@wowok/agent-mcp 2.7.0 → 2.7.2

package/dist/knowledge/progress-risk.js

@@ -1,461 +1 @@
-import { MAX_NAMED_OPERATOR_COUNT, MAX_NAMED_OPERATOR_ADDRESS_COUNT, MAX_CONTEXT_REPOSITORY_COUNT, } from "@wowok/wowok";
-const R_PR_1_01 = {
-    id: "R-PR-1-01",
-    category: "structural",
-    trigger: "named_operator addresses count > MAX_NAMED_OPERATOR_ADDRESS_COUNT (80)",
-    check: (ctx) => {
-        if (!ctx.progress_namedOperator)
-            return null;
-        const count = ctx.progress_namedOperator.operators.length;
-        if (count > MAX_NAMED_OPERATOR_ADDRESS_COUNT) {
-            return {
-                id: "R-PR-1-01",
-                level: "HIGH",
-                category: "structural",
-                title: "named_operator address count exceeds limit",
-                description: `named_operator "${ctx.progress_namedOperator.name}" has ${count} addresses, ` +
-                    `exceeds MAX_NAMED_OPERATOR_ADDRESS_COUNT ${MAX_NAMED_OPERATOR_ADDRESS_COUNT}. ` +
-                    `Move aborts with E_MAX_NAMED_OPERATOR_ADDRESS_COUNT.`,
-                affected_stakeholders: ["owner", "named_operator"],
-                scenario: "Adding > 80 addresses to a single named operator",
-                mitigation: "Split into multiple named_operator names, or remove inactive addresses first",
-                evidence: `addr_count=${count}`,
-            };
-        }
-        return null;
-    },
-};
-const R_PR_1_02 = {
-    id: "R-PR-1-02",
-    category: "structural",
-    trigger: "Adding new named_operator would exceed MAX_NAMED_OPERATOR_COUNT (60)",
-    check: (ctx) => {
-        if (!ctx.progress_namedOperator || ctx.progress_namedOperator.op !== "add")
-            return null;
-        const current = ctx.current_named_operator_count ?? 0;
-        if (current >= MAX_NAMED_OPERATOR_COUNT) {
-            return {
-                id: "R-PR-1-02",
-                level: "HIGH",
-                category: "structural",
-                title: "named_operator namespace count at limit",
-                description: `Progress already has ${current} named operators, ` +
-                    `at MAX_NAMED_OPERATOR_COUNT ${MAX_NAMED_OPERATOR_COUNT}. Adding a new name will abort with E_MAX_NAMED_OPERATOR_COUNT.`,
-                affected_stakeholders: ["owner"],
-                scenario: "Adding a 61st named_operator name to a full Progress",
-                mitigation: "Use 'set' on an existing name (replace address list), or remove an unused name first",
-                evidence: `named_operator_count=${current}`,
-            };
-        }
-        return null;
-    },
-};
-const R_PR_1_03 = {
-    id: "R-PR-1-03",
-    category: "structural",
-    trigger: "context_repository add would exceed MAX_CONTEXT_REPOSITORY_COUNT (30)",
-    check: (ctx) => {
-        if (!ctx.repository)
-            return null;
-        if (ctx.repository.op === "clear")
-            return null;
-        const addCount = ctx.repository.op === "remove" ? 0 : ctx.repository.objects.length;
-        if (addCount === 0)
-            return null;
-        const current = ctx.current_context_repository_count ?? 0;
-        if (current + addCount > MAX_CONTEXT_REPOSITORY_COUNT) {
-            return {
-                id: "R-PR-1-03",
-                level: "HIGH",
-                category: "structural",
-                title: "context_repository count exceeds limit",
-                description: `Progress has ${current} repositories, adding ${addCount} would total ${current + addCount}, ` +
-                    `exceeds MAX_CONTEXT_REPOSITORY_COUNT ${MAX_CONTEXT_REPOSITORY_COUNT}. Move aborts with E_MAX_CONTEXT_REPOSITORY_COUNT.`,
-                affected_stakeholders: ["owner"],
-                scenario: "Adding too many context repositories",
-                mitigation: "Remove unused repositories first, or use repository 'set' to replace the list",
-                evidence: `current=${current}, add=${addCount}`,
-            };
-        }
-        return null;
-    },
-};
-const R_PR_1_04 = {
-    id: "R-PR-1-04",
-    category: "structural",
-    trigger: "named_operator name is empty string but is_order_holder_namespace=false",
-    check: (ctx) => {
-        if (!ctx.progress_namedOperator)
-            return null;
-        if (ctx.progress_namedOperator.name === "" && ctx.progress_namedOperator.op !== "remove") {
-            return {
-                id: "R-PR-1-04",
-                level: "MEDIUM",
-                category: "structural",
-                title: "named_operator name is empty (OrderHolder namespace)",
-                description: `progress_namedOperator.name="" — empty string maps to the OrderHolder namespace ` +
-                    `(machine::init_node_name()). This is typically set by service::buy, not by direct user op. ` +
-                    `Manual manipulation may overwrite order-payer authorization.`,
-                affected_stakeholders: ["owner", "named_operator"],
-                scenario: "User manually setting the empty-name namespace",
-                mitigation: "If intentional (e.g. order_owner_set internal call), confirm. Otherwise use a non-empty name.",
-                evidence: `name=""`,
-            };
-        }
-        return null;
-    },
-};
-const R_PR_2_01 = {
-    id: "R-PR-2-01",
-    category: "semantic",
-    trigger: "task_set on Progress that already has a task (E_TASK_ALREADY_SET)",
-    check: (ctx) => {
-        if (!ctx.task)
-            return null;
-        if (ctx.current_task !== null && ctx.current_task !== undefined) {
-            return {
-                id: "R-PR-2-01",
-                level: "HIGH",
-                category: "semantic",
-                title: "task_set on already-bound Progress (irreversible)",
-                description: `Progress already has task=${ctx.current_task}. task_set is one-time; ` +
-                    `Move aborts with E_TASK_ALREADY_SET. There is no way to change the task after first set.`,
-                affected_stakeholders: ["owner", "submitter"],
-                scenario: "User tries to rebind Progress to a different Order",
-                mitigation: "Create a new Progress via service::buy with the new Order; the old Progress is permanently bound",
-                evidence: `current_task=${ctx.current_task}`,
-            };
-        }
-        return null;
-    },
-};
-const R_PR_2_02 = {
-    id: "R-PR-2-02",
-    category: "semantic",
-    trigger: "operate.message exceeds MAX_LONG_NAME_LENGTH (long-name constraint)",
-    check: (ctx) => {
-        if (!ctx.operate?.message)
-            return null;
-        const msg = ctx.operate.message;
-        if (msg.length > 1024) {
-            return {
-                id: "R-PR-2-02",
-                level: "MEDIUM",
-                category: "semantic",
-                title: "operate.message exceeds long-name length",
-                description: `operate.message length ${msg.length} exceeds MAX_LONG_NAME_LENGTH (1024). ` +
-                    `Move aborts in common::LONG_NAME check.`,
-                affected_stakeholders: ["submitter"],
-                scenario: "Long deliverable message",
-                mitigation: "Truncate message to ≤ 1024 chars; store full payload in a context Repository",
-                evidence: `msg_len=${msg.length}`,
-            };
-        }
-        return null;
-    },
-};
-const R_PR_2_03 = {
-    id: "R-PR-2-03",
-    category: "semantic",
-    trigger: "operate.op is not a valid enum value (schema-enforced, defense-in-depth)",
-    check: (ctx) => {
-        if (!ctx.operate)
-            return null;
-        const validOps = ["next", "hold", "unhold", "adminUnhold"];
-        if (ctx.operate.op && !validOps.includes(ctx.operate.op)) {
-            return {
-                id: "R-PR-2-03",
-                level: "HIGH",
-                category: "semantic",
-                title: `operate.op must be one of: ${validOps.join(", ")}`,
-                description: `op enum selects the Move function: next=accomplish, hold=hold(bHold=true), ` +
-                    `unhold=hold(bHold=false), adminUnhold=unhold (224 permission).`,
-                affected_stakeholders: ["submitter"],
-                scenario: "Schema validation bypassed or stale client",
-                mitigation: `Use one of: ${validOps.join(", ")}`,
-                evidence: `op=${ctx.operate.op}`,
-            };
-        }
-        return null;
-    },
-};
-const R_PR_3_01 = {
-    id: "R-PR-3-01",
-    category: "permission",
-    trigger: "op='adminUnhold' (224 permission) — force release bypassing holder check",
-    check: (ctx) => {
-        if (ctx.operate?.op !== "adminUnhold")
-            return null;
-        return {
-            id: "R-PR-3-01",
-            level: "HIGH",
-            category: "permission",
-            title: "adminUnhold bypasses holder check (broad blast radius)",
-            description: `adminUnhold uses 224 permission to release a held forward WITHOUT verifying sender == holder. ` +
-                `If 224 is granted too broadly, any 224-holder can release ANY held forward in this Progress.`,
-            affected_stakeholders: ["owner", "named_operator", "submitter"],
-            scenario: "Admin force-releases a forward that the original holder still wanted held",
-            mitigation: "1) Grant 224 only to dedicated recovery addresses. 2) Log every adminUnhold for audit. " +
-                "3) Prefer normal unhold (holder self-release) when possible.",
-            evidence: `adminUnhold=true, forward=${ctx.operate.operation.forward}`,
-        };
-    },
-};
-const R_PR_3_02 = {
-    id: "R-PR-3-02",
-    category: "permission",
-    trigger: "namedOperator short-circuit bypasses 220-225 permission check",
-    check: (ctx) => {
-        if (!ctx.operate)
-            return null;
-        if (ctx.forward_named_operator && ctx.forward_named_operator !== "") {
-            return {
-                id: "R-PR-3-02",
-                level: "MEDIUM",
-                category: "permission",
-                title: "Forward advance via named_operator short-circuits 220-225 check",
-                description: `Forward "${ctx.operate.operation.forward}" uses namedOperator="${ctx.forward_named_operator}". ` +
-                    `Move's ASSERT_PERMISSION returns immediately if IsNamedOperator() succeeds, WITHOUT checking ` +
-                    `any permission index. Anyone in the named_operator list can advance this forward.`,
-                affected_stakeholders: ["owner", "named_operator"],
-                scenario: "Operator list too permissive (e.g. includes expired/compromised addresses)",
-                mitigation: "1) Keep named_operator lists minimal. 2) Use namedOperator_remove to revoke access promptly. " +
-                    "3) For sensitive forwards, prefer Forward.permissionIndex (Some) for dual-check.",
-                evidence: `named_operator=${ctx.forward_named_operator}`,
-            };
-        }
-        return null;
-    },
-};
-const R_PR_3_03 = {
-    id: "R-PR-3-03",
-    category: "permission",
-    trigger: "Forward has guard (Some) — Passport required but not provided",
-    check: (ctx) => {
-        if (!ctx.operate)
-            return null;
-        if (ctx.forward_has_guard && !ctx.forward_permission_index) {
-            return {
-                id: "R-PR-3-03",
-                level: "HIGH",
-                category: "permission",
-                title: "Forward guard requires Passport",
-                description: `Forward "${ctx.operate.operation.forward}" has a guard (Some). ` +
-                    `Move's next_imp asserts E_NEED_PASSPORT for guarded forwards when called without passport. ` +
-                    `Use next_with_passport / order_next_with_passport instead.`,
-                affected_stakeholders: ["submitter"],
-                scenario: "User calls next() on a guarded forward without passport",
-                mitigation: "Submit via *_with_passport variant; ensure submission data is valid for the Guard",
-                evidence: `forward=${ctx.operate.operation.forward}, has_guard=${ctx.forward_has_guard}`,
-            };
-        }
-        return null;
-    },
-};
-const R_PR_4_01 = {
-    id: "R-PR-4-01",
-    category: "lifecycle",
-    trigger: "Machine not published — Progress cannot be created",
-    check: (ctx) => {
-        if (ctx.machine_published === false) {
-            return {
-                id: "R-PR-4-01",
-                level: "CRITICAL",
-                category: "lifecycle",
-                title: "Machine not published — Progress creation blocked",
-                description: `Machine ${ctx.current_machine ?? "(unknown)"} is not published. ` +
-                    `Progress requires a published Machine (machine::on_progress_new asserts published state). ` +
-                    `All Progress ops will fail with E_MACHINE_NOT_MATCH or similar.`,
-                affected_stakeholders: ["owner"],
-                scenario: "User attempts to create Progress before Machine publish",
-                mitigation: "Publish the Machine first (machine::publish, 205 permission), then create Progress",
-                evidence: `machine=${ctx.current_machine}, published=false`,
-            };
-        }
-        return null;
-    },
-};
-const R_PR_4_02 = {
-    id: "R-PR-4-02",
-    category: "lifecycle",
-    trigger: "operate on already-accomplished forward (E_FORWARD_ALREADY_ACCOMPLISHED)",
-    check: (ctx) => {
-        if (!ctx.operate)
-            return null;
-        if (ctx.forward_already_accomplished) {
-            return {
-                id: "R-PR-4-02",
-                level: "MEDIUM",
-                category: "lifecycle",
-                title: "Forward already accomplished — re-hold blocked",
-                description: `Forward "${ctx.operate.operation.forward}" to "${ctx.operate.operation.next_node_name}" ` +
-                    `is already accomplished. Move aborts with E_FORWARD_ALREADY_ACCOMPLISHED on any re-hold attempt.`,
-                affected_stakeholders: ["submitter"],
-                scenario: "User retries an already-completed forward (race condition or stale state)",
-                mitigation: "Query Progress.current — if already past target, no action needed; if parallel session, use a different forward",
-                evidence: `forward=${ctx.operate.operation.forward}, accomplished=true`,
-            };
-        }
-        return null;
-    },
-};
-const R_PR_4_03 = {
-    id: "R-PR-4-03",
-    category: "lifecycle",
-    trigger: "unhold by non-holder without 224 permission (E_NOT_THE_HOLDER)",
-    check: (ctx) => {
-        if (!ctx.operate || ctx.operate.op !== "unhold")
-            return null;
-        if (ctx.holder_address && ctx.signer && ctx.holder_address !== ctx.signer) {
-            return {
-                id: "R-PR-4-03",
-                level: "HIGH",
-                category: "lifecycle",
-                title: "unhold by non-holder — Move will abort E_NOT_THE_HOLDER",
-                description: `Forward is held by ${ctx.holder_address}, but signer is ${ctx.signer}. ` +
-                    `Move aborts with E_NOT_THE_HOLDER unless signer has 224 permission (adminUnhold path).`,
-                affected_stakeholders: ["submitter"],
-                scenario: "User other than holder tries to release a hold",
-                mitigation: "1) Have the original holder call unhold. 2) If holder is unresponsive, use adminUnhold=true (requires 224).",
-                evidence: `holder=${ctx.holder_address}, signer=${ctx.signer}`,
-            };
-        }
-        return null;
-    },
-};
-const R_PR_5_01 = {
-    id: "R-PR-5-01",
-    category: "cross_object",
-    trigger: "operate.order_next called but progress.task != order address (E_ORDER_NOT_MATCH)",
-    check: (ctx) => {
-        if (!ctx.operate)
-            return null;
-        if (ctx.current_task && ctx.signer) {
-            return null;
-        }
-        return null;
-    },
-};
-const R_PR_5_02 = {
-    id: "R-PR-5-02",
-    category: "cross_object",
-    trigger: "context_repository_add without Registrar affiliation check",
-    check: (ctx) => {
-        if (!ctx.repository || ctx.repository.op !== "add")
-            return null;
-        return {
-            id: "R-PR-5-02",
-            level: "LOW",
-            category: "cross_object",
-            title: "context_repository_add creates Registrar affiliation",
-            description: `Adding ${ctx.repository.objects.length} repository(ies) creates Registrar affiliation ` +
-                `entries. If the Repository is later removed (disaffiliation), cross-object queries ` +
-                `that depend on it will return empty results without warning.`,
-            affected_stakeholders: ["owner", "system"],
-            scenario: "Repository deleted while Progress still references it",
-            mitigation: "Use context_repository_remove before deleting a Repository; audit affiliations periodically",
-            evidence: `add_count=${ctx.repository.objects.length}`,
-        };
-    },
-};
-const R_PR_5_03 = {
-    id: "R-PR-5-03",
-    category: "cross_object",
-    trigger: "Permission used by Progress is shared with other host objects",
-    check: (ctx) => {
-        if (!ctx.target_objects_types || ctx.target_objects_types.length < 2)
-            return null;
-        const uniqueTypes = new Set(ctx.target_objects_types);
-        if (uniqueTypes.size > 1) {
-            return {
-                id: "R-PR-5-03",
-                level: "MEDIUM",
-                category: "cross_object",
-                title: "Permission shared across heterogeneous host objects",
-                description: `Single Permission applied to ${[...uniqueTypes].join(", ")}. ` +
-                    `Progress builtin indexes (220-225) have different semantics per host object; ` +
-                    `granting 221 (PROGRESS_NAMED_OPERATOR) to a non-Progress entity is meaningless.`,
-                affected_stakeholders: ["owner"],
-                scenario: "One Permission for both Progress and Machine",
-                mitigation: "Use separate Permission objects per host object type",
-                evidence: `types=${[...uniqueTypes].join(",")}`,
-            };
-        }
-        return null;
-    },
-};
-const R_PR_5_04 = {
-    id: "R-PR-5-04",
-    category: "cross_object",
-    trigger: "Progress without bound Order (order=null) — order_next/order_hold blocked",
-    check: (ctx) => {
-        if (!ctx.operate)
-            return null;
-        if (ctx.current_task === null && ctx.operate.op !== undefined) {
-            return {
-                id: "R-PR-5-04",
-                level: "MEDIUM",
-                category: "cross_object",
-                title: "operate without bound Order — order_next/order_hold unavailable",
-                description: `Progress has no bound task (task=null). order_next and order_hold require ` +
-                    `progress.task == order address (E_ORDER_NOT_MATCH). Use plain next()/hold() instead.`,
-                affected_stakeholders: ["submitter"],
-                scenario: "User tries order variant on a task-less Progress",
-                mitigation: "Use non-order next()/hold() variant, OR call task_set first to bind an Order",
-                evidence: `task=null`,
-            };
-        }
-        return null;
-    },
-};
-const ALL_RULES = [
-    R_PR_1_01, R_PR_1_02, R_PR_1_03, R_PR_1_04,
-    R_PR_2_01, R_PR_2_02, R_PR_2_03,
-    R_PR_3_01, R_PR_3_02, R_PR_3_03,
-    R_PR_4_01, R_PR_4_02, R_PR_4_03,
-    R_PR_5_01, R_PR_5_02, R_PR_5_03, R_PR_5_04,
-];
-export const PROGRESS_RISK_VERSION = "1.0.0";
-export function getAllProgressRiskRules() {
-    return [...ALL_RULES];
-}
-export function getProgressRiskRulesCount() {
-    return ALL_RULES.length;
-}
-export function getProgressRiskRulesByCategory(category) {
-    return ALL_RULES.filter(r => r.category === category);
-}
-export function assessProgressRisks(ctx) {
-    const risks = [];
-    for (const rule of ALL_RULES) {
-        const r = rule.check(ctx);
-        if (r)
-            risks.push(r);
-    }
-    const overall = risks.length === 0
-        ? "LOW"
-        : risks.some(r => r.level === "CRITICAL") ? "CRITICAL"
-            : risks.some(r => r.level === "HIGH") ? "HIGH"
-                : risks.some(r => r.level === "MEDIUM") ? "MEDIUM"
-                    : "LOW";
-    const byCategory = {};
-    for (const r of risks) {
-        byCategory[r.category] = (byCategory[r.category] ?? 0) + 1;
-    }
-    const advice = {};
-    for (const r of risks) {
-        for (const s of r.affected_stakeholders) {
-            if (!advice[s])
-                advice[s] = [];
-            advice[s].push(`${r.id}: ${r.mitigation}`);
-        }
-    }
-    return {
-        summary: `Assessed ${risks.length} risk(s) across ${Object.keys(byCategory).length} categories`,
-        risks,
-        overall_risk: overall,
-        risks_by_category: byCategory,
-        stakeholder_advice: advice,
-        needs_human_review: risks.some(r => r.level === "CRITICAL" || r.level === "HIGH"),
-    };
-}
+import{MAX_NAMED_OPERATOR_COUNT,MAX_NAMED_OPERATOR_ADDRESS_COUNT,MAX_CONTEXT_REPOSITORY_COUNT}from'@wowok/wowok';const R_PR_1_01={'id':'R-PR-1-01','category':'structural','trigger':'named_operator\x20addresses\x20count\x20>\x20MAX_NAMED_OPERATOR_ADDRESS_COUNT\x20(80)','check':a=>{if(!a['progress_namedOperator'])return null;const b=a['progress_namedOperator']['operators']['length'];if(b>MAX_NAMED_OPERATOR_ADDRESS_COUNT)return{'id':'R-PR-1-01','level':'HIGH','category':'structural','title':'named_operator\x20address\x20count\x20exceeds\x20limit','description':'named_operator\x20\x22'+a['progress_namedOperator']['name']+'\x22\x20has\x20'+b+'\x20addresses,\x20'+('exceeds\x20MAX_NAMED_OPERATOR_ADDRESS_COUNT\x20'+MAX_NAMED_OPERATOR_ADDRESS_COUNT+'.\x20')+'Move\x20aborts\x20with\x20E_MAX_NAMED_OPERATOR_ADDRESS_COUNT.','affected_stakeholders':['owner','named_operator'],'scenario':'Adding\x20>\x2080\x20addresses\x20to\x20a\x20single\x20named\x20operator','mitigation':'Split\x20into\x20multiple\x20named_operator\x20names,\x20or\x20remove\x20inactive\x20addresses\x20first','evidence':'addr_count='+b};return null;}},R_PR_1_02={'id':'R-PR-1-02','category':'structural','trigger':'Adding\x20new\x20named_operator\x20would\x20exceed\x20MAX_NAMED_OPERATOR_COUNT\x20(60)','check':a=>{if(!a['progress_namedOperator']||a['progress_namedOperator']['op']!=='add')return null;const b=a['current_named_operator_count']??0x0;if(b>=MAX_NAMED_OPERATOR_COUNT)return{'id':'R-PR-1-02','level':'HIGH','category':'structural','title':'named_operator\x20namespace\x20count\x20at\x20limit','description':'Progress\x20already\x20has\x20'+b+'\x20named\x20operators,\x20'+('at\x20MAX_NAMED_OPERATOR_COUNT\x20'+MAX_NAMED_OPERATOR_COUNT+'.\x20Adding\x20a\x20new\x20name\x20will\x20abort\x20with\x20E_MAX_NAMED_OPERATOR_COUNT.'),'affected_stakeholders':['owner'],'scenario':'Adding\x20a\x2061st\x20named_operator\x20name\x20to\x20a\x20full\x20Progress','mitigation':'Use\x20\x27set\x27\x20on\x20an\x20existing\x20name\x20(replace\x20address\x20list),\x20or\x20remove\x20an\x20unused\x20name\x20first','evidence':'named_operator_count='+b};return null;}},R_PR_1_03={'id':'R-PR-1-03','category':'structural','trigger':'context_repository\x20add\x20would\x20exceed\x20MAX_CONTEXT_REPOSITORY_COUNT\x20(30)','check':a=>{if(!a['repository'])return null;if(a['repository']['op']==='clear')return null;const b=a['repository']['op']==='remove'?0x0:a['repository']['objects']['length'];if(b===0x0)return null;const c=a['current_context_repository_count']??0x0;if(c+b>MAX_CONTEXT_REPOSITORY_COUNT)return{'id':'R-PR-1-03','level':'HIGH','category':'structural','title':'context_repository\x20count\x20exceeds\x20limit','description':'Progress\x20has\x20'+c+'\x20repositories,\x20adding\x20'+b+'\x20would\x20total\x20'+(c+b)+',\x20'+('exceeds\x20MAX_CONTEXT_REPOSITORY_COUNT\x20'+MAX_CONTEXT_REPOSITORY_COUNT+'.\x20Move\x20aborts\x20with\x20E_MAX_CONTEXT_REPOSITORY_COUNT.'),'affected_stakeholders':['owner'],'scenario':'Adding\x20too\x20many\x20context\x20repositories','mitigation':'Remove\x20unused\x20repositories\x20first,\x20or\x20use\x20repository\x20\x27set\x27\x20to\x20replace\x20the\x20list','evidence':'current='+c+',\x20add='+b};return null;}},R_PR_1_04={'id':'R-PR-1-04','category':'structural','trigger':'named_operator\x20name\x20is\x20empty\x20string\x20but\x20is_order_holder_namespace=false','check':a=>{if(!a['progress_namedOperator'])return null;if(a['progress_namedOperator']['name']===''&&a['progress_namedOperator']['op']!=='remove')return{'id':'R-PR-1-04','level':'MEDIUM','category':'structural','title':'named_operator\x20name\x20is\x20empty\x20(OrderHolder\x20namespace)','description':'progress_namedOperator.name=\x22\x22\x20—\x20empty\x20string\x20maps\x20to\x20the\x20OrderHolder\x20namespace\x20'+'(machine::init_node_name()).\x20This\x20is\x20typically\x20set\x20by\x20service::buy,\x20not\x20by\x20direct\x20user\x20op.\x20'+'Manual\x20manipulation\x20may\x20overwrite\x20order-payer\x20authorization.','affected_stakeholders':['owner','named_operator'],'scenario':'User\x20manually\x20setting\x20the\x20empty-name\x20namespace','mitigation':'If\x20intentional\x20(e.g.\x20order_owner_set\x20internal\x20call),\x20confirm.\x20Otherwise\x20use\x20a\x20non-empty\x20name.','evidence':'name=\x22\x22'};return null;}},R_PR_2_01={'id':'R-PR-2-01','category':'semantic','trigger':'task_set\x20on\x20Progress\x20that\x20already\x20has\x20a\x20task\x20(E_TASK_ALREADY_SET)','check':a=>{if(!a['task'])return null;if(a['current_task']!==null&&a['current_task']!==undefined)return{'id':'R-PR-2-01','level':'HIGH','category':'semantic','title':'task_set\x20on\x20already-bound\x20Progress\x20(irreversible)','description':'Progress\x20already\x20has\x20task='+a['current_task']+'.\x20task_set\x20is\x20one-time;\x20'+'Move\x20aborts\x20with\x20E_TASK_ALREADY_SET.\x20There\x20is\x20no\x20way\x20to\x20change\x20the\x20task\x20after\x20first\x20set.','affected_stakeholders':['owner','submitter'],'scenario':'User\x20tries\x20to\x20rebind\x20Progress\x20to\x20a\x20different\x20Order','mitigation':'Create\x20a\x20new\x20Progress\x20via\x20service::buy\x20with\x20the\x20new\x20Order;\x20the\x20old\x20Progress\x20is\x20permanently\x20bound','evidence':'current_task='+a['current_task']};return null;}},R_PR_2_02={'id':'R-PR-2-02','category':'semantic','trigger':'operate.message\x20exceeds\x20MAX_LONG_NAME_LENGTH\x20(long-name\x20constraint)','check':a=>{if(!a['operate']?.['message'])return null;const b=a['operate']['message'];if(b['length']>0x400)return{'id':'R-PR-2-02','level':'MEDIUM','category':'semantic','title':'operate.message\x20exceeds\x20long-name\x20length','description':'operate.message\x20length\x20'+b['length']+'\x20exceeds\x20MAX_LONG_NAME_LENGTH\x20(1024).\x20'+'Move\x20aborts\x20in\x20common::LONG_NAME\x20check.','affected_stakeholders':['submitter'],'scenario':'Long\x20deliverable\x20message','mitigation':'Truncate\x20message\x20to\x20≤\x201024\x20chars;\x20store\x20full\x20payload\x20in\x20a\x20context\x20Repository','evidence':'msg_len='+b['length']};return null;}},R_PR_2_03={'id':'R-PR-2-03','category':'semantic','trigger':'operate.op\x20is\x20not\x20a\x20valid\x20enum\x20value\x20(schema-enforced,\x20defense-in-depth)','check':a=>{if(!a['operate'])return null;const b=['next','hold','unhold','adminUnhold'];if(a['operate']['op']&&!b['includes'](a['operate']['op']))return{'id':'R-PR-2-03','level':'HIGH','category':'semantic','title':'operate.op\x20must\x20be\x20one\x20of:\x20'+b['join'](',\x20'),'description':'op\x20enum\x20selects\x20the\x20Move\x20function:\x20next=accomplish,\x20hold=hold(bHold=true),\x20'+'unhold=hold(bHold=false),\x20adminUnhold=unhold\x20(224\x20permission).','affected_stakeholders':['submitter'],'scenario':'Schema\x20validation\x20bypassed\x20or\x20stale\x20client','mitigation':'Use\x20one\x20of:\x20'+b['join'](',\x20'),'evidence':'op='+a['operate']['op']};return null;}},R_PR_3_01={'id':'R-PR-3-01','category':'permission','trigger':'op=\x27adminUnhold\x27\x20(224\x20permission)\x20—\x20force\x20release\x20bypassing\x20holder\x20check','check':a=>{if(a['operate']?.['op']!=='adminUnhold')return null;return{'id':'R-PR-3-01','level':'HIGH','category':'permission','title':'adminUnhold\x20bypasses\x20holder\x20check\x20(broad\x20blast\x20radius)','description':'adminUnhold\x20uses\x20224\x20permission\x20to\x20release\x20a\x20held\x20forward\x20WITHOUT\x20verifying\x20sender\x20==\x20holder.\x20'+'If\x20224\x20is\x20granted\x20too\x20broadly,\x20any\x20224-holder\x20can\x20release\x20ANY\x20held\x20forward\x20in\x20this\x20Progress.','affected_stakeholders':['owner','named_operator','submitter'],'scenario':'Admin\x20force-releases\x20a\x20forward\x20that\x20the\x20original\x20holder\x20still\x20wanted\x20held','mitigation':'1)\x20Grant\x20224\x20only\x20to\x20dedicated\x20recovery\x20addresses.\x202)\x20Log\x20every\x20adminUnhold\x20for\x20audit.\x20'+'3)\x20Prefer\x20normal\x20unhold\x20(holder\x20self-release)\x20when\x20possible.','evidence':'adminUnhold=true,\x20forward='+a['operate']['operation']['forward']};}},R_PR_3_02={'id':'R-PR-3-02','category':'permission','trigger':'namedOperator\x20short-circuit\x20bypasses\x20220-225\x20permission\x20check','check':a=>{if(!a['operate'])return null;if(a['forward_named_operator']&&a['forward_named_operator']!=='')return{'id':'R-PR-3-02','level':'MEDIUM','category':'permission','title':'Forward\x20advance\x20via\x20named_operator\x20short-circuits\x20220-225\x20check','description':'Forward\x20\x22'+a['operate']['operation']['forward']+'\x22\x20uses\x20namedOperator=\x22'+a['forward_named_operator']+'\x22.\x20'+'Move\x27s\x20ASSERT_PERMISSION\x20returns\x20immediately\x20if\x20IsNamedOperator()\x20succeeds,\x20WITHOUT\x20checking\x20'+'any\x20permission\x20index.\x20Anyone\x20in\x20the\x20named_operator\x20list\x20can\x20advance\x20this\x20forward.','affected_stakeholders':['owner','named_operator'],'scenario':'Operator\x20list\x20too\x20permissive\x20(e.g.\x20includes\x20expired/compromised\x20addresses)','mitigation':'1)\x20Keep\x20named_operator\x20lists\x20minimal.\x202)\x20Use\x20namedOperator_remove\x20to\x20revoke\x20access\x20promptly.\x20'+'3)\x20For\x20sensitive\x20forwards,\x20prefer\x20Forward.permissionIndex\x20(Some)\x20for\x20dual-check.','evidence':'named_operator='+a['forward_named_operator']};return null;}},R_PR_3_03={'id':'R-PR-3-03','category':'permission','trigger':'Forward\x20has\x20guard\x20(Some)\x20—\x20Passport\x20required\x20but\x20not\x20provided','check':a=>{if(!a['operate'])return null;if(a['forward_has_guard']&&!a['forward_permission_index'])return{'id':'R-PR-3-03','level':'HIGH','category':'permission','title':'Forward\x20guard\x20requires\x20Passport','description':'Forward\x20\x22'+a['operate']['operation']['forward']+'\x22\x20has\x20a\x20guard\x20(Some).\x20'+'Move\x27s\x20next_imp\x20asserts\x20E_NEED_PASSPORT\x20for\x20guarded\x20forwards\x20when\x20called\x20without\x20passport.\x20'+'Use\x20next_with_passport\x20/\x20order_next_with_passport\x20instead.','affected_stakeholders':['submitter'],'scenario':'User\x20calls\x20next()\x20on\x20a\x20guarded\x20forward\x20without\x20passport','mitigation':'Submit\x20via\x20*_with_passport\x20variant;\x20ensure\x20submission\x20data\x20is\x20valid\x20for\x20the\x20Guard','evidence':'forward='+a['operate']['operation']['forward']+',\x20has_guard='+a['forward_has_guard']};return null;}},R_PR_4_01={'id':'R-PR-4-01','category':'lifecycle','trigger':'Machine\x20not\x20published\x20—\x20Progress\x20cannot\x20be\x20created','check':a=>{if(a['machine_published']===![])return{'id':'R-PR-4-01','level':'CRITICAL','category':'lifecycle','title':'Machine\x20not\x20published\x20—\x20Progress\x20creation\x20blocked','description':'Machine\x20'+(a['current_machine']??'(unknown)')+'\x20is\x20not\x20published.\x20'+'Progress\x20requires\x20a\x20published\x20Machine\x20(machine::on_progress_new\x20asserts\x20published\x20state).\x20'+'All\x20Progress\x20ops\x20will\x20fail\x20with\x20E_MACHINE_NOT_MATCH\x20or\x20similar.','affected_stakeholders':['owner'],'scenario':'User\x20attempts\x20to\x20create\x20Progress\x20before\x20Machine\x20publish','mitigation':'Publish\x20the\x20Machine\x20first\x20(machine::publish,\x20205\x20permission),\x20then\x20create\x20Progress','evidence':'machine='+a['current_machine']+',\x20published=false'};return null;}},R_PR_4_02={'id':'R-PR-4-02','category':'lifecycle','trigger':'operate\x20on\x20already-accomplished\x20forward\x20(E_FORWARD_ALREADY_ACCOMPLISHED)','check':a=>{if(!a['operate'])return null;if(a['forward_already_accomplished'])return{'id':'R-PR-4-02','level':'MEDIUM','category':'lifecycle','title':'Forward\x20already\x20accomplished\x20—\x20re-hold\x20blocked','description':'Forward\x20\x22'+a['operate']['operation']['forward']+'\x22\x20to\x20\x22'+a['operate']['operation']['next_node_name']+'\x22\x20'+'is\x20already\x20accomplished.\x20Move\x20aborts\x20with\x20E_FORWARD_ALREADY_ACCOMPLISHED\x20on\x20any\x20re-hold\x20attempt.','affected_stakeholders':['submitter'],'scenario':'User\x20retries\x20an\x20already-completed\x20forward\x20(race\x20condition\x20or\x20stale\x20state)','mitigation':'Query\x20Progress.current\x20—\x20if\x20already\x20past\x20target,\x20no\x20action\x20needed;\x20if\x20parallel\x20session,\x20use\x20a\x20different\x20forward','evidence':'forward='+a['operate']['operation']['forward']+',\x20accomplished=true'};return null;}},R_PR_4_03={'id':'R-PR-4-03','category':'lifecycle','trigger':'unhold\x20by\x20non-holder\x20without\x20224\x20permission\x20(E_NOT_THE_HOLDER)','check':a=>{if(!a['operate']||a['operate']['op']!=='unhold')return null;if(a['holder_address']&&a['signer']&&a['holder_address']!==a['signer'])return{'id':'R-PR-4-03','level':'HIGH','category':'lifecycle','title':'unhold\x20by\x20non-holder\x20—\x20Move\x20will\x20abort\x20E_NOT_THE_HOLDER','description':'Forward\x20is\x20held\x20by\x20'+a['holder_address']+',\x20but\x20signer\x20is\x20'+a['signer']+'.\x20'+'Move\x20aborts\x20with\x20E_NOT_THE_HOLDER\x20unless\x20signer\x20has\x20224\x20permission\x20(adminUnhold\x20path).','affected_stakeholders':['submitter'],'scenario':'User\x20other\x20than\x20holder\x20tries\x20to\x20release\x20a\x20hold','mitigation':'1)\x20Have\x20the\x20original\x20holder\x20call\x20unhold.\x202)\x20If\x20holder\x20is\x20unresponsive,\x20use\x20adminUnhold=true\x20(requires\x20224).','evidence':'holder='+a['holder_address']+',\x20signer='+a['signer']};return null;}},R_PR_5_01={'id':'R-PR-5-01','category':'cross_object','trigger':'operate.order_next\x20called\x20but\x20progress.task\x20!=\x20order\x20address\x20(E_ORDER_NOT_MATCH)','check':a=>{if(!a['operate'])return null;if(a['current_task']&&a['signer'])return null;return null;}},R_PR_5_02={'id':'R-PR-5-02','category':'cross_object','trigger':'context_repository_add\x20without\x20Registrar\x20affiliation\x20check','check':a=>{if(!a['repository']||a['repository']['op']!=='add')return null;return{'id':'R-PR-5-02','level':'LOW','category':'cross_object','title':'context_repository_add\x20creates\x20Registrar\x20affiliation','description':'Adding\x20'+a['repository']['objects']['length']+'\x20repository(ies)\x20creates\x20Registrar\x20affiliation\x20'+'entries.\x20If\x20the\x20Repository\x20is\x20later\x20removed\x20(disaffiliation),\x20cross-object\x20queries\x20'+'that\x20depend\x20on\x20it\x20will\x20return\x20empty\x20results\x20without\x20warning.','affected_stakeholders':['owner','system'],'scenario':'Repository\x20deleted\x20while\x20Progress\x20still\x20references\x20it','mitigation':'Use\x20context_repository_remove\x20before\x20deleting\x20a\x20Repository;\x20audit\x20affiliations\x20periodically','evidence':'add_count='+a['repository']['objects']['length']};}},R_PR_5_03={'id':'R-PR-5-03','category':'cross_object','trigger':'Permission\x20used\x20by\x20Progress\x20is\x20shared\x20with\x20other\x20host\x20objects','check':a=>{if(!a['target_objects_types']||a['target_objects_types']['length']<0x2)return null;const b=new Set(a['target_objects_types']);if(b['size']>0x1)return{'id':'R-PR-5-03','level':'MEDIUM','category':'cross_object','title':'Permission\x20shared\x20across\x20heterogeneous\x20host\x20objects','description':'Single\x20Permission\x20applied\x20to\x20'+[...b]['join'](',\x20')+'.\x20'+'Progress\x20builtin\x20indexes\x20(220-225)\x20have\x20different\x20semantics\x20per\x20host\x20object;\x20'+'granting\x20221\x20(PROGRESS_NAMED_OPERATOR)\x20to\x20a\x20non-Progress\x20entity\x20is\x20meaningless.','affected_stakeholders':['owner'],'scenario':'One\x20Permission\x20for\x20both\x20Progress\x20and\x20Machine','mitigation':'Use\x20separate\x20Permission\x20objects\x20per\x20host\x20object\x20type','evidence':'types='+[...b]['join'](',')};return null;}},R_PR_5_04={'id':'R-PR-5-04','category':'cross_object','trigger':'Progress\x20without\x20bound\x20Order\x20(order=null)\x20—\x20order_next/order_hold\x20blocked','check':a=>{if(!a['operate'])return null;if(a['current_task']===null&&a['operate']['op']!==undefined)return{'id':'R-PR-5-04','level':'MEDIUM','category':'cross_object','title':'operate\x20without\x20bound\x20Order\x20—\x20order_next/order_hold\x20unavailable','description':'Progress\x20has\x20no\x20bound\x20task\x20(task=null).\x20order_next\x20and\x20order_hold\x20require\x20'+'progress.task\x20==\x20order\x20address\x20(E_ORDER_NOT_MATCH).\x20Use\x20plain\x20next()/hold()\x20instead.','affected_stakeholders':['submitter'],'scenario':'User\x20tries\x20order\x20variant\x20on\x20a\x20task-less\x20Progress','mitigation':'Use\x20non-order\x20next()/hold()\x20variant,\x20OR\x20call\x20task_set\x20first\x20to\x20bind\x20an\x20Order','evidence':'task=null'};return null;}},ALL_RULES=[R_PR_1_01,R_PR_1_02,R_PR_1_03,R_PR_1_04,R_PR_2_01,R_PR_2_02,R_PR_2_03,R_PR_3_01,R_PR_3_02,R_PR_3_03,R_PR_4_01,R_PR_4_02,R_PR_4_03,R_PR_5_01,R_PR_5_02,R_PR_5_03,R_PR_5_04];export const PROGRESS_RISK_VERSION='1.0.0';export function getAllProgressRiskRules(){return[...ALL_RULES];}export function getProgressRiskRulesCount(){return ALL_RULES['length'];}export function getProgressRiskRulesByCategory(a){return ALL_RULES['filter'](b=>b['category']===a);}export function assessProgressRisks(a){const b=[];for(const f of ALL_RULES){const g=f['check'](a);if(g)b['push'](g);}const c=b['length']===0x0?'LOW':b['some'](h=>h['level']==='CRITICAL')?'CRITICAL':b['some'](h=>h['level']==='HIGH')?'HIGH':b['some'](h=>h['level']==='MEDIUM')?'MEDIUM':'LOW',d={};for(const h of b){d[h['category']]=(d[h['category']]??0x0)+0x1;}const e={};for(const i of b){for(const j of i['affected_stakeholders']){if(!e[j])e[j]=[];e[j]['push'](i['id']+':\x20'+i['mitigation']);}}return{'summary':'Assessed\x20'+b['length']+'\x20risk(s)\x20across\x20'+Object['keys'](d)['length']+'\x20categories','risks':b,'overall_risk':c,'risks_by_category':d,'stakeholder_advice':e,'needs_human_review':b['some'](k=>k['level']==='CRITICAL'||k['level']==='HIGH')};}