available; ACP governance-level scenarios ran instead (see the ' +
+                'scenarios step).',
+            provider: 'onboarding:did:web:onboard.getvda.ai',
+        };
+    },
+};
+//# sourceMappingURL=sandbox.js.map

package/dist/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAqBH,sEAAsE;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAqB;IACrD,KAAK,CAAC,QAAQ;QACZ,OAAO;YACL,MAAM,EAAE,eAAe;YACvB,MAAM,EACJ,uFAAuF;gBACvF,uFAAuF;gBACvF,uFAAuF;gBACvF,kBAAkB;YACpB,QAAQ,EAAE,sCAAsC;SACjD,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/scenarios.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Governance-level adversarial scenario runner (3c) — ACP's own crown jewel.
+ *
+ * Static analysis over the governance documents (NOT an agent sandbox). It asks
+ * the adversarial questions a reviewer would:
+ *   SC-1a unconditioned capability — a permission with NO conditions (structural,
+ *         CERTAIN → blocking).
+ *   SC-1b conditioned in name only — conditions exist but cannot be false, e.g.
+ *         "always permitted" (structural where provable → blocking; otherwise a
+ *         heuristic warning). Counting conditions is defeatable by writing a
+ *         word; SC-1b asks whether the condition can ever fail. See condition.ts
+ *         for the rule, and for why prose conditions are a bridge rather than
+ *         the destination.
+ *   SC-2  prohibition ↔ permission conflict — an SOP "MUST NOT <x>" whose subject
+ *         overlaps a granted capability (heuristic → warning; flagged when the
+ *         change NEWLY introduces the conflict — "permit something previously
+ *         denied").
+ *   SC-3  contradictory obligations — a "MUST <x>" and a "MUST NOT <x>" on the
+ *         same subject (heuristic → warning).
+ *
+ * Certainty is labelled honestly: SC-1a and a proven-vacuous SC-1b are structural
+ * (a proof); an undecidable SC-1b, SC-2 and SC-3 are keyword heuristics
+ * (best-effort flags for a human), never presented as proofs.
+ */
+import { type GovernanceSet } from '@getvda/governance-schema';
+import type { SuiteFinding } from './types.js';
+export interface ScenarioPolicy {
+    /** Capability names allowed to be unconditioned (e.g. "escalate_to_human"). */
+    readonly allowUnconditioned?: readonly string[];
+    /** Shared-token threshold for the heuristic conflict detectors. Default 2. */
+    readonly conflictTokenThreshold?: number;
+}
+export declare function runScenarios(before: GovernanceSet, after: GovernanceSet, policy?: ScenarioPolicy): SuiteFinding[];
+//# sourceMappingURL=scenarios.d.ts.map

package/dist/scenarios.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scenarios.d.ts","sourceRoot":"","sources":["../src/scenarios.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAC;AACtF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG/C,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,8EAA8E;IAC9E,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAC1C;AA8FD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,aAAa,EACpB,MAAM,CAAC,EAAE,cAAc,GACtB,YAAY,EAAE,CAuGhB"}

package/dist/scenarios.js

@@ -0,0 +1,209 @@
+/**
+ * Governance-level adversarial scenario runner (3c) — ACP's own crown jewel.
+ *
+ * Static analysis over the governance documents (NOT an agent sandbox). It asks
+ * the adversarial questions a reviewer would:
+ *   SC-1a unconditioned capability — a permission with NO conditions (structural,
+ *         CERTAIN → blocking).
+ *   SC-1b conditioned in name only — conditions exist but cannot be false, e.g.
+ *         "always permitted" (structural where provable → blocking; otherwise a
+ *         heuristic warning). Counting conditions is defeatable by writing a
+ *         word; SC-1b asks whether the condition can ever fail. See condition.ts
+ *         for the rule, and for why prose conditions are a bridge rather than
+ *         the destination.
+ *   SC-2  prohibition ↔ permission conflict — an SOP "MUST NOT <x>" whose subject
+ *         overlaps a granted capability (heuristic → warning; flagged when the
+ *         change NEWLY introduces the conflict — "permit something previously
+ *         denied").
+ *   SC-3  contradictory obligations — a "MUST <x>" and a "MUST NOT <x>" on the
+ *         same subject (heuristic → warning).
+ *
+ * Certainty is labelled honestly: SC-1a and a proven-vacuous SC-1b are structural
+ * (a proof); an undecidable SC-1b, SC-2 and SC-3 are keyword heuristics
+ * (best-effort flags for a human), never presented as proofs.
+ */
+import { GOVERNANCE_FILE_NAMES } from '@getvda/governance-schema';
+import { judgeConditions } from './condition.js';
+const STOPWORDS = new Set([
+    'the',
+    'agent',
+    'must',
+    'not',
+    'may',
+    'and',
+    'for',
+    'with',
+    'that',
+    'this',
+    'any',
+    'all',
+    'its',
+    'are',
+    'was',
+    'will',
+    'shall',
+    'from',
+    'into',
+    'when',
+    'than',
+    'then',
+    'every',
+    'each',
+    'without',
+    'within',
+    'have',
+    'has',
+    'been',
+    'a',
+    'an',
+    'to',
+    'of',
+    'in',
+    'on',
+    'is',
+    'be',
+    'or',
+    'no',
+    'it',
+    'as',
+    'by',
+    'at',
+    'if',
+    'do',
+    'does',
+]);
+/** Significant lowercased tokens (len ≥ 4, non-stopword) for overlap heuristics. */
+function tokens(text) {
+    const out = new Set();
+    for (const raw of text.toLowerCase().split(/[^a-z0-9]+/)) {
+        if (raw.length >= 4 && !STOPWORDS.has(raw))
+            out.add(raw);
+    }
+    return out;
+}
+function overlap(a, b) {
+    return [...a].filter((x) => b.has(x));
+}
+/** Detect prohibition↔permission conflicts in a single set (heuristic). */
+function detectConflicts(set, threshold) {
+    const sop = set.files['SOP.md'];
+    const skill = set.files['SKILL.md'];
+    if (!sop || !skill)
+        return [];
+    const conflicts = [];
+    const prohibitions = sop.parsed.clauses.filter((c) => c.modality === 'MUST NOT');
+    for (const p of prohibitions) {
+        const pTokens = tokens(p.text);
+        for (const cap of skill.parsed.capabilities) {
+            const capText = `${cap.capability} ${cap.conditions.join(' ')}`;
+            const shared = overlap(pTokens, tokens(capText));
+            if (shared.length >= threshold) {
+                conflicts.push({ prohibition: p.text, capability: cap.capability, shared });
+            }
+        }
+    }
+    return conflicts;
+}
+function conflictKey(c) {
+    return `${c.capability}::${c.prohibition}`;
+}
+export function runScenarios(before, after, policy) {
+    const findings = [];
+    const threshold = policy?.conflictTokenThreshold ?? 2;
+    const allow = new Set(policy?.allowUnconditioned ?? []);
+    // SC-1a — unconditioned capability (structural, certain, blocking error).
+    // SC-1b — conditioned in name only: the conditions exist but do not constrain.
+    //
+    // SC-1a alone was defeatable by writing a word: a capability conditioned on
+    // "always permitted" passes a length check while meaning the opposite. SC-1b
+    // asks the real question — can this condition ever be false?
+    const skill = after.files['SKILL.md'];
+    for (const cap of skill?.parsed.capabilities ?? []) {
+        if (allow.has(cap.capability))
+            continue;
+        if (cap.conditions.length === 0) {
+            findings.push({
+                severity: 'error',
+                code: 'unconditioned_capability',
+                message: `Capability "${cap.capability}" is granted with NO conditions.`,
+                detail: 'An unconditioned capability is an unbounded permission. Add a condition or allowlist it.',
+                file: 'SKILL.md',
+            });
+            continue;
+        }
+        const judged = judgeConditions(cap.conditions);
+        if (judged.verdict === 'vacuous') {
+            // Still structural and certain: every condition is a tautology, so the
+            // capability is unbounded in substance even though the array is not empty.
+            findings.push({
+                severity: 'error',
+                code: 'vacuously_conditioned_capability',
+                message: `Capability "${cap.capability}" is conditioned in name only.`,
+                detail: `Condition(s) ${judged.vacuous.map((c) => `"${c}"`).join(', ')} cannot be false, ` +
+                    'so they do not constrain anything. A condition that cannot fail is not a condition — ' +
+                    'state what must hold for the capability to apply.',
+                file: 'SKILL.md',
+            });
+            continue;
+        }
+        if (judged.verdict === 'indeterminate') {
+            // Deliberately a WARNING, and deliberately labelled heuristic. Whether
+            // prose constrains is a semantic judgement; asserting a verdict we do not
+            // have would be the same failure this check exists to catch.
+            findings.push({
+                severity: 'warning',
+                code: 'condition_may_not_constrain',
+                message: `Capability "${cap.capability}" may be conditioned in name only.`,
+                detail: `Could not tell whether ${judged.indeterminate.map((c) => `"${c}"`).join(', ')} ` +
+                    'actually constrains the capability. Heuristic over prose (English-only vocabulary) — ' +
+                    'a human should confirm. See condition.ts for the rule and its known limits.',
+                file: 'SKILL.md',
+                heuristic: true,
+            });
+        }
+    }
+    // SC-2 — prohibition ↔ permission conflict (heuristic, warning).
+    const beforeConflicts = new Set(detectConflicts(before, threshold).map(conflictKey));
+    for (const c of detectConflicts(after, threshold)) {
+        const isNew = !beforeConflicts.has(conflictKey(c));
+        findings.push({
+            severity: 'warning',
+            code: isNew ? 'newly_permitted_conflict' : 'prohibition_permission_conflict',
+            message: isNew
+                ? `This change may PERMIT something previously denied: capability "${c.capability}" overlaps prohibition "${trim(c.prohibition)}".`
+                : `Capability "${c.capability}" may conflict with prohibition "${trim(c.prohibition)}".`,
+            detail: `Shared terms: ${c.shared.join(', ')}. Heuristic — confirm manually.`,
+            file: 'SKILL.md',
+            heuristic: true,
+        });
+    }
+    // SC-3 — contradictory obligations (heuristic, warning).
+    const sop = after.files['SOP.md'];
+    if (sop) {
+        const musts = sop.parsed.clauses.filter((c) => c.modality === 'MUST');
+        const mustNots = sop.parsed.clauses.filter((c) => c.modality === 'MUST NOT');
+        for (const mn of mustNots) {
+            const mnTokens = tokens(mn.text);
+            for (const m of musts) {
+                const shared = overlap(mnTokens, tokens(m.text));
+                if (shared.length >= threshold + 1) {
+                    findings.push({
+                        severity: 'warning',
+                        code: 'contradictory_obligations',
+                        message: `Possible contradiction: "${trim(m.text)}" vs "${trim(mn.text)}".`,
+                        detail: `Shared terms: ${shared.join(', ')}. Heuristic — confirm manually.`,
+                        file: 'SOP.md',
+                        heuristic: true,
+                    });
+                }
+            }
+        }
+    }
+    return findings;
+}
+function trim(s) {
+    return s.length > 70 ? `${s.slice(0, 67)}…` : s;
+}
+// keep the taxonomy import meaningful for future per-file scenarios
+void GOVERNANCE_FILE_NAMES;
+//# sourceMappingURL=scenarios.js.map

package/dist/scenarios.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scenarios.js","sourceRoot":"","sources":["../src/scenarios.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,qBAAqB,EAAsB,MAAM,2BAA2B,CAAC;AAEtF,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AASjD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,KAAK;IACL,OAAO;IACP,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,SAAS;IACT,QAAQ;IACR,MAAM;IACN,KAAK;IACL,MAAM;IACN,GAAG;IACH,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,MAAM;CACP,CAAC,CAAC;AAEH,oFAAoF;AACpF,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,CAAc,EAAE,CAAc;IAC7C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAQD,2EAA2E;AAC3E,SAAS,eAAe,CAAC,GAAkB,EAAE,SAAiB;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,SAAS,GAA0B,EAAE,CAAC;IAC5C,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YACjD,IAAI,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC/B,SAAS,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,CAAsB;IACzC,OAAO,GAAG,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,MAAqB,EACrB,KAAoB,EACpB,MAAuB;IAEvB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,EAAE,sBAAsB,IAAI,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC;IAExD,0EAA0E;IAC1E,+EAA+E;IAC/E,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,SAAS;QAExC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,0BAA0B;gBAChC,OAAO,EAAE,eAAe,GAAG,CAAC,UAAU,kCAAkC;gBACxE,MAAM,EACJ,0FAA0F;gBAC5F,IAAI,EAAE,UAAU;aACjB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE/C,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACjC,uEAAuE;YACvE,2EAA2E;YAC3E,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,kCAAkC;gBACxC,OAAO,EAAE,eAAe,GAAG,CAAC,UAAU,gCAAgC;gBACtE,MAAM,EACJ,gBAAgB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB;oBAClF,uFAAuF;oBACvF,mDAAmD;gBACrD,IAAI,EAAE,UAAU;aACjB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;YACvC,uEAAuE;YACvE,0EAA0E;YAC1E,6DAA6D;YAC7D,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,eAAe,GAAG,CAAC,UAAU,oCAAoC;gBAC1E,MAAM,EACJ,0BAA0B,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBACjF,uFAAuF;oBACvF,6EAA6E;gBAC/E,IAAI,EAAE,UAAU;gBAChB,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IACrF,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,iCAAiC;YAC5E,OAAO,EAAE,KAAK;gBACZ,CAAC,CAAC,mEAAmE,CAAC,CAAC,UAAU,2BAA2B,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI;gBACnI,CAAC,CAAC,eAAe,CAAC,CAAC,UAAU,oCAAoC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI;YAC1F,MAAM,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC;YAC7E,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAED,yDAAyD;IACzD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;QAC7E,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjD,IAAI,MAAM,CAAC,MAAM,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;oBACnC,QAAQ,CAAC,IAAI,CAAC;wBACZ,QAAQ,EAAE,SAAS;wBACnB,IAAI,EAAE,2BAA2B;wBACjC,OAAO,EAAE,4BAA4B,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI;wBAC3E,MAAM,EAAE,iBAAiB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC;wBAC3E,IAAI,EAAE,QAAQ;wBACd,SAAS,EAAE,IAAI;qBAChB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,IAAI,CAAC,CAAS;IACrB,OAAO,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,oEAAoE;AACpE,KAAK,qBAAqB,CAAC"}