@mnemom/mnemom 0.7.1 → 0.8.0

package/dist/commands/card.js

@@ -1,28 +1,13 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
+import * as os from "node:os";
+import { spawnSync } from "node:child_process";
 import yaml from "js-yaml";
-import { configExists, loadConfig, requireAgent } from "../lib/config.js";
-import { getCard, updateCard, reverifyAgent, } from "../lib/api.js";
+import { getAlignmentCard, putAlignmentCard, resolveAgentId, } from "../lib/api.js";
 import { requireAuth } from "../lib/auth.js";
 import { fmt } from "../lib/format.js";
 import { askYesNo, isInteractive } from "../lib/prompt.js";
-// Standard AAP values that do not require custom definitions
-const STANDARD_VALUES = new Set([
-    "transparency",
-    "honesty",
-    "safety",
-    "privacy",
-    "fairness",
-    "accountability",
-    "beneficence",
-    "non-maleficence",
-    "autonomy",
-    "justice",
-    "reliability",
-    "security",
-    "human_oversight",
-    "explainability",
-]);
+import { evaluatePolicy, } from "@mnemom/policy-engine";
 function detectFormat(filePath) {
     const ext = path.extname(filePath).toLowerCase();
     if (ext === ".yaml" || ext === ".yml")
@@ -37,37 +22,48 @@ export function parseCardFile(filePath) {
         if (!parsed || typeof parsed !== "object") {
             throw new Error("YAML did not produce a valid object");
         }
-        return { format, parsed };
+        return { format, parsed, raw };
     }
-    return { format, parsed: JSON.parse(raw) };
+    return { format, parsed: JSON.parse(raw), raw };
 }
-/** @deprecated Use validateCard instead */
-export const validateCardJson = validateCard;
-export function validateCard(raw) {
+// Standard AAP values that do not require custom definitions
+const STANDARD_VALUES = new Set([
+    "transparency", "honesty", "safety", "privacy", "fairness",
+    "accountability", "beneficence", "non-maleficence", "autonomy",
+    "justice", "reliability", "security", "human_oversight", "explainability",
+]);
+/**
+ * Validate a unified alignment card object against ADR-008 schema.
+ * Sections: principal, values, conscience, integrity, autonomy,
+ *           capabilities, enforcement, audit, extensions
+ */
+export function validateUnifiedCard(card) {
     const checks = [];
-    // Check 1: Valid JSON
-    let card;
-    try {
-        card = JSON.parse(raw);
-        checks.push({ name: "Valid JSON", passed: true, message: "Parsed successfully" });
-    }
-    catch (e) {
-        const msg = e instanceof Error ? e.message : String(e);
-        checks.push({ name: "Valid JSON", passed: false, message: `Parse error: ${msg}` });
-        return checks; // Can't continue without valid JSON
-    }
-    // Check 2: Required blocks
-    const requiredBlocks = ["principal", "values", "autonomy_envelope", "audit_commitment"];
-    for (const block of requiredBlocks) {
-        if (card[block] && typeof card[block] === "object") {
-            checks.push({ name: `Block: ${block}`, passed: true, message: "Present" });
+    // Required sections
+    const requiredSections = ["principal", "values", "autonomy"];
+    for (const section of requiredSections) {
+        if (card[section] && typeof card[section] === "object") {
+            checks.push({ name: `Section: ${section}`, passed: true, message: "Present" });
         }
         else {
-            checks.push({ name: `Block: ${block}`, passed: false, message: "Missing or invalid" });
+            checks.push({ name: `Section: ${section}`, passed: false, message: "Missing or invalid" });
         }
     }
-    // Check 3: values.declared is non-empty array
-    const declared = card.values?.declared;
+    // Optional sections — validate shape if present
+    const optionalSections = ["conscience", "integrity", "capabilities", "enforcement", "audit", "extensions"];
+    for (const section of optionalSections) {
+        if (card[section] !== undefined) {
+            if (typeof card[section] === "object" && card[section] !== null) {
+                checks.push({ name: `Section: ${section}`, passed: true, message: "Present" });
+            }
+            else {
+                checks.push({ name: `Section: ${section}`, passed: false, message: "Must be an object" });
+            }
+        }
+    }
+    // values.declared is non-empty array
+    const values = card.values;
+    const declared = values?.declared;
     if (Array.isArray(declared) && declared.length > 0) {
         checks.push({
             name: "values.declared",
@@ -75,16 +71,16 @@ export function validateCard(raw) {
             message: `${declared.length} value(s) declared`,
         });
     }
-    else {
+    else if (values) {
         checks.push({
             name: "values.declared",
             passed: false,
             message: "Must be a non-empty array",
         });
     }
-    // Check 4: Custom values have definitions
+    // Custom values need definitions
     if (Array.isArray(declared)) {
-        const definitions = card.values?.definitions || {};
+        const definitions = (values?.definitions ?? {});
         const customValues = declared.filter((v) => !STANDARD_VALUES.has(v));
         const missingDefs = customValues.filter((v) => !definitions[v]);
         if (missingDefs.length === 0) {
@@ -104,220 +100,90 @@ export function validateCard(raw) {
             });
         }
     }
-    // Check 5: bounded_actions is non-empty array
-    const bounded = card.autonomy_envelope?.bounded_actions;
+    // autonomy.bounded_actions is non-empty
+    const autonomy = card.autonomy;
+    const bounded = autonomy?.bounded_actions;
     if (Array.isArray(bounded) && bounded.length > 0) {
         checks.push({
-            name: "bounded_actions",
+            name: "autonomy.bounded_actions",
             passed: true,
             message: `${bounded.length} bounded action(s)`,
         });
     }
-    else {
+    else if (autonomy) {
         checks.push({
-            name: "bounded_actions",
+            name: "autonomy.bounded_actions",
             passed: false,
             message: "Must be a non-empty array",
         });
     }
-    // Check 6: escalation_triggers conditions are evaluable
-    // Accepts: simple identifiers, tool_matches('...') calls, and logical expressions
-    // (comparisons with ==, !=, >, <, and/or, quoted strings, numbers)
-    const triggers = card.autonomy_envelope?.escalation_triggers;
-    if (Array.isArray(triggers) && triggers.length > 0) {
-        const conditionPattern = /^[\w\s\(\)\*\.'",=!><&|]+$/;
-        const invalidTriggers = triggers.filter((t) => !t.condition || !conditionPattern.test(t.condition));
-        if (invalidTriggers.length === 0) {
-            checks.push({
-                name: "escalation_triggers",
-                passed: true,
-                message: `${triggers.length} trigger(s), all valid`,
-            });
-        }
-        else {
-            checks.push({
-                name: "escalation_triggers",
-                passed: false,
-                message: `${invalidTriggers.length} trigger(s) with invalid conditions`,
-            });
-        }
-    }
-    else if (Array.isArray(triggers) && triggers.length === 0) {
-        checks.push({
-            name: "escalation_triggers",
-            passed: true,
-            message: "No triggers defined",
-        });
-    }
-    // Check 7: expires_at not already expired
-    if (card.expires_at) {
-        const expiresDate = new Date(card.expires_at);
-        if (isNaN(expiresDate.getTime())) {
-            checks.push({
-                name: "expires_at",
-                passed: false,
-                message: "Invalid date format",
-            });
-        }
-        else if (expiresDate.getTime() < Date.now()) {
-            checks.push({
-                name: "expires_at",
-                passed: false,
-                message: `Already expired: ${card.expires_at}`,
-            });
-        }
-        else {
-            checks.push({
-                name: "expires_at",
-                passed: true,
-                message: `Valid until ${card.expires_at}`,
-            });
-        }
-    }
-    return checks;
-}
-/**
- * Validate a pre-parsed card object (used for YAML cards).
- * Re-serializes to JSON so the same checks run identically.
- */
-export function validateCardObject(card) {
-    return validateCard(JSON.stringify(card));
-}
-// ============================================================================
-// Card display
-// ============================================================================
-function displayCard(cardResponse) {
-    const card = cardResponse.card_json;
-    console.log(fmt.header("Alignment Card"));
-    console.log();
-    // Header info
-    console.log(fmt.label("  Card ID: ", cardResponse.card_id));
-    if (card.version) {
-        console.log(fmt.label("  Version: ", card.version));
-    }
-    if (card.issued_at) {
-        console.log(fmt.label("  Issued:  ", card.issued_at));
-    }
-    if (card.expires_at) {
-        console.log(fmt.label("  Expires: ", card.expires_at));
-    }
-    // Principal
-    if (card.principal) {
-        console.log(fmt.section("Principal"));
-        console.log();
-        if (card.principal.name) {
-            console.log(fmt.label("  Name:        ", card.principal.name));
-        }
-        if (card.principal.type) {
-            console.log(fmt.label("  Type:        ", card.principal.type));
-        }
-        if (card.principal.organization) {
-            console.log(fmt.label("  Organization:", ` ${card.principal.organization}`));
-        }
-    }
-    // Values
-    if (card.values) {
-        console.log(fmt.section("Values"));
-        console.log();
-        if (Array.isArray(card.values.declared) && card.values.declared.length > 0) {
-            const badges = card.values.declared.map((v) => {
-                if (STANDARD_VALUES.has(v)) {
-                    return fmt.badge(v, "cyan");
-                }
-                return fmt.badge(v, "magenta");
-            });
-            console.log(`  ${badges.join(" ")}`);
-            // Show definitions for custom values
-            const definitions = card.values.definitions || {};
-            const customValues = card.values.declared.filter((v) => !STANDARD_VALUES.has(v));
-            if (customValues.length > 0) {
-                console.log();
-                for (const v of customValues) {
-                    if (definitions[v]) {
-                        console.log(fmt.label(`    ${v}:`, ` ${definitions[v]}`));
-                    }
-                }
+    // capabilities shape validation (if present)
+    const capabilities = card.capabilities;
+    if (capabilities && typeof capabilities === "object") {
+        for (const [name, mapping] of Object.entries(capabilities)) {
+            const m = mapping;
+            if (!Array.isArray(m?.tools)) {
+                checks.push({
+                    name: `capabilities.${name}.tools`,
+                    passed: false,
+                    message: "Must be an array",
+                });
             }
-        }
-    }
-    // Autonomy envelope
-    if (card.autonomy_envelope) {
-        console.log(fmt.section("Autonomy Envelope"));
-        console.log();
-        const bounded = card.autonomy_envelope.bounded_actions;
-        if (Array.isArray(bounded) && bounded.length > 0) {
-            console.log("  Bounded actions:");
-            for (const action of bounded) {
-                console.log(`    ${fmt.success(action)}`);
-            }
-        }
-        const forbidden = card.autonomy_envelope.forbidden_actions;
-        if (Array.isArray(forbidden) && forbidden.length > 0) {
-            console.log("  Forbidden actions:");
-            for (const action of forbidden) {
-                console.log(`    ${fmt.error(action)}`);
-            }
-        }
-        const triggers = card.autonomy_envelope.escalation_triggers;
-        if (Array.isArray(triggers) && triggers.length > 0) {
-            console.log("  Escalation triggers:");
-            for (const trigger of triggers) {
-                const action = trigger.action ? ` -> ${trigger.action}` : "";
-                console.log(`    ${fmt.warn(`${trigger.condition}${action}`)}`);
+            if (!Array.isArray(m?.required_actions)) {
+                checks.push({
+                    name: `capabilities.${name}.required_actions`,
+                    passed: false,
+                    message: "Must be an array",
+                });
             }
         }
     }
-    // Audit commitment
-    if (card.audit_commitment) {
-        console.log(fmt.section("Audit Commitment"));
-        console.log();
-        if (card.audit_commitment.log_level) {
-            console.log(fmt.label("  Log level:      ", card.audit_commitment.log_level));
-        }
-        if (card.audit_commitment.retention_days != null) {
-            console.log(fmt.label("  Retention:      ", `${card.audit_commitment.retention_days} days`));
-        }
-        if (card.audit_commitment.access_policy) {
-            console.log(fmt.label("  Access policy:  ", card.audit_commitment.access_policy));
+    // enforcement.forbidden_tools shape validation (if present)
+    const enforcement = card.enforcement;
+    const forbidden = enforcement?.forbidden_tools;
+    if (Array.isArray(forbidden)) {
+        for (let i = 0; i < forbidden.length; i++) {
+            const rule = forbidden[i];
+            if (!rule?.pattern || !rule?.reason) {
+                checks.push({
+                    name: `enforcement.forbidden_tools[${i}]`,
+                    passed: false,
+                    message: "Must have 'pattern' and 'reason' fields",
+                });
+            }
         }
     }
-    // Extensions
-    if (card.extensions && Object.keys(card.extensions).length > 0) {
-        console.log(fmt.section("Extensions"));
-        console.log();
-        console.log(fmt.json(card.extensions));
-    }
-    console.log();
+    return checks;
 }
+/** @deprecated Use validateUnifiedCard instead */
+export const validateCardJson = (raw) => validateUnifiedCard(JSON.parse(raw));
 // ============================================================================
 // Subcommands
 // ============================================================================
 export async function cardShowCommand(agentName) {
-    if (!configExists()) {
-        console.log("\n" + fmt.error("smoltbot is not initialized") + "\n");
-        console.log("Run `smoltbot init` to get started.\n");
-        process.exit(1);
-    }
-    const config = loadConfig();
-    if (!config) {
-        console.log("\n" + fmt.error("Failed to load configuration") + "\n");
-        process.exit(1);
-    }
-    const agent = await requireAgent(agentName);
-    if (!agent) {
-        console.log("\n" + fmt.error(`Agent not found${agentName ? `: ${agentName}` : ""}`) + "\n");
-        process.exit(1);
-    }
+    const agentId = await resolveAgentId(agentName);
     console.log("\nFetching alignment card...\n");
     try {
-        const cardResponse = await getCard(agent.agentId);
-        if (!cardResponse) {
-            console.log(fmt.warn("No custom card -- using default"));
-            console.log("\nPublish a custom card with:\n");
-            console.log("  smoltbot card publish <file.json>\n");
+        const { body, contentType } = await getAlignmentCard(agentId);
+        if (!body) {
+            console.log(fmt.warn("No alignment card found"));
+            console.log("\nPublish one with:\n");
+            console.log("  mnemom card publish <file.yaml>\n");
             return;
         }
-        displayCard(cardResponse);
+        // If the API returned YAML, print directly; otherwise convert
+        if (contentType.includes("yaml") || contentType.includes("text/yaml")) {
+            console.log(fmt.header("Alignment Card"));
+            console.log();
+            console.log(body);
+        }
+        else {
+            // JSON response — convert to YAML for display
+            const parsed = JSON.parse(body);
+            console.log(fmt.header("Alignment Card"));
+            console.log();
+            console.log(yaml.dump(parsed, { lineWidth: 120, noRefs: true }));
+        }
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
@@ -326,21 +192,7 @@ export async function cardShowCommand(agentName) {
     }
 }
 export async function cardPublishCommand(file, agentName) {
-    if (!configExists()) {
-        console.log("\n" + fmt.error("smoltbot is not initialized") + "\n");
-        console.log("Run `smoltbot init` to get started.\n");
-        process.exit(1);
-    }
-    const config = loadConfig();
-    if (!config) {
-        console.log("\n" + fmt.error("Failed to load configuration") + "\n");
-        process.exit(1);
-    }
-    const agent = await requireAgent(agentName);
-    if (!agent) {
-        console.log("\n" + fmt.error(`Agent not found${agentName ? `: ${agentName}` : ""}`) + "\n");
-        process.exit(1);
-    }
+    const agentId = await resolveAgentId(agentName);
     // Resolve file path
     const filePath = path.resolve(file);
     if (!fs.existsSync(filePath)) {
@@ -349,11 +201,8 @@ export async function cardPublishCommand(file, agentName) {
     }
     // Parse file (JSON or YAML)
     let parsed;
-    let format;
     try {
-        const result = parseCardFile(filePath);
-        parsed = result.parsed;
-        format = result.format;
+        parsed = parseCardFile(filePath);
     }
     catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
@@ -361,10 +210,10 @@ export async function cardPublishCommand(file, agentName) {
         process.exit(1);
     }
     // Validate locally
-    const checks = validateCardObject(parsed);
+    const checks = validateUnifiedCard(parsed.parsed);
     const allPassed = checks.every((c) => c.passed);
     console.log(fmt.header("Card Validation"));
-    console.log(fmt.label("  Format:", ` ${format.toUpperCase()}`));
+    console.log(fmt.label("  Format:", ` ${parsed.format.toUpperCase()}`));
     console.log();
     for (const check of checks) {
         if (check.passed) {
@@ -383,27 +232,24 @@ export async function cardPublishCommand(file, agentName) {
     await requireAuth();
     // Confirm with user
     if (isInteractive()) {
-        const confirm = await askYesNo(`Publish this card for agent ${agent.agentId}?`, false);
+        const confirm = await askYesNo(`Publish this alignment card for agent ${agentId}?`, false);
         if (!confirm) {
             console.log("\nPublish cancelled.\n");
             return;
         }
     }
-    // Publish (always sends JSON to API regardless of source format)
+    // Publish — send in source format
     try {
-        console.log("\nPublishing card...");
-        const result = await updateCard(agent.agentId, parsed);
-        console.log(fmt.success(`Card published successfully!`));
-        console.log(fmt.label("  Card ID:", ` ${result.card_id}`) + "\n");
-        // Trigger re-verification
-        try {
-            console.log("Triggering re-verification...");
-            const reverifyResult = await reverifyAgent(agent.agentId);
-            console.log(fmt.success(`Re-verification started (${reverifyResult.reverified} traces queued)`) + "\n");
-        }
-        catch {
-            console.log(fmt.warn("Could not trigger re-verification (non-critical)") + "\n");
+        console.log("\nPublishing alignment card...");
+        const contentType = parsed.format === "yaml" ? "text/yaml" : "application/json";
+        const body = parsed.format === "yaml" ? parsed.raw : JSON.stringify(parsed.parsed);
+        const result = await putAlignmentCard(agentId, body, contentType);
+        console.log(fmt.success("Alignment card published!"));
+        console.log(fmt.label("  Card ID:", ` ${result.card_id}`));
+        if (result.composed) {
+            console.log(fmt.success("Canonical card recomposed"));
         }
+        console.log();
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
@@ -420,11 +266,8 @@ export async function cardValidateCommand(file) {
     }
     // Parse file (JSON or YAML)
     let parsed;
-    let format;
     try {
-        const result = parseCardFile(filePath);
-        parsed = result.parsed;
-        format = result.format;
+        parsed = parseCardFile(filePath);
     }
     catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
@@ -432,14 +275,14 @@ export async function cardValidateCommand(file) {
         process.exit(1);
     }
     // Validate the parsed object
-    const checks = validateCardObject(parsed);
+    const checks = validateUnifiedCard(parsed.parsed);
     const allPassed = checks.every((c) => c.passed);
     const passCount = checks.filter((c) => c.passed).length;
     const failCount = checks.filter((c) => !c.passed).length;
     console.log(fmt.header("Card Validation Report"));
     console.log();
     console.log(fmt.label("  File:", ` ${filePath}`));
-    console.log(fmt.label("  Format:", ` ${format.toUpperCase()}`));
+    console.log(fmt.label("  Format:", ` ${parsed.format.toUpperCase()}`));
     console.log();
     for (const check of checks) {
         if (check.passed) {
@@ -458,3 +301,213 @@ export async function cardValidateCommand(file) {
         process.exit(1);
     }
 }
+export async function cardEditCommand(agentName) {
+    const agentId = await resolveAgentId(agentName);
+    await requireAuth();
+    // Fetch current card as YAML
+    console.log("\nFetching current alignment card...\n");
+    const { body: original } = await getAlignmentCard(agentId);
+    if (!original) {
+        console.log(fmt.warn("No alignment card found. Creating a template..."));
+    }
+    const cardYaml = original || yaml.dump({
+        principal: { name: "", type: "ai_agent", organization: "" },
+        values: { declared: ["transparency", "safety", "honesty"] },
+        autonomy: { bounded_actions: [], forbidden_actions: [], escalation_triggers: [] },
+    }, { lineWidth: 120, noRefs: true });
+    // Write to temp file
+    const tmpDir = os.tmpdir();
+    const tmpFile = path.join(tmpDir, `mnemom-card-${agentId}.yaml`);
+    fs.writeFileSync(tmpFile, cardYaml);
+    // Open in editor
+    const editor = process.env.EDITOR || process.env.VISUAL || "vi";
+    console.log(`Opening ${editor}...`);
+    const result = spawnSync(editor, [tmpFile], { stdio: "inherit" });
+    if (result.status !== 0) {
+        console.log("\n" + fmt.error("Editor exited with an error") + "\n");
+        try {
+            fs.unlinkSync(tmpFile);
+        }
+        catch { /* ignore */ }
+        process.exit(1);
+    }
+    // Read back and compare
+    const edited = fs.readFileSync(tmpFile, "utf-8");
+    try {
+        fs.unlinkSync(tmpFile);
+    }
+    catch { /* ignore */ }
+    if (edited === cardYaml) {
+        console.log("\nNo changes made.\n");
+        return;
+    }
+    // Validate
+    let parsed;
+    try {
+        parsed = yaml.load(edited);
+        if (!parsed || typeof parsed !== "object")
+            throw new Error("Invalid YAML");
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        console.log("\n" + fmt.error(`Invalid YAML: ${msg}`) + "\n");
+        process.exit(1);
+    }
+    const checks = validateUnifiedCard(parsed);
+    const allPassed = checks.every((c) => c.passed);
+    if (!allPassed) {
+        console.log(fmt.header("Validation Errors"));
+        console.log();
+        for (const check of checks.filter((c) => !c.passed)) {
+            console.log(fmt.error(`${check.name}: ${check.message}`));
+        }
+        console.log();
+        console.log(fmt.error("Validation failed. Card not published.") + "\n");
+        process.exit(1);
+    }
+    // Confirm and publish
+    if (isInteractive()) {
+        const confirm = await askYesNo("Publish updated alignment card?", true);
+        if (!confirm) {
+            console.log("\nPublish cancelled.\n");
+            return;
+        }
+    }
+    try {
+        console.log("\nPublishing alignment card...");
+        const putResult = await putAlignmentCard(agentId, edited, "text/yaml");
+        console.log(fmt.success("Alignment card published!"));
+        console.log(fmt.label("  Card ID:", ` ${putResult.card_id}`) + "\n");
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.log("\n" + fmt.error(`Failed to publish card: ${message}`) + "\n");
+        process.exit(1);
+    }
+}
+/**
+ * mnemom card evaluate <card-file> --tools <tools> -- local CI/CD evaluation
+ *
+ * Runs entirely locally using the embedded policy engine. No API key needed.
+ * The card IS the policy source -- capabilities and enforcement sections
+ * are extracted by @mnemom/policy-engine 0.3.0's evaluatePolicy().
+ */
+export async function cardEvaluateCommand(file, options) {
+    // 1. Read + validate card file
+    const cardPath = path.resolve(file);
+    if (!fs.existsSync(cardPath)) {
+        console.log("\n" + fmt.error(`Card file not found: ${cardPath}`) + "\n");
+        process.exit(1);
+    }
+    let parsed;
+    try {
+        parsed = parseCardFile(cardPath);
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        console.log("\n" + fmt.error(`Could not parse card file: ${msg}`) + "\n");
+        process.exit(1);
+    }
+    const checks = validateUnifiedCard(parsed.parsed);
+    const allPassed = checks.every((c) => c.passed);
+    if (!allPassed) {
+        console.log(fmt.error("Card validation failed:"));
+        for (const check of checks.filter((c) => !c.passed)) {
+            console.log(fmt.error(`  ${check.name}: ${check.message}`));
+        }
+        console.log();
+        process.exit(1);
+    }
+    // 2. Parse tool list from --tools or --tool-manifest
+    let tools = [];
+    if (options.tools) {
+        tools = options.tools.split(",").map((t) => ({ name: t.trim() })).filter((t) => t.name);
+    }
+    else if (options.toolManifest) {
+        const manifestPath = path.resolve(options.toolManifest);
+        if (!fs.existsSync(manifestPath)) {
+            console.log("\n" + fmt.error(`Tool manifest file not found: ${manifestPath}`) + "\n");
+            process.exit(1);
+        }
+        try {
+            const manifestRaw = fs.readFileSync(manifestPath, "utf-8");
+            const manifest = JSON.parse(manifestRaw);
+            if (Array.isArray(manifest)) {
+                tools = manifest.map((t) => typeof t === "string" ? { name: t } : { name: t.name });
+            }
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            console.log("\n" + fmt.error(`Could not read tool manifest: ${msg}`) + "\n");
+            process.exit(1);
+        }
+    }
+    if (tools.length === 0) {
+        console.log("\n" + fmt.error("No tools specified. Use --tools or --tool-manifest") + "\n");
+        process.exit(1);
+    }
+    // 3. Run evaluation -- card IS the policy source
+    const result = evaluatePolicy({
+        context: "cicd",
+        card: parsed.parsed,
+        tools,
+    });
+    // 4. Display results
+    console.log(fmt.header("Card Policy Evaluation"));
+    console.log();
+    const principal = parsed.parsed.principal;
+    console.log(fmt.label("  Card:", ` ${principal?.name ?? path.basename(cardPath)}`));
+    console.log(fmt.label("  Context:", " cicd"));
+    console.log(fmt.label("  Tools:", ` ${tools.length} (${tools.map((t) => t.name).join(", ")})`));
+    console.log();
+    // Verdict
+    if (result.verdict === "pass") {
+        console.log(fmt.success("PASS -- all tools comply with card policy"));
+    }
+    else if (result.verdict === "warn") {
+        console.log(fmt.warn("WARN -- policy warnings detected"));
+    }
+    else {
+        console.log(fmt.error("FAIL -- policy violations detected"));
+    }
+    console.log();
+    // Violations
+    if (result.violations.length > 0) {
+        console.log(fmt.section("Violations"));
+        console.log();
+        for (const v of result.violations) {
+            console.log(fmt.error(`  ${v.tool} [${v.severity}] -- ${v.type}`));
+            console.log(`    ${v.reason}`);
+        }
+    }
+    // Warnings
+    if (result.warnings.length > 0) {
+        console.log(fmt.section("Warnings"));
+        console.log();
+        for (const w of result.warnings) {
+            console.log(fmt.warn(`  ${w.tool} -- ${w.type}`));
+            console.log(`    ${w.reason}`);
+        }
+    }
+    // Coverage
+    const cov = result.coverage;
+    console.log(fmt.section("Coverage"));
+    console.log();
+    console.log(fmt.label("  Card actions:", ` ${cov.total_card_actions}`));
+    console.log(fmt.label("  Mapped:      ", ` ${cov.mapped_card_actions.length}`));
+    console.log(fmt.label("  Unmapped:    ", ` ${cov.unmapped_card_actions.length}`));
+    console.log(fmt.label("  Coverage:    ", ` ${cov.coverage_pct.toFixed(1)}%`));
+    if (cov.unmapped_card_actions.length > 0) {
+        console.log(fmt.label("  Unmapped list:", ` ${cov.unmapped_card_actions.join(", ")}`));
+    }
+    console.log();
+    console.log(fmt.label("  Duration:", ` ${result.duration_ms}ms`));
+    console.log();
+    // 5. Exit code
+    if (result.verdict === "fail") {
+        process.exit(1);
+    }
+    if (options.strict && result.verdict === "warn") {
+        process.exit(1);
+    }
+}