@wowok/agent-mcp 2.7.1 → 2.7.3

package/dist/knowledge/order-risk.js

@@ -1,653 +1 @@
-import { MAX_AGENT_COUNT, MAX_DISPUTE_COUNT, } from "@wowok/wowok";
-import { findSceneById, } from "./order-ledger.js";
-const R_O_1_01 = {
-    id: "R-O-1-01",
-    category: "structural",
-    trigger: "Order has 14 fields but no Permission field (unique among 22 objects)",
-    check: (ctx) => {
-        if (ctx.is_buy_operation) {
-            return {
-                id: "R-O-1-01",
-                level: "LOW",
-                category: "structural",
-                title: "Order uses owner/agent dual-layer (no Permission)",
-                description: "Order is the only business object among 22 WoWok objects that does NOT use the Permission system. All access control flows through assert_owner and has_op_permission inline functions.",
-                affected_stakeholders: ["system", "owner", "agent"],
-                scenario: "Developer assumes Order uses Permission and writes permission::check logic",
-                mitigation: "Use owner/agent checks directly. Do NOT attempt to apply a Permission object to Order.",
-                evidence: "no_permission_field",
-            };
-        }
-        return null;
-    },
-};
-const R_O_1_02 = {
-    id: "R-O-1-02",
-    category: "structural",
-    trigger: "Item count check (informational; no Move-level limit on items)",
-    check: (ctx) => {
-        if (!ctx.items || ctx.items.length === 0)
-            return null;
-        if (ctx.items.length > 50) {
-            return {
-                id: "R-O-1-02",
-                level: "LOW",
-                category: "structural",
-                title: "Large items list may exceed tx size limits",
-                description: `${ctx.items.length} items in a single Order — no protocol limit, but large lists increase transaction size and may hit gas/size limits`,
-                affected_stakeholders: ["owner"],
-                scenario: "Bulk purchase with many line items",
-                mitigation: "Split into multiple Orders if items > 50",
-                evidence: `items_count=${ctx.items.length}`,
-            };
-        }
-        return null;
-    },
-};
-const R_O_1_03 = {
-    id: "R-O-1-03",
-    category: "structural",
-    trigger: "dispute count >= MAX_DISPUTE_COUNT (10)",
-    check: (ctx) => {
-        const count = ctx.current_dispute_count ?? 0;
-        if (count >= MAX_DISPUTE_COUNT) {
-            return {
-                id: "R-O-1-03",
-                level: "HIGH",
-                category: "structural",
-                title: "Dispute count at MAX_DISPUTE_COUNT limit",
-                description: `Order already has ${count} disputes (MAX_DISPUTE_COUNT=${MAX_DISPUTE_COUNT}). Next dispute() call will abort E_DISPUTE_COUNT_EXCEEDED.`,
-                affected_stakeholders: ["owner", "agent", "arbitrator"],
-                scenario: "Filing 11th dispute on an Order with 10 existing disputes",
-                mitigation: "Resolve existing disputes (via arb_claim_compensation) before filing new ones. Note: claimed_by blocks ALL future disputes.",
-                evidence: `dispute_count=${count}`,
-            };
-        }
-        return null;
-    },
-};
-const R_O_1_04 = {
-    id: "R-O-1-04",
-    category: "structural",
-    trigger: "agent count > MAX_AGENT_COUNT (doc=10, actual allows 11 due to <= bug)",
-    check: (ctx) => {
-        if (!ctx.agent_set)
-            return null;
-        const count = ctx.agent_set.agents.length;
-        if (count > MAX_AGENT_COUNT) {
-            return {
-                id: "R-O-1-04",
-                level: "HIGH",
-                category: "structural",
-                title: "Agent count exceeds documented MAX_AGENT_COUNT (boundary bug)",
-                description: `Attempting to set ${count} agents. Doc says MAX_AGENT_COUNT=${MAX_AGENT_COUNT}, but Move agent_set_imp uses <= instead of <, actually allowing 11. SDK constant = ${MAX_AGENT_COUNT} does not match chain behavior.`,
-                affected_stakeholders: ["owner", "system"],
-                scenario: "Setting 11 agents — succeeds on chain but contradicts SDK/docs",
-                mitigation: "Treat 10 as the soft cap (matching docs). If 11 is intentional, document the boundary bug explicitly. Long-term: fix Move to use < and sync SDK.",
-                evidence: `agent_count=${count}, max_doc=${MAX_AGENT_COUNT}, max_actual=11`,
-            };
-        }
-        return null;
-    },
-};
-const R_O_1_05 = {
-    id: "R-O-1-05",
-    category: "structural",
-    trigger: "wip_hash is empty string in any item",
-    check: (ctx) => {
-        if (!ctx.items)
-            return null;
-        const emptyHashItem = ctx.items.find(i => !i.wip_hash || i.wip_hash === "");
-        if (emptyHashItem) {
-            return {
-                id: "R-O-1-05",
-                level: "HIGH",
-                category: "structural",
-                title: "Empty wip_hash in item",
-                description: `Item "${emptyHashItem.name}" has empty wip_hash. Move rejects empty strings (F-O-18).`,
-                affected_stakeholders: ["owner"],
-                scenario: "User submits item without computing WIP hash",
-                mitigation: "Compute wip_hash from the work-in-progress file content before service::buy().",
-                evidence: `item_name=${emptyHashItem.name}`,
-            };
-        }
-        return null;
-    },
-};
-const R_O_2_01 = {
-    id: "R-O-2-01",
-    category: "semantic",
-    trigger: "Order.machine snapshot differs from current Service.machine",
-    check: (ctx) => {
-        if (!ctx.current_service_machine || !ctx.order_machine_snapshot)
-            return null;
-        if (ctx.current_service_machine !== ctx.order_machine_snapshot) {
-            return {
-                id: "R-O-2-01",
-                level: "HIGH",
-                category: "semantic",
-                title: "Machine snapshot diverges from Service.machine",
-                description: `Order.machine=${ctx.order_machine_snapshot} was snapshotted at buy time. Service.machine is now ${ctx.current_service_machine}. Same Service has Orders running different Machine versions.`,
-                affected_stakeholders: ["owner", "service_provider", "arbitrator"],
-                scenario: "Service provider upgrades Machine after some Orders are created",
-                mitigation: "Audit each Order's machine snapshot separately. Document Machine version per Order. Plan migration paths for legacy Orders.",
-                evidence: `order_machine=${ctx.order_machine_snapshot}, service_machine=${ctx.current_service_machine}`,
-            };
-        }
-        return null;
-    },
-};
-const R_O_2_02 = {
-    id: "R-O-2-02",
-    category: "semantic",
-    trigger: "SDK uses 'builder' field for Move's 'owner' field (naming deviation)",
-    check: (ctx) => {
-        if (ctx.object) {
-            return {
-                id: "R-O-2-02",
-                level: "MEDIUM",
-                category: "semantic",
-                title: "SDK builder ≠ Move owner (only naming deviation in 22 objects)",
-                description: "SDK ObjectOrder.builder corresponds to Move Order.owner. This is the only field name deviation across all 22 WoWok objects. All Order knowledge uses Move's 'owner' as canonical.",
-                affected_stakeholders: ["system"],
-                scenario: "Developer reads SDK 'builder' and assumes it's a different concept from owner",
-                mitigation: "Use moveToSdkField()/sdkToMoveField() helpers from order-ledger.ts. Document 'builder = owner' in all SDK consumers.",
-                evidence: "sdk_field=builder, move_field=owner",
-            };
-        }
-        return null;
-    },
-};
-const R_O_2_03 = {
-    id: "R-O-2-03",
-    category: "semantic",
-    trigger: "owner_change or agent_set aborted with E_PROGRESS_NOT_SPECIFIED (dual semantics)",
-    check: (ctx) => {
-        if (!ctx.operation)
-            return null;
-        if ((ctx.operation === "agent_set") && ctx.progress_bound) {
-            return {
-                id: "R-O-2-03",
-                level: "MEDIUM",
-                category: "semantic",
-                title: "E_PROGRESS_NOT_SPECIFIED dual semantics (literal vs actual)",
-                description: "agent_set aborted because progress.is_some() — but error code says 'PROGRESS_NOT_SPECIFIED'. The code is used in two OPPOSITE scenarios: (A) progress.is_none() during on_progress (literal), (B) progress.is_some() during owner_change/agent_set (opposite).",
-                affected_stakeholders: ["owner", "agent"],
-                scenario: "User sees 'Progress not specified' error when Progress IS specified — confusion",
-                mitigation: "Translate error to: 'Cannot modify owner/agent: Progress already bound (frozen).' Long-term: split into two error codes (E_PROGRESS_ALREADY_BOUND and E_PROGRESS_NOT_SPECIFIED).",
-                evidence: `operation=${ctx.operation}, progress_bound=${ctx.progress_bound}`,
-            };
-        }
-        return null;
-    },
-};
-const R_O_2_04 = {
-    id: "R-O-2-04",
-    category: "semantic",
-    trigger: "SaleItem.item → PurchasedItem.name field name mapping",
-    check: (ctx) => {
-        if (ctx.is_buy_operation) {
-            return {
-                id: "R-O-2-04",
-                level: "LOW",
-                category: "semantic",
-                title: "SaleItem.item (Move) maps to PurchasedItem.name (SDK)",
-                description: "Move struct SaleItem uses field 'item', but SDK ObjectOrder.items uses field 'name'. This is the second naming deviation in Order system (after builder/owner).",
-                affected_stakeholders: ["system"],
-                scenario: "Cross-layer data mapping between Move and SDK",
-                mitigation: "Use consistent SDK field names in user-facing code; document Move ↔ SDK mapping in audit logs.",
-                evidence: "move_field=SaleItem.item, sdk_field=PurchasedItem.name",
-            };
-        }
-        return null;
-    },
-};
-const R_O_3_01 = {
-    id: "R-O-3-01",
-    category: "authority",
-    trigger: "Agent attempts receive or transfer_to (L1 owner-only operations)",
-    check: (ctx) => {
-        if (!ctx.operation)
-            return null;
-        if ((ctx.operation === "receive" || ctx.operation === "transfer_to") &&
-            ctx.caller_is_agent && !ctx.caller_is_owner) {
-            return {
-                id: "R-O-3-01",
-                level: "HIGH",
-                category: "authority",
-                title: "Agent attempting owner-only operation",
-                description: `Agent cannot call ${ctx.operation} — these are L1 owner-only operations (assert_owner). Agent can operate progress/arb_*/required_info but CANNOT receive funds or transfer ownership.`,
-                affected_stakeholders: ["agent", "owner"],
-                scenario: "Logistics agent tries to collect payment on behalf of buyer",
-                mitigation: "Owner must call receive/transfer_to directly. If delegation is needed, owner can transfer_to a multi-sig wallet that includes the agent.",
-                evidence: `operation=${ctx.operation}, caller=agent`,
-            };
-        }
-        return null;
-    },
-};
-const R_O_3_02 = {
-    id: "R-O-3-02",
-    category: "authority",
-    trigger: "Non-owner non-agent attempts operation (no permission)",
-    check: (ctx) => {
-        if (!ctx.operation)
-            return null;
-        if (ctx.caller_is_owner === false && ctx.caller_is_agent === false) {
-            return {
-                id: "R-O-3-02",
-                level: "HIGH",
-                category: "authority",
-                title: "Non-owner non-agent attempting operation",
-                description: `Caller is neither owner nor agent. All Order operations require at least has_op_permission (L2 layer). Aborts E_PERMISSION.`,
-                affected_stakeholders: ["system"],
-                scenario: "Random address attempts to advance someone else's Order",
-                mitigation: "Verify caller is owner or in agent[] before submitting transaction.",
-                evidence: `operation=${ctx.operation}, caller=unauthorized`,
-            };
-        }
-        return null;
-    },
-};
-const R_O_3_03 = {
-    id: "R-O-3-03",
-    category: "authority",
-    trigger: "arb_claim_compensation called (sets claimed_by, irreversible)",
-    check: (ctx) => {
-        if (ctx.operation !== "arb_claim_compensation")
-            return null;
-        return {
-            id: "R-O-3-03",
-            level: "HIGH",
-            category: "authority",
-            title: "arb_claim_compensation is IRREVERSIBLE (claimed_by one-time set)",
-            description: "Setting claimed_by is permanent. After this call: (1) claimed_by cannot be reset, (2) NO new disputes can be filed (E_ORDER_ALREADY_CLAIMED), (3) all unresolved disputes become unactionable. If first compensation is insufficient, buyer has no recourse.",
-            affected_stakeholders: ["owner", "agent", "arbitrator"],
-            scenario: "Buyer claims partial compensation, then discovers additional damages",
-            mitigation: "BEFORE claiming: (1) enumerate ALL disputes, (2) ensure proposition covers all damages, (3) confirm Arb ruling is final. Add explicit user confirmation (C-O-08).",
-            evidence: `operation=arb_claim_compensation, current_claimed_by=${ctx.claimed_by_set ?? false}`,
-        };
-    },
-};
-const R_O_3_04 = {
-    id: "R-O-3-04",
-    category: "authority",
-    trigger: "dispute attempted after claimed_by is set",
-    check: (ctx) => {
-        if (ctx.claimed_by_set && (ctx.operation === "arb_confirm" || ctx.operation === "arb_objection")) {
-            return {
-                id: "R-O-3-04",
-                level: "HIGH",
-                category: "authority",
-                title: "Cannot file new dispute after claimed_by is set",
-                description: "Order.claimed_by is set — any new dispute() call aborts E_ORDER_ALREADY_CLAIMED. arb_confirm/arb_objection trigger dispute() internally.",
-                affected_stakeholders: ["owner", "agent"],
-                scenario: "Buyer claims compensation then tries to file additional dispute",
-                mitigation: "Resolve ALL disputes BEFORE calling arb_claim_compensation. claimed_by is terminal for dispute flow.",
-                evidence: `operation=${ctx.operation}, claimed_by_set=true`,
-            };
-        }
-        return null;
-    },
-};
-const R_O_4_01 = {
-    id: "R-O-4-01",
-    category: "lifecycle",
-    trigger: "Attempt to create Order independently (not via service::buy)",
-    check: (ctx) => {
-        if (ctx.is_buy_operation === false && ctx.operation === "service_buy" && !ctx.object) {
-            return {
-                id: "R-O-4-01",
-                level: "CRITICAL",
-                category: "lifecycle",
-                title: "Order cannot be created independently (compound creation only)",
-                description: "order::new() is package-only — only service::buy() can create Orders. Any attempt to call order::new directly will fail at the Move module boundary. Order + Allocation + Progress are created atomically in one transaction.",
-                affected_stakeholders: ["system", "owner"],
-                scenario: "Developer tries to construct Order independently for testing",
-                mitigation: "Always use service::buy() to create Orders. For testing, deploy a minimal Service with machine/allocators configured.",
-                evidence: "independent_creation_attempted",
-            };
-        }
-        return null;
-    },
-};
-const R_O_4_02 = {
-    id: "R-O-4-02",
-    category: "lifecycle",
-    trigger: "agent_set or owner_change attempted after Progress binding",
-    check: (ctx) => {
-        if (!ctx.operation)
-            return null;
-        if ((ctx.operation === "agent_set") && ctx.progress_bound) {
-            return {
-                id: "R-O-4-02",
-                level: "HIGH",
-                category: "lifecycle",
-                title: "agent_set blocked — Progress binding frozen owner/agent",
-                description: "Once order.progress is set (during service::buy if Service has machine), agent_set and owner_change abort E_PROGRESS_NOT_SPECIFIED. Owner/agent must be finalized BEFORE buy.",
-                affected_stakeholders: ["owner", "agent"],
-                scenario: "Buyer wants to add agent mid-fulfillment after Progress is bound",
-                mitigation: "Set agent list BEFORE service::buy (via pre-buy configuration). If post-buy agent change is needed, use transfer_to a new owner who has the desired agents.",
-                evidence: `operation=agent_set, progress_bound=${ctx.progress_bound}`,
-            };
-        }
-        return null;
-    },
-};
-const R_O_4_03 = {
-    id: "R-O-4-03",
-    category: "lifecycle",
-    trigger: "Progress advance attempted without progress bound",
-    check: (ctx) => {
-        if (ctx.operation === "progress_advance" && ctx.progress_bound === false) {
-            return {
-                id: "R-O-4-03",
-                level: "HIGH",
-                category: "lifecycle",
-                title: "Cannot advance Progress — no Progress bound to Order",
-                description: "Order has no progress field set (Service had no machine configured). Cannot advance a non-existent Progress. SDK CallOrder validates this pre-flight (CallOrder_Data.progress requires order.machine and order.progress).",
-                affected_stakeholders: ["owner", "agent"],
-                scenario: "Buyer tries to advance Progress on an Order created from a Service without machine",
-                mitigation: "Use a Service with machine configured. If manual lifecycle is needed, track state off-chain.",
-                evidence: `operation=progress_advance, progress_bound=false`,
-            };
-        }
-        return null;
-    },
-};
-const R_O_4_04 = {
-    id: "R-O-4-04",
-    category: "lifecycle",
-    trigger: "arb_confirm/arb_objection/arb_claim_compensation (irreversible Arb operations)",
-    check: (ctx) => {
-        if (!ctx.operation)
-            return null;
-        if (ctx.operation === "arb_confirm" || ctx.operation === "arb_objection" || ctx.operation === "arb_claim_compensation") {
-            return {
-                id: "R-O-4-04",
-                level: "HIGH",
-                category: "lifecycle",
-                title: `${ctx.operation} is irreversible (triggers Arb flow)`,
-                description: `${ctx.operation} triggers the Arbitration workflow which cannot be undone. arb_confirm files a new dispute, arb_objection requests re-arbitration, arb_claim_compensation sets claimed_by permanently.`,
-                affected_stakeholders: ["owner", "agent", "arbitrator"],
-                scenario: "User accidentally files arb_confirm without understanding consequences",
-                mitigation: "Add explicit user confirmation (C-O-08, C-O-11, C-O-12) before these operations. Show warning text describing irreversibility.",
-                evidence: `operation=${ctx.operation}`,
-            };
-        }
-        return null;
-    },
-};
-const R_O_4_05 = {
-    id: "R-O-4-05",
-    category: "lifecycle",
-    trigger: "receive attempted while Progress not at terminal node",
-    check: (ctx) => {
-        if (ctx.operation === "receive" && ctx.progress_bound && !ctx.progress_at_terminal) {
-            return {
-                id: "R-O-4-05",
-                level: "HIGH",
-                category: "lifecycle",
-                title: "receive blocked — Order still delivering (E_ORDER_DELIVERING)",
-                description: "owner_receive aborts E_ORDER_DELIVERING when Progress has not reached a terminal node. Funds cannot be collected until fulfillment completes.",
-                affected_stakeholders: ["owner"],
-                scenario: "Buyer tries to collect refund before Progress reaches 'completed' or 'cancelled'",
-                mitigation: "Wait for Progress to reach terminal/cancel node. If urgent, file arb_confirm to dispute.",
-                evidence: `operation=receive, progress_at_terminal=${ctx.progress_at_terminal}`,
-            };
-        }
-        return null;
-    },
-};
-const R_O_4_06 = {
-    id: "R-O-4-06",
-    category: "lifecycle",
-    trigger: "transfer_to attempted (irreversible ownership transfer)",
-    check: (ctx) => {
-        if (ctx.operation !== "transfer_to")
-            return null;
-        return {
-            id: "R-O-4-06",
-            level: "CRITICAL",
-            category: "lifecycle",
-            title: "transfer_to is IRREVERSIBLE — new owner takes over ALL permissions",
-            description: `Ownership transfer to ${ctx.transfer_to_new_owner ?? "(unknown)"} is permanent. New owner becomes the sole receiver of payments and gains full L1 control. Original owner loses ALL access.`,
-            affected_stakeholders: ["owner"],
-            scenario: "Buyer transfers Order to wrong address by mistake",
-            mitigation: "1) Verify new owner address twice. 2) Coordinate with new owner before transfer. 3) Add explicit user confirmation (C-O-09). Note: transfer_to is NOT blocked by progress binding (unlike agent_set).",
-            evidence: `new_owner=${ctx.transfer_to_new_owner}`,
-        };
-    },
-};
-const R_O_5_01 = {
-    id: "R-O-5-01",
-    category: "cross_object",
-    trigger: "Service.machine upgraded after Order creation (snapshot divergence)",
-    check: (ctx) => {
-        if (ctx.is_buy_operation) {
-            return {
-                id: "R-O-5-01",
-                level: "LOW",
-                category: "cross_object",
-                title: "Service snapshot mechanism — order.machine is a copy, not a reference",
-                description: "When service::buy() creates an Order, order.machine is COPIED from service.machine. Future Service.machine upgrades do NOT affect this Order. Same Service may have Orders running different Machine versions.",
-                affected_stakeholders: ["owner", "service_provider", "arbitrator"],
-                scenario: "Service provider upgrades Machine workflow — old Orders keep old workflow",
-                mitigation: "Track Machine version per Order (via order.machine address). Plan migration paths for legacy Orders. Document that old Orders are decoupled.",
-                evidence: "snapshot_mechanism",
-            };
-        }
-        return null;
-    },
-};
-const R_O_5_02 = {
-    id: "R-O-5-02",
-    category: "cross_object",
-    trigger: "Order references Progress that no longer exists or is corrupted",
-    check: (ctx) => {
-        if (ctx.progress_bound && ctx.object) {
-            return {
-                id: "R-O-5-02",
-                level: "MEDIUM",
-                category: "cross_object",
-                title: "Order-Progress 1:1 binding (E_PROGRESS_ALREADY_SPECIFIED)",
-                description: "Order.progress is one-time-set via on_progress (package-only). Cannot be rebound. If Progress object is corrupted, Order becomes stuck — cannot advance, cannot rebind.",
-                affected_stakeholders: ["owner", "agent"],
-                scenario: "Progress object becomes unresponsive or corrupted",
-                mitigation: "Ensure Progress integrity via Machine audit before publishing Service. Use arb_claim_compensation as escape hatch if Progress is stuck.",
-                evidence: `progress_bound=${ctx.progress_bound}`,
-            };
-        }
-        return null;
-    },
-};
-const R_O_5_03 = {
-    id: "R-O-5-03",
-    category: "cross_object",
-    trigger: "Order references Allocation that no longer exists or is corrupted",
-    check: (ctx) => {
-        if (ctx.object && ctx.progress_bound) {
-            return {
-                id: "R-O-5-03",
-                level: "MEDIUM",
-                category: "cross_object",
-                title: "Order-Allocation 1:1 binding (E_ALLOCATION_ALREADY_SPECIFIED)",
-                description: "Order.allocation is one-time-set via on_allocation (package-only). Cannot be rebound. If Allocation object is corrupted, fund distribution is blocked.",
-                affected_stakeholders: ["owner", "service_provider"],
-                scenario: "Allocation object has wrong allocator configuration",
-                mitigation: "Audit order_allocators configuration on Service BEFORE publishing. Use compensation_fund as fallback fund source.",
-                evidence: "allocation_binding",
-            };
-        }
-        return null;
-    },
-};
-const R_O_5_04 = {
-    id: "R-O-5-04",
-    category: "cross_object",
-    trigger: "Arbitration dispute appended to Order.dispute list",
-    check: (ctx) => {
-        if (ctx.operation === "arb_confirm") {
-            return {
-                id: "R-O-5-04",
-                level: "LOW",
-                category: "cross_object",
-                title: "Arb object will be appended to order.dispute (package-only dispute())",
-                description: "arb_confirm triggers Arb module to call order::dispute(arb_address), appending the Arb object to order.dispute list. Max 10 disputes (MAX_DISPUTE_COUNT). Frozen when claimed_by is set.",
-                affected_stakeholders: ["arbitrator", "owner", "agent"],
-                scenario: "Multiple arb_confirm calls create multiple Arb objects on same Order",
-                mitigation: "Track dispute count. Once at 10, no more disputes can be filed. Resolve existing disputes before filing new ones.",
-                evidence: `operation=arb_confirm, current_disputes=${ctx.current_dispute_count ?? 0}`,
-            };
-        }
-        return null;
-    },
-};
-const R_O_5_05 = {
-    id: "R-O-5-05",
-    category: "cross_object",
-    trigger: "External system expects OrderCompletedEvent (does not exist)",
-    check: (ctx) => {
-        if (ctx.is_buy_operation || ctx.object) {
-            return {
-                id: "R-O-5-05",
-                level: "MEDIUM",
-                category: "cross_object",
-                title: "Only NewOrderEvent emitted — no OrderCompletedEvent",
-                description: "Move contract ONLY emits NewOrderEvent at creation. Order completion/cancellation/refund are IMPLICIT — must be inferred by querying Progress.current_node (terminal? cancel?) or Order.claimed_by. External monitoring requires polling, not event-driven.",
-                affected_stakeholders: ["system"],
-                scenario: "Analytics dashboard expects OrderCompletedEvent to track completion rate",
-                mitigation: "Build composite query: NewOrderEvent + Order.progress query → infer completion. Document this limitation in monitoring tools. Long-term: advocate for Move upgrade to add OrderCompletedEvent.",
-                evidence: "no_order_completed_event",
-            };
-        }
-        return null;
-    },
-};
-const R_O_5_06 = {
-    id: "R-O-5-06",
-    category: "cross_object",
-    trigger: "service::buy pre-flight: Service not published or paused",
-    check: (ctx) => {
-        if (!ctx.is_buy_operation)
-            return null;
-        if (ctx.service_published === false) {
-            return {
-                id: "R-O-5-06",
-                level: "CRITICAL",
-                category: "cross_object",
-                title: "Service not published — service::buy will abort E_NOT_PUBLISHED",
-                description: "Cannot create Order from an unpublished Service. Service must be published (bPublished=true) before service::buy() can be called.",
-                affected_stakeholders: ["owner"],
-                scenario: "Buyer attempts to purchase from a draft Service",
-                mitigation: "Verify Service.bPublished=true before service::buy(). Service owner must call service::publish() first.",
-                evidence: `service_published=${ctx.service_published}`,
-            };
-        }
-        if (ctx.service_paused === true) {
-            return {
-                id: "R-O-5-06",
-                level: "CRITICAL",
-                category: "cross_object",
-                title: "Service paused — service::buy will abort E_PAUSED",
-                description: "Cannot create Order from a paused Service. Service must be unpaused before service::buy() can be called.",
-                affected_stakeholders: ["owner"],
-                scenario: "Buyer attempts to purchase from a paused Service (e.g. during maintenance)",
-                mitigation: "Wait for Service owner to call service::pause(false). Check Service.paused before service::buy().",
-                evidence: `service_paused=${ctx.service_paused}`,
-            };
-        }
-        return null;
-    },
-};
-const ALL_RULES = [
-    R_O_1_01, R_O_1_02, R_O_1_03, R_O_1_04, R_O_1_05,
-    R_O_2_01, R_O_2_02, R_O_2_03, R_O_2_04,
-    R_O_3_01, R_O_3_02, R_O_3_03, R_O_3_04,
-    R_O_4_01, R_O_4_02, R_O_4_03, R_O_4_04, R_O_4_05, R_O_4_06,
-    R_O_5_01, R_O_5_02, R_O_5_03, R_O_5_04, R_O_5_05, R_O_5_06,
-];
-export const ORDER_RISK_VERSION = "1.0.0";
-export function getAllOrderRiskRules() {
-    return [...ALL_RULES];
-}
-export function getOrderRiskRulesCount() {
-    return ALL_RULES.length;
-}
-export function getOrderRiskRulesByCategory(category) {
-    return ALL_RULES.filter(r => r.category === category);
-}
-export function getOrderRiskRuleById(id) {
-    return ALL_RULES.find(r => r.id === id);
-}
-export function assessOrderRisks(ctx) {
-    const risks = [];
-    for (const rule of ALL_RULES) {
-        const r = rule.check(ctx);
-        if (r)
-            risks.push(r);
-    }
-    const overall = risks.length === 0
-        ? "LOW"
-        : risks.some(r => r.level === "CRITICAL") ? "CRITICAL"
-            : risks.some(r => r.level === "HIGH") ? "HIGH"
-                : risks.some(r => r.level === "MEDIUM") ? "MEDIUM"
-                    : "LOW";
-    const byCategory = {};
-    for (const r of risks) {
-        byCategory[r.category] = (byCategory[r.category] ?? 0) + 1;
-    }
-    const advice = {};
-    for (const r of risks) {
-        for (const s of r.affected_stakeholders) {
-            if (!advice[s])
-                advice[s] = [];
-            advice[s].push(`${r.id}: ${r.mitigation}`);
-        }
-    }
-    let scene;
-    if (ctx.operation) {
-        const sceneMap = {
-            agent_set: "order_set_agent",
-            required_info_update: "order_required_info",
-            progress_advance: "order_advance",
-            arb_confirm: "order_arb_confirm",
-            arb_objection: "order_arb_objection",
-            arb_claim_compensation: "order_arb_claim_compensation",
-            receive: "order_receive",
-            transfer_to: "order_transfer",
-            service_buy: "order_create",
-        };
-        scene = findSceneById(sceneMap[ctx.operation] ?? "");
-    }
-    return {
-        summary: `Assessed ${risks.length} risk(s) across ${Object.keys(byCategory).length} categories`,
-        scene,
-        risks,
-        overall_risk: overall,
-        risks_by_category: byCategory,
-        stakeholder_advice: advice,
-        needs_human_review: risks.some(r => r.level === "CRITICAL" || r.level === "HIGH"),
-    };
-}
-export function checkPermissionLayer(operation, caller_is_owner, caller_is_agent) {
-    const l1_ops = ["receive", "transfer_to", "owner_change", "agent_set"];
-    const l2_ops = ["required_info_update", "progress_advance", "arb_confirm", "arb_objection", "arb_claim_compensation"];
-    const l3_ops = ["on_progress", "on_allocation", "dispute", "compensate"];
-    if (l3_ops.includes(operation)) {
-        return { allowed: false, layer: "L3_package_only", reason: "Package-only — not callable externally" };
-    }
-    if (l1_ops.includes(operation)) {
-        if (!caller_is_owner) {
-            return { allowed: false, layer: "L1_owner_only", reason: `Owner-only operation (${operation}) — agent or unauthorized caller` };
-        }
-        return { allowed: true, layer: "L1_owner_only" };
-    }
-    if (l2_ops.includes(operation)) {
-        if (!caller_is_owner && !caller_is_agent) {
-            return { allowed: false, layer: "L2_owner_or_agent", reason: `Requires owner or agent permission (${operation})` };
-        }
-        return { allowed: true, layer: "L2_owner_or_agent" };
-    }
-    return { allowed: false, layer: "L3_package_only", reason: `Unknown operation: ${operation}` };
-}
+import{MAX_AGENT_COUNT,MAX_DISPUTE_COUNT}from'@wowok/wowok';import{findSceneById}from'./order-ledger.js';const R_O_1_01={'id':'R-O-1-01','category':'structural','trigger':'Order\x20has\x2014\x20fields\x20but\x20no\x20Permission\x20field\x20(unique\x20among\x2022\x20objects)','check':a=>{if(a['is_buy_operation'])return{'id':'R-O-1-01','level':'LOW','category':'structural','title':'Order\x20uses\x20owner/agent\x20dual-layer\x20(no\x20Permission)','description':'Order\x20is\x20the\x20only\x20business\x20object\x20among\x2022\x20WoWok\x20objects\x20that\x20does\x20NOT\x20use\x20the\x20Permission\x20system.\x20All\x20access\x20control\x20flows\x20through\x20assert_owner\x20and\x20has_op_permission\x20inline\x20functions.','affected_stakeholders':['system','owner','agent'],'scenario':'Developer\x20assumes\x20Order\x20uses\x20Permission\x20and\x20writes\x20permission::check\x20logic','mitigation':'Use\x20owner/agent\x20checks\x20directly.\x20Do\x20NOT\x20attempt\x20to\x20apply\x20a\x20Permission\x20object\x20to\x20Order.','evidence':'no_permission_field'};return null;}},R_O_1_02={'id':'R-O-1-02','category':'structural','trigger':'Item\x20count\x20check\x20(informational;\x20no\x20Move-level\x20limit\x20on\x20items)','check':a=>{if(!a['items']||a['items']['length']===0x0)return null;if(a['items']['length']>0x32)return{'id':'R-O-1-02','level':'LOW','category':'structural','title':'Large\x20items\x20list\x20may\x20exceed\x20tx\x20size\x20limits','description':a['items']['length']+'\x20items\x20in\x20a\x20single\x20Order\x20—\x20no\x20protocol\x20limit,\x20but\x20large\x20lists\x20increase\x20transaction\x20size\x20and\x20may\x20hit\x20gas/size\x20limits','affected_stakeholders':['owner'],'scenario':'Bulk\x20purchase\x20with\x20many\x20line\x20items','mitigation':'Split\x20into\x20multiple\x20Orders\x20if\x20items\x20>\x2050','evidence':'items_count='+a['items']['length']};return null;}},R_O_1_03={'id':'R-O-1-03','category':'structural','trigger':'dispute\x20count\x20>=\x20MAX_DISPUTE_COUNT\x20(10)','check':a=>{const b=a['current_dispute_count']??0x0;if(b>=MAX_DISPUTE_COUNT)return{'id':'R-O-1-03','level':'HIGH','category':'structural','title':'Dispute\x20count\x20at\x20MAX_DISPUTE_COUNT\x20limit','description':'Order\x20already\x20has\x20'+b+'\x20disputes\x20(MAX_DISPUTE_COUNT='+MAX_DISPUTE_COUNT+').\x20Next\x20dispute()\x20call\x20will\x20abort\x20E_DISPUTE_COUNT_EXCEEDED.','affected_stakeholders':['owner','agent','arbitrator'],'scenario':'Filing\x2011th\x20dispute\x20on\x20an\x20Order\x20with\x2010\x20existing\x20disputes','mitigation':'Resolve\x20existing\x20disputes\x20(via\x20arb_claim_compensation)\x20before\x20filing\x20new\x20ones.\x20Note:\x20claimed_by\x20blocks\x20ALL\x20future\x20disputes.','evidence':'dispute_count='+b};return null;}},R_O_1_04={'id':'R-O-1-04','category':'structural','trigger':'agent\x20count\x20>\x20MAX_AGENT_COUNT\x20(doc=10,\x20actual\x20allows\x2011\x20due\x20to\x20<=\x20bug)','check':a=>{if(!a['agent_set'])return null;const b=a['agent_set']['agents']['length'];if(b>MAX_AGENT_COUNT)return{'id':'R-O-1-04','level':'HIGH','category':'structural','title':'Agent\x20count\x20exceeds\x20documented\x20MAX_AGENT_COUNT\x20(boundary\x20bug)','description':'Attempting\x20to\x20set\x20'+b+'\x20agents.\x20Doc\x20says\x20MAX_AGENT_COUNT='+MAX_AGENT_COUNT+',\x20but\x20Move\x20agent_set_imp\x20uses\x20<=\x20instead\x20of\x20<,\x20actually\x20allowing\x2011.\x20SDK\x20constant\x20=\x20'+MAX_AGENT_COUNT+'\x20does\x20not\x20match\x20chain\x20behavior.','affected_stakeholders':['owner','system'],'scenario':'Setting\x2011\x20agents\x20—\x20succeeds\x20on\x20chain\x20but\x20contradicts\x20SDK/docs','mitigation':'Treat\x2010\x20as\x20the\x20soft\x20cap\x20(matching\x20docs).\x20If\x2011\x20is\x20intentional,\x20document\x20the\x20boundary\x20bug\x20explicitly.\x20Long-term:\x20fix\x20Move\x20to\x20use\x20<\x20and\x20sync\x20SDK.','evidence':'agent_count='+b+',\x20max_doc='+MAX_AGENT_COUNT+',\x20max_actual=11'};return null;}},R_O_1_05={'id':'R-O-1-05','category':'structural','trigger':'wip_hash\x20is\x20empty\x20string\x20in\x20any\x20item','check':a=>{if(!a['items'])return null;const b=a['items']['find'](c=>!c['wip_hash']||c['wip_hash']==='');if(b)return{'id':'R-O-1-05','level':'HIGH','category':'structural','title':'Empty\x20wip_hash\x20in\x20item','description':'Item\x20\x22'+b['name']+'\x22\x20has\x20empty\x20wip_hash.\x20Move\x20rejects\x20empty\x20strings\x20(F-O-18).','affected_stakeholders':['owner'],'scenario':'User\x20submits\x20item\x20without\x20computing\x20WIP\x20hash','mitigation':'Compute\x20wip_hash\x20from\x20the\x20work-in-progress\x20file\x20content\x20before\x20service::buy().','evidence':'item_name='+b['name']};return null;}},R_O_2_01={'id':'R-O-2-01','category':'semantic','trigger':'Order.machine\x20snapshot\x20differs\x20from\x20current\x20Service.machine','check':a=>{if(!a['current_service_machine']||!a['order_machine_snapshot'])return null;if(a['current_service_machine']!==a['order_machine_snapshot'])return{'id':'R-O-2-01','level':'HIGH','category':'semantic','title':'Machine\x20snapshot\x20diverges\x20from\x20Service.machine','description':'Order.machine='+a['order_machine_snapshot']+'\x20was\x20snapshotted\x20at\x20buy\x20time.\x20Service.machine\x20is\x20now\x20'+a['current_service_machine']+'.\x20Same\x20Service\x20has\x20Orders\x20running\x20different\x20Machine\x20versions.','affected_stakeholders':['owner','service_provider','arbitrator'],'scenario':'Service\x20provider\x20upgrades\x20Machine\x20after\x20some\x20Orders\x20are\x20created','mitigation':'Audit\x20each\x20Order\x27s\x20machine\x20snapshot\x20separately.\x20Document\x20Machine\x20version\x20per\x20Order.\x20Plan\x20migration\x20paths\x20for\x20legacy\x20Orders.','evidence':'order_machine='+a['order_machine_snapshot']+',\x20service_machine='+a['current_service_machine']};return null;}},R_O_2_02={'id':'R-O-2-02','category':'semantic','trigger':'SDK\x20uses\x20\x27builder\x27\x20field\x20for\x20Move\x27s\x20\x27owner\x27\x20field\x20(naming\x20deviation)','check':a=>{if(a['object'])return{'id':'R-O-2-02','level':'MEDIUM','category':'semantic','title':'SDK\x20builder\x20≠\x20Move\x20owner\x20(only\x20naming\x20deviation\x20in\x2022\x20objects)','description':'SDK\x20ObjectOrder.builder\x20corresponds\x20to\x20Move\x20Order.owner.\x20This\x20is\x20the\x20only\x20field\x20name\x20deviation\x20across\x20all\x2022\x20WoWok\x20objects.\x20All\x20Order\x20knowledge\x20uses\x20Move\x27s\x20\x27owner\x27\x20as\x20canonical.','affected_stakeholders':['system'],'scenario':'Developer\x20reads\x20SDK\x20\x27builder\x27\x20and\x20assumes\x20it\x27s\x20a\x20different\x20concept\x20from\x20owner','mitigation':'Use\x20moveToSdkField()/sdkToMoveField()\x20helpers\x20from\x20order-ledger.ts.\x20Document\x20\x27builder\x20=\x20owner\x27\x20in\x20all\x20SDK\x20consumers.','evidence':'sdk_field=builder,\x20move_field=owner'};return null;}},R_O_2_03={'id':'R-O-2-03','category':'semantic','trigger':'owner_change\x20or\x20agent_set\x20aborted\x20with\x20E_PROGRESS_NOT_SPECIFIED\x20(dual\x20semantics)','check':a=>{if(!a['operation'])return null;if(a['operation']==='agent_set'&&a['progress_bound'])return{'id':'R-O-2-03','level':'MEDIUM','category':'semantic','title':'E_PROGRESS_NOT_SPECIFIED\x20dual\x20semantics\x20(literal\x20vs\x20actual)','description':'agent_set\x20aborted\x20because\x20progress.is_some()\x20—\x20but\x20error\x20code\x20says\x20\x27PROGRESS_NOT_SPECIFIED\x27.\x20The\x20code\x20is\x20used\x20in\x20two\x20OPPOSITE\x20scenarios:\x20(A)\x20progress.is_none()\x20during\x20on_progress\x20(literal),\x20(B)\x20progress.is_some()\x20during\x20owner_change/agent_set\x20(opposite).','affected_stakeholders':['owner','agent'],'scenario':'User\x20sees\x20\x27Progress\x20not\x20specified\x27\x20error\x20when\x20Progress\x20IS\x20specified\x20—\x20confusion','mitigation':'Translate\x20error\x20to:\x20\x27Cannot\x20modify\x20owner/agent:\x20Progress\x20already\x20bound\x20(frozen).\x27\x20Long-term:\x20split\x20into\x20two\x20error\x20codes\x20(E_PROGRESS_ALREADY_BOUND\x20and\x20E_PROGRESS_NOT_SPECIFIED).','evidence':'operation='+a['operation']+',\x20progress_bound='+a['progress_bound']};return null;}},R_O_2_04={'id':'R-O-2-04','category':'semantic','trigger':'SaleItem.item\x20→\x20PurchasedItem.name\x20field\x20name\x20mapping','check':a=>{if(a['is_buy_operation'])return{'id':'R-O-2-04','level':'LOW','category':'semantic','title':'SaleItem.item\x20(Move)\x20maps\x20to\x20PurchasedItem.name\x20(SDK)','description':'Move\x20struct\x20SaleItem\x20uses\x20field\x20\x27item\x27,\x20but\x20SDK\x20ObjectOrder.items\x20uses\x20field\x20\x27name\x27.\x20This\x20is\x20the\x20second\x20naming\x20deviation\x20in\x20Order\x20system\x20(after\x20builder/owner).','affected_stakeholders':['system'],'scenario':'Cross-layer\x20data\x20mapping\x20between\x20Move\x20and\x20SDK','mitigation':'Use\x20consistent\x20SDK\x20field\x20names\x20in\x20user-facing\x20code;\x20document\x20Move\x20↔\x20SDK\x20mapping\x20in\x20audit\x20logs.','evidence':'move_field=SaleItem.item,\x20sdk_field=PurchasedItem.name'};return null;}},R_O_3_01={'id':'R-O-3-01','category':'authority','trigger':'Agent\x20attempts\x20receive\x20or\x20transfer_to\x20(L1\x20owner-only\x20operations)','check':a=>{if(!a['operation'])return null;if((a['operation']==='receive'||a['operation']==='transfer_to')&&a['caller_is_agent']&&!a['caller_is_owner'])return{'id':'R-O-3-01','level':'HIGH','category':'authority','title':'Agent\x20attempting\x20owner-only\x20operation','description':'Agent\x20cannot\x20call\x20'+a['operation']+'\x20—\x20these\x20are\x20L1\x20owner-only\x20operations\x20(assert_owner).\x20Agent\x20can\x20operate\x20progress/arb_*/required_info\x20but\x20CANNOT\x20receive\x20funds\x20or\x20transfer\x20ownership.','affected_stakeholders':['agent','owner'],'scenario':'Logistics\x20agent\x20tries\x20to\x20collect\x20payment\x20on\x20behalf\x20of\x20buyer','mitigation':'Owner\x20must\x20call\x20receive/transfer_to\x20directly.\x20If\x20delegation\x20is\x20needed,\x20owner\x20can\x20transfer_to\x20a\x20multi-sig\x20wallet\x20that\x20includes\x20the\x20agent.','evidence':'operation='+a['operation']+',\x20caller=agent'};return null;}},R_O_3_02={'id':'R-O-3-02','category':'authority','trigger':'Non-owner\x20non-agent\x20attempts\x20operation\x20(no\x20permission)','check':a=>{if(!a['operation'])return null;if(a['caller_is_owner']===![]&&a['caller_is_agent']===![])return{'id':'R-O-3-02','level':'HIGH','category':'authority','title':'Non-owner\x20non-agent\x20attempting\x20operation','description':'Caller\x20is\x20neither\x20owner\x20nor\x20agent.\x20All\x20Order\x20operations\x20require\x20at\x20least\x20has_op_permission\x20(L2\x20layer).\x20Aborts\x20E_PERMISSION.','affected_stakeholders':['system'],'scenario':'Random\x20address\x20attempts\x20to\x20advance\x20someone\x20else\x27s\x20Order','mitigation':'Verify\x20caller\x20is\x20owner\x20or\x20in\x20agent[]\x20before\x20submitting\x20transaction.','evidence':'operation='+a['operation']+',\x20caller=unauthorized'};return null;}},R_O_3_03={'id':'R-O-3-03','category':'authority','trigger':'arb_claim_compensation\x20called\x20(sets\x20claimed_by,\x20irreversible)','check':a=>{if(a['operation']!=='arb_claim_compensation')return null;return{'id':'R-O-3-03','level':'HIGH','category':'authority','title':'arb_claim_compensation\x20is\x20IRREVERSIBLE\x20(claimed_by\x20one-time\x20set)','description':'Setting\x20claimed_by\x20is\x20permanent.\x20After\x20this\x20call:\x20(1)\x20claimed_by\x20cannot\x20be\x20reset,\x20(2)\x20NO\x20new\x20disputes\x20can\x20be\x20filed\x20(E_ORDER_ALREADY_CLAIMED),\x20(3)\x20all\x20unresolved\x20disputes\x20become\x20unactionable.\x20If\x20first\x20compensation\x20is\x20insufficient,\x20buyer\x20has\x20no\x20recourse.','affected_stakeholders':['owner','agent','arbitrator'],'scenario':'Buyer\x20claims\x20partial\x20compensation,\x20then\x20discovers\x20additional\x20damages','mitigation':'BEFORE\x20claiming:\x20(1)\x20enumerate\x20ALL\x20disputes,\x20(2)\x20ensure\x20proposition\x20covers\x20all\x20damages,\x20(3)\x20confirm\x20Arb\x20ruling\x20is\x20final.\x20Add\x20explicit\x20user\x20confirmation\x20(C-O-08).','evidence':'operation=arb_claim_compensation,\x20current_claimed_by='+(a['claimed_by_set']??![])};}},R_O_3_04={'id':'R-O-3-04','category':'authority','trigger':'dispute\x20attempted\x20after\x20claimed_by\x20is\x20set','check':a=>{if(a['claimed_by_set']&&(a['operation']==='arb_confirm'||a['operation']==='arb_objection'))return{'id':'R-O-3-04','level':'HIGH','category':'authority','title':'Cannot\x20file\x20new\x20dispute\x20after\x20claimed_by\x20is\x20set','description':'Order.claimed_by\x20is\x20set\x20—\x20any\x20new\x20dispute()\x20call\x20aborts\x20E_ORDER_ALREADY_CLAIMED.\x20arb_confirm/arb_objection\x20trigger\x20dispute()\x20internally.','affected_stakeholders':['owner','agent'],'scenario':'Buyer\x20claims\x20compensation\x20then\x20tries\x20to\x20file\x20additional\x20dispute','mitigation':'Resolve\x20ALL\x20disputes\x20BEFORE\x20calling\x20arb_claim_compensation.\x20claimed_by\x20is\x20terminal\x20for\x20dispute\x20flow.','evidence':'operation='+a['operation']+',\x20claimed_by_set=true'};return null;}},R_O_4_01={'id':'R-O-4-01','category':'lifecycle','trigger':'Attempt\x20to\x20create\x20Order\x20independently\x20(not\x20via\x20service::buy)','check':a=>{if(a['is_buy_operation']===![]&&a['operation']==='service_buy'&&!a['object'])return{'id':'R-O-4-01','level':'CRITICAL','category':'lifecycle','title':'Order\x20cannot\x20be\x20created\x20independently\x20(compound\x20creation\x20only)','description':'order::new()\x20is\x20package-only\x20—\x20only\x20service::buy()\x20can\x20create\x20Orders.\x20Any\x20attempt\x20to\x20call\x20order::new\x20directly\x20will\x20fail\x20at\x20the\x20Move\x20module\x20boundary.\x20Order\x20+\x20Allocation\x20+\x20Progress\x20are\x20created\x20atomically\x20in\x20one\x20transaction.','affected_stakeholders':['system','owner'],'scenario':'Developer\x20tries\x20to\x20construct\x20Order\x20independently\x20for\x20testing','mitigation':'Always\x20use\x20service::buy()\x20to\x20create\x20Orders.\x20For\x20testing,\x20deploy\x20a\x20minimal\x20Service\x20with\x20machine/allocators\x20configured.','evidence':'independent_creation_attempted'};return null;}},R_O_4_02={'id':'R-O-4-02','category':'lifecycle','trigger':'agent_set\x20or\x20owner_change\x20attempted\x20after\x20Progress\x20binding','check':a=>{if(!a['operation'])return null;if(a['operation']==='agent_set'&&a['progress_bound'])return{'id':'R-O-4-02','level':'HIGH','category':'lifecycle','title':'agent_set\x20blocked\x20—\x20Progress\x20binding\x20frozen\x20owner/agent','description':'Once\x20order.progress\x20is\x20set\x20(during\x20service::buy\x20if\x20Service\x20has\x20machine),\x20agent_set\x20and\x20owner_change\x20abort\x20E_PROGRESS_NOT_SPECIFIED.\x20Owner/agent\x20must\x20be\x20finalized\x20BEFORE\x20buy.','affected_stakeholders':['owner','agent'],'scenario':'Buyer\x20wants\x20to\x20add\x20agent\x20mid-fulfillment\x20after\x20Progress\x20is\x20bound','mitigation':'Set\x20agent\x20list\x20BEFORE\x20service::buy\x20(via\x20pre-buy\x20configuration).\x20If\x20post-buy\x20agent\x20change\x20is\x20needed,\x20use\x20transfer_to\x20a\x20new\x20owner\x20who\x20has\x20the\x20desired\x20agents.','evidence':'operation=agent_set,\x20progress_bound='+a['progress_bound']};return null;}},R_O_4_03={'id':'R-O-4-03','category':'lifecycle','trigger':'Progress\x20advance\x20attempted\x20without\x20progress\x20bound','check':a=>{if(a['operation']==='progress_advance'&&a['progress_bound']===![])return{'id':'R-O-4-03','level':'HIGH','category':'lifecycle','title':'Cannot\x20advance\x20Progress\x20—\x20no\x20Progress\x20bound\x20to\x20Order','description':'Order\x20has\x20no\x20progress\x20field\x20set\x20(Service\x20had\x20no\x20machine\x20configured).\x20Cannot\x20advance\x20a\x20non-existent\x20Progress.\x20SDK\x20CallOrder\x20validates\x20this\x20pre-flight\x20(CallOrder_Data.progress\x20requires\x20order.machine\x20and\x20order.progress).','affected_stakeholders':['owner','agent'],'scenario':'Buyer\x20tries\x20to\x20advance\x20Progress\x20on\x20an\x20Order\x20created\x20from\x20a\x20Service\x20without\x20machine','mitigation':'Use\x20a\x20Service\x20with\x20machine\x20configured.\x20If\x20manual\x20lifecycle\x20is\x20needed,\x20track\x20state\x20off-chain.','evidence':'operation=progress_advance,\x20progress_bound=false'};return null;}},R_O_4_04={'id':'R-O-4-04','category':'lifecycle','trigger':'arb_confirm/arb_objection/arb_claim_compensation\x20(irreversible\x20Arb\x20operations)','check':a=>{if(!a['operation'])return null;if(a['operation']==='arb_confirm'||a['operation']==='arb_objection'||a['operation']==='arb_claim_compensation')return{'id':'R-O-4-04','level':'HIGH','category':'lifecycle','title':a['operation']+'\x20is\x20irreversible\x20(triggers\x20Arb\x20flow)','description':a['operation']+'\x20triggers\x20the\x20Arbitration\x20workflow\x20which\x20cannot\x20be\x20undone.\x20arb_confirm\x20files\x20a\x20new\x20dispute,\x20arb_objection\x20requests\x20re-arbitration,\x20arb_claim_compensation\x20sets\x20claimed_by\x20permanently.','affected_stakeholders':['owner','agent','arbitrator'],'scenario':'User\x20accidentally\x20files\x20arb_confirm\x20without\x20understanding\x20consequences','mitigation':'Add\x20explicit\x20user\x20confirmation\x20(C-O-08,\x20C-O-11,\x20C-O-12)\x20before\x20these\x20operations.\x20Show\x20warning\x20text\x20describing\x20irreversibility.','evidence':'operation='+a['operation']};return null;}},R_O_4_05={'id':'R-O-4-05','category':'lifecycle','trigger':'receive\x20attempted\x20while\x20Progress\x20not\x20at\x20terminal\x20node','check':a=>{if(a['operation']==='receive'&&a['progress_bound']&&!a['progress_at_terminal'])return{'id':'R-O-4-05','level':'HIGH','category':'lifecycle','title':'receive\x20blocked\x20—\x20Order\x20still\x20delivering\x20(E_ORDER_DELIVERING)','description':'owner_receive\x20aborts\x20E_ORDER_DELIVERING\x20when\x20Progress\x20has\x20not\x20reached\x20a\x20terminal\x20node.\x20Funds\x20cannot\x20be\x20collected\x20until\x20fulfillment\x20completes.','affected_stakeholders':['owner'],'scenario':'Buyer\x20tries\x20to\x20collect\x20refund\x20before\x20Progress\x20reaches\x20\x27completed\x27\x20or\x20\x27cancelled\x27','mitigation':'Wait\x20for\x20Progress\x20to\x20reach\x20terminal/cancel\x20node.\x20If\x20urgent,\x20file\x20arb_confirm\x20to\x20dispute.','evidence':'operation=receive,\x20progress_at_terminal='+a['progress_at_terminal']};return null;}},R_O_4_06={'id':'R-O-4-06','category':'lifecycle','trigger':'transfer_to\x20attempted\x20(irreversible\x20ownership\x20transfer)','check':a=>{if(a['operation']!=='transfer_to')return null;return{'id':'R-O-4-06','level':'CRITICAL','category':'lifecycle','title':'transfer_to\x20is\x20IRREVERSIBLE\x20—\x20new\x20owner\x20takes\x20over\x20ALL\x20permissions','description':'Ownership\x20transfer\x20to\x20'+(a['transfer_to_new_owner']??'(unknown)')+'\x20is\x20permanent.\x20New\x20owner\x20becomes\x20the\x20sole\x20receiver\x20of\x20payments\x20and\x20gains\x20full\x20L1\x20control.\x20Original\x20owner\x20loses\x20ALL\x20access.','affected_stakeholders':['owner'],'scenario':'Buyer\x20transfers\x20Order\x20to\x20wrong\x20address\x20by\x20mistake','mitigation':'1)\x20Verify\x20new\x20owner\x20address\x20twice.\x202)\x20Coordinate\x20with\x20new\x20owner\x20before\x20transfer.\x203)\x20Add\x20explicit\x20user\x20confirmation\x20(C-O-09).\x20Note:\x20transfer_to\x20is\x20NOT\x20blocked\x20by\x20progress\x20binding\x20(unlike\x20agent_set).','evidence':'new_owner='+a['transfer_to_new_owner']};}},R_O_5_01={'id':'R-O-5-01','category':'cross_object','trigger':'Service.machine\x20upgraded\x20after\x20Order\x20creation\x20(snapshot\x20divergence)','check':a=>{if(a['is_buy_operation'])return{'id':'R-O-5-01','level':'LOW','category':'cross_object','title':'Service\x20snapshot\x20mechanism\x20—\x20order.machine\x20is\x20a\x20copy,\x20not\x20a\x20reference','description':'When\x20service::buy()\x20creates\x20an\x20Order,\x20order.machine\x20is\x20COPIED\x20from\x20service.machine.\x20Future\x20Service.machine\x20upgrades\x20do\x20NOT\x20affect\x20this\x20Order.\x20Same\x20Service\x20may\x20have\x20Orders\x20running\x20different\x20Machine\x20versions.','affected_stakeholders':['owner','service_provider','arbitrator'],'scenario':'Service\x20provider\x20upgrades\x20Machine\x20workflow\x20—\x20old\x20Orders\x20keep\x20old\x20workflow','mitigation':'Track\x20Machine\x20version\x20per\x20Order\x20(via\x20order.machine\x20address).\x20Plan\x20migration\x20paths\x20for\x20legacy\x20Orders.\x20Document\x20that\x20old\x20Orders\x20are\x20decoupled.','evidence':'snapshot_mechanism'};return null;}},R_O_5_02={'id':'R-O-5-02','category':'cross_object','trigger':'Order\x20references\x20Progress\x20that\x20no\x20longer\x20exists\x20or\x20is\x20corrupted','check':a=>{if(a['progress_bound']&&a['object'])return{'id':'R-O-5-02','level':'MEDIUM','category':'cross_object','title':'Order-Progress\x201:1\x20binding\x20(E_PROGRESS_ALREADY_SPECIFIED)','description':'Order.progress\x20is\x20one-time-set\x20via\x20on_progress\x20(package-only).\x20Cannot\x20be\x20rebound.\x20If\x20Progress\x20object\x20is\x20corrupted,\x20Order\x20becomes\x20stuck\x20—\x20cannot\x20advance,\x20cannot\x20rebind.','affected_stakeholders':['owner','agent'],'scenario':'Progress\x20object\x20becomes\x20unresponsive\x20or\x20corrupted','mitigation':'Ensure\x20Progress\x20integrity\x20via\x20Machine\x20audit\x20before\x20publishing\x20Service.\x20Use\x20arb_claim_compensation\x20as\x20escape\x20hatch\x20if\x20Progress\x20is\x20stuck.','evidence':'progress_bound='+a['progress_bound']};return null;}},R_O_5_03={'id':'R-O-5-03','category':'cross_object','trigger':'Order\x20references\x20Allocation\x20that\x20no\x20longer\x20exists\x20or\x20is\x20corrupted','check':a=>{if(a['object']&&a['progress_bound'])return{'id':'R-O-5-03','level':'MEDIUM','category':'cross_object','title':'Order-Allocation\x201:1\x20binding\x20(E_ALLOCATION_ALREADY_SPECIFIED)','description':'Order.allocation\x20is\x20one-time-set\x20via\x20on_allocation\x20(package-only).\x20Cannot\x20be\x20rebound.\x20If\x20Allocation\x20object\x20is\x20corrupted,\x20fund\x20distribution\x20is\x20blocked.','affected_stakeholders':['owner','service_provider'],'scenario':'Allocation\x20object\x20has\x20wrong\x20allocator\x20configuration','mitigation':'Audit\x20order_allocators\x20configuration\x20on\x20Service\x20BEFORE\x20publishing.\x20Use\x20compensation_fund\x20as\x20fallback\x20fund\x20source.','evidence':'allocation_binding'};return null;}},R_O_5_04={'id':'R-O-5-04','category':'cross_object','trigger':'Arbitration\x20dispute\x20appended\x20to\x20Order.dispute\x20list','check':a=>{if(a['operation']==='arb_confirm')return{'id':'R-O-5-04','level':'LOW','category':'cross_object','title':'Arb\x20object\x20will\x20be\x20appended\x20to\x20order.dispute\x20(package-only\x20dispute())','description':'arb_confirm\x20triggers\x20Arb\x20module\x20to\x20call\x20order::dispute(arb_address),\x20appending\x20the\x20Arb\x20object\x20to\x20order.dispute\x20list.\x20Max\x2010\x20disputes\x20(MAX_DISPUTE_COUNT).\x20Frozen\x20when\x20claimed_by\x20is\x20set.','affected_stakeholders':['arbitrator','owner','agent'],'scenario':'Multiple\x20arb_confirm\x20calls\x20create\x20multiple\x20Arb\x20objects\x20on\x20same\x20Order','mitigation':'Track\x20dispute\x20count.\x20Once\x20at\x2010,\x20no\x20more\x20disputes\x20can\x20be\x20filed.\x20Resolve\x20existing\x20disputes\x20before\x20filing\x20new\x20ones.','evidence':'operation=arb_confirm,\x20current_disputes='+(a['current_dispute_count']??0x0)};return null;}},R_O_5_05={'id':'R-O-5-05','category':'cross_object','trigger':'External\x20system\x20expects\x20OrderCompletedEvent\x20(does\x20not\x20exist)','check':a=>{if(a['is_buy_operation']||a['object'])return{'id':'R-O-5-05','level':'MEDIUM','category':'cross_object','title':'Only\x20NewOrderEvent\x20emitted\x20—\x20no\x20OrderCompletedEvent','description':'Move\x20contract\x20ONLY\x20emits\x20NewOrderEvent\x20at\x20creation.\x20Order\x20completion/cancellation/refund\x20are\x20IMPLICIT\x20—\x20must\x20be\x20inferred\x20by\x20querying\x20Progress.current_node\x20(terminal?\x20cancel?)\x20or\x20Order.claimed_by.\x20External\x20monitoring\x20requires\x20polling,\x20not\x20event-driven.','affected_stakeholders':['system'],'scenario':'Analytics\x20dashboard\x20expects\x20OrderCompletedEvent\x20to\x20track\x20completion\x20rate','mitigation':'Build\x20composite\x20query:\x20NewOrderEvent\x20+\x20Order.progress\x20query\x20→\x20infer\x20completion.\x20Document\x20this\x20limitation\x20in\x20monitoring\x20tools.\x20Long-term:\x20advocate\x20for\x20Move\x20upgrade\x20to\x20add\x20OrderCompletedEvent.','evidence':'no_order_completed_event'};return null;}},R_O_5_06={'id':'R-O-5-06','category':'cross_object','trigger':'service::buy\x20pre-flight:\x20Service\x20not\x20published\x20or\x20paused','check':a=>{if(!a['is_buy_operation'])return null;if(a['service_published']===![])return{'id':'R-O-5-06','level':'CRITICAL','category':'cross_object','title':'Service\x20not\x20published\x20—\x20service::buy\x20will\x20abort\x20E_NOT_PUBLISHED','description':'Cannot\x20create\x20Order\x20from\x20an\x20unpublished\x20Service.\x20Service\x20must\x20be\x20published\x20(bPublished=true)\x20before\x20service::buy()\x20can\x20be\x20called.','affected_stakeholders':['owner'],'scenario':'Buyer\x20attempts\x20to\x20purchase\x20from\x20a\x20draft\x20Service','mitigation':'Verify\x20Service.bPublished=true\x20before\x20service::buy().\x20Service\x20owner\x20must\x20call\x20service::publish()\x20first.','evidence':'service_published='+a['service_published']};if(a['service_paused']===!![])return{'id':'R-O-5-06','level':'CRITICAL','category':'cross_object','title':'Service\x20paused\x20—\x20service::buy\x20will\x20abort\x20E_PAUSED','description':'Cannot\x20create\x20Order\x20from\x20a\x20paused\x20Service.\x20Service\x20must\x20be\x20unpaused\x20before\x20service::buy()\x20can\x20be\x20called.','affected_stakeholders':['owner'],'scenario':'Buyer\x20attempts\x20to\x20purchase\x20from\x20a\x20paused\x20Service\x20(e.g.\x20during\x20maintenance)','mitigation':'Wait\x20for\x20Service\x20owner\x20to\x20call\x20service::pause(false).\x20Check\x20Service.paused\x20before\x20service::buy().','evidence':'service_paused='+a['service_paused']};return null;}},ALL_RULES=[R_O_1_01,R_O_1_02,R_O_1_03,R_O_1_04,R_O_1_05,R_O_2_01,R_O_2_02,R_O_2_03,R_O_2_04,R_O_3_01,R_O_3_02,R_O_3_03,R_O_3_04,R_O_4_01,R_O_4_02,R_O_4_03,R_O_4_04,R_O_4_05,R_O_4_06,R_O_5_01,R_O_5_02,R_O_5_03,R_O_5_04,R_O_5_05,R_O_5_06];export const ORDER_RISK_VERSION='1.0.0';export function getAllOrderRiskRules(){return[...ALL_RULES];}export function getOrderRiskRulesCount(){return ALL_RULES['length'];}export function getOrderRiskRulesByCategory(a){return ALL_RULES['filter'](b=>b['category']===a);}export function getOrderRiskRuleById(a){return ALL_RULES['find'](b=>b['id']===a);}export function assessOrderRisks(a){const b=[];for(const g of ALL_RULES){const h=g['check'](a);if(h)b['push'](h);}const c=b['length']===0x0?'LOW':b['some'](i=>i['level']==='CRITICAL')?'CRITICAL':b['some'](i=>i['level']==='HIGH')?'HIGH':b['some'](i=>i['level']==='MEDIUM')?'MEDIUM':'LOW',d={};for(const i of b){d[i['category']]=(d[i['category']]??0x0)+0x1;}const e={};for(const j of b){for(const k of j['affected_stakeholders']){if(!e[k])e[k]=[];e[k]['push'](j['id']+':\x20'+j['mitigation']);}}let f;if(a['operation']){const l={'agent_set':'order_set_agent','required_info_update':'order_required_info','progress_advance':'order_advance','arb_confirm':'order_arb_confirm','arb_objection':'order_arb_objection','arb_claim_compensation':'order_arb_claim_compensation','receive':'order_receive','transfer_to':'order_transfer','service_buy':'order_create'};f=findSceneById(l[a['operation']]??'');}return{'summary':'Assessed\x20'+b['length']+'\x20risk(s)\x20across\x20'+Object['keys'](d)['length']+'\x20categories','scene':f,'risks':b,'overall_risk':c,'risks_by_category':d,'stakeholder_advice':e,'needs_human_review':b['some'](m=>m['level']==='CRITICAL'||m['level']==='HIGH')};}export function checkPermissionLayer(a,b,c){const d=['receive','transfer_to','owner_change','agent_set'],e=['required_info_update','progress_advance','arb_confirm','arb_objection','arb_claim_compensation'],f=['on_progress','on_allocation','dispute','compensate'];if(f['includes'](a))return{'allowed':![],'layer':'L3_package_only','reason':'Package-only\x20—\x20not\x20callable\x20externally'};if(d['includes'](a)){if(!b)return{'allowed':![],'layer':'L1_owner_only','reason':'Owner-only\x20operation\x20('+a+')\x20—\x20agent\x20or\x20unauthorized\x20caller'};return{'allowed':!![],'layer':'L1_owner_only'};}if(e['includes'](a)){if(!b&&!c)return{'allowed':![],'layer':'L2_owner_or_agent','reason':'Requires\x20owner\x20or\x20agent\x20permission\x20('+a+')'};return{'allowed':!![],'layer':'L2_owner_or_agent'};}return{'allowed':![],'layer':'L3_package_only','reason':'Unknown\x20operation:\x20'+a};}