@mneme-ai/core 3.89.0 → 3.91.0

package/dist/arch_firewall/arch_firewall.test.js

@@ -1,59 +1,81 @@
 import { describe, it, expect } from "vitest";
-import { firewall, parsePolicy, severityFromAge, firewallReport, archFirewallGauntlet } from "./index.js";
+import { firewall, parsePolicy, loadPolicy, scoreSeverity, firewallReport, archFirewallGauntlet, DEFAULT_POLICY } from "./index.js";
 const baseline = [
     { path: "schema.prisma", content: "model Wallet { id Int @id }\nmodel Note { id Int @id }" },
     { path: "a.ts", content: "export function charge(){ return prisma.wallet.create({data:{}}); }\nexport function readNote(){ return prisma.note.findMany(); }" },
 ];
 const broke = [...baseline, { path: "refund.ts", content: "export function refundHandler(){ return prisma.wallet.update({where:{}}); }" }];
+const oldAge = () => ({ ageDays: 875, establishedAt: "a1b2c3", heldThroughCommits: 312 });
+const youngAge = () => ({ ageDays: 3 });
 describe("arch_firewall", () => {
     it("gauntlet is 100", () => expect(archFirewallGauntlet().score).toBe(100));
-    it("BLOCKS a broken old contract, names the offending writer + history", () => {
-        const v = firewall(baseline, broke, { ageResolver: () => ({ ageDays: 426, establishedAt: "a1b2c3", heldThroughCommits: 312 }) });
+    it("BLOCKS an old contract (base high +2 ⇒ critical), names the writer + history", () => {
+        const v = firewall(baseline, broke, DEFAULT_POLICY, { ageResolver: oldAge });
         expect(v.verdict).toBe("BLOCK");
-        expect(v.critical).toBe(1);
-        expect(v.violations[0].counterexample).toMatch(/refundHandler/);
-        expect(v.violations[0].heldThroughCommits).toBe(312);
+        expect(v.findings[0].finalSeverity).toBe("critical");
+        expect(v.findings[0].counterexample).toMatch(/refundHandler/);
+        expect(v.findings[0].heldThroughCommits).toBe(312);
         expect(firewallReport(v)).toMatch(/BLOCKED/);
     });
-    it("treats a broken YOUNG contract as evolution (info, not blocked)", () => {
-        const v = firewall(baseline, broke, { ageResolver: () => ({ ageDays: 3 }) });
+    it("WARNs (not BLOCK) for a young contract (base high +0 ⇒ high)", () => {
+        const v = firewall(baseline, broke, DEFAULT_POLICY, { ageResolver: youngAge });
+        expect(v.verdict).toBe("WARN");
+        expect(v.findings[0].finalSeverity).toBe("high");
+    });
+    it("a waiver suppresses the block", () => {
+        const pol = parsePolicy("waive table wallet single-writer :: dual-writer approved in RFC-42");
+        const v = firewall(baseline, broke, pol, { ageResolver: oldAge, today: "2026-06-11" });
         expect(v.verdict).not.toBe("BLOCK");
-        expect(v.violations[0].severity).toBe("info");
+        expect(v.findings[0].waived).toBe(true);
+        expect(v.findings[0].waiverReason).toMatch(/RFC-42/);
     });
-    it("a declared-critical policy overrides age and forces BLOCK", () => {
-        const v = firewall(baseline, broke, { policies: parsePolicy("critical table wallet single-writer"), ageResolver: () => ({ ageDays: 3 }) });
+    it("an EXPIRED waiver is NOT honoured — block stands + surfaced", () => {
+        const pol = parsePolicy("waive until=2025-01-01 table wallet single-writer :: temporary");
+        const v = firewall(baseline, broke, pol, { ageResolver: oldAge, today: "2026-06-11" });
         expect(v.verdict).toBe("BLOCK");
-        expect(v.violations[0].severity).toBe("critical");
+        expect(v.findings[0].waiverExpired).toBe(true);
+        expect(v.expiredWaivers.length).toBe(1);
     });
     it("PASSES when nothing regressed", () => {
-        const v = firewall(baseline, baseline, { ageResolver: () => ({ ageDays: 999 }) });
+        const v = firewall(baseline, baseline, DEFAULT_POLICY, { ageResolver: oldAge });
         expect(v.verdict).toBe("PASS");
-        expect(v.violations.length).toBe(0);
-    });
-    it("parsePolicy: severity prefix + default warn + comments", () => {
-        const p = parsePolicy("# header\ncritical table wallet single-writer\nwarn endpoint POST /x exists\ntable note private\n   \n");
-        expect(p.length).toBe(3);
-        expect(p[0].severity).toBe("critical");
-        expect(p[1].severity).toBe("warn");
-        expect(p[2].severity).toBe("warn"); // default
-        expect(p[2].rule).toBe("table note private");
-    });
-    it("severityFromAge thresholds", () => {
-        expect(severityFromAge(400)).toBe("critical");
-        expect(severityFromAge(120)).toBe("warn");
-        expect(severityFromAge(5)).toBe("info");
-        expect(severityFromAge(null)).toBe("warn");
-        expect(severityFromAge(undefined)).toBe("warn");
-    });
-    it("verdict is the worst severity present (critical > warn > info)", () => {
-        // declare wallet warn (so the regression is warn, not age-critical) → WARN verdict
-        const v = firewall(baseline, broke, { policies: parsePolicy("warn table wallet single-writer"), ageResolver: () => ({ ageDays: 999 }) });
-        expect(v.verdict).toBe("WARN");
+        expect(v.clean).toBe(true);
+    });
+    it("scoreSeverity: age bump, flicker cap, UNKNOWN penalty", () => {
+        expect(scoreSeverity({ base: "high", status: "VIOLATED", ageDays: 800, flickered: false, ageWeight: true, ageTiers: DEFAULT_POLICY.ageTiers }).final).toBe("critical"); // +2
+        expect(scoreSeverity({ base: "medium", status: "VIOLATED", ageDays: 800, flickered: false, ageWeight: true, ageTiers: DEFAULT_POLICY.ageTiers }).final).toBe("critical"); // medium +2
+        expect(scoreSeverity({ base: "medium", status: "VIOLATED", ageDays: 800, flickered: true, ageWeight: true, ageTiers: DEFAULT_POLICY.ageTiers }).final).toBe("high"); // flicker caps +2→+1
+        expect(scoreSeverity({ base: "high", status: "UNKNOWN", ageDays: 3, flickered: false, ageWeight: true, ageTiers: DEFAULT_POLICY.ageTiers }).final).toBe("medium"); // +0 −1
+        expect(scoreSeverity({ base: "medium", status: "VIOLATED", ageDays: 200, flickered: false, ageWeight: true, ageTiers: DEFAULT_POLICY.ageTiers }).final).toBe("high"); // +1
+    });
+    it("parsePolicy: directives + enforce + waiver(+until)", () => {
+        const p = parsePolicy("# header\nname payments\nblockon high\ndefault single-writer critical\nagetier 30 1\ncritical table x single-writer\nwaive until=2030-01-01 table y private :: ok");
+        expect(p.name).toBe("payments");
+        expect(p.blockOn).toBe("high");
+        expect(p.defaults["single-writer"]).toBe("critical");
+        expect(p.enforce.length).toBe(1);
+        expect(p.enforce[0].severity).toBe("critical");
+        expect(p.waivers[0].until).toBe("2030-01-01");
+        expect(p.ageTiers.some((t) => t.minDays === 30 && t.bump === 1)).toBe(true);
+    });
+    it("an enforce override changes the base severity", () => {
+        // pin wallet single-writer to 'critical' base → even at 3 days it blocks (critical ≥ blockOn critical)
+        const pol = parsePolicy("critical table wallet single-writer");
+        const v = firewall(baseline, broke, pol, { ageResolver: youngAge });
+        expect(v.verdict).toBe("BLOCK");
+    });
+    it("loadPolicy parses JSON and falls back to DSL", () => {
+        const j = loadPolicy(JSON.stringify({ name: "j", blockOn: "high", waivers: [{ rule: "table wallet single-writer", reason: "x" }] }));
+        expect(j.name).toBe("j");
+        expect(j.blockOn).toBe("high");
+        expect(j.waivers.length).toBe(1);
+        expect(loadPolicy("critical table z private").enforce.length).toBe(1);
     });
     it("never throws on garbage", () => {
         expect(() => firewall(null, null)).not.toThrow();
         expect(firewall(null, null).verdict).toBe("PASS");
         expect(() => parsePolicy(null)).not.toThrow();
+        expect(() => loadPolicy("{bad json")).not.toThrow();
     });
 });
 //# sourceMappingURL=arch_firewall.test.js.map

package/dist/arch_firewall/arch_firewall.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"arch_firewall.test.js","sourceRoot":"","sources":["../../src/arch_firewall/arch_firewall.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAG1G,MAAM,QAAQ,GAAiB;IAC7B,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,wDAAwD,EAAE;IAC5F,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mIAAmI,EAAE;CAC/J,CAAC;AACF,MAAM,KAAK,GAAiB,CAAC,GAAG,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,6EAA6E,EAAE,CAAC,CAAC;AAEzJ,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5E,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACjI,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7E,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,qCAAqC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3I,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAClF,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,GAAG,WAAW,CAAC,wGAAwG,CAAC,CAAC;QAChI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAG,UAAU;QAChD,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,mFAAmF;QACnF,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,iCAAiC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACzI,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAa,EAAE,IAAa,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACnE,MAAM,CAAC,QAAQ,CAAC,IAAa,EAAE,IAAa,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAa,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"arch_firewall.test.js","sourceRoot":"","sources":["../../src/arch_firewall/arch_firewall.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAIpI,MAAM,QAAQ,GAAiB;IAC7B,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,wDAAwD,EAAE;IAC5F,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mIAAmI,EAAE;CAC/J,CAAC;AACF,MAAM,KAAK,GAAiB,CAAC,GAAG,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,6EAA6E,EAAE,CAAC,CAAC;AACzJ,MAAM,MAAM,GAAG,GAAY,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;AACnG,MAAM,QAAQ,GAAG,GAAY,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;AAEjD,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5E,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7E,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC9D,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG,WAAW,CAAC,oEAAoE,CAAC,CAAC;QAC9F,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACvF,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,GAAG,GAAG,WAAW,CAAC,gEAAgE,CAAC,CAAC;QAC1F,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACvF,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QAChF,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK;QAC7K,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY;QACtL,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB;QAC1L,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QAC3K,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;IAC7K,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,GAAG,WAAW,CAAC,mKAAmK,CAAC,CAAC;QAC3L,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9C,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,uGAAuG;QACvG,MAAM,GAAG,GAAG,WAAW,CAAC,qCAAqC,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACrI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAa,EAAE,IAAa,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACnE,MAAM,CAAC,QAAQ,CAAC,IAAa,EAAE,IAAa,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAa,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACvD,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/arch_firewall/index.d.ts

@@ -1,51 +1,89 @@
 import { type SourceFile } from "../cross_layer_graph/index.js";
-export type Severity = "critical" | "warn" | "info";
-export interface Policy {
+export type Severity = "info" | "low" | "medium" | "high" | "critical";
+export interface AgeTier {
+    minDays: number;
+    bump: number;
+}
+export interface Waiver {
     rule: string;
-    severity: Severity;
-    raw: string;
-}
-/**
- * Parse a policy file. Each non-comment line is `[critical|warn|info] <invariant-rule>`; the severity
- * prefix is optional (defaults to `warn`). e.g. `critical table wallet single-writer`.
- */
-export declare function parsePolicy(text: string): Policy[];
-/** Severity weighted by how long a contract has stood. Old contract broken = crime; young = evolution. */
-export declare function severityFromAge(ageDays: number | null | undefined): Severity;
+    reason: string;
+    until?: string;
+}
+export interface FirewallPolicy {
+    name: string;
+    defaults: Record<string, Severity>;
+    enforce: Array<{
+        rule: string;
+        severity: Severity;
+    }>;
+    declared: string[];
+    waivers: Waiver[];
+    ageWeight: boolean;
+    ageTiers: AgeTier[];
+    blockOn: Severity;
+}
+export declare const DEFAULT_POLICY: FirewallPolicy;
+/** Parse the line-DSL policy. Directives: `blockon <sev>`, `default <kind> <sev>`, `agetier <days> <bump>`,
+ *  `waive [until=YYYY-MM-DD] <rule> :: <reason>`. Rule lines: `[<sev>] <invariant-rule>`. `#` comments. */
+export declare function parsePolicy(text: string): FirewallPolicy;
+/** Load a policy from JSON (full structured) or the line DSL, merged onto DEFAULT_POLICY. */
+export declare function loadPolicy(raw: string): FirewallPolicy;
+export interface ScoreInput {
+    base: Severity;
+    status: "VIOLATED" | "UNKNOWN";
+    ageDays: number | null;
+    flickered?: boolean;
+    ageWeight: boolean;
+    ageTiers: ReadonlyArray<AgeTier>;
+}
+/** final = base + age-tier bump − UNKNOWN penalty, with a flicker cap and a transparent rationale. */
+export declare function scoreSeverity(s: ScoreInput): {
+    final: Severity;
+    rationale: string;
+};
 export interface AgeInfo {
     ageDays: number;
     establishedAt?: string;
     heldThroughCommits?: number;
+    flickered?: boolean;
 }
-export interface FirewallViolation {
+export interface FirewallFinding {
     rule: string;
-    severity: Severity;
+    kind: string;
+    status: "VIOLATED" | "UNKNOWN";
     reason: string;
     counterexample?: string;
     source: "mined" | "declared";
-    ageDays?: number | null;
+    baseSeverity: Severity;
+    finalSeverity: Severity;
+    rationale: string;
+    ageDays: number | null;
     establishedAt?: string;
     heldThroughCommits?: number;
+    waived: boolean;
+    waiverReason?: string;
+    waiverExpired: boolean;
+    blocking: boolean;
 }
 export interface FirewallVerdict {
     verdict: "PASS" | "WARN" | "BLOCK";
-    violations: FirewallViolation[];
+    policyName: string;
+    baselineContracts: number;
+    findings: FirewallFinding[];
+    blocked: boolean;
+    blockedBy: FirewallFinding[];
+    expiredWaivers: FirewallFinding[];
+    waivedCount: number;
+    clean: boolean;
     critical: number;
-    warn: number;
-    info: number;
-    checkedContracts: number;
-    declaredChecked: number;
-}
-/**
- * Run the firewall: which baseline contracts (and which architect-declared policies) does the current
- * code violate, weighted into PASS / WARN / BLOCK. `ageResolver` (optional, git-backed in the caller)
- * supplies how long each violated contract has stood; in tests pass a stub.
- */
-export declare function firewall(baselineFiles: ReadonlyArray<SourceFile>, currentFiles: ReadonlyArray<SourceFile>, opts?: {
-    policies?: ReadonlyArray<Policy>;
+    high: number;
+    blockOn: Severity;
+}
+export declare function firewall(baselineFiles: ReadonlyArray<SourceFile>, currentFiles: ReadonlyArray<SourceFile>, policy?: FirewallPolicy, opts?: {
     ageResolver?: (rule: string) => AgeInfo | null;
+    today?: string;
 }): FirewallVerdict;
-/** A human/PR-comment rendering of the verdict, with the killer line per violation. */
+/** Plain-text verdict, ready for a terminal or a PR comment. */
 export declare function firewallReport(v: FirewallVerdict): string;
 export interface ArchFirewallGauntlet {
     score: 0 | 100;

package/dist/arch_firewall/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/arch_firewall/index.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAEhE,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,MAAM;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AAEzE;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAUlD;AAED,0GAA0G;AAC1G,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,QAAQ,CAK5E;AAED,MAAM,WAAW,OAAO;IAAG,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE;AACjG,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAC1E,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5G;AACD,MAAM,WAAW,eAAe;IAAG,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE;AAQzM;;;;GAIG;AACH,wBAAgB,QAAQ,CACtB,aAAa,EAAE,aAAa,CAAC,UAAU,CAAC,EACxC,YAAY,EAAE,aAAa,CAAC,UAAU,CAAC,EACvC,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAA;CAAE,GAC1F,eAAe,CAkCjB;AAED,uFAAuF;AACvF,wBAAgB,cAAc,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM,CAUzD;AAGD,MAAM,WAAW,oBAAoB;IAAG,KAAK,EAAE,CAAC,GAAG,GAAG,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE;AACxH,wBAAgB,oBAAoB,IAAI,oBAAoB,CAuC3D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/arch_firewall/index.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAEhE,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AASvE,MAAM,WAAW,OAAO;IAAG,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAC1D,MAAM,WAAW,MAAM;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE;AACxE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnC,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,OAAO,EAAE,QAAQ,CAAC;CACnB;AACD,eAAO,MAAM,cAAc,EAAE,cAG5B,CAAC;AAEF;2GAC2G;AAC3G,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CA0BxD;AAED,6FAA6F;AAC7F,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAItD;AAQD,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAA;CAAE;AACjL,sGAAsG;AACtG,wBAAgB,aAAa,CAAC,CAAC,EAAE,UAAU,GAAG;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAanF;AAED,MAAM,WAAW,OAAO;IAAG,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE;AACtH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC;IAClI,YAAY,EAAE,QAAQ,CAAC;IAAC,aAAa,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAChJ,MAAM,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;CACnF;AACD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC/G,OAAO,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,eAAe,EAAE,CAAC;IAAC,cAAc,EAAE,eAAe,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IACvH,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,QAAQ,CAAC;CACnD;AAED,wBAAgB,QAAQ,CACtB,aAAa,EAAE,aAAa,CAAC,UAAU,CAAC,EACxC,YAAY,EAAE,aAAa,CAAC,UAAU,CAAC,EACvC,MAAM,GAAE,cAA+B,EACvC,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACxE,eAAe,CAsCjB;AAID,gEAAgE;AAChE,wBAAgB,cAAc,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM,CAgBzD;AAGD,MAAM,WAAW,oBAAoB;IAAG,KAAK,EAAE,CAAC,GAAG,GAAG,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE;AACxH,wBAAgB,oBAAoB,IAAI,oBAAoB,CAmD3D"}