@wowok/agent-mcp 3.0.5 → 3.0.6

package/dist/knowledge/guard-risk.js

@@ -1 +1 @@
-import{GUARDQUERY}from'@wowok/wowok';export const GUARD_COGNITIVE_PRINCIPLES=[{'id':'P1','title':'Guard\x20validation\x20always\x20precedes\x20the\x20operation','statement':'Guard\x20validation\x20ALWAYS\x20occurs\x20BEFORE\x20the\x20operation\x20it\x20guards.\x20'+'A\x20Guard\x20must\x20NOT\x20depend\x20on\x20data\x20that\x20the\x20current\x20operation\x20will\x20modify.','code_evidence':'progress.move\x20next_with_passport_imp:\x20result_for_guard\x20(line\x20471)\x20'+'runs\x20before\x20session_accomplish\x20(line\x20481)\x20which\x20sets\x20self.current\x20(line\x20443).','legitimate_exception':'Querying\x20progress.current\x20of\x20a\x20DIFFERENT\x20Progress\x20object\x20(cross-machine)\x20'+'is\x20safe\x20and\x20reasonable\x20—\x20that\x20progress\x20is\x20not\x20modified\x20by\x20the\x20current\x20operation.','scope':'Applies\x20when\x20a\x20Guard\x20queries\x20state\x20of\x20the\x20SAME\x20object\x20the\x20operation\x20mutates.'},{'id':'P2','title':'Guard\x20is\x20CREATE-only\x20and\x20immutable','statement':'After\x20creation,\x20Guard\x20table/root/rely\x20cannot\x20be\x20modified.\x20'+'To\x20change\x20logic,\x20create\x20a\x20new\x20Guard\x20and\x20rebind\x20references.','scope':'Applies\x20to\x20all\x20Guard\x20lifecycle\x20decisions.'}];function rootStr(a){return JSON['stringify'](a['root'])['toLowerCase']();}function hasSignerCheck(a){return JSON['stringify'](a['root'])['includes']('\x22Signer\x22');}function hasClockCheck(a){return JSON['stringify'](a['root'])['includes']('\x22Clock\x22');}function hasGuardSelfRef(a){return JSON['stringify'](a['root'])['includes']('\x22Guard\x22');}function hasWitness(a){const b=JSON['stringify'](a);return b['includes']('\x22convert_witness\x22');}function queriesRepository(a){return rootStr(a)['includes']('repository');}function queriesProgress(a){return rootStr(a)['includes']('progress');}function extractWitnessCodes(a){const b=[],c=JSON['stringify'](a),d=c['matchAll'](/"convert_witness"\s*:\s*(\d+)/g);for(const e of d){const f=parseInt(e[0x1],0xa);if(f>=0x64&&f<=0x6c)b['push'](f);}return b;}const WITNESS_CHAIN={0x64:['Order','Progress'],0x65:['Order','Machine'],0x66:['Order','Service'],0x67:['Progress','Machine'],0x68:['Arb','Order'],0x69:['Arb','Arbitration'],0x6a:['Arb','Order','Progress'],0x6b:['Arb','Order','Service'],0x6c:['Arb','Order','Machine']};function extractWitnessIdentifierPairs(a){const b=[],c=new WeakSet();function d(e){if(e===null||typeof e!=='object')return;if(c['has'](e))return;c['add'](e);typeof e['convert_witness']==='number'&&typeof e['identifier']==='number'&&b['push']({'code':e['convert_witness'],'identifier':e['identifier']});for(const f of Object['keys'](e)){const g=e[f];if(Array['isArray'](g)){for(const h of g)d(h);}else g!==null&&typeof g==='object'&&d(g);}}return d(a),b;}function getChildNodes(a){if(!a||typeof a!=='object')return[];const b=[];if(Array['isArray'](a['nodes']))b['push'](...a['nodes']);if(a['left'])b['push'](a['left']);if(a['right'])b['push'](a['right']);if(a['vec'])b['push'](a['vec']);if(a['target'])b['push'](a['target']);if(a['object']&&typeof a['object']==='object')b['push'](a['object']);if(Array['isArray'](a['parameters']))b['push'](...a['parameters']);return b['filter'](d=>d&&typeof d==='object');}function findSignerLogicEqualNodes(a){const b=[];function c(d,e){if(!d||typeof d!=='object')return;if(d['type']==='logic_equal'){const f=Array['isArray'](d['nodes'])?d['nodes']:d['left']&&d['right']?[d['left'],d['right']]:[];if(f['length']===0x2){const g=f['findIndex'](h=>h?.['type']==='context'&&h?.['context']==='Signer');g>=0x0&&b['push']({'node':d,'parentType':e,'otherOperand':f[0x1-g]});}}for(const h of getChildNodes(d)){c(h,d['type']);}}return c(a,null),b;}function detectLevel1StrictBinding(a,b){const c=findSignerLogicEqualNodes(a);for(const d of c){const e=d['otherOperand'];if(e?.['type']==='identifier'){const f=b['find'](g=>g['identifier']===e['identifier']);if(f&&!f['b_submission']&&f['value_type']==='Address'&&typeof f['value']==='string'&&f['value']['length']>0x0)return{'detected':!![],'entry':{'identifier':f['identifier'],'value':f['value'],'name':f['name']}};}}return{'detected':![]};}function isSignerCheckInLogicOr(a){const b=findSignerLogicEqualNodes(a);return b['some'](c=>c['parentType']==='logic_or');}const QUERY_INVARIANT_MAP=((()=>{const a=new Map();for(const b of GUARDQUERY){b['invariant']!==undefined&&a['set'](b['id'],b['invariant']);}return a;})());function extractQueryIds(a){const b=[],c=JSON['stringify'](a),d=c['matchAll'](/"query"\s*:\s*(\d+)/g);for(const f of d){const g=parseInt(f[0x1],0xa);if(!b['includes'](g))b['push'](g);}const e=c['matchAll'](/"query"\s*:\s*"([^"]+)"/g);for(const h of e){const i=h[0x1],j=GUARDQUERY['find'](k=>k['name']===i);if(j&&!b['includes'](j['id']))b['push'](j['id']);}return b;}function getQueryInvariant(a){return QUERY_INVARIANT_MAP['get'](a);}function rootHasNonZeroQuery(a){const b=extractQueryIds(a);return b['some'](c=>QUERY_INVARIANT_MAP['has'](c));}function rootAllQueriesNonZero(a){const b=extractQueryIds(a);if(b['length']===0x0)return![];return b['every'](c=>QUERY_INVARIANT_MAP['has'](c));}const REENTRANCY_SPECS=[{'sceneId':'reward_guard','level':'critical','existsPrimitives':[0x64d],'countPrimitives':[0x64c],'addressPrimitives':[0x65a],'rationale':'Guard\x20pass\x20distributes\x20reward\x20funds\x20to\x20the\x20Claimant\x20AND\x20creates\x20a\x20reward_record,\x20but\x20the\x20Guard\x20conditions\x20(identity,\x20time,\x20node\x20state)\x20do\x20NOT\x20naturally\x20invalidate\x20after\x20a\x20claim.\x20'+'Without\x20an\x20explicit\x20anti-reentrancy\x20primitive,\x20the\x20same\x20Claimant\x20can\x20repeatedly\x20pass\x20the\x20Guard\x20and\x20DRAIN\x20THE\x20ENTIRE\x20POOL.\x20'+'This\x20is\x20the\x20most\x20severe\x20reentrancy\x20scene\x20—\x20direct\x20fund\x20loss.','mitigation':'Add\x20ONE\x20of\x20the\x20following\x20to\x20the\x20root\x20(wrapped\x20in\x20logic_and\x20with\x20existing\x20conditions):\x0a'+'\x20\x20-\x20logic_not(query(\x27reward.record\x20has\x27,\x20object=reward,\x20parameters=[claimant_address]))\x20—\x20RECOMMENDED\x20(per-user\x20Bool\x20check)\x0a'+'\x20\x20-\x20logic_equal([query(\x27reward.record\x20count\x27,\x20object=reward),\x20identifier(N)])\x20where\x20table[N].value=0\x20—\x20total-claim\x20count\x20is\x200\x0a'+'\x20\x20-\x20logic_not(query(\x27reward.record.find_first\x27,\x20object=reward,\x20where={...}))\x20—\x20no\x20matching\x20record\x20found\x0a'+'Reference\x20template:\x20MyShop_Advanced\x20Guard\x207\x20condition\x204\x20(logic_not(query_reward_record_exists(where.storeFromId=order_id)))'},{'sceneId':'arbitration_voting_guard','level':'critical','existsPrimitives':[0x57c,0x57e],'countPrimitives':[0x57d],'addressPrimitives':[],'rationale':'Guard\x20pass\x20counts\x20the\x20vote\x20with\x20the\x20extracted\x20weight.\x20Without\x20anti-reentrancy,\x20the\x20same\x20voter\x20can\x20vote\x20MULTIPLE\x20times,\x20'+'multiplying\x20their\x20weight\x20and\x20skewing\x20the\x20arbitration\x20result\x20—\x20which\x20directly\x20determines\x20fund\x20ownership\x20via\x20compensation.\x20'+'The\x20voter\x27s\x20eligibility\x20(identity,\x20reputation)\x20does\x20NOT\x20naturally\x20invalidate\x20after\x20voting.\x20'+'Note:\x20arb.voted_count\x20(1403)\x20is\x20total\x20voter\x20count\x20(NOT\x20per-voter)\x20and\x20does\x20NOT\x20serve\x20as\x20an\x20anti-reentrancy\x20primitive\x20for\x20an\x20individual\x20voter.','mitigation':'Add\x20ONE\x20of\x20the\x20following\x20to\x20the\x20root\x20(wrapped\x20in\x20logic_and):\x0a'+'\x20\x20-\x20logic_not(query(\x27arb.voted\x20has\x27,\x20object=arb,\x20parameters=[voter_address]))\x20—\x20RECOMMENDED\x20(per-voter\x20Bool)\x0a'+'\x20\x20-\x20logic_not(query(\x27arb.voted.agree\x20has\x27,\x20object=arb,\x20parameters=[voter_address,\x20proposition_index]))\x20—\x20per-voter-per-proposition\x0a'+'\x20\x20-\x20logic_equal([query(\x27arb.voted.agree\x20count\x27,\x20object=arb,\x20parameters=[voter_address]),\x20identifier(N)])\x20where\x20table[N].value=0'},{'sceneId':'arbitration_usage_guard','level':'high','existsPrimitives':[0x61d],'countPrimitives':[0x61c],'addressPrimitives':[],'rationale':'Guard\x20pass\x20creates\x20a\x20new\x20Arb\x20case.\x20Without\x20anti-reentrancy,\x20a\x20customer\x20can\x20create\x20multiple\x20Arb\x20cases\x20for\x20the\x20SAME\x20Order\x20'+'(up\x20to\x20MAX_DISPUTE_COUNT=10\x20per\x20order.move\x20L96),\x20harassing\x20the\x20counterparty\x20and\x20inflating\x20arbitration\x20system\x20load.\x20'+'Not\x20direct\x20fund\x20loss,\x20but\x20severe\x20system\x20abuse.\x20order::dispute\x20(order.move\x20L93-99)\x20deduplicates\x20by\x20Arb\x20address\x20but\x20does\x20NOT\x20prevent\x20multiple\x20distinct\x20Arbs.','mitigation':'Add\x20ONE\x20of\x20the\x20following\x20to\x20the\x20root\x20(wrapped\x20in\x20logic_and):\x0a'+'\x20\x20-\x20logic_not(query(\x27order.dispute\x20has\x27,\x20object=order,\x20parameters=[existing_arb_address]))\x20—\x20per-Arb\x20check\x0a'+'\x20\x20-\x20logic_equal([query(\x27order.dispute\x20count\x27,\x20object=order),\x20identifier(N)])\x20where\x20table[N].value=0\x20—\x20STRICT:\x20block\x20any\x20prior\x20dispute\x0a'+'\x20\x20-\x20logic_as_u256_less_or_equal([query(\x27order.dispute\x20count\x27,\x20object=order),\x20identifier(N)])\x20where\x20table[N].value=K\x20—\x20LENIENT:\x20allow\x20up\x20to\x20K\x20disputes'},{'sceneId':'service_order_allocators_guard','level':'low','existsPrimitives':[0x620],'countPrimitives':[],'addressPrimitives':[0x621],'rationale':'Protocol-level\x20protection:\x20order::on_allocation\x20(order.move\x20L116-119)\x20asserts\x20ONE\x20Allocation\x20per\x20Order\x20(E_ALLOCATION_ALREADY_SPECIFIED).\x20'+'After\x20alloc()\x20executes,\x20typical\x20Rate-mode\x20allocators\x20(sum=10000)\x20and\x20Surplus-mode\x20allocators\x20drain\x20balance\x20to\x200,\x20making\x20reentrancy\x20unprofitable.\x20'+'EDGE\x20CASE:\x20Amount-mode-only\x20allocators\x20(no\x20Surplus,\x20total\x20<\x20full\x20balance)\x20leave\x20remainder;\x20a\x20second\x20alloc()\x20could\x20extract\x20more\x20—\x20mitigated\x20by\x20preferring\x20Rate/Surplus\x20modes.\x20'+'External\x20deposit\x20via\x20receive()\x20is\x20possible\x20but\x20irrational\x20(attacker\x20funds\x20the\x20Allocation\x20they\x20attack).','mitigation':'Default:\x20no\x20action\x20needed\x20(protocol-level\x20guard).\x20IF\x20using\x20Amount-mode-only\x20allocators\x20without\x20Surplus:\x20'+'consider\x20adding\x20logic_not(query(\x27order.allocation\x20some\x27,\x20object=order))\x20OR\x20switch\x20to\x20Rate/Surplus\x20mode\x20to\x20drain\x20balance\x20completely.'},{'sceneId':'service_buy_guard','level':'low','existsPrimitives':[],'countPrimitives':[],'addressPrimitives':[],'rationale':'Each\x20purchase\x20creates\x20a\x20fresh\x20Order;\x20no\x20existing\x20Order\x20state\x20is\x20modified.\x20Default:\x20no\x20reentrancy\x20risk.\x20'+'IF\x20business\x20intent\x20is\x20\x27limit\x20one\x20purchase\x20per\x20user\x27\x20(limited-edition\x20goods,\x20whitelist\x20single-buy),\x20an\x20anti-reentrancy\x20check\x20is\x20REQUIRED\x20'+'but\x20no\x20direct\x20GUARDQUERY\x20primitive\x20exists\x20for\x20per-user\x20purchase\x20history.','mitigation':'IF\x20limit-purchase\x20intent:\x20record\x20purchases\x20in\x20a\x20Repository\x20and\x20add\x20logic_not(query(\x27repository.data\x20has\x27,\x20...))\x20to\x20root;\x20'+'OR\x20revoke\x20EntityRegistrar\x20membership\x20after\x20first\x20buy;\x20OR\x20use\x20an\x20off-chain\x20allowlist\x20with\x20on-chain\x20Merkle\x20proof.'},{'sceneId':'repository_write_guard','level':'low','existsPrimitives':[0x48e],'countPrimitives':[],'addressPrimitives':[],'rationale':'Default\x20writes\x20are\x20idempotent\x20(same\x20ID\x20overwrites,\x20different\x20ID\x20appends);\x20no\x20fund\x20flow.\x20'+'IF\x20business\x20intent\x20is\x20\x27one\x20write\x20per\x20ID\x27\x20(voting,\x20immutable\x20credential,\x20single-attestation),\x20an\x20anti-reentrancy\x20check\x20is\x20needed.','mitigation':'IF\x20one-write-per-ID\x20intent:\x20add\x20logic_not(query(\x27repository.data\x20has\x27,\x20object=repository,\x20parameters=[policy_name,\x20user_or_object_id]))\x20to\x20root.'},{'sceneId':'gen_passport_guard','level':'low','existsPrimitives':[],'countPrimitives':[],'addressPrimitives':[],'rationale':'Each\x20gen_passport\x20call\x20generates\x20an\x20independent\x20Passport\x20(one\x20Passport\x20per\x20operation).\x20'+'Multiple\x20Passports\x20for\x20the\x20same\x20user\x20are\x20usually\x20valid\x20(each\x20serves\x20a\x20different\x20subsequent\x20operation).\x20'+'IF\x20business\x20intent\x20is\x20\x27one\x20active\x20Passport\x20per\x20user\x27,\x20an\x20anti-reentrancy\x20check\x20is\x20needed\x20but\x20no\x20direct\x20GUARDQUERY\x20primitive\x20exists.','mitigation':'IF\x20one-passport-per-user\x20intent:\x20use\x20off-chain\x20tracking\x20or\x20a\x20Repository\x20to\x20record\x20issued\x20Passport\x20IDs.'}],QUERY_TYPE_ALIASES=new Map([['query_reward_record_exists',0x64d],['query_reward_record_count',0x64c],['query_reward_record_find',0x65a],['query_progress_history_find',0x4fa],['query_progress_history_session_find',0x4fb],['query_progress_history_session_forward_find',0x4fc],['query_progress_history_session_count',0x4f9],['query_progress_history_session_forward_count',0x4ee]]);function detectReentrancyProtection(a,b,c){const d=new Set([...c['existsPrimitives'],...c['countPrimitives'],...c['addressPrimitives']]);if(d['size']===0x0)return{'state':'absent','evidence':'No\x20anti-reentrancy\x20primitive\x20available\x20in\x20GUARDQUERY\x20for\x20this\x20scene'};const e=new Map(),f=new Map();for(const p of d){const q=GUARDQUERY['find'](r=>r['id']===p);q&&(e['set'](p,q['name']),f['set'](q['name'],p));}const g=Array['from'](f['keys']());function h(r){if(!r||typeof r!=='object')return-0x1;if(typeof r['query']==='number'&&d['has'](r['query']))return r['query'];if(typeof r['query']==='string'&&f['has'](r['query']))return f['get'](r['query']);if(typeof r['type']==='string'&&QUERY_TYPE_ALIASES['has'](r['type'])){const s=QUERY_TYPE_ALIASES['get'](r['type']);if(d['has'](s))return s;}if(typeof r['type']==='string'&&f['has'](r['type']))return f['get'](r['type']);return-0x1;}function i(r){if(!r||typeof r!=='object')return![];if(typeof r['type']==='string'&&['number','u8','u16','u32','u64','u128','u256']['includes'](r['type']))return r['value']===0x0||r['value']==='0'||r['value']===0x0n;if(r['type']==='identifier'&&typeof r['identifier']==='number'){const s=b['find'](t=>t['identifier']===r['identifier']);if(s&&!s['b_submission'])return s['value']===0x0||s['value']==='0'||s['value']===0x0n;}return![];}function j(r,s){if(!r||typeof r!=='object')return[];const t=[];if(Array['isArray'](r['nodes']))for(const u of r['nodes']){if(u!==s)t['push'](u);}if(r['left']&&r['left']!==s)t['push'](r['left']);if(r['right']&&r['right']!==s)t['push'](r['right']);return t['filter'](v=>v&&typeof v==='object');}let k=![],l=![],m='',n='';function o(r,s){if(!r||typeof r!=='object')return;const t=h(r);if(t>=0x0){k=!![];const v=e['get'](t)??'query_'+t;n=v;const w=s?.['type']??null;let x=![];const y=c['existsPrimitives']['includes'](t),z=c['addressPrimitives']['includes'](t),A=c['countPrimitives']['includes'](t);(y||z)&&w==='logic_not'&&(x=!![]);if(A&&w==='logic_equal'){const B=j(s,r);B['some'](C=>i(C))&&(x=!![]);}if(x)l=!![];else{if(!m){const C=A?'logic_equal\x20with\x20a\x20zero\x20operand':'logic_not';m='Primitive\x20\x22'+v+'\x22\x20found\x20but\x20its\x20immediate\x20parent\x20is\x20'+(w??'root')+'\x20(expected\x20'+C+').\x20The\x20primitive\x20is\x20present\x20but\x20does\x20NOT\x20actually\x20prevent\x20reentrancy\x20—\x20this\x20is\x20a\x20false\x20sense\x20of\x20security.';}}}const u=[];if(Array['isArray'](r['nodes']))u['push'](...r['nodes']);if(r['left'])u['push'](r['left']);if(r['right'])u['push'](r['right']);if(r['node'])u['push'](r['node']);if(r['vec'])u['push'](r['vec']);if(r['target'])u['push'](r['target']);if(r['object']&&typeof r['object']==='object')u['push'](r['object']);if(Array['isArray'](r['parameters']))u['push'](...r['parameters']);for(const D of u){D&&typeof D==='object'&&o(D,r);}}o(a,null);if(l)return{'state':'protected','evidence':'Anti-reentrancy\x20primitive\x20\x22'+n+'\x22\x20is\x20properly\x20wrapped','foundPrimitiveName':n};if(k)return{'state':'pseudo','evidence':m,'foundPrimitiveName':n};return{'state':'absent','evidence':'No\x20anti-reentrancy\x20primitive\x20found\x20in\x20root.\x20Expected\x20one\x20of:\x20'+g['join'](',\x20')};}const RISK_RULES=[{'id':'R-C1-01','data_source_class':'type1_onchain_constant','trigger':'Guard\x20table\x20contains\x20Address\x20constants\x20with\x20b_submission=false;\x20values\x20may\x20change\x20after\x20Guard\x20rebuild','check':a=>{const b=a['table']['filter'](c=>!c['b_submission']&&c['value_type']==='Address'&&c['value']);if(b['length']===0x0)return null;return{'id':'R-C1-01','data_source_class':'type1_onchain_constant','level':'low','category':'data_source_trust','title':'Constant\x20object\x20addresses\x20may\x20be\x20inconsistent\x20after\x20Guard\x20rebuild','description':'Guard\x20table\x20contains\x20'+b['length']+'\x20Address\x20constants\x20(b_submission=false).'+'Guard\x20is\x20immutable,\x20but\x20if\x20a\x20future\x20Guard\x20rebuild\x20is\x20needed\x20(e.g.\x20to\x20fix\x20logic),\x20the\x20new\x20Guard\x27s\x20table\x20constant\x20addresses\x20may\x20differ\x20from\x20the\x20old\x20version.'+'Objects\x20referencing\x20the\x20old\x20Guard\x20(Machine/Service,\x20etc.)\x20will\x20not\x20auto-update,\x20leading\x20to\x20constant\x20address\x20inconsistency.','affected_stakeholders':['provider'],'scenario':'Guard\x20iteration:\x20after\x20rebuild,\x20constant\x20addresses\x20change\x20but\x20references\x20still\x20point\x20to\x20the\x20old\x20Guard','mitigation':'1)\x20After\x20Guard\x20rebuild,\x20update\x20all\x20references\x20(Machine\x20forward\x20guard,\x20Service\x20buy_guard,\x20etc.);'+'2)\x20Use\x20guard2file\x20to\x20export\x20a\x20backup\x20and\x20record\x20constant-address-to-semantics\x20mappings;'+'3)\x20Document\x20constant-address\x20changes\x20in\x20the\x20migration\x20notes','evidence':'Constant\x20Address\x20entries:\x20'+b['map'](c=>'#'+c['identifier']+'='+c['value'])['join'](',\x20')};}},{'id':'R-C1-02','data_source_class':'type1_onchain_constant','trigger':'Guard\x20table\x20contains\x20EntityRegistrar(0xaab)\x20or\x20EntityLinker(0xaaa)\x20system\x20address\x20constants','check':a=>{const b=a['table']['filter'](d=>!d['b_submission']&&d['value_type']==='Address'&&typeof d['value']==='string'&&(d['value']['toLowerCase']()==='0xaab'||d['value']['toLowerCase']()==='0xaaa'));if(b['length']===0x0)return null;const c=b['find'](d=>d['value']==='0xaab'&&d['name']&&!d['name']['toLowerCase']()['includes']('registrar')||d['value']==='0xaaa'&&d['name']&&!d['name']['toLowerCase']()['includes']('linker'));return{'id':'R-C1-02','data_source_class':'type1_onchain_constant','level':c?'medium':'low','category':'data_source_trust','title':c?'EntityRegistrar/EntityLinker\x20system\x20address\x20name\x20annotation\x20suspected\x20to\x20be\x20wrong':'Guard\x20uses\x20EntityRegistrar/EntityLinker\x20system\x20address\x20constants','description':'EntityRegistrar\x20(0xaab)\x20and\x20EntityLinker\x20(0xaaa)\x20are\x20fixed\x20WoWok\x20protocol\x20system\x20addresses.'+(c?'Detected\x20name\x20annotation\x20does\x20not\x20match\x20the\x20address\x20(e.g.\x200xaab\x20not\x20annotated\x20as\x20registrar),\x20which\x20may\x20cause\x20semantic\x20misunderstanding.':'Address\x20is\x20correct,\x20but\x20ensure\x20the\x20name\x20annotation\x20is\x20clear\x20to\x20avoid\x20later\x20maintenance\x20confusion.'),'affected_stakeholders':['provider'],'scenario':'System\x20address\x20misuse:\x20incorrect\x200xaab/0xaaa\x20name\x20annotation\x20causes\x20query\x20target\x20confusion','mitigation':'1)\x20Confirm\x200xaab\x20corresponds\x20to\x20EntityRegistrar\x20(entity\x20registrar);'+'2)\x20Confirm\x200xaaa\x20corresponds\x20to\x20EntityLinker\x20(entity\x20linker);'+'3)\x20The\x20table\x20entry\x20name\x20should\x20clearly\x20indicate\x20the\x20system\x20address\x20purpose','evidence':'System\x20address\x20entries:\x20'+b['map'](d=>'#'+d['identifier']+'='+d['value']+'('+d['name']+')')['join'](',\x20')};}},{'id':'R-C1-03','data_source_class':'type1_onchain_constant','trigger':'Guard\x20queries\x20Repository\x20data\x20without\x20verifying\x20writer\x20permissions','check':a=>{if(!queriesRepository(a))return null;if(hasSignerCheck(a))return null;return{'id':'R-C1-03','data_source_class':'type1_onchain_constant','level':'high','category':'data_source_trust','title':'Repository\x20data\x20source\x20does\x20not\x20verify\x20writer\x20permissions','description':'Guard\x20queries\x20Repository\x20data\x20but\x20does\x20not\x20verify\x20who\x20has\x20permission\x20to\x20write\x20to\x20that\x20Repository.'+'A\x20malicious\x20writer\x20can\x20manipulate\x20Repository\x20data\x20to\x20deceive\x20the\x20Guard.\x20As\x20a\x20Type1\x20constant\x20object,\x20'+'the\x20Repository\x27s\x20address\x20is\x20immutable,\x20but\x20its\x20internal\x20data\x20can\x20be\x20modified\x20by\x20authorized\x20writers.','affected_stakeholders':['customer','provider'],'scenario':'Data\x20source\x20manipulation:\x20attacker\x20writes\x20false\x20data\x20so\x20Guard\x20passes','mitigation':'1)\x20Restrict\x20writer\x20permissions\x20in\x20the\x20Repository\x20write_guard;'+'2)\x20Add\x20context(Signer)\x20in\x20the\x20current\x20Guard\x20to\x20verify\x20writer\x20identity;'+'3)\x20Use\x20multi-point\x20data\x20source\x20cross-validation'};}},{'id':'R-C2-01','data_source_class':'type2_witness_derived','trigger':'Guard\x20uses\x20multi-hop\x20witness\x20(106/107/108:\x20Arb→Progress/Machine/Service)\x20to\x20derive\x20target\x20object','check':a=>{const b=extractWitnessCodes(a['root']),c=b['filter'](e=>[0x6a,0x6b,0x6c]['includes'](e));if(c['length']===0x0)return null;const d={0x6a:'Arb→Progress\x20(two\x20hops:\x20arb.order\x20→\x20order.progress)',0x6b:'Arb→Machine\x20(two\x20hops:\x20arb.order\x20→\x20order.machine)',0x6c:'Arb→Service\x20(two\x20hops:\x20arb.order\x20→\x20order.service)'};return{'id':'R-C2-01','data_source_class':'type2_witness_derived','level':'medium','category':'data_source_trust','title':'Multi-hop\x20witness\x20chain\x20derivation\x20may\x20break','description':'Guard\x20uses\x20multi-hop\x20witness\x20['+c['join'](',\x20')+']\x20to\x20derive\x20target\x20object.'+'Multi-hop\x20witness\x20(e.g.\x20Arb→Progress\x20requires\x20reading\x20arb.order\x20then\x20order.progress)\x20requires\x20intermediate\x20objects\x20to\x20exist\x20and\x20fields\x20to\x20be\x20set.'+'If\x20an\x20intermediate\x20object\x20does\x20not\x20exist\x20(e.g.\x20Arb\x27s\x20order\x20field\x20is\x20empty)\x20or\x20the\x20relationship\x20chain\x20breaks,\x20witness\x20derivation\x20fails.'+'In\x20the\x20WoWok\x20protocol\x20this\x20usually\x20returns\x20empty\x20or\x200,\x20potentially\x20causing\x20unexpected\x20Guard\x20behavior.\x0a'+c['map'](e=>'\x20\x20-\x20'+e+':\x20'+d[e])['join']('\x0a'),'affected_stakeholders':['customer','provider','arbitrator'],'scenario':'Witness\x20break:\x20intermediate\x20object\x20missing\x20causes\x20derivation\x20failure\x20and\x20unexpected\x20Guard\x20behavior','mitigation':'1)\x20Confirm\x20the\x20Arb\x20object\x27s\x20order\x20field\x20is\x20properly\x20set\x20(Arb\x20is\x20bound\x20to\x20Order\x20at\x20creation);'+'2)\x20Add\x20null\x20checks\x20for\x20derived\x20results\x20in\x20Guard\x20logic;'+'3)\x20Prefer\x20single-hop\x20witness\x20(100-105)\x20to\x20reduce\x20derivation\x20chain\x20length;'+'4)\x20Test\x20the\x20edge\x20case\x20where\x20Arb\x20is\x20not\x20associated\x20with\x20an\x20Order','evidence':'Multi-hop\x20witness\x20codes:\x20'+c['join'](',\x20')};}},{'id':'R-C2-02','data_source_class':'type2_witness_derived','trigger':'Guard\x20uses\x20witness\x20but\x20source\x20object\x27s\x20object_type\x20may\x20not\x20match\x20the\x20witness\x20source\x20type,\x20or\x20multi-hop\x20chain\x20has\x20missing\x20intermediate\x20objects','check':a=>{const b=extractWitnessIdentifierPairs(a['root']),c=b['filter'](i=>i['code']>=0x64&&i['code']<=0x6c);if(c['length']===0x0)return null;const d=[],e=[];for(const {code:i,identifier:j}of c){const k=WITNESS_CHAIN[i];if(!k)continue;const l=k[0x0],m=a['table']['find'](o=>o['identifier']===j);if(!m)continue;const n=i+'\x20('+k['join']('→')+')';m['object_type']?m['object_type']!==l&&d['push']('witness\x20'+n+'\x20references\x20#'+j+'\x20'+('but\x20object_type='+m['object_type']+'\x20(expected\x20'+l+')')):e['push']('witness\x20'+n+'\x20references\x20#'+j+'\x20'+('but\x20object_type\x20is\x20not\x20set\x20(expected\x20'+l+')'));if(k['length']===0x3){const o=k[0x1],p=a['table']['some'](q=>q['object_type']===o);!p&&e['push']('witness\x20'+n+'\x20multi-hop\x20chain\x20expects\x20intermediate\x20'+(o+'\x20in\x20table,\x20but\x20no\x20entry\x20with\x20object_type='+o+'\x20found'));}}const f=d['length']+e['length'];if(f===0x0)return null;const g=d['length']>0x0?'medium':'low',h=[...d,...e];return{'id':'R-C2-02','data_source_class':'type2_witness_derived','level':g,'category':'data_source_trust','title':d['length']>0x0?'witness\x20source\x20object_type\x20explicitly\x20contradicts\x20the\x20witness\x20derivation\x20chain':'witness\x20source\x20object_type\x20annotation\x20missing\x20or\x20multi-hop\x20chain\x20incomplete','description':'Guard\x20uses\x20witness\x20derivation,\x20but\x20the\x20source\x20object\x27s\x20object_type\x20in\x20table\x20is\x20either\x20'+'inconsistent\x20with\x20the\x20witness\x20expected\x20source\x20type,\x20or\x20the\x20annotation\x20is\x20missing\x20'+'(preventing\x20validation),\x20or\x20the\x20multi-hop\x20chain\x20lacks\x20an\x20intermediate\x20object.\x0a'+h['map'](q=>'\x20\x20-\x20'+q)['join']('\x0a')+'\x0aNote:\x20object_type\x20is\x20an\x20auxiliary\x20annotation\x20field\x20on\x20table\x20entries;\x20it\x20is\x20not\x20strictly\x20'+'validated\x20at\x20on-chain\x20creation.\x20However,\x20wrong\x20or\x20missing\x20annotations\x20cause\x20semantic\x20'+'misunderstanding\x20and\x20maintenance\x20difficulty,\x20and\x20may\x20indicate\x20a\x20deeper\x20structural\x20mismatch.','affected_stakeholders':['provider'],'scenario':d['length']>0x0?'Type\x20annotation\x20mismatch:\x20witness\x20source\x20type\x20annotation\x20is\x20wrong,\x20causing\x20semantic\x20confusion':'Type\x20annotation\x20missing:\x20witness\x20source\x20type\x20cannot\x20be\x20validated,\x20raising\x20maintenance\x20risk','mitigation':'1)\x20Set\x20or\x20fix\x20the\x20table\x20entry\x27s\x20object_type\x20field\x20to\x20match\x20the\x20witness\x20source\x20type;\x0a'+'2)\x20witness\x20100-102\x20source\x20type\x20is\x20Order;\x20103\x20is\x20Progress;\x20104-108\x20is\x20Arb;\x0a'+'3)\x20For\x20multi-hop\x20witnesses\x20(106-108),\x20ensure\x20the\x20intermediate\x20Order\x20object\x20is\x20also\x20in\x20the\x20table;\x0a'+'4)\x20Use\x20wowok_buildin_info(info=\x27guard\x20instructions\x27)\x20to\x20query\x20the\x20full\x20witness\x20definition','evidence':h['join'](';\x20')};}},{'id':'R-C2-03','data_source_class':'type2_witness_derived','trigger':'Guard\x20queries\x20Progress\x20status\x20without\x20verifying\x20Machine\x20publish\x20state','check':a=>{if(!queriesProgress(a))return null;if(!hasWitness(a['root']))return null;if(a['scene']?.['host_object']!=='Machine')return null;return{'id':'R-C2-03','data_source_class':'type2_witness_derived','level':'medium','category':'data_source_trust','title':'Progress\x20data\x20depends\x20on\x20Machine\x20immutability','description':'Guard\x20queries\x20Progress\x20status\x20via\x20witness,\x20and\x20the\x20Guard\x20is\x20bound\x20to\x20a\x20Machine.'+'If\x20the\x20Machine\x20is\x20not\x20published\x20(bPublished=false),\x20the\x20Provider\x20can\x20modify\x20the\x20Machine\x20node\x20structure,\x20'+'causing\x20node\x20names\x20validated\x20by\x20the\x20Guard\x20to\x20become\x20invalid\x20or\x20be\x20renamed.\x20Progress\x27s\x20current\x20node\x20name,\x20node\x20time,\x20etc.\x20'+'all\x20depend\x20on\x20the\x20Machine\x27s\x20node\x20definitions.','affected_stakeholders':['customer'],'scenario':'Provider\x20modifies\x20Machine\x20node\x20names\x20to\x20invalidate\x20Guard\x20verification','mitigation':'1)\x20Ensure\x20the\x20Machine\x20is\x20published\x20(bPublished=true)\x20before\x20binding\x20the\x20Guard;'+'2)\x20Query\x20the\x20Machine.bPublished\x20field\x20in\x20the\x20Guard\x20to\x20verify;'+'3)\x20Use\x20node\x20IDs\x20instead\x20of\x20node\x20names\x20for\x20comparison'};}},{'id':'R-C2-04','data_source_class':'type2_witness_derived','trigger':'Guard\x20uses\x20witness\x20query\x20and\x20the\x20query\x20parameter\x20requires\x20type\x20conversion\x20(e.g.\x20Address\x20→\x20U64\x20timestamp\x20key)','check':a=>{if(!hasWitness(a['root']))return null;const b=rootStr(a),c=b['includes']('convert_number_address')||b['includes']('convert_address_number')||b['includes']('convert_u256')||b['includes']('convert_string'),d=b['includes']('repository')&&b['includes']('\x22query\x22'),e=b['includes']('progress_history')&&b['includes']('\x22query\x22');if(!d&&!e)return null;return{'id':'R-C2-04','data_source_class':'type2_witness_derived','level':'medium','category':'data_source_trust','title':'witness\x20query\x20parameter\x20requires\x20type\x20translation\x20(missing\x20will\x20cause\x20type\x20mismatch\x20or\x20wrong\x20comparison)','description':'Guard\x20queries\x20object\x20fields\x20via\x20witness,\x20but\x20the\x20query\x20parameter\x20type\x20may\x20not\x20match\x20the\x20type\x20declared\x20in\x20table.\x0a'+'Typical\x20scenarios:\x0a'+'\x20\x20-\x20Repository.data\x20query:\x20the\x20key\x20may\x20be\x20of\x20Address\x20type\x20(vector<u8>\x20address\x20representation\x20in\x20Move),\x20'+'but\x20the\x20actual\x20semantics\x20is\x20a\x20U64\x20timestamp,\x20requiring\x20convert_number_address\x20translation\x0a'+'\x20\x20-\x20Progress.history\x20query:\x20Forward\x20ID\x20may\x20need\x20to\x20be\x20converted\x20from\x20String\x20to\x20Address\x0a'+'\x20\x20-\x20Order\x20field\x20query:\x20some\x20ID\x20fields\x20may\x20be\x20stored\x20as\x20Address\x20but\x20need\x20U256\x20for\x20comparison\x0a'+(c?'\x0aThe\x20current\x20Guard\x20already\x20uses\x20type\x20conversion\x20nodes,\x20but\x20ensure\x20the\x20conversion\x20direction\x20is\x20correct.':'\x0aWarning:\x20no\x20type\x20conversion\x20node\x20detected\x20in\x20the\x20current\x20Guard;\x20parameter\x20type\x20mismatch\x20risk\x20may\x20exist.'),'affected_stakeholders':['provider','customer'],'scenario':'Query\x20parameter\x20type\x20does\x20not\x20match\x20the\x20parameters\x20type\x20defined\x20by\x20GUARDQUERY,\x20causing\x20creation\x20failure\x20or\x20runtime\x20comparison\x20error','mitigation':'1)\x20Query\x20GUARDQUERY\x20to\x20confirm\x20the\x20parameters\x20type\x20and\x20return\x20type\x20of\x20each\x20query\x20instruction;\x0a'+'2)\x20If\x20table\x20declares\x20Address\x20but\x20the\x20query\x20needs\x20U64,\x20use\x20convert_number_address\x20to\x20translate;\x0a'+'3)\x20Use\x20wowok_buildin_info\x20info=\x27guard\x20instructions\x27\x20to\x20verify\x20parameter\x20types;\x0a'+'4)\x20Verify\x20type\x20compatibility\x20via\x20schema_query\x20before\x20creation','evidence':c?'Type\x20conversion\x20node\x20in\x20use':'No\x20type\x20conversion\x20node\x20detected'};}},{'id':'R-C3-01','data_source_class':'type3_submitted_object','trigger':'Guard\x20depends\x20on\x20submitted\x20data\x20but\x20does\x20not\x20verify\x20signer\x20identity\x20(no\x20Signer\x20check=high;\x20with\x20Signer\x20check=info\x20downgrade)','check':a=>{const b=a['table']['some'](c=>c['b_submission']);if(!b)return null;if(a['scene']?.['binding_field']==='voting_guard')return null;if(a['scene']?.['id']==='service_order_allocators_guard'&&a['sharing_recipients']&&a['sharing_recipients']['length']>0x0&&!a['sharing_recipients']['includes']('Signer'))return null;if(!hasSignerCheck(a)){if(a['scene']?.['id']==='machine_forward_guard')return{'id':'R-C3-01','data_source_class':'type3_submitted_object','level':'medium','category':'submission_forgery','title':'Submitted\x20data\x20not\x20bound\x20to\x20signer\x20identity\x20(Forward\x20scenario\x20implicitly\x20verified\x20by\x20permissionIndex)','description':'Guard\x20accepts\x20runtime-submitted\x20data\x20(b_submission=true),\x20and\x20root\x20does\x20not\x20explicitly\x20verify\x20Signer.'+'This\x20Guard\x20is\x20used\x20for\x20Machine\x20Forward;\x20Forward\x27s\x20permissionIndex/namedOperator\x20already\x20implicitly\x20verifies\x20operator\x20identity,\x20'+'so\x20the\x20Signer\x20binding\x20risk\x20is\x20reduced.\x20But\x20permissionIndex\x20only\x20verifies\x20\x27operator\x20has\x20permission\x27,\x20'+'not\x20\x27submitted\x20data\x20belongs\x20to\x20operator\x27\x20—\x20for\x20example,\x20a\x20merchant\x20holding\x20permissionIndex\x20can\x20still\x20submit\x20someone\x20else\x27s\x20credentials.','affected_stakeholders':['customer','provider'],'scenario':'In-permission\x20forgery:\x20an\x20authorized\x20operator\x20submits\x20someone\x20else\x27s\x20data\x20(e.g.\x20someone\x20else\x27s\x20Merkle\x20Root)','mitigation':'1)\x20If\x20the\x20submitted\x20data\x20should\x20belong\x20to\x20the\x20operator\x20(e.g.\x20the\x20operator\x27s\x20address),\x20it\x20is\x20still\x20recommended\x20to\x20add\x20context(Signer)\x20binding;'+'2)\x20If\x20the\x20submitted\x20data\x20is\x20a\x20public\x20credential\x20(e.g.\x20Merkle\x20Root\x20string),\x20the\x20current\x20risk\x20is\x20acceptable;'+'3)\x20Use\x20retained_submission\x20to\x20retain\x20submitted\x20data\x20for\x20later\x20audit'};return{'id':'R-C3-01','data_source_class':'type3_submitted_object','level':'high','category':'submission_forgery','title':'Submitted\x20data\x20not\x20bound\x20to\x20signer\x20identity','description':'Guard\x20accepts\x20runtime-submitted\x20data\x20(b_submission=true),\x20but\x20does\x20not\x20verify\x20whether\x20the\x20submitter\x20is\x20the\x20current\x20transaction\x20signer.'+'An\x20attacker\x20can\x20submit\x20someone\x20else\x27s\x20data\x20(e.g.\x20someone\x20else\x27s\x20address,\x20someone\x20else\x27s\x20credentials)\x20to\x20pass\x20the\x20Guard.'+'Type3\x20submitted\x20objects\x20are\x20isomorphic\x20with\x20Type1\x20at\x20the\x20native\x20layer\x20(TYPE_QUERY+TYPE_CONSTANT),\x20'+'the\x20only\x20difference\x20being\x20that\x20the\x20value\x20is\x20injected\x20by\x20submission,\x20so\x20identity\x20must\x20be\x20bound\x20via\x20logical\x20constraints.','affected_stakeholders':['customer','provider'],'scenario':'Identity\x20forgery:\x20attacker\x20submits\x20someone\x20else\x27s\x20address\x20to\x20impersonate\x20an\x20authorized\x20user','mitigation':'1)\x20Add\x20context(Signer)\x20binding\x20with\x20the\x20submitted\x20data\x20for\x20verification;'+'2)\x20Use\x20vec_contains_address\x20to\x20verify\x20the\x20signer\x20is\x20in\x20the\x20whitelist;'+'3)\x20Use\x20Passport\x20credentials\x20instead\x20of\x20bare\x20address\x20submission'};}return{'id':'R-C3-01','data_source_class':'type3_submitted_object','level':'low','category':'submission_forgery','title':'Submitted\x20data\x20is\x20indirectly\x20bound\x20via\x20context(Signer)\x20(confirm\x20the\x20binding\x20direction\x20is\x20correct)','description':'Guard\x20accepts\x20runtime-submitted\x20data,\x20and\x20the\x20root\x20subtree\x20contains\x20a\x20context(Signer)\x20check,\x20'+'forming\x20an\x20indirect\x20binding\x20between\x20submitted\x20data\x20and\x20signer,\x20reducing\x20forgery\x20risk.'+'But\x20manual\x20confirmation\x20is\x20needed:\x20the\x20constant\x20compared\x20with\x20context(Signer)\x20is\x20the\x20correct\x20role\x20(e.g.\x20Provider\x20address\x20rather\x20than\x20Customer\x20address),\x20'+'and\x20the\x20submitted\x20data\x20should\x20indeed\x20be\x20provided\x20by\x20that\x20signer.\x20See\x20R-C4-01\x20Signer\x20direction\x20risk.','affected_stakeholders':['customer','provider'],'scenario':'Indirect\x20binding\x20to\x20confirm:\x20whether\x20the\x20Signer\x20check\x20direction\x20matches\x20the\x20submitted\x20data\x20ownership','mitigation':'1)\x20Confirm\x20context(Signer)\x20is\x20compared\x20with\x20the\x20correct\x20table\x20constant\x20(Provider\x20address\x20rather\x20than\x20Customer\x20address);'+'2)\x20Confirm\x20the\x20source\x20role\x20of\x20the\x20submitted\x20data\x20matches\x20the\x20Signer\x20check;'+'3)\x20For\x20stricter\x20binding,\x20use\x20query\x20to\x20verify\x20the\x20submitter\x27s\x20on-chain\x20identity'};}},{'id':'R-C3-02','data_source_class':'type3_submitted_object','trigger':'voting_guard\x20weight\x20comes\x20from\x20submitted\x20data\x20without\x20verifying\x20source','check':a=>{if(a['scene']?.['binding_field']!=='voting_guard')return null;const b=a['table']['filter'](c=>c['b_submission']&&['U8','U16','U32','U64','U128','U256']['includes'](c['value_type']));if(b['length']===0x0)return null;return{'id':'R-C3-02','data_source_class':'type3_submitted_object','level':'critical','category':'submission_forgery','title':'Voting\x20weight\x20comes\x20from\x20user\x20submission\x20and\x20may\x20be\x20forged','description':'voting_guard\x20weight\x20data\x20comes\x20from\x20table\x20entries\x20with\x20b_submission=true\x20(Type3\x20submitted\x20values).'+'If\x20the\x20weight\x20is\x20not\x20verified\x20through\x20EntityRegistrar\x20or\x20other\x20trusted\x20sources,\x20'+'a\x20voter\x20can\x20submit\x20arbitrarily\x20high\x20weights\x20to\x20manipulate\x20the\x20voting\x20result.'+'Type3\x20submitted\x20values\x20are\x20only\x20validated\x20by\x20type\x20byte\x20(value[0])\x20at\x20the\x20native\x20layer;\x20value\x20range\x20and\x20source\x20are\x20not\x20checked.','affected_stakeholders':['arbitrator'],'scenario':'Weight\x20forgery:\x20voters\x20submit\x20fake\x20high\x20scores\x20to\x20manipulate\x20the\x20arbitration\x20result','mitigation':'1)\x20Weights\x20should\x20be\x20queried\x20from\x20EntityRegistrar\x20rather\x20than\x20submitted\x20by\x20users;'+'2)\x20Use\x20query(entity.records)\x20to\x20obtain\x20on-chain\x20registered\x20reputation\x20scores;'+'3)\x20Verify\x20in\x20the\x20Guard\x20that\x20the\x20submitted\x20weight\x20matches\x20the\x20on-chain\x20record','evidence':'Submitted\x20numeric\x20entries:\x20'+b['map'](c=>'#'+c['identifier']+'('+c['value_type']+')')['join'](',\x20')};}},{'id':'R-C3-03','data_source_class':'type3_submitted_object','trigger':'Guard\x20contains\x20Address\x20entries\x20with\x20b_submission=true;\x20the\x20runtime\x20submitted\x20object\x20type\x20may\x20not\x20match\x20expectations','check':a=>{const b=a['table']['filter'](f=>f['b_submission']&&f['value_type']==='Address');if(b['length']===0x0)return null;const c=b['filter'](f=>!f['object_type']),d=rootStr(a)['includes']('\x22query\x22');if(!d)return null;return{'id':'R-C3-03','data_source_class':'type3_submitted_object','level':c['length']>0x0?'medium':'low','category':'submission_forgery','title':c['length']>0x0?'Submitted\x20object\x20missing\x20object_type\x20annotation;\x20runtime\x20type\x20validation\x20relies\x20on\x20native\x20inference':'Submitted\x20object\x20type\x20validation\x20relies\x20on\x20runtime\x20native\x20inference','description':'Guard\x20contains\x20'+b['length']+'\x20Address\x20entries\x20with\x20b_submission=true\x20(Type3\x20submitted\x20objects).'+'The\x20native\x20layer\x20(passport.rs#parse_table_items)\x20only\x20checks\x20the\x20value[0]\x20type\x20byte\x20for\x20submission;\x20'+'object_type\x20is\x20derived\x20at\x20runtime\x20by\x20wobject_type\x20and\x20does\x20not\x20strictly\x20validate\x20the\x20actual\x20submitted\x20object\x20type.\x0a'+(c['length']>0x0?'Warning:\x20'+c['length']+'\x20entries\x20are\x20missing\x20object_type\x20annotation,\x20semantics\x20are\x20unclear.':'object_type\x20is\x20annotated,\x20but\x20still\x20confirm\x20the\x20annotation\x20matches\x20what\x20the\x20query\x20expects.'),'affected_stakeholders':['customer','provider'],'scenario':'Type\x20mismatch:\x20submitting\x20a\x20wrong-typed\x20object\x20causes\x20query\x20to\x20return\x20unexpected\x20values','mitigation':'1)\x20Annotate\x20object_type\x20for\x20all\x20Address\x20entries\x20with\x20b_submission=true;'+'2)\x20object_type\x20should\x20match\x20the\x20object\x20type\x20expected\x20by\x20the\x20query\x20instruction;'+'3)\x20Indirectly\x20verify\x20the\x20object\x20type\x20via\x20query\x20results\x20in\x20Guard\x20logic\x20(e.g.\x20query\x20order.amount\x20to\x20verify\x20it\x20is\x20an\x20Order)','evidence':c['length']>0x0?'Missing\x20object_type:\x20'+c['map'](f=>'#'+f['identifier'])['join'](',\x20'):'Annotated:\x20'+b['map'](f=>'#'+f['identifier']+'='+f['object_type'])['join'](',\x20')};}},{'id':'R-C3-04','data_source_class':'type3_submitted_object','trigger':'Repository\x20write_guard\x20does\x20not\x20verify\x20id_from_submission\x20type','check':a=>{if(a['scene']?.['binding_field']!=='write_guard')return null;return{'id':'R-C3-04','data_source_class':'type3_submitted_object','level':'high','category':'binding_risk','title':'Repository\x20write_guard\x20must\x20verify\x20id_from_submission\x20type','description':'The\x20table\x20entry\x20referenced\x20by\x20Repository\x20write_guard\x27s\x20id_from_submission\x20must\x20be\x20of\x20Address\x20type\x20(Type3\x20submitted\x20object).'+'The\x20entry\x20referenced\x20by\x20data_from_submission\x20must\x20match\x20the\x20Repository\x20value_type.'+'Type\x20mismatch\x20will\x20cause\x20write\x20failure\x20or\x20data\x20corruption.\x20The\x20write_guard\x20submission\x20contains\x20both\x20id\x20and\x20data\x20parts;\x20'+'the\x20native\x20layer\x20distinguishes\x20them\x20by\x20op_code,\x20but\x20value\x20types\x20must\x20match\x20the\x20table\x20declaration.','affected_stakeholders':['provider'],'scenario':'Type\x20mismatch:\x20write\x20failure\x20or\x20data\x20corruption','mitigation':'1)\x20Confirm\x20the\x20entry\x20referenced\x20by\x20id_from_submission\x20has\x20value_type=Address;'+'2)\x20Confirm\x20the\x20entry\x20referenced\x20by\x20data_from_submission\x20has\x20value_type\x20matching\x20the\x20Repository;'+'3)\x20Cover\x20write\x20scenarios\x20in\x20gen_passport\x20tests'};}},{'id':'R-C3-05','data_source_class':'type3_submitted_object','trigger':'Guard\x20accepts\x20a\x20runtime-submitted\x20Order/Progress/Arb\x20object\x20(Type3)\x20but\x20does\x20NOT\x20verify\x20the\x20submitted\x20object\x20belongs\x20to\x20the\x20current\x20project\x20(Machine\x20or\x20Service).\x20'+'The\x20WoWok\x20runtime\x20does\x20NOT\x20enforce\x20any\x20binding\x20between\x20the\x20submitted\x20order_id\x20and\x20the\x20actual\x20Progress\x20being\x20forwarded\x20—\x20verify_guard\x20receives\x20only\x20the\x20caller-provided\x20submission\x20bytes,\x20never\x20the\x20Progress\x20object\x20under\x20advancement\x20(passport.move:27,251-253;\x20progress.move:458-483).\x20'+'A\x20caller\x20can\x20therefore\x20submit\x20an\x20unrelated\x20order_id\x20from\x20a\x20DIFFERENT\x20project\x20while\x20forwarding\x20a\x20different\x20Progress,\x20causing\x20witness=100\x20(Order->Progress)\x20to\x20evaluate\x20against\x20foreign\x20data.','check':a=>{const b=a['table']['filter'](v=>v['b_submission']&&v['value_type']==='Address');if(b['length']===0x0)return null;const c=extractWitnessCodes(a['root']),d=c['some'](v=>[0x64,0x65,0x66]['includes'](v)),f=c['some'](v=>[0x67]['includes'](v)),g=c['some'](v=>[0x68,0x69,0x6a,0x6b,0x6c]['includes'](v)),h=b['filter'](v=>v['object_type']==='Order'||d&&!v['object_type']),i=b['filter'](v=>v['object_type']==='Progress'||f&&!v['object_type']),j=b['filter'](v=>v['object_type']==='Arb'||g&&!v['object_type']),k=h['length']>0x0||i['length']>0x0||j['length']>0x0;if(!k)return null;const l=['machine_forward_guard','service_order_allocators_guard','arbitration_usage_guard','arbitration_voting_guard','reward_guard','progress_submission_guard'],m=a['scene']?.['id'],n=!m||l['includes'](m);if(!n)return null;const o=new Set([0x61b,0x618,0x4e2,0x57a,0x579]),p=extractQueryIds(a['root']),q=p['some'](v=>o['has'](v));if(q)return null;const r=new Set(['machine_forward_guard','service_order_allocators_guard']),s=m&&r['has'](m)?'critical':'high',t=[];for(const v of h){t['push']('#'+v['identifier']+(v['object_type']?'(Order)':'(inferred\x20Order\x20via\x20witness\x20100-102)'));}for(const w of i){t['push']('#'+w['identifier']+(w['object_type']?'(Progress)':'(inferred\x20Progress\x20via\x20witness\x20103)'));}for(const x of j){t['push']('#'+x['identifier']+(x['object_type']?'(Arb)':'(inferred\x20Arb\x20via\x20witness\x20104-108)'));}const u=m??'unknown\x20scene\x20(conservative\x20flag)';return{'id':'R-C3-05','data_source_class':'type3_submitted_object','level':s,'category':'submission_forgery','title':'Submitted\x20Order/Progress/Arb\x20is\x20NOT\x20verified\x20to\x20belong\x20to\x20the\x20current\x20project\x20(cross-project\x20bypass\x20—\x20CRITICAL\x20trust-boundary\x20gap)','description':'Guard\x20accepts\x20runtime-submitted\x20Order/Progress/Arb\x20object(s)\x20['+t['join'](',\x20')+']\x20but\x20the\x20root\x20does\x20NOT\x20verify\x20the\x20submitted\x20object\x20belongs\x20to\x20the\x20current\x20project\x20(no\x20query\x20of\x20order.service/order.machine/progress.machine/arb.service\x20compared\x20to\x20a\x20project\x20constant).\x0a\x0a'+'TRUST-BOUNDARY\x20GAP\x20(verified\x20via\x20Move\x20source):\x0a'+'\x20\x20-\x20The\x20Passport\x20submission\x20is\x20built\x20by\x20the\x20CALLER,\x20not\x20auto-injected\x20by\x20the\x20runtime\x20(passport.move:120,149,157)\x0a'+'\x20\x20-\x20verify_guard\x20receives\x20ONLY\x20the\x20caller-provided\x20submission\x20bytes\x20—\x20it\x20never\x20sees\x20the\x20Progress/Order\x20actually\x20being\x20forwarded\x20(passport.move:27,251-253)\x0a'+'\x20\x20-\x20next_with_passport\x20performs\x20NO\x20linkage\x20check\x20between\x20the\x20passport\x20submission\x20and\x20the\x20Progress\x20under\x20advancement\x20(progress.move:458-483)\x0a'+'\x20\x20-\x20Even\x20order_next_with_passport\x27s\x20E_ORDER_NOT_MATCH\x20only\x20checks\x20the\x20separate\x20`order:&Order`\x20parameter,\x20NOT\x20the\x20order_id\x20embedded\x20in\x20the\x20passport\x20submission\x20(progress.move:452)\x0a\x0a'+('EXPLOIT\x20(scene='+u+'):\x0a')+'\x20\x201.\x20Attacker\x20holds\x20Order\x20Y\x20from\x20project\x20B\x20(where\x20progress.current_time\x20is\x20old\x20enough\x20to\x20pass\x20the\x20time-lock)\x0a'+'\x20\x202.\x20Attacker\x20calls\x20forward\x20on\x20Order\x20X\x27s\x20Progress\x20(project\x20A,\x20freshly\x20entered\x20the\x20node)\x0a'+'\x20\x203.\x20Attacker\x20submits\x20Order\x20Y\x27s\x20ID\x20in\x20the\x20passport\x20(lying\x20about\x20which\x20order\x20is\x20being\x20forwarded)\x0a'+'\x20\x204.\x20Guard\x27s\x20witness=100\x20reads\x20Order\x20Y\x27s\x20Progress\x20->\x20time-lock\x20passes\x20(Order\x20Y\x20is\x20old)\x0a'+'\x20\x205.\x20forward\x20actually\x20executes\x20on\x20Order\x20X\x27s\x20Progress\x20->\x20TIME-LOCK\x20BYPASSED\x0a\x0a'+'This\x20is\x20distinct\x20from\x20R-C3-01\x20(Signer\x20binding\x20—\x20WHO\x20can\x20submit)\x20and\x20R-C3-03\x20(type\x20matching\x20—\x20WHAT\x20type\x20is\x20submitted).\x20'+'R-C3-05\x20addresses\x20WHETHER\x20the\x20submitted\x20object\x20belongs\x20to\x20the\x20current\x20project\x20—\x20a\x20third\x20orthogonal\x20axis\x20of\x20submission\x20trust.\x20'+'Even\x20with\x20R-C3-01\x20satisfied\x20(authorized\x20Signer)\x20and\x20R-C3-03\x20satisfied\x20(correct\x20type),\x20the\x20Signer\x20can\x20still\x20submit\x20an\x20unrelated\x20project\x27s\x20object.','affected_stakeholders':['customer','provider','arbitrator'],'scenario':'Cross-project\x20bypass:\x20authorized\x20signer\x20submits\x20an\x20unrelated\x20project\x27s\x20order/progress/arb\x20to\x20bypass\x20time-lock,\x20status,\x20or\x20allocation\x20conditions','mitigation':'Add\x20a\x20project-binding\x20check\x20to\x20the\x20root\x20(wrap\x20existing\x20root\x20in\x20logic_and):\x0a'+'\x20\x20-\x20For\x20submitted\x20Order:\x20add\x20logic_equal[query(1563:\x20order.service),\x20identifier[N](project_service_address)]\x20—\x20RECOMMENDED\x20(service\x20is\x20the\x20canonical\x20project\x20anchor)\x0a'+'\x20\x20-\x20For\x20submitted\x20Order:\x20add\x20logic_equal[query(1560:\x20order.machine),\x20identifier[N](project_machine_address)]\x20—\x20alternative\x20(machine\x20anchor)\x0a'+'\x20\x20-\x20For\x20submitted\x20Progress:\x20add\x20logic_equal[query(1250:\x20progress.machine),\x20identifier[N](project_machine_address)]\x0a'+'\x20\x20-\x20For\x20submitted\x20Arb:\x20add\x20logic_equal[query(1402:\x20arb.service),\x20identifier[N](project_service_address)]\x0a'+'\x20\x20-\x20Use\x20witness=102\x20(TypeOrderService)\x20on\x20the\x20submitted\x20Order\x20to\x20derive\x20the\x20Service,\x20then\x20compare\x20to\x20the\x20project\x20service\x20constant\x0a\x0a'+'Intentional\x20cross-project\x20exception:\x20if\x20the\x20Guard\x20is\x20DESIGNED\x20to\x20accept\x20cross-project\x20submissions\x20(rare),\x20document\x20this\x20explicitly\x20in\x20the\x20description\x20and\x20add\x20a\x20binding_hint\x20annotation\x20\x27cross_project_intentional:true\x27\x20to\x20suppress\x20this\x20rule.','evidence':'Unbound\x20submitted\x20project-relevant\x20entries:\x20'+t['join'](',\x20')+'.\x20'+('Scene:\x20'+u+'.\x20')+'Missing\x20project-binding\x20queries:\x20none\x20of\x20[1563(order.service),\x201560(order.machine),\x201250(progress.machine),\x201402(arb.service)]\x20present\x20in\x20root.'};}},{'id':'R-C3-06','data_source_class':'type3_submitted_object','trigger':'Guard\x20is\x20bound\x20to\x20Service\x20order_allocators\x20(service_order_allocators_guard\x20scene).\x20'+'In\x20this\x20scene\x20the\x20Guard\x20decides\x20IF\x20allocation\x20happens,\x20while\x20sharing.who\x20decides\x20WHERE\x20funds\x20go.\x20'+'If\x20sharing.who=Signer,\x20the\x20transaction\x20caller\x20receives\x20the\x20funds\x20—\x20so\x20a\x20Guard\x20that\x20does\x20NOT\x20bind\x20'+'context(Signer)\x20lets\x20ANYONE\x20who\x20passes\x20the\x20Guard\x20steal\x20100%\x20of\x20the\x20order\x20funds.\x20'+'This\x20is\x20a\x20Guard+sharing\x20coupling\x20risk:\x20neither\x20piece\x20alone\x20reveals\x20the\x20theft\x20—\x20only\x20their\x20combination.','check':a=>{if(a['scene']?.['id']!=='service_order_allocators_guard')return null;if(hasSignerCheck(a))return null;const b=a['sharing_recipients'],c=b!==undefined&&b['length']>0x0,d=c&&b['includes']('Signer');if(c&&!d)return null;const e=d?'critical':'medium',f=c?'['+b['join'](',\x20')+']':'(not\x20provided\x20—\x20conservative\x20flag)',g=d?'sharing.who=Signer\x20confirmed\x20—\x20anyone\x20can\x20steal\x20100%\x20of\x20funds':'if\x20sharing.who=Signer,\x20anyone\x20can\x20steal\x20100%\x20of\x20funds';return{'id':'R-C3-06','data_source_class':'type3_submitted_object','level':e,'category':'binding_risk','title':'allocators\x20Guard\x20without\x20Signer\x20binding\x20—\x20'+g,'description':'Guard\x20is\x20bound\x20to\x20Service\x20order_allocators\x20but\x20does\x20NOT\x20verify\x20context(Signer).\x20'+'In\x20the\x20allocators\x20scene,\x20sharing.who\x20determines\x20the\x20fund\x20recipient:\x0a'+'\x20\x20-\x20sharing.who=Signer\x20→\x20funds\x20flow\x20to\x20the\x20CALLER\x20(transaction\x20signer)\x0a'+'\x20\x20-\x20sharing.who=Entity\x20→\x20funds\x20flow\x20to\x20a\x20FIXED\x20address\x20(Treasury/personal)\x0a'+'\x20\x20-\x20sharing.who=GuardIdentifier\x20→\x20funds\x20flow\x20to\x20a\x20Guard-table-derived\x20address\x0a\x0a'+'When\x20sharing.who=Signer\x20and\x20the\x20Guard\x20does\x20not\x20bind\x20Signer,\x20ANY\x20caller\x20who\x20passes\x20the\x20Guard\x20'+'receives\x20the\x20order\x20funds\x20—\x20a\x20direct\x20theft.\x20Even\x20an\x20authorized\x20caller\x20is\x20unnecessary:\x20the\x20attacker\x20'+'only\x20needs\x20to\x20pass\x20the\x20Guard\x27s\x20condition\x20(e.g.\x20submit\x20any\x20completed\x20order_id),\x20then\x20the\x20funds\x20go\x20to\x20'+'their\x20own\x20address.\x0a\x0a'+'This\x20is\x20distinct\x20from\x20R-C3-01\x20(generic\x20Signer\x20binding)\x20and\x20R-C3-05\x20(cross-project\x20bypass).\x20'+'R-C3-06\x20addresses\x20the\x20allocators-specific\x20Guard+sharing\x20coupling:\x20the\x20SAFE\x20design\x20uses\x20'+'sharing.who=Entity\x20so\x20the\x20recipient\x20is\x20fixed,\x20making\x20Guard\x20Signer\x20binding\x20unnecessary.\x0a\x0a'+('sharing_recipients\x20hint:\x20'+f),'affected_stakeholders':['provider','customer'],'scenario':'Fund\x20theft:\x20attacker\x20passes\x20the\x20allocators\x20Guard\x20(e.g.\x20submits\x20a\x20completed\x20order_id)\x20and\x20'+'sharing.who=Signer\x20routes\x20100%\x20of\x20the\x20order\x20funds\x20to\x20the\x20attacker\x27s\x20address','mitigation':'TWO\x20mitigation\x20options:\x0a'+'\x20\x20(A)\x20Traditional:\x20add\x20context(Signer)\x20binding\x20to\x20the\x20Guard\x20root\x20'+'(logic_equal[context(Signer),\x20identifier[N](authorized_address)])\x20so\x20only\x20the\x20authorized\x20'+'recipient\x20can\x20trigger\x20allocation.\x0a'+'\x20\x20(B)\x20PREFERRED:\x20use\x20sharing.who=Entity\x20(Treasury\x20object\x20or\x20fixed\x20personal\x20address)\x20in\x20the\x20'+'Allocator\x27s\x20sharing\x20config.\x20Funds\x20then\x20always\x20flow\x20to\x20the\x20designated\x20recipient\x20regardless\x20of\x20'+'who\x20triggers\x20allocation\x20—\x20the\x20Guard\x20does\x20NOT\x20need\x20to\x20bind\x20Signer.\x20This\x20is\x20more\x20robust\x20because\x20'+'it\x20does\x20not\x20depend\x20on\x20Guard\x20correctness.\x0a\x0a'+'Design\x20checklist\x20when\x20using\x20sharing.who=Entity:\x0a'+'\x20\x20-\x20If\x20Entity\x20points\x20to\x20a\x20Treasury\x20object,\x20verify\x20the\x20Treasury\x27s\x20permission\x20is\x20consistent\x20with\x20'+'the\x20Service\x27s\x20permission\x20(different\x20permissions\x20=\x20different\x20permission\x20organizations\x20=\x20minor\x20risk).\x0a'+'\x20\x20-\x20allocators\x20require\x20unique\x20guard\x20addresses:\x20create\x20separate\x20Guard\x20objects\x20(identical\x20root/table,\x20'+'different\x20descriptions)\x20for\x20each\x20allocator.\x0a'+'\x20\x20-\x20First-match-wins:\x20only\x20the\x20first\x20Allocator\x20whose\x20Guard\x20passes\x20executes;\x20multiple\x20allocators\x20'+'represent\x20alternative\x20strategies,\x20not\x20a\x20simultaneous\x20split.\x0a'+'\x20\x20-\x20Still\x20add\x20order.service\x20project\x20binding\x20(query\x201563)\x20to\x20prevent\x20cross-project\x20bypass\x20(R-C3-05)\x20'+'triggering\x20premature\x20allocation.','evidence':'Scene:\x20service_order_allocators_guard.\x20'+'Guard\x20binds\x20Signer:\x20no.\x20'+('sharing_recipients:\x20'+f+'.\x20')+('Level\x20rationale:\x20'+(d?'Signer\x20sharing\x20confirmed\x20→\x20critical':'sharing\x20hint\x20absent\x20→\x20conservative\x20medium')+'.')};}},{'id':'R-C4-01','data_source_class':'type4_system_context','trigger':'Guard\x20contains\x20context(Signer)\x20check;\x20need\x20to\x20confirm\x20comparison\x20direction\x20(==\x20vs\x20!=)\x20and\x20compared\x20object\x20role','check':a=>{if(!hasSignerCheck(a))return null;const b=JSON['stringify'](a['root']),c=b['includes']('\x22logic_equal\x22'),d=b['includes']('\x22logic_not_equal\x22');return{'id':'R-C4-01','data_source_class':'type4_system_context','level':'medium','category':'system_context_risk','title':'Signer\x20check\x20direction\x20needs\x20manual\x20confirmation\x20(comparison\x20operator\x20and\x20role\x20match)','description':'Guard\x20contains\x20a\x20context(Signer)\x20check.\x20Signer\x20is\x20a\x20Type4\x20system\x20context,\x20'+'from\x20TransactionContext.sender()\x20(transaction\x20initiator\x20address).\x0a'+('Detected\x20comparison:\x20'+(c?'logic_equal(==)':'')+'\x20'+(d?'logic_not_equal(!=)':'')+'\x0a')+'Manual\x20confirmation\x20required:\x0a'+'\x20\x201)\x20Whether\x20the\x20comparison\x20direction\x20is\x20correct:\x20use\x20==\x20for\x20identity\x20verification\x20(Signer\x20==\x20authorized\x20address),\x20use\x20!=\x20for\x20exclusion\x20(Signer\x20!=\x20blacklist\x20address)\x0a'+'\x20\x202)\x20Whether\x20the\x20compared\x20object\x20role\x20is\x20correct:\x20buy_guard\x20should\x20compare\x20the\x20Customer\x20address,\x20Forward.guard\x20may\x20compare\x20the\x20Provider\x20address\x0a'+'\x20\x203)\x20Wrong\x20direction\x20causes\x20reverse\x20effect:\x20==\x20blacklist\x20address\x20would\x20only\x20allow\x20blacklisted\x20users','affected_stakeholders':['customer','provider'],'scenario':'Wrong\x20direction:\x20Signer\x20==\x20blacklist\x20address\x20would\x20only\x20allow\x20blacklisted\x20users','mitigation':'1)\x20Confirm\x20logic_equal\x20is\x20used\x20for\x20identity\x20verification\x20(Signer\x20==\x20authorized\x20address);'+'2)\x20Confirm\x20logic_not_equal\x20is\x20used\x20for\x20exclusion\x20(Signer\x20!=\x20blacklist\x20address);'+'3)\x20Confirm\x20the\x20compared\x20table\x20constant\x20is\x20the\x20address\x20of\x20the\x20correct\x20role;'+'4)\x20Cover\x20both\x20expected-pass\x20and\x20expected-fail\x20scenarios\x20in\x20gen_passport\x20tests','evidence':'Comparison:\x20'+(c?'==':'')+'\x20'+(d?'!=':'')};}},{'id':'R-C4-02','data_source_class':'type4_system_context','trigger':'Guard\x20uses\x20context(Clock)\x20for\x20precise\x20boundary\x20time-lock\x20comparison','check':a=>{if(!hasClockCheck(a))return null;const b=rootStr(a),c=b['includes']('logic_as_u256_greater_or_equal'),d=b['includes']('logic_as_u256_greater');if(!c&&!d)return null;return{'id':'R-C4-02','data_source_class':'type4_system_context','level':'low','category':'system_context_risk','title':'Clock\x20time-lock\x20should\x20have\x20tolerance\x20to\x20avoid\x20boundary\x20invalidation\x20from\x20validator\x20block-time\x20variance','description':'Guard\x20uses\x20context(Clock)\x20for\x20time-lock\x20comparison.\x20Clock\x20comes\x20from\x20the\x20timestamp_ms\x20field\x20(U64\x20millisecond\x20timestamp)\x20of\x20system\x20shared\x20object\x200x6.\x0a'+'The\x20Wow\x20on-chain\x20timestamp\x20is\x20produced\x20by\x20validator\x20consensus\x20and\x20has\x20a\x20slight\x20deviation\x20from\x20real\x20time\x20(usually\x20<\x201\x20second),\x20'+'and\x20block-time\x20variance\x20may\x20cause\x20timestamp\x20jumps.\x20Using\x20precise\x20boundaries\x20(>=\x20or\x20==)\x20may\x20cause:\x0a'+'\x20\x20-\x20The\x20time-lock\x20expiration\x20transaction\x20is\x20packaged\x20exactly\x20at\x20the\x20moment\x20but\x20fails\x20due\x20to\x20slight\x20timestamp\x20deviation\x0a'+'\x20\x20-\x20Or\x20conversely,\x20slight\x20deviation\x20causes\x20the\x20time-lock\x20to\x20pass\x20early\x0a'+'It\x20is\x20recommended\x20to\x20use\x20>\x20instead\x20of\x20>=,\x20or\x20add\x20a\x20small\x20tolerance\x20constant.','affected_stakeholders':['customer','provider'],'scenario':'Timestamp\x20variance:\x20validator\x20block-time\x20deviation\x20causes\x20boundary\x20transactions\x20to\x20fail\x20or\x20pass\x20early','mitigation':'1)\x20Use\x20logic_as_u256_greater\x20(>)\x20instead\x20of\x20greater_or_equal\x20(>=)\x20for\x20expiration\x20judgment;'+'2)\x20Or\x20add\x20a\x20small\x20tolerance\x20constant\x20(e.g.\x201000ms)\x20in\x20calc_number_add;'+'3)\x20Time-locks\x20should\x20not\x20rely\x20on\x20second-level\x20precision;\x20reserve\x20minute-level\x20tolerance;'+'4)\x20Design\x20timeout\x20Forward\x20nodes\x20in\x20the\x20Machine\x20as\x20a\x20fallback','evidence':'Comparison:\x20'+(c?'>=':'')+'\x20'+(d?'>':'')};}},{'id':'R-C4-03','data_source_class':'type4_system_context','trigger':'Guard\x20uses\x20context(Guard)\x20self-reference','check':a=>{if(!hasGuardSelfRef(a))return null;return{'id':'R-C4-03','data_source_class':'type4_system_context','level':'low','category':'system_context_risk','title':'Guard\x20uses\x20context(Guard)\x20self-reference\x20(rare\x20scenario,\x20needs\x20special\x20explanation)','description':'Guard\x20contains\x20a\x20context(Guard)\x20node.\x20Guard\x20is\x20a\x20Type4\x20system\x20context,\x20'+'returning\x20the\x20ObjectID\x20of\x20the\x20currently\x20verified\x20Guard\x20object\x20itself.\x0a'+'This\x20is\x20a\x20rare\x20scenario,\x20typically\x20used\x20for:\x0a'+'\x20\x201)\x20Guard\x20referencing\x20its\x20own\x20address\x20as\x20a\x20replacement\x20for\x20a\x20table\x20constant\x20(avoiding\x20hardcoding)\x0a'+'\x20\x202)\x20Identifying\x20the\x20current\x20Guard\x20in\x20a\x20rely\x20combination\x20(rare)\x0a'+'Need\x20to\x20confirm\x20whether\x20the\x20use\x20of\x20context(Guard)\x20is\x20necessary\x20and\x20whether\x20the\x20comparison\x20object\x20is\x20correct.','affected_stakeholders':['provider'],'scenario':'Self-reference\x20misuse:\x20context(Guard)\x20comparing\x20wrong\x20object\x20causes\x20logic\x20invalidation','mitigation':'1)\x20Confirm\x20the\x20context(Guard)\x20comparison\x20object\x20is\x20the\x20Guard\x20ObjectID\x20rather\x20than\x20an\x20address\x20constant;'+'2)\x20Evaluate\x20whether\x20self-reference\x20is\x20truly\x20needed;\x20usually\x20a\x20table\x20constant\x20can\x20replace\x20it;'+'3)\x20Verify\x20in\x20gen_passport\x20tests\x20that\x20self-reference\x20behavior\x20meets\x20expectations'};}},{'id':'R-C4-04','data_source_class':'type4_system_context','trigger':'Guard\x20uses\x20logic_equal[context(Signer),\x20identifier[N](fixed_address)]\x20—\x20Level\x201\x20strict\x20single-identity\x20binding.\x20'+'Only\x20ONE\x20address\x20can\x20pass\x20the\x20Guard,\x20and\x20because\x20Guards\x20are\x20immutable,\x20changing\x20the\x20authorized\x20address\x20requires\x20'+'rebuilding\x20the\x20Guard\x20and\x20migrating\x20all\x20references.\x20This\x20creates\x20a\x20convenience\x20trade-off:\x20maximum\x20security\x20but\x20'+'maximum\x20inflexibility\x20(key\x20loss\x20or\x20personnel\x20change\x20permanently\x20blocks\x20the\x20operation).','check':a=>{if(!hasSignerCheck(a))return null;if(isSignerCheckInLogicOr(a['root']))return null;const b=detectLevel1StrictBinding(a['root'],a['table']);if(!b['detected']||!b['entry'])return null;const c=b['entry'];return{'id':'R-C4-04','data_source_class':'type4_system_context','level':'low','category':'system_context_risk','title':'Level\x201\x20strict\x20single-identity\x20Signer\x20binding\x20—\x20convenience\x20trade-off\x20(consider\x20Level\x202/3\x20alternatives)','description':'Guard\x20uses\x20logic_equal[context(Signer),\x20identifier['+c['identifier']+'](fixed\x20address)]\x20—\x20only\x20the\x20address\x20\x22'+c['value']+'\x22\x20can\x20pass.\x0a'+'This\x20is\x20Level\x201\x20strict\x20single-identity\x20binding:\x20maximally\x20secure\x20but\x20maximally\x20inconvenient.\x0a'+'Guards\x20are\x20immutable\x20on-chain.\x20If\x20the\x20authorized\x20address\x20becomes\x20unavailable\x20(key\x20loss,\x20personnel\x20change,\x20'+'role\x20rotation),\x20the\x20Guard\x20permanently\x20blocks\x20the\x20operation\x20—\x20the\x20only\x20recovery\x20is\x20to\x20build\x20a\x20new\x20Guard\x20'+'and\x20migrate\x20ALL\x20references\x20(Machine\x20forward\x20guards,\x20Service\x20buy_guard,\x20allocators,\x20etc.).\x0a\x0a'+'Three\x20verifier\x20constraint\x20levels\x20trade\x20off\x20security\x20vs\x20convenience:\x0a'+'\x20\x20-\x20Level\x201\x20(current):\x20strict\x20single-identity\x20—\x20one\x20address,\x20no\x20flexibility\x20(AVOID\x20unless\x20justified)\x0a'+'\x20\x20-\x20Level\x202:\x20identity-set\x20—\x20logic_or\x20of\x20multiple\x20valid\x20identities\x20(e.g.\x20order.owner\x20OR\x20order.agent;\x20'+'permission.owner\x20OR\x20permission.admin).\x20Recommended\x20for\x20role-based\x20access.\x0a'+'\x20\x20-\x20Level\x203:\x20scene-combined\x20—\x20verify\x20whether\x20Signer\x20binding\x20is\x20even\x20needed.\x20Many\x20scenes\x20(allocators\x20with\x20'+'sharing.who=Entity,\x20machine\x20forward\x20with\x20permissionIndex)\x20already\x20ensure\x20safety\x20without\x20Signer\x20binding.\x0a\x0a'+'Use\x20Level\x201\x20only\x20when:\x20(a)\x20the\x20role\x20is\x20permanently\x20tied\x20to\x20one\x20address,\x20AND\x20(b)\x20the\x20designer\x20explicitly\x20'+'accepts\x20the\x20immutability\x20lock-in\x20risk.\x20Otherwise\x20prefer\x20Level\x202\x20or\x20Level\x203.','affected_stakeholders':['provider'],'scenario':'Immutability\x20lock-in:\x20authorized\x20address\x20becomes\x20unavailable,\x20Guard\x20permanently\x20blocks\x20the\x20operation,\x20'+'requiring\x20full\x20Guard\x20rebuild\x20and\x20reference\x20migration','mitigation':'Consider\x20these\x20alternatives\x20before\x20settling\x20on\x20Level\x201\x20strict\x20binding:\x0a'+'\x20\x20(A)\x20Level\x202\x20identity-set\x20(RECOMMENDED\x20for\x20role-based\x20access):\x20use\x20logic_or\x20to\x20allow\x20multiple\x20valid\x20identities.\x0a'+'\x20\x20\x20\x20\x20\x20-\x20Order\x20holder:\x20logic_or[logic_equal[query(1562:\x20order.owner),\x20context(Signer)],\x20query(1567:\x20order.agent\x20has,\x20parameters:\x20[context(Signer)])]\x0a'+'\x20\x20\x20\x20\x20\x20-\x20Service\x20provider:\x20logic_or[logic_equal[query(1002:\x20permission.owner),\x20context(Signer)],\x20query(1004:\x20permission.admin\x20has,\x20parameters:\x20[context(Signer)])]\x0a'+'\x20\x20\x20\x20\x20\x20-\x20Dynamic\x20permission\x20(survives\x20rotation):\x20submit\x20permission\x20address,\x20verify\x20query(1488:\x20service.permission)\x20==\x20submitted,\x20then\x20check\x201002/1004\x0a'+'\x20\x20(B)\x20Level\x203\x20scene-combined:\x20evaluate\x20whether\x20Signer\x20binding\x20is\x20needed\x20at\x20all.\x0a'+'\x20\x20\x20\x20\x20\x20-\x20If\x20using\x20allocators\x20with\x20sharing.who=Entity\x20(Treasury):\x20funds\x20flow\x20to\x20a\x20fixed\x20recipient\x20regardless\x20of\x20caller\x20—\x20no\x20Signer\x20binding\x20needed\x20(R-C3-06\x20safe)\x0a'+'\x20\x20\x20\x20\x20\x20-\x20If\x20using\x20machine\x20forward:\x20permissionIndex\x20already\x20verifies\x20operator\x20identity\x20—\x20Signer\x20binding\x20may\x20be\x20redundant\x0a'+'\x20\x20(C)\x20If\x20Level\x201\x20is\x20truly\x20required:\x20document\x20the\x20justification\x20in\x20the\x20Guard\x20description\x20and\x20ensure\x20a\x20key-recovery\x20/\x20address-rotation\x20plan\x20exists.','evidence':'Level\x201\x20strict\x20binding\x20detected:\x20logic_equal[context(Signer),\x20identifier['+c['identifier']+']]\x20'+('where\x20identifier['+c['identifier']+']\x20is\x20a\x20fixed\x20Address\x20constant\x20(b_submission=false,\x20value=\x22'+c['value']+'\x22'+(c['name']?',\x20name=\x22'+c['name']+'\x22':'')+').\x20')+'Not\x20wrapped\x20in\x20logic_or\x20(not\x20Level\x202\x20identity-set).'};}},{'id':'R-X1-01','data_source_class':'cross_type','trigger':'Time-lock\x20uses\x20logic_as_u256_greater_or_equal\x20with\x20a\x20baseline\x20query\x20that\x20has\x20NO\x20non-zero\x20invariant\x20(i.e.\x20the\x20query\x20MAY\x20legitimately\x20return\x200\x20when\x20it\x20succeeds),\x20causing\x20Clock\x20>=\x200\x20+\x20timeout\x20to\x20always\x20be\x20true','check':a=>{const b=rootStr(a),c=b['includes']('logic_as_u256_greater_or_equal'),d=b['includes']('\x22clock\x22'),e=b['includes']('calc_number_add'),f=b['includes']('\x22query\x22');if(!(c&&d&&e&&f))return null;if(rootAllQueriesNonZero(a['root']))return null;const g=extractQueryIds(a['root']),h=g['filter'](j=>!QUERY_INVARIANT_MAP['has'](j)),i=h['length']>0x0?'Queries\x20without\x20non-zero\x20invariant:\x20'+h['map'](j=>{const k=GUARDQUERY['find'](l=>l['id']===j);return k?k['id']+'\x20('+k['name']+')':''+j;})['join'](',\x20'):'Baseline\x20query\x20may\x20return\x200';return{'id':'R-X1-01','data_source_class':'cross_type','level':'medium','category':'logic_gap','title':'Time-lock\x20baseline\x20query\x20may\x20return\x200\x20causing\x20>=\x20comparison\x20to\x20always\x20be\x20true','description':'Guard\x20uses\x20logic_as_u256_greater_or_equal\x20for\x20time-lock\x20comparison,\x20and\x20the\x20compared\x20baseline\x20value\x20comes\x20from\x20a\x20query\x20(Type1/2/3\x20data\x20sources).\x20'+'If\x20the\x20query\x20SUCCEEDS\x20but\x20its\x20stored\x20value\x20is\x200\x20(e.g.\x20a\x20count\x20that\x20is\x200\x20in\x20the\x20empty\x20initial\x20state,\x20a\x20user-submitted\x20value\x20of\x200,\x20or\x20a\x20Some(0)\x20from\x20an\x20Option\x20field),\x20'+'then\x20Clock\x20>=\x200\x20+\x20timeout\x20is\x20always\x20true,\x20the\x20time-lock\x20is\x20effectively\x20void,\x20and\x20the\x20disadvantaged\x20party\x20can\x20bypass\x20the\x20time\x20constraint\x20immediately.\x0a\x0a'+'IMPORTANT\x20—\x20\x27VM\x20error\x20=\x20Guard\x20failure\x27\x20baseline:\x20'+'if\x20a\x20query\x20targets\x20an\x20absent\x20object,\x20unset\x20Option,\x20or\x20missing\x20collection\x20entry,\x20the\x20WoWok\x20native\x20runtime\x20aborts\x20with\x20a\x20VM\x20error\x20(e.g.\x20W_FIELD_NOT_FOUND)\x20'+'and\x20the\x20Guard\x20fails\x20as\x20a\x20whole\x20(does\x20NOT\x20silently\x20return\x200).\x20Therefore\x20the\x20null-bypass\x20risk\x20ONLY\x20applies\x20to\x20queries\x20whose\x20stored\x20value\x20can\x20legitimately\x20be\x200\x20'+'while\x20the\x20query\x20itself\x20succeeds.\x20Such\x20queries\x20are\x20exactly\x20those\x20WITHOUT\x20an\x20`invariant`\x20annotation\x20in\x20the\x20SDK\x20GUARDQUERY\x20catalog.','affected_stakeholders':['customer','provider'],'scenario':'Time-lock\x20invalidation:\x20baseline\x20query\x20returns\x200\x20(not\x20VM\x20error),\x20making\x20the\x20>=\x20condition\x20always\x20pass','mitigation':'1)\x20Use\x20a\x20query\x20whose\x20return\x20is\x20guaranteed\x20non-zero\x20(look\x20for\x20`invariant`\x20in\x20guard-ins.ts\x20—\x20e.g.\x20progress.current_time\x20id=1272\x20with\x20invariant=\x27clock_derived\x27);\x20'+'2)\x20Add\x20a\x20precondition\x20check\x20query\x20>\x200\x20before\x20the\x20time-lock\x20(for\x20queries\x20without\x20an\x20invariant,\x20e.g.\x20user-submitted\x20baselines);\x20'+'3)\x20Avoid\x20using\x20count/index/find/user-submitted\x20values\x20as\x20time-lock\x20baselines\x20—\x20these\x20can\x20all\x20legitimately\x20return\x200;\x20'+'4)\x20Distinguish\x20\x27VM\x20error\x27\x20(safe\x20—\x20Guard\x20fails)\x20from\x20\x27query\x20returns\x200\x27\x20(unsafe\x20—\x20Guard\x20bypassed).\x20Only\x20the\x20latter\x20is\x20a\x20null-bypass\x20risk.','evidence':i};}},{'id':'R-X1-02','data_source_class':'cross_type','trigger':'Guard\x20uses\x20logic_as_u256_greater\x20with\x20a\x20query\x20operand\x20that\x20has\x20NO\x20non-zero\x20invariant\x20(i.e.\x20the\x20query\x20MAY\x20legitimately\x20return\x200\x20when\x20it\x20succeeds),\x20and\x20the\x20comparison\x20does\x20not\x20distinguish\x20\x27query\x20succeeded\x20with\x200\x27\x20from\x20\x27query\x20failed\x27','check':a=>{const b=rootStr(a);if(!(b['includes']('logic_as_u256_greater')&&b['includes']('\x22query\x22')))return null;if(rootAllQueriesNonZero(a['root']))return null;const c=extractQueryIds(a['root']),d=c['filter'](f=>!QUERY_INVARIANT_MAP['has'](f)),e=d['length']>0x0?'Queries\x20without\x20non-zero\x20invariant:\x20'+d['map'](f=>{const g=GUARDQUERY['find'](h=>h['id']===f);return g?g['id']+'\x20('+g['name']+')':''+f;})['join'](',\x20'):'Query\x20may\x20return\x200';return{'id':'R-X1-02','data_source_class':'cross_type','level':'medium','category':'logic_gap','title':'Numeric\x20comparison\x20with\x20a\x20query\x20that\x20may\x20legitimately\x20return\x200','description':'Guard\x20uses\x20logic_as_u256_greater\x20for\x20numeric\x20comparison,\x20and\x20one\x20of\x20the\x20operands\x20comes\x20from\x20a\x20query\x20(Type1/2/3\x20data\x20sources)\x20that\x20has\x20NO\x20non-zero\x20invariant\x20annotation.\x20'+'If\x20the\x20query\x20SUCCEEDS\x20but\x20its\x20stored\x20value\x20is\x200\x20(e.g.\x20a\x20count\x20that\x20is\x200\x20in\x20the\x20empty\x20initial\x20state,\x20a\x20user-submitted\x20value\x20of\x200,\x20or\x20a\x20Some(0)\x20from\x20an\x20Option\x20field),\x20'+'the\x20comparison\x20may\x20produce\x20an\x20unexpected\x20result\x20(e.g.\x20`query\x20>\x200`\x20fails,\x20or\x20`query\x20>\x20some_threshold`\x20is\x20silently\x20bypassed).\x0a\x0a'+'IMPORTANT\x20—\x20\x27VM\x20error\x20=\x20Guard\x20failure\x27\x20baseline:\x20'+'if\x20a\x20query\x20targets\x20absent\x20data\x20(e.g.\x20object\x20does\x20not\x20exist,\x20Option\x20is\x20None,\x20collection\x20entry\x20is\x20missing),\x20the\x20WoWok\x20native\x20runtime\x20aborts\x20with\x20a\x20VM\x20error\x20'+'(not\x200).\x20The\x20Guard\x20fails\x20as\x20a\x20whole\x20(does\x20NOT\x20silently\x20return\x200).\x20Therefore\x20this\x20rule\x20only\x20flags\x20queries\x20whose\x20stored\x20value\x20can\x20be\x200\x20while\x20the\x20query\x20succeeds.','affected_stakeholders':['customer','provider'],'scenario':'Null\x20misjudgment:\x20query\x20succeeds\x20with\x20value\x200,\x20causing\x20>\x200\x20condition\x20to\x20unexpectedly\x20fail\x20(or\x20>\x20threshold\x20to\x20be\x20bypassed)','mitigation':'1)\x20Prefer\x20queries\x20with\x20an\x20`invariant`\x20annotation\x20(e.g.\x20clock_derived\x20/\x20positive_lower_bound);\x20'+'2)\x20Add\x20a\x20precondition\x20check\x20(query\x20>\x200)\x20before\x20the\x20main\x20comparison\x20when\x20using\x20count/index/find/user-submitted\x20baselines;\x20'+'3)\x20Distinguish\x20\x27VM\x20error\x27\x20(safe\x20—\x20Guard\x20fails)\x20from\x20\x27query\x20returns\x200\x27\x20(potentially\x20unsafe).\x20Only\x20the\x20latter\x20is\x20a\x20null-bypass\x20risk.','evidence':e};}},{'id':'R-X1-03','data_source_class':'cross_type','trigger':'Guard\x20uses\x20logic_string_contains\x20and\x20may\x20be\x20bypassed\x20by\x20substring\x20matching','check':a=>{const b=rootStr(a);if(!(b['includes']('logic_string_contains')&&!b['includes']('logic_string_nocase')))return null;return{'id':'R-X1-03','data_source_class':'cross_type','level':'low','category':'logic_gap','title':'logic_string_contains\x20substring\x20match\x20may\x20be\x20bypassed','description':'Guard\x20uses\x20logic_string_contains\x20for\x20string\x20matching.'+'Substring\x20matching\x20may\x20be\x20bypassed:\x20e.g.\x20when\x20checking\x20\x27Completed\x27,\x20\x27NotCompleted\x27\x20also\x20contains\x20\x27Completed\x27.'+'In\x20addition,\x20case\x20sensitivity\x20may\x20cause\x20unexpected\x20failures.\x20String\x20data\x20may\x20come\x20from\x20Type1\x20(query\x20object\x20fields),\x20'+'Type3\x20(submitted\x20values),\x20or\x20the\x20context\x20of\x20a\x20rely-dependent\x20Guard.','affected_stakeholders':['customer','provider'],'scenario':'Substring\x20mismatch:\x20\x27NotCompleted\x27\x20contains\x20\x27Completed\x27,\x20causing\x20false\x20pass','mitigation':'1)\x20Prefer\x20logic_equal\x20for\x20exact\x20matching;'+'2)\x20If\x20substring\x20matching\x20is\x20needed,\x20add\x20boundary\x20conditions\x20(e.g.\x20prefix\x20+\x20suffix);'+'3)\x20Confirm\x20whether\x20case-insensitivity\x20is\x20needed\x20(use\x20the\x20nocase\x20variant)'};}},{'id':'R-X1-04','data_source_class':'cross_type','trigger':'Guard\x20root\x20is\x20an\x20identifier\x20directly\x20returning\x20Bool','check':a=>{if(a['root']?.['type']!=='identifier')return null;const b=a['table']['find'](d=>d['identifier']===a['root']['identifier']),c=b?.['b_submission']??![];return{'id':'R-X1-04','data_source_class':'cross_type','level':c?'medium':'low','category':'logic_gap','title':'Root\x20directly\x20returns\x20identifier\x20value,\x20no\x20operation\x20logic','description':'Guard\x20root\x20is\x20an\x20identifier\x20node,\x20directly\x20returning\x20the\x20value\x20(Bool)\x20from\x20table.'+(c?'This\x20entry\x20has\x20b_submission=true\x20(Type3\x20submitted\x20value);\x20the\x20caller\x20can\x20directly\x20submit\x20true\x20to\x20bypass\x20all\x20verification.':'This\x20entry\x20has\x20b_submission=false\x20(Type1\x20constant);\x20the\x20value\x20is\x20fixed\x20but\x20the\x20Guard\x20has\x20no\x20actual\x20verification\x20logic.'),'affected_stakeholders':['customer','provider'],'scenario':c?'Bypass\x20verification:\x20caller\x20submits\x20true\x20to\x20pass\x20the\x20Guard\x20directly':'No\x20verification\x20logic:\x20Guard\x20always\x20returns\x20a\x20fixed\x20value,\x20providing\x20no\x20actual\x20protection','mitigation':c?'1)\x20Ensure\x20the\x20entry\x20referenced\x20by\x20identifier\x20has\x20b_submission=false\x20(constant);'+'2)\x20Or\x20add\x20an\x20additional\x20logic_and\x20condition\x20for\x20cross-validation':'1)\x20Add\x20actual\x20verification\x20logic\x20(query\x20+\x20logic\x20comparison);'+'2)\x20Evaluate\x20whether\x20this\x20Guard\x20needs\x20to\x20exist'};}},{'id':'R-X1-05','data_source_class':'cross_type','trigger':'Allocation\x20Guard\x20may\x20cause\x20some\x20participants\x20to\x20be\x20skipped','check':a=>{if(a['scene']?.['binding_field']!=='order_allocators')return null;return{'id':'R-X1-05','data_source_class':'cross_type','level':'medium','category':'game_theory','title':'order_allocators\x20first-match-wins\x20may\x20cause\x20unfair\x20allocation','description':'order_allocators\x20uses\x20a\x20first-match-wins\x20strategy:\x20the\x20first\x20Allocator\x20whose\x20Guard\x20passes\x20executes\x20the\x20allocation.'+'If\x20the\x20order\x20is\x20poorly\x20designed,\x20some\x20participants\x20may\x20never\x20get\x20allocated.'+'For\x20example:\x20if\x20the\x20first\x20Allocator\x27s\x20Guard\x20condition\x20is\x20too\x20broad,\x20subsequent\x20more\x20precise\x20Allocators\x20will\x20never\x20execute.'+'Allocation\x20Guards\x20typically\x20combine\x20Type1\x20(query\x20order\x20fields),\x20Type3\x20(submit\x20Order\x20address),\x20and\x20Type4\x20(Signer)\x20data.','affected_stakeholders':['provider'],'scenario':'Allocation\x20skip:\x20the\x20Provider\x27s\x20allocation\x20Allocator\x20is\x20skipped\x20by\x20preceding\x20broad\x20conditions','mitigation':'1)\x20Ensure\x20the\x20order_allocators\x20order\x20goes\x20from\x20strict\x20to\x20loose;'+'2)\x20Each\x20Allocator\x27s\x20Guard\x20conditions\x20should\x20be\x20mutually\x20exclusive;'+'3)\x20Consider\x20using\x20logic_or\x20dependencies\x20rather\x20than\x20sequential\x20ordering'};}},{'id':'R-X1-06','data_source_class':'cross_type','trigger':'Workflow\x20Guard\x20time-lock\x20may\x20lock\x20the\x20disadvantaged\x20party','check':a=>{const b=rootStr(a);if(!(b['includes']('clock')&&b['includes']('calc_number_add')))return null;return{'id':'R-X1-06','data_source_class':'cross_type','level':'medium','category':'game_theory','title':'Time-lock\x20may\x20lock\x20the\x20disadvantaged\x20party','description':'Guard\x20uses\x20a\x20time-lock\x20(context(Clock)\x20+\x20calc_number_add).\x20The\x20time-lock\x20itself\x20is\x20neutral,\x20'+'but\x20the\x20locking\x20direction\x20needs\x20to\x20be\x20checked:\x20if\x20the\x20Customer\x20is\x20locked\x20to\x20pay\x20first\x20but\x20cannot\x20accept\x20in\x20time,\x20the\x20Provider\x20gains\x20advantage;\x20'+'if\x20the\x20Provider\x20is\x20locked\x20to\x20deliver\x20first\x20but\x20cannot\x20receive\x20payment\x20in\x20time,\x20the\x20Customer\x20gains\x20advantage.'+'The\x20time-lock\x20combines\x20Type4\x20(Clock)\x20and\x20Type1/2\x20(query\x20time\x20fields)\x20data\x20sources.','affected_stakeholders':['customer','provider'],'scenario':'Time\x20asymmetry:\x20one\x20party\x20is\x20locked\x20by\x20time\x20while\x20the\x20other\x20has\x20freedom\x20of\x20action','mitigation':'1)\x20Ensure\x20the\x20time-lock\x20is\x20symmetric\x20(both\x20parties\x20have\x20time\x20constraints);'+'2)\x20Provide\x20an\x20exit\x20mechanism\x20after\x20the\x20time-lock\x20expires\x20(e.g.\x20auto-refund/auto-complete);'+'3)\x20Design\x20corresponding\x20timeout\x20Forward\x20nodes\x20in\x20the\x20Machine'};}},{'id':'R-X1-07','data_source_class':'cross_type','trigger':'Arbitration\x20usage_guard\x20may\x20block\x20legitimate\x20disputes','check':a=>{if(a['scene']?.['binding_field']!=='usage_guard')return null;const b=rootStr(a),c=(b['match'](/"logic_and"/g)||[])['length'];if(c<0x3)return null;return{'id':'R-X1-07','data_source_class':'cross_type','level':'high','category':'game_theory','title':'usage_guard\x20has\x20too\x20many\x20conditions\x20and\x20may\x20block\x20legitimate\x20disputes','description':'Detected\x20'+c+'\x20logic_and\x20combinations.\x20Too\x20many\x20AND\x20conditions\x20make\x20the\x20dispute\x20threshold\x20too\x20high,\x20'+'the\x20Customer\x20may\x20not\x20be\x20able\x20to\x20initiate\x20a\x20legitimate\x20dispute,\x20and\x20the\x20Provider\x20gains\x20an\x20unfair\x20advantage.'+'usage_guard\x20typically\x20combines\x20Type4\x20(Signer\x20identity),\x20Type3\x20(submit\x20Passport\x20credentials),\x20'+'and\x20Type1\x20(query\x20EntityRegistrar\x20verification)\x20data\x20sources.','affected_stakeholders':['customer'],'scenario':'Dispute\x20threshold\x20too\x20high:\x20Customer\x20cannot\x20initiate\x20a\x20legitimate\x20dispute','mitigation':'1)\x20Re-evaluate\x20the\x20necessity\x20of\x20each\x20AND\x20condition;'+'2)\x20Consider\x20using\x20logic_or\x20to\x20lower\x20the\x20threshold;'+'3)\x20Move\x20non-essential\x20conditions\x20to\x20voting_guard\x20rather\x20than\x20usage_guard'};}},{'id':'R-X1-08','data_source_class':'cross_type','trigger':'Guard\x20is\x20bound\x20to\x20a\x20published\x20Machine/Service\x20(immutable)','check':a=>{if(!a['scene']||a['scene']['mutable_after_publish'])return null;return{'id':'R-X1-08','data_source_class':'cross_type','level':'low','category':'binding_risk','title':'Guard\x20is\x20bound\x20to\x20immutable\x20'+a['scene']['host_object']+'\x20(cannot\x20be\x20modified\x20after\x20publish)','description':'After\x20'+a['scene']['host_object']+'\x20is\x20published,\x20'+a['scene']['binding_field']+'\x20cannot\x20be\x20modified.'+'If\x20the\x20Guard\x20design\x20is\x20flawed,\x20a\x20new\x20Machine/Service\x20must\x20be\x20created\x20and\x20all\x20references\x20migrated.'+'This\x20is\x20a\x20design\x20constraint\x20rather\x20than\x20a\x20risk,\x20but\x20the\x20Guard\x20design\x20must\x20be\x20correct\x20before\x20publishing.','affected_stakeholders':['provider'],'scenario':'Irreversible\x20binding:\x20after\x20publish,\x20a\x20flawed\x20Guard\x20design\x20cannot\x20be\x20modified','mitigation':'1)\x20Use\x20gen_passport\x20for\x20thorough\x20testing\x20before\x20publishing;'+'2)\x20Test\x20both\x20expected-pass\x20and\x20expected-fail\x20scenarios;'+'3)\x20Export\x20a\x20Guard\x20backup\x20(guard2file)\x20before\x20publishing'};}},{'id':'R-X1-09','data_source_class':'cross_type','trigger':'Guard\x20uses\x20rely\x20but\x20the\x20dependent\x20Guard\x20may\x20fail','check':a=>{if(!a['rely']||a['rely']['guards']['length']===0x0)return null;const b=a['rely']['logic_or']?'OR':'AND';return{'id':'R-X1-09','data_source_class':'cross_type','level':a['rely']['logic_or']?'low':'medium','category':'dependency_risk','title':'rely\x20'+b+'\x20depends\x20on\x20'+a['rely']['guards']['length']+'\x20external\x20Guards','description':'Guard\x20uses\x20rely\x20'+b+'\x20to\x20depend\x20on\x20'+a['rely']['guards']['length']+'\x20external\x20Guards.'+(a['rely']['logic_or']?'OR\x20logic:\x20any\x20one\x20passing\x20is\x20enough.\x20If\x20a\x20dependent\x20Guard\x20is\x20loosely\x20designed,\x20it\x20may\x20become\x20a\x20bypass\x20entry\x20point.':'AND\x20logic:\x20all\x20dependencies\x20must\x20pass.\x20If\x20a\x20dependent\x20Guard\x20fails\x20or\x20is\x20deleted,\x20the\x20current\x20Guard\x20will\x20always\x20fail.')+'\x20rely-dependent\x20Guards\x20must\x20have\x20rep=true\x20(repository.data\x20queries\x20do\x20not\x20depend\x20on\x20runtime\x20submission).','affected_stakeholders':['customer','provider'],'scenario':a['rely']['logic_or']?'Dependency\x20bypass:\x20a\x20loose\x20dependent\x20Guard\x20becomes\x20an\x20attack\x20entry\x20point':'Dependency\x20failure:\x20a\x20dependent\x20Guard\x20is\x20deleted,\x20causing\x20the\x20current\x20Guard\x20to\x20always\x20fail','mitigation':a['rely']['logic_or']?'1)\x20Review\x20the\x20strictness\x20of\x20each\x20dependent\x20Guard;\x202)\x20Ensure\x20all\x20dependent\x20Guards\x20are\x20at\x20least\x20as\x20strict\x20as\x20the\x20current\x20Guard':'1)\x20Confirm\x20all\x20dependent\x20Guards\x20have\x20rep=true\x20and\x20cannot\x20be\x20deleted;\x202)\x20Consider\x20whether\x20AND\x20dependency\x20is\x20truly\x20needed'};}},{'id':'R-X1-10','data_source_class':'cross_type','trigger':'Guard\x20uses\x20repository.data\x20query\x20(query\x201167)\x20and\x20the\x20Repository\x20has\x20quote_guard\x20set\x20—\x20rigid\x20verification\x20requirement','check':a=>{const b=rootStr(a);if(!(b['includes']('repository')&&b['includes']('\x22query\x22')))return null;return{'id':'R-X1-10','data_source_class':'cross_type','level':'low','category':'impack_risk','title':'repository.data\x20quote_guard\x20is\x20a\x20RIGID\x20verification\x20requirement\x20(data\x20subscription\x20access\x20control)','description':'When\x20a\x20Guard\x20queries\x20repository.data\x20(query\x201167),\x20if\x20the\x20Repository\x20policy\x20has\x20quote_guard\x20set\x20(Some(addr)),\x20'+'then\x20the\x20quote_guard\x20MUST\x20be\x20verified.\x20This\x20is\x20a\x20RIGID\x20requirement\x20—\x20not\x20context-dependent.\x0a\x0a'+'TWO-PHASE\x20VERIFICATION\x20MECHANISM\x20(VERIFIED:\x20passport.rs#L756-769,\x20passport.rs#L545-612):\x0a'+'\x20\x20Phase\x201\x20—\x20Passport\x20generation\x20(scan\x20guard):\x20The\x20system\x20scans\x20the\x20Guard\x20to\x20identify\x20that\x20it\x20queries\x20repository\x20data.\x20'+'If\x20the\x20Repository\x20has\x20a\x20quote_guard,\x20the\x20system\x20prepares\x20the\x20quote_guard\x20for\x20verification\x20(adds\x20it\x20to\x20the\x20required\x20'+'verification\x20set,\x20populating\x20impack_list).\x0a'+'\x20\x20Phase\x202\x20—\x20Passport\x20verification:\x20The\x20system\x20re-checks\x20(a)\x20is\x20the\x20quote_guard\x20prepared/in\x20impack_list?\x20'+'(b)\x20rigidly\x20verify\x20the\x20quote_guard\x20(e.g.,\x20verify\x20Payment\x20proof\x20for\x20subscription).\x0a\x0a'+'SEMANTIC\x20INTENT:\x20Any\x20Guard\x20that\x20uses\x20a\x20Repository\x27s\x20data\x20MUST\x20satisfy\x20that\x20Repository\x27s\x20quote_guard.\x20'+'This\x20is\x20the\x20intended\x20access\x20control\x20mechanism\x20for\x20data\x20subscription\x20—\x20e.g.,\x20accessing\x20weather\x20data\x20'+'requires\x20payment\x20proof\x20verified\x20by\x20the\x20quote_guard.\x0a\x0a'+'DESIGN\x20PHILOSOPHY:\x20On-chain\x20data\x20is\x20consumed\x20by\x20guard\x20verifiers.\x20The\x20quote_guard\x20gates\x20Repository\x20data\x20access,\x20'+'enabling\x20subscription\x20revenue\x20models.\x20The\x20Guard\x20only\x20verifies\x20logic\x20+\x20data\x20accuracy\x20(verifier-evidence\x20design).','affected_stakeholders':['customer','provider'],'scenario':'quote_guard\x20rigid\x20verification:\x20any\x20guard\x20querying\x20repository\x20data\x20must\x20satisfy\x20the\x20repository\x27s\x20quote_guard\x20(e.g.,\x20payment\x20requirement)','mitigation':'1)\x20This\x20is\x20an\x20INTENDED\x20capability,\x20not\x20a\x20limitation\x20—\x20quote_guard\x20enables\x20data\x20subscription\x20access\x20control;\x0a'+'2)\x20When\x20designing\x20a\x20Guard\x20that\x20queries\x20Repository\x20data\x20with\x20quote_guard:\x20ensure\x20the\x20Passport\x20includes\x20'+'the\x20quote_guard\x20verification\x20with\x20necessary\x20submissions\x20(e.g.,\x20Payment\x20proof);\x0a'+'3)\x20Pattern:\x20Repository\x20with\x20quote_guard\x20for\x20data\x20subscription\x20—\x20quote_guard\x20verifies\x20Payment\x20(for_object,\x20for_guard,\x20index),\x20'+'user\x20submits\x20Payment\x20via\x20Passport,\x20quote_guard\x20verified\x20in\x20both\x20phases,\x20repository\x20data\x20query\x20passes;\x0a'+'4)\x20If\x20quote_guard==None:\x20no\x20access\x20control\x20—\x20Repository\x20data\x20is\x20freely\x20queryable'};}},{'id':'R-X1-11','data_source_class':'cross_type','trigger':'Guard\x20uses\x20rely\x20to\x20depend\x20on\x20other\x20Guards;\x20need\x20to\x20confirm\x20the\x20rep\x20flag\x20of\x20dependent\x20Guards\x20is\x20correct','check':a=>{if(!a['rely']||a['rely']['guards']['length']===0x0)return null;const b=rootStr(a),c=b['includes']('repository')&&b['includes']('\x22query\x22'),d=a['table']['some'](f=>f['b_submission']&&f['value_type']==='Address'&&f['object_type']==='Repository');return{'id':'R-X1-11','data_source_class':'cross_type','level':c&&d?'medium':'low','category':'rep_risk','title':'rep\x20semantics\x20needs\x20confirmation\x20(when\x20repository.data\x20query\x20depends\x20on\x20submission,\x20rep=false\x20and\x20cannot\x20be\x20depended\x20on)','description':'Guard\x20uses\x20rely\x20to\x20depend\x20on\x20external\x20Guards.\x20In\x20the\x20WoWok\x20protocol,\x20rely-dependent\x20Guards\x20must\x20have\x20rep=true.\x0a'+'Precise\x20rep\x20semantics\x20(guard.rs#L483-L492):\x20repository.data\x20query\x20(query\x201167)\x20does\x20not\x20depend\x20on\x20runtime\x20submission.\x0a'+'\x20\x20-\x20rep=true:\x20repository.data\x20query\x20is\x20fully\x20constant-driven\x20(object\x20address\x20b_submission=false\x20and\x20query\x20parameters\x20are\x20not\x20submission)\x0a'+'\x20\x20-\x20rep=false:\x20repository\x20address\x20comes\x20from\x20runtime\x20submission,\x20or\x20query\x20parameters\x20come\x20from\x20submission\x0a'+'Guards\x20with\x20rep=false\x20cannot\x20appear\x20in\x20other\x20Guards\x27\x20rely\x20lists.\x0a'+(c&&d?'\x0aWarning:\x20the\x20current\x20Guard\x20itself\x20queries\x20repository.data\x20and\x20the\x20Repository\x20address\x20comes\x20from\x20submission,\x20'+'so\x20its\x20own\x20rep=false\x20and\x20cannot\x20be\x20depended\x20on\x20by\x20other\x20Guards.':''),'affected_stakeholders':['provider'],'scenario':'rep\x20misjudgment:\x20depending\x20on\x20a\x20rep=false\x20Guard\x20causes\x20creation\x20failure,\x20or\x20its\x20own\x20rep=false\x20is\x20wrongly\x20depended\x20on','mitigation':'1)\x20Confirm\x20all\x20rely-dependent\x20Guards\x20have\x20rep=true\x20(do\x20not\x20depend\x20on\x20submission\x20to\x20query\x20repository.data);'+'2)\x20If\x20the\x20current\x20Guard\x20queries\x20repository.data\x20and\x20the\x20address\x20comes\x20from\x20submission,\x20its\x20own\x20rep=false;\x20annotate\x20that\x20it\x20cannot\x20be\x20depended\x20on;'+'3)\x20rep\x20is\x20not\x20\x27no\x20Repository\x20dependency\x27,\x20but\x20\x27repository.data\x20query\x20does\x20not\x20depend\x20on\x20submission\x27;'+'4)\x20Use\x20wowok_buildin_info\x20to\x20query\x20the\x20full\x20definition\x20of\x20the\x20rep\x20flag','evidence':c&&d?'Self\x20rep=false\x20(repository.data\x20query\x20depends\x20on\x20submission)':'Self\x20rep\x20status\x20to\x20be\x20confirmed'};}},{'id':'R-X1-12','data_source_class':'cross_type','trigger':'Guard\x20table\x20contains\x20b_submission=true\x20entries\x20with\x20vague\x20name\x20descriptions\x20or\x20missing\x20binding_constraint','check':a=>{const b=a['table']['filter'](d=>d['b_submission']);if(b['length']===0x0)return null;const c=b['filter'](d=>{const f=d['name']??'';return f['length']<0xa||/^[a-z_]+$/i['test'](f)||f==='';});if(c['length']===0x0)return null;return{'id':'R-X1-12','data_source_class':'cross_type','level':'medium','category':'submission_forgery','title':'Submitted\x20data\x20entry\x20description\x20is\x20vague\x20(retained_submission\x20risk:\x20caller\x20may\x20submit\x20wrong\x20data)','description':'Guard\x20table\x20has\x20'+c['length']+'\x20b_submission=true\x20entries\x20with\x20vague\x20name\x20descriptions.\x0a'+'The\x20name\x20of\x20a\x20submission\x20entry\x20is\x20the\x20only\x20data\x20contract\x20between\x20the\x20Guard\x20and\x20the\x20caller.\x0a'+'If\x20the\x20name\x20description\x20is\x20unclear\x20(e.g.\x20only\x20\x27addr\x27\x20/\x20\x27order_id\x27),\x20the\x20caller\x20may:\x0a'+'\x20\x20-\x20Submit\x20a\x20wrong-typed\x20object\x20address\x20(e.g.\x20submit\x20a\x20Service\x20address\x20instead\x20of\x20an\x20Order\x20address)\x0a'+'\x20\x20-\x20Submit\x20a\x20wrong\x20value\x20(e.g.\x20inconsistent\x20amount\x20units)\x0a'+'\x20\x20-\x20Confuse\x20submission\x20slots\x20of\x20different\x20Guards\x20in\x20multi-Guard\x20scenarios\x0a'+'Vague\x20submission\x20entries\x20are\x20\x27retained\x27\x20in\x20the\x20table\x20but\x20provide\x20no\x20effective\x20data\x20constraints,\x20'+'equivalent\x20to\x20the\x20Guard\x20accepting\x20arbitrary\x20data\x20without\x20validating\x20its\x20semantic\x20correctness.','affected_stakeholders':['customer','provider'],'scenario':'Caller\x20submits\x20wrong\x20data\x20due\x20to\x20vague\x20name\x20description;\x20the\x20Guard\x20passes\x20verification\x20but\x20the\x20business\x20logic\x20is\x20wrong','mitigation':'1)\x20Each\x20submission\x20entry\x27s\x20name\x20should\x20be\x20a\x20complete\x20natural-language\x20description\x20(e.g.\x20\x27The\x20order\x20ID\x20that\x20identifies\x20the\x20target\x20Order\x20for\x20verification\x27);\x0a'+'2)\x20Avoid\x20Technical\x20identifiers\x20as\x20name\x20(e.g.\x20\x27order_id\x27\x20should\x20become\x20\x27Order\x20ID,\x20used\x20to\x20query\x20progress\x20status\x27);\x0a'+'3)\x20Add\x20failure_conditions\x20in\x20binding_hint\x20to\x20clarify\x20failure\x20scenarios;\x0a'+'4)\x20Consider\x20adding\x20type\x20validation\x20logic\x20in\x20root\x20(e.g.\x20query\x20the\x20submitted\x20object\x27s\x20objectType\x20and\x20match\x20with\x20expectation)','evidence':'Vague\x20entries:\x20'+c['map'](d=>'identifier='+d['identifier']+',\x20name=\x22'+d['name']+'\x22')['join'](';\x20')};}},{'id':'R-X1-13','data_source_class':'cross_type','trigger':'Guard\x20references\x20its\x20host\x20object\x20(Host\x20Object)\x20itself\x20—\x20circular\x20reference\x20pattern','check':a=>{if(!a['scene'])return null;const b=a['scene']['host_object'],c=a['table']['find'](d=>!d['b_submission']&&d['value_type']==='Address'&&d['object_type']===b);if(!c)return null;return{'id':'R-X1-13','data_source_class':'cross_type','level':'medium','category':'binding_risk','title':'Circular\x20reference\x20pattern\x20(Guard\x20references\x20the\x20host\x20object\x20itself;\x20note\x20creation\x20order)','description':'In\x20the\x20Guard\x27s\x20table,\x20identifier='+c['identifier']+'\x20has\x20object_type\x20equal\x20to\x20the\x20host\x20object\x20type\x20\x22'+b+'\x22.\x0a'+'Circular\x20reference\x20pattern:\x20the\x20Guard\x20is\x20bound\x20to\x20a\x20Host\x20Object\x20(e.g.\x20Service.buy_guard)\x20and\x20also\x20queries\x20the\x20Host\x20Object\x27s\x20own\x20fields.\x0a'+'Creation\x20order\x20constraints:\x0a'+'\x20\x201.\x20The\x20Host\x20Object\x20must\x20be\x20created\x20first\x20(unpublished\x20state)\x0a'+'\x20\x202.\x20When\x20the\x20Guard\x20is\x20created,\x20the\x20table\x20uses\x20the\x20Host\x20Object\x27s\x20name\x20(not\x20address);\x20the\x20SDK\x20resolves\x20it\x20at\x20binding\x20time\x0a'+'\x20\x203.\x20After\x20the\x20Guard\x20is\x20bound\x20to\x20the\x20Host\x20Object,\x20the\x20Host\x20Object\x20is\x20published\x0a'+'Risks:\x0a'+'\x20\x20-\x20If\x20the\x20Host\x20Object\x20is\x20already\x20published\x20(immutable),\x20the\x20Guard\x20can\x20no\x20longer\x20be\x20bound\x0a'+'\x20\x20-\x20If\x20the\x20Host\x20Object\x27s\x20name\x20is\x20modified\x20after\x20the\x20Guard\x20is\x20created,\x20the\x20Guard\x27s\x20table\x20reference\x20is\x20invalidated\x0a'+'\x20\x20-\x20Circular\x20reference\x20makes\x20the\x20Guard\x20not\x20independently\x20testable\x20(the\x20Host\x20Object\x20must\x20exist\x20to\x20verify)','affected_stakeholders':['provider'],'scenario':'Guard\x20queries\x20fields\x20of\x20the\x20Service/Machine/Reward\x20it\x20is\x20bound\x20to;\x20wrong\x20creation\x20order\x20causes\x20binding\x20failure','mitigation':'1)\x20Ensure\x20the\x20Host\x20Object\x20is\x20unpublished\x20(bPublished=false)\x20when\x20creating\x20and\x20binding\x20the\x20Guard;\x0a'+'2)\x20Use\x20the\x20Host\x20Object\x27s\x20name\x20rather\x20than\x20address\x20in\x20table\x20(the\x20SDK\x20auto-resolves);\x0a'+'3)\x20Perform\x20Guard\x20verification\x20tests\x20after\x20the\x20Host\x20Object\x20is\x20published;\x0a'+'4)\x20Use\x20guard2file\x20to\x20export\x20a\x20Guard\x20backup\x20for\x20restoring\x20references\x20during\x20rebuild','evidence':'Circular\x20reference:\x20identifier='+c['identifier']+',\x20object_type=\x22'+b+'\x22\x20→\x20'+a['scene']['host_object']};}},{'id':'R-X1-14','data_source_class':'cross_type','trigger':'Scene-specific\x20reentrancy:\x20Guard\x20pass\x20triggers\x20a\x20state-changing\x20side\x20effect\x20(fund\x20distribution,\x20vote\x20count,\x20Arb\x20creation)\x20that\x20does\x20NOT\x20naturally\x20invalidate\x20the\x20Guard\x20condition.\x20'+'Without\x20an\x20anti-reentrancy\x20primitive,\x20the\x20same\x20Signer\x20can\x20repeatedly\x20pass\x20the\x20Guard.\x20'+'Additionally\x20detects\x20pseudo-protection:\x20primitive\x20present\x20but\x20not\x20properly\x20wrapped\x20in\x20logic_not\x20(for\x20Bool\x20queries)\x20or\x20logic_equal(0)\x20(for\x20count\x20queries).','check':a=>{const b=REENTRANCY_SPECS['find'](f=>f['sceneId']===a['scene']?.['id']);if(!b)return null;const c=detectReentrancyProtection(a['root'],a['table'],b);if(c['state']==='protected')return null;if(c['state']==='pseudo')return{'id':'R-X1-14','data_source_class':'cross_type','level':'medium','category':'logic_gap','title':'Reentrancy\x20pseudo-protection:\x20anti-reentrancy\x20primitive\x20present\x20but\x20not\x20properly\x20wrapped\x20('+b['sceneId']+')','description':'Scene:\x20'+b['sceneId']+'\x0a'+('The\x20Guard\x20root\x20contains\x20an\x20anti-reentrancy\x20primitive\x20('+c['foundPrimitiveName']+'),\x20but\x20it\x20is\x20NOT\x20properly\x20wrapped.\x0a')+'Proper\x20wrapping\x20rules:\x0a'+'\x20\x20-\x20Bool-returning\x20primitives\x20(exists-style):\x20must\x20be\x20wrapped\x20in\x20logic_not\x0a'+'\x20\x20-\x20U64-returning\x20primitives\x20(count-style):\x20must\x20be\x20compared\x20to\x200\x20via\x20logic_equal\x0a'+'\x20\x20-\x20Address-returning\x20primitives:\x20must\x20be\x20wrapped\x20in\x20logic_not\x20(None\x20check)\x0a\x0a'+'WHY\x20THIS\x20IS\x20DANGEROUS:\x0a'+'\x20\x20The\x20developer\x20likely\x20intended\x20to\x20prevent\x20reentrancy\x20but\x20the\x20wrapping\x20is\x20incorrect,\x20'+'so\x20the\x20primitive\x20does\x20NOT\x20actually\x20block\x20repeated\x20Guard\x20passes.\x20This\x20is\x20arguably\x20MORE\x20'+'dangerous\x20than\x20absence\x20—\x20code\x20reviewers\x20see\x20the\x20primitive\x20and\x20assume\x20protection\x20is\x20in\x20place.\x0a\x0a'+('Scene\x20rationale:\x20'+b['rationale']),'affected_stakeholders':deriveStakeholders(b['sceneId']),'scenario':'Developer\x20added\x20anti-reentrancy\x20primitive\x20but\x20used\x20wrong\x20wrapping;\x20reentrancy\x20exploit\x20still\x20possible\x20in\x20'+b['sceneId'],'mitigation':'Fix\x20the\x20wrapping:\x0a'+'\x20\x20-\x20For\x20exists-style\x20(Bool)\x20primitives:\x20wrap\x20in\x20logic_not\x20—\x20{\x20type:\x20\x27logic_not\x27,\x20node:\x20{\x20type:\x20\x27query\x27,\x20query:\x20<primitive>,\x20...\x20}\x20}\x0a'+'\x20\x20-\x20For\x20count-style\x20(U64)\x20primitives:\x20compare\x20to\x200\x20—\x20{\x20type:\x20\x27logic_equal\x27,\x20nodes:\x20[\x20{\x20type:\x20\x27query\x27,\x20query:\x20<primitive>,\x20...\x20},\x20identifier(N)\x20]\x20}\x20where\x20table[N].value\x20=\x200\x0a'+'\x20\x20-\x20For\x20address-style\x20primitives:\x20wrap\x20in\x20logic_not\x20(None\x20check)\x0a'+'Then\x20wrap\x20the\x20protection\x20in\x20logic_and\x20with\x20the\x20existing\x20root\x20conditions.\x0a\x0a'+('Full\x20mitigation\x20for\x20'+b['sceneId']+':\x0a'+b['mitigation']),'evidence':c['evidence']};const d=b['level'],e=deriveStakeholders(b['sceneId']);return{'id':'R-X1-14','data_source_class':'cross_type','level':d,'category':'logic_gap','title':d==='low'?'Reentrancy\x20reminder:\x20'+b['sceneId']+'\x20has\x20no\x20anti-reentrancy\x20primitive\x20(LOW\x20risk)':'Reentrancy\x20risk:\x20'+b['sceneId']+'\x20has\x20NO\x20anti-reentrancy\x20protection\x20('+d['toUpperCase']()+')','description':'Scene:\x20'+b['sceneId']+'\x0a'+('Reentrancy\x20risk\x20level:\x20'+d['toUpperCase']()+'\x0a\x0a')+('RATIONALE:\x0a'+b['rationale']+'\x0a\x0a')+(c['evidence']?'DETECTION:\x0a'+c['evidence']+'\x0a\x0a':'')+(d==='critical'?'IMPACT:\x20Without\x20protection,\x20the\x20same\x20Signer\x20can\x20repeatedly\x20trigger\x20the\x20side\x20effect\x20(fund\x20distribution\x20/\x20vote\x20counting),\x20causing\x20direct\x20fund\x20loss\x20or\x20result\x20manipulation.\x20THIS\x20IS\x20A\x20CRITICAL\x20VULNERABILITY\x20—\x20the\x20Guard\x20MUST\x20be\x20rebuilt\x20with\x20an\x20anti-reentrancy\x20primitive\x20before\x20deployment.\x0a\x0a':d==='high'?'IMPACT:\x20Without\x20protection,\x20the\x20system\x20can\x20be\x20abused\x20(multiple\x20dispute\x20cases,\x20arbitration\x20harassment).\x20Strongly\x20recommended\x20to\x20add\x20protection.\x0a\x0a':'IMPACT:\x20Low\x20by\x20default;\x20only\x20relevant\x20if\x20business\x20intent\x20requires\x20single-action\x20enforcement.\x20Review\x20the\x20rationale\x20above.\x0a\x0a'),'affected_stakeholders':e,'scenario':d==='low'?b['sceneId']+'\x20lacks\x20anti-reentrancy\x20primitive;\x20may\x20or\x20may\x20not\x20be\x20needed\x20depending\x20on\x20business\x20intent':b['sceneId']+'\x20lacks\x20anti-reentrancy\x20primitive;\x20same\x20Signer\x20can\x20repeatedly\x20trigger\x20the\x20side\x20effect','mitigation':b['mitigation'],'evidence':c['evidence']};}},{'id':'R-X1-15','data_source_class':'cross_type','trigger':'Guard\x20root\x20contains\x20a\x20progress.current\x20query\x20(id=1253\x20or\x20name=\x27progress.current\x27);\x20'+'if\x20bound\x20to\x20a\x20forward\x20of\x20the\x20SAME\x20Progress\x20object,\x20the\x20guard\x20evaluates\x20before\x20state\x20transition','check':a=>{const b=extractQueryIds(a['root']);if(!b['includes'](0x4e5))return null;return{'id':'R-X1-15','data_source_class':'cross_type','level':'medium','category':'logic_gap','title':'Guard\x20queries\x20progress.current\x20—\x20verify\x20it\x20is\x20NOT\x20the\x20same\x20Progress\x20object\x20the\x20hosting\x20operation\x20mutates','description':'Cognitive\x20Principle\x20P1:\x20Guard\x20validation\x20ALWAYS\x20occurs\x20BEFORE\x20the\x20operation.\x20'+'This\x20Guard\x20contains\x20a\x20progress.current\x20query.\x20If\x20this\x20Guard\x20is\x20bound\x20to\x20a\x20forward\x20'+'of\x20the\x20SAME\x20Progress\x20object\x20it\x20queries,\x20the\x20Guard\x20will\x20see\x20the\x20PRE-transition\x20value\x20'+'(source\x20node,\x20not\x20target\x20node)\x20and\x20may\x20always\x20fail.\x20'+'Querying\x20a\x20DIFFERENT\x20Progress\x20object\x20(e.g.\x20another\x20Machine\x27s\x20progress)\x20is\x20a\x20valid\x20'+'and\x20reasonable\x20design\x20pattern\x20—\x20the\x20principle\x20does\x20not\x20apply\x20in\x20that\x20case.\x20'+'Allocator-bound\x20guards\x20are\x20also\x20unaffected\x20because\x20allocation.alloc()\x20runs\x20AFTER\x20'+'the\x20state\x20transition\x20completes.','affected_stakeholders':['provider'],'scenario':'Forward\x20guard\x20checks\x20progress.current\x20==\x20target_node\x20of\x20the\x20same\x20Progress\x20—\x20'+'always\x20fails\x20because\x20guard\x20runs\x20before\x20session_accomplish\x20sets\x20the\x20new\x20current\x20node','mitigation':'1)\x20If\x20this\x20Guard\x20queries\x20the\x20SAME\x20Progress\x20object\x20the\x20forward\x20operates\x20on:\x20'+'remove\x20the\x20guard\x20from\x20the\x20forward,\x20bind\x20it\x20ONLY\x20to\x20the\x20Allocator\x20(which\x20runs\x20after\x20transition);\x20'+'OR\x20change\x20the\x20check\x20to\x20verify\x20the\x20SOURCE\x20node\x20instead\x20of\x20the\x20target\x20node.\x20'+'2)\x20If\x20this\x20Guard\x20queries\x20a\x20DIFFERENT\x20Progress\x20object\x20(cross-machine):\x20no\x20action\x20needed\x20—\x20'+'this\x20is\x20a\x20legitimate\x20pattern.\x20'+'3)\x20Refer\x20to\x20GUARD_COGNITIVE_PRINCIPLES\x20P1\x20for\x20the\x20full\x20principle\x20and\x20code\x20evidence.','evidence':'Root\x20contains\x20progress.current\x20query\x20(id=1253).\x20'+('Query\x20IDs\x20detected:\x20['+b['join'](',\x20')+'].')};}}];function deriveStakeholders(a){switch(a){case'reward_guard':return['claimant','provider'];case'arbitration_voting_guard':return['customer','provider','arbitrator'];case'arbitration_usage_guard':return['customer','provider'];case'service_order_allocators_guard':return['customer','provider'];default:return['provider'];}}export function assessGuardRisks(a){const b={'table':a['table'],'root':a['root'],'rely':a['rely'],'scene':a['scene'],'operation_type':a['operation_type'],'sharing_recipients':a['sharing_recipients']},c=[];for(const i of RISK_RULES){try{const j=i['check'](b);if(j)c['push'](j);}catch{}}const d=getOverallRiskLevel(c),e={};for(const k of c){e[k['data_source_class']]=(e[k['data_source_class']]??0x0)+0x1;}const f=generateStakeholderAdvice(c,a['scene']),g=c['some'](l=>l['level']==='critical')||c['filter'](l=>l['level']==='high')['length']>=0x2,h=generateGuardSummary(a);return{'guard_summary':h,'scene':a['scene'],'risks':c,'overall_risk':d,'risks_by_data_source':e,'stakeholder_advice':f,'needs_human_review':g};}function getOverallRiskLevel(a){if(a['some'](b=>b['level']==='critical'))return'critical';if(a['some'](b=>b['level']==='high'))return'high';if(a['some'](b=>b['level']==='medium'))return'medium';return'low';}function generateStakeholderAdvice(a,b){const c={};for(const d of a){for(const e of d['affected_stakeholders']){if(!c[e])c[e]=[];c[e]['push']('['+d['level']['toUpperCase']()+']\x20'+d['title']+':\x20'+d['mitigation']);}}if(b)switch(b['binding_field']){case'buy_guard':if(!c['customer'])c['customer']=[];c['customer']['push']('Before\x20purchase,\x20verify\x20the\x20buy_guard\x20logic\x20to\x20ensure\x20your\x20identity/credentials\x20can\x20pass\x20validation');break;case'order_allocators':if(!c['provider'])c['provider']=[];c['provider']['push']('Verify\x20the\x20order_allocators\x20ordering\x20to\x20ensure\x20your\x20Allocator\x20will\x20not\x20be\x20skipped\x20by\x20preceding\x20conditions');break;case'voting_guard':if(!c['arbitrator'])c['arbitrator']=[];c['arbitrator']['push']('Confirm\x20the\x20voting\x20weight\x20source\x20is\x20trustworthy;\x20prefer\x20querying\x20EntityRegistrar\x20rather\x20than\x20user-submitted\x20data');break;case'Forward.guard':if(!c['customer'])c['customer']=[];c['customer']['push']('Verify\x20the\x20Forward.guard\x20conditions\x20to\x20ensure\x20you\x20can\x20satisfy\x20the\x20advancement\x20criteria\x20and\x20avoid\x20locked\x20funds');break;}return c;}function generateGuardSummary(a){const b=[];b['push']('table\x20entries:\x20'+a['table']['length']);const c=a['table']['filter'](d=>d['b_submission'])['length'];return b['push']('submitted\x20data:\x20'+c+'\x20entries'),b['push']('root\x20type:\x20'+(a['root']?.['type']??'unknown')),a['rely']&&b['push']('rely:\x20'+a['rely']['guards']['length']+'\x20dependencies\x20('+(a['rely']['logic_or']?'OR':'AND')+')'),b['join'](',\x20');}export function assessGuardRisksForOperation(a,b){if(a!=='guard')return null;const c=b?.['table']??[],d=b?.['root'],e=b?.['rely'];let f;return assessGuardRisks({'table':c,'root':d,'rely':e,'scene':f,'operation_type':a});}export function getRiskSummary(a){return{'risk_count':a['risks']['length'],'critical_count':a['risks']['filter'](b=>b['level']==='critical')['length'],'high_count':a['risks']['filter'](b=>b['level']==='high')['length'],'needs_human_review':a['needs_human_review'],'top_risks':a['risks']['filter'](b=>b['level']==='critical'||b['level']==='high')['slice'](0x0,0x3)['map'](b=>b['title'])};}export function getRiskRulesByDataSourceClass(a){return RISK_RULES['filter'](b=>b['data_source_class']===a);}export function getAllRiskRules(){return RISK_RULES;}export function getRiskRulesCount(){return RISK_RULES['length'];}
+import{GUARDQUERY}from'@wowok/wowok';import{isUnboundSignerTheft}from'./recipient-constraint.js';export const GUARD_COGNITIVE_PRINCIPLES=[{'id':'P1','title':'Guard\x20validation\x20always\x20precedes\x20the\x20operation','statement':'Guard\x20validation\x20ALWAYS\x20occurs\x20BEFORE\x20the\x20operation\x20it\x20guards.\x20'+'A\x20Guard\x20must\x20NOT\x20depend\x20on\x20data\x20that\x20the\x20current\x20operation\x20will\x20modify.','code_evidence':'progress.move\x20next_with_passport_imp:\x20result_for_guard\x20(line\x20471)\x20'+'runs\x20before\x20session_accomplish\x20(line\x20481)\x20which\x20sets\x20self.current\x20(line\x20443).','legitimate_exception':'Querying\x20progress.current\x20of\x20a\x20DIFFERENT\x20Progress\x20object\x20(cross-machine)\x20'+'is\x20safe\x20and\x20reasonable\x20—\x20that\x20progress\x20is\x20not\x20modified\x20by\x20the\x20current\x20operation.','scope':'Applies\x20when\x20a\x20Guard\x20queries\x20state\x20of\x20the\x20SAME\x20object\x20the\x20operation\x20mutates.'},{'id':'P2','title':'Guard\x20is\x20CREATE-only\x20and\x20immutable','statement':'After\x20creation,\x20Guard\x20table/root/rely\x20cannot\x20be\x20modified.\x20'+'To\x20change\x20logic,\x20create\x20a\x20new\x20Guard\x20and\x20rebind\x20references.','scope':'Applies\x20to\x20all\x20Guard\x20lifecycle\x20decisions.'}];function rootStr(a){return JSON['stringify'](a['root'])['toLowerCase']();}function hasSignerCheck(a){return JSON['stringify'](a['root'])['includes']('\x22Signer\x22');}function hasClockCheck(a){return JSON['stringify'](a['root'])['includes']('\x22Clock\x22');}function hasGuardSelfRef(a){return JSON['stringify'](a['root'])['includes']('\x22Guard\x22');}function hasWitness(a){const b=JSON['stringify'](a);return b['includes']('\x22convert_witness\x22');}function queriesRepository(a){return rootStr(a)['includes']('repository');}function queriesProgress(a){return rootStr(a)['includes']('progress');}function extractWitnessCodes(a){const b=[],c=JSON['stringify'](a),d=c['matchAll'](/"convert_witness"\s*:\s*(\d+)/g);for(const e of d){const f=parseInt(e[0x1],0xa);if(f>=0x64&&f<=0x6c)b['push'](f);}return b;}const WITNESS_CHAIN={0x64:['Order','Progress'],0x65:['Order','Machine'],0x66:['Order','Service'],0x67:['Progress','Machine'],0x68:['Arb','Order'],0x69:['Arb','Arbitration'],0x6a:['Arb','Order','Progress'],0x6b:['Arb','Order','Service'],0x6c:['Arb','Order','Machine']};function extractWitnessIdentifierPairs(a){const b=[],c=new WeakSet();function d(e){if(e===null||typeof e!=='object')return;if(c['has'](e))return;c['add'](e);typeof e['convert_witness']==='number'&&typeof e['identifier']==='number'&&b['push']({'code':e['convert_witness'],'identifier':e['identifier']});for(const f of Object['keys'](e)){const g=e[f];if(Array['isArray'](g)){for(const h of g)d(h);}else g!==null&&typeof g==='object'&&d(g);}}return d(a),b;}function getChildNodes(a){if(!a||typeof a!=='object')return[];const b=[];if(Array['isArray'](a['nodes']))b['push'](...a['nodes']);if(a['left'])b['push'](a['left']);if(a['right'])b['push'](a['right']);if(a['vec'])b['push'](a['vec']);if(a['target'])b['push'](a['target']);if(a['object']&&typeof a['object']==='object')b['push'](a['object']);if(Array['isArray'](a['parameters']))b['push'](...a['parameters']);return b['filter'](d=>d&&typeof d==='object');}function findSignerLogicEqualNodes(a){const b=[];function c(d,e){if(!d||typeof d!=='object')return;if(d['type']==='logic_equal'){const f=Array['isArray'](d['nodes'])?d['nodes']:d['left']&&d['right']?[d['left'],d['right']]:[];if(f['length']===0x2){const g=f['findIndex'](h=>h?.['type']==='context'&&h?.['context']==='Signer');g>=0x0&&b['push']({'node':d,'parentType':e,'otherOperand':f[0x1-g]});}}for(const h of getChildNodes(d)){c(h,d['type']);}}return c(a,null),b;}function detectLevel1StrictBinding(a,b){const c=findSignerLogicEqualNodes(a);for(const d of c){const e=d['otherOperand'];if(e?.['type']==='identifier'){const f=b['find'](g=>g['identifier']===e['identifier']);if(f&&!f['b_submission']&&f['value_type']==='Address'&&typeof f['value']==='string'&&f['value']['length']>0x0)return{'detected':!![],'entry':{'identifier':f['identifier'],'value':f['value'],'name':f['name']}};}}return{'detected':![]};}function isSignerCheckInLogicOr(a){const b=findSignerLogicEqualNodes(a);return b['some'](c=>c['parentType']==='logic_or');}const QUERY_INVARIANT_MAP=((()=>{const a=new Map();for(const b of GUARDQUERY){b['invariant']!==undefined&&a['set'](b['id'],b['invariant']);}return a;})());function extractQueryIds(a){const b=[],c=JSON['stringify'](a),d=c['matchAll'](/"query"\s*:\s*(\d+)/g);for(const f of d){const g=parseInt(f[0x1],0xa);if(!b['includes'](g))b['push'](g);}const e=c['matchAll'](/"query"\s*:\s*"([^"]+)"/g);for(const h of e){const i=h[0x1],j=GUARDQUERY['find'](k=>k['name']===i);if(j&&!b['includes'](j['id']))b['push'](j['id']);}return b;}function getQueryInvariant(a){return QUERY_INVARIANT_MAP['get'](a);}function rootHasNonZeroQuery(a){const b=extractQueryIds(a);return b['some'](c=>QUERY_INVARIANT_MAP['has'](c));}function rootAllQueriesNonZero(a){const b=extractQueryIds(a);if(b['length']===0x0)return![];return b['every'](c=>QUERY_INVARIANT_MAP['has'](c));}const REENTRANCY_SPECS=[{'sceneId':'reward_guard','level':'critical','existsPrimitives':[0x64d],'countPrimitives':[0x64c],'addressPrimitives':[0x65a],'rationale':'Guard\x20pass\x20distributes\x20reward\x20funds\x20to\x20the\x20Claimant\x20AND\x20creates\x20a\x20reward_record,\x20but\x20the\x20Guard\x20conditions\x20(identity,\x20time,\x20node\x20state)\x20do\x20NOT\x20naturally\x20invalidate\x20after\x20a\x20claim.\x20'+'Without\x20an\x20explicit\x20anti-reentrancy\x20primitive,\x20the\x20same\x20Claimant\x20can\x20repeatedly\x20pass\x20the\x20Guard\x20and\x20DRAIN\x20THE\x20ENTIRE\x20POOL.\x20'+'This\x20is\x20the\x20most\x20severe\x20reentrancy\x20scene\x20—\x20direct\x20fund\x20loss.','mitigation':'Add\x20ONE\x20of\x20the\x20following\x20to\x20the\x20root\x20(wrapped\x20in\x20logic_and\x20with\x20existing\x20conditions):\x0a'+'\x20\x20-\x20logic_not(query(\x27reward.record\x20has\x27,\x20object=reward,\x20parameters=[claimant_address]))\x20—\x20RECOMMENDED\x20(per-user\x20Bool\x20check)\x0a'+'\x20\x20-\x20logic_equal([query(\x27reward.record\x20count\x27,\x20object=reward),\x20identifier(N)])\x20where\x20table[N].value=0\x20—\x20total-claim\x20count\x20is\x200\x0a'+'\x20\x20-\x20logic_not(query(\x27reward.record.find_first\x27,\x20object=reward,\x20where={...}))\x20—\x20no\x20matching\x20record\x20found\x0a'+'Reference\x20template:\x20MyShop_Advanced\x20Guard\x207\x20condition\x204\x20(logic_not(query_reward_record_exists(where.storeFromId=order_id)))'},{'sceneId':'arbitration_voting_guard','level':'critical','existsPrimitives':[0x57c,0x57e],'countPrimitives':[0x57d],'addressPrimitives':[],'rationale':'Guard\x20pass\x20counts\x20the\x20vote\x20with\x20the\x20extracted\x20weight.\x20Without\x20anti-reentrancy,\x20the\x20same\x20voter\x20can\x20vote\x20MULTIPLE\x20times,\x20'+'multiplying\x20their\x20weight\x20and\x20skewing\x20the\x20arbitration\x20result\x20—\x20which\x20directly\x20determines\x20fund\x20ownership\x20via\x20compensation.\x20'+'The\x20voter\x27s\x20eligibility\x20(identity,\x20reputation)\x20does\x20NOT\x20naturally\x20invalidate\x20after\x20voting.\x20'+'Note:\x20arb.voted_count\x20(1403)\x20is\x20total\x20voter\x20count\x20(NOT\x20per-voter)\x20and\x20does\x20NOT\x20serve\x20as\x20an\x20anti-reentrancy\x20primitive\x20for\x20an\x20individual\x20voter.','mitigation':'Add\x20ONE\x20of\x20the\x20following\x20to\x20the\x20root\x20(wrapped\x20in\x20logic_and):\x0a'+'\x20\x20-\x20logic_not(query(\x27arb.voted\x20has\x27,\x20object=arb,\x20parameters=[voter_address]))\x20—\x20RECOMMENDED\x20(per-voter\x20Bool)\x0a'+'\x20\x20-\x20logic_not(query(\x27arb.voted.agree\x20has\x27,\x20object=arb,\x20parameters=[voter_address,\x20proposition_index]))\x20—\x20per-voter-per-proposition\x0a'+'\x20\x20-\x20logic_equal([query(\x27arb.voted.agree\x20count\x27,\x20object=arb,\x20parameters=[voter_address]),\x20identifier(N)])\x20where\x20table[N].value=0'},{'sceneId':'arbitration_usage_guard','level':'high','existsPrimitives':[0x61d],'countPrimitives':[0x61c],'addressPrimitives':[],'rationale':'Guard\x20pass\x20creates\x20a\x20new\x20Arb\x20case.\x20Without\x20anti-reentrancy,\x20a\x20customer\x20can\x20create\x20multiple\x20Arb\x20cases\x20for\x20the\x20SAME\x20Order\x20'+'(up\x20to\x20MAX_DISPUTE_COUNT=10\x20per\x20order.move\x20L96),\x20harassing\x20the\x20counterparty\x20and\x20inflating\x20arbitration\x20system\x20load.\x20'+'Not\x20direct\x20fund\x20loss,\x20but\x20severe\x20system\x20abuse.\x20order::dispute\x20(order.move\x20L93-99)\x20deduplicates\x20by\x20Arb\x20address\x20but\x20does\x20NOT\x20prevent\x20multiple\x20distinct\x20Arbs.','mitigation':'Add\x20ONE\x20of\x20the\x20following\x20to\x20the\x20root\x20(wrapped\x20in\x20logic_and):\x0a'+'\x20\x20-\x20logic_not(query(\x27order.dispute\x20has\x27,\x20object=order,\x20parameters=[existing_arb_address]))\x20—\x20per-Arb\x20check\x0a'+'\x20\x20-\x20logic_equal([query(\x27order.dispute\x20count\x27,\x20object=order),\x20identifier(N)])\x20where\x20table[N].value=0\x20—\x20STRICT:\x20block\x20any\x20prior\x20dispute\x0a'+'\x20\x20-\x20logic_as_u256_less_or_equal([query(\x27order.dispute\x20count\x27,\x20object=order),\x20identifier(N)])\x20where\x20table[N].value=K\x20—\x20LENIENT:\x20allow\x20up\x20to\x20K\x20disputes'},{'sceneId':'service_order_allocators_guard','level':'low','existsPrimitives':[0x620],'countPrimitives':[],'addressPrimitives':[0x621],'rationale':'Protocol-level\x20protection:\x20order::on_allocation\x20(order.move\x20L116-119)\x20asserts\x20ONE\x20Allocation\x20per\x20Order\x20(E_ALLOCATION_ALREADY_SPECIFIED).\x20'+'After\x20alloc()\x20executes,\x20typical\x20Rate-mode\x20allocators\x20(sum=10000)\x20and\x20Surplus-mode\x20allocators\x20drain\x20balance\x20to\x200,\x20making\x20reentrancy\x20unprofitable.\x20'+'EDGE\x20CASE:\x20Amount-mode-only\x20allocators\x20(no\x20Surplus,\x20total\x20<\x20full\x20balance)\x20leave\x20remainder;\x20a\x20second\x20alloc()\x20could\x20extract\x20more\x20—\x20mitigated\x20by\x20preferring\x20Rate/Surplus\x20modes.\x20'+'External\x20deposit\x20via\x20receive()\x20is\x20possible\x20but\x20irrational\x20(attacker\x20funds\x20the\x20Allocation\x20they\x20attack).','mitigation':'Default:\x20no\x20action\x20needed\x20(protocol-level\x20guard).\x20IF\x20using\x20Amount-mode-only\x20allocators\x20without\x20Surplus:\x20'+'consider\x20adding\x20logic_not(query(\x27order.allocation\x20some\x27,\x20object=order))\x20OR\x20switch\x20to\x20Rate/Surplus\x20mode\x20to\x20drain\x20balance\x20completely.'},{'sceneId':'service_buy_guard','level':'low','existsPrimitives':[],'countPrimitives':[],'addressPrimitives':[],'rationale':'Each\x20purchase\x20creates\x20a\x20fresh\x20Order;\x20no\x20existing\x20Order\x20state\x20is\x20modified.\x20Default:\x20no\x20reentrancy\x20risk.\x20'+'IF\x20business\x20intent\x20is\x20\x27limit\x20one\x20purchase\x20per\x20user\x27\x20(limited-edition\x20goods,\x20whitelist\x20single-buy),\x20an\x20anti-reentrancy\x20check\x20is\x20REQUIRED\x20'+'but\x20no\x20direct\x20GUARDQUERY\x20primitive\x20exists\x20for\x20per-user\x20purchase\x20history.','mitigation':'IF\x20limit-purchase\x20intent:\x20record\x20purchases\x20in\x20a\x20Repository\x20and\x20add\x20logic_not(query(\x27repository.data\x20has\x27,\x20...))\x20to\x20root;\x20'+'OR\x20revoke\x20EntityRegistrar\x20membership\x20after\x20first\x20buy;\x20OR\x20use\x20an\x20off-chain\x20allowlist\x20with\x20on-chain\x20Merkle\x20proof.'},{'sceneId':'repository_write_guard','level':'low','existsPrimitives':[0x48e],'countPrimitives':[],'addressPrimitives':[],'rationale':'Default\x20writes\x20are\x20idempotent\x20(same\x20ID\x20overwrites,\x20different\x20ID\x20appends);\x20no\x20fund\x20flow.\x20'+'IF\x20business\x20intent\x20is\x20\x27one\x20write\x20per\x20ID\x27\x20(voting,\x20immutable\x20credential,\x20single-attestation),\x20an\x20anti-reentrancy\x20check\x20is\x20needed.','mitigation':'IF\x20one-write-per-ID\x20intent:\x20add\x20logic_not(query(\x27repository.data\x20has\x27,\x20object=repository,\x20parameters=[policy_name,\x20user_or_object_id]))\x20to\x20root.'},{'sceneId':'gen_passport_guard','level':'low','existsPrimitives':[],'countPrimitives':[],'addressPrimitives':[],'rationale':'Each\x20gen_passport\x20call\x20generates\x20an\x20independent\x20Passport\x20(one\x20Passport\x20per\x20operation).\x20'+'Multiple\x20Passports\x20for\x20the\x20same\x20user\x20are\x20usually\x20valid\x20(each\x20serves\x20a\x20different\x20subsequent\x20operation).\x20'+'IF\x20business\x20intent\x20is\x20\x27one\x20active\x20Passport\x20per\x20user\x27,\x20an\x20anti-reentrancy\x20check\x20is\x20needed\x20but\x20no\x20direct\x20GUARDQUERY\x20primitive\x20exists.','mitigation':'IF\x20one-passport-per-user\x20intent:\x20use\x20off-chain\x20tracking\x20or\x20a\x20Repository\x20to\x20record\x20issued\x20Passport\x20IDs.'}],QUERY_TYPE_ALIASES=new Map([['query_reward_record_exists',0x64d],['query_reward_record_count',0x64c],['query_reward_record_find',0x65a],['query_progress_history_find',0x4fa],['query_progress_history_session_find',0x4fb],['query_progress_history_session_forward_find',0x4fc],['query_progress_history_session_count',0x4f9],['query_progress_history_session_forward_count',0x4ee]]);function detectReentrancyProtection(a,b,c){const d=new Set([...c['existsPrimitives'],...c['countPrimitives'],...c['addressPrimitives']]);if(d['size']===0x0)return{'state':'absent','evidence':'No\x20anti-reentrancy\x20primitive\x20available\x20in\x20GUARDQUERY\x20for\x20this\x20scene'};const e=new Map(),f=new Map();for(const p of d){const q=GUARDQUERY['find'](r=>r['id']===p);q&&(e['set'](p,q['name']),f['set'](q['name'],p));}const g=Array['from'](f['keys']());function h(r){if(!r||typeof r!=='object')return-0x1;if(typeof r['query']==='number'&&d['has'](r['query']))return r['query'];if(typeof r['query']==='string'&&f['has'](r['query']))return f['get'](r['query']);if(typeof r['type']==='string'&&QUERY_TYPE_ALIASES['has'](r['type'])){const s=QUERY_TYPE_ALIASES['get'](r['type']);if(d['has'](s))return s;}if(typeof r['type']==='string'&&f['has'](r['type']))return f['get'](r['type']);return-0x1;}function i(r){if(!r||typeof r!=='object')return![];if(typeof r['type']==='string'&&['number','u8','u16','u32','u64','u128','u256']['includes'](r['type']))return r['value']===0x0||r['value']==='0'||r['value']===0x0n;if(r['type']==='identifier'&&typeof r['identifier']==='number'){const s=b['find'](t=>t['identifier']===r['identifier']);if(s&&!s['b_submission'])return s['value']===0x0||s['value']==='0'||s['value']===0x0n;}return![];}function j(r,s){if(!r||typeof r!=='object')return[];const t=[];if(Array['isArray'](r['nodes']))for(const u of r['nodes']){if(u!==s)t['push'](u);}if(r['left']&&r['left']!==s)t['push'](r['left']);if(r['right']&&r['right']!==s)t['push'](r['right']);return t['filter'](v=>v&&typeof v==='object');}let k=![],l=![],m='',n='';function o(r,s){if(!r||typeof r!=='object')return;const t=h(r);if(t>=0x0){k=!![];const v=e['get'](t)??'query_'+t;n=v;const w=s?.['type']??null;let x=![];const y=c['existsPrimitives']['includes'](t),z=c['addressPrimitives']['includes'](t),A=c['countPrimitives']['includes'](t);(y||z)&&w==='logic_not'&&(x=!![]);if(A&&w==='logic_equal'){const B=j(s,r);B['some'](C=>i(C))&&(x=!![]);}if(x)l=!![];else{if(!m){const C=A?'logic_equal\x20with\x20a\x20zero\x20operand':'logic_not';m='Primitive\x20\x22'+v+'\x22\x20found\x20but\x20its\x20immediate\x20parent\x20is\x20'+(w??'root')+'\x20(expected\x20'+C+').\x20The\x20primitive\x20is\x20present\x20but\x20does\x20NOT\x20actually\x20prevent\x20reentrancy\x20—\x20this\x20is\x20a\x20false\x20sense\x20of\x20security.';}}}const u=[];if(Array['isArray'](r['nodes']))u['push'](...r['nodes']);if(r['left'])u['push'](r['left']);if(r['right'])u['push'](r['right']);if(r['node'])u['push'](r['node']);if(r['vec'])u['push'](r['vec']);if(r['target'])u['push'](r['target']);if(r['object']&&typeof r['object']==='object')u['push'](r['object']);if(Array['isArray'](r['parameters']))u['push'](...r['parameters']);for(const D of u){D&&typeof D==='object'&&o(D,r);}}o(a,null);if(l)return{'state':'protected','evidence':'Anti-reentrancy\x20primitive\x20\x22'+n+'\x22\x20is\x20properly\x20wrapped','foundPrimitiveName':n};if(k)return{'state':'pseudo','evidence':m,'foundPrimitiveName':n};return{'state':'absent','evidence':'No\x20anti-reentrancy\x20primitive\x20found\x20in\x20root.\x20Expected\x20one\x20of:\x20'+g['join'](',\x20')};}const RISK_RULES=[{'id':'R-C1-01','data_source_class':'type1_onchain_constant','trigger':'Guard\x20table\x20contains\x20Address\x20constants\x20with\x20b_submission=false;\x20values\x20may\x20change\x20after\x20Guard\x20rebuild','check':a=>{const b=a['table']['filter'](c=>!c['b_submission']&&c['value_type']==='Address'&&c['value']);if(b['length']===0x0)return null;return{'id':'R-C1-01','data_source_class':'type1_onchain_constant','level':'low','category':'data_source_trust','title':'Constant\x20object\x20addresses\x20may\x20be\x20inconsistent\x20after\x20Guard\x20rebuild','description':'Guard\x20table\x20contains\x20'+b['length']+'\x20Address\x20constants\x20(b_submission=false).'+'Guard\x20is\x20immutable,\x20but\x20if\x20a\x20future\x20Guard\x20rebuild\x20is\x20needed\x20(e.g.\x20to\x20fix\x20logic),\x20the\x20new\x20Guard\x27s\x20table\x20constant\x20addresses\x20may\x20differ\x20from\x20the\x20old\x20version.'+'Objects\x20referencing\x20the\x20old\x20Guard\x20(Machine/Service,\x20etc.)\x20will\x20not\x20auto-update,\x20leading\x20to\x20constant\x20address\x20inconsistency.','affected_stakeholders':['provider'],'scenario':'Guard\x20iteration:\x20after\x20rebuild,\x20constant\x20addresses\x20change\x20but\x20references\x20still\x20point\x20to\x20the\x20old\x20Guard','mitigation':'1)\x20After\x20Guard\x20rebuild,\x20update\x20all\x20references\x20(Machine\x20forward\x20guard,\x20Service\x20buy_guard,\x20etc.);'+'2)\x20Use\x20guard2file\x20to\x20export\x20a\x20backup\x20and\x20record\x20constant-address-to-semantics\x20mappings;'+'3)\x20Document\x20constant-address\x20changes\x20in\x20the\x20migration\x20notes','evidence':'Constant\x20Address\x20entries:\x20'+b['map'](c=>'#'+c['identifier']+'='+c['value'])['join'](',\x20')};}},{'id':'R-C1-02','data_source_class':'type1_onchain_constant','trigger':'Guard\x20table\x20contains\x20EntityRegistrar(0xaab)\x20or\x20EntityLinker(0xaaa)\x20system\x20address\x20constants','check':a=>{const b=a['table']['filter'](d=>!d['b_submission']&&d['value_type']==='Address'&&typeof d['value']==='string'&&(d['value']['toLowerCase']()==='0xaab'||d['value']['toLowerCase']()==='0xaaa'));if(b['length']===0x0)return null;const c=b['find'](d=>d['value']==='0xaab'&&d['name']&&!d['name']['toLowerCase']()['includes']('registrar')||d['value']==='0xaaa'&&d['name']&&!d['name']['toLowerCase']()['includes']('linker'));return{'id':'R-C1-02','data_source_class':'type1_onchain_constant','level':c?'medium':'low','category':'data_source_trust','title':c?'EntityRegistrar/EntityLinker\x20system\x20address\x20name\x20annotation\x20suspected\x20to\x20be\x20wrong':'Guard\x20uses\x20EntityRegistrar/EntityLinker\x20system\x20address\x20constants','description':'EntityRegistrar\x20(0xaab)\x20and\x20EntityLinker\x20(0xaaa)\x20are\x20fixed\x20WoWok\x20protocol\x20system\x20addresses.'+(c?'Detected\x20name\x20annotation\x20does\x20not\x20match\x20the\x20address\x20(e.g.\x200xaab\x20not\x20annotated\x20as\x20registrar),\x20which\x20may\x20cause\x20semantic\x20misunderstanding.':'Address\x20is\x20correct,\x20but\x20ensure\x20the\x20name\x20annotation\x20is\x20clear\x20to\x20avoid\x20later\x20maintenance\x20confusion.'),'affected_stakeholders':['provider'],'scenario':'System\x20address\x20misuse:\x20incorrect\x200xaab/0xaaa\x20name\x20annotation\x20causes\x20query\x20target\x20confusion','mitigation':'1)\x20Confirm\x200xaab\x20corresponds\x20to\x20EntityRegistrar\x20(entity\x20registrar);'+'2)\x20Confirm\x200xaaa\x20corresponds\x20to\x20EntityLinker\x20(entity\x20linker);'+'3)\x20The\x20table\x20entry\x20name\x20should\x20clearly\x20indicate\x20the\x20system\x20address\x20purpose','evidence':'System\x20address\x20entries:\x20'+b['map'](d=>'#'+d['identifier']+'='+d['value']+'('+d['name']+')')['join'](',\x20')};}},{'id':'R-C1-03','data_source_class':'type1_onchain_constant','trigger':'Guard\x20queries\x20Repository\x20data\x20without\x20verifying\x20writer\x20permissions','check':a=>{if(!queriesRepository(a))return null;if(hasSignerCheck(a))return null;return{'id':'R-C1-03','data_source_class':'type1_onchain_constant','level':'high','category':'data_source_trust','title':'Repository\x20data\x20source\x20does\x20not\x20verify\x20writer\x20permissions','description':'Guard\x20queries\x20Repository\x20data\x20but\x20does\x20not\x20verify\x20who\x20has\x20permission\x20to\x20write\x20to\x20that\x20Repository.'+'A\x20malicious\x20writer\x20can\x20manipulate\x20Repository\x20data\x20to\x20deceive\x20the\x20Guard.\x20As\x20a\x20Type1\x20constant\x20object,\x20'+'the\x20Repository\x27s\x20address\x20is\x20immutable,\x20but\x20its\x20internal\x20data\x20can\x20be\x20modified\x20by\x20authorized\x20writers.','affected_stakeholders':['customer','provider'],'scenario':'Data\x20source\x20manipulation:\x20attacker\x20writes\x20false\x20data\x20so\x20Guard\x20passes','mitigation':'1)\x20Restrict\x20writer\x20permissions\x20in\x20the\x20Repository\x20write_guard;'+'2)\x20Add\x20context(Signer)\x20in\x20the\x20current\x20Guard\x20to\x20verify\x20writer\x20identity;'+'3)\x20Use\x20multi-point\x20data\x20source\x20cross-validation'};}},{'id':'R-C2-01','data_source_class':'type2_witness_derived','trigger':'Guard\x20uses\x20multi-hop\x20witness\x20(106/107/108:\x20Arb→Progress/Machine/Service)\x20to\x20derive\x20target\x20object','check':a=>{const b=extractWitnessCodes(a['root']),c=b['filter'](e=>[0x6a,0x6b,0x6c]['includes'](e));if(c['length']===0x0)return null;const d={0x6a:'Arb→Progress\x20(two\x20hops:\x20arb.order\x20→\x20order.progress)',0x6b:'Arb→Machine\x20(two\x20hops:\x20arb.order\x20→\x20order.machine)',0x6c:'Arb→Service\x20(two\x20hops:\x20arb.order\x20→\x20order.service)'};return{'id':'R-C2-01','data_source_class':'type2_witness_derived','level':'medium','category':'data_source_trust','title':'Multi-hop\x20witness\x20chain\x20derivation\x20may\x20break','description':'Guard\x20uses\x20multi-hop\x20witness\x20['+c['join'](',\x20')+']\x20to\x20derive\x20target\x20object.'+'Multi-hop\x20witness\x20(e.g.\x20Arb→Progress\x20requires\x20reading\x20arb.order\x20then\x20order.progress)\x20requires\x20intermediate\x20objects\x20to\x20exist\x20and\x20fields\x20to\x20be\x20set.'+'If\x20an\x20intermediate\x20object\x20does\x20not\x20exist\x20(e.g.\x20Arb\x27s\x20order\x20field\x20is\x20empty)\x20or\x20the\x20relationship\x20chain\x20breaks,\x20witness\x20derivation\x20fails.'+'In\x20the\x20WoWok\x20protocol\x20this\x20usually\x20returns\x20empty\x20or\x200,\x20potentially\x20causing\x20unexpected\x20Guard\x20behavior.\x0a'+c['map'](e=>'\x20\x20-\x20'+e+':\x20'+d[e])['join']('\x0a'),'affected_stakeholders':['customer','provider','arbitrator'],'scenario':'Witness\x20break:\x20intermediate\x20object\x20missing\x20causes\x20derivation\x20failure\x20and\x20unexpected\x20Guard\x20behavior','mitigation':'1)\x20Confirm\x20the\x20Arb\x20object\x27s\x20order\x20field\x20is\x20properly\x20set\x20(Arb\x20is\x20bound\x20to\x20Order\x20at\x20creation);'+'2)\x20Add\x20null\x20checks\x20for\x20derived\x20results\x20in\x20Guard\x20logic;'+'3)\x20Prefer\x20single-hop\x20witness\x20(100-105)\x20to\x20reduce\x20derivation\x20chain\x20length;'+'4)\x20Test\x20the\x20edge\x20case\x20where\x20Arb\x20is\x20not\x20associated\x20with\x20an\x20Order','evidence':'Multi-hop\x20witness\x20codes:\x20'+c['join'](',\x20')};}},{'id':'R-C2-02','data_source_class':'type2_witness_derived','trigger':'Guard\x20uses\x20witness\x20but\x20source\x20object\x27s\x20object_type\x20may\x20not\x20match\x20the\x20witness\x20source\x20type,\x20or\x20multi-hop\x20chain\x20has\x20missing\x20intermediate\x20objects','check':a=>{const b=extractWitnessIdentifierPairs(a['root']),c=b['filter'](i=>i['code']>=0x64&&i['code']<=0x6c);if(c['length']===0x0)return null;const d=[],e=[];for(const {code:i,identifier:j}of c){const k=WITNESS_CHAIN[i];if(!k)continue;const l=k[0x0],m=a['table']['find'](o=>o['identifier']===j);if(!m)continue;const n=i+'\x20('+k['join']('→')+')';m['object_type']?m['object_type']!==l&&d['push']('witness\x20'+n+'\x20references\x20#'+j+'\x20'+('but\x20object_type='+m['object_type']+'\x20(expected\x20'+l+')')):e['push']('witness\x20'+n+'\x20references\x20#'+j+'\x20'+('but\x20object_type\x20is\x20not\x20set\x20(expected\x20'+l+')'));if(k['length']===0x3){const o=k[0x1],p=a['table']['some'](q=>q['object_type']===o);!p&&e['push']('witness\x20'+n+'\x20multi-hop\x20chain\x20expects\x20intermediate\x20'+(o+'\x20in\x20table,\x20but\x20no\x20entry\x20with\x20object_type='+o+'\x20found'));}}const f=d['length']+e['length'];if(f===0x0)return null;const g=d['length']>0x0?'medium':'low',h=[...d,...e];return{'id':'R-C2-02','data_source_class':'type2_witness_derived','level':g,'category':'data_source_trust','title':d['length']>0x0?'witness\x20source\x20object_type\x20explicitly\x20contradicts\x20the\x20witness\x20derivation\x20chain':'witness\x20source\x20object_type\x20annotation\x20missing\x20or\x20multi-hop\x20chain\x20incomplete','description':'Guard\x20uses\x20witness\x20derivation,\x20but\x20the\x20source\x20object\x27s\x20object_type\x20in\x20table\x20is\x20either\x20'+'inconsistent\x20with\x20the\x20witness\x20expected\x20source\x20type,\x20or\x20the\x20annotation\x20is\x20missing\x20'+'(preventing\x20validation),\x20or\x20the\x20multi-hop\x20chain\x20lacks\x20an\x20intermediate\x20object.\x0a'+h['map'](q=>'\x20\x20-\x20'+q)['join']('\x0a')+'\x0aNote:\x20object_type\x20is\x20an\x20auxiliary\x20annotation\x20field\x20on\x20table\x20entries;\x20it\x20is\x20not\x20strictly\x20'+'validated\x20at\x20on-chain\x20creation.\x20However,\x20wrong\x20or\x20missing\x20annotations\x20cause\x20semantic\x20'+'misunderstanding\x20and\x20maintenance\x20difficulty,\x20and\x20may\x20indicate\x20a\x20deeper\x20structural\x20mismatch.','affected_stakeholders':['provider'],'scenario':d['length']>0x0?'Type\x20annotation\x20mismatch:\x20witness\x20source\x20type\x20annotation\x20is\x20wrong,\x20causing\x20semantic\x20confusion':'Type\x20annotation\x20missing:\x20witness\x20source\x20type\x20cannot\x20be\x20validated,\x20raising\x20maintenance\x20risk','mitigation':'1)\x20Set\x20or\x20fix\x20the\x20table\x20entry\x27s\x20object_type\x20field\x20to\x20match\x20the\x20witness\x20source\x20type;\x0a'+'2)\x20witness\x20100-102\x20source\x20type\x20is\x20Order;\x20103\x20is\x20Progress;\x20104-108\x20is\x20Arb;\x0a'+'3)\x20For\x20multi-hop\x20witnesses\x20(106-108),\x20ensure\x20the\x20intermediate\x20Order\x20object\x20is\x20also\x20in\x20the\x20table;\x0a'+'4)\x20Use\x20wowok_buildin_info(info=\x27guard\x20instructions\x27)\x20to\x20query\x20the\x20full\x20witness\x20definition','evidence':h['join'](';\x20')};}},{'id':'R-C2-03','data_source_class':'type2_witness_derived','trigger':'Guard\x20queries\x20Progress\x20status\x20without\x20verifying\x20Machine\x20publish\x20state','check':a=>{if(!queriesProgress(a))return null;if(!hasWitness(a['root']))return null;if(a['scene']?.['host_object']!=='Machine')return null;return{'id':'R-C2-03','data_source_class':'type2_witness_derived','level':'medium','category':'data_source_trust','title':'Progress\x20data\x20depends\x20on\x20Machine\x20immutability','description':'Guard\x20queries\x20Progress\x20status\x20via\x20witness,\x20and\x20the\x20Guard\x20is\x20bound\x20to\x20a\x20Machine.'+'If\x20the\x20Machine\x20is\x20not\x20published\x20(bPublished=false),\x20the\x20Provider\x20can\x20modify\x20the\x20Machine\x20node\x20structure,\x20'+'causing\x20node\x20names\x20validated\x20by\x20the\x20Guard\x20to\x20become\x20invalid\x20or\x20be\x20renamed.\x20Progress\x27s\x20current\x20node\x20name,\x20node\x20time,\x20etc.\x20'+'all\x20depend\x20on\x20the\x20Machine\x27s\x20node\x20definitions.','affected_stakeholders':['customer'],'scenario':'Provider\x20modifies\x20Machine\x20node\x20names\x20to\x20invalidate\x20Guard\x20verification','mitigation':'1)\x20Ensure\x20the\x20Machine\x20is\x20published\x20(bPublished=true)\x20before\x20binding\x20the\x20Guard;'+'2)\x20Query\x20the\x20Machine.bPublished\x20field\x20in\x20the\x20Guard\x20to\x20verify;'+'3)\x20Use\x20node\x20IDs\x20instead\x20of\x20node\x20names\x20for\x20comparison'};}},{'id':'R-C2-04','data_source_class':'type2_witness_derived','trigger':'Guard\x20uses\x20witness\x20query\x20and\x20the\x20query\x20parameter\x20requires\x20type\x20conversion\x20(e.g.\x20Address\x20→\x20U64\x20timestamp\x20key)','check':a=>{if(!hasWitness(a['root']))return null;const b=rootStr(a),c=b['includes']('convert_number_address')||b['includes']('convert_address_number')||b['includes']('convert_u256')||b['includes']('convert_string'),d=b['includes']('repository')&&b['includes']('\x22query\x22'),e=b['includes']('progress_history')&&b['includes']('\x22query\x22');if(!d&&!e)return null;return{'id':'R-C2-04','data_source_class':'type2_witness_derived','level':'medium','category':'data_source_trust','title':'witness\x20query\x20parameter\x20requires\x20type\x20translation\x20(missing\x20will\x20cause\x20type\x20mismatch\x20or\x20wrong\x20comparison)','description':'Guard\x20queries\x20object\x20fields\x20via\x20witness,\x20but\x20the\x20query\x20parameter\x20type\x20may\x20not\x20match\x20the\x20type\x20declared\x20in\x20table.\x0a'+'Typical\x20scenarios:\x0a'+'\x20\x20-\x20Repository.data\x20query:\x20the\x20key\x20may\x20be\x20of\x20Address\x20type\x20(vector<u8>\x20address\x20representation\x20in\x20Move),\x20'+'but\x20the\x20actual\x20semantics\x20is\x20a\x20U64\x20timestamp,\x20requiring\x20convert_number_address\x20translation\x0a'+'\x20\x20-\x20Progress.history\x20query:\x20Forward\x20ID\x20may\x20need\x20to\x20be\x20converted\x20from\x20String\x20to\x20Address\x0a'+'\x20\x20-\x20Order\x20field\x20query:\x20some\x20ID\x20fields\x20may\x20be\x20stored\x20as\x20Address\x20but\x20need\x20U256\x20for\x20comparison\x0a'+(c?'\x0aThe\x20current\x20Guard\x20already\x20uses\x20type\x20conversion\x20nodes,\x20but\x20ensure\x20the\x20conversion\x20direction\x20is\x20correct.':'\x0aWarning:\x20no\x20type\x20conversion\x20node\x20detected\x20in\x20the\x20current\x20Guard;\x20parameter\x20type\x20mismatch\x20risk\x20may\x20exist.'),'affected_stakeholders':['provider','customer'],'scenario':'Query\x20parameter\x20type\x20does\x20not\x20match\x20the\x20parameters\x20type\x20defined\x20by\x20GUARDQUERY,\x20causing\x20creation\x20failure\x20or\x20runtime\x20comparison\x20error','mitigation':'1)\x20Query\x20GUARDQUERY\x20to\x20confirm\x20the\x20parameters\x20type\x20and\x20return\x20type\x20of\x20each\x20query\x20instruction;\x0a'+'2)\x20If\x20table\x20declares\x20Address\x20but\x20the\x20query\x20needs\x20U64,\x20use\x20convert_number_address\x20to\x20translate;\x0a'+'3)\x20Use\x20wowok_buildin_info\x20info=\x27guard\x20instructions\x27\x20to\x20verify\x20parameter\x20types;\x0a'+'4)\x20Verify\x20type\x20compatibility\x20via\x20schema_query\x20before\x20creation','evidence':c?'Type\x20conversion\x20node\x20in\x20use':'No\x20type\x20conversion\x20node\x20detected'};}},{'id':'R-C3-01','data_source_class':'type3_submitted_object','trigger':'Guard\x20depends\x20on\x20submitted\x20data\x20but\x20does\x20not\x20verify\x20signer\x20identity\x20(no\x20Signer\x20check=high;\x20with\x20Signer\x20check=info\x20downgrade)','check':a=>{const b=a['table']['some'](c=>c['b_submission']);if(!b)return null;if(a['scene']?.['binding_field']==='voting_guard')return null;if(a['scene']?.['id']==='service_order_allocators_guard'&&a['sharing_recipients']&&a['sharing_recipients']['length']>0x0&&!a['sharing_recipients']['includes']('Signer'))return null;if(!hasSignerCheck(a)){if(a['scene']?.['id']==='machine_forward_guard')return{'id':'R-C3-01','data_source_class':'type3_submitted_object','level':'medium','category':'submission_forgery','title':'Submitted\x20data\x20not\x20bound\x20to\x20signer\x20identity\x20(Forward\x20scenario\x20implicitly\x20verified\x20by\x20permissionIndex)','description':'Guard\x20accepts\x20runtime-submitted\x20data\x20(b_submission=true),\x20and\x20root\x20does\x20not\x20explicitly\x20verify\x20Signer.'+'This\x20Guard\x20is\x20used\x20for\x20Machine\x20Forward;\x20Forward\x27s\x20permissionIndex/namedOperator\x20already\x20implicitly\x20verifies\x20operator\x20identity,\x20'+'so\x20the\x20Signer\x20binding\x20risk\x20is\x20reduced.\x20But\x20permissionIndex\x20only\x20verifies\x20\x27operator\x20has\x20permission\x27,\x20'+'not\x20\x27submitted\x20data\x20belongs\x20to\x20operator\x27\x20—\x20for\x20example,\x20a\x20merchant\x20holding\x20permissionIndex\x20can\x20still\x20submit\x20someone\x20else\x27s\x20credentials.','affected_stakeholders':['customer','provider'],'scenario':'In-permission\x20forgery:\x20an\x20authorized\x20operator\x20submits\x20someone\x20else\x27s\x20data\x20(e.g.\x20someone\x20else\x27s\x20Merkle\x20Root)','mitigation':'1)\x20If\x20the\x20submitted\x20data\x20should\x20belong\x20to\x20the\x20operator\x20(e.g.\x20the\x20operator\x27s\x20address),\x20it\x20is\x20still\x20recommended\x20to\x20add\x20context(Signer)\x20binding;'+'2)\x20If\x20the\x20submitted\x20data\x20is\x20a\x20public\x20credential\x20(e.g.\x20Merkle\x20Root\x20string),\x20the\x20current\x20risk\x20is\x20acceptable;'+'3)\x20Use\x20retained_submission\x20to\x20retain\x20submitted\x20data\x20for\x20later\x20audit'};return{'id':'R-C3-01','data_source_class':'type3_submitted_object','level':'high','category':'submission_forgery','title':'Submitted\x20data\x20not\x20bound\x20to\x20signer\x20identity','description':'Guard\x20accepts\x20runtime-submitted\x20data\x20(b_submission=true),\x20but\x20does\x20not\x20verify\x20whether\x20the\x20submitter\x20is\x20the\x20current\x20transaction\x20signer.'+'An\x20attacker\x20can\x20submit\x20someone\x20else\x27s\x20data\x20(e.g.\x20someone\x20else\x27s\x20address,\x20someone\x20else\x27s\x20credentials)\x20to\x20pass\x20the\x20Guard.'+'Type3\x20submitted\x20objects\x20are\x20isomorphic\x20with\x20Type1\x20at\x20the\x20native\x20layer\x20(TYPE_QUERY+TYPE_CONSTANT),\x20'+'the\x20only\x20difference\x20being\x20that\x20the\x20value\x20is\x20injected\x20by\x20submission,\x20so\x20identity\x20must\x20be\x20bound\x20via\x20logical\x20constraints.','affected_stakeholders':['customer','provider'],'scenario':'Identity\x20forgery:\x20attacker\x20submits\x20someone\x20else\x27s\x20address\x20to\x20impersonate\x20an\x20authorized\x20user','mitigation':'1)\x20Add\x20context(Signer)\x20binding\x20with\x20the\x20submitted\x20data\x20for\x20verification;'+'2)\x20Use\x20vec_contains_address\x20to\x20verify\x20the\x20signer\x20is\x20in\x20the\x20whitelist;'+'3)\x20Use\x20Passport\x20credentials\x20instead\x20of\x20bare\x20address\x20submission'};}return{'id':'R-C3-01','data_source_class':'type3_submitted_object','level':'low','category':'submission_forgery','title':'Submitted\x20data\x20is\x20indirectly\x20bound\x20via\x20context(Signer)\x20(confirm\x20the\x20binding\x20direction\x20is\x20correct)','description':'Guard\x20accepts\x20runtime-submitted\x20data,\x20and\x20the\x20root\x20subtree\x20contains\x20a\x20context(Signer)\x20check,\x20'+'forming\x20an\x20indirect\x20binding\x20between\x20submitted\x20data\x20and\x20signer,\x20reducing\x20forgery\x20risk.'+'But\x20manual\x20confirmation\x20is\x20needed:\x20the\x20constant\x20compared\x20with\x20context(Signer)\x20is\x20the\x20correct\x20role\x20(e.g.\x20Provider\x20address\x20rather\x20than\x20Customer\x20address),\x20'+'and\x20the\x20submitted\x20data\x20should\x20indeed\x20be\x20provided\x20by\x20that\x20signer.\x20See\x20R-C4-01\x20Signer\x20direction\x20risk.','affected_stakeholders':['customer','provider'],'scenario':'Indirect\x20binding\x20to\x20confirm:\x20whether\x20the\x20Signer\x20check\x20direction\x20matches\x20the\x20submitted\x20data\x20ownership','mitigation':'1)\x20Confirm\x20context(Signer)\x20is\x20compared\x20with\x20the\x20correct\x20table\x20constant\x20(Provider\x20address\x20rather\x20than\x20Customer\x20address);'+'2)\x20Confirm\x20the\x20source\x20role\x20of\x20the\x20submitted\x20data\x20matches\x20the\x20Signer\x20check;'+'3)\x20For\x20stricter\x20binding,\x20use\x20query\x20to\x20verify\x20the\x20submitter\x27s\x20on-chain\x20identity'};}},{'id':'R-C3-02','data_source_class':'type3_submitted_object','trigger':'voting_guard\x20weight\x20comes\x20from\x20submitted\x20data\x20without\x20verifying\x20source','check':a=>{if(a['scene']?.['binding_field']!=='voting_guard')return null;const b=a['table']['filter'](c=>c['b_submission']&&['U8','U16','U32','U64','U128','U256']['includes'](c['value_type']));if(b['length']===0x0)return null;return{'id':'R-C3-02','data_source_class':'type3_submitted_object','level':'critical','category':'submission_forgery','title':'Voting\x20weight\x20comes\x20from\x20user\x20submission\x20and\x20may\x20be\x20forged','description':'voting_guard\x20weight\x20data\x20comes\x20from\x20table\x20entries\x20with\x20b_submission=true\x20(Type3\x20submitted\x20values).'+'If\x20the\x20weight\x20is\x20not\x20verified\x20through\x20EntityRegistrar\x20or\x20other\x20trusted\x20sources,\x20'+'a\x20voter\x20can\x20submit\x20arbitrarily\x20high\x20weights\x20to\x20manipulate\x20the\x20voting\x20result.'+'Type3\x20submitted\x20values\x20are\x20only\x20validated\x20by\x20type\x20byte\x20(value[0])\x20at\x20the\x20native\x20layer;\x20value\x20range\x20and\x20source\x20are\x20not\x20checked.','affected_stakeholders':['arbitrator'],'scenario':'Weight\x20forgery:\x20voters\x20submit\x20fake\x20high\x20scores\x20to\x20manipulate\x20the\x20arbitration\x20result','mitigation':'1)\x20Weights\x20should\x20be\x20queried\x20from\x20EntityRegistrar\x20rather\x20than\x20submitted\x20by\x20users;'+'2)\x20Use\x20query(entity.records)\x20to\x20obtain\x20on-chain\x20registered\x20reputation\x20scores;'+'3)\x20Verify\x20in\x20the\x20Guard\x20that\x20the\x20submitted\x20weight\x20matches\x20the\x20on-chain\x20record','evidence':'Submitted\x20numeric\x20entries:\x20'+b['map'](c=>'#'+c['identifier']+'('+c['value_type']+')')['join'](',\x20')};}},{'id':'R-C3-03','data_source_class':'type3_submitted_object','trigger':'Guard\x20contains\x20Address\x20entries\x20with\x20b_submission=true;\x20the\x20runtime\x20submitted\x20object\x20type\x20may\x20not\x20match\x20expectations','check':a=>{const b=a['table']['filter'](f=>f['b_submission']&&f['value_type']==='Address');if(b['length']===0x0)return null;const c=b['filter'](f=>!f['object_type']),d=rootStr(a)['includes']('\x22query\x22');if(!d)return null;return{'id':'R-C3-03','data_source_class':'type3_submitted_object','level':c['length']>0x0?'medium':'low','category':'submission_forgery','title':c['length']>0x0?'Submitted\x20object\x20missing\x20object_type\x20annotation;\x20runtime\x20type\x20validation\x20relies\x20on\x20native\x20inference':'Submitted\x20object\x20type\x20validation\x20relies\x20on\x20runtime\x20native\x20inference','description':'Guard\x20contains\x20'+b['length']+'\x20Address\x20entries\x20with\x20b_submission=true\x20(Type3\x20submitted\x20objects).'+'The\x20native\x20layer\x20(passport.rs#parse_table_items)\x20only\x20checks\x20the\x20value[0]\x20type\x20byte\x20for\x20submission;\x20'+'object_type\x20is\x20derived\x20at\x20runtime\x20by\x20wobject_type\x20and\x20does\x20not\x20strictly\x20validate\x20the\x20actual\x20submitted\x20object\x20type.\x0a'+(c['length']>0x0?'Warning:\x20'+c['length']+'\x20entries\x20are\x20missing\x20object_type\x20annotation,\x20semantics\x20are\x20unclear.':'object_type\x20is\x20annotated,\x20but\x20still\x20confirm\x20the\x20annotation\x20matches\x20what\x20the\x20query\x20expects.'),'affected_stakeholders':['customer','provider'],'scenario':'Type\x20mismatch:\x20submitting\x20a\x20wrong-typed\x20object\x20causes\x20query\x20to\x20return\x20unexpected\x20values','mitigation':'1)\x20Annotate\x20object_type\x20for\x20all\x20Address\x20entries\x20with\x20b_submission=true;'+'2)\x20object_type\x20should\x20match\x20the\x20object\x20type\x20expected\x20by\x20the\x20query\x20instruction;'+'3)\x20Indirectly\x20verify\x20the\x20object\x20type\x20via\x20query\x20results\x20in\x20Guard\x20logic\x20(e.g.\x20query\x20order.amount\x20to\x20verify\x20it\x20is\x20an\x20Order)','evidence':c['length']>0x0?'Missing\x20object_type:\x20'+c['map'](f=>'#'+f['identifier'])['join'](',\x20'):'Annotated:\x20'+b['map'](f=>'#'+f['identifier']+'='+f['object_type'])['join'](',\x20')};}},{'id':'R-C3-04','data_source_class':'type3_submitted_object','trigger':'Repository\x20write_guard\x20does\x20not\x20verify\x20id_from_submission\x20type','check':a=>{if(a['scene']?.['binding_field']!=='write_guard')return null;return{'id':'R-C3-04','data_source_class':'type3_submitted_object','level':'high','category':'binding_risk','title':'Repository\x20write_guard\x20must\x20verify\x20id_from_submission\x20type','description':'The\x20table\x20entry\x20referenced\x20by\x20Repository\x20write_guard\x27s\x20id_from_submission\x20must\x20be\x20of\x20Address\x20type\x20(Type3\x20submitted\x20object).'+'The\x20entry\x20referenced\x20by\x20data_from_submission\x20must\x20match\x20the\x20Repository\x20value_type.'+'Type\x20mismatch\x20will\x20cause\x20write\x20failure\x20or\x20data\x20corruption.\x20The\x20write_guard\x20submission\x20contains\x20both\x20id\x20and\x20data\x20parts;\x20'+'the\x20native\x20layer\x20distinguishes\x20them\x20by\x20op_code,\x20but\x20value\x20types\x20must\x20match\x20the\x20table\x20declaration.','affected_stakeholders':['provider'],'scenario':'Type\x20mismatch:\x20write\x20failure\x20or\x20data\x20corruption','mitigation':'1)\x20Confirm\x20the\x20entry\x20referenced\x20by\x20id_from_submission\x20has\x20value_type=Address;'+'2)\x20Confirm\x20the\x20entry\x20referenced\x20by\x20data_from_submission\x20has\x20value_type\x20matching\x20the\x20Repository;'+'3)\x20Cover\x20write\x20scenarios\x20in\x20gen_passport\x20tests'};}},{'id':'R-C3-05','data_source_class':'type3_submitted_object','trigger':'Guard\x20accepts\x20a\x20runtime-submitted\x20Order/Progress/Arb\x20object\x20(Type3)\x20but\x20does\x20NOT\x20verify\x20the\x20submitted\x20object\x20belongs\x20to\x20the\x20current\x20project\x20(Machine\x20or\x20Service).\x20'+'The\x20WoWok\x20runtime\x20does\x20NOT\x20enforce\x20any\x20binding\x20between\x20the\x20submitted\x20order_id\x20and\x20the\x20actual\x20Progress\x20being\x20forwarded\x20—\x20verify_guard\x20receives\x20only\x20the\x20caller-provided\x20submission\x20bytes,\x20never\x20the\x20Progress\x20object\x20under\x20advancement\x20(passport.move:27,251-253;\x20progress.move:458-483).\x20'+'A\x20caller\x20can\x20therefore\x20submit\x20an\x20unrelated\x20order_id\x20from\x20a\x20DIFFERENT\x20project\x20while\x20forwarding\x20a\x20different\x20Progress,\x20causing\x20witness=100\x20(Order->Progress)\x20to\x20evaluate\x20against\x20foreign\x20data.','check':a=>{const b=a['table']['filter'](v=>v['b_submission']&&v['value_type']==='Address');if(b['length']===0x0)return null;const c=extractWitnessCodes(a['root']),d=c['some'](v=>[0x64,0x65,0x66]['includes'](v)),f=c['some'](v=>[0x67]['includes'](v)),g=c['some'](v=>[0x68,0x69,0x6a,0x6b,0x6c]['includes'](v)),h=b['filter'](v=>v['object_type']==='Order'||d&&!v['object_type']),i=b['filter'](v=>v['object_type']==='Progress'||f&&!v['object_type']),j=b['filter'](v=>v['object_type']==='Arb'||g&&!v['object_type']),k=h['length']>0x0||i['length']>0x0||j['length']>0x0;if(!k)return null;const l=['machine_forward_guard','service_order_allocators_guard','arbitration_usage_guard','arbitration_voting_guard','reward_guard','progress_submission_guard'],m=a['scene']?.['id'],n=!m||l['includes'](m);if(!n)return null;const o=new Set([0x61b,0x618,0x4e2,0x57a,0x579]),p=extractQueryIds(a['root']),q=p['some'](v=>o['has'](v));if(q)return null;const r=new Set(['machine_forward_guard','service_order_allocators_guard']),s=m&&r['has'](m)?'critical':'high',t=[];for(const v of h){t['push']('#'+v['identifier']+(v['object_type']?'(Order)':'(inferred\x20Order\x20via\x20witness\x20100-102)'));}for(const w of i){t['push']('#'+w['identifier']+(w['object_type']?'(Progress)':'(inferred\x20Progress\x20via\x20witness\x20103)'));}for(const x of j){t['push']('#'+x['identifier']+(x['object_type']?'(Arb)':'(inferred\x20Arb\x20via\x20witness\x20104-108)'));}const u=m??'unknown\x20scene\x20(conservative\x20flag)';return{'id':'R-C3-05','data_source_class':'type3_submitted_object','level':s,'category':'submission_forgery','title':'Submitted\x20Order/Progress/Arb\x20is\x20NOT\x20verified\x20to\x20belong\x20to\x20the\x20current\x20project\x20(cross-project\x20bypass\x20—\x20CRITICAL\x20trust-boundary\x20gap)','description':'Guard\x20accepts\x20runtime-submitted\x20Order/Progress/Arb\x20object(s)\x20['+t['join'](',\x20')+']\x20but\x20the\x20root\x20does\x20NOT\x20verify\x20the\x20submitted\x20object\x20belongs\x20to\x20the\x20current\x20project\x20(no\x20query\x20of\x20order.service/order.machine/progress.machine/arb.service\x20compared\x20to\x20a\x20project\x20constant).\x0a\x0a'+'TRUST-BOUNDARY\x20GAP\x20(verified\x20via\x20Move\x20source):\x0a'+'\x20\x20-\x20The\x20Passport\x20submission\x20is\x20built\x20by\x20the\x20CALLER,\x20not\x20auto-injected\x20by\x20the\x20runtime\x20(passport.move:120,149,157)\x0a'+'\x20\x20-\x20verify_guard\x20receives\x20ONLY\x20the\x20caller-provided\x20submission\x20bytes\x20—\x20it\x20never\x20sees\x20the\x20Progress/Order\x20actually\x20being\x20forwarded\x20(passport.move:27,251-253)\x0a'+'\x20\x20-\x20next_with_passport\x20performs\x20NO\x20linkage\x20check\x20between\x20the\x20passport\x20submission\x20and\x20the\x20Progress\x20under\x20advancement\x20(progress.move:458-483)\x0a'+'\x20\x20-\x20Even\x20order_next_with_passport\x27s\x20E_ORDER_NOT_MATCH\x20only\x20checks\x20the\x20separate\x20`order:&Order`\x20parameter,\x20NOT\x20the\x20order_id\x20embedded\x20in\x20the\x20passport\x20submission\x20(progress.move:452)\x0a\x0a'+('EXPLOIT\x20(scene='+u+'):\x0a')+'\x20\x201.\x20Attacker\x20holds\x20Order\x20Y\x20from\x20project\x20B\x20(where\x20progress.current_time\x20is\x20old\x20enough\x20to\x20pass\x20the\x20time-lock)\x0a'+'\x20\x202.\x20Attacker\x20calls\x20forward\x20on\x20Order\x20X\x27s\x20Progress\x20(project\x20A,\x20freshly\x20entered\x20the\x20node)\x0a'+'\x20\x203.\x20Attacker\x20submits\x20Order\x20Y\x27s\x20ID\x20in\x20the\x20passport\x20(lying\x20about\x20which\x20order\x20is\x20being\x20forwarded)\x0a'+'\x20\x204.\x20Guard\x27s\x20witness=100\x20reads\x20Order\x20Y\x27s\x20Progress\x20->\x20time-lock\x20passes\x20(Order\x20Y\x20is\x20old)\x0a'+'\x20\x205.\x20forward\x20actually\x20executes\x20on\x20Order\x20X\x27s\x20Progress\x20->\x20TIME-LOCK\x20BYPASSED\x0a\x0a'+'This\x20is\x20distinct\x20from\x20R-C3-01\x20(Signer\x20binding\x20—\x20WHO\x20can\x20submit)\x20and\x20R-C3-03\x20(type\x20matching\x20—\x20WHAT\x20type\x20is\x20submitted).\x20'+'R-C3-05\x20addresses\x20WHETHER\x20the\x20submitted\x20object\x20belongs\x20to\x20the\x20current\x20project\x20—\x20a\x20third\x20orthogonal\x20axis\x20of\x20submission\x20trust.\x20'+'Even\x20with\x20R-C3-01\x20satisfied\x20(authorized\x20Signer)\x20and\x20R-C3-03\x20satisfied\x20(correct\x20type),\x20the\x20Signer\x20can\x20still\x20submit\x20an\x20unrelated\x20project\x27s\x20object.','affected_stakeholders':['customer','provider','arbitrator'],'scenario':'Cross-project\x20bypass:\x20authorized\x20signer\x20submits\x20an\x20unrelated\x20project\x27s\x20order/progress/arb\x20to\x20bypass\x20time-lock,\x20status,\x20or\x20allocation\x20conditions','mitigation':'Add\x20a\x20project-binding\x20check\x20to\x20the\x20root\x20(wrap\x20existing\x20root\x20in\x20logic_and):\x0a'+'\x20\x20-\x20For\x20submitted\x20Order:\x20add\x20logic_equal[query(1563:\x20order.service),\x20identifier[N](project_service_address)]\x20—\x20RECOMMENDED\x20(service\x20is\x20the\x20canonical\x20project\x20anchor)\x0a'+'\x20\x20-\x20For\x20submitted\x20Order:\x20add\x20logic_equal[query(1560:\x20order.machine),\x20identifier[N](project_machine_address)]\x20—\x20alternative\x20(machine\x20anchor)\x0a'+'\x20\x20-\x20For\x20submitted\x20Progress:\x20add\x20logic_equal[query(1250:\x20progress.machine),\x20identifier[N](project_machine_address)]\x0a'+'\x20\x20-\x20For\x20submitted\x20Arb:\x20add\x20logic_equal[query(1402:\x20arb.service),\x20identifier[N](project_service_address)]\x0a'+'\x20\x20-\x20Use\x20witness=102\x20(TypeOrderService)\x20on\x20the\x20submitted\x20Order\x20to\x20derive\x20the\x20Service,\x20then\x20compare\x20to\x20the\x20project\x20service\x20constant\x0a\x0a'+'Intentional\x20cross-project\x20exception:\x20if\x20the\x20Guard\x20is\x20DESIGNED\x20to\x20accept\x20cross-project\x20submissions\x20(rare),\x20document\x20this\x20explicitly\x20in\x20the\x20description\x20and\x20add\x20a\x20binding_hint\x20annotation\x20\x27cross_project_intentional:true\x27\x20to\x20suppress\x20this\x20rule.','evidence':'Unbound\x20submitted\x20project-relevant\x20entries:\x20'+t['join'](',\x20')+'.\x20'+('Scene:\x20'+u+'.\x20')+'Missing\x20project-binding\x20queries:\x20none\x20of\x20[1563(order.service),\x201560(order.machine),\x201250(progress.machine),\x201402(arb.service)]\x20present\x20in\x20root.'};}},{'id':'R-C3-06','data_source_class':'type3_submitted_object','trigger':'Guard\x20is\x20bound\x20to\x20Service\x20order_allocators\x20(service_order_allocators_guard\x20scene).\x20'+'In\x20this\x20scene\x20the\x20Guard\x20decides\x20IF\x20allocation\x20happens,\x20while\x20sharing.who\x20decides\x20WHERE\x20funds\x20go.\x20'+'If\x20sharing.who=Signer,\x20the\x20transaction\x20caller\x20receives\x20the\x20funds\x20—\x20so\x20a\x20Guard\x20that\x20does\x20NOT\x20bind\x20'+'context(Signer)\x20lets\x20ANYONE\x20who\x20passes\x20the\x20Guard\x20steal\x20100%\x20of\x20the\x20order\x20funds.\x20'+'This\x20is\x20a\x20Guard+sharing\x20coupling\x20risk:\x20neither\x20piece\x20alone\x20reveals\x20the\x20theft\x20—\x20only\x20their\x20combination.','check':a=>{if(a['scene']?.['id']!=='service_order_allocators_guard')return null;if(hasSignerCheck(a))return null;const b=a['sharing_recipients'],c=b!==undefined&&b['length']>0x0,d=c&&b['includes']('Signer');if(c&&!d)return null;const e=isUnboundSignerTheft({'recipient_is_signer':d,'caller_identity_constrained':![]}),f=e?'critical':'medium',g=c?'['+b['join'](',\x20')+']':'(not\x20provided\x20—\x20conservative\x20flag)',h=d?'sharing.who=Signer\x20confirmed\x20—\x20anyone\x20can\x20steal\x20100%\x20of\x20funds':'if\x20sharing.who=Signer,\x20anyone\x20can\x20steal\x20100%\x20of\x20funds';return{'id':'R-C3-06','data_source_class':'type3_submitted_object','level':f,'category':'binding_risk','title':'allocators\x20Guard\x20without\x20Signer\x20binding\x20—\x20'+h,'description':'Guard\x20is\x20bound\x20to\x20Service\x20order_allocators\x20but\x20does\x20NOT\x20verify\x20context(Signer).\x20'+'In\x20the\x20allocators\x20scene,\x20sharing.who\x20determines\x20the\x20fund\x20recipient:\x0a'+'\x20\x20-\x20sharing.who=Signer\x20→\x20funds\x20flow\x20to\x20the\x20CALLER\x20(transaction\x20signer)\x0a'+'\x20\x20-\x20sharing.who=Entity\x20→\x20funds\x20flow\x20to\x20a\x20FIXED\x20address\x20(Treasury/personal)\x0a'+'\x20\x20-\x20sharing.who=GuardIdentifier\x20→\x20funds\x20flow\x20to\x20the\x20submitted\x20constrained\x20object\x20'+'(e.g.\x20an\x20Order),\x20receivable\x20only\x20by\x20that\x20object\x27s\x20owner\x20(object\x20receipt\x20=\x20owner\x20receipt);\x20'+'see\x20RC-FIND-03\x20residual\x20in\x20the\x20recipient\x20constraint\x20audit\x0a\x0a'+'When\x20sharing.who=Signer\x20and\x20the\x20Guard\x20does\x20not\x20bind\x20Signer,\x20ANY\x20caller\x20who\x20passes\x20the\x20Guard\x20'+'receives\x20the\x20order\x20funds\x20—\x20a\x20direct\x20theft.\x20Even\x20an\x20authorized\x20caller\x20is\x20unnecessary:\x20the\x20attacker\x20'+'only\x20needs\x20to\x20pass\x20the\x20Guard\x27s\x20condition\x20(e.g.\x20submit\x20any\x20completed\x20order_id),\x20then\x20the\x20funds\x20go\x20to\x20'+'their\x20own\x20address.\x0a\x0a'+'This\x20is\x20distinct\x20from\x20R-C3-01\x20(generic\x20Signer\x20binding)\x20and\x20R-C3-05\x20(cross-project\x20bypass).\x20'+'R-C3-06\x20addresses\x20the\x20allocators-specific\x20Guard+sharing\x20coupling:\x20the\x20SAFE\x20design\x20uses\x20'+'sharing.who=Entity\x20so\x20the\x20recipient\x20is\x20fixed,\x20making\x20Guard\x20Signer\x20binding\x20unnecessary.\x0a\x0a'+('sharing_recipients\x20hint:\x20'+g),'affected_stakeholders':['provider','customer'],'scenario':'Fund\x20theft:\x20attacker\x20passes\x20the\x20allocators\x20Guard\x20(e.g.\x20submits\x20a\x20completed\x20order_id)\x20and\x20'+'sharing.who=Signer\x20routes\x20100%\x20of\x20the\x20order\x20funds\x20to\x20the\x20attacker\x27s\x20address','mitigation':'TWO\x20mitigation\x20options:\x0a'+'\x20\x20(A)\x20Traditional:\x20add\x20context(Signer)\x20binding\x20to\x20the\x20Guard\x20root\x20'+'(logic_equal[context(Signer),\x20identifier[N](authorized_address)])\x20so\x20only\x20the\x20authorized\x20'+'recipient\x20can\x20trigger\x20allocation.\x0a'+'\x20\x20(B)\x20PREFERRED:\x20use\x20sharing.who=Entity\x20(Treasury\x20object\x20or\x20fixed\x20personal\x20address)\x20in\x20the\x20'+'Allocator\x27s\x20sharing\x20config.\x20Funds\x20then\x20always\x20flow\x20to\x20the\x20designated\x20recipient\x20regardless\x20of\x20'+'who\x20triggers\x20allocation\x20—\x20the\x20Guard\x20does\x20NOT\x20need\x20to\x20bind\x20Signer.\x20This\x20is\x20more\x20robust\x20because\x20'+'it\x20does\x20not\x20depend\x20on\x20Guard\x20correctness.\x0a\x0a'+'Design\x20checklist\x20when\x20using\x20sharing.who=Entity:\x0a'+'\x20\x20-\x20If\x20Entity\x20points\x20to\x20a\x20Treasury\x20object,\x20verify\x20the\x20Treasury\x27s\x20permission\x20is\x20consistent\x20with\x20'+'the\x20Service\x27s\x20permission\x20(different\x20permissions\x20=\x20different\x20permission\x20organizations\x20=\x20minor\x20risk).\x0a'+'\x20\x20-\x20allocators\x20require\x20unique\x20guard\x20addresses:\x20create\x20separate\x20Guard\x20objects\x20(identical\x20root/table,\x20'+'different\x20descriptions)\x20for\x20each\x20allocator.\x0a'+'\x20\x20-\x20First-match-wins:\x20only\x20the\x20first\x20Allocator\x20whose\x20Guard\x20passes\x20executes;\x20multiple\x20allocators\x20'+'represent\x20alternative\x20strategies,\x20not\x20a\x20simultaneous\x20split.\x0a'+'\x20\x20-\x20Still\x20add\x20order.service\x20project\x20binding\x20(query\x201563)\x20to\x20prevent\x20cross-project\x20bypass\x20(R-C3-05)\x20'+'triggering\x20premature\x20allocation.','evidence':'Scene:\x20service_order_allocators_guard.\x20'+'Guard\x20binds\x20Signer:\x20no.\x20'+('sharing_recipients:\x20'+g+'.\x20')+('Level\x20rationale:\x20'+(d?'Signer\x20sharing\x20confirmed\x20→\x20critical':'sharing\x20hint\x20absent\x20→\x20conservative\x20medium')+'.')};}},{'id':'R-C4-01','data_source_class':'type4_system_context','trigger':'Guard\x20contains\x20context(Signer)\x20check;\x20need\x20to\x20confirm\x20comparison\x20direction\x20(==\x20vs\x20!=)\x20and\x20compared\x20object\x20role','check':a=>{if(!hasSignerCheck(a))return null;const b=JSON['stringify'](a['root']),c=b['includes']('\x22logic_equal\x22'),d=b['includes']('\x22logic_not_equal\x22');return{'id':'R-C4-01','data_source_class':'type4_system_context','level':'medium','category':'system_context_risk','title':'Signer\x20check\x20direction\x20needs\x20manual\x20confirmation\x20(comparison\x20operator\x20and\x20role\x20match)','description':'Guard\x20contains\x20a\x20context(Signer)\x20check.\x20Signer\x20is\x20a\x20Type4\x20system\x20context,\x20'+'from\x20TransactionContext.sender()\x20(transaction\x20initiator\x20address).\x0a'+('Detected\x20comparison:\x20'+(c?'logic_equal(==)':'')+'\x20'+(d?'logic_not_equal(!=)':'')+'\x0a')+'Manual\x20confirmation\x20required:\x0a'+'\x20\x201)\x20Whether\x20the\x20comparison\x20direction\x20is\x20correct:\x20use\x20==\x20for\x20identity\x20verification\x20(Signer\x20==\x20authorized\x20address),\x20use\x20!=\x20for\x20exclusion\x20(Signer\x20!=\x20blacklist\x20address)\x0a'+'\x20\x202)\x20Whether\x20the\x20compared\x20object\x20role\x20is\x20correct:\x20buy_guard\x20should\x20compare\x20the\x20Customer\x20address,\x20Forward.guard\x20may\x20compare\x20the\x20Provider\x20address\x0a'+'\x20\x203)\x20Wrong\x20direction\x20causes\x20reverse\x20effect:\x20==\x20blacklist\x20address\x20would\x20only\x20allow\x20blacklisted\x20users','affected_stakeholders':['customer','provider'],'scenario':'Wrong\x20direction:\x20Signer\x20==\x20blacklist\x20address\x20would\x20only\x20allow\x20blacklisted\x20users','mitigation':'1)\x20Confirm\x20logic_equal\x20is\x20used\x20for\x20identity\x20verification\x20(Signer\x20==\x20authorized\x20address);'+'2)\x20Confirm\x20logic_not_equal\x20is\x20used\x20for\x20exclusion\x20(Signer\x20!=\x20blacklist\x20address);'+'3)\x20Confirm\x20the\x20compared\x20table\x20constant\x20is\x20the\x20address\x20of\x20the\x20correct\x20role;'+'4)\x20Cover\x20both\x20expected-pass\x20and\x20expected-fail\x20scenarios\x20in\x20gen_passport\x20tests','evidence':'Comparison:\x20'+(c?'==':'')+'\x20'+(d?'!=':'')};}},{'id':'R-C4-02','data_source_class':'type4_system_context','trigger':'Guard\x20uses\x20context(Clock)\x20for\x20precise\x20boundary\x20time-lock\x20comparison','check':a=>{if(!hasClockCheck(a))return null;const b=rootStr(a),c=b['includes']('logic_as_u256_greater_or_equal'),d=b['includes']('logic_as_u256_greater');if(!c&&!d)return null;return{'id':'R-C4-02','data_source_class':'type4_system_context','level':'low','category':'system_context_risk','title':'Clock\x20time-lock\x20should\x20have\x20tolerance\x20to\x20avoid\x20boundary\x20invalidation\x20from\x20validator\x20block-time\x20variance','description':'Guard\x20uses\x20context(Clock)\x20for\x20time-lock\x20comparison.\x20Clock\x20comes\x20from\x20the\x20timestamp_ms\x20field\x20(U64\x20millisecond\x20timestamp)\x20of\x20system\x20shared\x20object\x200x6.\x0a'+'The\x20Wow\x20on-chain\x20timestamp\x20is\x20produced\x20by\x20validator\x20consensus\x20and\x20has\x20a\x20slight\x20deviation\x20from\x20real\x20time\x20(usually\x20<\x201\x20second),\x20'+'and\x20block-time\x20variance\x20may\x20cause\x20timestamp\x20jumps.\x20Using\x20precise\x20boundaries\x20(>=\x20or\x20==)\x20may\x20cause:\x0a'+'\x20\x20-\x20The\x20time-lock\x20expiration\x20transaction\x20is\x20packaged\x20exactly\x20at\x20the\x20moment\x20but\x20fails\x20due\x20to\x20slight\x20timestamp\x20deviation\x0a'+'\x20\x20-\x20Or\x20conversely,\x20slight\x20deviation\x20causes\x20the\x20time-lock\x20to\x20pass\x20early\x0a'+'It\x20is\x20recommended\x20to\x20use\x20>\x20instead\x20of\x20>=,\x20or\x20add\x20a\x20small\x20tolerance\x20constant.','affected_stakeholders':['customer','provider'],'scenario':'Timestamp\x20variance:\x20validator\x20block-time\x20deviation\x20causes\x20boundary\x20transactions\x20to\x20fail\x20or\x20pass\x20early','mitigation':'1)\x20Use\x20logic_as_u256_greater\x20(>)\x20instead\x20of\x20greater_or_equal\x20(>=)\x20for\x20expiration\x20judgment;'+'2)\x20Or\x20add\x20a\x20small\x20tolerance\x20constant\x20(e.g.\x201000ms)\x20in\x20calc_number_add;'+'3)\x20Time-locks\x20should\x20not\x20rely\x20on\x20second-level\x20precision;\x20reserve\x20minute-level\x20tolerance;'+'4)\x20Design\x20timeout\x20Forward\x20nodes\x20in\x20the\x20Machine\x20as\x20a\x20fallback','evidence':'Comparison:\x20'+(c?'>=':'')+'\x20'+(d?'>':'')};}},{'id':'R-C4-03','data_source_class':'type4_system_context','trigger':'Guard\x20uses\x20context(Guard)\x20self-reference','check':a=>{if(!hasGuardSelfRef(a))return null;return{'id':'R-C4-03','data_source_class':'type4_system_context','level':'low','category':'system_context_risk','title':'Guard\x20uses\x20context(Guard)\x20self-reference\x20(rare\x20scenario,\x20needs\x20special\x20explanation)','description':'Guard\x20contains\x20a\x20context(Guard)\x20node.\x20Guard\x20is\x20a\x20Type4\x20system\x20context,\x20'+'returning\x20the\x20ObjectID\x20of\x20the\x20currently\x20verified\x20Guard\x20object\x20itself.\x0a'+'This\x20is\x20a\x20rare\x20scenario,\x20typically\x20used\x20for:\x0a'+'\x20\x201)\x20Guard\x20referencing\x20its\x20own\x20address\x20as\x20a\x20replacement\x20for\x20a\x20table\x20constant\x20(avoiding\x20hardcoding)\x0a'+'\x20\x202)\x20Identifying\x20the\x20current\x20Guard\x20in\x20a\x20rely\x20combination\x20(rare)\x0a'+'Need\x20to\x20confirm\x20whether\x20the\x20use\x20of\x20context(Guard)\x20is\x20necessary\x20and\x20whether\x20the\x20comparison\x20object\x20is\x20correct.','affected_stakeholders':['provider'],'scenario':'Self-reference\x20misuse:\x20context(Guard)\x20comparing\x20wrong\x20object\x20causes\x20logic\x20invalidation','mitigation':'1)\x20Confirm\x20the\x20context(Guard)\x20comparison\x20object\x20is\x20the\x20Guard\x20ObjectID\x20rather\x20than\x20an\x20address\x20constant;'+'2)\x20Evaluate\x20whether\x20self-reference\x20is\x20truly\x20needed;\x20usually\x20a\x20table\x20constant\x20can\x20replace\x20it;'+'3)\x20Verify\x20in\x20gen_passport\x20tests\x20that\x20self-reference\x20behavior\x20meets\x20expectations'};}},{'id':'R-C4-04','data_source_class':'type4_system_context','trigger':'Guard\x20uses\x20logic_equal[context(Signer),\x20identifier[N](fixed_address)]\x20—\x20Level\x201\x20strict\x20single-identity\x20binding.\x20'+'Only\x20ONE\x20address\x20can\x20pass\x20the\x20Guard,\x20and\x20because\x20Guards\x20are\x20immutable,\x20changing\x20the\x20authorized\x20address\x20requires\x20'+'rebuilding\x20the\x20Guard\x20and\x20migrating\x20all\x20references.\x20This\x20creates\x20a\x20convenience\x20trade-off:\x20maximum\x20security\x20but\x20'+'maximum\x20inflexibility\x20(key\x20loss\x20or\x20personnel\x20change\x20permanently\x20blocks\x20the\x20operation).','check':a=>{if(!hasSignerCheck(a))return null;if(isSignerCheckInLogicOr(a['root']))return null;const b=detectLevel1StrictBinding(a['root'],a['table']);if(!b['detected']||!b['entry'])return null;const c=b['entry'];return{'id':'R-C4-04','data_source_class':'type4_system_context','level':'low','category':'system_context_risk','title':'Level\x201\x20strict\x20single-identity\x20Signer\x20binding\x20—\x20convenience\x20trade-off\x20(consider\x20Level\x202/3\x20alternatives)','description':'Guard\x20uses\x20logic_equal[context(Signer),\x20identifier['+c['identifier']+'](fixed\x20address)]\x20—\x20only\x20the\x20address\x20\x22'+c['value']+'\x22\x20can\x20pass.\x0a'+'This\x20is\x20Level\x201\x20strict\x20single-identity\x20binding:\x20maximally\x20secure\x20but\x20maximally\x20inconvenient.\x0a'+'Guards\x20are\x20immutable\x20on-chain.\x20If\x20the\x20authorized\x20address\x20becomes\x20unavailable\x20(key\x20loss,\x20personnel\x20change,\x20'+'role\x20rotation),\x20the\x20Guard\x20permanently\x20blocks\x20the\x20operation\x20—\x20the\x20only\x20recovery\x20is\x20to\x20build\x20a\x20new\x20Guard\x20'+'and\x20migrate\x20ALL\x20references\x20(Machine\x20forward\x20guards,\x20Service\x20buy_guard,\x20allocators,\x20etc.).\x0a\x0a'+'Three\x20verifier\x20constraint\x20levels\x20trade\x20off\x20security\x20vs\x20convenience:\x0a'+'\x20\x20-\x20Level\x201\x20(current):\x20strict\x20single-identity\x20—\x20one\x20address,\x20no\x20flexibility\x20(AVOID\x20unless\x20justified)\x0a'+'\x20\x20-\x20Level\x202:\x20identity-set\x20—\x20logic_or\x20of\x20multiple\x20valid\x20identities\x20(e.g.\x20order.owner\x20OR\x20order.agent;\x20'+'permission.owner\x20OR\x20permission.admin).\x20Recommended\x20for\x20role-based\x20access.\x0a'+'\x20\x20-\x20Level\x203:\x20scene-combined\x20—\x20verify\x20whether\x20Signer\x20binding\x20is\x20even\x20needed.\x20Many\x20scenes\x20(allocators\x20with\x20'+'sharing.who=Entity,\x20machine\x20forward\x20with\x20permissionIndex)\x20already\x20ensure\x20safety\x20without\x20Signer\x20binding.\x0a\x0a'+'Use\x20Level\x201\x20only\x20when:\x20(a)\x20the\x20role\x20is\x20permanently\x20tied\x20to\x20one\x20address,\x20AND\x20(b)\x20the\x20designer\x20explicitly\x20'+'accepts\x20the\x20immutability\x20lock-in\x20risk.\x20Otherwise\x20prefer\x20Level\x202\x20or\x20Level\x203.','affected_stakeholders':['provider'],'scenario':'Immutability\x20lock-in:\x20authorized\x20address\x20becomes\x20unavailable,\x20Guard\x20permanently\x20blocks\x20the\x20operation,\x20'+'requiring\x20full\x20Guard\x20rebuild\x20and\x20reference\x20migration','mitigation':'Consider\x20these\x20alternatives\x20before\x20settling\x20on\x20Level\x201\x20strict\x20binding:\x0a'+'\x20\x20(A)\x20Level\x202\x20identity-set\x20(RECOMMENDED\x20for\x20role-based\x20access):\x20use\x20logic_or\x20to\x20allow\x20multiple\x20valid\x20identities.\x0a'+'\x20\x20\x20\x20\x20\x20-\x20Order\x20holder:\x20logic_or[logic_equal[query(1562:\x20order.owner),\x20context(Signer)],\x20query(1567:\x20order.agent\x20has,\x20parameters:\x20[context(Signer)])]\x0a'+'\x20\x20\x20\x20\x20\x20-\x20Service\x20provider:\x20logic_or[logic_equal[query(1002:\x20permission.owner),\x20context(Signer)],\x20query(1004:\x20permission.admin\x20has,\x20parameters:\x20[context(Signer)])]\x0a'+'\x20\x20\x20\x20\x20\x20-\x20Dynamic\x20permission\x20(survives\x20rotation):\x20submit\x20permission\x20address,\x20verify\x20query(1488:\x20service.permission)\x20==\x20submitted,\x20then\x20check\x201002/1004\x0a'+'\x20\x20(B)\x20Level\x203\x20scene-combined:\x20evaluate\x20whether\x20Signer\x20binding\x20is\x20needed\x20at\x20all.\x0a'+'\x20\x20\x20\x20\x20\x20-\x20If\x20using\x20allocators\x20with\x20sharing.who=Entity\x20(Treasury):\x20funds\x20flow\x20to\x20a\x20fixed\x20recipient\x20regardless\x20of\x20caller\x20—\x20no\x20Signer\x20binding\x20needed\x20(R-C3-06\x20safe)\x0a'+'\x20\x20\x20\x20\x20\x20-\x20If\x20using\x20machine\x20forward:\x20permissionIndex\x20already\x20verifies\x20operator\x20identity\x20—\x20Signer\x20binding\x20may\x20be\x20redundant\x0a'+'\x20\x20(C)\x20If\x20Level\x201\x20is\x20truly\x20required:\x20document\x20the\x20justification\x20in\x20the\x20Guard\x20description\x20and\x20ensure\x20a\x20key-recovery\x20/\x20address-rotation\x20plan\x20exists.','evidence':'Level\x201\x20strict\x20binding\x20detected:\x20logic_equal[context(Signer),\x20identifier['+c['identifier']+']]\x20'+('where\x20identifier['+c['identifier']+']\x20is\x20a\x20fixed\x20Address\x20constant\x20(b_submission=false,\x20value=\x22'+c['value']+'\x22'+(c['name']?',\x20name=\x22'+c['name']+'\x22':'')+').\x20')+'Not\x20wrapped\x20in\x20logic_or\x20(not\x20Level\x202\x20identity-set).'};}},{'id':'R-X1-01','data_source_class':'cross_type','trigger':'Time-lock\x20uses\x20logic_as_u256_greater_or_equal\x20with\x20a\x20baseline\x20query\x20that\x20has\x20NO\x20non-zero\x20invariant\x20(i.e.\x20the\x20query\x20MAY\x20legitimately\x20return\x200\x20when\x20it\x20succeeds),\x20causing\x20Clock\x20>=\x200\x20+\x20timeout\x20to\x20always\x20be\x20true','check':a=>{const b=rootStr(a),c=b['includes']('logic_as_u256_greater_or_equal'),d=b['includes']('\x22clock\x22'),e=b['includes']('calc_number_add'),f=b['includes']('\x22query\x22');if(!(c&&d&&e&&f))return null;if(rootAllQueriesNonZero(a['root']))return null;const g=extractQueryIds(a['root']),h=g['filter'](j=>!QUERY_INVARIANT_MAP['has'](j)),i=h['length']>0x0?'Queries\x20without\x20non-zero\x20invariant:\x20'+h['map'](j=>{const k=GUARDQUERY['find'](l=>l['id']===j);return k?k['id']+'\x20('+k['name']+')':''+j;})['join'](',\x20'):'Baseline\x20query\x20may\x20return\x200';return{'id':'R-X1-01','data_source_class':'cross_type','level':'medium','category':'logic_gap','title':'Time-lock\x20baseline\x20query\x20may\x20return\x200\x20causing\x20>=\x20comparison\x20to\x20always\x20be\x20true','description':'Guard\x20uses\x20logic_as_u256_greater_or_equal\x20for\x20time-lock\x20comparison,\x20and\x20the\x20compared\x20baseline\x20value\x20comes\x20from\x20a\x20query\x20(Type1/2/3\x20data\x20sources).\x20'+'If\x20the\x20query\x20SUCCEEDS\x20but\x20its\x20stored\x20value\x20is\x200\x20(e.g.\x20a\x20count\x20that\x20is\x200\x20in\x20the\x20empty\x20initial\x20state,\x20a\x20user-submitted\x20value\x20of\x200,\x20or\x20a\x20Some(0)\x20from\x20an\x20Option\x20field),\x20'+'then\x20Clock\x20>=\x200\x20+\x20timeout\x20is\x20always\x20true,\x20the\x20time-lock\x20is\x20effectively\x20void,\x20and\x20the\x20disadvantaged\x20party\x20can\x20bypass\x20the\x20time\x20constraint\x20immediately.\x0a\x0a'+'IMPORTANT\x20—\x20\x27VM\x20error\x20=\x20Guard\x20failure\x27\x20baseline:\x20'+'if\x20a\x20query\x20targets\x20an\x20absent\x20object,\x20unset\x20Option,\x20or\x20missing\x20collection\x20entry,\x20the\x20WoWok\x20native\x20runtime\x20aborts\x20with\x20a\x20VM\x20error\x20(e.g.\x20W_FIELD_NOT_FOUND)\x20'+'and\x20the\x20Guard\x20fails\x20as\x20a\x20whole\x20(does\x20NOT\x20silently\x20return\x200).\x20Therefore\x20the\x20null-bypass\x20risk\x20ONLY\x20applies\x20to\x20queries\x20whose\x20stored\x20value\x20can\x20legitimately\x20be\x200\x20'+'while\x20the\x20query\x20itself\x20succeeds.\x20Such\x20queries\x20are\x20exactly\x20those\x20WITHOUT\x20an\x20`invariant`\x20annotation\x20in\x20the\x20SDK\x20GUARDQUERY\x20catalog.','affected_stakeholders':['customer','provider'],'scenario':'Time-lock\x20invalidation:\x20baseline\x20query\x20returns\x200\x20(not\x20VM\x20error),\x20making\x20the\x20>=\x20condition\x20always\x20pass','mitigation':'1)\x20Use\x20a\x20query\x20whose\x20return\x20is\x20guaranteed\x20non-zero\x20(look\x20for\x20`invariant`\x20in\x20guard-ins.ts\x20—\x20e.g.\x20progress.current_time\x20id=1272\x20with\x20invariant=\x27clock_derived\x27);\x20'+'2)\x20Add\x20a\x20precondition\x20check\x20query\x20>\x200\x20before\x20the\x20time-lock\x20(for\x20queries\x20without\x20an\x20invariant,\x20e.g.\x20user-submitted\x20baselines);\x20'+'3)\x20Avoid\x20using\x20count/index/find/user-submitted\x20values\x20as\x20time-lock\x20baselines\x20—\x20these\x20can\x20all\x20legitimately\x20return\x200;\x20'+'4)\x20Distinguish\x20\x27VM\x20error\x27\x20(safe\x20—\x20Guard\x20fails)\x20from\x20\x27query\x20returns\x200\x27\x20(unsafe\x20—\x20Guard\x20bypassed).\x20Only\x20the\x20latter\x20is\x20a\x20null-bypass\x20risk.','evidence':i};}},{'id':'R-X1-02','data_source_class':'cross_type','trigger':'Guard\x20uses\x20logic_as_u256_greater\x20with\x20a\x20query\x20operand\x20that\x20has\x20NO\x20non-zero\x20invariant\x20(i.e.\x20the\x20query\x20MAY\x20legitimately\x20return\x200\x20when\x20it\x20succeeds),\x20and\x20the\x20comparison\x20does\x20not\x20distinguish\x20\x27query\x20succeeded\x20with\x200\x27\x20from\x20\x27query\x20failed\x27','check':a=>{const b=rootStr(a);if(!(b['includes']('logic_as_u256_greater')&&b['includes']('\x22query\x22')))return null;if(rootAllQueriesNonZero(a['root']))return null;const c=extractQueryIds(a['root']),d=c['filter'](f=>!QUERY_INVARIANT_MAP['has'](f)),e=d['length']>0x0?'Queries\x20without\x20non-zero\x20invariant:\x20'+d['map'](f=>{const g=GUARDQUERY['find'](h=>h['id']===f);return g?g['id']+'\x20('+g['name']+')':''+f;})['join'](',\x20'):'Query\x20may\x20return\x200';return{'id':'R-X1-02','data_source_class':'cross_type','level':'medium','category':'logic_gap','title':'Numeric\x20comparison\x20with\x20a\x20query\x20that\x20may\x20legitimately\x20return\x200','description':'Guard\x20uses\x20logic_as_u256_greater\x20for\x20numeric\x20comparison,\x20and\x20one\x20of\x20the\x20operands\x20comes\x20from\x20a\x20query\x20(Type1/2/3\x20data\x20sources)\x20that\x20has\x20NO\x20non-zero\x20invariant\x20annotation.\x20'+'If\x20the\x20query\x20SUCCEEDS\x20but\x20its\x20stored\x20value\x20is\x200\x20(e.g.\x20a\x20count\x20that\x20is\x200\x20in\x20the\x20empty\x20initial\x20state,\x20a\x20user-submitted\x20value\x20of\x200,\x20or\x20a\x20Some(0)\x20from\x20an\x20Option\x20field),\x20'+'the\x20comparison\x20may\x20produce\x20an\x20unexpected\x20result\x20(e.g.\x20`query\x20>\x200`\x20fails,\x20or\x20`query\x20>\x20some_threshold`\x20is\x20silently\x20bypassed).\x0a\x0a'+'IMPORTANT\x20—\x20\x27VM\x20error\x20=\x20Guard\x20failure\x27\x20baseline:\x20'+'if\x20a\x20query\x20targets\x20absent\x20data\x20(e.g.\x20object\x20does\x20not\x20exist,\x20Option\x20is\x20None,\x20collection\x20entry\x20is\x20missing),\x20the\x20WoWok\x20native\x20runtime\x20aborts\x20with\x20a\x20VM\x20error\x20'+'(not\x200).\x20The\x20Guard\x20fails\x20as\x20a\x20whole\x20(does\x20NOT\x20silently\x20return\x200).\x20Therefore\x20this\x20rule\x20only\x20flags\x20queries\x20whose\x20stored\x20value\x20can\x20be\x200\x20while\x20the\x20query\x20succeeds.','affected_stakeholders':['customer','provider'],'scenario':'Null\x20misjudgment:\x20query\x20succeeds\x20with\x20value\x200,\x20causing\x20>\x200\x20condition\x20to\x20unexpectedly\x20fail\x20(or\x20>\x20threshold\x20to\x20be\x20bypassed)','mitigation':'1)\x20Prefer\x20queries\x20with\x20an\x20`invariant`\x20annotation\x20(e.g.\x20clock_derived\x20/\x20positive_lower_bound);\x20'+'2)\x20Add\x20a\x20precondition\x20check\x20(query\x20>\x200)\x20before\x20the\x20main\x20comparison\x20when\x20using\x20count/index/find/user-submitted\x20baselines;\x20'+'3)\x20Distinguish\x20\x27VM\x20error\x27\x20(safe\x20—\x20Guard\x20fails)\x20from\x20\x27query\x20returns\x200\x27\x20(potentially\x20unsafe).\x20Only\x20the\x20latter\x20is\x20a\x20null-bypass\x20risk.','evidence':e};}},{'id':'R-X1-03','data_source_class':'cross_type','trigger':'Guard\x20uses\x20logic_string_contains\x20and\x20may\x20be\x20bypassed\x20by\x20substring\x20matching','check':a=>{const b=rootStr(a);if(!(b['includes']('logic_string_contains')&&!b['includes']('logic_string_nocase')))return null;return{'id':'R-X1-03','data_source_class':'cross_type','level':'low','category':'logic_gap','title':'logic_string_contains\x20substring\x20match\x20may\x20be\x20bypassed','description':'Guard\x20uses\x20logic_string_contains\x20for\x20string\x20matching.'+'Substring\x20matching\x20may\x20be\x20bypassed:\x20e.g.\x20when\x20checking\x20\x27Completed\x27,\x20\x27NotCompleted\x27\x20also\x20contains\x20\x27Completed\x27.'+'In\x20addition,\x20case\x20sensitivity\x20may\x20cause\x20unexpected\x20failures.\x20String\x20data\x20may\x20come\x20from\x20Type1\x20(query\x20object\x20fields),\x20'+'Type3\x20(submitted\x20values),\x20or\x20the\x20context\x20of\x20a\x20rely-dependent\x20Guard.','affected_stakeholders':['customer','provider'],'scenario':'Substring\x20mismatch:\x20\x27NotCompleted\x27\x20contains\x20\x27Completed\x27,\x20causing\x20false\x20pass','mitigation':'1)\x20Prefer\x20logic_equal\x20for\x20exact\x20matching;'+'2)\x20If\x20substring\x20matching\x20is\x20needed,\x20add\x20boundary\x20conditions\x20(e.g.\x20prefix\x20+\x20suffix);'+'3)\x20Confirm\x20whether\x20case-insensitivity\x20is\x20needed\x20(use\x20the\x20nocase\x20variant)'};}},{'id':'R-X1-04','data_source_class':'cross_type','trigger':'Guard\x20root\x20is\x20an\x20identifier\x20directly\x20returning\x20Bool','check':a=>{if(a['root']?.['type']!=='identifier')return null;const b=a['table']['find'](d=>d['identifier']===a['root']['identifier']),c=b?.['b_submission']??![];return{'id':'R-X1-04','data_source_class':'cross_type','level':c?'medium':'low','category':'logic_gap','title':'Root\x20directly\x20returns\x20identifier\x20value,\x20no\x20operation\x20logic','description':'Guard\x20root\x20is\x20an\x20identifier\x20node,\x20directly\x20returning\x20the\x20value\x20(Bool)\x20from\x20table.'+(c?'This\x20entry\x20has\x20b_submission=true\x20(Type3\x20submitted\x20value);\x20the\x20caller\x20can\x20directly\x20submit\x20true\x20to\x20bypass\x20all\x20verification.':'This\x20entry\x20has\x20b_submission=false\x20(Type1\x20constant);\x20the\x20value\x20is\x20fixed\x20but\x20the\x20Guard\x20has\x20no\x20actual\x20verification\x20logic.'),'affected_stakeholders':['customer','provider'],'scenario':c?'Bypass\x20verification:\x20caller\x20submits\x20true\x20to\x20pass\x20the\x20Guard\x20directly':'No\x20verification\x20logic:\x20Guard\x20always\x20returns\x20a\x20fixed\x20value,\x20providing\x20no\x20actual\x20protection','mitigation':c?'1)\x20Ensure\x20the\x20entry\x20referenced\x20by\x20identifier\x20has\x20b_submission=false\x20(constant);'+'2)\x20Or\x20add\x20an\x20additional\x20logic_and\x20condition\x20for\x20cross-validation':'1)\x20Add\x20actual\x20verification\x20logic\x20(query\x20+\x20logic\x20comparison);'+'2)\x20Evaluate\x20whether\x20this\x20Guard\x20needs\x20to\x20exist'};}},{'id':'R-X1-05','data_source_class':'cross_type','trigger':'Allocation\x20Guard\x20may\x20cause\x20some\x20participants\x20to\x20be\x20skipped','check':a=>{if(a['scene']?.['binding_field']!=='order_allocators')return null;return{'id':'R-X1-05','data_source_class':'cross_type','level':'medium','category':'game_theory','title':'order_allocators\x20first-match-wins\x20may\x20cause\x20unfair\x20allocation','description':'order_allocators\x20uses\x20a\x20first-match-wins\x20strategy:\x20the\x20first\x20Allocator\x20whose\x20Guard\x20passes\x20executes\x20the\x20allocation.'+'If\x20the\x20order\x20is\x20poorly\x20designed,\x20some\x20participants\x20may\x20never\x20get\x20allocated.'+'For\x20example:\x20if\x20the\x20first\x20Allocator\x27s\x20Guard\x20condition\x20is\x20too\x20broad,\x20subsequent\x20more\x20precise\x20Allocators\x20will\x20never\x20execute.'+'Allocation\x20Guards\x20typically\x20combine\x20Type1\x20(query\x20order\x20fields),\x20Type3\x20(submit\x20Order\x20address),\x20and\x20Type4\x20(Signer)\x20data.','affected_stakeholders':['provider'],'scenario':'Allocation\x20skip:\x20the\x20Provider\x27s\x20allocation\x20Allocator\x20is\x20skipped\x20by\x20preceding\x20broad\x20conditions','mitigation':'1)\x20Ensure\x20the\x20order_allocators\x20order\x20goes\x20from\x20strict\x20to\x20loose;'+'2)\x20Each\x20Allocator\x27s\x20Guard\x20conditions\x20should\x20be\x20mutually\x20exclusive;'+'3)\x20Consider\x20using\x20logic_or\x20dependencies\x20rather\x20than\x20sequential\x20ordering'};}},{'id':'R-X1-06','data_source_class':'cross_type','trigger':'Workflow\x20Guard\x20time-lock\x20may\x20lock\x20the\x20disadvantaged\x20party','check':a=>{const b=rootStr(a);if(!(b['includes']('clock')&&b['includes']('calc_number_add')))return null;return{'id':'R-X1-06','data_source_class':'cross_type','level':'medium','category':'game_theory','title':'Time-lock\x20may\x20lock\x20the\x20disadvantaged\x20party','description':'Guard\x20uses\x20a\x20time-lock\x20(context(Clock)\x20+\x20calc_number_add).\x20The\x20time-lock\x20itself\x20is\x20neutral,\x20'+'but\x20the\x20locking\x20direction\x20needs\x20to\x20be\x20checked:\x20if\x20the\x20Customer\x20is\x20locked\x20to\x20pay\x20first\x20but\x20cannot\x20accept\x20in\x20time,\x20the\x20Provider\x20gains\x20advantage;\x20'+'if\x20the\x20Provider\x20is\x20locked\x20to\x20deliver\x20first\x20but\x20cannot\x20receive\x20payment\x20in\x20time,\x20the\x20Customer\x20gains\x20advantage.'+'The\x20time-lock\x20combines\x20Type4\x20(Clock)\x20and\x20Type1/2\x20(query\x20time\x20fields)\x20data\x20sources.','affected_stakeholders':['customer','provider'],'scenario':'Time\x20asymmetry:\x20one\x20party\x20is\x20locked\x20by\x20time\x20while\x20the\x20other\x20has\x20freedom\x20of\x20action','mitigation':'1)\x20Ensure\x20the\x20time-lock\x20is\x20symmetric\x20(both\x20parties\x20have\x20time\x20constraints);'+'2)\x20Provide\x20an\x20exit\x20mechanism\x20after\x20the\x20time-lock\x20expires\x20(e.g.\x20auto-refund/auto-complete);'+'3)\x20Design\x20corresponding\x20timeout\x20Forward\x20nodes\x20in\x20the\x20Machine'};}},{'id':'R-X1-07','data_source_class':'cross_type','trigger':'Arbitration\x20usage_guard\x20may\x20block\x20legitimate\x20disputes','check':a=>{if(a['scene']?.['binding_field']!=='usage_guard')return null;const b=rootStr(a),c=(b['match'](/"logic_and"/g)||[])['length'];if(c<0x3)return null;return{'id':'R-X1-07','data_source_class':'cross_type','level':'high','category':'game_theory','title':'usage_guard\x20has\x20too\x20many\x20conditions\x20and\x20may\x20block\x20legitimate\x20disputes','description':'Detected\x20'+c+'\x20logic_and\x20combinations.\x20Too\x20many\x20AND\x20conditions\x20make\x20the\x20dispute\x20threshold\x20too\x20high,\x20'+'the\x20Customer\x20may\x20not\x20be\x20able\x20to\x20initiate\x20a\x20legitimate\x20dispute,\x20and\x20the\x20Provider\x20gains\x20an\x20unfair\x20advantage.'+'usage_guard\x20typically\x20combines\x20Type4\x20(Signer\x20identity),\x20Type3\x20(submit\x20Passport\x20credentials),\x20'+'and\x20Type1\x20(query\x20EntityRegistrar\x20verification)\x20data\x20sources.','affected_stakeholders':['customer'],'scenario':'Dispute\x20threshold\x20too\x20high:\x20Customer\x20cannot\x20initiate\x20a\x20legitimate\x20dispute','mitigation':'1)\x20Re-evaluate\x20the\x20necessity\x20of\x20each\x20AND\x20condition;'+'2)\x20Consider\x20using\x20logic_or\x20to\x20lower\x20the\x20threshold;'+'3)\x20Move\x20non-essential\x20conditions\x20to\x20voting_guard\x20rather\x20than\x20usage_guard'};}},{'id':'R-X1-08','data_source_class':'cross_type','trigger':'Guard\x20is\x20bound\x20to\x20a\x20published\x20Machine/Service\x20(immutable)','check':a=>{if(!a['scene']||a['scene']['mutable_after_publish'])return null;return{'id':'R-X1-08','data_source_class':'cross_type','level':'low','category':'binding_risk','title':'Guard\x20is\x20bound\x20to\x20immutable\x20'+a['scene']['host_object']+'\x20(cannot\x20be\x20modified\x20after\x20publish)','description':'After\x20'+a['scene']['host_object']+'\x20is\x20published,\x20'+a['scene']['binding_field']+'\x20cannot\x20be\x20modified.'+'If\x20the\x20Guard\x20design\x20is\x20flawed,\x20a\x20new\x20Machine/Service\x20must\x20be\x20created\x20and\x20all\x20references\x20migrated.'+'This\x20is\x20a\x20design\x20constraint\x20rather\x20than\x20a\x20risk,\x20but\x20the\x20Guard\x20design\x20must\x20be\x20correct\x20before\x20publishing.','affected_stakeholders':['provider'],'scenario':'Irreversible\x20binding:\x20after\x20publish,\x20a\x20flawed\x20Guard\x20design\x20cannot\x20be\x20modified','mitigation':'1)\x20Use\x20gen_passport\x20for\x20thorough\x20testing\x20before\x20publishing;'+'2)\x20Test\x20both\x20expected-pass\x20and\x20expected-fail\x20scenarios;'+'3)\x20Export\x20a\x20Guard\x20backup\x20(guard2file)\x20before\x20publishing'};}},{'id':'R-X1-09','data_source_class':'cross_type','trigger':'Guard\x20uses\x20rely\x20but\x20the\x20dependent\x20Guard\x20may\x20fail','check':a=>{if(!a['rely']||a['rely']['guards']['length']===0x0)return null;const b=a['rely']['logic_or']?'OR':'AND';return{'id':'R-X1-09','data_source_class':'cross_type','level':a['rely']['logic_or']?'low':'medium','category':'dependency_risk','title':'rely\x20'+b+'\x20depends\x20on\x20'+a['rely']['guards']['length']+'\x20external\x20Guards','description':'Guard\x20uses\x20rely\x20'+b+'\x20to\x20depend\x20on\x20'+a['rely']['guards']['length']+'\x20external\x20Guards.'+(a['rely']['logic_or']?'OR\x20logic:\x20any\x20one\x20passing\x20is\x20enough.\x20If\x20a\x20dependent\x20Guard\x20is\x20loosely\x20designed,\x20it\x20may\x20become\x20a\x20bypass\x20entry\x20point.':'AND\x20logic:\x20all\x20dependencies\x20must\x20pass.\x20If\x20a\x20dependent\x20Guard\x20fails\x20or\x20is\x20deleted,\x20the\x20current\x20Guard\x20will\x20always\x20fail.')+'\x20rely-dependent\x20Guards\x20must\x20have\x20rep=true\x20(repository.data\x20queries\x20do\x20not\x20depend\x20on\x20runtime\x20submission).','affected_stakeholders':['customer','provider'],'scenario':a['rely']['logic_or']?'Dependency\x20bypass:\x20a\x20loose\x20dependent\x20Guard\x20becomes\x20an\x20attack\x20entry\x20point':'Dependency\x20failure:\x20a\x20dependent\x20Guard\x20is\x20deleted,\x20causing\x20the\x20current\x20Guard\x20to\x20always\x20fail','mitigation':a['rely']['logic_or']?'1)\x20Review\x20the\x20strictness\x20of\x20each\x20dependent\x20Guard;\x202)\x20Ensure\x20all\x20dependent\x20Guards\x20are\x20at\x20least\x20as\x20strict\x20as\x20the\x20current\x20Guard':'1)\x20Confirm\x20all\x20dependent\x20Guards\x20have\x20rep=true\x20and\x20cannot\x20be\x20deleted;\x202)\x20Consider\x20whether\x20AND\x20dependency\x20is\x20truly\x20needed'};}},{'id':'R-X1-10','data_source_class':'cross_type','trigger':'Guard\x20uses\x20repository.data\x20query\x20(query\x201167)\x20and\x20the\x20Repository\x20has\x20quote_guard\x20set\x20—\x20rigid\x20verification\x20requirement','check':a=>{const b=rootStr(a);if(!(b['includes']('repository')&&b['includes']('\x22query\x22')))return null;return{'id':'R-X1-10','data_source_class':'cross_type','level':'low','category':'impack_risk','title':'repository.data\x20quote_guard\x20is\x20a\x20RIGID\x20verification\x20requirement\x20(data\x20subscription\x20access\x20control)','description':'When\x20a\x20Guard\x20queries\x20repository.data\x20(query\x201167),\x20if\x20the\x20Repository\x20policy\x20has\x20quote_guard\x20set\x20(Some(addr)),\x20'+'then\x20the\x20quote_guard\x20MUST\x20be\x20verified.\x20This\x20is\x20a\x20RIGID\x20requirement\x20—\x20not\x20context-dependent.\x0a\x0a'+'TWO-PHASE\x20VERIFICATION\x20MECHANISM\x20(VERIFIED:\x20passport.rs#L756-769,\x20passport.rs#L545-612):\x0a'+'\x20\x20Phase\x201\x20—\x20Passport\x20generation\x20(scan\x20guard):\x20The\x20system\x20scans\x20the\x20Guard\x20to\x20identify\x20that\x20it\x20queries\x20repository\x20data.\x20'+'If\x20the\x20Repository\x20has\x20a\x20quote_guard,\x20the\x20system\x20prepares\x20the\x20quote_guard\x20for\x20verification\x20(adds\x20it\x20to\x20the\x20required\x20'+'verification\x20set,\x20populating\x20impack_list).\x0a'+'\x20\x20Phase\x202\x20—\x20Passport\x20verification:\x20The\x20system\x20re-checks\x20(a)\x20is\x20the\x20quote_guard\x20prepared/in\x20impack_list?\x20'+'(b)\x20rigidly\x20verify\x20the\x20quote_guard\x20(e.g.,\x20verify\x20Payment\x20proof\x20for\x20subscription).\x0a\x0a'+'SEMANTIC\x20INTENT:\x20Any\x20Guard\x20that\x20uses\x20a\x20Repository\x27s\x20data\x20MUST\x20satisfy\x20that\x20Repository\x27s\x20quote_guard.\x20'+'This\x20is\x20the\x20intended\x20access\x20control\x20mechanism\x20for\x20data\x20subscription\x20—\x20e.g.,\x20accessing\x20weather\x20data\x20'+'requires\x20payment\x20proof\x20verified\x20by\x20the\x20quote_guard.\x0a\x0a'+'DESIGN\x20PHILOSOPHY:\x20On-chain\x20data\x20is\x20consumed\x20by\x20guard\x20verifiers.\x20The\x20quote_guard\x20gates\x20Repository\x20data\x20access,\x20'+'enabling\x20subscription\x20revenue\x20models.\x20The\x20Guard\x20only\x20verifies\x20logic\x20+\x20data\x20accuracy\x20(verifier-evidence\x20design).','affected_stakeholders':['customer','provider'],'scenario':'quote_guard\x20rigid\x20verification:\x20any\x20guard\x20querying\x20repository\x20data\x20must\x20satisfy\x20the\x20repository\x27s\x20quote_guard\x20(e.g.,\x20payment\x20requirement)','mitigation':'1)\x20This\x20is\x20an\x20INTENDED\x20capability,\x20not\x20a\x20limitation\x20—\x20quote_guard\x20enables\x20data\x20subscription\x20access\x20control;\x0a'+'2)\x20When\x20designing\x20a\x20Guard\x20that\x20queries\x20Repository\x20data\x20with\x20quote_guard:\x20ensure\x20the\x20Passport\x20includes\x20'+'the\x20quote_guard\x20verification\x20with\x20necessary\x20submissions\x20(e.g.,\x20Payment\x20proof);\x0a'+'3)\x20Pattern:\x20Repository\x20with\x20quote_guard\x20for\x20data\x20subscription\x20—\x20quote_guard\x20verifies\x20Payment\x20(for_object,\x20for_guard,\x20index),\x20'+'user\x20submits\x20Payment\x20via\x20Passport,\x20quote_guard\x20verified\x20in\x20both\x20phases,\x20repository\x20data\x20query\x20passes;\x0a'+'4)\x20If\x20quote_guard==None:\x20no\x20access\x20control\x20—\x20Repository\x20data\x20is\x20freely\x20queryable'};}},{'id':'R-X1-11','data_source_class':'cross_type','trigger':'Guard\x20uses\x20rely\x20to\x20depend\x20on\x20other\x20Guards;\x20need\x20to\x20confirm\x20the\x20rep\x20flag\x20of\x20dependent\x20Guards\x20is\x20correct','check':a=>{if(!a['rely']||a['rely']['guards']['length']===0x0)return null;const b=rootStr(a),c=b['includes']('repository')&&b['includes']('\x22query\x22'),d=a['table']['some'](f=>f['b_submission']&&f['value_type']==='Address'&&f['object_type']==='Repository');return{'id':'R-X1-11','data_source_class':'cross_type','level':c&&d?'medium':'low','category':'rep_risk','title':'rep\x20semantics\x20needs\x20confirmation\x20(when\x20repository.data\x20query\x20depends\x20on\x20submission,\x20rep=false\x20and\x20cannot\x20be\x20depended\x20on)','description':'Guard\x20uses\x20rely\x20to\x20depend\x20on\x20external\x20Guards.\x20In\x20the\x20WoWok\x20protocol,\x20rely-dependent\x20Guards\x20must\x20have\x20rep=true.\x0a'+'Precise\x20rep\x20semantics\x20(guard.rs#L483-L492):\x20repository.data\x20query\x20(query\x201167)\x20does\x20not\x20depend\x20on\x20runtime\x20submission.\x0a'+'\x20\x20-\x20rep=true:\x20repository.data\x20query\x20is\x20fully\x20constant-driven\x20(object\x20address\x20b_submission=false\x20and\x20query\x20parameters\x20are\x20not\x20submission)\x0a'+'\x20\x20-\x20rep=false:\x20repository\x20address\x20comes\x20from\x20runtime\x20submission,\x20or\x20query\x20parameters\x20come\x20from\x20submission\x0a'+'Guards\x20with\x20rep=false\x20cannot\x20appear\x20in\x20other\x20Guards\x27\x20rely\x20lists.\x0a'+(c&&d?'\x0aWarning:\x20the\x20current\x20Guard\x20itself\x20queries\x20repository.data\x20and\x20the\x20Repository\x20address\x20comes\x20from\x20submission,\x20'+'so\x20its\x20own\x20rep=false\x20and\x20cannot\x20be\x20depended\x20on\x20by\x20other\x20Guards.':''),'affected_stakeholders':['provider'],'scenario':'rep\x20misjudgment:\x20depending\x20on\x20a\x20rep=false\x20Guard\x20causes\x20creation\x20failure,\x20or\x20its\x20own\x20rep=false\x20is\x20wrongly\x20depended\x20on','mitigation':'1)\x20Confirm\x20all\x20rely-dependent\x20Guards\x20have\x20rep=true\x20(do\x20not\x20depend\x20on\x20submission\x20to\x20query\x20repository.data);'+'2)\x20If\x20the\x20current\x20Guard\x20queries\x20repository.data\x20and\x20the\x20address\x20comes\x20from\x20submission,\x20its\x20own\x20rep=false;\x20annotate\x20that\x20it\x20cannot\x20be\x20depended\x20on;'+'3)\x20rep\x20is\x20not\x20\x27no\x20Repository\x20dependency\x27,\x20but\x20\x27repository.data\x20query\x20does\x20not\x20depend\x20on\x20submission\x27;'+'4)\x20Use\x20wowok_buildin_info\x20to\x20query\x20the\x20full\x20definition\x20of\x20the\x20rep\x20flag','evidence':c&&d?'Self\x20rep=false\x20(repository.data\x20query\x20depends\x20on\x20submission)':'Self\x20rep\x20status\x20to\x20be\x20confirmed'};}},{'id':'R-X1-12','data_source_class':'cross_type','trigger':'Guard\x20table\x20contains\x20b_submission=true\x20entries\x20with\x20vague\x20name\x20descriptions\x20or\x20missing\x20binding_constraint','check':a=>{const b=a['table']['filter'](d=>d['b_submission']);if(b['length']===0x0)return null;const c=b['filter'](d=>{const f=d['name']??'';return f['length']<0xa||/^[a-z_]+$/i['test'](f)||f==='';});if(c['length']===0x0)return null;return{'id':'R-X1-12','data_source_class':'cross_type','level':'medium','category':'submission_forgery','title':'Submitted\x20data\x20entry\x20description\x20is\x20vague\x20(retained_submission\x20risk:\x20caller\x20may\x20submit\x20wrong\x20data)','description':'Guard\x20table\x20has\x20'+c['length']+'\x20b_submission=true\x20entries\x20with\x20vague\x20name\x20descriptions.\x0a'+'The\x20name\x20of\x20a\x20submission\x20entry\x20is\x20the\x20only\x20data\x20contract\x20between\x20the\x20Guard\x20and\x20the\x20caller.\x0a'+'If\x20the\x20name\x20description\x20is\x20unclear\x20(e.g.\x20only\x20\x27addr\x27\x20/\x20\x27order_id\x27),\x20the\x20caller\x20may:\x0a'+'\x20\x20-\x20Submit\x20a\x20wrong-typed\x20object\x20address\x20(e.g.\x20submit\x20a\x20Service\x20address\x20instead\x20of\x20an\x20Order\x20address)\x0a'+'\x20\x20-\x20Submit\x20a\x20wrong\x20value\x20(e.g.\x20inconsistent\x20amount\x20units)\x0a'+'\x20\x20-\x20Confuse\x20submission\x20slots\x20of\x20different\x20Guards\x20in\x20multi-Guard\x20scenarios\x0a'+'Vague\x20submission\x20entries\x20are\x20\x27retained\x27\x20in\x20the\x20table\x20but\x20provide\x20no\x20effective\x20data\x20constraints,\x20'+'equivalent\x20to\x20the\x20Guard\x20accepting\x20arbitrary\x20data\x20without\x20validating\x20its\x20semantic\x20correctness.','affected_stakeholders':['customer','provider'],'scenario':'Caller\x20submits\x20wrong\x20data\x20due\x20to\x20vague\x20name\x20description;\x20the\x20Guard\x20passes\x20verification\x20but\x20the\x20business\x20logic\x20is\x20wrong','mitigation':'1)\x20Each\x20submission\x20entry\x27s\x20name\x20should\x20be\x20a\x20complete\x20natural-language\x20description\x20(e.g.\x20\x27The\x20order\x20ID\x20that\x20identifies\x20the\x20target\x20Order\x20for\x20verification\x27);\x0a'+'2)\x20Avoid\x20Technical\x20identifiers\x20as\x20name\x20(e.g.\x20\x27order_id\x27\x20should\x20become\x20\x27Order\x20ID,\x20used\x20to\x20query\x20progress\x20status\x27);\x0a'+'3)\x20Add\x20failure_conditions\x20in\x20binding_hint\x20to\x20clarify\x20failure\x20scenarios;\x0a'+'4)\x20Consider\x20adding\x20type\x20validation\x20logic\x20in\x20root\x20(e.g.\x20query\x20the\x20submitted\x20object\x27s\x20objectType\x20and\x20match\x20with\x20expectation)','evidence':'Vague\x20entries:\x20'+c['map'](d=>'identifier='+d['identifier']+',\x20name=\x22'+d['name']+'\x22')['join'](';\x20')};}},{'id':'R-X1-13','data_source_class':'cross_type','trigger':'Guard\x20references\x20its\x20host\x20object\x20(Host\x20Object)\x20itself\x20—\x20circular\x20reference\x20pattern','check':a=>{if(!a['scene'])return null;const b=a['scene']['host_object'],c=a['table']['find'](d=>!d['b_submission']&&d['value_type']==='Address'&&d['object_type']===b);if(!c)return null;return{'id':'R-X1-13','data_source_class':'cross_type','level':'medium','category':'binding_risk','title':'Circular\x20reference\x20pattern\x20(Guard\x20references\x20the\x20host\x20object\x20itself;\x20note\x20creation\x20order)','description':'In\x20the\x20Guard\x27s\x20table,\x20identifier='+c['identifier']+'\x20has\x20object_type\x20equal\x20to\x20the\x20host\x20object\x20type\x20\x22'+b+'\x22.\x0a'+'Circular\x20reference\x20pattern:\x20the\x20Guard\x20is\x20bound\x20to\x20a\x20Host\x20Object\x20(e.g.\x20Service.buy_guard)\x20and\x20also\x20queries\x20the\x20Host\x20Object\x27s\x20own\x20fields.\x0a'+'Creation\x20order\x20constraints:\x0a'+'\x20\x201.\x20The\x20Host\x20Object\x20must\x20be\x20created\x20first\x20(unpublished\x20state)\x0a'+'\x20\x202.\x20When\x20the\x20Guard\x20is\x20created,\x20the\x20table\x20uses\x20the\x20Host\x20Object\x27s\x20name\x20(not\x20address);\x20the\x20SDK\x20resolves\x20it\x20at\x20binding\x20time\x0a'+'\x20\x203.\x20After\x20the\x20Guard\x20is\x20bound\x20to\x20the\x20Host\x20Object,\x20the\x20Host\x20Object\x20is\x20published\x0a'+'Risks:\x0a'+'\x20\x20-\x20If\x20the\x20Host\x20Object\x20is\x20already\x20published\x20(immutable),\x20the\x20Guard\x20can\x20no\x20longer\x20be\x20bound\x0a'+'\x20\x20-\x20If\x20the\x20Host\x20Object\x27s\x20name\x20is\x20modified\x20after\x20the\x20Guard\x20is\x20created,\x20the\x20Guard\x27s\x20table\x20reference\x20is\x20invalidated\x0a'+'\x20\x20-\x20Circular\x20reference\x20makes\x20the\x20Guard\x20not\x20independently\x20testable\x20(the\x20Host\x20Object\x20must\x20exist\x20to\x20verify)','affected_stakeholders':['provider'],'scenario':'Guard\x20queries\x20fields\x20of\x20the\x20Service/Machine/Reward\x20it\x20is\x20bound\x20to;\x20wrong\x20creation\x20order\x20causes\x20binding\x20failure','mitigation':'1)\x20Ensure\x20the\x20Host\x20Object\x20is\x20unpublished\x20(bPublished=false)\x20when\x20creating\x20and\x20binding\x20the\x20Guard;\x0a'+'2)\x20Use\x20the\x20Host\x20Object\x27s\x20name\x20rather\x20than\x20address\x20in\x20table\x20(the\x20SDK\x20auto-resolves);\x0a'+'3)\x20Perform\x20Guard\x20verification\x20tests\x20after\x20the\x20Host\x20Object\x20is\x20published;\x0a'+'4)\x20Use\x20guard2file\x20to\x20export\x20a\x20Guard\x20backup\x20for\x20restoring\x20references\x20during\x20rebuild','evidence':'Circular\x20reference:\x20identifier='+c['identifier']+',\x20object_type=\x22'+b+'\x22\x20→\x20'+a['scene']['host_object']};}},{'id':'R-X1-14','data_source_class':'cross_type','trigger':'Scene-specific\x20reentrancy:\x20Guard\x20pass\x20triggers\x20a\x20state-changing\x20side\x20effect\x20(fund\x20distribution,\x20vote\x20count,\x20Arb\x20creation)\x20that\x20does\x20NOT\x20naturally\x20invalidate\x20the\x20Guard\x20condition.\x20'+'Without\x20an\x20anti-reentrancy\x20primitive,\x20the\x20same\x20Signer\x20can\x20repeatedly\x20pass\x20the\x20Guard.\x20'+'Additionally\x20detects\x20pseudo-protection:\x20primitive\x20present\x20but\x20not\x20properly\x20wrapped\x20in\x20logic_not\x20(for\x20Bool\x20queries)\x20or\x20logic_equal(0)\x20(for\x20count\x20queries).','check':a=>{const b=REENTRANCY_SPECS['find'](f=>f['sceneId']===a['scene']?.['id']);if(!b)return null;const c=detectReentrancyProtection(a['root'],a['table'],b);if(c['state']==='protected')return null;if(c['state']==='pseudo')return{'id':'R-X1-14','data_source_class':'cross_type','level':'medium','category':'logic_gap','title':'Reentrancy\x20pseudo-protection:\x20anti-reentrancy\x20primitive\x20present\x20but\x20not\x20properly\x20wrapped\x20('+b['sceneId']+')','description':'Scene:\x20'+b['sceneId']+'\x0a'+('The\x20Guard\x20root\x20contains\x20an\x20anti-reentrancy\x20primitive\x20('+c['foundPrimitiveName']+'),\x20but\x20it\x20is\x20NOT\x20properly\x20wrapped.\x0a')+'Proper\x20wrapping\x20rules:\x0a'+'\x20\x20-\x20Bool-returning\x20primitives\x20(exists-style):\x20must\x20be\x20wrapped\x20in\x20logic_not\x0a'+'\x20\x20-\x20U64-returning\x20primitives\x20(count-style):\x20must\x20be\x20compared\x20to\x200\x20via\x20logic_equal\x0a'+'\x20\x20-\x20Address-returning\x20primitives:\x20must\x20be\x20wrapped\x20in\x20logic_not\x20(None\x20check)\x0a\x0a'+'WHY\x20THIS\x20IS\x20DANGEROUS:\x0a'+'\x20\x20The\x20developer\x20likely\x20intended\x20to\x20prevent\x20reentrancy\x20but\x20the\x20wrapping\x20is\x20incorrect,\x20'+'so\x20the\x20primitive\x20does\x20NOT\x20actually\x20block\x20repeated\x20Guard\x20passes.\x20This\x20is\x20arguably\x20MORE\x20'+'dangerous\x20than\x20absence\x20—\x20code\x20reviewers\x20see\x20the\x20primitive\x20and\x20assume\x20protection\x20is\x20in\x20place.\x0a\x0a'+('Scene\x20rationale:\x20'+b['rationale']),'affected_stakeholders':deriveStakeholders(b['sceneId']),'scenario':'Developer\x20added\x20anti-reentrancy\x20primitive\x20but\x20used\x20wrong\x20wrapping;\x20reentrancy\x20exploit\x20still\x20possible\x20in\x20'+b['sceneId'],'mitigation':'Fix\x20the\x20wrapping:\x0a'+'\x20\x20-\x20For\x20exists-style\x20(Bool)\x20primitives:\x20wrap\x20in\x20logic_not\x20—\x20{\x20type:\x20\x27logic_not\x27,\x20node:\x20{\x20type:\x20\x27query\x27,\x20query:\x20<primitive>,\x20...\x20}\x20}\x0a'+'\x20\x20-\x20For\x20count-style\x20(U64)\x20primitives:\x20compare\x20to\x200\x20—\x20{\x20type:\x20\x27logic_equal\x27,\x20nodes:\x20[\x20{\x20type:\x20\x27query\x27,\x20query:\x20<primitive>,\x20...\x20},\x20identifier(N)\x20]\x20}\x20where\x20table[N].value\x20=\x200\x0a'+'\x20\x20-\x20For\x20address-style\x20primitives:\x20wrap\x20in\x20logic_not\x20(None\x20check)\x0a'+'Then\x20wrap\x20the\x20protection\x20in\x20logic_and\x20with\x20the\x20existing\x20root\x20conditions.\x0a\x0a'+('Full\x20mitigation\x20for\x20'+b['sceneId']+':\x0a'+b['mitigation']),'evidence':c['evidence']};const d=b['level'],e=deriveStakeholders(b['sceneId']);return{'id':'R-X1-14','data_source_class':'cross_type','level':d,'category':'logic_gap','title':d==='low'?'Reentrancy\x20reminder:\x20'+b['sceneId']+'\x20has\x20no\x20anti-reentrancy\x20primitive\x20(LOW\x20risk)':'Reentrancy\x20risk:\x20'+b['sceneId']+'\x20has\x20NO\x20anti-reentrancy\x20protection\x20('+d['toUpperCase']()+')','description':'Scene:\x20'+b['sceneId']+'\x0a'+('Reentrancy\x20risk\x20level:\x20'+d['toUpperCase']()+'\x0a\x0a')+('RATIONALE:\x0a'+b['rationale']+'\x0a\x0a')+(c['evidence']?'DETECTION:\x0a'+c['evidence']+'\x0a\x0a':'')+(d==='critical'?'IMPACT:\x20Without\x20protection,\x20the\x20same\x20Signer\x20can\x20repeatedly\x20trigger\x20the\x20side\x20effect\x20(fund\x20distribution\x20/\x20vote\x20counting),\x20causing\x20direct\x20fund\x20loss\x20or\x20result\x20manipulation.\x20THIS\x20IS\x20A\x20CRITICAL\x20VULNERABILITY\x20—\x20the\x20Guard\x20MUST\x20be\x20rebuilt\x20with\x20an\x20anti-reentrancy\x20primitive\x20before\x20deployment.\x0a\x0a':d==='high'?'IMPACT:\x20Without\x20protection,\x20the\x20system\x20can\x20be\x20abused\x20(multiple\x20dispute\x20cases,\x20arbitration\x20harassment).\x20Strongly\x20recommended\x20to\x20add\x20protection.\x0a\x0a':'IMPACT:\x20Low\x20by\x20default;\x20only\x20relevant\x20if\x20business\x20intent\x20requires\x20single-action\x20enforcement.\x20Review\x20the\x20rationale\x20above.\x0a\x0a'),'affected_stakeholders':e,'scenario':d==='low'?b['sceneId']+'\x20lacks\x20anti-reentrancy\x20primitive;\x20may\x20or\x20may\x20not\x20be\x20needed\x20depending\x20on\x20business\x20intent':b['sceneId']+'\x20lacks\x20anti-reentrancy\x20primitive;\x20same\x20Signer\x20can\x20repeatedly\x20trigger\x20the\x20side\x20effect','mitigation':b['mitigation'],'evidence':c['evidence']};}},{'id':'R-X1-15','data_source_class':'cross_type','trigger':'Guard\x20root\x20contains\x20a\x20progress.current\x20query\x20(id=1253\x20or\x20name=\x27progress.current\x27);\x20'+'if\x20bound\x20to\x20a\x20forward\x20of\x20the\x20SAME\x20Progress\x20object,\x20the\x20guard\x20evaluates\x20before\x20state\x20transition','check':a=>{const b=extractQueryIds(a['root']);if(!b['includes'](0x4e5))return null;return{'id':'R-X1-15','data_source_class':'cross_type','level':'medium','category':'logic_gap','title':'Guard\x20queries\x20progress.current\x20—\x20verify\x20it\x20is\x20NOT\x20the\x20same\x20Progress\x20object\x20the\x20hosting\x20operation\x20mutates','description':'Cognitive\x20Principle\x20P1:\x20Guard\x20validation\x20ALWAYS\x20occurs\x20BEFORE\x20the\x20operation.\x20'+'This\x20Guard\x20contains\x20a\x20progress.current\x20query.\x20If\x20this\x20Guard\x20is\x20bound\x20to\x20a\x20forward\x20'+'of\x20the\x20SAME\x20Progress\x20object\x20it\x20queries,\x20the\x20Guard\x20will\x20see\x20the\x20PRE-transition\x20value\x20'+'(source\x20node,\x20not\x20target\x20node)\x20and\x20may\x20always\x20fail.\x20'+'Querying\x20a\x20DIFFERENT\x20Progress\x20object\x20(e.g.\x20another\x20Machine\x27s\x20progress)\x20is\x20a\x20valid\x20'+'and\x20reasonable\x20design\x20pattern\x20—\x20the\x20principle\x20does\x20not\x20apply\x20in\x20that\x20case.\x20'+'Allocator-bound\x20guards\x20are\x20also\x20unaffected\x20because\x20allocation.alloc()\x20runs\x20AFTER\x20'+'the\x20state\x20transition\x20completes.','affected_stakeholders':['provider'],'scenario':'Forward\x20guard\x20checks\x20progress.current\x20==\x20target_node\x20of\x20the\x20same\x20Progress\x20—\x20'+'always\x20fails\x20because\x20guard\x20runs\x20before\x20session_accomplish\x20sets\x20the\x20new\x20current\x20node','mitigation':'1)\x20If\x20this\x20Guard\x20queries\x20the\x20SAME\x20Progress\x20object\x20the\x20forward\x20operates\x20on:\x20'+'remove\x20the\x20guard\x20from\x20the\x20forward,\x20bind\x20it\x20ONLY\x20to\x20the\x20Allocator\x20(which\x20runs\x20after\x20transition);\x20'+'OR\x20change\x20the\x20check\x20to\x20verify\x20the\x20SOURCE\x20node\x20instead\x20of\x20the\x20target\x20node.\x20'+'2)\x20If\x20this\x20Guard\x20queries\x20a\x20DIFFERENT\x20Progress\x20object\x20(cross-machine):\x20no\x20action\x20needed\x20—\x20'+'this\x20is\x20a\x20legitimate\x20pattern.\x20'+'3)\x20Refer\x20to\x20GUARD_COGNITIVE_PRINCIPLES\x20P1\x20for\x20the\x20full\x20principle\x20and\x20code\x20evidence.','evidence':'Root\x20contains\x20progress.current\x20query\x20(id=1253).\x20'+('Query\x20IDs\x20detected:\x20['+b['join'](',\x20')+'].')};}}];function deriveStakeholders(a){switch(a){case'reward_guard':return['claimant','provider'];case'arbitration_voting_guard':return['customer','provider','arbitrator'];case'arbitration_usage_guard':return['customer','provider'];case'service_order_allocators_guard':return['customer','provider'];default:return['provider'];}}export function assessGuardRisks(a){const b={'table':a['table'],'root':a['root'],'rely':a['rely'],'scene':a['scene'],'operation_type':a['operation_type'],'sharing_recipients':a['sharing_recipients']},c=[];for(const i of RISK_RULES){try{const j=i['check'](b);if(j)c['push'](j);}catch{}}const d=getOverallRiskLevel(c),e={};for(const k of c){e[k['data_source_class']]=(e[k['data_source_class']]??0x0)+0x1;}const f=generateStakeholderAdvice(c,a['scene']),g=c['some'](l=>l['level']==='critical')||c['filter'](l=>l['level']==='high')['length']>=0x2,h=generateGuardSummary(a);return{'guard_summary':h,'scene':a['scene'],'risks':c,'overall_risk':d,'risks_by_data_source':e,'stakeholder_advice':f,'needs_human_review':g};}function getOverallRiskLevel(a){if(a['some'](b=>b['level']==='critical'))return'critical';if(a['some'](b=>b['level']==='high'))return'high';if(a['some'](b=>b['level']==='medium'))return'medium';return'low';}function generateStakeholderAdvice(a,b){const c={};for(const d of a){for(const e of d['affected_stakeholders']){if(!c[e])c[e]=[];c[e]['push']('['+d['level']['toUpperCase']()+']\x20'+d['title']+':\x20'+d['mitigation']);}}if(b)switch(b['binding_field']){case'buy_guard':if(!c['customer'])c['customer']=[];c['customer']['push']('Before\x20purchase,\x20verify\x20the\x20buy_guard\x20logic\x20to\x20ensure\x20your\x20identity/credentials\x20can\x20pass\x20validation');break;case'order_allocators':if(!c['provider'])c['provider']=[];c['provider']['push']('Verify\x20the\x20order_allocators\x20ordering\x20to\x20ensure\x20your\x20Allocator\x20will\x20not\x20be\x20skipped\x20by\x20preceding\x20conditions');break;case'voting_guard':if(!c['arbitrator'])c['arbitrator']=[];c['arbitrator']['push']('Confirm\x20the\x20voting\x20weight\x20source\x20is\x20trustworthy;\x20prefer\x20querying\x20EntityRegistrar\x20rather\x20than\x20user-submitted\x20data');break;case'Forward.guard':if(!c['customer'])c['customer']=[];c['customer']['push']('Verify\x20the\x20Forward.guard\x20conditions\x20to\x20ensure\x20you\x20can\x20satisfy\x20the\x20advancement\x20criteria\x20and\x20avoid\x20locked\x20funds');break;}return c;}function generateGuardSummary(a){const b=[];b['push']('table\x20entries:\x20'+a['table']['length']);const c=a['table']['filter'](d=>d['b_submission'])['length'];return b['push']('submitted\x20data:\x20'+c+'\x20entries'),b['push']('root\x20type:\x20'+(a['root']?.['type']??'unknown')),a['rely']&&b['push']('rely:\x20'+a['rely']['guards']['length']+'\x20dependencies\x20('+(a['rely']['logic_or']?'OR':'AND')+')'),b['join'](',\x20');}export function assessGuardRisksForOperation(a,b){if(a!=='guard')return null;const c=b?.['table']??[],d=b?.['root'],e=b?.['rely'];let f;return assessGuardRisks({'table':c,'root':d,'rely':e,'scene':f,'operation_type':a});}export function getRiskSummary(a){return{'risk_count':a['risks']['length'],'critical_count':a['risks']['filter'](b=>b['level']==='critical')['length'],'high_count':a['risks']['filter'](b=>b['level']==='high')['length'],'needs_human_review':a['needs_human_review'],'top_risks':a['risks']['filter'](b=>b['level']==='critical'||b['level']==='high')['slice'](0x0,0x3)['map'](b=>b['title'])};}export function getRiskRulesByDataSourceClass(a){return RISK_RULES['filter'](b=>b['data_source_class']===a);}export function getAllRiskRules(){return RISK_RULES;}export function getRiskRulesCount(){return RISK_RULES['length'];}