@waratahlabs/canopy 0.5.0

package/dist/references/dstg-meaid.js

@@ -0,0 +1,352 @@
+/**
+ * DSTG MEAID — A Method for Ethical AI in Defence
+ *
+ * Primary source: "A Method for Ethical AI in Defence" (DSTG-TR-3786)
+ * Authors: Kate Devitt, Michael Gan, Jason Scholz and Robert Bolia
+ * Defence Science and Technology Group, Department of Defence
+ * © Commonwealth of Australia 2020
+ *
+ * Secondary source: "Case Study: A Method for Ethical AI in Defence Applied to
+ * an Envisioned Tactical Command and Control System" (DSTG-TR-3847)
+ * Authors: Dianna Gaetjens, Kate Devitt, and Christopher Shanahan
+ * © Commonwealth of Australia 2022
+ *
+ * MEAID is an ethical AI framework, not a security framework. It organises
+ * risk across five facets — Responsibility, Governance, Trust, Law, Traceability —
+ * and twenty evidence-based topics. Most risks are ethical or compliance in nature;
+ * this is correct and intentional. MEAID covers ground that AIVSS+ATLAS cannot.
+ *
+ * AIVSS metric mapping rationale:
+ * - Responsibility risks → EI (Ethical Implications), GV (Governance)
+ * - Governance risks → GV, EI, AD (Adaptive Defence — human factors/resilience)
+ * - Trust risks → GV, LL (Lifecycle & Lineage), CS (supply chain), MR, DS, EI
+ * - Law risks → GV, EI (legal compliance obligations)
+ * - Traceability risks → GV, LL, EI
+ */
+import { buildHelpers, } from "./registry.js";
+// ── RESPONSIBILITY ──────────────────────────────────────────────────────────
+// Who is responsible for AI?
+// Topics: Education, Command
+const RESPONSIBILITY_RISKS = [
+    {
+        id: "meaid-responsibility-education",
+        framework: "dstg-meaid",
+        category: "Responsibility",
+        name: "Insufficient AI Education for Responsible Use",
+        description: "Military personnel who lack sufficient understanding of AI systems cannot lead, manage or meaningfully oversee them, creating a gap between formal responsibility and actual capability to exercise that responsibility. Defence teaches leadership through human cognition and social factors; without equivalent AI literacy, commanders cannot understand system behaviour, identify limitations, or develop the trust required to use AI appropriately in high-stakes decisions. This risk is especially acute as AI capabilities become embedded across defence functions, since personnel who cannot understand a system cannot be reasonably held responsible for its outputs. Education is the foundational prerequisite for all other facets of ethical AI.",
+        riskType: "ethical",
+        aivssMetrics: ["EI", "GV"],
+        atlasTechniqueIds: [],
+        sourceSection: "DSTG-TR-3786 §3.1.1 Education",
+    },
+    {
+        id: "meaid-responsibility-command",
+        framework: "dstg-meaid",
+        category: "Responsibility",
+        name: "Diffuse Command Accountability in Human-AI Decision Networks",
+        description: "When AI systems are embedded in the decision chain, responsibility for a given action is distributed across coders, procurers, deployers and operators — creating a 'moral crumple zone' in which human operators bear disproportionate accountability for system-wide failures they did not control. The information age means humans command information environments that control machines; identifying who is 'in command' of the AI — the algorithm designer, the acquisition agency, the deploying commander, or the operator — requires proactive legal and ethical frameworks. Without such frameworks, accountability falls arbitrarily on whichever human is most proximate to the outcome, rather than on those who made the decisions that shaped the system's behaviour. Australian domestic legislation (Archives Act, Defence Act) and ADDP 00.1 Command and Control impose obligations that must be explicitly reconciled with AI-augmented decision-making.",
+        riskType: "compliance",
+        aivssMetrics: ["GV", "EI"],
+        atlasTechniqueIds: [],
+        sourceSection: "DSTG-TR-3786 §3.1.2 Command; DSTG-TR-3847 §4.1.1 Accountability",
+    },
+];
+// ── GOVERNANCE ──────────────────────────────────────────────────────────────
+// How is AI controlled?
+// Topics: Effectiveness, Integration, Transparency, Human Factors, Scope, Confidence, Resilience
+const GOVERNANCE_RISKS = [
+    {
+        id: "meaid-governance-effectiveness",
+        framework: "dstg-meaid",
+        category: "Governance",
+        name: "Undemonstrated Effectiveness Prior to Deployment",
+        description: "AI systems may be deployed before their effectiveness has been rigorously demonstrated across the range of operational scenarios in which they will be used, including varying levels of risk, dynamics and decision requirements. The IEEE Ethically Aligned Design principle requires creators and operators of intelligent systems to provide evidence of fitness for purpose; deploying without such evidence exposes operators and commanders to decisions supported by systems whose capabilities are poorly understood. Robust pre-deployment testing through experimentation, simulation and limited live trials is an ethical obligation because overconfidence in an untested AI may lead to unjustified reliance and consequent harm.",
+        riskType: "ethical",
+        aivssMetrics: ["GV", "EI"],
+        atlasTechniqueIds: [],
+        sourceSection: "DSTG-TR-3786 §3.2.1 Effectiveness; DSTG-TR-3847 §4.2.1 Effectiveness",
+    },
+    {
+        id: "meaid-governance-integration",
+        framework: "dstg-meaid",
+        category: "Governance",
+        name: "Inadequate Human-AI Integration Design",
+        description: "Effective governance requires that AI systems be integrated with human operators in ways that account for individual differences in cognitive ability, operational context and human-autonomy teaming dynamics. Poor integration — treating AI as a bolt-on to existing processes rather than a redesign of the human-machine system — risks either under-use (operators bypassing AI) or over-use (automation bias, skill degradation). Social integration of AI into military organisations also produces second-order effects on culture, trust and institutional authority that require deliberate management. Integration that fits the operator and the context is an ethical precondition for effective and safe AI use.",
+        riskType: "ethical",
+        aivssMetrics: ["GV", "EI"],
+        atlasTechniqueIds: [],
+        sourceSection: "DSTG-TR-3786 §3.2.2 Integration; DSTG-TR-3847 §4.2.2 Integration",
+    },
+    {
+        id: "meaid-governance-transparency",
+        framework: "dstg-meaid",
+        category: "Governance",
+        name: "Transparency Miscalibration — Too Little or Too Much",
+        description: "Transparency — an operator's awareness of an autonomous agent's actions, decisions, behaviours and intentions — must be calibrated to context: too little creates opacity that undermines meaningful human control, while too much creates information overload and decision paralysis. The IEEE Ethically Aligned Design principle holds that the basis of a particular AI decision should always be discoverable, allowing for differences in user need (e.g. a legal review team vs. a tactical operator). Overly explanatory systems can increase automation bias by lending authority to outputs that operators can no longer critically assess. Defence must determine the appropriate level of transparency for each context of AI use throughout the system lifecycle.",
+        riskType: "ethical",
+        aivssMetrics: ["GV", "EI"],
+        atlasTechniqueIds: [],
+        sourceSection: "DSTG-TR-3786 §3.2.3 Transparency",
+    },
+    {
+        id: "meaid-governance-human-factors",
+        framework: "dstg-meaid",
+        category: "Governance",
+        name: "Human Cognitive and Neurophysiological Risk in Human-AI Teaming",
+        description: "Complex AI-enabled information systems create cognitive fatigue, distraction (via multi-modal delivery), automation bias and skill degradation in human operators — risks that are not being sufficiently considered when determining the appropriate level of AI use, when not to use it, or how to design human-on/in-the-loop processes. Reliance on automation over time degrades the cognitive and coordination capabilities of operators, leaving them vulnerable when operating at the boundaries of system competence or in novel contexts. The human-AI cognitive relationship is critical to the system's proper use, particularly as the tempo and scale of operations increase; autonomous countermeasures that can respond faster than human reaction times present a specific case where assigning humans to decisions may not improve decision-making.",
+        riskType: "ethical",
+        aivssMetrics: ["EI", "GV"],
+        atlasTechniqueIds: [],
+        sourceSection: "DSTG-TR-3786 §3.2.4 Human Factors",
+    },
+    {
+        id: "meaid-governance-scope",
+        framework: "dstg-meaid",
+        category: "Governance",
+        name: "Inappropriate Scope of AI Autonomy",
+        description: "Full autonomy is achievable only under very high levels of reliability and robustness that current AI systems have not demonstrated; deploying AI beyond its validated scope — whether through over-reliance or under-reliance — is an ethical risk. Technical issues including autonomy brittleness, capacity to handle emergence, software validation challenges, graceful degradation requirements and learning-system transparency mean that the appropriate scope of AI autonomy must be determined carefully for each deployment context. Human decision-makers can be nuanced, flexible and contextual in ways that brittle AIs struggle with, but machine complexity confounds human decision-makers even when there is ample time for considered judgment. Governance must define the boundaries of AI autonomy and ensure operators maintain an accurate mental model of system capabilities.",
+        riskType: "ethical",
+        aivssMetrics: ["GV", "EI"],
+        atlasTechniqueIds: [],
+        sourceSection: "DSTG-TR-3786 §3.2.5 Scope",
+    },
+    {
+        id: "meaid-governance-confidence",
+        framework: "dstg-meaid",
+        category: "Governance",
+        name: "Miscalibrated Confidence in AI Outputs",
+        description: "AI systems that provide advice should also provide calibrated confidence in that advice — not merely classification probability but also whether the class or situation is even within the model's trained domain. Confidence reporting is currently an unsolved problem: softmax and similar outputs do not indicate whether an input is within the model's training distribution, and very few AI systems convey multiple types of uncertainty (ignorance, vagueness, ambiguity, incompleteness) in a form meaningful to human operators. Automation bias — operators placing too high a confidence in AI outputs — is a direct consequence of poor confidence communication. Commanders need to know when to trust AI and when not to; without nested, calibrated confidence levels across all decision components, meaningful human control is compromised.",
+        riskType: "ethical",
+        aivssMetrics: ["EI", "GV"],
+        atlasTechniqueIds: [],
+        sourceSection: "DSTG-TR-3786 §3.2.6 Confidence; DSTG-TR-3847 §4.2.3 Confidence",
+    },
+    {
+        id: "meaid-governance-resilience",
+        framework: "dstg-meaid",
+        category: "Governance",
+        name: "Insufficient System Resilience to Anomalous Situations",
+        description: "AI-enabled Defence systems must exhibit resilience: the ability to foresee, contain, and recover from anomalous situations — including cyber-attack, sensor degradation, unexpected operational environments and AI malfunctions. Systems that cannot foresee and contain anomalies propagate errors into downstream human decisions without adequate warning; systems that cannot recover force abrupt fallback to human-only operation in conditions for which operators may be poorly prepared after extended AI-assisted work. Governance must require that AI systems be designed with resilience properties throughout the system lifecycle, using supervised and unsupervised machine learning for anomaly detection paired with probabilistic reasoning for reconfiguration decisions.",
+        riskType: "ethical",
+        aivssMetrics: ["GV", "EI"],
+        atlasTechniqueIds: [],
+        sourceSection: "DSTG-TR-3786 §3.2.7 Resilience; DSTG-TR-3847 §4.2.4 Resilience",
+    },
+];
+// ── TRUST ───────────────────────────────────────────────────────────────────
+// How can AI be trusted?
+// Topics: Sovereign Capability, Safety, Supply Chain, Test & Evaluation,
+//         Misuse and Risks, Authority Pathway, Data Subjects
+const TRUST_RISKS = [
+    {
+        id: "meaid-trust-sovereign-capability",
+        framework: "dstg-meaid",
+        category: "Trust",
+        name: "Sovereign AI Capability Dependency Risk",
+        description: "Australia's reliance on overseas AI suppliers may expose Defence to anti-competitive proprietary systems encumbered by International Traffic in Arms Regulations (ITAR) and other export control regimes, limiting the ability to modify, audit or sustain AI systems during operations. Lack of investment in sovereign AI capability risks decision superiority being contingent on the availability and goodwill of foreign vendors — a strategic vulnerability analogous to the lack of spare parts for jointly-procured platforms. The National Security Science and Technology Interdepartmental Committee has endorsed national security priorities — including cybersecurity, intelligence, border security and forensic science — all of which depend on AI; sovereign capability is a trust precondition for each.",
+        riskType: "compliance",
+        aivssMetrics: ["GV", "LL"],
+        atlasTechniqueIds: [],
+        sourceSection: "DSTG-TR-3786 §3.3.1 Sovereign Capability",
+    },
+    {
+        id: "meaid-trust-safety",
+        framework: "dstg-meaid",
+        category: "Trust",
+        name: "AI Safety Failure in Operational Contexts",
+        description: "AI systems used in Defence must be safe: avoiding negative side effects, avoiding reward hacking, maintaining scalable oversight, exploring safely and demonstrating robustness to distributional shift — that is, performing safely in contexts different from those in which they were trained. The Australian ethical AI principles require that AI systems should reliably operate in accordance with their intended purpose throughout their lifecycle; test and evaluation will have limited guarantees for adaptive AI systems operating in unforeseen contexts, meaning risk levels must be understood and documented at design time. Safety failures in Defence AI are not merely technical incidents but ethical failures with potential for irreversible harm to personnel and non-combatants.",
+        riskType: "ethical",
+        aivssMetrics: ["GV", "EI"],
+        atlasTechniqueIds: [],
+        sourceSection: "DSTG-TR-3786 §3.3.2 Safety",
+    },
+    {
+        id: "meaid-trust-supply-chain",
+        framework: "dstg-meaid",
+        category: "Trust",
+        name: "Unvetted AI Supply Chain — Bias, Backdoors and Undisclosed Provenance",
+        description: "AI generated through unsecure or opaque supply chains may contain backdoors, be vulnerable to hacking, or embed unjust biases from datasets to learning protocols to interpretive layers. Better data transparency is required to verify the provenance of suppliers and the full lineage of training data, models and components used in Defence AI systems. Participants felt that all aspects of developing AI for Defence should be scrutinised for ethicality — not just the end product — reflecting a 'cradle to grave' assessment model. Supply chain bias that produces unfair discrimination (violating jus in bello principles of distinction and proportionality) is an especially insidious risk because it is often invisible to the end user of a deployed product.",
+        riskType: "compliance",
+        aivssMetrics: ["LL", "GV", "CS"],
+        atlasTechniqueIds: [],
+        sourceSection: "DSTG-TR-3786 §3.3.3 Supply Chain",
+    },
+    {
+        id: "meaid-trust-test-and-evaluation",
+        framework: "dstg-meaid",
+        category: "Trust",
+        name: "Test and Evaluation Inadequacy for Adaptive AI Systems",
+        description: "Traditional test and evaluation defines desired system responses for all anticipated operating conditions, but the condition-response matrix for AI is intractably large — particularly for deep learning systems that are not programmed with explicit responses and can solve problems in domains not encoded in software. AI weapons systems are subject to Article 36 review under Additional Protocol 1 of the Geneva Conventions, which requires that new weapons be reviewed for compliance with international humanitarian law; adaptive AI systems that develop emergent capabilities challenge this review framework. AI T&E must be iterative, adversarial and conducted throughout design and application — including testing for second and third order effects that are especially likely to be unknown with new technology.",
+        riskType: "compliance",
+        aivssMetrics: ["GV", "LL"],
+        atlasTechniqueIds: [],
+        sourceSection: "DSTG-TR-3786 §3.3.4 Test and Evaluation",
+    },
+    {
+        id: "meaid-trust-misuse-and-risks",
+        framework: "dstg-meaid",
+        category: "Trust",
+        name: "AI Misuse, Cyber Exploitation and Unforeseeable Risk Vectors",
+        description: "The potential misuses and risks for AI are categorically different and more extensive depending on the anticipated level of autonomy and planned context of use; as AI capabilities become more powerful, threats expand through lower costs, a larger pool of capable threat actors, increased attack rates and a wider set of targets. Cyber capabilities that change system behaviour — either deliberately or as a malware by-product — represent a significant threat to trust in autonomous systems; systems must be resilient to attack and protect their communication feeds. In a worst-case scenario, AI systems could be re-tasked to operate on behalf of opposing forces. Dirty data used to train AI (demonstrated by MIT's 'Norman' experiment) and the unavailability of responsible disclosure norms for AI models present additional misuse vectors that Defence must govern proactively.",
+        riskType: "security",
+        aivssMetrics: ["MR", "DS", "GV"],
+        atlasTechniqueIds: [
+            "AML.T0020", // Poison training data
+            "AML.T0018", // Backdoor ML model
+        ],
+        sourceSection: "DSTG-TR-3786 §3.3.5 Misuse and Risks",
+    },
+    {
+        id: "meaid-trust-authority-pathway",
+        framework: "dstg-meaid",
+        category: "Trust",
+        name: "Failure to Embed Authority Pathway and Ethical Constraints in AI Decision Support",
+        description: "AI decision support systems used in targeting and use-of-force contexts must be programmed with the applicable ethical and legal constraints — including rules of engagement, IHL distinctions between combatants and non-combatants, and proportionality — so that the AI guides rather than bypasses the authority pathway. The Vincennes incident, where human cognitive biases led to the shooting down of an Iranian civilian aircraft, illustrates how AI prioritising IHL compliance and integrating disconfirming evidence might prevent errors of catastrophic consequence. AI built to assist tactical decision-making at trigger-point decisions must be designed with embedded ethical awareness, reasoning and action constraints — not as post-hoc filters but as constitutive elements of the system's decision architecture.",
+        riskType: "ethical",
+        aivssMetrics: ["EI", "GV"],
+        atlasTechniqueIds: [],
+        sourceSection: "DSTG-TR-3786 §3.3.6 Authority Pathway; DSTG-TR-3847 §4.2.5 Decision support for targeting",
+    },
+    {
+        id: "meaid-trust-data-subjects",
+        framework: "dstg-meaid",
+        category: "Trust",
+        name: "Privacy and Dignity Harm to Data Subjects via Defence AI",
+        description: "Data of Defence personnel may be used by AI in HR areas such as posting, promotion, disciplinary management, recruitment and retention — contexts where the Australian ethical AI principles require respect for privacy rights and data protection throughout the system lifecycle. The use of big data and statistical research tools creates a heightened risk that individuals could be harmed through mosaic theory techniques — where AI programs with access to both anonymous surveys and system-level demographic data can attribute negative comments or indicators to specific individuals. Defence must balance the business intelligence value of large-scale personnel data analysis against the ethical obligations owed to individuals whose data is analysed, noting that Defence personnel face different circumstances from civilians regarding data availability and national security constraints.",
+        riskType: "ethical",
+        aivssMetrics: ["EI", "GV"],
+        atlasTechniqueIds: [],
+        sourceSection: "DSTG-TR-3786 §3.3.7 Data Subjects",
+    },
+];
+// ── LAW ─────────────────────────────────────────────────────────────────────
+// How can AI be used lawfully?
+// Topics: Protected Symbols and Surrender, De-escalation
+const LAW_RISKS = [
+    {
+        id: "meaid-law-protected-symbols",
+        framework: "dstg-meaid",
+        category: "Law",
+        name: "AI Misidentification of Protected Symbols, Civilians and Surrender",
+        description: "AI systems deployed in combat contexts must correctly recognise protected symbols (red cross, red crescent, white flag of surrender) and apply the IHL distinctions of jus in bello — proportionality, distinction and military necessity — to avoid unlawful targeting of protected persons, objects and activities. Human error in protected symbol recognition has produced catastrophic and politically damaging results (e.g. attacks on MSF hospital in Kunduz, 2015; attacks on hospitals in Yemen). Adversarial parties also falsify protected symbols — an act of perfidy that constitutes a war crime and can fool AI classifiers — meaning that human-AI systems seeking to improve IHL compliance must be embedded in an information environment that anticipates deception, disinformation and misinformation regarding protected objects. Failure to address this risk exposes Defence to violations of international humanitarian law.",
+        riskType: "compliance",
+        aivssMetrics: ["GV", "EI"],
+        atlasTechniqueIds: [],
+        sourceSection: "DSTG-TR-3786 §3.4.1 Protected Symbols and Surrender",
+    },
+    {
+        id: "meaid-law-de-escalation",
+        framework: "dstg-meaid",
+        category: "Law",
+        name: "AI-Driven Force Escalation and Proportionality Risk",
+        description: "The use of AI and autonomous systems changes the escalation calculus in conflict: the reduced political cost of losing an unmanned system versus a crewed aircraft alters retaliatory thresholds, while the un-attributable nature of some cyber and electronic warfare systems creates new challenges for both force escalation and de-escalation. AI could be used to increase situational awareness to enable commanders to manage escalation with better information, but poorly governed AI could also accelerate decision cycles in ways that bypass the proportionality assessments required by jus ad bellum. Defence must understand the evolving dynamics of escalation and deterrence when using autonomous systems, and ensure AI decision support tools are consistent with the legal obligation to consider proportionality in the use of force.",
+        riskType: "compliance",
+        aivssMetrics: ["GV", "EI"],
+        atlasTechniqueIds: [],
+        sourceSection: "DSTG-TR-3786 §3.4.2 De-escalation",
+    },
+];
+// ── TRACEABILITY ─────────────────────────────────────────────────────────────
+// How are the actions of AI recorded?
+// Topics: Explainability, Accountability
+const TRACEABILITY_RISKS = [
+    {
+        id: "meaid-traceability-explainability",
+        framework: "dstg-meaid",
+        category: "Traceability",
+        name: "Insufficient AI Explainability for Meaningful Human Oversight",
+        description: "Human oversight, understanding and explainability of AI decisions are complex and variously interpretable requirements; there is no shared definition of what constitutes a sufficient explanation for an AI system. The Boeing 737 Max MCAS case demonstrates how autonomous systems can be deployed without operators and testing authorities being sufficiently informed about system behaviour — a failure of explainability that caused hundreds of deaths. DARPA's Explainable AI (XAI) programme recognises that explainability is critical for humans to appropriately trust and effectively manage human-AI systems, but notes that some explanations can decrease scepticism and increase automation bias. Information about AI system training, test and evaluation, background theories and assumptions must be retained and available to auditors, while the appropriate level of explanation for tactical versus legal review contexts will differ.",
+        riskType: "ethical",
+        aivssMetrics: ["GV", "EI", "LL"],
+        atlasTechniqueIds: [],
+        sourceSection: "DSTG-TR-3786 §3.5.1 Explainability",
+    },
+    {
+        id: "meaid-traceability-accountability",
+        framework: "dstg-meaid",
+        category: "Traceability",
+        name: "Accountability Framework Gap for AI-Assisted Decisions",
+        description: "Australian domestic legislation — including the Archives Act and the Public Governance, Performance and Accountability Act — imposes obligations on Commonwealth Departments to record and retain records relating to certain decisions; AI-driven decisions are likely captured by these requirements but existing policy has not explicitly addressed how AI decision records should be structured, retained and audited. Decisions made by or with AI must be supported by evidence of the AI decision process so that potential reviews are meaningful; human-AI logistics and operational systems should be able to output explanations of decisions in accordance with legislative obligations. The basis of any particular AI decision in Defence — data, training, theoretical underpinning, decision-making models and actions — should be recorded and auditable by appropriate levels of government, and made available to the public where appropriate.",
+        riskType: "compliance",
+        aivssMetrics: ["GV", "LL", "EI"],
+        atlasTechniqueIds: [],
+        sourceSection: "DSTG-TR-3786 §3.5.2 Accountability; DSTG-TR-3847 §4.1.1 Accountability",
+    },
+];
+// ── WHOLE-OF-DEFENCE DATA GOVERNANCE ────────────────────────────────────────
+// From DSTG-TR-3847 key findings — a cross-cutting risk not covered by the
+// 20 topics directly but surfaced as a first-order finding requiring policy action.
+const DATA_GOVERNANCE_RISKS = [
+    {
+        id: "meaid-data-governance",
+        framework: "dstg-meaid",
+        category: "Governance",
+        name: "Absence of a Whole-of-Defence AI Data Policy",
+        description: "The lack of a comprehensive Defence data framework for AI applications — governing collection, processing and transformation, storage, and use of data — represents a significant ethical risk that is insidious because it is often invisible to the user of a product built on poorly governed data. Errors, inaccuracy, bias and discrimination arising from poor data practices are especially likely in AI systems relying on deep learning, where exponential increases in data volume amplify the consequences of any lack of rigour in data collection and use. DSTG-TR-3847 identifies this as a whole-of-Defence finding: any lack of rigour around data practices presents significant ethical risks including unintentional operational harms, and a comprehensive Defence data framework for AI applications is required to allow consistency across all AI projects.",
+        riskType: "compliance",
+        aivssMetrics: ["GV", "LL", "DS"],
+        atlasTechniqueIds: [],
+        sourceSection: "DSTG-TR-3847 §4.1.3 Data",
+    },
+];
+/**
+ * Complete MEAID risk catalogue.
+ *
+ * 20 topics across 5 facets, plus one additional cross-cutting data governance
+ * risk surfaced by the DSTG-TR-3847 case study as a whole-of-Defence finding.
+ * Total: 21 entries.
+ */
+export const DSTG_MEAID_RISKS = [
+    ...RESPONSIBILITY_RISKS,
+    ...GOVERNANCE_RISKS,
+    ...TRUST_RISKS,
+    ...LAW_RISKS,
+    ...TRACEABILITY_RISKS,
+    ...DATA_GOVERNANCE_RISKS,
+];
+/**
+ * Citation for the primary MEAID document.
+ * The case study (DSTG-TR-3847) is the secondary source and is referenced in
+ * individual risk sourceSection fields where it provides additional detail.
+ */
+export const DSTG_MEAID_CITATION = {
+    id: "dstg-meaid",
+    title: "A Method for Ethical AI in Defence",
+    version: "DSTG-TR-3786",
+    authors: [
+        "Kate Devitt",
+        "Michael Gan",
+        "Jason Scholz",
+        "Robert Bolia",
+        "Defence Science and Technology Group, Department of Defence",
+        "Trusted Autonomous Systems Defence Cooperative Research Centre (TASDCRC)",
+    ],
+    year: 2020,
+    url: "https://www.dst.defence.gov.au/ethicalai",
+};
+// ── LOOKUP HELPERS ────────────────────────────────────────────────────────────
+const helpers = buildHelpers(DSTG_MEAID_RISKS);
+/**
+ * Return MEAID risks relevant to a given AIVSS V4 metric.
+ * Results are ordered by number of ATLAS techniques (most-grounded first).
+ */
+export const getRisksForMetric = helpers.getRisksForMetric;
+/**
+ * Return MEAID risks of a given risk type (security | ethical | compliance).
+ */
+export const getRisksByType = helpers.getRisksByType;
+/**
+ * Look up a MEAID risk by its id. Returns undefined if not found.
+ */
+export const getRiskById = helpers.getRiskById;
+/**
+ * Complete MEAID framework adapter.
+ */
+export const DSTG_MEAID_ADAPTER = {
+    citation: DSTG_MEAID_CITATION,
+    risks: DSTG_MEAID_RISKS,
+    getRisksForMetric,
+    getRisksByType,
+    getRiskById,
+};
+//# sourceMappingURL=dstg-meaid.js.map

package/dist/references/dstg-meaid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dstg-meaid.js","sourceRoot":"","sources":["../../src/references/dstg-meaid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAIL,YAAY,GACb,MAAM,eAAe,CAAC;AAEvB,+EAA+E;AAC/E,6BAA6B;AAC7B,6BAA6B;AAE7B,MAAM,oBAAoB,GAAoB;IAC5C;QACE,EAAE,EAAE,gCAAgC;QACpC,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,gBAAgB;QAC1B,IAAI,EAAE,+CAA+C;QACrD,WAAW,EACT,suBAAsuB;QACxuB,QAAQ,EAAE,SAAS;QACnB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,+BAA+B;KAC/C;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,gBAAgB;QAC1B,IAAI,EAAE,8DAA8D;QACpE,WAAW,EACT,86BAA86B;QACh7B,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,iEAAiE;KACjF;CACF,CAAC;AAEF,+EAA+E;AAC/E,wBAAwB;AACxB,iGAAiG;AAEjG,MAAM,gBAAgB,GAAoB;IACxC;QACE,EAAE,EAAE,gCAAgC;QACpC,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,kDAAkD;QACxD,WAAW,EACT,ktBAAktB;QACptB,QAAQ,EAAE,SAAS;QACnB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,sEAAsE;KACtF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,wCAAwC;QAC9C,WAAW,EACT,isBAAisB;QACnsB,QAAQ,EAAE,SAAS;QACnB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,kEAAkE;KAClF;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,sDAAsD;QAC5D,WAAW,EACT,gvBAAgvB;QAClvB,QAAQ,EAAE,SAAS;QACnB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,kCAAkC;KAClD;IACD;QACE,EAAE,EAAE,gCAAgC;QACpC,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,iEAAiE;QACvE,WAAW,EACT,u0BAAu0B;QACz0B,QAAQ,EAAE,SAAS;QACnB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,mCAAmC;KACnD;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,oCAAoC;QAC1C,WAAW,EACT,y2BAAy2B;QAC32B,QAAQ,EAAE,SAAS;QACnB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,2BAA2B;KAC3C;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,wCAAwC;QAC9C,WAAW,EACT,i0BAAi0B;QACn0B,QAAQ,EAAE,SAAS;QACnB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gEAAgE;KAChF;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,wDAAwD;QAC9D,WAAW,EACT,gwBAAgwB;QAClwB,QAAQ,EAAE,SAAS;QACnB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gEAAgE;KAChF;CACF,CAAC;AAEF,+EAA+E;AAC/E,yBAAyB;AACzB,yEAAyE;AACzE,6DAA6D;AAE7D,MAAM,WAAW,GAAoB;IACnC;QACE,EAAE,EAAE,kCAAkC;QACtC,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,yCAAyC;QAC/C,WAAW,EACT,8xBAA8xB;QAChyB,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,0CAA0C;KAC1D;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,2CAA2C;QACjD,WAAW,EACT,2wBAA2wB;QAC7wB,QAAQ,EAAE,SAAS;QACnB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,4BAA4B;KAC5C;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,uEAAuE;QAC7E,WAAW,EACT,ovBAAovB;QACtvB,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,kCAAkC;KAClD;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,wDAAwD;QAC9D,WAAW,EACT,4yBAA4yB;QAC9yB,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,yCAAyC;KACzD;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,8DAA8D;QACpE,WAAW,EACT,62BAA62B;QAC/2B,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE;YACjB,WAAW,EAAE,uBAAuB;YACpC,WAAW,EAAE,oBAAoB;SAClC;QACD,aAAa,EAAE,sCAAsC;KACtD;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,mFAAmF;QACzF,WAAW,EACT,8yBAA8yB;QAChzB,QAAQ,EAAE,SAAS;QACnB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,2FAA2F;KAC3G;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,0DAA0D;QAChE,WAAW,EACT,y3BAAy3B;QAC33B,QAAQ,EAAE,SAAS;QACnB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,mCAAmC;KACnD;CACF,CAAC;AAEF,+EAA+E;AAC/E,+BAA+B;AAC/B,yDAAyD;AAEzD,MAAM,SAAS,GAAoB;IACjC;QACE,EAAE,EAAE,6BAA6B;QACjC,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,oEAAoE;QAC1E,WAAW,EACT,u5BAAu5B;QACz5B,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,qDAAqD;KACrE;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,qDAAqD;QAC3D,WAAW,EACT,g0BAAg0B;QACl0B,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,mCAAmC;KACnD;CACF,CAAC;AAEF,gFAAgF;AAChF,sCAAsC;AACtC,yCAAyC;AAEzC,MAAM,kBAAkB,GAAoB;IAC1C;QACE,EAAE,EAAE,mCAAmC;QACvC,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,cAAc;QACxB,IAAI,EAAE,+DAA+D;QACrE,WAAW,EACT,m6BAAm6B;QACr6B,QAAQ,EAAE,SAAS;QACnB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,oCAAoC;KACpD;IACD;QACE,EAAE,EAAE,mCAAmC;QACvC,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,cAAc;QACxB,IAAI,EAAE,wDAAwD;QAC9D,WAAW,EACT,q6BAAq6B;QACv6B,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,wEAAwE;KACxF;CACF,CAAC;AAEF,+EAA+E;AAC/E,2EAA2E;AAC3E,oFAAoF;AAEpF,MAAM,qBAAqB,GAAoB;IAC7C;QACE,EAAE,EAAE,uBAAuB;QAC3B,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,8CAA8C;QACpD,WAAW,EACT,o1BAAo1B;QACt1B,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,0BAA0B;KAC1C;CACF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,GAAG,oBAAoB;IACvB,GAAG,gBAAgB;IACnB,GAAG,WAAW;IACd,GAAG,SAAS;IACZ,GAAG,kBAAkB;IACrB,GAAG,qBAAqB;CACzB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,oCAAoC;IAC3C,OAAO,EAAE,cAAc;IACvB,OAAO,EAAE;QACP,aAAa;QACb,aAAa;QACb,cAAc;QACd,cAAc;QACd,6DAA6D;QAC7D,0EAA0E;KAC3E;IACD,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,0CAA0C;CAChD,CAAC;AAEF,iFAAiF;AAEjF,MAAM,OAAO,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;AAE3D;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AAErD;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;AAE/C;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAqB;IAClD,QAAQ,EAAE,mBAAmB;IAC7B,KAAK,EAAE,gBAAgB;IACvB,iBAAiB;IACjB,cAAc;IACd,WAAW;CACZ,CAAC"}

package/dist/references/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Framework registry bootstrap.
+ *
+ * Imports each adapter and registers it. Import this module once (the assembler
+ * does so) to ensure FRAMEWORK_REGISTRY is populated before any lookups occur.
+ *
+ * Adding a framework: create src/references/{name}.ts exporting a FrameworkAdapter,
+ * then add one registerFrameworkAdapter() call below.
+ */
+import { FRAMEWORK_REGISTRY } from "./registry.js";
+/**
+ * Framework IDs this build actually registers. Exported so the parity test and
+ * the CLI can assert against one list rather than re-deriving it, and so drift
+ * between what package.json advertises and what the engine does is mechanical
+ * to detect.
+ * */
+export declare const REGISTERED_FRAMEWORK_IDS: string[];
+export { FRAMEWORK_REGISTRY };
+export type { FrameworkAdapter, FrameworkRisk, FrameworkCitation, RiskType } from "./registry.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/references/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/references/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAA4B,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAe7E;;;;;KAKK;AACL,eAAO,MAAM,wBAAwB,UAAsD,CAAC;AAE5F,OAAO,EAAE,kBAAkB,EAAE,CAAC;AAC9B,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC"}

package/dist/references/index.js

@@ -0,0 +1,31 @@
+/**
+ * Framework registry bootstrap.
+ *
+ * Imports each adapter and registers it. Import this module once (the assembler
+ * does so) to ensure FRAMEWORK_REGISTRY is populated before any lookups occur.
+ *
+ * Adding a framework: create src/references/{name}.ts exporting a FrameworkAdapter,
+ * then add one registerFrameworkAdapter() call below.
+ */
+import { registerFrameworkAdapter, FRAMEWORK_REGISTRY } from "./registry.js";
+import { ACSC_ADAPTER } from "./acsc-risks.js";
+import { DSTG_MEAID_ADAPTER } from "./dstg-meaid.js";
+import { AICM_ADAPTER } from "./aicm.js";
+import { NIST_AI_RMF_ADAPTER } from "./nist-ai-rmf.js";
+import { OWASP_AGENTIC_TOP10_ADAPTER } from "./owasp-agentic-top10.js";
+import { NEMOCLAW_ADAPTER } from "./nemoclaw.js";
+registerFrameworkAdapter(ACSC_ADAPTER);
+registerFrameworkAdapter(DSTG_MEAID_ADAPTER);
+registerFrameworkAdapter(AICM_ADAPTER);
+registerFrameworkAdapter(NIST_AI_RMF_ADAPTER);
+registerFrameworkAdapter(OWASP_AGENTIC_TOP10_ADAPTER);
+registerFrameworkAdapter(NEMOCLAW_ADAPTER);
+/**
+ * Framework IDs this build actually registers. Exported so the parity test and
+ * the CLI can assert against one list rather than re-deriving it, and so drift
+ * between what package.json advertises and what the engine does is mechanical
+ * to detect.
+ * */
+export const REGISTERED_FRAMEWORK_IDS = FRAMEWORK_REGISTRY.map((a) => a.citation.id).sort();
+export { FRAMEWORK_REGISTRY };
+//# sourceMappingURL=index.js.map

package/dist/references/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/references/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,wBAAwB,CAAC,YAAY,CAAC,CAAC;AACvC,wBAAwB,CAAC,kBAAkB,CAAC,CAAC;AAC7C,wBAAwB,CAAC,YAAY,CAAC,CAAC;AACvC,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;AAC9C,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;AACtD,wBAAwB,CAAC,gBAAgB,CAAC,CAAC;AAE3C;;;;;KAKK;AACL,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAE5F,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/references/nemoclaw.d.ts

@@ -0,0 +1,48 @@
+/**
+ * NeMo Claw — Security Isolation Layer Reference
+ *
+ * NeMo Claw is NVIDIA's enterprise security wrapper for OpenClaw. It places the
+ * agent inside a kernel-enforced sandbox (Landlock + seccomp + network namespaces)
+ * rather than applying application-layer guardrails. Security constraints live
+ * outside the agent process — they cannot be bypassed even if the agent is
+ * compromised.
+ *
+ * This adapter documents NeMo Claw's four isolation layers as FrameworkRisks —
+ * specifically, the *residual risks* that persist even with the sandbox active.
+ * It is used by Canopy to annotate which threats are mitigated vs. unchanged
+ * when comparing a baseline OpenClaw deployment to a NeMo Claw deployment.
+ *
+ * Architecture:
+ *   Layer 1 — Network:    allowlisted egress only (hot-reloadable YAML policy)
+ *   Layer 2 — Filesystem: agent restricted to /sandbox + /tmp; host FS read-only
+ *   Layer 3 — Process:    Landlock + seccomp block privilege escalation + dangerous syscalls
+ *   Layer 4 — Inference:  all model API calls routed through controlled backends
+ *
+ * Container taxonomy mapping (what NeMo Claw changes):
+ *   L4 Host:        largely mitigated by Layers 2 + 3 (Landlock, seccomp, network ns)
+ *   L3 Engine:      largely mitigated by Layer 3 (seccomp)
+ *   L2 Application: partially mitigated (Layer 1 network, Layer 4 inference routing)
+ *   L1 Orchestration: unchanged — cron and agent bindings operate inside the sandbox
+ *
+ * Key caveat: NeMo Claw is alpha/early-access. Ubuntu 22.04+ only. 8 GB RAM min.
+ *
+ * Reference: https://www.secondtalent.com/resources/nemoclaw-vs-openclaw/
+ */
+import type { MetricCode } from "../aivss/types.js";
+import { type FrameworkRisk, type FrameworkCitation, type FrameworkAdapter } from "./registry.js";
+declare const NEMOCLAW_RESIDUAL_RISKS: FrameworkRisk[];
+declare module "./registry.js" {
+    interface FrameworkRisk {
+        containerTaxonomy?: {
+            layer: string;
+            exploitType: string;
+        };
+    }
+}
+export declare const NEMOCLAW_CITATION: FrameworkCitation;
+export declare const getRisksForMetric: (metric: MetricCode) => FrameworkRisk[];
+export declare const getRisksByType: (type: import("./registry.js").RiskType) => FrameworkRisk[];
+export declare const getRiskById: (id: string) => FrameworkRisk | undefined;
+export declare const NEMOCLAW_ADAPTER: FrameworkAdapter;
+export { NEMOCLAW_RESIDUAL_RISKS };
+//# sourceMappingURL=nemoclaw.d.ts.map

package/dist/references/nemoclaw.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nemoclaw.d.ts","sourceRoot":"","sources":["../../src/references/nemoclaw.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EAEtB,MAAM,eAAe,CAAC;AAIvB,QAAA,MAAM,uBAAuB,EAAE,aAAa,EA2F3C,CAAC;AAIF,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,aAAa;QACrB,iBAAiB,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAA;SAAE,CAAC;KAC5D;CACF;AAID,eAAO,MAAM,iBAAiB,EAAE,iBAO/B,CAAC;AAMF,eAAO,MAAM,iBAAiB,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,aAAa,EAA8B,CAAC;AACpG,eAAO,MAAM,cAAc,6DAAyB,CAAC;AACrD,eAAO,MAAM,WAAW,2CAAsB,CAAC;AAE/C,eAAO,MAAM,gBAAgB,EAAE,gBAM9B,CAAC;AAEF,OAAO,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/references/nemoclaw.js

@@ -0,0 +1,140 @@
+/**
+ * NeMo Claw — Security Isolation Layer Reference
+ *
+ * NeMo Claw is NVIDIA's enterprise security wrapper for OpenClaw. It places the
+ * agent inside a kernel-enforced sandbox (Landlock + seccomp + network namespaces)
+ * rather than applying application-layer guardrails. Security constraints live
+ * outside the agent process — they cannot be bypassed even if the agent is
+ * compromised.
+ *
+ * This adapter documents NeMo Claw's four isolation layers as FrameworkRisks —
+ * specifically, the *residual risks* that persist even with the sandbox active.
+ * It is used by Canopy to annotate which threats are mitigated vs. unchanged
+ * when comparing a baseline OpenClaw deployment to a NeMo Claw deployment.
+ *
+ * Architecture:
+ *   Layer 1 — Network:    allowlisted egress only (hot-reloadable YAML policy)
+ *   Layer 2 — Filesystem: agent restricted to /sandbox + /tmp; host FS read-only
+ *   Layer 3 — Process:    Landlock + seccomp block privilege escalation + dangerous syscalls
+ *   Layer 4 — Inference:  all model API calls routed through controlled backends
+ *
+ * Container taxonomy mapping (what NeMo Claw changes):
+ *   L4 Host:        largely mitigated by Layers 2 + 3 (Landlock, seccomp, network ns)
+ *   L3 Engine:      largely mitigated by Layer 3 (seccomp)
+ *   L2 Application: partially mitigated (Layer 1 network, Layer 4 inference routing)
+ *   L1 Orchestration: unchanged — cron and agent bindings operate inside the sandbox
+ *
+ * Key caveat: NeMo Claw is alpha/early-access. Ubuntu 22.04+ only. 8 GB RAM min.
+ *
+ * Reference: https://www.secondtalent.com/resources/nemoclaw-vs-openclaw/
+ */
+import { buildHelpers, } from "./registry.js";
+// ── RESIDUAL RISKS (what NeMo Claw does NOT fix) ─────────────────────────────
+const NEMOCLAW_RESIDUAL_RISKS = [
+    {
+        id: "nemoclaw-residual-prompt-injection",
+        framework: "nemoclaw",
+        category: "Residual — Application Layer",
+        name: "Prompt Injection Within Sandboxed Process",
+        description: "NeMo Claw's kernel-level sandbox confines the damage from a successful prompt injection, " +
+            "but does not prevent the injection itself. An attacker who injects a malicious instruction " +
+            "via an inbound channel can still cause the agent to execute unintended tool calls, " +
+            "exfiltrate data to allowlisted endpoints, or abuse skills that operate within /sandbox. " +
+            "The blast radius is reduced (no host FS access, egress filtered) but the attack vector " +
+            "remains fully open at L2 Application. MR and EI metrics are unchanged by the sandbox.",
+        riskType: "security",
+        aivssMetrics: ["MR", "EI"],
+        atlasTechniqueIds: ["AML.T0051"],
+        sourceSection: "NeMo Claw — Layer 2 Filesystem (residual)",
+        containerTaxonomy: { layer: "L2 Application", exploitType: "Prompt injection (contained)" },
+    },
+    {
+        id: "nemoclaw-residual-cron-persistence",
+        framework: "nemoclaw",
+        category: "Residual — Orchestration Layer",
+        name: "Autonomous Cron Execution Within Sandbox",
+        description: "Cron-based job execution operates entirely inside the sandbox boundary. A successful " +
+            "prompt injection that creates a cron job establishes persistence that survives conversation " +
+            "resets and executes autonomously — the sandbox does not prevent this. The persistence " +
+            "mechanism remains intact; only the escape path (host FS, network exfiltration beyond " +
+            "allowlist) is blocked. The AA metric (Agentic Autonomy) risk is unchanged.",
+        riskType: "security",
+        aivssMetrics: ["AA"],
+        atlasTechniqueIds: ["AML.T0080"],
+        sourceSection: "NeMo Claw — L1 Orchestration (unchanged)",
+        containerTaxonomy: { layer: "L1 Orchestration", exploitType: "Scheduled task persistence" },
+    },
+    {
+        id: "nemoclaw-residual-alpha-stability",
+        framework: "nemoclaw",
+        category: "Residual — Deployment Risk",
+        name: "Alpha-Stage Deployment Maturity",
+        description: "NeMo Claw is alpha/early-access software. The security properties of the four isolation " +
+            "layers have not been independently audited at production scale. Organisations relying on " +
+            "NeMo Claw as their primary security control should treat the isolation guarantees as " +
+            "best-effort until a stable release with published CVE history is available. " +
+            "Ubuntu 22.04+ requirement also limits deployment flexibility. The GV metric " +
+            "(Governance) must account for this maturity gap.",
+        riskType: "compliance",
+        aivssMetrics: ["GV", "DC"],
+        atlasTechniqueIds: [],
+        sourceSection: "NeMo Claw — Deployment maturity (alpha)",
+        containerTaxonomy: { layer: "L2 Application", exploitType: "Immature security control" },
+    },
+    // ── MITIGATIONS (what NeMo Claw DOES fix — documented for completeness) ────
+    {
+        id: "nemoclaw-mitigated-supply-chain",
+        framework: "nemoclaw",
+        category: "Mitigated — Filesystem Isolation",
+        name: "Malicious Skill Exfiltration Path Broken",
+        description: "NeMo Claw's Layer 2 filesystem isolation restricts all skill execution to /sandbox and /tmp. " +
+            "A malicious skill cannot read host credentials, cannot write to persistent storage outside " +
+            "the sandbox, and cannot reach unapproved network endpoints. The 900-malicious-package " +
+            "OpenClaw registry incident (early 2026) would have had significantly reduced impact " +
+            "under NeMo Claw — skills could not escape their confined environment regardless of payload.",
+        riskType: "security",
+        aivssMetrics: ["CS", "DC"],
+        atlasTechniqueIds: ["AML.T0010"],
+        sourceSection: "NeMo Claw — Layer 2 Filesystem + Layer 1 Network",
+        containerTaxonomy: { layer: "L2 Application", exploitType: "Supply chain (blast radius reduced)" },
+    },
+    {
+        id: "nemoclaw-mitigated-credential-theft",
+        framework: "nemoclaw",
+        category: "Mitigated — Host Filesystem",
+        name: "Host Credential Access Blocked",
+        description: "Without NeMo Claw, skill API keys and channel tokens in openclaw.json are accessible to " +
+            "any process with device access. NeMo Claw's Layer 2 isolation makes the host filesystem " +
+            "read-only outside /sandbox — a compromised skill or injected agent action cannot read " +
+            "openclaw.json or other host credential stores. This directly mitigates the container taxonomy L4 " +
+            "Host credential theft vector.",
+        riskType: "security",
+        aivssMetrics: ["DC", "CS"],
+        atlasTechniqueIds: ["AML.T0044"],
+        sourceSection: "NeMo Claw — Layer 2 Filesystem",
+        containerTaxonomy: { layer: "L4 Host", exploitType: "Credential theft (mitigated)" },
+    },
+];
+// ── Citation ──────────────────────────────────────────────────────────────────
+export const NEMOCLAW_CITATION = {
+    id: "nemoclaw",
+    title: "NeMo Claw: Security Wrapper for OpenClaw",
+    authors: ["Second Talent"],
+    url: "https://www.secondtalent.com/resources/nemoclaw-vs-openclaw/",
+    version: "alpha-2026",
+    year: 2026,
+};
+// ── Adapter ───────────────────────────────────────────────────────────────────
+const helpers = buildHelpers(NEMOCLAW_RESIDUAL_RISKS);
+export const getRisksForMetric = helpers.getRisksForMetric;
+export const getRisksByType = helpers.getRisksByType;
+export const getRiskById = helpers.getRiskById;
+export const NEMOCLAW_ADAPTER = {
+    citation: NEMOCLAW_CITATION,
+    risks: NEMOCLAW_RESIDUAL_RISKS,
+    getRisksForMetric: helpers.getRisksForMetric,
+    getRisksByType: helpers.getRisksByType,
+    getRiskById: helpers.getRiskById,
+};
+export { NEMOCLAW_RESIDUAL_RISKS };
+//# sourceMappingURL=nemoclaw.js.map