@wowok/agent-mcp 2.4.1 → 2.4.3

package/dist/knowledge/guard-risk.js

@@ -1,3 +1,4 @@
+import { GUARDQUERY } from "@wowok/wowok";
 function rootStr(ctx) {
     return JSON.stringify(ctx.root).toLowerCase();
 }
@@ -31,6 +32,415 @@ function extractWitnessCodes(root) {
     }
     return codes;
 }
+const WITNESS_CHAIN = {
+    100: ["Order", "Progress"],
+    101: ["Order", "Machine"],
+    102: ["Order", "Service"],
+    103: ["Progress", "Machine"],
+    104: ["Arb", "Order"],
+    105: ["Arb", "Arbitration"],
+    106: ["Arb", "Order", "Progress"],
+    107: ["Arb", "Order", "Service"],
+    108: ["Arb", "Order", "Machine"],
+};
+function extractWitnessIdentifierPairs(root) {
+    const pairs = [];
+    const visited = new WeakSet();
+    function walk(node) {
+        if (node === null || typeof node !== "object")
+            return;
+        if (visited.has(node))
+            return;
+        visited.add(node);
+        if (typeof node.convert_witness === "number" &&
+            typeof node.identifier === "number") {
+            pairs.push({ code: node.convert_witness, identifier: node.identifier });
+        }
+        for (const key of Object.keys(node)) {
+            const child = node[key];
+            if (Array.isArray(child)) {
+                for (const item of child)
+                    walk(item);
+            }
+            else if (child !== null && typeof child === "object") {
+                walk(child);
+            }
+        }
+    }
+    walk(root);
+    return pairs;
+}
+function getChildNodes(node) {
+    if (!node || typeof node !== "object")
+        return [];
+    const children = [];
+    if (Array.isArray(node.nodes))
+        children.push(...node.nodes);
+    if (node.left)
+        children.push(node.left);
+    if (node.right)
+        children.push(node.right);
+    if (node.vec)
+        children.push(node.vec);
+    if (node.target)
+        children.push(node.target);
+    if (node.object && typeof node.object === "object")
+        children.push(node.object);
+    if (Array.isArray(node.parameters))
+        children.push(...node.parameters);
+    return children.filter((c) => c && typeof c === "object");
+}
+function findSignerLogicEqualNodes(root) {
+    const results = [];
+    function walk(node, parentType) {
+        if (!node || typeof node !== "object")
+            return;
+        if (node.type === "logic_equal") {
+            const operands = Array.isArray(node.nodes)
+                ? node.nodes
+                : node.left && node.right
+                    ? [node.left, node.right]
+                    : [];
+            if (operands.length === 2) {
+                const signerIdx = operands.findIndex((op) => op?.type === "context" && op?.context === "Signer");
+                if (signerIdx >= 0) {
+                    results.push({
+                        node,
+                        parentType,
+                        otherOperand: operands[1 - signerIdx],
+                    });
+                }
+            }
+        }
+        for (const child of getChildNodes(node)) {
+            walk(child, node.type);
+        }
+    }
+    walk(root, null);
+    return results;
+}
+function detectLevel1StrictBinding(root, table) {
+    const signerChecks = findSignerLogicEqualNodes(root);
+    for (const check of signerChecks) {
+        const other = check.otherOperand;
+        if (other?.type === "identifier") {
+            const entry = table.find((e) => e.identifier === other.identifier);
+            if (entry &&
+                !entry.b_submission &&
+                entry.value_type === "Address" &&
+                typeof entry.value === "string" &&
+                entry.value.length > 0) {
+                return {
+                    detected: true,
+                    entry: {
+                        identifier: entry.identifier,
+                        value: entry.value,
+                        name: entry.name,
+                    },
+                };
+            }
+        }
+    }
+    return { detected: false };
+}
+function isSignerCheckInLogicOr(root) {
+    const signerChecks = findSignerLogicEqualNodes(root);
+    return signerChecks.some((check) => check.parentType === "logic_or");
+}
+const QUERY_INVARIANT_MAP = (() => {
+    const map = new Map();
+    for (const q of GUARDQUERY) {
+        if (q.invariant !== undefined) {
+            map.set(q.id, q.invariant);
+        }
+    }
+    return map;
+})();
+function extractQueryIds(root) {
+    const ids = [];
+    const str = JSON.stringify(root);
+    const numMatches = str.matchAll(/"query"\s*:\s*(\d+)/g);
+    for (const m of numMatches) {
+        const id = parseInt(m[1], 10);
+        if (!ids.includes(id))
+            ids.push(id);
+    }
+    const nameMatches = str.matchAll(/"query"\s*:\s*"([^"]+)"/g);
+    for (const m of nameMatches) {
+        const name = m[1];
+        const entry = GUARDQUERY.find((q) => q.name === name);
+        if (entry && !ids.includes(entry.id))
+            ids.push(entry.id);
+    }
+    return ids;
+}
+function getQueryInvariant(queryId) {
+    return QUERY_INVARIANT_MAP.get(queryId);
+}
+function rootHasNonZeroQuery(root) {
+    const ids = extractQueryIds(root);
+    return ids.some((id) => QUERY_INVARIANT_MAP.has(id));
+}
+function rootAllQueriesNonZero(root) {
+    const ids = extractQueryIds(root);
+    if (ids.length === 0)
+        return false;
+    return ids.every((id) => QUERY_INVARIANT_MAP.has(id));
+}
+const REENTRANCY_SPECS = [
+    {
+        sceneId: "reward_guard",
+        level: "critical",
+        existsPrimitives: [1613],
+        countPrimitives: [1612],
+        addressPrimitives: [1626],
+        rationale: "Guard pass distributes reward funds to the Claimant AND creates a reward_record, but the Guard conditions (identity, time, node state) do NOT naturally invalidate after a claim. " +
+            "Without an explicit anti-reentrancy primitive, the same Claimant can repeatedly pass the Guard and DRAIN THE ENTIRE POOL. " +
+            "This is the most severe reentrancy scene — direct fund loss.",
+        mitigation: "Add ONE of the following to the root (wrapped in logic_and with existing conditions):\n" +
+            "  - logic_not(query('reward.record has', object=reward, parameters=[claimant_address])) — RECOMMENDED (per-user Bool check)\n" +
+            "  - logic_equal([query('reward.record count', object=reward), identifier(N)]) where table[N].value=0 — total-claim count is 0\n" +
+            "  - logic_not(query('reward.record.find_first', object=reward, where={...})) — no matching record found\n" +
+            "Reference template: MyShop_Advanced Guard 7 condition 4 (logic_not(query_reward_record_exists(where.storeFromId=order_id)))",
+    },
+    {
+        sceneId: "arbitration_voting_guard",
+        level: "critical",
+        existsPrimitives: [1404, 1406],
+        countPrimitives: [1405],
+        addressPrimitives: [],
+        rationale: "Guard pass counts the vote with the extracted weight. Without anti-reentrancy, the same voter can vote MULTIPLE times, " +
+            "multiplying their weight and skewing the arbitration result — which directly determines fund ownership via compensation. " +
+            "The voter's eligibility (identity, reputation) does NOT naturally invalidate after voting. " +
+            "Note: arb.voted_count (1403) is total voter count (NOT per-voter) and does NOT serve as an anti-reentrancy primitive for an individual voter.",
+        mitigation: "Add ONE of the following to the root (wrapped in logic_and):\n" +
+            "  - logic_not(query('arb.voted has', object=arb, parameters=[voter_address])) — RECOMMENDED (per-voter Bool)\n" +
+            "  - logic_not(query('arb.voted.agree has', object=arb, parameters=[voter_address, proposition_index])) — per-voter-per-proposition\n" +
+            "  - logic_equal([query('arb.voted.agree count', object=arb, parameters=[voter_address]), identifier(N)]) where table[N].value=0",
+    },
+    {
+        sceneId: "arbitration_usage_guard",
+        level: "high",
+        existsPrimitives: [1565],
+        countPrimitives: [1564],
+        addressPrimitives: [],
+        rationale: "Guard pass creates a new Arb case. Without anti-reentrancy, a customer can create multiple Arb cases for the SAME Order " +
+            "(up to MAX_DISPUTE_COUNT=10 per order.move L96), harassing the counterparty and inflating arbitration system load. " +
+            "Not direct fund loss, but severe system abuse. order::dispute (order.move L93-99) deduplicates by Arb address but does NOT prevent multiple distinct Arbs.",
+        mitigation: "Add ONE of the following to the root (wrapped in logic_and):\n" +
+            "  - logic_not(query('order.dispute has', object=order, parameters=[existing_arb_address])) — per-Arb check\n" +
+            "  - logic_equal([query('order.dispute count', object=order), identifier(N)]) where table[N].value=0 — STRICT: block any prior dispute\n" +
+            "  - logic_as_u256_less_or_equal([query('order.dispute count', object=order), identifier(N)]) where table[N].value=K — LENIENT: allow up to K disputes",
+    },
+    {
+        sceneId: "service_order_allocators_guard",
+        level: "info",
+        existsPrimitives: [1568],
+        countPrimitives: [],
+        addressPrimitives: [1569],
+        rationale: "Protocol-level protection: order::on_allocation (order.move L116-119) asserts ONE Allocation per Order (E_ALLOCATION_ALREADY_SPECIFIED). " +
+            "After alloc() executes, typical Rate-mode allocators (sum=10000) and Surplus-mode allocators drain balance to 0, making reentrancy unprofitable. " +
+            "EDGE CASE: Amount-mode-only allocators (no Surplus, total < full balance) leave remainder; a second alloc() could extract more — mitigated by preferring Rate/Surplus modes. " +
+            "External deposit via receive() is possible but irrational (attacker funds the Allocation they attack).",
+        mitigation: "Default: no action needed (protocol-level guard). IF using Amount-mode-only allocators without Surplus: " +
+            "consider adding logic_not(query('order.allocation some', object=order)) OR switch to Rate/Surplus mode to drain balance completely.",
+    },
+    {
+        sceneId: "service_buy_guard",
+        level: "info",
+        existsPrimitives: [],
+        countPrimitives: [],
+        addressPrimitives: [],
+        rationale: "Each purchase creates a fresh Order; no existing Order state is modified. Default: no reentrancy risk. " +
+            "IF business intent is 'limit one purchase per user' (limited-edition goods, whitelist single-buy), an anti-reentrancy check is REQUIRED " +
+            "but no direct GUARDQUERY primitive exists for per-user purchase history.",
+        mitigation: "IF limit-purchase intent: record purchases in a Repository and add logic_not(query('repository.data has', ...)) to root; " +
+            "OR revoke EntityRegistrar membership after first buy; OR use an off-chain allowlist with on-chain Merkle proof.",
+    },
+    {
+        sceneId: "repository_write_guard",
+        level: "info",
+        existsPrimitives: [1166],
+        countPrimitives: [],
+        addressPrimitives: [],
+        rationale: "Default writes are idempotent (same ID overwrites, different ID appends); no fund flow. " +
+            "IF business intent is 'one write per ID' (voting, immutable credential, single-attestation), an anti-reentrancy check is needed.",
+        mitigation: "IF one-write-per-ID intent: add logic_not(query('repository.data has', object=repository, parameters=[policy_name, user_or_object_id])) to root.",
+    },
+    {
+        sceneId: "gen_passport_guard",
+        level: "info",
+        existsPrimitives: [],
+        countPrimitives: [],
+        addressPrimitives: [],
+        rationale: "Each gen_passport call generates an independent Passport (one Passport per operation). " +
+            "Multiple Passports for the same user are usually valid (each serves a different subsequent operation). " +
+            "IF business intent is 'one active Passport per user', an anti-reentrancy check is needed but no direct GUARDQUERY primitive exists.",
+        mitigation: "IF one-passport-per-user intent: use off-chain tracking or a Repository to record issued Passport IDs.",
+    },
+];
+const QUERY_TYPE_ALIASES = new Map([
+    ["query_reward_record_exists", 1613],
+    ["query_reward_record_count", 1612],
+    ["query_reward_record_find", 1626],
+    ["query_progress_history_find", 1274],
+    ["query_progress_history_session_find", 1275],
+    ["query_progress_history_session_forward_find", 1276],
+    ["query_progress_history_session_count", 1273],
+    ["query_progress_history_session_forward_count", 1262],
+]);
+function detectReentrancyProtection(root, table, spec) {
+    const allPrimitives = new Set([
+        ...spec.existsPrimitives,
+        ...spec.countPrimitives,
+        ...spec.addressPrimitives,
+    ]);
+    if (allPrimitives.size === 0) {
+        return {
+            state: "absent",
+            evidence: "No anti-reentrancy primitive available in GUARDQUERY for this scene",
+        };
+    }
+    const idToName = new Map();
+    const nameToId = new Map();
+    for (const id of allPrimitives) {
+        const entry = GUARDQUERY.find((q) => q.id === id);
+        if (entry) {
+            idToName.set(id, entry.name);
+            nameToId.set(entry.name, id);
+        }
+    }
+    const primitiveNames = Array.from(nameToId.keys());
+    function resolvePrimitiveId(node) {
+        if (!node || typeof node !== "object")
+            return -1;
+        if (typeof node.query === "number" && allPrimitives.has(node.query)) {
+            return node.query;
+        }
+        if (typeof node.query === "string" && nameToId.has(node.query)) {
+            return nameToId.get(node.query);
+        }
+        if (typeof node.type === "string" && QUERY_TYPE_ALIASES.has(node.type)) {
+            const aliasId = QUERY_TYPE_ALIASES.get(node.type);
+            if (allPrimitives.has(aliasId)) {
+                return aliasId;
+            }
+        }
+        if (typeof node.type === "string" && nameToId.has(node.type)) {
+            return nameToId.get(node.type);
+        }
+        return -1;
+    }
+    function isZeroValue(node) {
+        if (!node || typeof node !== "object")
+            return false;
+        if (typeof node.type === "string" &&
+            ["number", "u8", "u16", "u32", "u64", "u128", "u256"].includes(node.type)) {
+            return node.value === 0 || node.value === "0" || node.value === 0n;
+        }
+        if (node.type === "identifier" && typeof node.identifier === "number") {
+            const entry = table.find((e) => e.identifier === node.identifier);
+            if (entry && !entry.b_submission) {
+                return entry.value === 0 || entry.value === "0" || entry.value === 0n;
+            }
+        }
+        return false;
+    }
+    function getSiblings(parent, child) {
+        if (!parent || typeof parent !== "object")
+            return [];
+        const siblings = [];
+        if (Array.isArray(parent.nodes)) {
+            for (const n of parent.nodes) {
+                if (n !== child)
+                    siblings.push(n);
+            }
+        }
+        if (parent.left && parent.left !== child)
+            siblings.push(parent.left);
+        if (parent.right && parent.right !== child)
+            siblings.push(parent.right);
+        return siblings.filter((s) => s && typeof s === "object");
+    }
+    let foundPrimitive = false;
+    let foundProtected = false;
+    let pseudoEvidence = "";
+    let foundPrimitiveName = "";
+    function walk(node, parent) {
+        if (!node || typeof node !== "object")
+            return;
+        const primId = resolvePrimitiveId(node);
+        if (primId >= 0) {
+            foundPrimitive = true;
+            const primName = idToName.get(primId) ?? `query_${primId}`;
+            foundPrimitiveName = primName;
+            const parentType = parent?.type ?? null;
+            let properlyWrapped = false;
+            const isExistsStyle = spec.existsPrimitives.includes(primId);
+            const isAddressStyle = spec.addressPrimitives.includes(primId);
+            const isCountStyle = spec.countPrimitives.includes(primId);
+            if ((isExistsStyle || isAddressStyle) && parentType === "logic_not") {
+                properlyWrapped = true;
+            }
+            if (isCountStyle && parentType === "logic_equal") {
+                const siblings = getSiblings(parent, node);
+                if (siblings.some((sib) => isZeroValue(sib))) {
+                    properlyWrapped = true;
+                }
+            }
+            if (properlyWrapped) {
+                foundProtected = true;
+            }
+            else if (!pseudoEvidence) {
+                const expected = isCountStyle
+                    ? "logic_equal with a zero operand"
+                    : "logic_not";
+                pseudoEvidence = `Primitive "${primName}" found but its immediate parent is ${parentType ?? "root"} (expected ${expected}). The primitive is present but does NOT actually prevent reentrancy — this is a false sense of security.`;
+            }
+        }
+        const children = [];
+        if (Array.isArray(node.nodes))
+            children.push(...node.nodes);
+        if (node.left)
+            children.push(node.left);
+        if (node.right)
+            children.push(node.right);
+        if (node.node)
+            children.push(node.node);
+        if (node.vec)
+            children.push(node.vec);
+        if (node.target)
+            children.push(node.target);
+        if (node.object && typeof node.object === "object")
+            children.push(node.object);
+        if (Array.isArray(node.parameters))
+            children.push(...node.parameters);
+        for (const child of children) {
+            if (child && typeof child === "object") {
+                walk(child, node);
+            }
+        }
+    }
+    walk(root, null);
+    if (foundProtected) {
+        return {
+            state: "protected",
+            evidence: `Anti-reentrancy primitive "${foundPrimitiveName}" is properly wrapped`,
+            foundPrimitiveName,
+        };
+    }
+    if (foundPrimitive) {
+        return {
+            state: "pseudo",
+            evidence: pseudoEvidence,
+            foundPrimitiveName,
+        };
+    }
+    return {
+        state: "absent",
+        evidence: `No anti-reentrancy primitive found in root. Expected one of: ${primitiveNames.join(", ")}`,
+    };
+}
 const RISK_RULES = [
     {
         id: "R-C1-01",
@@ -156,57 +566,74 @@ const RISK_RULES = [
     {
         id: "R-C2-02",
         data_source_class: "type2_witness_derived",
-        trigger: "Guard uses witness but source object's object_type may not match the witness source type",
+        trigger: "Guard uses witness but source object's object_type may not match the witness source type, or multi-hop chain has missing intermediate objects",
         check: (ctx) => {
-            const codes = extractWitnessCodes(ctx.root);
-            if (codes.length === 0)
+            const pairs = extractWitnessIdentifierPairs(ctx.root);
+            const validPairs = pairs.filter((p) => p.code >= 100 && p.code <= 108);
+            if (validPairs.length === 0)
                 return null;
-            const witnessSourceTypes = {
-                100: "Order", 101: "Order", 102: "Order",
-                103: "Progress",
-                104: "Arb", 105: "Arb", 106: "Arb", 107: "Arb", 108: "Arb",
-            };
-            const rootStr = JSON.stringify(ctx.root);
-            const mismatches = [];
-            for (const code of codes) {
-                const expectedSource = witnessSourceTypes[code];
-                if (!expectedSource)
+            const hardMismatches = [];
+            const missingAnnotations = [];
+            for (const { code, identifier } of validPairs) {
+                const chain = WITNESS_CHAIN[code];
+                if (!chain)
                     continue;
-                const pattern1 = new RegExp(`"identifier"\\s*:\\s*(\\d+)\\s*,\\s*"convert_witness"\\s*:\\s*${code}`, "g");
-                const pattern2 = new RegExp(`"convert_witness"\\s*:\\s*${code}\\s*,\\s*"identifier"\\s*:\\s*(\\d+)`, "g");
-                const foundIds = new Set();
-                let m;
-                while ((m = pattern1.exec(rootStr)) !== null) {
-                    foundIds.add(parseInt(m[1], 10));
+                const expectedSource = chain[0];
+                const entry = ctx.table.find((e) => e.identifier === identifier);
+                if (!entry)
+                    continue;
+                const chainStr = `${code} (${chain.join("→")})`;
+                if (entry.object_type) {
+                    if (entry.object_type !== expectedSource) {
+                        hardMismatches.push(`witness ${chainStr} references #${identifier} ` +
+                            `but object_type=${entry.object_type} (expected ${expectedSource})`);
+                    }
                 }
-                while ((m = pattern2.exec(rootStr)) !== null) {
-                    foundIds.add(parseInt(m[1], 10));
+                else {
+                    missingAnnotations.push(`witness ${chainStr} references #${identifier} ` +
+                        `but object_type is not set (expected ${expectedSource})`);
                 }
-                for (const id of foundIds) {
-                    const entry = ctx.table.find((e) => e.identifier === id);
-                    if (entry?.object_type && entry.object_type !== expectedSource) {
-                        mismatches.push(`witness ${code}(${expectedSource}→?) references #${id} object_type=${entry.object_type}`);
+                if (chain.length === 3) {
+                    const intermediateType = chain[1];
+                    const hasIntermediate = ctx.table.some((e) => e.object_type === intermediateType);
+                    if (!hasIntermediate) {
+                        missingAnnotations.push(`witness ${chainStr} multi-hop chain expects intermediate ` +
+                            `${intermediateType} in table, but no entry with object_type=${intermediateType} found`);
                     }
                 }
             }
-            if (mismatches.length === 0)
+            const totalIssues = hardMismatches.length + missingAnnotations.length;
+            if (totalIssues === 0)
                 return null;
+            const level = hardMismatches.length > 0 ? "medium" : "low";
+            const evidenceParts = [
+                ...hardMismatches,
+                ...missingAnnotations,
+            ];
             return {
                 id: "R-C2-02",
                 data_source_class: "type2_witness_derived",
-                level: "low",
+                level,
                 category: "data_source_trust",
-                title: "witness source object object_type may not match the witness source type",
-                description: "Guard uses witness derivation, but the source object's object_type in table is inconsistent with the witness expected source type.\n" +
-                    mismatches.map((mm) => `  - ${mm}`).join("\n") +
-                    "\nNote: object_type is an auxiliary annotation field on table entries; it is not strictly validated at on-chain creation." +
-                    "However, wrong annotations cause semantic misunderstanding and maintenance difficulty.",
+                title: hardMismatches.length > 0
+                    ? "witness source object_type explicitly contradicts the witness derivation chain"
+                    : "witness source object_type annotation missing or multi-hop chain incomplete",
+                description: "Guard uses witness derivation, but the source object's object_type in table is either " +
+                    "inconsistent with the witness expected source type, or the annotation is missing " +
+                    "(preventing validation), or the multi-hop chain lacks an intermediate object.\n" +
+                    evidenceParts.map((e) => `  - ${e}`).join("\n") +
+                    "\nNote: object_type is an auxiliary annotation field on table entries; it is not strictly " +
+                    "validated at on-chain creation. However, wrong or missing annotations cause semantic " +
+                    "misunderstanding and maintenance difficulty, and may indicate a deeper structural mismatch.",
                 affected_stakeholders: ["provider"],
-                scenario: "Type annotation mismatch: witness source type annotation is wrong, causing semantic confusion",
-                mitigation: "1) Fix the table entry's object_type field to match the witness source type;" +
-                    "2) witness 100-102 source type is Order; 103 is Progress; 104-108 is Arb;" +
-                    "3) Use wowok_buildin_info(info='guard instructions') to query the full witness definition",
-                evidence: mismatches.join("; "),
+                scenario: hardMismatches.length > 0
+                    ? "Type annotation mismatch: witness source type annotation is wrong, causing semantic confusion"
+                    : "Type annotation missing: witness source type cannot be validated, raising maintenance risk",
+                mitigation: "1) Set or fix the table entry's object_type field to match the witness source type;\n" +
+                    "2) witness 100-102 source type is Order; 103 is Progress; 104-108 is Arb;\n" +
+                    "3) For multi-hop witnesses (106-108), ensure the intermediate Order object is also in the table;\n" +
+                    "4) Use wowok_buildin_info(info='guard instructions') to query the full witness definition",
+                evidence: evidenceParts.join("; "),
             };
         },
     },
@@ -290,6 +717,12 @@ const RISK_RULES = [
                 return null;
             if (ctx.scene?.binding_field === "voting_guard")
                 return null;
+            if (ctx.scene?.id === "service_order_allocators_guard" &&
+                ctx.sharing_recipients &&
+                ctx.sharing_recipients.length > 0 &&
+                !ctx.sharing_recipients.includes("Signer")) {
+                return null;
+            }
             if (!hasSignerCheck(ctx)) {
                 if (ctx.scene?.id === "machine_forward_guard") {
                     return {
@@ -436,6 +869,170 @@ const RISK_RULES = [
             };
         },
     },
+    {
+        id: "R-C3-05",
+        data_source_class: "type3_submitted_object",
+        trigger: "Guard accepts a runtime-submitted Order/Progress/Arb object (Type3) but does NOT verify the submitted object belongs to the current project (Machine or Service). " +
+            "The WoWok runtime does NOT enforce any binding between the submitted order_id and the actual Progress being forwarded — verify_guard receives only the caller-provided submission bytes, never the Progress object under advancement (passport.move:27,251-253; progress.move:458-483). " +
+            "A caller can therefore submit an unrelated order_id from a DIFFERENT project while forwarding a different Progress, causing witness=100 (Order->Progress) to evaluate against foreign data.",
+        check: (ctx) => {
+            const submittedAddrs = ctx.table.filter((e) => e.b_submission && e.value_type === "Address");
+            if (submittedAddrs.length === 0)
+                return null;
+            const witnessCodes = extractWitnessCodes(ctx.root);
+            const hasOrderWitness = witnessCodes.some((c) => [100, 101, 102].includes(c));
+            const hasProgressWitness = witnessCodes.some((c) => [103].includes(c));
+            const hasArbWitness = witnessCodes.some((c) => [104, 105, 106, 107, 108].includes(c));
+            const submittedOrders = submittedAddrs.filter((e) => e.object_type === "Order" || (hasOrderWitness && !e.object_type));
+            const submittedProgress = submittedAddrs.filter((e) => e.object_type === "Progress" || (hasProgressWitness && !e.object_type));
+            const submittedArbs = submittedAddrs.filter((e) => e.object_type === "Arb" || (hasArbWitness && !e.object_type));
+            const hasProjectRelevantSubmission = submittedOrders.length > 0 ||
+                submittedProgress.length > 0 ||
+                submittedArbs.length > 0;
+            if (!hasProjectRelevantSubmission)
+                return null;
+            const affectedSceneIds = [
+                "machine_forward_guard",
+                "service_order_allocators_guard",
+                "arbitration_usage_guard",
+                "arbitration_voting_guard",
+                "reward_guard",
+                "progress_submission_guard",
+            ];
+            const sceneId = ctx.scene?.id;
+            const isAffectedScene = !sceneId || affectedSceneIds.includes(sceneId);
+            if (!isAffectedScene)
+                return null;
+            const PROJECT_BINDING_QUERY_IDS = new Set([1563, 1560, 1250, 1402, 1401]);
+            const rootQueryIds = extractQueryIds(ctx.root);
+            const hasProjectBinding = rootQueryIds.some((id) => PROJECT_BINDING_QUERY_IDS.has(id));
+            if (hasProjectBinding)
+                return null;
+            const criticalScenes = new Set([
+                "machine_forward_guard",
+                "service_order_allocators_guard",
+            ]);
+            const level = sceneId && criticalScenes.has(sceneId)
+                ? "critical"
+                : "high";
+            const unboundEntries = [];
+            for (const e of submittedOrders) {
+                unboundEntries.push(`#${e.identifier}${e.object_type ? "(Order)" : "(inferred Order via witness 100-102)"}`);
+            }
+            for (const e of submittedProgress) {
+                unboundEntries.push(`#${e.identifier}${e.object_type ? "(Progress)" : "(inferred Progress via witness 103)"}`);
+            }
+            for (const e of submittedArbs) {
+                unboundEntries.push(`#${e.identifier}${e.object_type ? "(Arb)" : "(inferred Arb via witness 104-108)"}`);
+            }
+            const sceneLabel = sceneId ?? "unknown scene (conservative flag)";
+            return {
+                id: "R-C3-05",
+                data_source_class: "type3_submitted_object",
+                level,
+                category: "submission_forgery",
+                title: "Submitted Order/Progress/Arb is NOT verified to belong to the current project (cross-project bypass — CRITICAL trust-boundary gap)",
+                description: `Guard accepts runtime-submitted Order/Progress/Arb object(s) [${unboundEntries.join(", ")}] but the root does NOT verify the submitted object belongs to the current project (no query of order.service/order.machine/progress.machine/arb.service compared to a project constant).\n\n` +
+                    "TRUST-BOUNDARY GAP (verified via Move source):\n" +
+                    "  - The Passport submission is built by the CALLER, not auto-injected by the runtime (passport.move:120,149,157)\n" +
+                    "  - verify_guard receives ONLY the caller-provided submission bytes — it never sees the Progress/Order actually being forwarded (passport.move:27,251-253)\n" +
+                    "  - next_with_passport performs NO linkage check between the passport submission and the Progress under advancement (progress.move:458-483)\n" +
+                    "  - Even order_next_with_passport's E_ORDER_NOT_MATCH only checks the separate `order:&Order` parameter, NOT the order_id embedded in the passport submission (progress.move:452)\n\n" +
+                    `EXPLOIT (scene=${sceneLabel}):\n` +
+                    "  1. Attacker holds Order Y from project B (where progress.current_time is old enough to pass the time-lock)\n" +
+                    "  2. Attacker calls forward on Order X's Progress (project A, freshly entered the node)\n" +
+                    "  3. Attacker submits Order Y's ID in the passport (lying about which order is being forwarded)\n" +
+                    "  4. Guard's witness=100 reads Order Y's Progress -> time-lock passes (Order Y is old)\n" +
+                    "  5. forward actually executes on Order X's Progress -> TIME-LOCK BYPASSED\n\n" +
+                    "This is distinct from R-C3-01 (Signer binding — WHO can submit) and R-C3-03 (type matching — WHAT type is submitted). " +
+                    "R-C3-05 addresses WHETHER the submitted object belongs to the current project — a third orthogonal axis of submission trust. " +
+                    "Even with R-C3-01 satisfied (authorized Signer) and R-C3-03 satisfied (correct type), the Signer can still submit an unrelated project's object.",
+                affected_stakeholders: ["customer", "provider", "arbitrator"],
+                scenario: "Cross-project bypass: authorized signer submits an unrelated project's order/progress/arb to bypass time-lock, status, or allocation conditions",
+                mitigation: "Add a project-binding check to the root (wrap existing root in logic_and):\n" +
+                    "  - For submitted Order: add logic_equal[query(1563: order.service), identifier[N](project_service_address)] — RECOMMENDED (service is the canonical project anchor)\n" +
+                    "  - For submitted Order: add logic_equal[query(1560: order.machine), identifier[N](project_machine_address)] — alternative (machine anchor)\n" +
+                    "  - For submitted Progress: add logic_equal[query(1250: progress.machine), identifier[N](project_machine_address)]\n" +
+                    "  - For submitted Arb: add logic_equal[query(1402: arb.service), identifier[N](project_service_address)]\n" +
+                    "  - Use witness=102 (TypeOrderService) on the submitted Order to derive the Service, then compare to the project service constant\n\n" +
+                    "Intentional cross-project exception: if the Guard is DESIGNED to accept cross-project submissions (rare), document this explicitly in the description and add a binding_hint annotation 'cross_project_intentional:true' to suppress this rule.",
+                evidence: `Unbound submitted project-relevant entries: ${unboundEntries.join(", ")}. ` +
+                    `Scene: ${sceneLabel}. ` +
+                    `Missing project-binding queries: none of [1563(order.service), 1560(order.machine), 1250(progress.machine), 1402(arb.service)] present in root.`,
+            };
+        },
+    },
+    {
+        id: "R-C3-06",
+        data_source_class: "type3_submitted_object",
+        trigger: "Guard is bound to Service order_allocators (service_order_allocators_guard scene). " +
+            "In this scene the Guard decides IF allocation happens, while sharing.who decides WHERE funds go. " +
+            "If sharing.who=Signer, the transaction caller receives the funds — so a Guard that does NOT bind " +
+            "context(Signer) lets ANYONE who passes the Guard steal 100% of the order funds. " +
+            "This is a Guard+sharing coupling risk: neither piece alone reveals the theft — only their combination.",
+        check: (ctx) => {
+            if (ctx.scene?.id !== "service_order_allocators_guard")
+                return null;
+            if (hasSignerCheck(ctx))
+                return null;
+            const recipients = ctx.sharing_recipients;
+            const sharingProvided = recipients !== undefined && recipients.length > 0;
+            const hasSignerSharing = sharingProvided && recipients.includes("Signer");
+            if (sharingProvided && !hasSignerSharing)
+                return null;
+            const level = hasSignerSharing ? "critical" : "medium";
+            const recipientsLabel = sharingProvided
+                ? `[${recipients.join(", ")}]`
+                : "(not provided — conservative flag)";
+            const titleSuffix = hasSignerSharing
+                ? "sharing.who=Signer confirmed — anyone can steal 100% of funds"
+                : "if sharing.who=Signer, anyone can steal 100% of funds";
+            return {
+                id: "R-C3-06",
+                data_source_class: "type3_submitted_object",
+                level,
+                category: "binding_risk",
+                title: `allocators Guard without Signer binding — ${titleSuffix}`,
+                description: `Guard is bound to Service order_allocators but does NOT verify context(Signer). ` +
+                    `In the allocators scene, sharing.who determines the fund recipient:\n` +
+                    `  - sharing.who=Signer → funds flow to the CALLER (transaction signer)\n` +
+                    `  - sharing.who=Entity → funds flow to a FIXED address (Treasury/personal)\n` +
+                    `  - sharing.who=GuardIdentifier → funds flow to a Guard-table-derived address\n\n` +
+                    `When sharing.who=Signer and the Guard does not bind Signer, ANY caller who passes the Guard ` +
+                    `receives the order funds — a direct theft. Even an authorized caller is unnecessary: the attacker ` +
+                    `only needs to pass the Guard's condition (e.g. submit any completed order_id), then the funds go to ` +
+                    `their own address.\n\n` +
+                    `This is distinct from R-C3-01 (generic Signer binding) and R-C3-05 (cross-project bypass). ` +
+                    `R-C3-06 addresses the allocators-specific Guard+sharing coupling: the SAFE design uses ` +
+                    `sharing.who=Entity so the recipient is fixed, making Guard Signer binding unnecessary.\n\n` +
+                    `sharing_recipients hint: ${recipientsLabel}`,
+                affected_stakeholders: ["provider", "customer"],
+                scenario: "Fund theft: attacker passes the allocators Guard (e.g. submits a completed order_id) and " +
+                    "sharing.who=Signer routes 100% of the order funds to the attacker's address",
+                mitigation: "TWO mitigation options:\n" +
+                    "  (A) Traditional: add context(Signer) binding to the Guard root " +
+                    "(logic_equal[context(Signer), identifier[N](authorized_address)]) so only the authorized " +
+                    "recipient can trigger allocation.\n" +
+                    "  (B) PREFERRED: use sharing.who=Entity (Treasury object or fixed personal address) in the " +
+                    "Allocator's sharing config. Funds then always flow to the designated recipient regardless of " +
+                    "who triggers allocation — the Guard does NOT need to bind Signer. This is more robust because " +
+                    "it does not depend on Guard correctness.\n\n" +
+                    "Design checklist when using sharing.who=Entity:\n" +
+                    "  - If Entity points to a Treasury object, verify the Treasury's permission is consistent with " +
+                    "the Service's permission (different permissions = different permission organizations = minor risk).\n" +
+                    "  - allocators require unique guard addresses: create separate Guard objects (identical root/table, " +
+                    "different descriptions) for each allocator.\n" +
+                    "  - First-match-wins: only the first Allocator whose Guard passes executes; multiple allocators " +
+                    "represent alternative strategies, not a simultaneous split.\n" +
+                    "  - Still add order.service project binding (query 1563) to prevent cross-project bypass (R-C3-05) " +
+                    "triggering premature allocation.",
+                evidence: `Scene: service_order_allocators_guard. ` +
+                    `Guard binds Signer: no. ` +
+                    `sharing_recipients: ${recipientsLabel}. ` +
+                    `Level rationale: ${hasSignerSharing ? "Signer sharing confirmed → critical" : "sharing hint absent → conservative medium"}.`,
+            };
+        },
+    },
     {
         id: "R-C4-01",
         data_source_class: "type4_system_context",
@@ -488,7 +1085,7 @@ const RISK_RULES = [
                 category: "system_context_risk",
                 title: "Clock time-lock should have tolerance to avoid boundary invalidation from validator block-time variance",
                 description: "Guard uses context(Clock) for time-lock comparison. Clock comes from the timestamp_ms field (U64 millisecond timestamp) of system shared object 0x6.\n" +
-                    "The Sui on-chain timestamp is produced by validator consensus and has a slight deviation from real time (usually < 1 second), " +
+                    "The Wow on-chain timestamp is produced by validator consensus and has a slight deviation from real time (usually < 1 second), " +
                     "and block-time variance may cause timestamp jumps. Using precise boundaries (>= or ==) may cause:\n" +
                     "  - The time-lock expiration transaction is packaged exactly at the moment but fails due to slight timestamp deviation\n" +
                     "  - Or conversely, slight deviation causes the time-lock to pass early\n" +
@@ -530,10 +1127,63 @@ const RISK_RULES = [
             };
         },
     },
+    {
+        id: "R-C4-04",
+        data_source_class: "type4_system_context",
+        trigger: "Guard uses logic_equal[context(Signer), identifier[N](fixed_address)] — Level 1 strict single-identity binding. " +
+            "Only ONE address can pass the Guard, and because Guards are immutable, changing the authorized address requires " +
+            "rebuilding the Guard and migrating all references. This creates a convenience trade-off: maximum security but " +
+            "maximum inflexibility (key loss or personnel change permanently blocks the operation).",
+        check: (ctx) => {
+            if (!hasSignerCheck(ctx))
+                return null;
+            if (isSignerCheckInLogicOr(ctx.root))
+                return null;
+            const detection = detectLevel1StrictBinding(ctx.root, ctx.table);
+            if (!detection.detected || !detection.entry)
+                return null;
+            const entry = detection.entry;
+            return {
+                id: "R-C4-04",
+                data_source_class: "type4_system_context",
+                level: "info",
+                category: "system_context_risk",
+                title: "Level 1 strict single-identity Signer binding — convenience trade-off (consider Level 2/3 alternatives)",
+                description: `Guard uses logic_equal[context(Signer), identifier[${entry.identifier}](fixed address)] — only the address "${entry.value}" can pass.\n` +
+                    "This is Level 1 strict single-identity binding: maximally secure but maximally inconvenient.\n" +
+                    "Guards are immutable on-chain. If the authorized address becomes unavailable (key loss, personnel change, " +
+                    "role rotation), the Guard permanently blocks the operation — the only recovery is to build a new Guard " +
+                    "and migrate ALL references (Machine forward guards, Service buy_guard, allocators, etc.).\n\n" +
+                    "Three verifier constraint levels trade off security vs convenience:\n" +
+                    "  - Level 1 (current): strict single-identity — one address, no flexibility (AVOID unless justified)\n" +
+                    "  - Level 2: identity-set — logic_or of multiple valid identities (e.g. order.owner OR order.agent; " +
+                    "permission.owner OR permission.admin). Recommended for role-based access.\n" +
+                    "  - Level 3: scene-combined — verify whether Signer binding is even needed. Many scenes (allocators with " +
+                    "sharing.who=Entity, machine forward with permissionIndex) already ensure safety without Signer binding.\n\n" +
+                    "Use Level 1 only when: (a) the role is permanently tied to one address, AND (b) the designer explicitly " +
+                    "accepts the immutability lock-in risk. Otherwise prefer Level 2 or Level 3.",
+                affected_stakeholders: ["provider"],
+                scenario: "Immutability lock-in: authorized address becomes unavailable, Guard permanently blocks the operation, " +
+                    "requiring full Guard rebuild and reference migration",
+                mitigation: "Consider these alternatives before settling on Level 1 strict binding:\n" +
+                    "  (A) Level 2 identity-set (RECOMMENDED for role-based access): use logic_or to allow multiple valid identities.\n" +
+                    "      - Order holder: logic_or[logic_equal[query(1562: order.owner), context(Signer)], query(1567: order.agent has, parameters: [context(Signer)])]\n" +
+                    "      - Service provider: logic_or[logic_equal[query(1002: permission.owner), context(Signer)], query(1004: permission.admin has, parameters: [context(Signer)])]\n" +
+                    "      - Dynamic permission (survives rotation): submit permission address, verify query(1488: service.permission) == submitted, then check 1002/1004\n" +
+                    "  (B) Level 3 scene-combined: evaluate whether Signer binding is needed at all.\n" +
+                    "      - If using allocators with sharing.who=Entity (Treasury): funds flow to a fixed recipient regardless of caller — no Signer binding needed (R-C3-06 safe)\n" +
+                    "      - If using machine forward: permissionIndex already verifies operator identity — Signer binding may be redundant\n" +
+                    "  (C) If Level 1 is truly required: document the justification in the Guard description and ensure a key-recovery / address-rotation plan exists.",
+                evidence: `Level 1 strict binding detected: logic_equal[context(Signer), identifier[${entry.identifier}]] ` +
+                    `where identifier[${entry.identifier}] is a fixed Address constant (b_submission=false, value="${entry.value}"${entry.name ? `, name="${entry.name}"` : ""}). ` +
+                    `Not wrapped in logic_or (not Level 2 identity-set).`,
+            };
+        },
+    },
     {
         id: "R-X1-01",
         data_source_class: "cross_type",
-        trigger: "Time-lock query returns 0 causing logic_as_u256_greater_or_equal comparison to always be true",
+        trigger: "Time-lock uses logic_as_u256_greater_or_equal with a baseline query that has NO non-zero invariant (i.e. the query MAY legitimately return 0 when it succeeds), causing Clock >= 0 + timeout to always be true",
         check: (ctx) => {
             const str = rootStr(ctx);
             const hasGreaterOrEqual = str.includes("logic_as_u256_greater_or_equal");
@@ -542,46 +1192,79 @@ const RISK_RULES = [
             const hasQuery = str.includes('"query"');
             if (!(hasGreaterOrEqual && hasClock && hasCalcAdd && hasQuery))
                 return null;
+            if (rootAllQueriesNonZero(ctx.root))
+                return null;
+            const queryIds = extractQueryIds(ctx.root);
+            const riskyQueries = queryIds.filter((id) => !QUERY_INVARIANT_MAP.has(id));
+            const evidence = riskyQueries.length > 0
+                ? `Queries without non-zero invariant: ${riskyQueries
+                    .map((id) => {
+                    const q = GUARDQUERY.find((x) => x.id === id);
+                    return q ? `${q.id} (${q.name})` : `${id}`;
+                })
+                    .join(", ")}`
+                : "Baseline query may return 0";
             return {
                 id: "R-X1-01",
                 data_source_class: "cross_type",
                 level: "medium",
                 category: "logic_gap",
-                title: "Time-lock query may return 0 causing >= comparison to always be true",
-                description: "Guard uses logic_as_u256_greater_or_equal for time-lock comparison, and the compared baseline value comes from a query (Type1/2/3 data sources)." +
-                    "If the query returns 0 (e.g. querying a timestamp of an operation that hasn't happened, or unset node entry time), " +
-                    "then Clock >= 0 + timeout is always true, the time-lock is effectively void, and the disadvantaged party can bypass the time constraint immediately.",
+                title: "Time-lock baseline query may return 0 causing >= comparison to always be true",
+                description: "Guard uses logic_as_u256_greater_or_equal for time-lock comparison, and the compared baseline value comes from a query (Type1/2/3 data sources). " +
+                    "If the query SUCCEEDS but its stored value is 0 (e.g. a count that is 0 in the empty initial state, a user-submitted value of 0, or a Some(0) from an Option field), " +
+                    "then Clock >= 0 + timeout is always true, the time-lock is effectively void, and the disadvantaged party can bypass the time constraint immediately.\n\n" +
+                    "IMPORTANT — 'VM error = Guard failure' baseline: " +
+                    "if a query targets an absent object, unset Option, or missing collection entry, the WoWok native runtime aborts with a VM error (e.g. W_FIELD_NOT_FOUND) " +
+                    "and the Guard fails as a whole (does NOT silently return 0). Therefore the null-bypass risk ONLY applies to queries whose stored value can legitimately be 0 " +
+                    "while the query itself succeeds. Such queries are exactly those WITHOUT an `invariant` annotation in the SDK GUARDQUERY catalog.",
                 affected_stakeholders: ["customer", "provider"],
-                scenario: "Time-lock invalidation: query returns 0, making the >= condition always pass",
-                mitigation: "1) Use a query that returns the current node entry time (e.g. progress.current_time, id=1272) " +
-                    "instead of the operation timestamp (e.g. progress.session.forward.time, id=1271);" +
-                    "2) Add a precondition check query > 0 before the time-lock;" +
-                    "3) Confirm the query must have a value when the Guard executes (query current node attributes rather than historical operations)",
+                scenario: "Time-lock invalidation: baseline query returns 0 (not VM error), making the >= condition always pass",
+                mitigation: "1) Use a query whose return is guaranteed non-zero (look for `invariant` in guard-ins.ts — e.g. progress.current_time id=1272 with invariant='clock_derived'); " +
+                    "2) Add a precondition check query > 0 before the time-lock (for queries without an invariant, e.g. user-submitted baselines); " +
+                    "3) Avoid using count/index/find/user-submitted values as time-lock baselines — these can all legitimately return 0; " +
+                    "4) Distinguish 'VM error' (safe — Guard fails) from 'query returns 0' (unsafe — Guard bypassed). Only the latter is a null-bypass risk.",
+                evidence,
             };
         },
     },
     {
         id: "R-X1-02",
         data_source_class: "cross_type",
-        trigger: "Guard uses logic_as_u256_greater but does not handle null values",
+        trigger: "Guard uses logic_as_u256_greater with a query operand that has NO non-zero invariant (i.e. the query MAY legitimately return 0 when it succeeds), and the comparison does not distinguish 'query succeeded with 0' from 'query failed'",
         check: (ctx) => {
             const str = rootStr(ctx);
             if (!(str.includes("logic_as_u256_greater") && str.includes('"query"')))
                 return null;
+            if (rootAllQueriesNonZero(ctx.root))
+                return null;
+            const queryIds = extractQueryIds(ctx.root);
+            const riskyQueries = queryIds.filter((id) => !QUERY_INVARIANT_MAP.has(id));
+            const evidence = riskyQueries.length > 0
+                ? `Queries without non-zero invariant: ${riskyQueries
+                    .map((id) => {
+                    const q = GUARDQUERY.find((x) => x.id === id);
+                    return q ? `${q.id} (${q.name})` : `${id}`;
+                })
+                    .join(", ")}`
+                : "Query may return 0";
             return {
                 id: "R-X1-02",
                 data_source_class: "cross_type",
                 level: "medium",
                 category: "logic_gap",
-                title: "Numeric comparison does not handle the case of query returning null",
-                description: "Guard uses logic_as_u256_greater for numeric comparison, and operands come from a query (Type1/2/3 data sources)." +
-                    "If the query returns null (e.g. object does not exist, field not set), the comparison result may be undefined." +
-                    "In the WoWok protocol null is usually treated as 0, which may cause unexpected pass.",
+                title: "Numeric comparison with a query that may legitimately return 0",
+                description: "Guard uses logic_as_u256_greater for numeric comparison, and one of the operands comes from a query (Type1/2/3 data sources) that has NO non-zero invariant annotation. " +
+                    "If the query SUCCEEDS but its stored value is 0 (e.g. a count that is 0 in the empty initial state, a user-submitted value of 0, or a Some(0) from an Option field), " +
+                    "the comparison may produce an unexpected result (e.g. `query > 0` fails, or `query > some_threshold` is silently bypassed).\n\n" +
+                    "IMPORTANT — 'VM error = Guard failure' baseline: " +
+                    "if a query targets absent data (e.g. object does not exist, Option is None, collection entry is missing), the WoWok native runtime aborts with a VM error " +
+                    "(not 0). The Guard fails as a whole (does NOT silently return 0). Therefore this rule only flags queries whose stored value can be 0 while the query succeeds.",
                 affected_stakeholders: ["customer", "provider"],
-                scenario: "Null misjudgment: query returns 0, causing > 0 condition to unexpectedly pass or fail",
-                mitigation: "1) Add a query result existence check before comparison;" +
-                    "2) Use query_reward_record_exists or query_progress_history_find to verify first;" +
-                    "3) Consider adding a logic_and(object exists, numeric comparison) combination",
+                scenario: "Null misjudgment: query succeeds with value 0, causing > 0 condition to unexpectedly fail (or > threshold to be bypassed)",
+                mitigation: "1) Prefer queries with an `invariant` annotation (e.g. clock_derived / positive_lower_bound); " +
+                    "2) Add a precondition check (query > 0) before the main comparison when using count/index/find/user-submitted baselines; " +
+                    "3) Distinguish 'VM error' (safe — Guard fails) from 'query returns 0' (potentially unsafe). Only the latter is a null-bypass risk.",
+                evidence,
             };
         },
     },
@@ -918,7 +1601,93 @@ const RISK_RULES = [
             };
         },
     },
+    {
+        id: "R-X1-14",
+        data_source_class: "cross_type",
+        trigger: "Scene-specific reentrancy: Guard pass triggers a state-changing side effect (fund distribution, vote count, Arb creation) that does NOT naturally invalidate the Guard condition. " +
+            "Without an anti-reentrancy primitive, the same Signer can repeatedly pass the Guard. " +
+            "Additionally detects pseudo-protection: primitive present but not properly wrapped in logic_not (for Bool queries) or logic_equal(0) (for count queries).",
+        check: (ctx) => {
+            const spec = REENTRANCY_SPECS.find((s) => s.sceneId === ctx.scene?.id);
+            if (!spec)
+                return null;
+            const protection = detectReentrancyProtection(ctx.root, ctx.table, spec);
+            if (protection.state === "protected")
+                return null;
+            if (protection.state === "pseudo") {
+                return {
+                    id: "R-X1-14",
+                    data_source_class: "cross_type",
+                    level: "medium",
+                    category: "logic_gap",
+                    title: `Reentrancy pseudo-protection: anti-reentrancy primitive present but not properly wrapped (${spec.sceneId})`,
+                    description: `Scene: ${spec.sceneId}\n` +
+                        `The Guard root contains an anti-reentrancy primitive (${protection.foundPrimitiveName}), but it is NOT properly wrapped.\n` +
+                        "Proper wrapping rules:\n" +
+                        "  - Bool-returning primitives (exists-style): must be wrapped in logic_not\n" +
+                        "  - U64-returning primitives (count-style): must be compared to 0 via logic_equal\n" +
+                        "  - Address-returning primitives: must be wrapped in logic_not (None check)\n\n" +
+                        "WHY THIS IS DANGEROUS:\n" +
+                        "  The developer likely intended to prevent reentrancy but the wrapping is incorrect, " +
+                        "so the primitive does NOT actually block repeated Guard passes. This is arguably MORE " +
+                        "dangerous than absence — code reviewers see the primitive and assume protection is in place.\n\n" +
+                        `Scene rationale: ${spec.rationale}`,
+                    affected_stakeholders: deriveStakeholders(spec.sceneId),
+                    scenario: `Developer added anti-reentrancy primitive but used wrong wrapping; reentrancy exploit still possible in ${spec.sceneId}`,
+                    mitigation: "Fix the wrapping:\n" +
+                        "  - For exists-style (Bool) primitives: wrap in logic_not — { type: 'logic_not', node: { type: 'query', query: <primitive>, ... } }\n" +
+                        "  - For count-style (U64) primitives: compare to 0 — { type: 'logic_equal', nodes: [ { type: 'query', query: <primitive>, ... }, identifier(N) ] } where table[N].value = 0\n" +
+                        "  - For address-style primitives: wrap in logic_not (None check)\n" +
+                        `Then wrap the protection in logic_and with the existing root conditions.\n\n` +
+                        `Full mitigation for ${spec.sceneId}:\n${spec.mitigation}`,
+                    evidence: protection.evidence,
+                };
+            }
+            const level = spec.level;
+            const stakeholders = deriveStakeholders(spec.sceneId);
+            return {
+                id: "R-X1-14",
+                data_source_class: "cross_type",
+                level,
+                category: "logic_gap",
+                title: level === "info"
+                    ? `Reentrancy reminder: ${spec.sceneId} has no anti-reentrancy primitive (LOW risk)`
+                    : `Reentrancy risk: ${spec.sceneId} has NO anti-reentrancy protection (${level.toUpperCase()})`,
+                description: `Scene: ${spec.sceneId}\n` +
+                    `Reentrancy risk level: ${level.toUpperCase()}\n\n` +
+                    `RATIONALE:\n${spec.rationale}\n\n` +
+                    (protection.evidence
+                        ? `DETECTION:\n${protection.evidence}\n\n`
+                        : "") +
+                    (level === "critical"
+                        ? "IMPACT: Without protection, the same Signer can repeatedly trigger the side effect (fund distribution / vote counting), causing direct fund loss or result manipulation. THIS IS A CRITICAL VULNERABILITY — the Guard MUST be rebuilt with an anti-reentrancy primitive before deployment.\n\n"
+                        : level === "high"
+                            ? "IMPACT: Without protection, the system can be abused (multiple dispute cases, arbitration harassment). Strongly recommended to add protection.\n\n"
+                            : "IMPACT: Low by default; only relevant if business intent requires single-action enforcement. Review the rationale above.\n\n"),
+                affected_stakeholders: stakeholders,
+                scenario: level === "info"
+                    ? `${spec.sceneId} lacks anti-reentrancy primitive; may or may not be needed depending on business intent`
+                    : `${spec.sceneId} lacks anti-reentrancy primitive; same Signer can repeatedly trigger the side effect`,
+                mitigation: spec.mitigation,
+                evidence: protection.evidence,
+            };
+        },
+    },
 ];
+function deriveStakeholders(sceneId) {
+    switch (sceneId) {
+        case "reward_guard":
+            return ["claimant", "provider"];
+        case "arbitration_voting_guard":
+            return ["customer", "provider", "arbitrator"];
+        case "arbitration_usage_guard":
+            return ["customer", "provider"];
+        case "service_order_allocators_guard":
+            return ["customer", "provider"];
+        default:
+            return ["provider"];
+    }
+}
 export function assessGuardRisks(params) {
     const ctx = {
         table: params.table,
@@ -926,6 +1695,7 @@ export function assessGuardRisks(params) {
         rely: params.rely,
         scene: params.scene,
         operation_type: params.operation_type,
+        sharing_recipients: params.sharing_recipients,
     };
     const risks = [];
     for (const rule of RISK_RULES) {