@wowok/agent-mcp 2.6.3 → 2.6.6

package/dist/project/evaluation.js

@@ -84,6 +84,16 @@ function shortTypeName(objectType) {
     }
     return shortName;
 }
+function groupByType(objects) {
+    const byType = new Map();
+    for (const obj of objects) {
+        const t = shortTypeName(obj.objectType);
+        if (!byType.has(t))
+            byType.set(t, []);
+        byType.get(t).push(obj);
+    }
+    return byType;
+}
 function parseCacheData(cached) {
     if (!cached)
         return null;
@@ -338,6 +348,43 @@ function normalizeWeights(criterionScores) {
         return criterionScores;
     return criterionScores.map(c => ({ ...c, weight: c.weight / total }));
 }
+export const RISK_WEIGHTS = {
+    structural_risk: 0.25,
+    fund_safety: 0.2,
+    operational_risk: 0.15,
+    governance_risk: 0.1,
+    graph_coherence: 0.2,
+    mode_registry: 0.1,
+};
+export const TRUST_WEIGHTS = {
+    reputation: 0.25,
+    arbitration_coverage: 0.2,
+    guard_quality: 0.2,
+    transparency: 0.15,
+    consumer_diligence: 0.2,
+};
+export const COMPLETENESS_WEIGHTS = {
+    object_coverage: 0.3,
+    binding_completeness: 0.25,
+    workflow_rationality: 0.2,
+    deployment_readiness: 0.25,
+};
+export const EXTENDED_DIMENSION_WEIGHTS = {
+    escrow_quality: 0.15,
+    proof_integrity: 0.1,
+    arbitration_fairness: 0.15,
+    fee_transparency: 0.1,
+    timeout_protection: 0.1,
+    supplier_visibility: 0.1,
+    content_commitment: 0.1,
+    reputation_verifiability: 0.1,
+    permission_safety: 0.1,
+};
+export function finalizeCriterionScores(baseScores, perspective) {
+    const criterionScores = normalizeWeights(adjustWeightsForPerspective(baseScores, perspective));
+    const overall = clampScore(criterionScores.reduce((sum, c) => sum + c.score * c.weight, 0));
+    return { criterionScores, overall };
+}
 function buildBindingIndex(edges) {
     const idx = new Map();
     for (const e of edges) {
@@ -379,13 +426,7 @@ function evaluateIndustryPattern(project, objects, objectCache, edges) {
     }
     if (!mode)
         return result;
-    const byType = new Map();
-    for (const obj of objects) {
-        const t = shortTypeName(obj.objectType);
-        if (!byType.has(t))
-            byType.set(t, []);
-        byType.get(t).push(obj);
-    }
+    const byType = groupByType(objects);
     const bindingIndex = buildBindingIndex(edges);
     let matchCount = 0;
     let totalChecks = 0;
@@ -534,13 +575,7 @@ function evaluateRisk(input) {
     const findings = [];
     const strengths = [];
     const { objects, edges, objectCache, project } = input;
-    const byType = new Map();
-    for (const obj of objects) {
-        const t = shortTypeName(obj.objectType);
-        if (!byType.has(t))
-            byType.set(t, []);
-        byType.get(t).push(obj);
-    }
+    const byType = groupByType(objects);
     const services = byType.get("Service") ?? [];
     const bindingIndex = buildBindingIndex(edges);
     let structuralScore = 100;
@@ -944,15 +979,91 @@ function evaluateRisk(input) {
         strengths.push("Graph is coherent — no dangling refs or cycles");
     }
     coherenceScore = clampScore(coherenceScore);
-    let criterionScores = [
-        { name: "structural_risk", score: structuralScore, weight: 0.25, rationale: `${CRITICAL_BINDINGS.filter(b => b.sourceType === "Service").length} expected Service bindings checked` },
-        { name: "fund_safety", score: fundScore, weight: 0.2, rationale: `Treasury + compensation_fund coverage` },
-        { name: "operational_risk", score: operationalScore, weight: 0.2, rationale: `Service state + arbitration coverage` },
-        { name: "governance_risk", score: governanceScore, weight: 0.15, rationale: `Permission + UM presence` },
-        { name: "graph_coherence", score: coherenceScore, weight: 0.2, rationale: `${danglingCount} dangling + ${cycles.length} circular refs` },
-    ];
-    criterionScores = normalizeWeights(adjustWeightsForPerspective(criterionScores, project.perspective));
-    const overall = clampScore(criterionScores.reduce((sum, c) => sum + c.score * c.weight, 0));
+    let modeRegistryScore = 100;
+    let modeRegistryRationale = "no industry declared — check skipped";
+    if (!project.industry) {
+        findings.push({
+            criterion: "mode_registry",
+            severity: "info",
+            message: "Project has no industry tag — mode registry gates (metrics/constraints) not evaluated. Set project industry to enable.",
+            deduction: 0,
+        });
+    }
+    else {
+        try {
+            const modeEval = IndustryModeRegistry.Instance().evaluateMode(project.industry, project.description ?? project.name, {
+                prefix: project.prefix,
+                network: project.network === "mainnet" ? "mainnet" : "testnet",
+                business_intent: project.description ?? undefined,
+                industry: project.industry,
+                version: project.currentVersion ?? undefined,
+            });
+            const modeNotFound = modeEval.unmet_conditions.some(c => c.includes("not found"));
+            if (modeNotFound) {
+                modeRegistryScore = 50;
+                modeRegistryRationale = `mode '${project.industry}' not registered`;
+                findings.push({
+                    criterion: "mode_registry",
+                    severity: "warning",
+                    message: `Industry mode '${project.industry}' is not registered in the mode registry — cannot verify capability/conflict/constraint gates. Falling back to unverified mode.`,
+                    deduction: -50,
+                });
+            }
+            else {
+                for (const v of modeEval.violated_constraints) {
+                    modeRegistryScore -= 25;
+                    findings.push({
+                        criterion: "mode_registry",
+                        severity: "critical",
+                        message: `Mode '${project.industry}' hard constraint violated: ${v}`,
+                        deduction: -25,
+                    });
+                }
+                for (const c of modeEval.capability_conflicts) {
+                    modeRegistryScore -= 20;
+                    findings.push({
+                        criterion: "mode_registry",
+                        severity: "critical",
+                        message: `Mode '${project.industry}' capability conflict: ${c}`,
+                        deduction: -20,
+                    });
+                }
+                for (const u of modeEval.unmet_conditions) {
+                    modeRegistryScore -= 10;
+                    findings.push({
+                        criterion: "mode_registry",
+                        severity: "warning",
+                        message: `Mode '${project.industry}' soft constraint unmet: ${u}`,
+                        deduction: -10,
+                    });
+                }
+                modeRegistryScore = clampScore(modeRegistryScore);
+                modeRegistryRationale =
+                    `metric risk ${modeEval.risk_score} / benefit ${modeEval.benefit_score} ` +
+                        `(ratio ${modeEval.risk_benefit_ratio.toFixed(2)}); ` +
+                        `${modeEval.violated_constraints.length} hard + ${modeEval.unmet_conditions.length} soft constraint issue(s), ` +
+                        `${modeEval.capability_conflicts.length} capability conflict(s)`;
+                if (modeEval.applicable && modeEval.violated_constraints.length === 0 &&
+                    modeEval.capability_conflicts.length === 0 && modeEval.unmet_conditions.length === 0) {
+                    strengths.push(`Mode '${project.industry}' passes all mode-registry gates — ` +
+                        `metric risk ${modeEval.risk_score} / benefit ${modeEval.benefit_score} ` +
+                        `(risk-benefit ratio ${modeEval.risk_benefit_ratio.toFixed(2)})`);
+                }
+            }
+        }
+        catch {
+            modeRegistryRationale = "mode registry unavailable — check skipped";
+        }
+    }
+    modeRegistryScore = clampScore(modeRegistryScore);
+    const { criterionScores, overall } = finalizeCriterionScores([
+        { name: "structural_risk", score: structuralScore, weight: RISK_WEIGHTS.structural_risk, rationale: `${CRITICAL_BINDINGS.filter(b => b.sourceType === "Service").length} expected Service bindings checked` },
+        { name: "fund_safety", score: fundScore, weight: RISK_WEIGHTS.fund_safety, rationale: `Treasury + compensation_fund coverage` },
+        { name: "operational_risk", score: operationalScore, weight: RISK_WEIGHTS.operational_risk, rationale: `Service state + arbitration coverage` },
+        { name: "governance_risk", score: governanceScore, weight: RISK_WEIGHTS.governance_risk, rationale: `Permission + UM presence` },
+        { name: "graph_coherence", score: coherenceScore, weight: RISK_WEIGHTS.graph_coherence, rationale: `${danglingCount} dangling + ${cycles.length} circular refs` },
+        { name: "mode_registry", score: modeRegistryScore, weight: RISK_WEIGHTS.mode_registry, rationale: modeRegistryRationale },
+    ], project.perspective);
     const criticalCount = findings.filter(f => f.severity === "critical").length;
     const summary = criticalCount > 0
         ? `HIGH RISK: ${criticalCount} critical issue(s). ${findings.length} total findings.`
@@ -972,13 +1083,7 @@ function evaluateTrust(input) {
     const findings = [];
     const strengths = [];
     const { objects, edges, objectCache, reputation, project } = input;
-    const byType = new Map();
-    for (const obj of objects) {
-        const t = shortTypeName(obj.objectType);
-        if (!byType.has(t))
-            byType.set(t, []);
-        byType.get(t).push(obj);
-    }
+    const byType = groupByType(objects);
     const services = byType.get("Service") ?? [];
     let reputationScore = 50;
     if (reputation && reputation.size > 0 && services[0]) {
@@ -1192,15 +1297,13 @@ function evaluateTrust(input) {
         });
     }
     diligenceScore = clampScore(diligenceScore);
-    let criterionScores = [
-        { name: "reputation", score: reputationScore, weight: 0.25, rationale: `Registrar likes/dislikes + affiliations` },
-        { name: "arbitration_coverage", score: arbitrationScore, weight: 0.2, rationale: `Dispute resolution availability` },
-        { name: "guard_quality", score: guardScore, weight: 0.2, rationale: `Validation rules + buy_guard binding` },
-        { name: "transparency", score: transparencyScore, weight: 0.15, rationale: `Description + Repository + Contact presence` },
-        { name: "consumer_diligence", score: diligenceScore, weight: 0.2, rationale: `${diligencePassed.length}/${CONSUMER_DUE_DILIGENCE.length} E-checks passed` },
-    ];
-    criterionScores = normalizeWeights(adjustWeightsForPerspective(criterionScores, project.perspective));
-    const overall = clampScore(criterionScores.reduce((sum, c) => sum + c.score * c.weight, 0));
+    const { criterionScores, overall } = finalizeCriterionScores([
+        { name: "reputation", score: reputationScore, weight: TRUST_WEIGHTS.reputation, rationale: `Registrar likes/dislikes + affiliations` },
+        { name: "arbitration_coverage", score: arbitrationScore, weight: TRUST_WEIGHTS.arbitration_coverage, rationale: `Dispute resolution availability` },
+        { name: "guard_quality", score: guardScore, weight: TRUST_WEIGHTS.guard_quality, rationale: `Validation rules + buy_guard binding` },
+        { name: "transparency", score: transparencyScore, weight: TRUST_WEIGHTS.transparency, rationale: `Description + Repository + Contact presence` },
+        { name: "consumer_diligence", score: diligenceScore, weight: TRUST_WEIGHTS.consumer_diligence, rationale: `${diligencePassed.length}/${CONSUMER_DUE_DILIGENCE.length} E-checks passed` },
+    ], project.perspective);
     const summary = overall >= 70
         ? `Trusted project (score ${overall}/100). ${strengths.length} strength(s).`
         : `Limited trust signals (score ${overall}/100). ${findings.length} finding(s).`;
@@ -1219,13 +1322,7 @@ function evaluateCompleteness(input) {
     const findings = [];
     const strengths = [];
     const { objects, edges, objectCache, project } = input;
-    const byType = new Map();
-    for (const obj of objects) {
-        const t = shortTypeName(obj.objectType);
-        if (!byType.has(t))
-            byType.set(t, []);
-        byType.get(t).push(obj);
-    }
+    const byType = groupByType(objects);
     const services = byType.get("Service") ?? [];
     const bindingIndex = buildBindingIndex(edges);
     const svcObjForRequiredItems = services[0];
@@ -1473,14 +1570,12 @@ function evaluateCompleteness(input) {
         readinessScore = 0;
     }
     readinessScore = clampScore(readinessScore);
-    let criterionScores = [
-        { name: "object_coverage", score: coverageScore, weight: 0.3, rationale: `R1-R8: ${requiredMet}/${requiredCount} required, R9-R12: ${optionalMet}/${optionalItems.length} optional` },
-        { name: "binding_completeness", score: bindingScore, weight: 0.25, rationale: `Service critical bindings checked` },
-        { name: "workflow_rationality", score: workflowScore, weight: 0.2, rationale: `Machine nodes + dangling edges` },
-        { name: "deployment_readiness", score: readinessScore, weight: 0.25, rationale: `Service publishable state` },
-    ];
-    criterionScores = normalizeWeights(adjustWeightsForPerspective(criterionScores, project.perspective));
-    const overall = clampScore(criterionScores.reduce((sum, c) => sum + c.score * c.weight, 0));
+    const { criterionScores, overall } = finalizeCriterionScores([
+        { name: "object_coverage", score: coverageScore, weight: COMPLETENESS_WEIGHTS.object_coverage, rationale: `R1-R8: ${requiredMet}/${requiredCount} required, R9-R12: ${optionalMet}/${optionalItems.length} optional` },
+        { name: "binding_completeness", score: bindingScore, weight: COMPLETENESS_WEIGHTS.binding_completeness, rationale: `Service critical bindings checked` },
+        { name: "workflow_rationality", score: workflowScore, weight: COMPLETENESS_WEIGHTS.workflow_rationality, rationale: `Machine nodes + dangling edges` },
+        { name: "deployment_readiness", score: readinessScore, weight: COMPLETENESS_WEIGHTS.deployment_readiness, rationale: `Service publishable state` },
+    ], project.perspective);
     const criticalCount = findings.filter(f => f.severity === "critical").length;
     const summary = criticalCount > 0
         ? `Incomplete: ${criticalCount} critical gap(s). Not ready for deployment.`
@@ -1501,10 +1596,278 @@ function evaluateCompleteness(input) {
         evaluatedAt: Date.now(),
     };
 }
+function evaluateEscrowQuality(input) {
+    const { objects, edges, objectCache } = input;
+    const byType = groupByType(objects);
+    const services = byType.get("Service") ?? [];
+    const allocations = byType.get("Allocation") ?? [];
+    const bindingIndex = buildBindingIndex(edges);
+    let score = 50;
+    const findings = [];
+    if (services.length === 0) {
+        return { name: "escrow_quality", score: 0, weight: EXTENDED_DIMENSION_WEIGHTS.escrow_quality, rationale: "No Service object" };
+    }
+    const service = services[0];
+    const svcData = parseCacheData(objectCache.get(service.objectAddress));
+    const hasOrderAllocators = bindingIndex.get(`${service.objectAddress}#order_allocators`)?.size ?? 0;
+    if (hasOrderAllocators > 0 && allocations.length > 0) {
+        score = 90;
+        findings.push("On-chain escrow active: order_allocators bound + Allocation objects present");
+    }
+    else if (hasOrderAllocators > 0) {
+        score = 70;
+        findings.push("order_allocators template bound — escrow will activate per-order");
+    }
+    else if (svcData && getBalanceValue(svcData, "compensation_fund") > 0) {
+        score = 60;
+        findings.push("compensation_fund present but no Allocation escrow — funds held by merchant, not locked in contract");
+    }
+    else {
+        score = 20;
+        findings.push("No escrow mechanism — funds flow directly to merchant (high counterparty risk)");
+    }
+    return { name: "escrow_quality", score: clampScore(score), weight: EXTENDED_DIMENSION_WEIGHTS.escrow_quality, rationale: findings.join("; ") };
+}
+function evaluateProofIntegrity(input) {
+    const { objects, edges } = input;
+    const byType = groupByType(objects);
+    const repositories = byType.get("Repository") ?? [];
+    const guards = byType.get("Guard") ?? [];
+    const proofs = byType.get("Proof") ?? [];
+    let score = 50;
+    const parts = [];
+    if (repositories.length > 0) {
+        score += 20;
+        parts.push(`${repositories.length} Repository object(s)`);
+    }
+    if (guards.length > 0) {
+        score += 15;
+        parts.push(`${guards.length} Guard object(s)`);
+    }
+    if (proofs.length > 0) {
+        score += 15;
+        parts.push(`${proofs.length} Proof object(s)`);
+    }
+    if (repositories.length === 0 && guards.length === 0) {
+        score = 20;
+        parts.push("No on-chain proof mechanism — evidence can be tampered");
+    }
+    return { name: "proof_integrity", score: clampScore(score), weight: EXTENDED_DIMENSION_WEIGHTS.proof_integrity, rationale: parts.join(", ") || "No proof objects" };
+}
+function evaluateArbitrationFairness(input) {
+    const { objects, edges, objectCache } = input;
+    const byType = groupByType(objects);
+    const services = byType.get("Service") ?? [];
+    const arbitrations = byType.get("Arbitration") ?? [];
+    const bindingIndex = buildBindingIndex(edges);
+    if (arbitrations.length === 0) {
+        return { name: "arbitration_fairness", score: 0, weight: EXTENDED_DIMENSION_WEIGHTS.arbitration_fairness, rationale: "No Arbitration configured" };
+    }
+    let score = 50;
+    const issues = [];
+    const service = services[0];
+    if (!service) {
+        return { name: "arbitration_fairness", score: 30, weight: EXTENDED_DIMENSION_WEIGHTS.arbitration_fairness, rationale: "No Service to compare against" };
+    }
+    const svcPermKey = `${service.objectAddress}#permission`;
+    const svcPermAddr = bindingIndex.get(svcPermKey)?.values().next().value;
+    for (const arb of arbitrations) {
+        const arbPermKey = `${arb.objectAddress}#permission`;
+        const arbPermAddr = bindingIndex.get(arbPermKey)?.values().next().value;
+        if (!svcPermAddr || !arbPermAddr) {
+            score -= 10;
+            issues.push(`Arbitration ${arb.objectAddress.slice(0, 8)} missing permission binding`);
+            continue;
+        }
+        if (svcPermAddr === arbPermAddr) {
+            score = 10;
+            issues.push(`Arbitration ${arb.objectAddress.slice(0, 8)} shares SAME Permission as Service — NOT independent`);
+        }
+        else {
+            score += 30;
+            issues.push(`Arbitration ${arb.objectAddress.slice(0, 8)} has independent Permission`);
+        }
+    }
+    return { name: "arbitration_fairness", score: clampScore(score), weight: EXTENDED_DIMENSION_WEIGHTS.arbitration_fairness, rationale: issues.join("; ") };
+}
+function evaluateFeeTransparency(input) {
+    const { objects, edges, objectCache } = input;
+    const byType = groupByType(objects);
+    const allocations = byType.get("Allocation") ?? [];
+    const services = byType.get("Service") ?? [];
+    let score = 60;
+    const parts = [];
+    if (allocations.length > 0) {
+        score += 20;
+        parts.push(`${allocations.length} Allocation object(s) — fee distribution on-chain`);
+    }
+    const service = services[0];
+    if (service) {
+        const svcData = parseCacheData(objectCache.get(service.objectAddress));
+        if (svcData?.sales && Array.isArray(svcData.sales)) {
+            score += 10;
+            parts.push(`${svcData.sales.length} sale item(s) — pricing visible`);
+        }
+        if (svcData?.compensation_fund && getBalanceValue(svcData, "compensation_fund") > 0) {
+            score += 10;
+            parts.push("compensation_fund visible");
+        }
+    }
+    return { name: "fee_transparency", score: clampScore(score), weight: EXTENDED_DIMENSION_WEIGHTS.fee_transparency, rationale: parts.join(", ") || "Limited fee visibility" };
+}
+function evaluateTimeoutProtection(input) {
+    const { objects, objectCache } = input;
+    const byType = groupByType(objects);
+    const machines = byType.get("Machine") ?? [];
+    let score = 50;
+    const parts = [];
+    for (const machine of machines) {
+        const data = parseCacheData(objectCache.get(machine.objectAddress));
+        const nodeCount = getMachineNodeCount(data);
+        if (nodeCount > 0) {
+            const meta = machine.metadata;
+            const config = meta?.config;
+            if (config?.timeout_guard || config?.time_guard) {
+                score += 30;
+                parts.push("Machine has timeout guard configured");
+            }
+            else if (nodeCount >= 2) {
+                score += 10;
+                parts.push(`Machine has ${nodeCount} nodes — workflow structure present`);
+            }
+        }
+    }
+    if (machines.length === 0) {
+        score = 20;
+        parts.push("No Machine — no workflow timeout protection");
+    }
+    return { name: "timeout_protection", score: clampScore(score), weight: EXTENDED_DIMENSION_WEIGHTS.timeout_protection, rationale: parts.join("; ") || "No timeout mechanisms detected" };
+}
+function evaluateSupplierVisibility(input) {
+    const { objects } = input;
+    const byType = groupByType(objects);
+    const demands = byType.get("Demand") ?? [];
+    const allocations = byType.get("Allocation") ?? [];
+    let score = 60;
+    const parts = [];
+    if (demands.length > 0) {
+        score += 20;
+        parts.push(`${demands.length} Demand object(s) — supplier discovery on-chain`);
+    }
+    if (allocations.length > 0) {
+        score += 20;
+        parts.push(`${allocations.length} Allocation object(s) — supplier payments visible`);
+    }
+    if (demands.length === 0 && allocations.length === 0) {
+        score = 30;
+        parts.push("No Demand or Allocation — supplier relationships opaque");
+    }
+    return { name: "supplier_visibility", score: clampScore(score), weight: EXTENDED_DIMENSION_WEIGHTS.supplier_visibility, rationale: parts.join(", ") || "No supplier transparency" };
+}
+function evaluateContentCommitment(input) {
+    const { objects } = input;
+    const byType = groupByType(objects);
+    const repositories = byType.get("Repository") ?? [];
+    const guards = byType.get("Guard") ?? [];
+    let score = 50;
+    const parts = [];
+    if (repositories.length > 0) {
+        score += 25;
+        parts.push("Repository present — content hash commitments possible");
+    }
+    if (guards.length > 0) {
+        score += 25;
+        parts.push("Guard present — delivery verification possible");
+    }
+    return { name: "content_commitment", score: clampScore(score), weight: EXTENDED_DIMENSION_WEIGHTS.content_commitment, rationale: parts.join(", ") || "No content commitment mechanism" };
+}
+function evaluateReputationVerifiability(input) {
+    const { reputation, objects } = input;
+    const services = groupByType(objects).get("Service") ?? [];
+    let score = 40;
+    const parts = [];
+    if (reputation && reputation.size > 0 && services[0]) {
+        const rep = reputation.get(services[0].objectAddress);
+        if (rep) {
+            score += 30;
+            parts.push(`Registrar data: ${rep.likes} likes, ${rep.dislikes} dislikes, ${rep.affiliations} affiliations`);
+        }
+    }
+    if (services.length > 0) {
+        score += 10;
+        parts.push("Service object present — reputation can accumulate");
+    }
+    return { name: "reputation_verifiability", score: clampScore(score), weight: EXTENDED_DIMENSION_WEIGHTS.reputation_verifiability, rationale: parts.join(", ") || "No reputation data available" };
+}
+function evaluatePermissionSafety(input) {
+    const { objects, edges, objectCache } = input;
+    const byType = groupByType(objects);
+    const machines = byType.get("Machine") ?? [];
+    const permissions = byType.get("Permission") ?? [];
+    const bindingIndex = buildBindingIndex(edges);
+    let score = 60;
+    const issues = [];
+    if (machines.length === 0) {
+        return { name: "permission_safety", score: 50, weight: EXTENDED_DIMENSION_WEIGHTS.permission_safety, rationale: "No Machine to check" };
+    }
+    const permDataMap = new Map();
+    for (const permObj of permissions) {
+        const cached = parseCacheData(objectCache.get(permObj.objectAddress));
+        if (cached) {
+            permDataMap.set(permObj.objectAddress, {
+                address: permObj.objectAddress,
+                entity_count: typeof cached.entity_count === "number" ? cached.entity_count : undefined,
+                perm_remark: Array.isArray(cached.perm_remark) ? cached.perm_remark : undefined,
+                owner: typeof cached.owner === "string" ? cached.owner : undefined,
+                admin: Array.isArray(cached.admin) ? cached.admin : undefined,
+            });
+        }
+    }
+    for (const machine of machines) {
+        const permBindings = bindingIndex.get(`${machine.objectAddress}#permission`);
+        if (!permBindings || permBindings.size === 0)
+            continue;
+        const permAddr = permBindings.values().next().value;
+        const permData = permAddr ? permDataMap.get(permAddr) : null;
+        if (!permData)
+            continue;
+        const machineData = parseCacheData(objectCache.get(machine.objectAddress));
+        const nodes = extractMachineNodesFromCache(machineData);
+        if (nodes.length === 0)
+            continue;
+        const collection = collectPermissionIndexes(nodes);
+        if (collection.requiredIndexes.length === 0)
+            continue;
+        const report = checkPermissionAuthorization(collection.requiredIndexes, permData);
+        if (!report.allAuthorized) {
+            score -= 30;
+            issues.push(`Machine ${machine.objectAddress.slice(0, 8)} has unauthorized permission indexes: [${report.missingIndexes.join(", ")}]`);
+        }
+        else {
+            score += 20;
+            issues.push(`Machine ${machine.objectAddress.slice(0, 8)}: all ${collection.requiredIndexes.length} permission index(es) authorized`);
+        }
+    }
+    return { name: "permission_safety", score: clampScore(score), weight: EXTENDED_DIMENSION_WEIGHTS.permission_safety, rationale: issues.join("; ") || "Permission checks passed" };
+}
 function evaluateWorthBuyingStub(input, llmPrompt) {
     const riskResult = evaluateRisk(input);
     const trustResult = evaluateTrust(input);
     const completenessResult = evaluateCompleteness(input);
+    const extendedDimensions = [
+        evaluateEscrowQuality(input),
+        evaluateProofIntegrity(input),
+        evaluateArbitrationFairness(input),
+        evaluateFeeTransparency(input),
+        evaluateTimeoutProtection(input),
+        evaluateSupplierVisibility(input),
+        evaluateContentCommitment(input),
+        evaluateReputationVerifiability(input),
+        evaluatePermissionSafety(input),
+    ];
+    const extendedSummary = extendedDimensions
+        .map(d => `${d.name}: ${d.score}/100 — ${d.rationale}`)
+        .join("\n");
     const summaryLines = [
         "=== RULE-BASED EVALUATION SUMMARY (F-08 enriched context) ===",
         "",
@@ -1517,6 +1880,9 @@ function evaluateWorthBuyingStub(input, llmPrompt) {
         `Completeness: ${completenessResult.score}/100 — ${completenessResult.summary}`,
         ...completenessResult.findings.slice(0, 3).map(f => `  - [${f.severity}] ${f.message}`),
         "",
+        "=== EXTENDED DIMENSIONS D16-D24 (GLM6/93) ===",
+        extendedSummary,
+        "",
         "=== END RULE-BASED SUMMARY ===",
         "",
     ];
@@ -1530,8 +1896,8 @@ function evaluateWorthBuyingStub(input, llmPrompt) {
         evaluationType: "worth_buying",
         score: 0,
         summary: "Requires LLM evaluation — semantic prompt assembled with rule-based " +
-            "context (risk/trust/completeness summary). Call save_evaluation with " +
-            "the LLM result.",
+            "context (risk/trust/completeness + D16-D24 extended dimensions). " +
+            "Call save_evaluation with the LLM result.",
         criterionScores: [],
         findings: [],
         strengths: [],

package/dist/project/game-theory.d.ts

@@ -0,0 +1,43 @@
+import type { SemanticObjectGraph } from "./semantic-graph.js";
+import type { BusinessIntent } from "./intent-analyzer.js";
+import type { BusinessModuleId } from "../extensions/business-modules.js";
+export type GameScenario = "merchant_may_deliver_late" | "merchant_may_abandon" | "customer_may_deny_acceptance" | "customer_may_false_claim" | "supplier_may_not_deliver";
+export interface GameTheoryConstraint {
+    scenario: GameScenario;
+    conflict: string;
+    userProtection: {
+        mechanism: string;
+        object: string;
+        guard?: string;
+    };
+    merchantConstraint: {
+        requiredDeposit?: boolean;
+        requiredArbitration?: boolean;
+        requiredProof?: string;
+        timeoutPenalty?: string;
+    };
+    evaluationMetric: string;
+    mitigationSignals: string[][];
+    mitigatingModules: BusinessModuleId[];
+    recommendation: string;
+}
+export interface GameTheoryCheckResult {
+    scenario: GameScenario;
+    conflict: string;
+    covered: boolean;
+    matchedSignals: string[];
+    partialSignals: string[];
+    userProtection: string;
+    evaluationMetric: string;
+    recommendation?: string;
+}
+export interface GameTheoryReport {
+    results: GameTheoryCheckResult[];
+    coveredCount: number;
+    totalCount: number;
+    exposedScenarios: GameScenario[];
+    wowAlignments: string[];
+    summary: string;
+}
+export declare const GAME_THEORY_CONSTRAINTS: GameTheoryConstraint[];
+export declare function checkGameTheoryConstraints(graph: SemanticObjectGraph, intent: BusinessIntent): GameTheoryReport;