@neuroverseos/governance 0.1.6 → 0.2.2

package/dist/{chunk-B4NF3OLW.js → chunk-4JRYGIO7.js}

@@ -1,3 +1,8 @@
+import {
+  buildPlanCheck,
+  evaluatePlan
+} from "./chunk-4QXB6PEO.js";
+
 // src/engine/guard-engine.ts
 var PROMPT_INJECTION_PATTERNS = [
   // Instruction override
@@ -89,6 +94,7 @@ function evaluateGuard(event, world, options = {}) {
   const eventText = (event.intent + " " + (event.tool ?? "") + " " + (event.scope ?? "")).toLowerCase();
   const invariantChecks = [];
   const safetyChecks = [];
+  let planCheckResult;
   const roleChecks = [];
   const guardChecks = [];
   const kernelRuleChecks = [];
@@ -116,6 +122,7 @@ function evaluateGuard(event, world, options = {}) {
         includeTrace ? buildTrace(
           invariantChecks,
           safetyChecks,
+          planCheckResult,
           roleChecks,
           guardChecks,
           kernelRuleChecks,
@@ -144,6 +151,7 @@ function evaluateGuard(event, world, options = {}) {
       includeTrace ? buildTrace(
         invariantChecks,
         safetyChecks,
+        planCheckResult,
         roleChecks,
         guardChecks,
         kernelRuleChecks,
@@ -154,6 +162,42 @@ function evaluateGuard(event, world, options = {}) {
       ) : void 0
     );
   }
+  if (options.plan) {
+    const planVerdict = evaluatePlan(event, options.plan);
+    planCheckResult = buildPlanCheck(event, options.plan, planVerdict);
+    if (!planVerdict.allowed && planVerdict.status !== "PLAN_COMPLETE") {
+      decidingLayer = "plan-enforcement";
+      decidingId = `plan-${options.plan.plan_id}`;
+      const planStatus = planVerdict.status === "CONSTRAINT_VIOLATED" ? "PAUSE" : "BLOCK";
+      let reason = planVerdict.reason ?? "Action blocked by plan.";
+      if (planVerdict.status === "OFF_PLAN" && planVerdict.closestStep) {
+        reason += ` Closest step: "${planVerdict.closestStep}" (similarity: ${(planVerdict.similarityScore ?? 0).toFixed(2)})`;
+      }
+      return buildVerdict(
+        planStatus,
+        reason,
+        `plan-${options.plan.plan_id}`,
+        void 0,
+        world,
+        level,
+        invariantChecks,
+        guardsMatched,
+        rulesMatched,
+        includeTrace ? buildTrace(
+          invariantChecks,
+          safetyChecks,
+          planCheckResult,
+          roleChecks,
+          guardChecks,
+          kernelRuleChecks,
+          levelChecks,
+          decidingLayer,
+          decidingId,
+          startTime
+        ) : void 0
+      );
+    }
+  }
   const roleVerdict = checkRoleRules(event, eventText, world, roleChecks);
   if (roleVerdict) {
     decidingLayer = "role";
@@ -171,6 +215,7 @@ function evaluateGuard(event, world, options = {}) {
       includeTrace ? buildTrace(
         invariantChecks,
         safetyChecks,
+        planCheckResult,
         roleChecks,
         guardChecks,
         kernelRuleChecks,
@@ -199,6 +244,7 @@ function evaluateGuard(event, world, options = {}) {
         includeTrace ? buildTrace(
           invariantChecks,
           safetyChecks,
+          planCheckResult,
           roleChecks,
           guardChecks,
           kernelRuleChecks,
@@ -227,6 +273,7 @@ function evaluateGuard(event, world, options = {}) {
       includeTrace ? buildTrace(
         invariantChecks,
         safetyChecks,
+        planCheckResult,
         roleChecks,
         guardChecks,
         kernelRuleChecks,
@@ -254,6 +301,7 @@ function evaluateGuard(event, world, options = {}) {
       includeTrace ? buildTrace(
         invariantChecks,
         safetyChecks,
+        planCheckResult,
         roleChecks,
         guardChecks,
         kernelRuleChecks,
@@ -278,6 +326,7 @@ function evaluateGuard(event, world, options = {}) {
     includeTrace ? buildTrace(
       invariantChecks,
       safetyChecks,
+      planCheckResult,
       roleChecks,
       guardChecks,
       kernelRuleChecks,
@@ -615,8 +664,8 @@ function matchesKeywords(eventText, ruleText) {
 function eventToAllowlistKey(event) {
   return `${(event.tool ?? "*").toLowerCase()}::${event.intent.toLowerCase().trim()}`;
 }
-function buildTrace(invariantChecks, safetyChecks, roleChecks, guardChecks, kernelRuleChecks, levelChecks, decidingLayer, decidingId, startTime) {
-  return {
+function buildTrace(invariantChecks, safetyChecks, planCheck, roleChecks, guardChecks, kernelRuleChecks, levelChecks, decidingLayer, decidingId, startTime) {
+  const trace = {
     invariantChecks,
     safetyChecks,
     roleChecks,
@@ -634,6 +683,7 @@ function buildTrace(invariantChecks, safetyChecks, roleChecks, guardChecks, kern
         "safety-scope-escape",
         "safety-execution-claim",
         "safety-execution-intent",
+        "plan-enforcement",
         "role-rules",
         "declarative-guards",
         "kernel-rules",
@@ -643,6 +693,10 @@ function buildTrace(invariantChecks, safetyChecks, roleChecks, guardChecks, kern
     },
     durationMs: performance.now() - startTime
   };
+  if (planCheck) {
+    trace.planCheck = planCheck;
+  }
+  return trace;
 }
 function buildVerdict(status, reason, ruleId, warning, world, level, invariantChecks, guardsMatched, rulesMatched, trace) {
   const evidence = {

package/dist/chunk-4QXB6PEO.js

@@ -0,0 +1,232 @@
+// src/engine/plan-engine.ts
+function keywordMatch(eventText, step) {
+  const stepText = [
+    step.label,
+    step.description ?? "",
+    ...step.tags ?? []
+  ].join(" ").toLowerCase();
+  const keywords = stepText.split(/\s+/).filter((w) => w.length > 3);
+  if (keywords.length === 0) return false;
+  const matched = keywords.filter((kw) => eventText.includes(kw));
+  return matched.length >= Math.ceil(keywords.length * 0.5);
+}
+function tokenSimilarity(a, b) {
+  const tokensA = new Set(a.toLowerCase().split(/\s+/).filter((w) => w.length > 2));
+  const tokensB = new Set(b.toLowerCase().split(/\s+/).filter((w) => w.length > 2));
+  if (tokensA.size === 0 || tokensB.size === 0) return 0;
+  let intersection = 0;
+  for (const t of tokensA) {
+    if (tokensB.has(t)) intersection++;
+  }
+  const union = (/* @__PURE__ */ new Set([...tokensA, ...tokensB])).size;
+  return union > 0 ? intersection / union : 0;
+}
+function findMatchingStep(eventText, event, steps) {
+  const pendingOrActive = steps.filter((s) => s.status === "pending" || s.status === "active");
+  if (pendingOrActive.length === 0) {
+    return { matched: null, closest: null, closestScore: 0 };
+  }
+  for (const step of pendingOrActive) {
+    if (keywordMatch(eventText, step)) {
+      if (step.tools && event.tool && !step.tools.includes(event.tool)) {
+        continue;
+      }
+      return { matched: step, closest: step, closestScore: 1 };
+    }
+  }
+  const intentText = [event.intent, event.tool ?? "", event.scope ?? ""].join(" ");
+  let bestStep = null;
+  let bestScore = 0;
+  for (const step of pendingOrActive) {
+    const stepText = [step.label, step.description ?? "", ...step.tags ?? []].join(" ");
+    const score = tokenSimilarity(intentText, stepText);
+    if (score > bestScore) {
+      bestScore = score;
+      bestStep = step;
+    }
+  }
+  const SIMILARITY_THRESHOLD = 0.35;
+  if (bestScore >= SIMILARITY_THRESHOLD && bestStep) {
+    if (bestStep.tools && event.tool && !bestStep.tools.includes(event.tool)) {
+      return { matched: null, closest: bestStep, closestScore: bestScore };
+    }
+    return { matched: bestStep, closest: bestStep, closestScore: bestScore };
+  }
+  return { matched: null, closest: bestStep, closestScore: bestScore };
+}
+function isSequenceValid(step, plan) {
+  if (!plan.sequential) return true;
+  if (!step.requires || step.requires.length === 0) return true;
+  return step.requires.every((reqId) => {
+    const reqStep = plan.steps.find((s) => s.id === reqId);
+    return reqStep?.status === "completed";
+  });
+}
+function checkConstraints(event, eventText, constraints) {
+  const checks = [];
+  for (const constraint of constraints) {
+    if (constraint.type === "approval") {
+      if (constraint.trigger && eventText.includes(constraint.trigger.substring(0, 10).toLowerCase())) {
+        checks.push({ constraintId: constraint.id, passed: false, reason: constraint.description });
+        return { violated: constraint, checks };
+      }
+      const keywords = constraint.description.toLowerCase().split(/\s+/).filter((w) => w.length > 3);
+      const relevant = keywords.some((kw) => eventText.includes(kw));
+      if (relevant) {
+        checks.push({ constraintId: constraint.id, passed: false, reason: constraint.description });
+        return { violated: constraint, checks };
+      }
+      checks.push({ constraintId: constraint.id, passed: true });
+      continue;
+    }
+    if (constraint.type === "scope" && constraint.trigger) {
+      const keywords = constraint.trigger.split(/\s+/).filter((w) => w.length > 3);
+      const violated = keywords.length > 0 && keywords.every((kw) => eventText.includes(kw));
+      checks.push({
+        constraintId: constraint.id,
+        passed: !violated,
+        reason: violated ? constraint.description : void 0
+      });
+      if (violated) {
+        return { violated: constraint, checks };
+      }
+      continue;
+    }
+    checks.push({ constraintId: constraint.id, passed: true });
+  }
+  return { violated: null, checks };
+}
+function getPlanProgress(plan) {
+  const completed = plan.steps.filter((s) => s.status === "completed").length;
+  const total = plan.steps.length;
+  return {
+    completed,
+    total,
+    percentage: total > 0 ? Math.round(completed / total * 100) : 0
+  };
+}
+function advancePlan(plan, stepId, evidence) {
+  const step = plan.steps.find((s) => s.id === stepId);
+  if (!step) {
+    return { success: false, reason: `Step "${stepId}" not found in plan.` };
+  }
+  if (step.status === "completed") {
+    return { success: false, reason: `Step "${stepId}" is already completed.` };
+  }
+  const mode = plan.completion ?? "trust";
+  if (mode === "verified" && step.verify) {
+    if (!evidence) {
+      return {
+        success: false,
+        reason: `Step "${step.label}" requires evidence (verify: ${step.verify}). Provide evidence to advance.`
+      };
+    }
+    if (evidence.type !== step.verify) {
+      return {
+        success: false,
+        reason: `Evidence type "${evidence.type}" does not match required verification "${step.verify}".`
+      };
+    }
+  }
+  const updatedPlan = {
+    ...plan,
+    steps: plan.steps.map(
+      (s) => s.id === stepId ? { ...s, status: "completed" } : s
+    )
+  };
+  return {
+    success: true,
+    plan: updatedPlan,
+    evidence: evidence ?? void 0
+  };
+}
+function evaluatePlan(event, plan) {
+  const progress = getPlanProgress(plan);
+  if (plan.expires_at) {
+    const expiresAt = new Date(plan.expires_at).getTime();
+    if (Date.now() > expiresAt) {
+      return {
+        allowed: true,
+        status: "PLAN_COMPLETE",
+        reason: "Plan has expired.",
+        progress
+      };
+    }
+  }
+  if (progress.completed === progress.total) {
+    return {
+      allowed: true,
+      status: "PLAN_COMPLETE",
+      reason: "All plan steps are completed.",
+      progress
+    };
+  }
+  const eventText = [
+    event.intent,
+    event.tool ?? "",
+    event.scope ?? ""
+  ].join(" ").toLowerCase();
+  const { matched, closest, closestScore } = findMatchingStep(eventText, event, plan.steps);
+  if (!matched) {
+    return {
+      allowed: false,
+      status: "OFF_PLAN",
+      reason: "Action does not match any plan step.",
+      closestStep: closest?.label,
+      similarityScore: closestScore,
+      progress
+    };
+  }
+  if (!isSequenceValid(matched, plan)) {
+    const pendingDeps = (matched.requires ?? []).filter((reqId) => plan.steps.find((s) => s.id === reqId)?.status !== "completed").join(", ");
+    return {
+      allowed: false,
+      status: "OFF_PLAN",
+      reason: `Step "${matched.label}" requires completion of: ${pendingDeps}`,
+      matchedStep: matched.id,
+      progress
+    };
+  }
+  const { violated } = checkConstraints(event, eventText, plan.constraints);
+  if (violated) {
+    return {
+      allowed: false,
+      status: "CONSTRAINT_VIOLATED",
+      reason: violated.description,
+      matchedStep: matched.id,
+      progress
+    };
+  }
+  return {
+    allowed: true,
+    status: "ON_PLAN",
+    reason: `Matches step: ${matched.label}`,
+    matchedStep: matched.id,
+    progress
+  };
+}
+function buildPlanCheck(event, plan, verdict) {
+  const eventText = [event.intent, event.tool ?? "", event.scope ?? ""].join(" ").toLowerCase();
+  const { matched, closest, closestScore } = findMatchingStep(eventText, event, plan.steps);
+  const { checks: constraintChecks } = checkConstraints(event, eventText, plan.constraints);
+  const progress = getPlanProgress(plan);
+  return {
+    planId: plan.plan_id,
+    matched: !!matched,
+    matchedStepId: matched?.id,
+    matchedStepLabel: matched?.label,
+    closestStepId: !matched ? closest?.id : void 0,
+    closestStepLabel: !matched ? closest?.label : void 0,
+    similarityScore: !matched ? closestScore : void 0,
+    sequenceValid: matched ? isSequenceValid(matched, plan) : void 0,
+    constraintsChecked: constraintChecks,
+    progress: { completed: progress.completed, total: progress.total }
+  };
+}
+
+export {
+  getPlanProgress,
+  advancePlan,
+  evaluatePlan,
+  buildPlanCheck
+};

package/dist/chunk-6CZSKEY5.js

@@ -0,0 +1,164 @@
+// src/engine/plan-parser.ts
+function slugify(text) {
+  return text.toLowerCase().replace(/[^a-z0-9\s]/g, "").trim().replace(/\s+/g, "_");
+}
+function extractBracketAnnotation(line, key) {
+  const regex = new RegExp(`\\[${key}:\\s*([^\\]]+)\\]`, "i");
+  const match = line.match(regex);
+  if (!match) return null;
+  return match[1].split(",").map((s) => s.trim()).filter(Boolean);
+}
+function extractParenAnnotation(line, key) {
+  const regex = new RegExp(`\\(${key}:\\s*([^)]+)\\)`, "i");
+  const match = line.match(regex);
+  if (!match) return null;
+  return match[1].split(",").map((s) => s.trim()).filter(Boolean);
+}
+function stripAnnotations(line) {
+  return line.replace(/\[(?:tools|tag|verify|type):\s*[^\]]+\]/gi, "").replace(/\((?:after):\s*[^)]+\)/gi, "").trim();
+}
+function parseFrontmatter(content) {
+  const frontmatter = {};
+  const fmMatch = content.match(/^---\s*\n([\s\S]*?)\n---\s*\n/);
+  if (!fmMatch) {
+    return { frontmatter, body: content };
+  }
+  const fmBody = fmMatch[1];
+  for (const line of fmBody.split("\n")) {
+    const colonIndex = line.indexOf(":");
+    if (colonIndex > 0) {
+      const key = line.slice(0, colonIndex).trim();
+      const value = line.slice(colonIndex + 1).trim();
+      frontmatter[key] = value;
+    }
+  }
+  return { frontmatter, body: content.slice(fmMatch[0].length) };
+}
+function parseSections(body) {
+  const steps = [];
+  const constraints = [];
+  let currentSection = "none";
+  for (const line of body.split("\n")) {
+    const trimmed = line.trim();
+    if (/^#+\s*Steps/i.test(trimmed)) {
+      currentSection = "steps";
+      continue;
+    }
+    if (/^#+\s*Constraints/i.test(trimmed)) {
+      currentSection = "constraints";
+      continue;
+    }
+    if (/^#+\s/.test(trimmed) && currentSection !== "none") {
+      currentSection = "none";
+      continue;
+    }
+    if (trimmed.startsWith("- ")) {
+      const item = trimmed.slice(2).trim();
+      if (currentSection === "steps") {
+        steps.push(item);
+      } else if (currentSection === "constraints") {
+        constraints.push(item);
+      }
+    }
+  }
+  return { steps, constraints };
+}
+function parseStep(raw) {
+  const label = stripAnnotations(raw);
+  const id = slugify(label);
+  const tools = extractBracketAnnotation(raw, "tools");
+  const tags = extractBracketAnnotation(raw, "tag");
+  const verifyArr = extractBracketAnnotation(raw, "verify");
+  const requires = extractParenAnnotation(raw, "after");
+  return {
+    id,
+    label,
+    tools: tools ?? void 0,
+    tags: tags ?? void 0,
+    verify: verifyArr?.[0] ?? void 0,
+    requires: requires ?? void 0,
+    status: "pending"
+  };
+}
+function parseConstraint(raw, index) {
+  const typeAnnotation = extractBracketAnnotation(raw, "type");
+  const description = stripAnnotations(raw);
+  const id = `constraint_${index}`;
+  let type = "custom";
+  let enforcement = "block";
+  let limit;
+  let unit;
+  if (typeAnnotation?.[0] === "approval") {
+    type = "approval";
+    enforcement = "pause";
+  } else if (/budget|\$|spending|cost/i.test(description)) {
+    type = "budget";
+    const amountMatch = description.match(/\$?([\d,]+)/);
+    if (amountMatch) {
+      limit = parseInt(amountMatch[1].replace(/,/g, ""), 10);
+      unit = "USD";
+    }
+  } else if (/time|hour|minute|day|deadline/i.test(description)) {
+    type = "time";
+  } else if (/scope|access|database|production/i.test(description)) {
+    type = "scope";
+  }
+  const trigger = description.toLowerCase();
+  return {
+    id,
+    type,
+    description,
+    enforcement,
+    limit,
+    unit,
+    trigger
+  };
+}
+function parsePlanMarkdown(markdown) {
+  const errors = [];
+  const { frontmatter, body } = parseFrontmatter(markdown.trim());
+  const { steps: stepLines, constraints: constraintLines } = parseSections(body);
+  if (!frontmatter.plan_id) {
+    errors.push("Missing required field: plan_id");
+  }
+  if (stepLines.length === 0) {
+    errors.push("Plan must have at least one step");
+  }
+  if (errors.length > 0) {
+    return { success: false, errors };
+  }
+  const steps = stepLines.map((line) => parseStep(line));
+  const constraints = constraintLines.map((line, i) => parseConstraint(line, i));
+  let expires_at;
+  if (frontmatter.expires) {
+    expires_at = new Date(frontmatter.expires).toISOString();
+  }
+  const completionRaw = frontmatter.completion?.toLowerCase();
+  const completion = completionRaw === "verified" ? "verified" : "trust";
+  const plan = {
+    plan_id: frontmatter.plan_id,
+    objective: frontmatter.objective ?? "",
+    sequential: frontmatter.sequential === "true",
+    completion,
+    steps,
+    constraints,
+    world_id: frontmatter.world ?? void 0,
+    created_at: (/* @__PURE__ */ new Date()).toISOString(),
+    expires_at
+  };
+  return { success: true, plan, errors: [] };
+}
+
+// src/contracts/plan-contract.ts
+var PLAN_EXIT_CODES = {
+  ON_PLAN: 0,
+  OFF_PLAN: 1,
+  CONSTRAINT_VIOLATED: 2,
+  ERROR: 3,
+  PLAN_COMPLETE: 4
+};
+
+export {
+  parsePlanMarkdown,
+  PLAN_EXIT_CODES
+};