@neuroverseos/governance 0.9.0 → 0.11.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (99) hide show
  1. package/README.md +1 -1
  2. package/dist/adapters/autoresearch.cjs +19 -1
  3. package/dist/adapters/autoresearch.d.cts +1 -1
  4. package/dist/adapters/autoresearch.d.ts +1 -1
  5. package/dist/adapters/autoresearch.js +2 -2
  6. package/dist/adapters/deep-agents.cjs +19 -1
  7. package/dist/adapters/deep-agents.d.cts +2 -2
  8. package/dist/adapters/deep-agents.d.ts +2 -2
  9. package/dist/adapters/deep-agents.js +2 -2
  10. package/dist/adapters/express.cjs +19 -1
  11. package/dist/adapters/express.d.cts +1 -1
  12. package/dist/adapters/express.d.ts +1 -1
  13. package/dist/adapters/express.js +2 -2
  14. package/dist/adapters/github.cjs +19 -1
  15. package/dist/adapters/github.d.cts +2 -2
  16. package/dist/adapters/github.d.ts +2 -2
  17. package/dist/adapters/github.js +2 -2
  18. package/dist/adapters/index.cjs +19 -1
  19. package/dist/adapters/index.d.cts +2 -2
  20. package/dist/adapters/index.d.ts +2 -2
  21. package/dist/adapters/index.js +8 -8
  22. package/dist/adapters/langchain.cjs +19 -1
  23. package/dist/adapters/langchain.d.cts +2 -2
  24. package/dist/adapters/langchain.d.ts +2 -2
  25. package/dist/adapters/langchain.js +2 -2
  26. package/dist/adapters/mentraos.cjs +19 -1
  27. package/dist/adapters/mentraos.d.cts +2 -2
  28. package/dist/adapters/mentraos.d.ts +2 -2
  29. package/dist/adapters/mentraos.js +2 -2
  30. package/dist/adapters/openai.cjs +19 -1
  31. package/dist/adapters/openai.d.cts +2 -2
  32. package/dist/adapters/openai.d.ts +2 -2
  33. package/dist/adapters/openai.js +2 -2
  34. package/dist/adapters/openclaw.cjs +19 -1
  35. package/dist/adapters/openclaw.d.cts +2 -2
  36. package/dist/adapters/openclaw.d.ts +2 -2
  37. package/dist/adapters/openclaw.js +2 -2
  38. package/dist/admin/index.cjs +19 -1
  39. package/dist/admin/index.js +1 -1
  40. package/dist/audit-CRJOB4CP.js +93 -0
  41. package/dist/audit-behavior-C62FdRAC.d.cts +100 -0
  42. package/dist/audit-behavior-DFy7LeYv.d.ts +100 -0
  43. package/dist/{behavioral-SPWPGYXL.js → behavioral-4TKMHZQZ.js} +2 -2
  44. package/dist/{chunk-OQU65525.js → chunk-24YW7BHC.js} +1 -1
  45. package/dist/{chunk-3ZWU7C43.js → chunk-2KTPIE57.js} +494 -14
  46. package/dist/{chunk-TJ5L2UTE.js → chunk-5K3LATTM.js} +1 -1
  47. package/dist/{chunk-HDNDL6D5.js → chunk-5LDBYOSJ.js} +1 -1
  48. package/dist/{chunk-FDPPZLSQ.js → chunk-5ZWKM7MO.js} +1 -1
  49. package/dist/{chunk-B3IIPTY3.js → chunk-6MB6TMAG.js} +1 -1
  50. package/dist/{chunk-IOVXB6QN.js → chunk-GXTAHCND.js} +1 -1
  51. package/dist/{chunk-FKQCPRKI.js → chunk-MAOIHKFO.js} +1 -1
  52. package/dist/{chunk-ZAF6JH23.js → chunk-MBOW6YXN.js} +19 -1
  53. package/dist/{chunk-A2UZTLRV.js → chunk-MLXKSX3L.js} +1 -1
  54. package/dist/{chunk-7FL3U7Z5.js → chunk-MWGEXHOD.js} +1 -1
  55. package/dist/{chunk-6CV4XG3J.js → chunk-QFDFAWZ6.js} +1 -1
  56. package/dist/{chunk-2VAWP6FI.js → chunk-RAS62JXV.js} +1 -1
  57. package/dist/{chunk-OTZU76DH.js → chunk-XAF3CYCW.js} +1 -1
  58. package/dist/{chunk-T6GMRZWC.js → chunk-XTYQCTDD.js} +1 -1
  59. package/dist/{chunk-TIXVEPS2.js → chunk-YN7OI5ZV.js} +1 -1
  60. package/dist/cli/neuroverse.cjs +999 -111
  61. package/dist/cli/neuroverse.js +16 -12
  62. package/dist/cli/plan.cjs +18 -0
  63. package/dist/cli/radiant.cjs +814 -17
  64. package/dist/cli/radiant.d.cts +44 -1
  65. package/dist/cli/radiant.d.ts +44 -1
  66. package/dist/cli/radiant.js +295 -7
  67. package/dist/cli/run.cjs +18 -0
  68. package/dist/cli/run.js +4 -4
  69. package/dist/{decision-flow-IJPNMVQK.js → decision-flow-5VI5YG6A.js} +2 -2
  70. package/dist/{demo-6W3YXLAX.js → demo-GYX6CYHC.js} +2 -2
  71. package/dist/engine/guard-engine.cjs +19 -1
  72. package/dist/engine/guard-engine.d.cts +21 -1
  73. package/dist/engine/guard-engine.d.ts +21 -1
  74. package/dist/engine/guard-engine.js +1 -1
  75. package/dist/{equity-penalties-CCO3GVHS.js → equity-penalties-NOM46NEO.js} +2 -2
  76. package/dist/{guard-IHJEKHL2.js → guard-PQ3SYV4Y.js} +3 -3
  77. package/dist/{guard-contract-ddiIPlOg.d.cts → guard-contract-Oznf-Kgq.d.cts} +32 -0
  78. package/dist/{guard-contract-q6HJAq3Q.d.ts → guard-contract-w_i_6gh-.d.ts} +32 -0
  79. package/dist/{impact-WIAM66IH.js → impact-LDJLTVRU.js} +3 -3
  80. package/dist/index.cjs +62 -1
  81. package/dist/index.d.cts +4 -3
  82. package/dist/index.d.ts +4 -3
  83. package/dist/index.js +49 -8
  84. package/dist/{mcp-server-CKYBHXWK.js → mcp-server-W3MWSKD7.js} +2 -2
  85. package/dist/{playground-3TTBN7XD.js → playground-SSZRNUAF.js} +1 -1
  86. package/dist/radiant/index.cjs +517 -14
  87. package/dist/radiant/index.d.cts +180 -10
  88. package/dist/radiant/index.d.ts +180 -10
  89. package/dist/radiant/index.js +12 -2
  90. package/dist/{redteam-W644UMWN.js → redteam-KCULS7EW.js} +1 -1
  91. package/dist/{server-JKUBUK5H.js → server-EGRGGSM2.js} +2 -2
  92. package/dist/{session-FMAROEIE.js → session-PZLTL22G.js} +2 -2
  93. package/dist/{shared-PpalGKxc.d.cts → shared-BC8mOpt0.d.cts} +1 -1
  94. package/dist/{shared-DAzdfWtU.d.ts → shared-CP63gNNW.d.ts} +1 -1
  95. package/dist/{test-XDB2DH3L.js → test-LIHGWHBA.js} +1 -1
  96. package/dist/{trace-2YDNAXMK.js → trace-DC3D7XPD.js} +2 -2
  97. package/examples/radiant-weekly-workflow.yml +4 -1
  98. package/package.json +1 -1
  99. /package/dist/{doctor-XEMLO6UA.js → doctor-SIWQGTAO.js} +0 -0
@@ -1,5 +1,5 @@
1
1
  import { WorldDefinition, GovernanceEvent } from '../types.js';
2
- import { a as GuardEvent, b as GuardEngineOptions, G as GuardVerdict, d as GuardStatus } from '../guard-contract-q6HJAq3Q.js';
2
+ import { a as GuardEvent, b as GuardEngineOptions, G as GuardVerdict, d as GuardStatus } from '../guard-contract-w_i_6gh-.js';
3
3
 
4
4
  /**
5
5
  * Guard Engine — Deterministic Governance Evaluator
@@ -28,6 +28,26 @@ import { a as GuardEvent, b as GuardEngineOptions, G as GuardVerdict, d as Guard
28
28
  * - No hidden logic. Everything is in the world file or declared here.
29
29
  */
30
30
 
31
+ /**
32
+ * Evaluate a guard event against a world definition.
33
+ *
34
+ * This is the entire guard engine. One function. Deterministic.
35
+ * No class instantiation, no state, no side effects.
36
+ *
37
+ * Two modes, same evaluation logic:
38
+ *
39
+ * mode: 'enforce' (default)
40
+ * Returns the real verdict — BLOCK blocks, PAUSE pauses, MODIFY
41
+ * modifies, PENALIZE penalizes.
42
+ *
43
+ * mode: 'observe'
44
+ * Runs every layer identically, then coerces any non-ALLOW verdict
45
+ * to ALLOW before returning — preserving the original status on
46
+ * `shadowStatus`. The caller passes the action through; Radiant /
47
+ * Bevia / audit logs read `shadowStatus` to see what WOULD have
48
+ * happened. This is how teams roll out governance without the
49
+ * political cost of enforcement.
50
+ */
31
51
  declare function evaluateGuard(event: GuardEvent, world: WorldDefinition, options?: GuardEngineOptions): GuardVerdict;
32
52
  /**
33
53
  * Build a normalized allowlist key from a GuardEvent.
@@ -2,7 +2,7 @@ import {
2
2
  evaluateGuard,
3
3
  eventToAllowlistKey,
4
4
  verdictToEvent
5
- } from "../chunk-ZAF6JH23.js";
5
+ } from "../chunk-MBOW6YXN.js";
6
6
  import "../chunk-QLPTHTVB.js";
7
7
  import "../chunk-QWGCMQQD.js";
8
8
  export {
@@ -8,13 +8,13 @@ import {
8
8
  } from "./chunk-D2UCV5AK.js";
9
9
  import {
10
10
  verdictToAuditEvent
11
- } from "./chunk-2VAWP6FI.js";
11
+ } from "./chunk-RAS62JXV.js";
12
12
  import {
13
13
  loadWorld
14
14
  } from "./chunk-I4RTIMLX.js";
15
15
  import {
16
16
  evaluateGuard
17
- } from "./chunk-ZAF6JH23.js";
17
+ } from "./chunk-MBOW6YXN.js";
18
18
  import "./chunk-QLPTHTVB.js";
19
19
  import "./chunk-QWGCMQQD.js";
20
20
 
@@ -4,12 +4,12 @@ import {
4
4
  import {
5
5
  GUARD_EXIT_CODES,
6
6
  evaluateGuardWithAI
7
- } from "./chunk-6CV4XG3J.js";
7
+ } from "./chunk-QFDFAWZ6.js";
8
8
  import "./chunk-INWQHLPS.js";
9
9
  import {
10
10
  FileAuditLogger,
11
11
  verdictToAuditEvent
12
- } from "./chunk-2VAWP6FI.js";
12
+ } from "./chunk-RAS62JXV.js";
13
13
  import {
14
14
  describeActiveWorld,
15
15
  resolveWorldPath
@@ -19,7 +19,7 @@ import {
19
19
  } from "./chunk-I4RTIMLX.js";
20
20
  import {
21
21
  evaluateGuard
22
- } from "./chunk-ZAF6JH23.js";
22
+ } from "./chunk-MBOW6YXN.js";
23
23
  import "./chunk-QLPTHTVB.js";
24
24
  import "./chunk-QWGCMQQD.js";
25
25
 
@@ -364,6 +364,20 @@ interface GuardVerdict {
364
364
  reason?: string;
365
365
  /** ID of the rule/guard that produced this verdict */
366
366
  ruleId?: string;
367
+ /**
368
+ * Shadow verdict — populated when the engine ran in `mode: 'observe'`.
369
+ * If the real enforcement decision would have been BLOCK/PAUSE/MODIFY/
370
+ * PENALIZE, that original status is captured here while `status` is
371
+ * coerced to ALLOW so the caller passes the action through.
372
+ *
373
+ * Use this for observe/shadow/mirror-mode governance: the engine
374
+ * records every crossing of a rule without stopping anything. Lets
375
+ * teams adopt governance without the political cost of enforcement,
376
+ * and lets tools like Radiant surface which invariants got bumped.
377
+ */
378
+ shadowStatus?: GuardStatus;
379
+ /** Reason the shadow verdict fired (empty when shadowStatus is absent) */
380
+ shadowReason?: string;
367
381
  /** Advisory warning (for ALLOW with warn-mode guards) */
368
382
  warning?: string;
369
383
  /** Consequence applied (for PENALIZE verdicts) */
@@ -494,6 +508,24 @@ interface GuardEngineOptions {
494
508
  trace?: boolean;
495
509
  /** Enforcement level override. If not set, uses world default or 'standard'. */
496
510
  level?: 'basic' | 'standard' | 'strict';
511
+ /**
512
+ * Enforcement mode.
513
+ *
514
+ * - `'enforce'` (default) — the engine returns its real verdict. BLOCK
515
+ * blocks, PAUSE pauses, PENALIZE penalizes, MODIFY modifies.
516
+ *
517
+ * - `'observe'` — the engine evaluates every rule exactly the same way,
518
+ * but coerces non-ALLOW verdicts to ALLOW before returning. The
519
+ * original status is preserved on `shadowStatus` so the caller can
520
+ * record the crossing without blocking the action. Used by Radiant
521
+ * + Bevia to show leaders where their worldmodel is being touched
522
+ * without imposing enforcement, and by teams who want to roll out
523
+ * governance gradually rule-by-rule.
524
+ *
525
+ * Observe mode does NOT alter the evaluation — all layers still run.
526
+ * It only changes how the final verdict is packaged for the caller.
527
+ */
528
+ mode?: 'enforce' | 'observe';
497
529
  /**
498
530
  * Session allowlist — set of pre-approved event keys.
499
531
  * Use `eventToAllowlistKey(event)` to build keys.
@@ -364,6 +364,20 @@ interface GuardVerdict {
364
364
  reason?: string;
365
365
  /** ID of the rule/guard that produced this verdict */
366
366
  ruleId?: string;
367
+ /**
368
+ * Shadow verdict — populated when the engine ran in `mode: 'observe'`.
369
+ * If the real enforcement decision would have been BLOCK/PAUSE/MODIFY/
370
+ * PENALIZE, that original status is captured here while `status` is
371
+ * coerced to ALLOW so the caller passes the action through.
372
+ *
373
+ * Use this for observe/shadow/mirror-mode governance: the engine
374
+ * records every crossing of a rule without stopping anything. Lets
375
+ * teams adopt governance without the political cost of enforcement,
376
+ * and lets tools like Radiant surface which invariants got bumped.
377
+ */
378
+ shadowStatus?: GuardStatus;
379
+ /** Reason the shadow verdict fired (empty when shadowStatus is absent) */
380
+ shadowReason?: string;
367
381
  /** Advisory warning (for ALLOW with warn-mode guards) */
368
382
  warning?: string;
369
383
  /** Consequence applied (for PENALIZE verdicts) */
@@ -494,6 +508,24 @@ interface GuardEngineOptions {
494
508
  trace?: boolean;
495
509
  /** Enforcement level override. If not set, uses world default or 'standard'. */
496
510
  level?: 'basic' | 'standard' | 'strict';
511
+ /**
512
+ * Enforcement mode.
513
+ *
514
+ * - `'enforce'` (default) — the engine returns its real verdict. BLOCK
515
+ * blocks, PAUSE pauses, PENALIZE penalizes, MODIFY modifies.
516
+ *
517
+ * - `'observe'` — the engine evaluates every rule exactly the same way,
518
+ * but coerces non-ALLOW verdicts to ALLOW before returning. The
519
+ * original status is preserved on `shadowStatus` so the caller can
520
+ * record the crossing without blocking the action. Used by Radiant
521
+ * + Bevia to show leaders where their worldmodel is being touched
522
+ * without imposing enforcement, and by teams who want to roll out
523
+ * governance gradually rule-by-rule.
524
+ *
525
+ * Observe mode does NOT alter the evaluation — all layers still run.
526
+ * It only changes how the final verdict is packaged for the caller.
527
+ */
528
+ mode?: 'enforce' | 'observe';
497
529
  /**
498
530
  * Session allowlist — set of pre-approved event keys.
499
531
  * Use `eventToAllowlistKey(event)` to build keys.
@@ -1,11 +1,11 @@
1
1
  import {
2
2
  generateImpactReport,
3
3
  renderImpactReport
4
- } from "./chunk-OQU65525.js";
4
+ } from "./chunk-24YW7BHC.js";
5
5
  import {
6
6
  readAuditLog
7
- } from "./chunk-2VAWP6FI.js";
8
- import "./chunk-ZAF6JH23.js";
7
+ } from "./chunk-RAS62JXV.js";
8
+ import "./chunk-MBOW6YXN.js";
9
9
  import "./chunk-QLPTHTVB.js";
10
10
  import "./chunk-QWGCMQQD.js";
11
11
 
package/dist/index.cjs CHANGED
@@ -966,6 +966,8 @@ __export(index_exports, {
966
966
  advancePlan: () => advancePlan,
967
967
  applyConsequence: () => applyConsequence,
968
968
  applyReward: () => applyReward,
969
+ auditBehavior: () => auditBehavior,
970
+ auditBehaviors: () => auditBehaviors,
969
971
  buildPlanCheck: () => buildPlanCheck,
970
972
  classifyAdaptation: () => classifyAdaptation,
971
973
  classifyIntent: () => classifyIntent,
@@ -1362,8 +1364,26 @@ function isExternalScope(scope) {
1362
1364
  ];
1363
1365
  return !internalPatterns.some((p) => p.test(scope));
1364
1366
  }
1365
- var MAX_INPUT_LENGTH = 1e5;
1366
1367
  function evaluateGuard(event, world, options = {}) {
1368
+ const verdict = evaluateGuardCore(event, world, options);
1369
+ return options.mode === "observe" ? toShadowVerdict(verdict) : verdict;
1370
+ }
1371
+ function toShadowVerdict(verdict) {
1372
+ if (verdict.status === "ALLOW") return verdict;
1373
+ return {
1374
+ ...verdict,
1375
+ status: "ALLOW",
1376
+ shadowStatus: verdict.status,
1377
+ shadowReason: verdict.reason,
1378
+ // Preserve the original reason as shadowReason and wipe the
1379
+ // top-level reason so callers that display `reason` for BLOCK/PAUSE
1380
+ // don't accidentally surface an enforcement message.
1381
+ reason: void 0,
1382
+ warning: verdict.reason ? `Observe mode: would have ${verdict.status.toLowerCase()} \u2014 ${verdict.reason}` : `Observe mode: would have ${verdict.status.toLowerCase()}`
1383
+ };
1384
+ }
1385
+ var MAX_INPUT_LENGTH = 1e5;
1386
+ function evaluateGuardCore(event, world, options = {}) {
1367
1387
  const startTime = performance.now();
1368
1388
  const level = options.level ?? "standard";
1369
1389
  const includeTrace = options.trace ?? false;
@@ -2151,6 +2171,45 @@ function verdictToEvent(status, intent) {
2151
2171
  };
2152
2172
  }
2153
2173
 
2174
+ // src/engine/audit-behavior.ts
2175
+ function auditBehavior(event, world) {
2176
+ const guardEvent = toGuardEvent(event);
2177
+ const verdict = evaluateGuard(guardEvent, world, { mode: "observe" });
2178
+ const wouldHaveBlocked = verdict.shadowStatus !== void 0 && verdict.shadowStatus !== "ALLOW";
2179
+ return {
2180
+ eventId: event.id,
2181
+ timestamp: event.timestamp,
2182
+ kind: event.kind,
2183
+ actorId: event.actorId,
2184
+ shadowStatus: verdict.shadowStatus ?? "ALLOW",
2185
+ shadowReason: verdict.shadowReason,
2186
+ ruleId: verdict.ruleId,
2187
+ excerpt: event.content ? excerptContent(event.content) : void 0,
2188
+ wouldHaveBlocked,
2189
+ verdict
2190
+ };
2191
+ }
2192
+ function auditBehaviors(events, world) {
2193
+ return events.map((e) => auditBehavior(e, world));
2194
+ }
2195
+ function toGuardEvent(event) {
2196
+ return {
2197
+ intent: event.content ?? event.kind ?? "unspecified",
2198
+ tool: event.kind,
2199
+ scope: event.scope,
2200
+ payload: {
2201
+ actorId: event.actorId,
2202
+ actorKind: event.actorKind,
2203
+ timestamp: event.timestamp,
2204
+ sourceEventId: event.id
2205
+ }
2206
+ };
2207
+ }
2208
+ function excerptContent(content, max = 280) {
2209
+ if (content.length <= max) return content;
2210
+ return content.slice(0, max - 1).trimEnd() + "\u2026";
2211
+ }
2212
+
2154
2213
  // src/providers/ai-provider.ts
2155
2214
  var ChatCompletionsProvider = class {
2156
2215
  model;
@@ -8357,6 +8416,8 @@ function handleCreateCapsule(body) {
8357
8416
  advancePlan,
8358
8417
  applyConsequence,
8359
8418
  applyReward,
8419
+ auditBehavior,
8420
+ auditBehaviors,
8360
8421
  buildPlanCheck,
8361
8422
  classifyAdaptation,
8362
8423
  classifyIntent,
package/dist/index.d.cts CHANGED
@@ -1,6 +1,7 @@
1
1
  export { evaluateGuard, eventToAllowlistKey, verdictToEvent } from './engine/guard-engine.cjs';
2
- import { b as GuardEngineOptions, G as GuardVerdict, a as GuardEvent, P as PlanDefinition, S as StepEvidence, A as AdvanceResult, e as PlanVerdict, f as PlanCheck, c as PlanProgress, g as AgentBehaviorState, d as GuardStatus, C as Consequence, R as Reward } from './guard-contract-ddiIPlOg.cjs';
3
- export { E as EvaluationTrace, h as GUARD_EXIT_CODES, i as GuardCheck, j as GuardExitCode, I as IntentRecord, k as InvariantCheck, K as KernelRuleCheck, L as LevelCheck, l as PLAN_EXIT_CODES, m as PlanCompletionMode, n as PlanConstraint, o as PlanExitCode, p as PlanStatus, q as PlanStep, r as PrecedenceResolution, s as RoleCheck, t as SafetyCheck, V as VerdictEvidence } from './guard-contract-ddiIPlOg.cjs';
2
+ export { A as AuditableEvent, C as Crossing, a as auditBehavior, b as auditBehaviors } from './audit-behavior-C62FdRAC.cjs';
3
+ import { b as GuardEngineOptions, G as GuardVerdict, a as GuardEvent, P as PlanDefinition, S as StepEvidence, A as AdvanceResult, e as PlanVerdict, f as PlanCheck, c as PlanProgress, g as AgentBehaviorState, d as GuardStatus, C as Consequence, R as Reward } from './guard-contract-Oznf-Kgq.cjs';
4
+ export { E as EvaluationTrace, h as GUARD_EXIT_CODES, i as GuardCheck, j as GuardExitCode, I as IntentRecord, k as InvariantCheck, K as KernelRuleCheck, L as LevelCheck, l as PLAN_EXIT_CODES, m as PlanCompletionMode, n as PlanConstraint, o as PlanExitCode, p as PlanStatus, q as PlanStep, r as PrecedenceResolution, s as RoleCheck, t as SafetyCheck, V as VerdictEvidence } from './guard-contract-Oznf-Kgq.cjs';
4
5
  import { WorldDefinition, Guard, Invariant, Rule } from './types.cjs';
5
6
  export { GovernanceEvent } from './types.cjs';
6
7
  export { parseWorldMarkdown } from './engine/bootstrap-parser.cjs';
@@ -8,7 +9,7 @@ export { emitWorldDefinition } from './engine/bootstrap-emitter.cjs';
8
9
  export { B as BOOTSTRAP_EXIT_CODES, b as BootstrapExitCode, c as BootstrapResult, a as ParseIssue, d as ParsedAssumptionProfile, e as ParsedEffect, f as ParsedFrontmatter, g as ParsedGate, h as ParsedInvariant, i as ParsedOutcome, j as ParsedRule, k as ParsedStateVariable, l as ParsedTrigger, P as ParsedWorld } from './bootstrap-contract-DcV6t-8M.cjs';
9
10
  export { AppliedEffect, EventApplication, RuleEvaluation, SimulateOptions, SimulationResult, SimulationStep, renderSimulateText, simulateWorld } from './engine/simulate-engine.cjs';
10
11
  export { ActionsOutput, GitHubAction, GitHubGovernanceBlockedError, GitHubGovernanceResult, GitHubGovernor, GitHubGovernorOptions, GitHubWebhookEvent, GitHubWebhookHandler, WebhookGovernanceResult, WebhookHandlerOptions, createGitHubGovernor, createGitHubGovernorFromWorld, createGitHubWebhookHandler, createGitHubWebhookHandlerFromWorld, formatForActions, formatPRComment } from './adapters/github.cjs';
11
- import './shared-PpalGKxc.cjs';
12
+ import './shared-BC8mOpt0.cjs';
12
13
 
13
14
  /**
14
15
  * Derive Contract — AI-Assisted World Synthesis Types
package/dist/index.d.ts CHANGED
@@ -1,6 +1,7 @@
1
1
  export { evaluateGuard, eventToAllowlistKey, verdictToEvent } from './engine/guard-engine.js';
2
- import { b as GuardEngineOptions, G as GuardVerdict, a as GuardEvent, P as PlanDefinition, S as StepEvidence, A as AdvanceResult, e as PlanVerdict, f as PlanCheck, c as PlanProgress, g as AgentBehaviorState, d as GuardStatus, C as Consequence, R as Reward } from './guard-contract-q6HJAq3Q.js';
3
- export { E as EvaluationTrace, h as GUARD_EXIT_CODES, i as GuardCheck, j as GuardExitCode, I as IntentRecord, k as InvariantCheck, K as KernelRuleCheck, L as LevelCheck, l as PLAN_EXIT_CODES, m as PlanCompletionMode, n as PlanConstraint, o as PlanExitCode, p as PlanStatus, q as PlanStep, r as PrecedenceResolution, s as RoleCheck, t as SafetyCheck, V as VerdictEvidence } from './guard-contract-q6HJAq3Q.js';
2
+ export { A as AuditableEvent, C as Crossing, a as auditBehavior, b as auditBehaviors } from './audit-behavior-DFy7LeYv.js';
3
+ import { b as GuardEngineOptions, G as GuardVerdict, a as GuardEvent, P as PlanDefinition, S as StepEvidence, A as AdvanceResult, e as PlanVerdict, f as PlanCheck, c as PlanProgress, g as AgentBehaviorState, d as GuardStatus, C as Consequence, R as Reward } from './guard-contract-w_i_6gh-.js';
4
+ export { E as EvaluationTrace, h as GUARD_EXIT_CODES, i as GuardCheck, j as GuardExitCode, I as IntentRecord, k as InvariantCheck, K as KernelRuleCheck, L as LevelCheck, l as PLAN_EXIT_CODES, m as PlanCompletionMode, n as PlanConstraint, o as PlanExitCode, p as PlanStatus, q as PlanStep, r as PrecedenceResolution, s as RoleCheck, t as SafetyCheck, V as VerdictEvidence } from './guard-contract-w_i_6gh-.js';
4
5
  import { WorldDefinition, Guard, Invariant, Rule } from './types.js';
5
6
  export { GovernanceEvent } from './types.js';
6
7
  export { parseWorldMarkdown } from './engine/bootstrap-parser.js';
@@ -8,7 +9,7 @@ export { emitWorldDefinition } from './engine/bootstrap-emitter.js';
8
9
  export { B as BOOTSTRAP_EXIT_CODES, b as BootstrapExitCode, c as BootstrapResult, a as ParseIssue, d as ParsedAssumptionProfile, e as ParsedEffect, f as ParsedFrontmatter, g as ParsedGate, h as ParsedInvariant, i as ParsedOutcome, j as ParsedRule, k as ParsedStateVariable, l as ParsedTrigger, P as ParsedWorld } from './bootstrap-contract-DcV6t-8M.js';
9
10
  export { AppliedEffect, EventApplication, RuleEvaluation, SimulateOptions, SimulationResult, SimulationStep, renderSimulateText, simulateWorld } from './engine/simulate-engine.js';
10
11
  export { ActionsOutput, GitHubAction, GitHubGovernanceBlockedError, GitHubGovernanceResult, GitHubGovernor, GitHubGovernorOptions, GitHubWebhookEvent, GitHubWebhookHandler, WebhookGovernanceResult, WebhookHandlerOptions, createGitHubGovernor, createGitHubGovernorFromWorld, createGitHubWebhookHandler, createGitHubWebhookHandlerFromWorld, formatForActions, formatPRComment } from './adapters/github.js';
11
- import './shared-DAzdfWtU.js';
12
+ import './shared-CP63gNNW.js';
12
13
 
13
14
  /**
14
15
  * Derive Contract — AI-Assisted World Synthesis Types
package/dist/index.js CHANGED
@@ -2,7 +2,7 @@ import {
2
2
  generateImpactReport,
3
3
  generateImpactReportFromFile,
4
4
  renderImpactReport
5
- } from "./chunk-OQU65525.js";
5
+ } from "./chunk-24YW7BHC.js";
6
6
  import {
7
7
  VALIDATE_EXIT_CODES
8
8
  } from "./chunk-I3RRAYK2.js";
@@ -11,7 +11,7 @@ import {
11
11
  classifyIntentWithAI,
12
12
  evaluateGuardWithAI,
13
13
  extractContentFields
14
- } from "./chunk-6CV4XG3J.js";
14
+ } from "./chunk-QFDFAWZ6.js";
15
15
  import {
16
16
  actionToGuardEvent,
17
17
  createGovernor,
@@ -21,7 +21,7 @@ import {
21
21
  handleListPresets,
22
22
  handleReasonRequest,
23
23
  writeTempWorld
24
- } from "./chunk-7FL3U7Z5.js";
24
+ } from "./chunk-MWGEXHOD.js";
25
25
  import {
26
26
  adaptationFromVerdict,
27
27
  classifyAdaptation,
@@ -54,7 +54,7 @@ import {
54
54
  SessionManager,
55
55
  runInteractiveMode,
56
56
  runPipeMode
57
- } from "./chunk-OTZU76DH.js";
57
+ } from "./chunk-XAF3CYCW.js";
58
58
  import {
59
59
  applyConsequence,
60
60
  applyReward,
@@ -70,7 +70,7 @@ import {
70
70
  } from "./chunk-A5W4GNQO.js";
71
71
  import {
72
72
  McpGovernanceServer
73
- } from "./chunk-FDPPZLSQ.js";
73
+ } from "./chunk-5ZWKM7MO.js";
74
74
  import {
75
75
  addGuard,
76
76
  addInvariant,
@@ -103,7 +103,7 @@ import {
103
103
  readAuditLog,
104
104
  summarizeAuditEvents,
105
105
  verdictToAuditEvent
106
- } from "./chunk-2VAWP6FI.js";
106
+ } from "./chunk-RAS62JXV.js";
107
107
  import {
108
108
  describeActiveWorld,
109
109
  getActiveWorldName,
@@ -121,7 +121,7 @@ import {
121
121
  createGitHubWebhookHandlerFromWorld,
122
122
  formatForActions,
123
123
  formatPRComment
124
- } from "./chunk-A2UZTLRV.js";
124
+ } from "./chunk-MLXKSX3L.js";
125
125
  import "./chunk-5U2MQO5P.js";
126
126
  import {
127
127
  loadWorld,
@@ -131,7 +131,7 @@ import {
131
131
  evaluateGuard,
132
132
  eventToAllowlistKey,
133
133
  verdictToEvent
134
- } from "./chunk-ZAF6JH23.js";
134
+ } from "./chunk-MBOW6YXN.js";
135
135
  import {
136
136
  advancePlan,
137
137
  buildPlanCheck,
@@ -140,6 +140,45 @@ import {
140
140
  } from "./chunk-QLPTHTVB.js";
141
141
  import "./chunk-QWGCMQQD.js";
142
142
 
143
+ // src/engine/audit-behavior.ts
144
+ function auditBehavior(event, world) {
145
+ const guardEvent = toGuardEvent(event);
146
+ const verdict = evaluateGuard(guardEvent, world, { mode: "observe" });
147
+ const wouldHaveBlocked = verdict.shadowStatus !== void 0 && verdict.shadowStatus !== "ALLOW";
148
+ return {
149
+ eventId: event.id,
150
+ timestamp: event.timestamp,
151
+ kind: event.kind,
152
+ actorId: event.actorId,
153
+ shadowStatus: verdict.shadowStatus ?? "ALLOW",
154
+ shadowReason: verdict.shadowReason,
155
+ ruleId: verdict.ruleId,
156
+ excerpt: event.content ? excerptContent(event.content) : void 0,
157
+ wouldHaveBlocked,
158
+ verdict
159
+ };
160
+ }
161
+ function auditBehaviors(events, world) {
162
+ return events.map((e) => auditBehavior(e, world));
163
+ }
164
+ function toGuardEvent(event) {
165
+ return {
166
+ intent: event.content ?? event.kind ?? "unspecified",
167
+ tool: event.kind,
168
+ scope: event.scope,
169
+ payload: {
170
+ actorId: event.actorId,
171
+ actorKind: event.actorKind,
172
+ timestamp: event.timestamp,
173
+ sourceEventId: event.id
174
+ }
175
+ };
176
+ }
177
+ function excerptContent(content, max = 280) {
178
+ if (content.length <= max) return content;
179
+ return content.slice(0, max - 1).trimEnd() + "\u2026";
180
+ }
181
+
143
182
  // src/engine/verdict-formatter.ts
144
183
  var ANSI = {
145
184
  red: "\x1B[31m",
@@ -435,6 +474,8 @@ export {
435
474
  advancePlan,
436
475
  applyConsequence,
437
476
  applyReward,
477
+ auditBehavior,
478
+ auditBehaviors,
438
479
  buildPlanCheck,
439
480
  classifyAdaptation,
440
481
  classifyIntent,
@@ -1,10 +1,10 @@
1
1
  import {
2
2
  McpGovernanceServer,
3
3
  startMcpServer
4
- } from "./chunk-FDPPZLSQ.js";
4
+ } from "./chunk-5ZWKM7MO.js";
5
5
  import "./chunk-AKW5YVCE.js";
6
6
  import "./chunk-I4RTIMLX.js";
7
- import "./chunk-ZAF6JH23.js";
7
+ import "./chunk-MBOW6YXN.js";
8
8
  import "./chunk-QLPTHTVB.js";
9
9
  import "./chunk-QWGCMQQD.js";
10
10
  export {
@@ -8,7 +8,7 @@ import {
8
8
  } from "./chunk-I4RTIMLX.js";
9
9
  import {
10
10
  evaluateGuard
11
- } from "./chunk-ZAF6JH23.js";
11
+ } from "./chunk-MBOW6YXN.js";
12
12
  import "./chunk-QLPTHTVB.js";
13
13
  import "./chunk-QWGCMQQD.js";
14
14