@runhalo/cli 0.4.1 → 0.6.0

package/dist/index.js

@@ -180,7 +180,7 @@ function formatSARIF(results, rules) {
                             name: r.name,
                             shortDescription: { text: r.description },
                             helpUri: `https://runhalo.dev/rules/${r.id}`,
-                            defaultConfiguration: { level: r.severity }
+                            defaultConfiguration: { level: r.severity === 'critical' || r.severity === 'high' ? 'error' : r.severity === 'medium' ? 'warning' : 'note' }
                         }))
                     }
                 },
@@ -248,6 +248,81 @@ const useColor = !process.env.NO_COLOR && process.stdout.isTTY !== false;
 function c(color, text) {
     return useColor ? `${color}${text}${colors.reset}` : text;
 }
+// Enforcement lookup: rule_id → matching enforcement cases
+// Source of truth: halo-admin/src/data/regulatory-actions.ts
+const ENFORCEMENT_DATA = {};
+// Build the lookup table from inline enforcement data
+(function buildEnforcementLookup() {
+    const cases = [
+        { company: 'Epic Games', fine: 275_000_000, date: '2022-12', jurisdiction: 'COPPA', violation: 'Tracking + dark patterns in child accounts', rules: [{ id: 'coppa-tracking-003', c: 'direct' }, { id: 'coppa-ui-008', c: 'direct' }] },
+        { company: 'Amazon Alexa', fine: 25_000_000, date: '2023-05', jurisdiction: 'COPPA', violation: 'Voice recording retention without deletion workflows', rules: [{ id: 'coppa-audio-007', c: 'direct' }, { id: 'coppa-data-002', c: 'related' }] },
+        { company: 'Microsoft Xbox', fine: 20_000_000, date: '2023-06', jurisdiction: 'COPPA', violation: 'Data collection before verifiable parental consent', rules: [{ id: 'coppa-auth-001', c: 'direct' }] },
+        { company: 'Disney YouTube', fine: 10_000_000, date: '2025-03', jurisdiction: 'COPPA', violation: 'Third-party data collection on kids channels', rules: [{ id: 'coppa-ext-017', c: 'direct' }, { id: 'coppa-tracking-003', c: 'direct' }] },
+        { company: 'Edmodo', fine: 6_000_000, date: '2023-05', jurisdiction: 'COPPA', violation: 'Kids data used for advertising profiles', rules: [{ id: 'coppa-tracking-003', c: 'direct' }, { id: 'coppa-analytics-018', c: 'direct' }] },
+        { company: 'NGL Labs', fine: 5_000_000, date: '2024-07', jurisdiction: 'COPPA', violation: 'Anonymous messaging + safety risk exposure', rules: [{ id: 'coppa-default-020', c: 'direct' }, { id: 'coppa-ext-011', c: 'direct' }, { id: 'coppa-ui-008', c: 'related' }] },
+        { company: 'HyperBeard', fine: 4_000_000, date: '2020-06', jurisdiction: 'COPPA', violation: 'Ad network tracking inside kids games', rules: [{ id: 'coppa-tracking-003', c: 'direct' }, { id: 'coppa-analytics-018', c: 'direct' }] },
+        { company: 'Kuuhubb Recolor', fine: 3_000_000, date: '2021-07', jurisdiction: 'COPPA', violation: 'Data collection without consent flow', rules: [{ id: 'coppa-auth-001', c: 'direct' }] },
+        { company: 'OpenX', fine: 2_000_000, date: '2021-12', jurisdiction: 'COPPA', violation: 'Location data harvested from kids apps', rules: [{ id: 'coppa-geo-004', c: 'direct' }, { id: 'coppa-tracking-003', c: 'direct' }] },
+        { company: 'Weight Watchers Kurbo', fine: 1_500_000, date: '2022-03', jurisdiction: 'COPPA', violation: 'Health data captured without consent', rules: [{ id: 'coppa-bio-012', c: 'direct' }, { id: 'coppa-sec-006', c: 'related' }] },
+        { company: 'Tilting Point Media', fine: 500_000, date: '2024-06', jurisdiction: 'COPPA/CCPA', violation: 'Unauthorized disclosure of kids info', rules: [{ id: 'coppa-ext-017', c: 'direct' }, { id: 'coppa-data-002', c: 'direct' }] },
+        { company: 'Instagram (Meta)', fine: 405_000_000, date: '2022-09', jurisdiction: 'GDPR Art.8', violation: 'Exposed children\'s contact info publicly', rules: [{ id: 'coppa-default-020', c: 'direct' }, { id: 'coppa-auth-001', c: 'direct' }, { id: 'coppa-sec-006', c: 'related' }] },
+        { company: 'TikTok (EU)', fine: 345_000_000, date: '2023-09', jurisdiction: 'GDPR Art.8', violation: 'Default public accounts for children, dark patterns', rules: [{ id: 'coppa-default-020', c: 'direct' }, { id: 'coppa-ui-008', c: 'direct' }, { id: 'coppa-auth-001', c: 'direct' }] },
+        { company: 'Google (YouTube)', fine: 170_000_000, date: '2019-09', jurisdiction: 'COPPA', violation: 'Cookies + persistent identifiers from children\'s channels', rules: [{ id: 'coppa-cookies-016', c: 'direct' }, { id: 'coppa-tracking-003', c: 'direct' }, { id: 'coppa-analytics-018', c: 'direct' }] },
+        { company: 'Reddit', fine: 14_470_000, date: '2026-02', jurisdiction: 'AADC', violation: 'Inadequate age gating under UK Children\'s Code', rules: [{ id: 'coppa-auth-001', c: 'direct' }, { id: 'coppa-default-020', c: 'direct' }, { id: 'coppa-ui-008', c: 'related' }] },
+        { company: 'Musical.ly (TikTok)', fine: 5_700_000, date: '2019-02', jurisdiction: 'COPPA', violation: 'PII collection from children, social features without safeguards', rules: [{ id: 'coppa-default-020', c: 'direct' }, { id: 'coppa-ext-011', c: 'direct' }, { id: 'coppa-auth-001', c: 'direct' }] },
+        { company: 'Apitor Technology', fine: 500_000, date: '2025-09', jurisdiction: 'COPPA', violation: 'Robot toy tracked location without parental consent', rules: [{ id: 'coppa-geo-004', c: 'direct' }, { id: 'coppa-auth-001', c: 'direct' }] },
+        { company: 'MediaLab (Imgur)', fine: 247_590, date: '2026-02', jurisdiction: 'AADC', violation: 'No age assurance, children exposed to adult content', rules: [{ id: 'coppa-auth-001', c: 'direct' }, { id: 'coppa-default-020', c: 'direct' }] },
+    ];
+    for (const c of cases) {
+        for (const rule of c.rules) {
+            if (!ENFORCEMENT_DATA[rule.id])
+                ENFORCEMENT_DATA[rule.id] = [];
+            ENFORCEMENT_DATA[rule.id].push({
+                company: c.company,
+                fine: c.fine,
+                date: c.date,
+                jurisdiction: c.jurisdiction,
+                violation: c.violation,
+                confidence: rule.c,
+            });
+        }
+    }
+})();
+function formatFine(amount) {
+    if (amount >= 1_000_000_000)
+        return `$${(amount / 1_000_000_000).toFixed(1)}B`;
+    if (amount >= 1_000_000)
+        return `$${(amount / 1_000_000).toFixed(0)}M`;
+    if (amount >= 1_000)
+        return `$${(amount / 1_000).toFixed(0)}K`;
+    if (amount === 0)
+        return 'DOJ action';
+    return `$${amount.toLocaleString()}`;
+}
+// COPPA Rule amendment compliance deadline
+const COPPA_DEADLINE = new Date('2026-04-22');
+function daysUntilDeadline() {
+    const now = new Date();
+    return Math.max(0, Math.ceil((COPPA_DEADLINE.getTime() - now.getTime()) / (1000 * 60 * 60 * 24)));
+}
+// Rules that are directly addressed by COPPA 2.0 amendment (April 22, 2026)
+const COPPA_2_RULES = new Set([
+    'coppa-auth-001', // Age verification strengthened
+    'coppa-tracking-003', // Ad tracking restrictions expanded
+    'coppa-bio-012', // Biometric data explicitly covered
+    'coppa-data-002', // Data minimization requirements
+    'coppa-retention-005', // Retention limits codified
+    'coppa-notif-013', // Push notification consent required
+    'coppa-geo-004', // Location data restrictions
+    'coppa-audio-007', // Voice data as biometric
+]);
+function classifyTier(ruleId) {
+    if (ENFORCEMENT_DATA[ruleId]?.some(c => c.confidence === 'direct'))
+        return 'enforcement-risk';
+    if (COPPA_2_RULES.has(ruleId) || ENFORCEMENT_DATA[ruleId]?.some(c => c.confidence === 'related'))
+        return 'regulatory-scrutiny';
+    return 'hardening';
+}
 /**
  * Format violations as human-readable text
  */
@@ -273,6 +348,11 @@ function formatText(results, verbose = false, fileCount = 0, scoreResult) {
     let mediumCount = 0;
     let lowCount = 0;
     let filesWithViolations = 0;
+    // Sprint 10b: Track enforcement tier counts
+    let enforcementRiskCount = 0;
+    let regulatoryScrutinyCount = 0;
+    let hardeningCount = 0;
+    const enforcementMatchedFines = new Set(); // Track unique cases for aggregate fine total
     for (const result of results) {
         if (result.violations.length === 0)
             continue;
@@ -338,10 +418,43 @@ function formatText(results, verbose = false, fileCount = 0, scoreResult) {
                     confidenceBadge = c(colors.dim, ` [${confStr}]`);
                 }
             }
+            // Sprint 10b: Classify enforcement tier
+            const tier = classifyTier(violation.ruleId);
+            switch (tier) {
+                case 'enforcement-risk':
+                    enforcementRiskCount++;
+                    break;
+                case 'regulatory-scrutiny':
+                    regulatoryScrutinyCount++;
+                    break;
+                case 'hardening':
+                    hardeningCount++;
+                    break;
+            }
             // Always show line:column (developer-standard format)
             const location = c(colors.dim, `${violation.line}:${violation.column}`);
             output += `  ${location}  ${severityTag}  ${c(colors.cyan, violation.ruleId)}${astBadge}${confidenceBadge}\n`;
             output += `  ${c(colors.dim, '│')} ${violation.message}\n`;
+            // Sprint 10b: Enforcement context — show related enforcement precedents
+            const enforcementCases = ENFORCEMENT_DATA[violation.ruleId];
+            if (enforcementCases) {
+                // Show top 2 direct matches by fine amount (most impactful)
+                const directCases = enforcementCases
+                    .filter(ec => ec.confidence === 'direct' && ec.fine > 0)
+                    .sort((a, b) => b.fine - a.fine)
+                    .slice(0, 2);
+                for (const ec of directCases) {
+                    output += `  ${c(colors.dim, '│')} ${c(colors.red, '⚖️')}  Related enforcement precedent: ${ec.jurisdiction} v. ${ec.company} (${formatFine(ec.fine)}, ${ec.date})\n`;
+                    enforcementMatchedFines.add(`${ec.company}-${ec.date}`);
+                }
+            }
+            // Show COPPA 2.0 deadline for rules affected by the amendment
+            if (COPPA_2_RULES.has(violation.ruleId)) {
+                const days = daysUntilDeadline();
+                if (days > 0) {
+                    output += `  ${c(colors.dim, '│')} ${c(colors.yellow, '⚠️')}  COPPA Rule amendment compliance deadline: April 22, 2026 (${days} days)\n`;
+                }
+            }
             if (verbose) {
                 output += `  ${c(colors.dim, '│')} ${c(colors.magenta, '💡')} ${violation.fixSuggestion}\n`;
                 if (violation.penalty) {
@@ -369,16 +482,50 @@ function formatText(results, verbose = false, fileCount = 0, scoreResult) {
         if (scoreResult) {
             cleanOutput += `\n${formatScoreLine(scoreResult)}\n`;
         }
+        // Sprint 15: Scope honesty
+        cleanOutput += `\n${c(colors.dim, '📋 Optimized for Python/PHP web applications. Coverage expanding to additional frameworks.')}\n`;
         return cleanOutput;
     }
+    // Sprint 10b: Calculate aggregate enforcement fine total
+    let totalEnforcementFines = 0;
+    const seenCases = new Set();
+    for (const result of results) {
+        for (const v of result.violations) {
+            const cases = ENFORCEMENT_DATA[v.ruleId];
+            if (cases) {
+                for (const ec of cases) {
+                    if (ec.confidence === 'direct') {
+                        const key = `${ec.company}-${ec.date}`;
+                        if (!seenCases.has(key)) {
+                            seenCases.add(key);
+                            totalEnforcementFines += ec.fine;
+                        }
+                    }
+                }
+            }
+        }
+    }
     // Summary header
     let header = `\n${c(colors.bold, `⚠  Found ${totalViolations} issue(s)`)}`;
     header += ` across ${filesWithViolations} file(s)`;
     if (fileCount > 0) {
         header += ` (${fileCount} files scanned)`;
     }
+    // Sprint 10b: Enforcement aggregate in summary line
+    if (enforcementRiskCount > 0) {
+        header += ` — ${c(colors.red + colors.bold, `${enforcementRiskCount} match active enforcement patterns`)} (${formatFine(totalEnforcementFines)} in historical fines)`;
+    }
     header += '\n';
-    // Severity breakdown
+    // Sprint 10b: Three-tier breakdown replaces raw severity counts
+    const tierParts = [];
+    if (enforcementRiskCount > 0)
+        tierParts.push(c(colors.red + colors.bold, `${enforcementRiskCount} enforcement-risk`));
+    if (regulatoryScrutinyCount > 0)
+        tierParts.push(c(colors.yellow + colors.bold, `${regulatoryScrutinyCount} regulatory scrutiny`));
+    if (hardeningCount > 0)
+        tierParts.push(c(colors.dim, `${hardeningCount} hardening`));
+    header += `   ${tierParts.join(c(colors.dim, ' · '))}\n`;
+    // Severity breakdown (secondary)
     const parts = [];
     if (criticalCount > 0)
         parts.push(c(colors.red + colors.bold, `${criticalCount} critical`));
@@ -388,17 +535,23 @@ function formatText(results, verbose = false, fileCount = 0, scoreResult) {
         parts.push(c(colors.blue, `${mediumCount} medium`));
     if (lowCount > 0)
         parts.push(c(colors.dim, `${lowCount} low`));
-    header += `   ${parts.join(c(colors.dim, ' · '))}\n`;
-    // Compliance score line
+    header += `   ${c(colors.dim, 'Severity:')} ${parts.join(c(colors.dim, ' · '))}\n`;
+    // Compliance score line with grade context labels
     if (scoreResult) {
-        header += `\n${formatScoreLine(scoreResult)}\n`;
+        header += `\n${formatScoreLine(scoreResult, enforcementRiskCount, regulatoryScrutinyCount, hardeningCount)}\n`;
+    }
+    // Sprint 15: Scope honesty
+    header += `\n${c(colors.dim, '📋 Optimized for Python/PHP web applications. Coverage expanding to additional frameworks.')}\n`;
+    // Sprint 10b: Enforcement disclaimer
+    if (enforcementRiskCount > 0) {
+        header += `\n${c(colors.dim, 'Enforcement citations are historical references, not risk assessments. Consult legal counsel for compliance guidance.')}\n`;
     }
     return header + output;
 }
 /**
  * Format the compliance score line with grade coloring
  */
-function formatScoreLine(scoreResult) {
+function formatScoreLine(scoreResult, enforcementRisk = 0, regulatoryScrutiny = 0, hardening = 0) {
     const { score, grade } = scoreResult;
     // Color the grade based on value
     let gradeColor;
@@ -420,7 +573,27 @@ function formatScoreLine(scoreResult) {
     }
     const gradeStr = c(gradeColor + colors.bold, grade);
     const scoreStr = c(colors.bold, `${score}/100`);
-    return `${c(colors.bold, '📊 COPPA Compliance Score:')} ${scoreStr} (${gradeStr})`;
+    let line = `${c(colors.bold, '📊 COPPA Compliance Score:')} ${scoreStr} (${gradeStr})`;
+    // Sprint 10b: Grade context labels — reframe from "you failed" to "here's your path forward"
+    const total = enforcementRisk + regulatoryScrutiny + hardening;
+    if (total > 0) {
+        const contextParts = [];
+        if (enforcementRisk > 0)
+            contextParts.push(`${enforcementRisk} enforcement-risk items`);
+        if (regulatoryScrutiny > 0)
+            contextParts.push(`${regulatoryScrutiny} under regulatory scrutiny`);
+        if (hardening > 0)
+            contextParts.push(`${hardening} hardening items`);
+        line += `\n   ${c(colors.dim, contextParts.join(', '))}`;
+        // Gap-to-compliance guidance
+        if (enforcementRisk > 0 && (grade === 'D' || grade === 'F')) {
+            line += `\n   ${c(colors.yellow, `Gap to compliance: Address the ${enforcementRisk} enforcement-risk items to reach C grade.`)}`;
+        }
+        else if (enforcementRisk > 0 && grade === 'C') {
+            line += `\n   ${c(colors.yellow, `Gap to compliance: Resolve enforcement-risk items and regulatory scrutiny items for B grade.`)}`;
+        }
+    }
+    return line;
 }
 /**
  * Format trend line comparing current score to last scan for the same project.
@@ -655,6 +828,10 @@ function escapeHtml(text) {
         .replace(/"/g, '"')
         .replace(/'/g, ''');
 }
+// ==================== Module-level scan data for cross-function access ====================
+// Stores the last scan's results so the action handler can regenerate the PDF
+// with AI Review Board data after the review board runs.
+const _lastScanData = { results: [], scoreResult: null, fileCount: 0, projectPath: '' };
 // ==================== PDF Report Generator (P3-2) ====================
 // PDF color constants
 const PDF_COLORS = {
@@ -690,11 +867,7 @@ function severityColor(severity) {
         default: return PDF_COLORS.cyan;
     }
 }
-/**
- * Generate a government-procurement-grade PDF compliance report.
- * Uses PDFKit — pure JS, no browser dependencies, CI-safe.
- */
-function generatePdfReport(results, scoreResult, fileCount, projectPath, history) {
+function generatePdfReport(results, scoreResult, fileCount, projectPath, history, reviewData) {
     return new Promise((resolve, reject) => {
         const doc = new pdfkit_1.default({
             size: 'LETTER',
@@ -983,6 +1156,117 @@ function generatePdfReport(results, scoreResult, fileCount, projectPath, history
             }
             addFooter();
         }
+        // ═══════════════ AI REVIEW BOARD (Sprint 9) ═══════════════
+        if (reviewData && reviewData.results.length > 0) {
+            doc.addPage();
+            doc.fontSize(20).fillColor(PDF_COLORS.darkText).text('AI Review Board Assessment', 60, 60);
+            doc.moveTo(60, 88).lineTo(60 + pageWidth, 88).lineWidth(1).strokeColor(PDF_COLORS.border).stroke();
+            y = 100;
+            // Review Board summary box
+            doc.rect(60, y, pageWidth, 70).fill(PDF_COLORS.lightBg);
+            doc.fontSize(10).fillColor(PDF_COLORS.bodyText);
+            doc.text(`${reviewData.summary.total} violations reviewed by Halo AI Review Board`, 70, y + 8, { width: pageWidth - 20 });
+            y += 22;
+            const verdictLine = [
+                reviewData.summary.escalated > 0 ? `🔴 ${reviewData.summary.escalated} escalated` : '',
+                reviewData.summary.confirmed > 0 ? `🟡 ${reviewData.summary.confirmed} confirmed` : '',
+                reviewData.summary.downgraded > 0 ? `🟢 ${reviewData.summary.downgraded} downgraded` : '',
+                reviewData.summary.dismissed > 0 ? `✅ ${reviewData.summary.dismissed} dismissed` : '',
+            ].filter(Boolean).join('   ');
+            doc.fontSize(9).fillColor(PDF_COLORS.bodyText);
+            doc.text(verdictLine, 70, y, { width: pageWidth - 20 });
+            y += 16;
+            // Marshall summary
+            if (reviewData.marshall_summary) {
+                const ms = reviewData.marshall_summary;
+                doc.fontSize(8).fillColor(PDF_COLORS.mutedText);
+                doc.text(`Marshall Intelligence: ${ms.enriched_count} violations enriched | Avg urgency: ${ms.avg_urgency} | ${ms.active_enforcement_count} in active enforcement areas`, 70, y, { width: pageWidth - 20 });
+            }
+            y += 40; // past the summary box
+            // Per-verdict sections
+            const verdictOrder = [
+                { key: 'escalated', label: 'ESCALATED — More Serious Than Initially Detected', color: PDF_COLORS.red, emoji: '🔴' },
+                { key: 'confirmed', label: 'CONFIRMED — Violations Validated by AI Review', color: PDF_COLORS.orange, emoji: '🟡' },
+                { key: 'downgraded', label: 'DOWNGRADED — Lower Risk Than Severity Suggests', color: PDF_COLORS.green, emoji: '🟢' },
+                { key: 'dismissed', label: 'DISMISSED — False Positives Cleared', color: PDF_COLORS.cyan, emoji: '✅' },
+            ];
+            for (const vType of verdictOrder) {
+                const items = reviewData.results.filter(r => r.verdict === vType.key);
+                if (items.length === 0)
+                    continue;
+                if (y > doc.page.height - 140) {
+                    addFooter();
+                    doc.addPage();
+                    y = 60;
+                }
+                doc.fontSize(12).fillColor(vType.color);
+                doc.text(`${vType.emoji} ${vType.label} (${items.length})`, 60, y);
+                y += 20;
+                // Show up to 10 per verdict type
+                const itemsToShow = items.slice(0, 10);
+                for (const item of itemsToShow) {
+                    if (y > doc.page.height - 100) {
+                        addFooter();
+                        doc.addPage();
+                        y = 60;
+                    }
+                    // Rule ID + verdict
+                    doc.fontSize(9).fillColor(PDF_COLORS.primary);
+                    doc.text(item.ruleId, 70, y);
+                    y += 14;
+                    // Clinical context
+                    if (item.clinicalContext) {
+                        doc.fontSize(8).fillColor(PDF_COLORS.bodyText);
+                        const ctxHeight = doc.heightOfString(item.clinicalContext, { width: pageWidth - 30 });
+                        doc.text(item.clinicalContext, 80, y, { width: pageWidth - 30 });
+                        y += ctxHeight + 4;
+                    }
+                    // Age groups
+                    if (item.ageGroupImpact && item.ageGroupImpact.length > 0) {
+                        doc.fontSize(7).fillColor(PDF_COLORS.mutedText);
+                        doc.text(`Ages most affected: ${item.ageGroupImpact.join(', ')}`, 80, y);
+                        y += 12;
+                    }
+                    // Regulatory context (Marshall enrichment)
+                    if (item.regulatoryContext) {
+                        const rc = item.regulatoryContext;
+                        const priorityLabel = rc.enforcement_priority === 'active' ? '🔴 ACTIVE'
+                            : rc.enforcement_priority === 'watching' ? '🟡 WATCHING' : '⚪ DORMANT';
+                        doc.fontSize(7).fillColor(PDF_COLORS.red);
+                        doc.text(`Regulatory: ${rc.regulation} | ${priorityLabel} | Penalty: ${rc.penalty_exposure} | Urgency: ${rc.urgency_score}`, 80, y, { width: pageWidth - 30 });
+                        y += 12;
+                        if (rc.recent_case) {
+                            doc.fontSize(7).fillColor(PDF_COLORS.mutedText);
+                            doc.text(`Recent precedent: ${rc.recent_case}`, 80, y, { width: pageWidth - 30 });
+                            y += 12;
+                        }
+                    }
+                    // Remediation
+                    if (item.remediationGuidance) {
+                        doc.fontSize(8).fillColor(PDF_COLORS.green);
+                        const remHeight = doc.heightOfString(`Fix: ${item.remediationGuidance}`, { width: pageWidth - 30 });
+                        doc.text(`Fix: ${item.remediationGuidance}`, 80, y, { width: pageWidth - 30 });
+                        y += remHeight + 4;
+                    }
+                    y += 8;
+                }
+                if (items.length > 10) {
+                    doc.fontSize(8).fillColor(PDF_COLORS.mutedText);
+                    doc.text(`+ ${items.length - 10} more ${vType.key} violation(s). See full results on your Halo Dashboard.`, 80, y, { width: pageWidth - 30 });
+                    y += 16;
+                }
+                y += 10;
+            }
+            // Review Board footer note
+            if (y > doc.page.height - 80) {
+                addFooter();
+                doc.addPage();
+                y = 60;
+            }
+            doc.fontSize(7).fillColor(PDF_COLORS.lightText);
+            doc.text(`Reviewed by Halo AI Review Board (Richard + Marshall) in ${reviewData.latency_ms}ms. Cost: $${reviewData.cost.estimated_usd.toFixed(4)}. ${reviewData.summary.cache_hits} results served from cache.`, 60, y, { width: pageWidth });
+            addFooter();
+        }
         // ═══════════════ RECOMMENDATIONS ═══════════════
         doc.addPage();
         doc.fontSize(20).fillColor(PDF_COLORS.darkText).text('Recommendations', 60, 60);
@@ -1068,6 +1352,122 @@ function loadHaloignore(startDir) {
     }
     return undefined;
 }
+/**
+ * Detect the project framework by scanning project files.
+ * Checks package.json, Gemfile, go.mod, Cargo.toml, manage.py, requirements.txt.
+ * Returns a framework identifier string or null if unknown.
+ */
+function detectProjectFramework(dir) {
+    // Check package.json for JS/TS frameworks
+    const pkgPath = path.join(dir, 'package.json');
+    if (fs.existsSync(pkgPath)) {
+        try {
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+            const allDeps = {
+                ...(pkg.dependencies || {}),
+                ...(pkg.devDependencies || {}),
+            };
+            // Order matters: check specific frameworks before generic ones
+            if (allDeps['next'])
+                return 'nextjs';
+            if (allDeps['@angular/core'])
+                return 'angular';
+            if (allDeps['vue'])
+                return 'vue';
+            if (allDeps['svelte'])
+                return 'svelte';
+            if (allDeps['react'])
+                return 'react';
+        }
+        catch {
+            // Malformed package.json — continue detection
+        }
+    }
+    // Django: manage.py or requirements.txt with django
+    if (fs.existsSync(path.join(dir, 'manage.py')))
+        return 'django';
+    const reqPath = path.join(dir, 'requirements.txt');
+    if (fs.existsSync(reqPath)) {
+        try {
+            const reqs = fs.readFileSync(reqPath, 'utf-8').toLowerCase();
+            if (reqs.includes('django'))
+                return 'django';
+        }
+        catch {
+            // Continue detection
+        }
+    }
+    // Rails: Gemfile with rails
+    const gemfilePath = path.join(dir, 'Gemfile');
+    if (fs.existsSync(gemfilePath)) {
+        try {
+            const gemfile = fs.readFileSync(gemfilePath, 'utf-8').toLowerCase();
+            if (gemfile.includes('rails'))
+                return 'rails';
+        }
+        catch {
+            // Continue detection
+        }
+    }
+    // Go
+    if (fs.existsSync(path.join(dir, 'go.mod')))
+        return 'go';
+    // Rust
+    if (fs.existsSync(path.join(dir, 'Cargo.toml')))
+        return 'rust';
+    return null;
+}
+/**
+ * Get default .haloignore content based on detected framework.
+ */
+function getDefaultHaloignoreContent(framework) {
+    const lines = [
+        '# Halo ignore patterns',
+        '# Generated by: runhalo init',
+        '',
+        'node_modules/',
+        'dist/',
+        'build/',
+        'coverage/',
+        '*.min.js',
+        '*.bundle.js',
+    ];
+    // Add framework-specific ignores
+    switch (framework) {
+        case 'nextjs':
+            lines.push('.next/');
+            lines.push('.vercel/');
+            break;
+        case 'angular':
+            lines.push('.angular/');
+            break;
+        case 'vue':
+            lines.push('.nuxt/');
+            break;
+        case 'svelte':
+            lines.push('.svelte-kit/');
+            break;
+        case 'django':
+            lines.push('__pycache__/');
+            lines.push('*.pyc');
+            lines.push('.venv/');
+            lines.push('venv/');
+            break;
+        case 'rails':
+            lines.push('tmp/');
+            lines.push('log/');
+            lines.push('vendor/bundle/');
+            break;
+        case 'go':
+            lines.push('vendor/');
+            break;
+        case 'rust':
+            lines.push('target/');
+            break;
+    }
+    lines.push('');
+    return lines.join('\n');
+}
 /**
  * Create a Halo engine instance
  */
@@ -1358,6 +1758,108 @@ function saveHistory(entry) {
         // Silent failure — never block scan
     }
 }
+/**
+ * Send webhook notifications to Discord and/or Slack after a scan completes.
+ * Non-blocking — failures are logged but never affect the scan exit code.
+ */
+async function sendWebhookNotifications(rcConfig, lastEntry, verbose) {
+    const notifications = rcConfig?.notifications;
+    if (!notifications)
+        return;
+    const { discord_webhook, slack_webhook } = notifications;
+    if (!discord_webhook && !slack_webhook)
+        return;
+    const hasFailed = lastEntry.totalViolations > 0;
+    const filesScanned = String(lastEntry.filesScanned);
+    const violations = String(lastEntry.totalViolations);
+    const grade = lastEntry.grade || 'N/A';
+    const topRules = lastEntry.rulesTriggered.slice(0, 5).join(', ') || 'None';
+    const timestamp = new Date().toISOString();
+    // Discord webhook
+    if (discord_webhook) {
+        try {
+            const discordPayload = {
+                embeds: [{
+                        title: '\u{1F6E1}\uFE0F Halo Scan Complete',
+                        color: hasFailed ? 15158332 : 3066993,
+                        fields: [
+                            { name: 'Files Scanned', value: filesScanned, inline: true },
+                            { name: 'Violations', value: violations, inline: true },
+                            { name: 'Grade', value: grade, inline: true },
+                            { name: 'Top Rules', value: topRules, inline: false },
+                        ],
+                        footer: { text: 'Halo \u2014 runhalo.dev' },
+                        timestamp,
+                    }],
+            };
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 5000);
+            const res = await fetch(discord_webhook, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(discordPayload),
+                signal: controller.signal,
+            });
+            clearTimeout(timeout);
+            if (verbose) {
+                console.error(res.ok
+                    ? '\u2709\uFE0F  Notification sent to Discord'
+                    : `\u26A0\uFE0F  Discord webhook returned ${res.status}`);
+            }
+        }
+        catch (err) {
+            if (verbose) {
+                console.error(`\u26A0\uFE0F  Discord webhook failed: ${err instanceof Error ? err.message : err}`);
+            }
+        }
+    }
+    // Slack webhook
+    if (slack_webhook) {
+        try {
+            const slackPayload = {
+                blocks: [
+                    {
+                        type: 'header',
+                        text: { type: 'plain_text', text: '\u{1F6E1}\uFE0F Halo Scan Complete' },
+                    },
+                    {
+                        type: 'section',
+                        fields: [
+                            { type: 'mrkdwn', text: `*Files Scanned*\n${filesScanned}` },
+                            { type: 'mrkdwn', text: `*Violations*\n${violations}` },
+                            { type: 'mrkdwn', text: `*Grade*\n${grade}` },
+                        ],
+                    },
+                    {
+                        type: 'section',
+                        fields: [
+                            { type: 'mrkdwn', text: `*Top Rules*\n${topRules}` },
+                        ],
+                    },
+                ],
+            };
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 5000);
+            const res = await fetch(slack_webhook, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(slackPayload),
+                signal: controller.signal,
+            });
+            clearTimeout(timeout);
+            if (verbose) {
+                console.error(res.ok
+                    ? '\u2709\uFE0F  Notification sent to Slack'
+                    : `\u26A0\uFE0F  Slack webhook returned ${res.status}`);
+            }
+        }
+        catch (err) {
+            if (verbose) {
+                console.error(`\u26A0\uFE0F  Slack webhook failed: ${err instanceof Error ? err.message : err}`);
+            }
+        }
+    }
+}
 async function submitCliLead(email) {
     try {
         const res = await fetch(`${SUPABASE_URL}/rest/v1/halo_leads`, {
@@ -1757,6 +2259,7 @@ async function scan(paths, options) {
             'au-sbd': 'AU Safety by Design',
             'au-osa': 'AU Online Safety Act',
             'caadca': 'California AADCA',
+            'eu-ai-act': 'EU AI Act (Children)',
         };
         const packLabel = packs.map(p => packNameMap[p] || p).join(' + ');
         console.error(c(colors.dim, `🔍 Scanning ${uniqueFiles.length} files (${packLabel})...`));
@@ -1843,7 +2346,14 @@ async function scan(paths, options) {
                 output += trendLine + '\n';
             }
     }
+    // Store scan data for potential PDF regeneration with AI Review Board data
+    _lastScanData.results = results;
+    _lastScanData.scoreResult = scoreResult;
+    _lastScanData.fileCount = fileCount;
+    _lastScanData.projectPath = projectPath;
     // Generate report if requested (HTML or PDF based on filename extension)
+    // Note: if --review-board is also set, the PDF will be regenerated with AI data
+    // in the action handler after the review board completes.
     if (options.report) {
         const reportFilename = typeof options.report === 'string'
             ? options.report
@@ -2132,6 +2642,9 @@ program
     .option('--report [filename]', 'Generate HTML compliance report (default: halo-report.html)')
     .option('--upload', 'Upload scan results to Halo Dashboard (requires Pro)')
     .option('--watch', 'Watch for file changes and re-scan automatically')
+    .option('--review-board', 'Enable AI Review Board — clinical assessment of each violation (Pro/Enterprise)')
+    .option('--license-key <key>', 'License key for Pro/Enterprise features (or set HALO_LICENSE_KEY env var)')
+    .option('--framework <framework>', 'Override framework detection (react, nextjs, vue, angular, django, rails)')
     .option('--no-prompt', 'Skip first-run email prompt')
     .option('-v, --verbose', 'Verbose output')
     .action(async (paths, options) => {
@@ -2156,6 +2669,9 @@ program
         if (options.upload && !checkProFeature('Dashboard Upload', '--upload')) {
             process.exit(0);
         }
+        if (options.reviewBoard && !checkProFeature('AI Review Board', '--review-board')) {
+            process.exit(0);
+        }
         // Scan limit check (soft — exit 0, not error)
         if (!checkScanLimit()) {
             process.exit(0);
@@ -2203,9 +2719,14 @@ program
             report: options.report || false,
             pack: mergedPacks,
             offline: options.offline || false,
-            // Sprint 8: Pass framework and AST config from .halorc.json to scan()
-            framework: rcConfig?.framework,
+            // Sprint 10: Framework resolution: CLI flag > .halorc.json > auto-detection
+            framework: options.framework || rcConfig?.framework || detectProjectFramework(fs.existsSync(projectRoot) && fs.statSync(projectRoot).isDirectory()
+                ? projectRoot
+                : path.dirname(projectRoot)) || undefined,
             astAnalysis: rcConfig?.astAnalysis,
+            // Sprint 9: AI Review Board
+            reviewBoard: options.reviewBoard || rcConfig?.reviewBoard || false,
+            licenseKey: options.licenseKey || process.env.HALO_LICENSE_KEY || rcConfig?.licenseKey,
         };
         // ==================== Watch Mode ====================
         if (options.watch) {
@@ -2360,6 +2881,179 @@ program
                 }
             }
         }
+        // ==================== AI Review Board (Sprint 9) ====================
+        let _reviewBoardResult;
+        if (scanOptions.reviewBoard) {
+            const licenseKey = scanOptions.licenseKey || loadConfig().license_key;
+            if (!licenseKey) {
+                console.error('⚠️  AI Review Board requires a license key. Run `halo activate <key>` or pass --license-key.');
+            }
+            else {
+                try {
+                    // Extract violations directly from the scan results already in memory
+                    const allViolations = _lastScanData.results.flatMap(r => r.violations);
+                    if (allViolations.length > 0) {
+                        console.error('\n🤖 Running AI Review Board...');
+                        const reviewUrl = 'https://wrfwcmyxxbafcdvxlmug.supabase.co/functions/v1/ai-review';
+                        // Chunk violations in batches of 50 (endpoint limit)
+                        const CHUNK_SIZE = 50;
+                        const chunks = [];
+                        for (let i = 0; i < allViolations.length; i += CHUNK_SIZE) {
+                            chunks.push(allViolations.slice(i, i + CHUNK_SIZE));
+                        }
+                        if (chunks.length > 1) {
+                            console.error(`  Sending ${allViolations.length} violations in ${chunks.length} batches...`);
+                        }
+                        // Process each chunk and merge results
+                        const mergedResults = [];
+                        let totalCost = 0;
+                        let totalLatency = 0;
+                        let totalCacheHits = 0;
+                        let mergedMarshall;
+                        let chunksFailed = 0;
+                        for (let ci = 0; ci < chunks.length; ci++) {
+                            const chunk = chunks[ci];
+                            if (chunks.length > 1) {
+                                console.error(`  Batch ${ci + 1}/${chunks.length} (${chunk.length} violations)...`);
+                            }
+                            const reviewRes = await fetch(reviewUrl, {
+                                method: 'POST',
+                                headers: { 'Content-Type': 'application/json' },
+                                body: JSON.stringify({
+                                    license_key: licenseKey,
+                                    violations: chunk,
+                                    repo_metadata: {
+                                        framework: scanOptions.framework,
+                                    },
+                                }),
+                            });
+                            if (reviewRes.ok) {
+                                const chunkReview = await reviewRes.json();
+                                mergedResults.push(...chunkReview.results);
+                                totalCost += chunkReview.cost.estimated_usd;
+                                totalLatency += chunkReview.latency_ms;
+                                totalCacheHits += chunkReview.summary.cache_hits;
+                                // Merge marshall summary (take the one with highest urgency)
+                                if (chunkReview.marshall_summary) {
+                                    if (!mergedMarshall || (chunkReview.marshall_summary.avg_urgency > mergedMarshall.avg_urgency)) {
+                                        mergedMarshall = chunkReview.marshall_summary;
+                                    }
+                                    if (mergedMarshall && chunkReview.marshall_summary !== mergedMarshall) {
+                                        mergedMarshall.enriched_count += chunkReview.marshall_summary.enriched_count;
+                                        mergedMarshall.active_enforcement_count += chunkReview.marshall_summary.active_enforcement_count;
+                                    }
+                                }
+                            }
+                            else {
+                                const err = await reviewRes.json().catch(() => ({}));
+                                console.error(`  ⚠️  Batch ${ci + 1} failed: ${err.error || reviewRes.statusText}`);
+                                chunksFailed++;
+                            }
+                        }
+                        if (mergedResults.length > 0) {
+                            // Build merged ReviewBoardData
+                            const review = {
+                                results: mergedResults,
+                                summary: {
+                                    total: mergedResults.length,
+                                    confirmed: mergedResults.filter(r => r.verdict === 'confirmed').length,
+                                    downgraded: mergedResults.filter(r => r.verdict === 'downgraded').length,
+                                    escalated: mergedResults.filter(r => r.verdict === 'escalated').length,
+                                    dismissed: mergedResults.filter(r => r.verdict === 'dismissed').length,
+                                    cache_hits: totalCacheHits,
+                                },
+                                marshall_summary: mergedMarshall,
+                                cost: { estimated_usd: totalCost },
+                                latency_ms: totalLatency,
+                            };
+                            _reviewBoardResult = review; // Store for PDF report
+                            // Display Review Board results
+                            console.error(`\n🛡️  Halo AI Review Board — ${review.summary.total} violations analyzed (${review.latency_ms}ms)`);
+                            console.error(`⚠️  AI-assisted review — may over-dismiss valid findings. Deterministic engine results (above) are authoritative.\n`);
+                            const critical = review.results.filter(r => r.verdict === 'escalated');
+                            const confirmed = review.results.filter(r => r.verdict === 'confirmed');
+                            const downgraded = review.results.filter(r => r.verdict === 'downgraded');
+                            const dismissed = review.results.filter(r => r.verdict === 'dismissed');
+                            if (critical.length > 0) {
+                                console.error(`🔴 ESCALATED (${critical.length}) — More serious than initially detected`);
+                                for (const r of critical) {
+                                    console.error(`  ${r.ruleId}: ${r.clinicalContext}`);
+                                    if (r.ageGroupImpact.length > 0)
+                                        console.error(`    Ages most affected: ${r.ageGroupImpact.join(', ')}`);
+                                    if (r.remediationGuidance)
+                                        console.error(`    Fix: ${r.remediationGuidance}`);
+                                }
+                                console.error('');
+                            }
+                            if (confirmed.length > 0) {
+                                console.error(`🟡 CONFIRMED (${confirmed.length}) — Violations validated by AI review`);
+                                for (const r of confirmed) {
+                                    console.error(`  ${r.ruleId}: ${r.clinicalContext}`);
+                                }
+                                console.error('');
+                            }
+                            if (downgraded.length > 0) {
+                                console.error(`🟢 DOWNGRADED (${downgraded.length}) — Lower risk than severity suggests`);
+                                for (const r of downgraded) {
+                                    console.error(`  ${r.ruleId}: ${r.clinicalContext}`);
+                                }
+                                console.error('');
+                            }
+                            if (dismissed.length > 0) {
+                                console.error(`✅ DISMISSED (${dismissed.length}) — False positives cleared by AI review`);
+                                for (const r of dismissed) {
+                                    console.error(`  ${r.ruleId}: ${r.clinicalContext}`);
+                                }
+                                console.error('');
+                            }
+                            const cacheStr = review.summary.cache_hits > 0 ? ` (${review.summary.cache_hits} cached)` : '';
+                            console.error(`📊 Cost: $${review.cost.estimated_usd.toFixed(4)}${cacheStr}`);
+                            console.error(`🤖 Reviewed by: Halo AI Review Board (${review.latency_ms}ms)\n`);
+                            // Output ReviewBoardData as JSON to stdout for batch tooling
+                            // (summary generator's readJsonSafe picks up the last JSON object)
+                            if (scanOptions.format === 'json') {
+                                console.log(JSON.stringify(review));
+                            }
+                        }
+                        else if (chunksFailed > 0) {
+                            console.error(`⚠️  AI Review failed: all ${chunksFailed} batches failed`);
+                        }
+                    }
+                }
+                catch (reviewErr) {
+                    console.error(`⚠️  AI Review failed: ${reviewErr instanceof Error ? reviewErr.message : reviewErr}`);
+                }
+            }
+        }
+        // ==================== Generate PDF Report with AI Review Board data ====================
+        // If both --review-board and --report *.pdf are set, regenerate the PDF with review data
+        if (options.report && _reviewBoardResult) {
+            const reportFilename = typeof options.report === 'string'
+                ? options.report
+                : 'halo-report.html';
+            if (reportFilename.endsWith('.pdf') && _lastScanData.results.length > 0) {
+                const projectHistory = loadHistory().filter(h => h.projectPath === _lastScanData.projectPath);
+                const historyForReport = projectHistory.slice(0, -1);
+                const pdfBuffer = await generatePdfReport(_lastScanData.results, _lastScanData.scoreResult, _lastScanData.fileCount, _lastScanData.projectPath, historyForReport, _reviewBoardResult);
+                fs.writeFileSync(reportFilename, pdfBuffer);
+                console.error(`📄 PDF report updated with AI Review Board assessment`);
+            }
+        }
+        // ==================== Webhook Notifications (Discord/Slack) ====================
+        if (rcConfig?.notifications) {
+            try {
+                const history = loadHistory();
+                const lastEntry = history[history.length - 1];
+                if (lastEntry) {
+                    await sendWebhookNotifications(rcConfig, lastEntry, options.verbose);
+                }
+            }
+            catch (notifyErr) {
+                if (options.verbose) {
+                    console.error(`\u26A0\uFE0F  Webhook notification error: ${notifyErr instanceof Error ? notifyErr.message : notifyErr}`);
+                }
+            }
+        }
         // Upload to Halo Dashboard (non-blocking — upload failure doesn't affect exit code)
         if (options.upload) {
             try {
@@ -2607,78 +3301,142 @@ function getCopilotInstructionsContent() {
     return getIDERulesContent();
 }
 /**
- * Init command — generate IDE rules files and project configuration.
+ * Init command — detect framework, generate .halorc.json, .haloignore, and IDE rules files.
  */
 async function init(projectPath, options) {
     const resolvedPath = path.resolve(projectPath);
-    if (!options.ide) {
-        console.log('🔮 Halo init — project setup');
+    // --ide flag: generate AI coding assistant rules files (existing behavior)
+    if (options.ide) {
+        console.log('🔮 Halo init — Generating AI coding assistant rules...\n');
+        const files = [
+            {
+                path: path.join(resolvedPath, '.cursor', 'rules'),
+                content: getCursorRulesContent(),
+                label: 'Cursor'
+            },
+            {
+                path: path.join(resolvedPath, '.windsurfrules'),
+                content: getWindsurfRulesContent(),
+                label: 'Windsurf'
+            },
+            {
+                path: path.join(resolvedPath, '.github', 'copilot-instructions.md'),
+                content: getCopilotInstructionsContent(),
+                label: 'GitHub Copilot'
+            }
+        ];
+        let created = 0;
+        let skipped = 0;
+        for (const file of files) {
+            const dir = path.dirname(file.path);
+            const relativePath = path.relative(resolvedPath, file.path);
+            if (fs.existsSync(file.path) && !options.force) {
+                console.log(`  ⏭  ${relativePath} (exists — use --force to overwrite)`);
+                skipped++;
+                continue;
+            }
+            try {
+                if (!fs.existsSync(dir)) {
+                    fs.mkdirSync(dir, { recursive: true });
+                }
+                fs.writeFileSync(file.path, file.content, 'utf-8');
+                console.log(`  ✅ ${relativePath} — ${file.label} rules`);
+                created++;
+            }
+            catch (err) {
+                console.error(`  ❌ ${relativePath} — ${err instanceof Error ? err.message : err}`);
+            }
+        }
         console.log('');
-        console.log('Usage:');
-        console.log('  runhalo init --ide       Generate AI coding assistant rules files');
+        if (created > 0) {
+            console.log(`Created ${created} rules file${created > 1 ? 's' : ''}. Your AI assistant now knows COPPA 2.0.`);
+        }
+        if (skipped > 0) {
+            console.log(`Skipped ${skipped} existing file${skipped > 1 ? 's' : ''}.`);
+        }
+        console.log('');
+        console.log('What happens next:');
+        console.log('  • Cursor, Windsurf, and Copilot will read these rules automatically');
+        console.log('  • AI-generated code will follow COPPA compliance patterns');
+        console.log('  • Run "npx runhalo scan ." to verify compliance');
         console.log('');
-        console.log('Options:');
-        console.log('  --ide        Generate .cursor/rules, .windsurfrules, .github/copilot-instructions.md');
-        console.log('  --force      Overwrite existing rules files');
+        console.log('Full-stack compliance for the AI coding era:');
+        console.log('  CI:        uses: runhalo/action@v1 catches violations in PRs');
+        console.log('  Local:     npx runhalo scan . catches violations on your machine');
+        console.log('  Proactive: AI rules files prevent violations before they\'re written');
         return 0;
     }
-    console.log('🔮 Halo init — Generating AI coding assistant rules...\n');
-    const files = [
-        {
-            path: path.join(resolvedPath, '.cursor', 'rules'),
-            content: getCursorRulesContent(),
-            label: 'Cursor'
-        },
-        {
-            path: path.join(resolvedPath, '.windsurfrules'),
-            content: getWindsurfRulesContent(),
-            label: 'Windsurf'
-        },
-        {
-            path: path.join(resolvedPath, '.github', 'copilot-instructions.md'),
-            content: getCopilotInstructionsContent(),
-            label: 'GitHub Copilot'
+    // Default init: auto-detect framework, generate .halorc.json and .haloignore
+    console.log('🔮 Halo init — project setup\n');
+    // Step 1: Detect framework
+    const detectedFramework = detectProjectFramework(resolvedPath);
+    if (detectedFramework) {
+        console.log(`  🔍 Detected framework: ${c(colors.bold, detectedFramework)}`);
+    }
+    else {
+        console.log(`  🔍 Framework: ${c(colors.dim, 'not detected (generic config will be generated)')}`);
+    }
+    let configCreated = false;
+    let ignoreCreated = false;
+    // Step 2: Generate .halorc.json
+    const rcPath = path.join(resolvedPath, '.halorc.json');
+    if (fs.existsSync(rcPath) && !options.force) {
+        console.log(`  ⏭  .halorc.json (exists — use --force to overwrite)`);
+    }
+    else {
+        const rcConfig = {
+            packs: ['coppa', 'ethical'],
+            severity_threshold: 'medium',
+            ignore: ['**/test/**', '**/__tests__/**', '**/node_modules/**'],
+            astAnalysis: true,
+            notifications: {},
+        };
+        if (detectedFramework) {
+            rcConfig.framework = detectedFramework;
         }
-    ];
-    let created = 0;
-    let skipped = 0;
-    for (const file of files) {
-        const dir = path.dirname(file.path);
-        const relativePath = path.relative(resolvedPath, file.path);
-        if (fs.existsSync(file.path) && !options.force) {
-            console.log(`  ⏭  ${relativePath} (exists — use --force to overwrite)`);
-            skipped++;
-            continue;
+        try {
+            fs.writeFileSync(rcPath, JSON.stringify(rcConfig, null, 2) + '\n', 'utf-8');
+            console.log(`  ✅ .halorc.json — project configuration`);
+            configCreated = true;
+        }
+        catch (err) {
+            console.error(`  ❌ .halorc.json — ${err instanceof Error ? err.message : err}`);
         }
+    }
+    // Step 3: Generate .haloignore
+    const ignorePath = path.join(resolvedPath, '.haloignore');
+    if (fs.existsSync(ignorePath) && !options.force) {
+        console.log(`  ⏭  .haloignore (exists — use --force to overwrite)`);
+    }
+    else {
         try {
-            if (!fs.existsSync(dir)) {
-                fs.mkdirSync(dir, { recursive: true });
-            }
-            fs.writeFileSync(file.path, file.content, 'utf-8');
-            console.log(`  ✅ ${relativePath} — ${file.label} rules`);
-            created++;
+            const ignoreContent = getDefaultHaloignoreContent(detectedFramework);
+            fs.writeFileSync(ignorePath, ignoreContent, 'utf-8');
+            console.log(`  ✅ .haloignore — scan exclusion patterns`);
+            ignoreCreated = true;
         }
         catch (err) {
-            console.error(`  ❌ ${relativePath} — ${err instanceof Error ? err.message : err}`);
+            console.error(`  ❌ .haloignore — ${err instanceof Error ? err.message : err}`);
         }
     }
+    // Step 4: Summary
     console.log('');
-    if (created > 0) {
-        console.log(`Created ${created} rules file${created > 1 ? 's' : ''}. Your AI assistant now knows COPPA 2.0.`);
+    if (configCreated || ignoreCreated) {
+        const parts = [];
+        if (configCreated)
+            parts.push('.halorc.json');
+        if (ignoreCreated)
+            parts.push('.haloignore');
+        console.log(`Created: ${parts.join(', ')}`);
     }
-    if (skipped > 0) {
-        console.log(`Skipped ${skipped} existing file${skipped > 1 ? 's' : ''}.`);
+    else {
+        console.log('No files created (all exist — use --force to overwrite).');
     }
     console.log('');
-    console.log('What happens next:');
-    console.log('  • Cursor, Windsurf, and Copilot will read these rules automatically');
-    console.log('  • AI-generated code will follow COPPA compliance patterns');
-    console.log('  • Run "npx runhalo scan ." to verify compliance');
+    console.log('Next steps:');
+    console.log(`  ${c(colors.bold, 'npx runhalo scan .')}         Scan your project for compliance issues`);
+    console.log(`  ${c(colors.bold, 'npx runhalo init --ide')}     Generate AI coding assistant rules files`);
     console.log('');
-    console.log('Full-stack compliance for the AI coding era:');
-    console.log('  CI:        uses: runhalo/action@v1 catches violations in PRs');
-    console.log('  Local:     npx runhalo scan . catches violations on your machine');
-    console.log('  Proactive: AI rules files prevent violations before they\'re written');
     return 0;
 }
 program
@@ -2811,10 +3569,10 @@ program
 });
 program
     .command('init')
-    .description('Initialize Halo in your project (generate IDE rules files)')
+    .description('Initialize Halo in your project (detect framework, generate .halorc.json and .haloignore)')
     .argument('[path]', 'Project root path (default: current directory)', '.')
     .option('--ide', 'Generate AI coding assistant rules files', false)
-    .option('--force', 'Overwrite existing rules files', false)
+    .option('--force', 'Overwrite existing files', false)
     .action(async (projectPath, options) => {
     try {
         const exitCode = await init(projectPath, {
@@ -2828,6 +3586,73 @@ program
         process.exit(3);
     }
 });
+// ─── Sprint 15: Graduate Command ──────────────────────────────────────────
+program
+    .command('graduate')
+    .description('Run graduation pipeline — analyze FP patterns for heuristic promotion')
+    .option('--dry-run', 'Show candidates without modifying engine')
+    .option('--report', 'Output JSON report')
+    .option('--log-dir <dir>', 'Verdict log directory', 'verdict-logs')
+    .action(async (options) => {
+    try {
+        const { GraduationPipeline, formatAggregationReport, formatGraduationReport, formatCodegenReport } = require('@runhalo/engine/dist/graduation');
+        const logDir = path.resolve(options.logDir);
+        console.log('🎓 Graduation Pipeline — Sprint 15');
+        console.log(`   Log directory: ${logDir}\n`);
+        const pipeline = new GraduationPipeline({ logDir });
+        // Run full pipeline (stages 2-4)
+        const { aggregation, graduation, codegen } = pipeline.runPipeline();
+        if (options.report) {
+            // JSON output
+            console.log(JSON.stringify({
+                aggregation: {
+                    totalPatterns: aggregation.patterns.size,
+                    totalVerdicts: aggregation.totalVerdicts,
+                },
+                graduation: {
+                    eligible: graduation.eligible.length,
+                    ineligible: graduation.ineligible.length,
+                    candidates: graduation.eligible.map((c) => ({
+                        patternId: c.patternId,
+                        ruleId: c.ruleId,
+                        dismissals: c.dismissals,
+                        precision: c.precision,
+                        avgConfidence: c.avgConfidence,
+                    })),
+                },
+                codegen: codegen.map((c) => ({
+                    patternId: c.patternId,
+                    type: c.type,
+                })),
+            }, null, 2));
+        }
+        else {
+            // Human-readable output
+            console.log(formatAggregationReport(aggregation));
+            console.log('\n' + formatGraduationReport(graduation));
+            if (codegen.length > 0) {
+                console.log('\n' + formatCodegenReport(codegen));
+            }
+            console.log(`\n📊 Summary:`);
+            console.log(`   Patterns analyzed: ${aggregation.patterns.size}`);
+            console.log(`   Eligible for graduation: ${graduation.eligible.length}`);
+            console.log(`   Code snippets generated: ${codegen.length}`);
+            if (options.dryRun) {
+                console.log('\n   (dry-run mode — no changes applied)\n');
+            }
+        }
+    }
+    catch (error) {
+        if (error.code === 'MODULE_NOT_FOUND' || error.message?.includes('no such file')) {
+            console.error('⚠️  No verdict logs found. Run scans with AI Review Board first to generate graduation data.');
+            console.error('   Usage: runhalo scan . --review-board --license-key <key>');
+        }
+        else {
+            console.error('❌ Error:', error.message || error);
+        }
+        process.exit(3);
+    }
+});
 // Run CLI
 if (require.main === module) {
     program.parse();