@wowok/agent-mcp 3.1.2 → 3.1.3

package/dist/knowledge/machine-risk.js

@@ -1 +1 @@
-import{USER_DEFINED_PERM_INDEX_START,MAX_NODE_COUNT}from'./onchain-constants.js';import{findUnachievableThresholds}from'./machine-topology.js';export const MACHINE_RISK_RULES=[{'id':'R-M1-01','name':'No\x20entry\x20point','category':'structural','severity':'critical','description':'Machine\x20has\x20no\x20Pair\x20with\x20prev_node=\x27\x27\x20(no\x20entry\x20point).\x20Workflow\x20cannot\x20start.','detection':'Check\x20if\x20any\x20pair\x20has\x20prev_node\x20===\x20\x27\x27','recommendation':'Add\x20at\x20least\x20one\x20Pair\x20with\x20prev_node=\x27\x27\x20to\x20serve\x20as\x20entry\x20point.','auto_fixable':![],'related_constraint':'MC-S-01'},{'id':'R-M1-02','name':'No\x20terminal\x20node','category':'structural','severity':'critical','description':'Machine\x20has\x20no\x20terminal\x20node\x20(all\x20nodes\x20have\x20outgoing\x20Pairs).\x20Workflow\x20never\x20completes.','detection':'Check\x20if\x20any\x20node\x20has\x20no\x20outgoing\x20Pair','recommendation':'Designate\x20at\x20least\x20one\x20node\x20as\x20terminal\x20(no\x20outgoing\x20Pair)\x20and\x20bind\x20Allocator\x20to\x20it.','auto_fixable':![],'related_constraint':'MC-S-02'},{'id':'R-M1-03','name':'Dead-end\x20node\x20(non-terminal)','category':'structural','severity':'medium','description':'Non-terminal\x20node\x20has\x20no\x20outgoing\x20Pair.\x20Workflow\x20stalls\x20at\x20this\x20node.','detection':'Find\x20nodes\x20with\x20no\x20outgoing\x20Pair\x20that\x20are\x20not\x20intended\x20terminals','recommendation':'Add\x20outgoing\x20Pair\x20or\x20designate\x20as\x20terminal\x20with\x20Allocator.','auto_fixable':![]},{'id':'R-M1-04','name':'Orphaned\x20node','category':'structural','severity':'high','description':'Node\x20has\x20no\x20incoming\x20Pair\x20(except\x20entry).\x20Unreachable.','detection':'Find\x20non-entry\x20nodes\x20with\x20no\x20incoming\x20Pair','recommendation':'Add\x20Pair\x20from\x20existing\x20node\x20to\x20this\x20orphaned\x20node,\x20or\x20remove\x20it.','auto_fixable':![],'related_constraint':'MC-S-03'},{'id':'R-M1-05','name':'Dead\x20branch\x20(competing\x20Pair\x20always\x20loses)','category':'structural','severity':'high','description':'A\x20competing\x20Pair\x27s\x20threshold\x20can\x20never\x20be\x20met\x20because\x20users\x20always\x20prefer\x20another\x20path.','detection':'Analyze\x20threshold\x20achievability\x20across\x20competing\x20Pairs','recommendation':'Make\x20thresholds\x20balanced,\x20or\x20remove\x20the\x20dead\x20branch.','auto_fixable':![],'related_constraint':'MC-S-04'},{'id':'R-M1-06','name':'Cycle\x20in\x20DAG','category':'structural','severity':'critical','description':'Workflow\x20has\x20a\x20cycle.\x20Nodes\x20reference\x20each\x20other\x20circularly.','detection':'DFS\x20cycle\x20detection','recommendation':'Break\x20the\x20cycle\x20by\x20removing\x20one\x20Pair.','auto_fixable':![],'related_constraint':'MC-S-05'},{'id':'R-M1-07','name':'Exceeds\x20MAX_NODE_COUNT\x20(100)','category':'structural','severity':'critical','description':'Node\x20count\x20exceeds\x20on-chain\x20limit.\x20Publish\x20will\x20fail.','detection':'nodes.length\x20>\x20'+MAX_NODE_COUNT,'recommendation':'Reduce\x20node\x20count\x20or\x20split\x20into\x20multiple\x20Machines.','auto_fixable':![],'related_constraint':'MC-C-01'},{'id':'R-M1-08','name':'Exceeds\x20MAX_NODE_PAIR_COUNT\x20(40)','category':'structural','severity':'high','description':'A\x20single\x20node\x27s\x20Pairs\x20exceed\x20on-chain\x20limit.\x20Publish\x20will\x20fail.','detection':'Find\x20node\x20where\x20pairs.length\x20>\x2040','recommendation':'Split\x20node\x20or\x20simplify\x20branches\x20to\x20reduce\x20Pair\x20count\x20per\x20node.','auto_fixable':![],'related_constraint':'MC-C-02'},{'id':'R-M1-09','name':'Exceeds\x20MAX_FORWARD_COUNT\x20(20)','category':'structural','severity':'high','description':'A\x20single\x20Pair\x27s\x20Forwards\x20exceed\x20on-chain\x20limit.\x20Publish\x20will\x20fail.','detection':'Find\x20Pair\x20where\x20forwards.length\x20>\x2020','recommendation':'Split\x20Pair\x20or\x20merge\x20Forwards\x20to\x20reduce\x20Forward\x20count\x20per\x20Pair.','auto_fixable':![],'related_constraint':'MC-C-03'},{'id':'R-M1-10','name':'Duplicate\x20node\x20name','category':'structural','severity':'critical','description':'Two\x20nodes\x20have\x20the\x20same\x20name.\x20On-chain\x20will\x20reject.','detection':'Find\x20duplicate\x20names\x20in\x20nodes\x20array','recommendation':'Rename\x20one\x20of\x20the\x20duplicates.','auto_fixable':![],'related_constraint':'MC-C-04'},{'id':'R-M1-11','name':'Dispute\x20anti-pattern\x20—\x20machine\x20illegally\x20models\x20dispute\x20flow','category':'structural','severity':'critical','description':'Machine\x20contains\x20nodes\x20named\x20\x27disputed\x27,\x20\x27refunded\x27,\x20\x27arb\x27,\x20\x27arbitration\x27,\x20'+'\x27dispute\x27,\x20or\x20\x27refund\x27.\x20This\x20is\x20a\x20CRITICAL\x20design\x20anti-pattern\x20because\x20'+'dispute\x20is\x20INDEPENDENT\x20of\x20the\x20machine\x20workflow.\x20Dispute\x20flows\x20through:\x20'+'Order\x20→\x20Arbitration.dispute()\x20→\x20Arb\x20object\x20→\x20arbitration()\x20ruling\x20→\x20'+'arb_withdraw\x20by\x20order\x20holder.\x20Arbitrators\x20are\x20configured\x20in\x20'+'Arbitration.voting_guard,\x20NOT\x20in\x20Permission.\x20Merchants\x20who\x20model\x20'+'dispute\x20in\x20the\x20machine\x20(e.g.,\x20\x27disputed\x20→\x20refunded\x27\x20forward\x20guarded\x20'+'by\x20Permission\x20index\x201500)\x20create\x20dead-end\x20paths\x20because\x20no\x20one\x20has\x20'+'Permission\x201500\x20—\x20arbitrators\x20are\x20NOT\x20Permission\x20holders.','detection':'Match\x20node\x20names\x20against\x20regex\x20/(^|_)(disputed?|refund(?:ed)?|arbitration|arb)(_|$)/i\x20'+'(catches\x20both\x20exact\x20names\x20like\x20\x27refunded\x27\x20and\x20compound\x20fund-flow\x20terminals\x20like\x20'+'\x27deposit_refunded\x27/\x27deposit_deducted\x27;\x20business\x20states\x20like\x20\x27return_approved\x27/'+'\x27damage_confirmed\x27/\x27cancelled\x27/\x27returned\x27\x20do\x20NOT\x20match)','recommendation':'Remove\x20all\x20dispute/refund\x20nodes\x20from\x20the\x20machine.\x20Instead:\x20(1)\x20bind\x20an\x20'+'Arbitration\x20object\x20to\x20the\x20Service\x20via\x20Service.arbitrations,\x20(2)\x20configure\x20'+'arbitrators\x20via\x20Arbitration.voting_guard_add,\x20(3)\x20deposit\x20compensation_fund\x20'+'to\x20the\x20Service.\x20Disputes\x20are\x20then\x20filed\x20via\x20arbitration::dispute(order,\x20'+'arbitration)\x20—\x20completely\x20independent\x20of\x20the\x20machine\x20workflow.','auto_fixable':![]},{'id':'R-M1-12','name':'Unreachable\x20threshold\x20—\x20Pair\x20can\x20never\x20migrate','category':'structural','severity':'critical','description':'A\x20Pair\x27s\x20threshold\x20exceeds\x20the\x20sum\x20of\x20its\x20forward\x20weights.\x20Each\x20forward\x20'+'contributes\x20its\x20weight\x20AT\x20MOST\x20ONCE:\x20it\x20is\x20locked\x20by\x20the\x20first\x20operator\x20that\x20'+'accomplishes\x20it\x20(progress.move\x20session_accomplish_imp),\x20and\x20a\x20second\x20operator\x20'+'re-executing\x20the\x20same\x20forward\x20aborts\x20E_NOT_THE_HOLDER.\x20The\x20maximum\x20achievable\x20'+'weight\x20of\x20a\x20Pair\x20is\x20therefore\x20the\x20sum\x20of\x20its\x20DISTINCT\x20forward\x20weights.\x20When\x20'+'that\x20sum\x20<\x20threshold,\x20the\x20transition\x20can\x20never\x20migrate\x20and\x20the\x20workflow\x20is\x20'+'permanently\x20stuck\x20at\x20this\x20node.','detection':'For\x20each\x20Pair\x20compute\x20sum(forward.weight)\x20and\x20compare\x20with\x20threshold;\x20flag\x20'+'Pairs\x20where\x20sum\x20<\x20threshold\x20(use\x20machine-topology\x20findUnachievableThresholds).','recommendation':'Raise\x20forward\x20weights\x20so\x20sum(weights)\x20>=\x20threshold,\x20or\x20lower\x20the\x20threshold.\x20'+'For\x20multi-operator\x20cooperation\x20add\x20one\x20DISTINCT\x20forward\x20per\x20contributing\x20'+'operator\x20(threshold\x20N\x20needs\x20N\x20distinct\x20forwards,\x20each\x20weight\x20≥\x201).','auto_fixable':![],'related_constraint':'MC-S-04'},{'id':'R-M1-13','name':'Single-forward\x20multi-operator\x20misuse\x20—\x20threshold\x20>\x201\x20with\x20too\x20few\x20forwards','category':'structural','severity':'high','description':'A\x20Pair\x20with\x20threshold\x20>\x201\x20has\x20fewer\x20distinct\x20forwards\x20than\x20the\x20threshold\x20'+'(with\x20weight-1\x20forwards,\x20or\x20a\x20single\x20forward\x20that\x20can\x20only\x20ever\x20be\x20accomplished\x20'+'by\x20ONE\x20operator).\x20Because\x20a\x20forward\x20is\x20single-operator-locked,\x20N\x20different\x20'+'people\x20cannot\x20all\x20\x27execute\x20the\x20same\x20forward\x27\x20—\x20each\x20contributor\x20needs\x20their\x20OWN\x20'+'forward\x20in\x20the\x20Pair.\x20This\x20either\x20makes\x20the\x20transition\x20unreachable\x20or\x20forces\x20a\x20'+'single\x20operator\x20to\x20control\x20multiple\x20forwards\x20(defeating\x20the\x20cooperation\x20design).','detection':'Flag\x20Pairs\x20where\x20threshold\x20>\x201\x20and\x20the\x20count\x20of\x20distinct\x20forwards\x20<\x20threshold\x20'+'(i.e.\x20threshold\x20cannot\x20be\x20met\x20by\x20that\x20many\x20different\x20operators).','recommendation':'Model\x20cooperation\x20with\x20parallel\x20forwards:\x20Pair\x20{\x20threshold:\x20N,\x20forwards:\x20['+'begin_a\x20(weight\x201,\x20operator\x20A),\x20begin_b\x20(weight\x201,\x20operator\x20B),\x20...]\x20}\x20—\x20one\x20'+'distinct\x20forward\x20per\x20contributing\x20operator.','auto_fixable':![],'related_constraint':'MC-S-04'},{'id':'R-M2-01','name':'Guard\x20not\x20created','category':'guard_integration','severity':'critical','description':'Forward\x20references\x20a\x20Guard\x20that\x20is\x20not\x20yet\x20created\x20on-chain.\x20Forward\x20execution\x20will\x20fail\x20Guard\x20verification.','detection':'Check\x20forward.guard\x20against\x20published_guards\x20set','recommendation':'Create\x20the\x20Guard\x20object\x20before\x20publishing\x20this\x20Machine.','auto_fixable':![],'related_constraint':'MC-C-09'},{'id':'R-M2-02','name':'Guard\x20not\x20tested\x20via\x20gen_passport','category':'guard_integration','severity':'high','description':'Guard\x20has\x20not\x20been\x20tested\x20via\x20gen_passport.\x20Guard\x20may\x20have\x20bugs,\x20cannot\x20be\x20fixed\x20after\x20publish.','detection':'Check\x20testnet\x20test\x20records\x20for\x20this\x20Guard','recommendation':'Run\x20gen_passport\x20on\x20testnet\x20before\x20binding\x20to\x20Machine.','auto_fixable':![]},{'id':'R-M2-03','name':'Guard\x20+\x20Machine\x20immutability\x20deadlock','category':'guard_integration','severity':'critical','description':'After\x20Machine\x20publish,\x20a\x20Guard\x20bug\x20is\x20discovered.\x20Guard\x20is\x20immutable\x20(cannot\x20be\x20fixed),\x20Machine\x20is\x20immutable\x20(cannot\x20be\x20rebound).','detection':'Verify\x20all\x20Guards\x20tested\x20before\x20Machine\x20publish','recommendation':'Keep\x20Machine\x20unpublished\x20until\x20all\x20Guards\x20are\x20verified.','auto_fixable':![]},{'id':'R-M2-04','name':'retained_submission\x20index\x20mismatch','category':'guard_integration','severity':'high','description':'Forward\x27s\x20retained_submission\x20key\x20does\x20not\x20correspond\x20to\x20Guard\x20table\x20b_submission=true\x20entry.\x20Retained\x20data\x20fails\x20or\x20is\x20incorrect.','detection':'Cross-check\x20forward.retained_submission\x20against\x20Guard\x20table\x20entries','recommendation':'Align\x20retained_submission\x20key\x20with\x20Guard\x20table\x20b_submission=true\x20identifier.','auto_fixable':!![],'related_constraint':'MC-C-11'},{'id':'R-M2-05','name':'Guard\x20reentry\x20risk','category':'guard_integration','severity':'high','description':'Guard\x20lacks\x20anti-reentry\x20mechanism\x20(see\x20Guard\x20R-X1-14).\x20Risk\x20of\x20duplicate\x20execution\x20or\x20vote\x20manipulation.','detection':'For\x20each\x20Guard\x20scene,\x20verify\x20anti-reentry\x20Guard\x20is\x20configured\x20(see\x20Guard\x20semantic\x20layer\x20R-X1-14)','recommendation':'Add\x20anti-reentry\x20Guard\x20for\x20each\x20scenario\x20(see\x20Guard\x20semantic\x20layer\x20R-X1-14).','auto_fixable':![]},{'id':'R-M2-06','name':'Guard\x20scene\x20mismatch','category':'guard_integration','severity':'medium','description':'Forward\x27s\x20bound\x20Guard\x20scene\x20does\x20not\x20match\x20Forward\x27s\x20business\x20(e.g.,\x20Forward\x20uses\x20reward_guard\x20instead\x20of\x20machine_forward_guard).','detection':'Cross-check\x20Guard\x20scene\x20against\x20Forward\x20business\x20purpose','recommendation':'Use\x20the\x20correct\x20Guard\x20scene\x20(machine_forward_guard).','auto_fixable':![]},{'id':'R-M2-07','name':'Cross-Machine\x20Guard\x20dependency\x20cycle','category':'guard_integration','severity':'critical','description':'Machine\x20A\x20depends\x20on\x20Machine\x20B\x20(via\x20Guard),\x20B\x20depends\x20on\x20A.\x20Circular\x20dependency.','detection':'Identify\x20cross-Machine\x20Guard\x20references\x20and\x20detect\x20cycles','recommendation':'Ensure\x20cross-Machine\x20dependencies\x20are\x20unidirectional.','auto_fixable':![]},{'id':'R-M2-08','name':'Guard\x20references\x20unpublished\x20object','category':'guard_integration','severity':'high','description':'Guard\x20table\x20references\x20an\x20object\x20(e.g.,\x20Service)\x20that\x20is\x20not\x20yet\x20published.','detection':'Cross-check\x20Guard\x20table\x20object\x20references\x20against\x20published\x20objects\x20set','recommendation':'Use\x20P16\x20circular\x20reference\x20pattern\x20(name\x20instead\x20of\x20address),\x20or\x20publish\x20referenced\x20objects\x20first.','auto_fixable':![]},{'id':'R-M3-01','name':'Forward\x20without\x20permission','category':'permission','severity':'critical','description':'Forward\x20has\x20neither\x20namedOperator\x20nor\x20permissionIndex.\x20Cannot\x20be\x20executed.','detection':'Check\x20each\x20forward\x20has\x20at\x20least\x20one\x20of\x20namedOperator\x20or\x20permissionIndex','recommendation':'Set\x20namedOperator=\x27\x27\x20for\x20OrderHolder,\x20or\x20set\x20permissionIndex.','auto_fixable':![],'related_constraint':'MC-C-07'},{'id':'R-M3-02','name':'permissionIndex\x20out\x20of\x20bounds','category':'permission','severity':'critical','description':'Forward\x27s\x20permissionIndex\x20>=\x20Permission.indices.length.\x20Execution\x20will\x20fail.','detection':'Check\x20permission_index\x20<\x20Permission.indices.length','recommendation':'Use\x20a\x20valid\x20permission\x20index\x20or\x20extend\x20Permission.indices.','auto_fixable':![],'related_constraint':'MC-C-08'},{'id':'R-M3-03','name':'Permission\x20rotation\x20failure','category':'permission','severity':'high','description':'Permission\x20object\x20updated,\x20indices\x20order\x20changed.\x20Original\x20permissionIndex\x20now\x20points\x20to\x20wrong\x20permission.','detection':'Detect\x20Permission\x20object\x20update\x20that\x20reorders\x20indices','recommendation':'Use\x20custom\x20Permission;\x20document\x20index\x20meanings;\x20avoid\x20frequent\x20Permission\x20updates.','auto_fixable':![]},{'id':'R-M3-04','name':'OrderHolder\x20misuse','category':'permission','severity':'medium','description':'namedOperator=\x27\x27\x20used\x20in\x20non-customer-operation\x20scenarios.\x20Non-intended\x20personnel\x20gain\x20operation\x20permission.','detection':'Find\x20Forwards\x20with\x20namedOperator=\x27\x27\x20on\x20non-customer-operation\x20nodes','recommendation':'Clarify\x20\x27\x27=OrderHolder\x20(customer),\x20not\x20\x27anyone\x27.\x20Use\x20namedOperator\x20for\x20specific\x20roles.','auto_fixable':![]},{'id':'R-M3-05','name':'NamedOperator\x20not\x20assigned\x20at\x20Progress\x20creation','category':'permission','severity':'high','description':'Forward\x20expects\x20namedOperator\x20role\x20but\x20Progress\x20doesn\x27t\x20have\x20it\x20assigned.\x20'+'Note:\x20MCP\x20API\x20layer\x20supports\x20progress_new.progress_namedOperator\x20(SDK\x20translates\x20to\x20namedOperator_add),\x20'+'but\x20Move\x20layer\x20progress::new\x20does\x20NOT\x20accept\x20it\x20(see\x2006\x20§14.5).','detection':'Verify\x20progress_namedOperator\x20is\x20provided\x20in\x20Progress\x20creation','recommendation':'Pass\x20progress_namedOperator\x20in\x20progress_new,\x20or\x20call\x20namedOperator_add\x20separately.','auto_fixable':![]},{'id':'R-M3-06','name':'Permission\x20game\x20imbalance','category':'permission','severity':'medium','description':'One\x20party\x20has\x20excessive\x20permission,\x20can\x20unilaterally\x20advance\x20workflow.\x20Game\x20theory\x20imbalance.','detection':'Analyze\x20permission\x20distribution\x20across\x20parties','recommendation':'Use\x20dual-signature\x20(threshold=2)\x20or\x20multi-signature\x20mechanism\x20to\x20balance\x20power.','auto_fixable':![]},{'id':'R-M3-07','name':'Permission\x20combination\x20OR\x20semantic\x20misuse','category':'permission','severity':'medium','description':'Both\x20namedOperator\x20and\x20permissionIndex\x20set,\x20but\x20OR\x20semantic\x20not\x20understood.\x20More\x20people\x20than\x20expected\x20can\x20execute\x20Forward.','detection':'Find\x20Forwards\x20with\x20both\x20namedOperator\x20and\x20permissionIndex\x20set','recommendation':'Clarify\x20that\x20when\x20both\x20permissions\x20are\x20non-null,\x20it\x20is\x20OR\x20relation\x20(either\x20can\x20execute).','auto_fixable':![]},{'id':'R-M3-08','name':'permissionIndex\x20below\x20USER_DEFINED_PERM_INDEX_START\x20(1000)','category':'permission','severity':'critical','description':'Forward\x27s\x20permissionIndex\x20<\x201000.\x20On-chain\x20constant\x20USER_DEFINED_PERM_INDEX_START\x20=\x201000\x20'+'in\x20permission.move\x20reserves\x20indexes\x200-999\x20for\x20built-in\x20permissions.\x20Using\x20index\x20<\x201000\x20'+'causes\x20confusion\x20with\x20built-in\x20permissions\x20and\x20is\x20a\x20hard\x20on-chain\x20constraint\x20(see\x20doc\x2006\x20§4.4).','detection':'Check\x20each\x20forward\x20with\x20permission_index\x20<\x201000','recommendation':'Use\x20permission_index\x20>=\x201000\x20(e.g.,\x201000,\x201001,\x201002,\x20...).\x20Reserve\x200-999\x20for\x20built-in\x20permissions.','auto_fixable':![],'related_constraint':'MC-C-08'},{'id':'R-M4-01','name':'No\x20backup\x20before\x20publish','category':'immutability','severity':'high','description':'machineNode2file\x20export\x20not\x20created\x20before\x20publish.\x20Cannot\x20restore\x20if\x20publish\x20fails.','detection':'Check\x20backup_created\x20flag','recommendation':'Run\x20machineNode2file\x20before\x20publish\x20to\x20create\x20backup.','auto_fixable':!![],'related_constraint':'MC-P-02'},{'id':'R-M4-02','name':'No\x20testnet\x20verification\x20before\x20mainnet','category':'immutability','severity':'medium','description':'Directly\x20publishing\x20to\x20mainnet\x20without\x20testnet\x20verification.\x20Potential\x20bugs\x20may\x20cause\x20fund\x20loss.','detection':'Check\x20network\x20===\x20\x27mainnet\x27\x20&&\x20!testnet_test_passed','recommendation':'Test\x20on\x20testnet\x20first.\x20Verify\x20Progress\x20runs\x20end-to-end.','auto_fixable':![],'related_constraint':'MC-P-03'},{'id':'R-M4-03','name':'Guards\x20not\x20all\x20created\x20before\x20publish','category':'immutability','severity':'critical','description':'Some\x20Forward.guard\x20is\x20still\x20null,\x20but\x20design\x20requires\x20Guard.\x20Cannot\x20add\x20Guard\x20after\x20publish\x20(immutability\x20deadlock).','detection':'Check\x20if\x20all\x20required\x20Guards\x20are\x20created\x20and\x20bound','recommendation':'Create\x20and\x20bind\x20all\x20Guards\x20before\x20publishing\x20Machine.','auto_fixable':![]},{'id':'R-M4-04','name':'Publish\x20order\x20incorrect','category':'immutability','severity':'critical','description':'Attempting\x20to\x20publish\x20Machine\x20before\x20creating\x20Guards.\x20Guards\x20cannot\x20bind\x20to\x20already-published\x20Machine.','detection':'Verify\x20dependency\x20order:\x20Permission\x20→\x20Machine(unpublished)\x20→\x20Guard\x20→\x20bind\x20→\x20publish','recommendation':'Follow\x20dependency\x20order:\x20Permission\x20→\x20Machine(unpublished)\x20→\x20Guard\x20→\x20bind\x20→\x20publish.','auto_fixable':![]},{'id':'R-M4-05','name':'Allocation\x20not\x20configured','category':'immutability','severity':'medium','description':'Terminal\x20node\x20not\x20mapped\x20to\x20Allocator.\x20Funds\x20cannot\x20be\x20distributed\x20after\x20workflow\x20completes.','detection':'Check\x20if\x20terminal\x20nodes\x20have\x20Allocator\x20mapping','recommendation':'Configure\x20Allocator\x20for\x20each\x20terminal\x20node.','auto_fixable':![]},{'id':'R-M4-06','name':'clear\x20operation\x20without\x20backup','category':'immutability','severity':'high','description':'Executing\x20node\x20clear\x20before\x20exporting\x20backup.\x20All\x20node\x20data\x20lost,\x20cannot\x20recover.','detection':'Check\x20if\x20machineNode2file\x20backup\x20created\x20before\x20clear\x20operation','recommendation':'Run\x20machineNode2file\x20backup\x20before\x20any\x20clear\x20operation.','auto_fixable':!![]},{'id':'R-M5-01','name':'Service\x20not\x20created','category':'environment','severity':'high','description':'Machine\x20design\x20complete\x20but\x20Service\x20not\x20created.\x20Machine\x20cannot\x20bind\x20to\x20Service.','detection':'Check\x20if\x20Service\x20object\x20is\x20in\x20published_services\x20set','recommendation':'Create\x20Service\x20first,\x20then\x20design/publish\x20Machine.','auto_fixable':![]},{'id':'R-M5-02','name':'Permission\x20object\x20mismatch','category':'environment','severity':'high','description':'Machine\x27s\x20Permission\x20differs\x20from\x20Service\x27s\x20Permission.\x20Permission\x20organization\x20inconsistent,\x20may\x20cause\x20operation\x20failure.','detection':'Cross-check\x20Machine\x27s\x20Permission\x20against\x20Service\x27s\x20Permission','recommendation':'Use\x20the\x20same\x20Permission\x20for\x20Machine\x20and\x20Service\x20(or\x20explicitly\x20document\x20different\x20organizations).','auto_fixable':![]},{'id':'R-M5-03','name':'Allocation\x20configuration\x20incomplete','category':'environment','severity':'high','description':'Service\x27s\x20order_allocators\x20not\x20configured\x20or\x20misconfigured.\x20Terminal\x20node\x20funds\x20cannot\x20be\x20distributed.','detection':'Check\x20if\x20Service.order_allocators\x20is\x20configured\x20for\x20each\x20terminal\x20node','recommendation':'Configure\x20Service.order_allocators,\x20one\x20Allocator\x20per\x20terminal\x20node.','auto_fixable':![]},{'id':'R-M5-04','name':'Reward\x20object\x20not\x20created','category':'environment','severity':'medium','description':'Reward\x20incentive\x20scenario\x20referenced\x20but\x20Reward\x20object\x20not\x20created.','detection':'Check\x20if\x20Reward\x20object\x20is\x20in\x20published_rewards\x20set','recommendation':'Create\x20Reward\x20object\x20first,\x20then\x20design\x20Guard.','auto_fixable':![]},{'id':'R-M5-05','name':'Arbitration\x20object\x20not\x20created','category':'environment','severity':'medium','description':'Arbitration\x20scenario\x20referenced\x20but\x20Arbitration\x20object\x20not\x20created.','detection':'Check\x20if\x20Arbitration\x20object\x20is\x20in\x20published_arbitrations\x20set','recommendation':'Create\x20Arbitration\x20object\x20first.','auto_fixable':![]},{'id':'R-M5-06','name':'Cross-Machine\x20dependency\x20not\x20published','category':'environment','severity':'critical','description':'Machine\x20A\x20depends\x20on\x20Machine\x20B,\x20but\x20B\x20is\x20not\x20published.\x20Guard\x20query\x20for\x20Machine\x20B\x27s\x20Progress\x20will\x20fail.\x20'+'Dependency\x20verification:\x20indirect\x20via\x20progress::new\x20->\x20assert_published\x20(see\x2006\x20§14.6).','detection':'Check\x20machine_ref\x20against\x20published_machines\x20set','recommendation':'Ensure\x20upstream\x20Machine\x20is\x20published\x20first.','auto_fixable':![]},{'id':'R-M5-07','name':'Repository\x20not\x20created','category':'environment','severity':'medium','description':'Guard\x20references\x20Repository\x20but\x20not\x20created.\x20Guard\x20query\x20will\x20fail.','detection':'Check\x20repository_ref\x20against\x20published\x20repositories\x20set','recommendation':'Create\x20and\x20publish\x20Repository\x20first.\x20Note:\x20consensus_repositories\x20is\x20declarative-only\x20(see\x2006\x20§14.4).','auto_fixable':![]},{'id':'R-M5-08','name':'Object\x20dependency\x20table\x20incomplete','category':'environment','severity':'low','description':'Project\x20object\x20dependency\x20table\x20missing\x20some\x20objects.\x20Design\x20decisions\x20based\x20on\x20incomplete\x20information.','detection':'Scan\x20project\x20environment\x20for\x20missing\x20object\x20references','recommendation':'Use\x20workflow-guidance.ts\x20to\x20scan\x20complete\x20project\x20environment.','auto_fixable':![]}];export function assessMachineRisks(a,b){const c=[];c['push'](...checkStructuralRisks(a)),c['push'](...checkGuardIntegrationRisks(a,b)),c['push'](...checkPermissionRisks(a)),c['push'](...checkImmutabilityRisks(a,b)),c['push'](...checkEnvironmentRisks(a,b));const d={'critical':c['filter'](g=>g['severity']==='critical')['length'],'high':c['filter'](g=>g['severity']==='high')['length'],'medium':c['filter'](g=>g['severity']==='medium')['length'],'low':c['filter'](g=>g['severity']==='low')['length']};let e='low';if(d['critical']>0x0)e='critical';else{if(d['high']>0x0)e='high';else{if(d['medium']>0x0)e='medium';else{if(d['low']>0x0)e='low';}}}let f;if(d['critical']>0x0)f='do_not_publish';else d['high']>0x2?f='fix_first':f='publish';return{'overall_level':e,'detected_risks':c,'summary':d,'recommendation':f};}function checkStructuralRisks(a){const b=[],c=a['pairs']['some'](m=>m['prev_node']==='');!c&&b['push'](makeRisk('R-M1-01','No\x20Pair\x20with\x20prev_node=\x27\x27\x20found.\x20Workflow\x20cannot\x20start.'));const d=new Set(a['pairs']['map'](m=>m['prev_node'])['filter'](m=>m!=='')),e=new Set(a['nodes']['map'](m=>m['name'])),f=[...e]['filter'](m=>!d['has'](m));f['length']===0x0&&b['push'](makeRisk('R-M1-02','No\x20terminal\x20node\x20found.\x20Workflow\x20never\x20completes.'));const g=new Set(a['pairs']['filter'](m=>m['prev_node']==='')['map'](m=>m['next_node'])),h=new Set(a['pairs']['map'](m=>m['prev_node'])['filter'](m=>m!==''));for(const m of a['nodes']){if(!g['has'](m['name'])&&!h['has'](m['name'])){const n=a['pairs']['some'](o=>o['next_node']===m['name']);!n&&b['push'](makeRisk('R-M1-04','Node\x20\x22'+m['name']+'\x22\x20is\x20orphaned\x20(no\x20incoming\x20Pair).'));}}a['nodes']['length']>MAX_NODE_COUNT&&b['push'](makeRisk('R-M1-07','Node\x20count\x20'+a['nodes']['length']+'\x20exceeds\x20MAX_NODE_COUNT\x20('+MAX_NODE_COUNT+').'));const i=new Map();for(const o of a['pairs']){i['set'](o['next_node'],(i['get'](o['next_node'])??0x0)+0x1);}for(const [q,r]of i){r>0x28&&b['push'](makeRisk('R-M1-08','Node\x20\x22'+q+'\x22\x20has\x20'+r+'\x20Pairs,\x20exceeds\x20MAX_NODE_PAIR_COUNT\x20(40).'));}for(const s of a['pairs']){s['forwards']['length']>0x14&&b['push'](makeRisk('R-M1-09','Pair\x20('+s['prev_node']+'\x20->\x20'+s['next_node']+')\x20has\x20'+s['forwards']['length']+'\x20Forwards,\x20exceeds\x20MAX_FORWARD_COUNT\x20(20).'));}const j=a['nodes']['map'](t=>t['name']),k=j['filter']((t,v)=>j['indexOf'](t)!==v);k['length']>0x0&&b['push'](makeRisk('R-M1-10','Duplicate\x20node\x20names:\x20'+[...new Set(k)]['join'](',\x20')));const l=findUnachievableThresholds(a['pairs']);for(const t of l){const v=t['threshold']>0x1&&t['distinct_forwards']<t['threshold'];b['push'](makeRisk(v?'R-M1-13':'R-M1-12','Pair\x20('+(t['prev_node']===''?'entry':t['prev_node'])+'\x20->\x20'+t['next_node']+'):\x20'+t['reason']));}return b;}function checkGuardIntegrationRisks(a,b){const c=[];for(const d of a['pairs']){for(const e of d['forwards']){e['guard']&&!b['published_guards']['has'](e['guard'])&&c['push'](makeRisk('R-M2-01','Forward\x20\x22'+e['name']+'\x22\x20references\x20Guard\x20\x22'+e['guard']+'\x22\x20not\x20in\x20published_guards.')),e['retained_submission']&&!e['guard']&&c['push'](makeRisk('R-M2-04','Forward\x20\x22'+e['name']+'\x22\x20has\x20retained_submission\x20but\x20no\x20Guard.\x20retained_submission\x20requires\x20a\x20Guard.'));}}return c;}function checkPermissionRisks(a){const b=[];for(const c of a['pairs']){for(const d of c['forwards']){const e=d['named_operator']!==undefined&&d['named_operator']!==null,f=d['permission_index']!==undefined&&d['permission_index']!==null;!e&&!f&&b['push'](makeRisk('R-M3-01','Forward\x20\x22'+d['name']+'\x22\x20in\x20Pair\x20('+c['prev_node']+'\x20->\x20'+c['next_node']+')\x20has\x20no\x20permission.'));}}for(const g of a['pairs']){for(const h of g['forwards']){const i=h['named_operator']!==undefined&&h['named_operator']!==null,j=h['permission_index']!==undefined&&h['permission_index']!==null;i&&j&&b['push'](makeRisk('R-M3-07','Forward\x20\x22'+h['name']+'\x22\x20in\x20Pair\x20('+g['prev_node']+'\x20->\x20'+g['next_node']+')\x20has\x20both\x20namedOperator\x20and\x20permissionIndex\x20(OR\x20semantic).'));}}for(const k of a['pairs']){for(const l of k['forwards']){l['permission_index']!==undefined&&l['permission_index']!==null&&l['permission_index']<USER_DEFINED_PERM_INDEX_START&&b['push'](makeRisk('R-M3-08','Forward\x20\x22'+l['name']+'\x22\x20in\x20Pair\x20('+k['prev_node']+'\x20->\x20'+k['next_node']+')\x20'+('has\x20permission_index='+l['permission_index']+'\x20<\x20'+USER_DEFINED_PERM_INDEX_START+'.\x20')+'Indexes\x200-999\x20are\x20reserved\x20for\x20built-in\x20permissions.'));}}return b;}function checkImmutabilityRisks(a,b){const c=[];b['network']==='mainnet'&&!b['testnet_test_passed']&&c['push'](makeRisk('R-M4-02','Mainnet\x20publish\x20attempted\x20without\x20testnet\x20test\x20passing.'));const d=new Set();for(const f of a['pairs']){for(const g of f['forwards']){if(g['guard'])d['add'](g['guard']);}}const e=[...d]['filter'](h=>!b['published_guards']['has'](h));return e['length']>0x0&&c['push'](makeRisk('R-M4-03','Guards\x20not\x20all\x20created\x20before\x20publish.\x20Missing:\x20'+e['join'](',\x20'))),c;}function checkEnvironmentRisks(a,b){const c=[],d=new Set();for(const f of a['pairs']){for(const g of f['forwards']){if(g['guard'])d['add'](g['guard']);}}const e=[...d]['filter'](h=>!b['published_guards']['has'](h));return e['length']>0x0&&c['push'](makeRisk('R-M5-08','Object\x20dependency\x20table\x20incomplete.\x20Missing\x20Guards:\x20'+e['join'](',\x20'))),c;}function makeRisk(a,b){const c=MACHINE_RISK_RULES['find'](d=>d['id']===a);if(!c)return{'rule_id':a,'name':'Unknown','severity':'low','detail':b,'recommendation':'Investigate\x20manually.','auto_fixable':![]};return{'rule_id':c['id'],'name':c['name'],'severity':c['severity'],'detail':b,'recommendation':c['recommendation'],'auto_fixable':c['auto_fixable']};}export function getRiskRulesByCategory(a){return MACHINE_RISK_RULES['filter'](b=>b['category']===a);}export function getRiskRuleById(a){return MACHINE_RISK_RULES['find'](b=>b['id']===a);}export function getRiskRulesBySeverity(a){return MACHINE_RISK_RULES['filter'](b=>b['severity']===a);}export function getAutoFixableRules(){return MACHINE_RISK_RULES['filter'](a=>a['auto_fixable']);}export function getRiskSummary(a){const b=['Overall\x20Risk\x20Level:\x20'+a['overall_level']['toUpperCase'](),'Recommendation:\x20'+a['recommendation'],'','Summary:','\x20\x20Critical:\x20'+a['summary']['critical'],'\x20\x20High:\x20\x20\x20\x20\x20'+a['summary']['high'],'\x20\x20Medium:\x20\x20\x20'+a['summary']['medium'],'\x20\x20Low:\x20\x20\x20\x20\x20\x20'+a['summary']['low'],'','Detected\x20Risks:'];for(const c of a['detected_risks']){b['push']('\x20\x20['+c['severity']['toUpperCase']()+']\x20'+c['rule_id']+':\x20'+c['name']),b['push']('\x20\x20\x20\x20Detail:\x20'+c['detail']),b['push']('\x20\x20\x20\x20Fix:\x20'+c['recommendation']);}return b['join']('\x0a');}export const MACHINE_RISK_VERSION='1.0.0';export const MACHINE_RISK_RULES_COUNT=MACHINE_RISK_RULES['length'];
+import{USER_DEFINED_PERM_INDEX_START,MAX_NODE_COUNT}from'./onchain-constants.js';import{findUnachievableThresholds}from'./machine-topology.js';export const MACHINE_RISK_RULES=[{'id':'R-M1-01','name':'No\x20entry\x20point','category':'structural','severity':'critical','description':'Machine\x20has\x20no\x20Pair\x20with\x20prev_node=\x27\x27\x20(no\x20entry\x20point).\x20Workflow\x20cannot\x20start.','detection':'Check\x20if\x20any\x20pair\x20has\x20prev_node\x20===\x20\x27\x27','recommendation':'Add\x20at\x20least\x20one\x20Pair\x20with\x20prev_node=\x27\x27\x20to\x20serve\x20as\x20entry\x20point.','auto_fixable':![],'related_constraint':'MC-S-01'},{'id':'R-M1-02','name':'No\x20terminal\x20node','category':'structural','severity':'critical','description':'Machine\x20has\x20no\x20terminal\x20node\x20(all\x20nodes\x20have\x20outgoing\x20Pairs).\x20Workflow\x20never\x20completes.','detection':'Check\x20if\x20any\x20node\x20has\x20no\x20outgoing\x20Pair','recommendation':'Designate\x20at\x20least\x20one\x20node\x20as\x20terminal\x20(no\x20outgoing\x20Pair)\x20and\x20bind\x20Allocator\x20to\x20it.','auto_fixable':![],'related_constraint':'MC-S-02'},{'id':'R-M1-03','name':'Dead-end\x20node\x20(non-terminal)','category':'structural','severity':'medium','description':'Non-terminal\x20node\x20has\x20no\x20outgoing\x20Pair.\x20Workflow\x20stalls\x20at\x20this\x20node.','detection':'Find\x20nodes\x20with\x20no\x20outgoing\x20Pair\x20that\x20are\x20not\x20intended\x20terminals','recommendation':'Add\x20outgoing\x20Pair\x20or\x20designate\x20as\x20terminal\x20with\x20Allocator.','auto_fixable':![]},{'id':'R-M1-04','name':'Orphaned\x20node','category':'structural','severity':'high','description':'Node\x20has\x20no\x20incoming\x20Pair\x20(except\x20entry).\x20Unreachable.','detection':'Find\x20non-entry\x20nodes\x20with\x20no\x20incoming\x20Pair','recommendation':'Add\x20Pair\x20from\x20existing\x20node\x20to\x20this\x20orphaned\x20node,\x20or\x20remove\x20it.','auto_fixable':![],'related_constraint':'MC-S-03'},{'id':'R-M1-05','name':'Dead\x20branch\x20(competing\x20Pair\x20always\x20loses)','category':'structural','severity':'high','description':'A\x20competing\x20Pair\x27s\x20threshold\x20can\x20never\x20be\x20met\x20because\x20users\x20always\x20prefer\x20another\x20path.','detection':'Analyze\x20threshold\x20achievability\x20across\x20competing\x20Pairs','recommendation':'Make\x20thresholds\x20balanced,\x20or\x20remove\x20the\x20dead\x20branch.','auto_fixable':![],'related_constraint':'MC-S-04'},{'id':'R-M1-06','name':'Cycle\x20in\x20DAG','category':'structural','severity':'critical','description':'Workflow\x20has\x20a\x20cycle.\x20Nodes\x20reference\x20each\x20other\x20circularly.','detection':'DFS\x20cycle\x20detection','recommendation':'Break\x20the\x20cycle\x20by\x20removing\x20one\x20Pair.','auto_fixable':![],'related_constraint':'MC-S-05'},{'id':'R-M1-07','name':'Exceeds\x20MAX_NODE_COUNT\x20(100)','category':'structural','severity':'critical','description':'Node\x20count\x20exceeds\x20on-chain\x20limit.\x20Publish\x20will\x20fail.','detection':'nodes.length\x20>\x20'+MAX_NODE_COUNT,'recommendation':'Reduce\x20node\x20count\x20or\x20split\x20into\x20multiple\x20Machines.','auto_fixable':![],'related_constraint':'MC-C-01'},{'id':'R-M1-08','name':'Exceeds\x20MAX_NODE_PAIR_COUNT\x20(40)','category':'structural','severity':'high','description':'A\x20single\x20node\x27s\x20Pairs\x20exceed\x20on-chain\x20limit.\x20Publish\x20will\x20fail.','detection':'Find\x20node\x20where\x20pairs.length\x20>\x2040','recommendation':'Split\x20node\x20or\x20simplify\x20branches\x20to\x20reduce\x20Pair\x20count\x20per\x20node.','auto_fixable':![],'related_constraint':'MC-C-02'},{'id':'R-M1-09','name':'Exceeds\x20MAX_FORWARD_COUNT\x20(20)','category':'structural','severity':'high','description':'A\x20single\x20Pair\x27s\x20Forwards\x20exceed\x20on-chain\x20limit.\x20Publish\x20will\x20fail.','detection':'Find\x20Pair\x20where\x20forwards.length\x20>\x2020','recommendation':'Split\x20Pair\x20or\x20merge\x20Forwards\x20to\x20reduce\x20Forward\x20count\x20per\x20Pair.','auto_fixable':![],'related_constraint':'MC-C-03'},{'id':'R-M1-10','name':'Duplicate\x20node\x20name','category':'structural','severity':'critical','description':'Two\x20nodes\x20have\x20the\x20same\x20name.\x20On-chain\x20will\x20reject.','detection':'Find\x20duplicate\x20names\x20in\x20nodes\x20array','recommendation':'Rename\x20one\x20of\x20the\x20duplicates.','auto_fixable':![],'related_constraint':'MC-C-04'},{'id':'R-M1-11','name':'Dispute\x20anti-pattern\x20—\x20machine\x20illegally\x20models\x20dispute\x20flow','category':'structural','severity':'critical','description':'Machine\x20contains\x20nodes\x20named\x20\x27disputed\x27,\x20\x27refunded\x27,\x20\x27arb\x27,\x20\x27arbitration\x27,\x20'+'\x27dispute\x27,\x20or\x20\x27refund\x27.\x20This\x20is\x20a\x20CRITICAL\x20design\x20anti-pattern\x20because\x20'+'dispute\x20is\x20INDEPENDENT\x20of\x20the\x20machine\x20workflow.\x20Dispute\x20flows\x20through:\x20'+'Order\x20→\x20Arbitration.dispute()\x20→\x20Arb\x20object\x20→\x20arbitration()\x20ruling\x20→\x20'+'arb_withdraw\x20by\x20order\x20holder.\x20Arbitrators\x20are\x20configured\x20in\x20'+'Arbitration.voting_guard,\x20NOT\x20in\x20Permission.\x20Merchants\x20who\x20model\x20'+'dispute\x20in\x20the\x20machine\x20(e.g.,\x20\x27disputed\x20→\x20refunded\x27\x20forward\x20guarded\x20'+'by\x20Permission\x20index\x201500)\x20create\x20dead-end\x20paths\x20because\x20no\x20one\x20has\x20'+'Permission\x201500\x20—\x20arbitrators\x20are\x20NOT\x20Permission\x20holders.','detection':'Match\x20node\x20names\x20against\x20regex\x20/(^|_)(disputed?|refund(?:ed)?|arbitration|arb)(_|$)/i\x20'+'(catches\x20both\x20exact\x20names\x20like\x20\x27refunded\x27\x20and\x20compound\x20fund-flow\x20terminals\x20like\x20'+'\x27deposit_refunded\x27/\x27deposit_deducted\x27;\x20business\x20states\x20like\x20\x27return_approved\x27/'+'\x27damage_confirmed\x27/\x27cancelled\x27/\x27returned\x27\x20do\x20NOT\x20match)','recommendation':'Remove\x20all\x20dispute/refund\x20nodes\x20from\x20the\x20machine.\x20Instead:\x20(1)\x20bind\x20an\x20'+'Arbitration\x20object\x20to\x20the\x20Service\x20via\x20Service.arbitrations,\x20(2)\x20configure\x20'+'arbitrators\x20via\x20Arbitration.voting_guard_add,\x20(3)\x20deposit\x20compensation_fund\x20'+'to\x20the\x20Service.\x20Disputes\x20are\x20then\x20filed\x20via\x20arbitration::dispute(order,\x20'+'arbitration)\x20—\x20completely\x20independent\x20of\x20the\x20machine\x20workflow.','auto_fixable':![]},{'id':'R-M1-12','name':'Unreachable\x20threshold\x20—\x20Pair\x20can\x20never\x20migrate','category':'structural','severity':'critical','description':'A\x20Pair\x27s\x20threshold\x20exceeds\x20the\x20sum\x20of\x20its\x20forward\x20weights.\x20Each\x20forward\x20'+'contributes\x20its\x20weight\x20AT\x20MOST\x20ONCE:\x20it\x20is\x20locked\x20by\x20the\x20first\x20operator\x20that\x20'+'accomplishes\x20it\x20(progress.move\x20session_accomplish_imp),\x20and\x20a\x20second\x20operator\x20'+'re-executing\x20the\x20same\x20forward\x20aborts\x20E_NOT_THE_HOLDER.\x20The\x20maximum\x20achievable\x20'+'weight\x20of\x20a\x20Pair\x20is\x20therefore\x20the\x20sum\x20of\x20its\x20DISTINCT\x20forward\x20weights.\x20When\x20'+'that\x20sum\x20<\x20threshold,\x20the\x20transition\x20can\x20never\x20migrate\x20and\x20the\x20workflow\x20is\x20'+'permanently\x20stuck\x20at\x20this\x20node.','detection':'For\x20each\x20Pair\x20compute\x20sum(forward.weight)\x20and\x20compare\x20with\x20threshold;\x20flag\x20'+'Pairs\x20where\x20sum\x20<\x20threshold\x20(use\x20machine-topology\x20findUnachievableThresholds).','recommendation':'Raise\x20forward\x20weights\x20so\x20sum(weights)\x20>=\x20threshold,\x20or\x20lower\x20the\x20threshold.\x20'+'For\x20multi-operator\x20cooperation\x20add\x20one\x20DISTINCT\x20forward\x20per\x20contributing\x20'+'operator\x20(threshold\x20N\x20needs\x20N\x20distinct\x20forwards,\x20each\x20weight\x20≥\x201).','auto_fixable':![],'related_constraint':'MC-S-04'},{'id':'R-M1-13','name':'Single-forward\x20multi-operator\x20misuse\x20—\x20threshold\x20>\x201\x20with\x20too\x20few\x20forwards','category':'structural','severity':'high','description':'A\x20Pair\x20with\x20threshold\x20>\x201\x20has\x20fewer\x20distinct\x20forwards\x20than\x20the\x20threshold\x20'+'(with\x20weight-1\x20forwards,\x20or\x20a\x20single\x20forward\x20that\x20can\x20only\x20ever\x20be\x20accomplished\x20'+'by\x20ONE\x20operator).\x20Because\x20a\x20forward\x20is\x20single-operator-locked,\x20N\x20different\x20'+'people\x20cannot\x20all\x20\x27execute\x20the\x20same\x20forward\x27\x20—\x20each\x20contributor\x20needs\x20their\x20OWN\x20'+'forward\x20in\x20the\x20Pair.\x20This\x20either\x20makes\x20the\x20transition\x20unreachable\x20or\x20forces\x20a\x20'+'single\x20operator\x20to\x20control\x20multiple\x20forwards\x20(defeating\x20the\x20cooperation\x20design).','detection':'Flag\x20Pairs\x20where\x20threshold\x20>\x201\x20and\x20the\x20count\x20of\x20distinct\x20forwards\x20<\x20threshold\x20'+'(i.e.\x20threshold\x20cannot\x20be\x20met\x20by\x20that\x20many\x20different\x20operators).','recommendation':'Model\x20cooperation\x20with\x20parallel\x20forwards:\x20Pair\x20{\x20threshold:\x20N,\x20forwards:\x20['+'begin_a\x20(weight\x201,\x20operator\x20A),\x20begin_b\x20(weight\x201,\x20operator\x20B),\x20...]\x20}\x20—\x20one\x20'+'distinct\x20forward\x20per\x20contributing\x20operator.','auto_fixable':![],'related_constraint':'MC-S-04'},{'id':'R-M2-01','name':'Guard\x20not\x20created','category':'guard_integration','severity':'critical','description':'Forward\x20references\x20a\x20Guard\x20that\x20is\x20not\x20yet\x20created\x20on-chain.\x20Forward\x20execution\x20will\x20fail\x20Guard\x20verification.','detection':'Check\x20forward.guard\x20against\x20published_guards\x20set','recommendation':'Create\x20the\x20Guard\x20object\x20before\x20publishing\x20this\x20Machine.','auto_fixable':![],'related_constraint':'MC-C-09'},{'id':'R-M2-02','name':'Guard\x20not\x20tested\x20via\x20gen_passport','category':'guard_integration','severity':'high','description':'Guard\x20has\x20not\x20been\x20tested\x20via\x20gen_passport.\x20Guard\x20may\x20have\x20bugs,\x20cannot\x20be\x20fixed\x20after\x20publish.','detection':'Check\x20testnet\x20test\x20records\x20for\x20this\x20Guard','recommendation':'Run\x20gen_passport\x20on\x20testnet\x20before\x20binding\x20to\x20Machine.','auto_fixable':![]},{'id':'R-M2-03','name':'Guard\x20+\x20Machine\x20immutability\x20deadlock','category':'guard_integration','severity':'critical','description':'After\x20Machine\x20publish,\x20a\x20Guard\x20bug\x20is\x20discovered.\x20Guard\x20is\x20immutable\x20(cannot\x20be\x20fixed),\x20Machine\x20is\x20immutable\x20(cannot\x20be\x20rebound).','detection':'Verify\x20all\x20Guards\x20tested\x20before\x20Machine\x20publish','recommendation':'Keep\x20Machine\x20unpublished\x20until\x20all\x20Guards\x20are\x20verified.','auto_fixable':![]},{'id':'R-M2-04','name':'retained_submission\x20index\x20mismatch','category':'guard_integration','severity':'high','description':'Forward\x27s\x20retained_submission\x20key\x20does\x20not\x20correspond\x20to\x20Guard\x20table\x20b_submission=true\x20entry.\x20Retained\x20data\x20fails\x20or\x20is\x20incorrect.','detection':'Cross-check\x20forward.retained_submission\x20against\x20Guard\x20table\x20entries','recommendation':'Align\x20retained_submission\x20key\x20with\x20Guard\x20table\x20b_submission=true\x20identifier.','auto_fixable':!![],'related_constraint':'MC-C-11'},{'id':'R-M2-05','name':'Guard\x20reentry\x20risk','category':'guard_integration','severity':'high','description':'Guard\x20lacks\x20anti-reentry\x20mechanism\x20(see\x20Guard\x20R-X1-14).\x20Risk\x20of\x20duplicate\x20execution\x20or\x20vote\x20manipulation.','detection':'For\x20each\x20Guard\x20scene,\x20verify\x20anti-reentry\x20Guard\x20is\x20configured\x20(see\x20Guard\x20semantic\x20layer\x20R-X1-14)','recommendation':'Add\x20anti-reentry\x20Guard\x20for\x20each\x20scenario\x20(see\x20Guard\x20semantic\x20layer\x20R-X1-14).','auto_fixable':![]},{'id':'R-M2-06','name':'Guard\x20scene\x20mismatch','category':'guard_integration','severity':'medium','description':'Forward\x27s\x20bound\x20Guard\x20scene\x20does\x20not\x20match\x20Forward\x27s\x20business\x20(e.g.,\x20Forward\x20uses\x20reward_guard\x20instead\x20of\x20machine_forward_guard).','detection':'Cross-check\x20Guard\x20scene\x20against\x20Forward\x20business\x20purpose','recommendation':'Use\x20the\x20correct\x20Guard\x20scene\x20(machine_forward_guard).','auto_fixable':![]},{'id':'R-M2-07','name':'Cross-Machine\x20Guard\x20dependency\x20cycle','category':'guard_integration','severity':'critical','description':'Machine\x20A\x20depends\x20on\x20Machine\x20B\x20(via\x20Guard),\x20B\x20depends\x20on\x20A.\x20Circular\x20dependency.','detection':'Identify\x20cross-Machine\x20Guard\x20references\x20and\x20detect\x20cycles','recommendation':'Ensure\x20cross-Machine\x20dependencies\x20are\x20unidirectional.','auto_fixable':![]},{'id':'R-M2-08','name':'Guard\x20references\x20unpublished\x20object','category':'guard_integration','severity':'high','description':'Guard\x20table\x20references\x20an\x20object\x20(e.g.,\x20Service)\x20that\x20is\x20not\x20yet\x20published.','detection':'Cross-check\x20Guard\x20table\x20object\x20references\x20against\x20published\x20objects\x20set','recommendation':'Use\x20P16\x20circular\x20reference\x20pattern\x20(name\x20instead\x20of\x20address),\x20or\x20publish\x20referenced\x20objects\x20first.','auto_fixable':![]},{'id':'R-M3-01','name':'Forward\x20without\x20permission','category':'permission','severity':'critical','description':'Forward\x20has\x20neither\x20namedOperator\x20nor\x20permissionIndex.\x20Cannot\x20be\x20executed.','detection':'Check\x20each\x20forward\x20has\x20at\x20least\x20one\x20of\x20namedOperator\x20or\x20permissionIndex','recommendation':'Set\x20namedOperator=\x27\x27\x20for\x20OrderHolder,\x20or\x20set\x20permissionIndex.','auto_fixable':![],'related_constraint':'MC-C-07'},{'id':'R-M3-02','name':'permissionIndex\x20out\x20of\x20bounds','category':'permission','severity':'critical','description':'Forward\x27s\x20permissionIndex\x20>=\x20Permission.indices.length.\x20Execution\x20will\x20fail.','detection':'Check\x20permission_index\x20<\x20Permission.indices.length','recommendation':'Use\x20a\x20valid\x20permission\x20index\x20or\x20extend\x20Permission.indices.','auto_fixable':![],'related_constraint':'MC-C-08'},{'id':'R-M3-03','name':'Permission\x20rotation\x20failure','category':'permission','severity':'high','description':'Permission\x20object\x20updated,\x20indices\x20order\x20changed.\x20Original\x20permissionIndex\x20now\x20points\x20to\x20wrong\x20permission.','detection':'Detect\x20Permission\x20object\x20update\x20that\x20reorders\x20indices','recommendation':'Use\x20custom\x20Permission;\x20document\x20index\x20meanings;\x20avoid\x20frequent\x20Permission\x20updates.','auto_fixable':![]},{'id':'R-M3-04','name':'OrderHolder\x20misuse','category':'permission','severity':'medium','description':'namedOperator=\x27\x27\x20used\x20in\x20non-customer-operation\x20scenarios.\x20Non-intended\x20personnel\x20gain\x20operation\x20permission.','detection':'Find\x20Forwards\x20with\x20namedOperator=\x27\x27\x20on\x20non-customer-operation\x20nodes','recommendation':'Clarify\x20\x27\x27=OrderHolder\x20(customer),\x20not\x20\x27anyone\x27.\x20Use\x20namedOperator\x20for\x20specific\x20roles.','auto_fixable':![]},{'id':'R-M3-05','name':'NamedOperator\x20not\x20assigned\x20at\x20Progress\x20creation','category':'permission','severity':'high','description':'Forward\x20expects\x20namedOperator\x20role\x20but\x20Progress\x20doesn\x27t\x20have\x20it\x20assigned.\x20'+'Note:\x20MCP\x20API\x20layer\x20supports\x20progress_new.progress_namedOperator\x20(SDK\x20translates\x20to\x20namedOperator_add),\x20'+'but\x20Move\x20layer\x20progress::new\x20does\x20NOT\x20accept\x20it\x20(see\x2006\x20§14.5).','detection':'Verify\x20progress_namedOperator\x20is\x20provided\x20in\x20Progress\x20creation','recommendation':'Pass\x20progress_namedOperator\x20in\x20progress_new,\x20or\x20call\x20namedOperator_add\x20separately.','auto_fixable':![]},{'id':'R-M3-06','name':'Permission\x20game\x20imbalance','category':'permission','severity':'medium','description':'One\x20party\x20has\x20excessive\x20permission,\x20can\x20unilaterally\x20advance\x20workflow.\x20Game\x20theory\x20imbalance.','detection':'Analyze\x20permission\x20distribution\x20across\x20parties','recommendation':'Use\x20dual-signature\x20(threshold=2)\x20or\x20multi-signature\x20mechanism\x20to\x20balance\x20power.','auto_fixable':![]},{'id':'R-M3-07','name':'Permission\x20combination\x20OR\x20semantic\x20misuse','category':'permission','severity':'medium','description':'Both\x20namedOperator\x20and\x20permissionIndex\x20set,\x20but\x20OR\x20semantic\x20not\x20understood.\x20More\x20people\x20than\x20expected\x20can\x20execute\x20Forward.','detection':'Find\x20Forwards\x20with\x20both\x20namedOperator\x20and\x20permissionIndex\x20set','recommendation':'Clarify\x20that\x20when\x20both\x20permissions\x20are\x20non-null,\x20it\x20is\x20OR\x20relation\x20(either\x20can\x20execute).','auto_fixable':![]},{'id':'R-M3-08','name':'permissionIndex\x20below\x20USER_DEFINED_PERM_INDEX_START\x20(1000)','category':'permission','severity':'critical','description':'Forward\x27s\x20permissionIndex\x20<\x201000.\x20On-chain\x20constant\x20USER_DEFINED_PERM_INDEX_START\x20=\x201000\x20'+'in\x20permission.move\x20reserves\x20indexes\x200-999\x20for\x20built-in\x20permissions.\x20Using\x20index\x20<\x201000\x20'+'causes\x20confusion\x20with\x20built-in\x20permissions\x20and\x20is\x20a\x20hard\x20on-chain\x20constraint\x20(see\x20doc\x2006\x20§4.4).','detection':'Check\x20each\x20forward\x20with\x20permission_index\x20<\x201000','recommendation':'Use\x20permission_index\x20>=\x201000\x20(e.g.,\x201000,\x201001,\x201002,\x20...).\x20Reserve\x200-999\x20for\x20built-in\x20permissions.','auto_fixable':![],'related_constraint':'MC-C-08'},{'id':'R-M4-01','name':'No\x20backup\x20before\x20publish','category':'immutability','severity':'high','description':'machineNode2file\x20export\x20not\x20created\x20before\x20publish.\x20Cannot\x20restore\x20if\x20publish\x20fails.','detection':'Check\x20backup_created\x20flag','recommendation':'Run\x20machineNode2file\x20before\x20publish\x20to\x20create\x20backup.','auto_fixable':!![],'related_constraint':'MC-P-02'},{'id':'R-M4-02','name':'No\x20testnet\x20verification\x20before\x20mainnet','category':'immutability','severity':'medium','description':'Directly\x20publishing\x20to\x20mainnet\x20without\x20testnet\x20verification.\x20Potential\x20bugs\x20may\x20cause\x20fund\x20loss.','detection':'Check\x20network\x20===\x20\x27mainnet\x27\x20&&\x20!testnet_test_passed','recommendation':'Test\x20on\x20testnet\x20first.\x20Verify\x20Progress\x20runs\x20end-to-end.','auto_fixable':![],'related_constraint':'MC-P-03'},{'id':'R-M4-03','name':'Guards\x20not\x20all\x20created\x20before\x20publish','category':'immutability','severity':'critical','description':'Some\x20Forward.guard\x20is\x20still\x20null,\x20but\x20design\x20requires\x20Guard.\x20Cannot\x20add\x20Guard\x20after\x20publish\x20(immutability\x20deadlock).','detection':'Check\x20if\x20all\x20required\x20Guards\x20are\x20created\x20and\x20bound','recommendation':'Create\x20and\x20bind\x20all\x20Guards\x20before\x20publishing\x20Machine.','auto_fixable':![]},{'id':'R-M4-04','name':'Publish\x20order\x20incorrect','category':'immutability','severity':'critical','description':'Attempting\x20to\x20publish\x20Machine\x20before\x20creating\x20Guards.\x20Guards\x20cannot\x20bind\x20to\x20already-published\x20Machine.','detection':'Verify\x20dependency\x20order:\x20Permission\x20→\x20Machine(unpublished)\x20→\x20Guard\x20→\x20bind\x20→\x20publish','recommendation':'Follow\x20dependency\x20order:\x20Permission\x20→\x20Machine(unpublished)\x20→\x20Guard\x20→\x20bind\x20→\x20publish.','auto_fixable':![]},{'id':'R-M4-05','name':'Allocation\x20not\x20configured','category':'immutability','severity':'medium','description':'Terminal\x20node\x20not\x20mapped\x20to\x20Allocator.\x20Funds\x20cannot\x20be\x20distributed\x20after\x20workflow\x20completes.','detection':'Check\x20if\x20terminal\x20nodes\x20have\x20Allocator\x20mapping','recommendation':'Configure\x20Allocator\x20for\x20each\x20terminal\x20node.','auto_fixable':![]},{'id':'R-M4-06','name':'clear\x20operation\x20without\x20backup','category':'immutability','severity':'high','description':'Executing\x20node\x20clear\x20before\x20exporting\x20backup.\x20All\x20node\x20data\x20lost,\x20cannot\x20recover.','detection':'Check\x20if\x20machineNode2file\x20backup\x20created\x20before\x20clear\x20operation','recommendation':'Run\x20machineNode2file\x20backup\x20before\x20any\x20clear\x20operation.','auto_fixable':!![]},{'id':'R-M5-01','name':'Service\x20not\x20created','category':'environment','severity':'high','description':'Machine\x20design\x20complete\x20but\x20Service\x20not\x20created.\x20Machine\x20cannot\x20bind\x20to\x20Service.','detection':'Check\x20if\x20Service\x20object\x20is\x20in\x20published_services\x20set','recommendation':'Create\x20Service\x20first,\x20then\x20design/publish\x20Machine.','auto_fixable':![]},{'id':'R-M5-02','name':'Permission\x20object\x20mismatch','category':'environment','severity':'high','description':'Machine\x27s\x20Permission\x20differs\x20from\x20Service\x27s\x20Permission.\x20Permission\x20organization\x20inconsistent,\x20may\x20cause\x20operation\x20failure.','detection':'Cross-check\x20Machine\x27s\x20Permission\x20against\x20Service\x27s\x20Permission','recommendation':'Use\x20the\x20same\x20Permission\x20for\x20Machine\x20and\x20Service\x20(or\x20explicitly\x20document\x20different\x20organizations).','auto_fixable':![]},{'id':'R-M5-03','name':'Allocation\x20configuration\x20incomplete','category':'environment','severity':'high','description':'Service\x27s\x20order_allocators\x20not\x20configured\x20or\x20misconfigured.\x20Terminal\x20node\x20funds\x20cannot\x20be\x20distributed.','detection':'Check\x20if\x20Service.order_allocators\x20is\x20configured\x20for\x20each\x20terminal\x20node','recommendation':'Configure\x20Service.order_allocators,\x20one\x20Allocator\x20per\x20terminal\x20node.','auto_fixable':![]},{'id':'R-M5-04','name':'Reward\x20object\x20not\x20created','category':'environment','severity':'medium','description':'Reward\x20incentive\x20scenario\x20referenced\x20but\x20Reward\x20object\x20not\x20created.','detection':'Check\x20if\x20Reward\x20object\x20is\x20in\x20published_rewards\x20set','recommendation':'Create\x20Reward\x20object\x20first,\x20then\x20design\x20Guard.','auto_fixable':![]},{'id':'R-M5-05','name':'Arbitration\x20object\x20not\x20created','category':'environment','severity':'medium','description':'Arbitration\x20scenario\x20referenced\x20but\x20Arbitration\x20object\x20not\x20created.','detection':'Check\x20if\x20Arbitration\x20object\x20is\x20in\x20published_arbitrations\x20set','recommendation':'Create\x20Arbitration\x20object\x20first.','auto_fixable':![]},{'id':'R-M5-06','name':'Cross-Machine\x20dependency\x20not\x20published','category':'environment','severity':'critical','description':'Machine\x20A\x20depends\x20on\x20Machine\x20B,\x20but\x20B\x20is\x20not\x20published.\x20Guard\x20query\x20for\x20Machine\x20B\x27s\x20Progress\x20will\x20fail.\x20'+'Dependency\x20verification:\x20indirect\x20via\x20progress::new\x20->\x20assert_published\x20(see\x2006\x20§14.6).','detection':'Check\x20machine_ref\x20against\x20published_machines\x20set','recommendation':'Ensure\x20upstream\x20Machine\x20is\x20published\x20first.','auto_fixable':![]},{'id':'R-M5-07','name':'Repository\x20not\x20created','category':'environment','severity':'medium','description':'Guard\x20references\x20Repository\x20but\x20not\x20created.\x20Guard\x20query\x20will\x20fail.','detection':'Check\x20repository_ref\x20against\x20published\x20repositories\x20set','recommendation':'Create\x20and\x20publish\x20Repository\x20first.\x20Note:\x20consensus_repositories\x20is\x20declarative-only\x20(see\x2006\x20§14.4).','auto_fixable':![]},{'id':'R-M5-08','name':'Object\x20dependency\x20table\x20incomplete','category':'environment','severity':'low','description':'Project\x20object\x20dependency\x20table\x20missing\x20some\x20objects.\x20Design\x20decisions\x20based\x20on\x20incomplete\x20information.','detection':'Scan\x20project\x20environment\x20for\x20missing\x20object\x20references','recommendation':'Use\x20workflow-guidance.ts\x20to\x20scan\x20complete\x20project\x20environment.','auto_fixable':![]}];export function assessMachineRisks(a,b){const c=[];c['push'](...checkStructuralRisks(a)),c['push'](...checkGuardIntegrationRisks(a,b)),c['push'](...checkPermissionRisks(a)),c['push'](...checkImmutabilityRisks(a,b)),c['push'](...checkEnvironmentRisks(a,b));const d={'critical':c['filter'](g=>g['severity']==='critical')['length'],'high':c['filter'](g=>g['severity']==='high')['length'],'medium':c['filter'](g=>g['severity']==='medium')['length'],'low':c['filter'](g=>g['severity']==='low')['length']};let e='low';if(d['critical']>0x0)e='critical';else{if(d['high']>0x0)e='high';else{if(d['medium']>0x0)e='medium';else{if(d['low']>0x0)e='low';}}}let f;if(d['critical']>0x0)f='do_not_publish';else d['high']>0x2?f='fix_first':f='publish';return{'overall_level':e,'detected_risks':c,'summary':d,'recommendation':f};}function checkStructuralRisks(a){const b=[],c=a['pairs']['some'](m=>m['prev_node']==='');!c&&b['push'](makeRisk('R-M1-01','No\x20Pair\x20with\x20prev_node=\x27\x27\x20found.\x20Workflow\x20cannot\x20start.'));const d=new Set(a['pairs']['map'](m=>m['prev_node'])['filter'](m=>m!=='')),e=new Set(a['nodes']['map'](m=>m['name'])),f=[...e]['filter'](m=>!d['has'](m));f['length']===0x0&&b['push'](makeRisk('R-M1-02','No\x20terminal\x20node\x20found.\x20Workflow\x20never\x20completes.'));const g=new Set(a['pairs']['filter'](m=>m['prev_node']==='')['map'](m=>m['next_node'])),h=new Set(a['pairs']['map'](m=>m['prev_node'])['filter'](m=>m!==''));for(const m of a['nodes']){if(!g['has'](m['name'])&&!h['has'](m['name'])){const n=a['pairs']['some'](o=>o['next_node']===m['name']);!n&&b['push'](makeRisk('R-M1-04','Node\x20\x22'+m['name']+'\x22\x20is\x20orphaned\x20(no\x20incoming\x20Pair).'));}}a['nodes']['length']>MAX_NODE_COUNT&&b['push'](makeRisk('R-M1-07','Node\x20count\x20'+a['nodes']['length']+'\x20exceeds\x20MAX_NODE_COUNT\x20('+MAX_NODE_COUNT+').'));const i=new Map();for(const o of a['pairs']){i['set'](o['next_node'],(i['get'](o['next_node'])??0x0)+0x1);}for(const [q,r]of i){r>0x28&&b['push'](makeRisk('R-M1-08','Node\x20\x22'+q+'\x22\x20has\x20'+r+'\x20Pairs,\x20exceeds\x20MAX_NODE_PAIR_COUNT\x20(40).'));}for(const s of a['pairs']){s['forwards']['length']>0x14&&b['push'](makeRisk('R-M1-09','Pair\x20('+s['prev_node']+'\x20->\x20'+s['next_node']+')\x20has\x20'+s['forwards']['length']+'\x20Forwards,\x20exceeds\x20MAX_FORWARD_COUNT\x20(20).'));}const j=a['nodes']['map'](t=>t['name']),k=j['filter']((t,v)=>j['indexOf'](t)!==v);k['length']>0x0&&b['push'](makeRisk('R-M1-10','Duplicate\x20node\x20names:\x20'+[...new Set(k)]['join'](',\x20')));const l=findUnachievableThresholds(a['pairs']);for(const t of l){const v=t['threshold']>0x1&&t['distinct_forwards']<t['threshold'];b['push'](makeRisk(v?'R-M1-13':'R-M1-12','Pair\x20('+(t['prev_node']===''?'entry':t['prev_node'])+'\x20->\x20'+t['next_node']+'):\x20'+t['reason']));}return b;}function checkGuardIntegrationRisks(a,b){const c=[];for(const d of a['pairs']){for(const e of d['forwards']){e['guard']&&!b['published_guards']['has'](e['guard'])&&c['push'](makeRisk('R-M2-01','Forward\x20\x22'+e['name']+'\x22\x20references\x20Guard\x20\x22'+e['guard']+'\x22\x20not\x20in\x20published_guards.')),e['retained_submission']&&!e['guard']&&c['push'](makeRisk('R-M2-04','Forward\x20\x22'+e['name']+'\x22\x20has\x20retained_submission\x20but\x20no\x20Guard.\x20retained_submission\x20requires\x20a\x20Guard.'));}}return c;}function checkPermissionRisks(a){const b=[];for(const c of a['pairs']){for(const d of c['forwards']){const e=d['named_operator']!==undefined&&d['named_operator']!==null,f=d['permission_index']!==undefined&&d['permission_index']!==null;!e&&!f&&b['push'](makeRisk('R-M3-01','Forward\x20\x22'+d['name']+'\x22\x20in\x20Pair\x20('+c['prev_node']+'\x20->\x20'+c['next_node']+')\x20has\x20no\x20permission.'));}}for(const g of a['pairs']){for(const h of g['forwards']){const i=h['named_operator']!==undefined&&h['named_operator']!==null,j=h['permission_index']!==undefined&&h['permission_index']!==null;i&&j&&b['push'](makeRisk('R-M3-07','Forward\x20\x22'+h['name']+'\x22\x20in\x20Pair\x20('+g['prev_node']+'\x20->\x20'+g['next_node']+')\x20has\x20both\x20namedOperator\x20and\x20permissionIndex\x20(OR\x20semantic).'));}}for(const k of a['pairs']){for(const l of k['forwards']){l['permission_index']!==undefined&&l['permission_index']!==null&&l['permission_index']<USER_DEFINED_PERM_INDEX_START&&b['push'](makeRisk('R-M3-08','Forward\x20\x22'+l['name']+'\x22\x20in\x20Pair\x20('+k['prev_node']+'\x20->\x20'+k['next_node']+')\x20'+('has\x20permission_index='+l['permission_index']+'\x20<\x20'+USER_DEFINED_PERM_INDEX_START+'.\x20')+'Indexes\x200-999\x20are\x20reserved\x20for\x20built-in\x20permissions.'));}}return b;}function checkImmutabilityRisks(a,b){const c=[];b['network']==='mainnet'&&!b['testnet_test_passed']&&c['push'](makeRisk('R-M4-02','Mainnet\x20publish\x20attempted\x20without\x20testnet\x20test\x20passing.'));const d=new Set();for(const f of a['pairs']){for(const g of f['forwards']){if(g['guard'])d['add'](g['guard']);}}const e=[...d]['filter'](h=>!b['published_guards']['has'](h));return e['length']>0x0&&c['push'](makeRisk('R-M4-03','Guards\x20not\x20all\x20created\x20before\x20publish.\x20Missing:\x20'+e['join'](',\x20'))),c;}function checkEnvironmentRisks(a,b){const c=[],d=new Set();for(const f of a['pairs']){for(const g of f['forwards']){if(g['guard'])d['add'](g['guard']);}}const e=[...d]['filter'](h=>!b['published_guards']['has'](h));return e['length']>0x0&&c['push'](makeRisk('R-M5-08','Object\x20dependency\x20table\x20incomplete.\x20Missing\x20Guards:\x20'+e['join'](',\x20'))),c;}function makeRisk(a,b){const c=MACHINE_RISK_RULES['find'](d=>d['id']===a);if(!c)return{'rule_id':a,'name':'Unknown','severity':'low','detail':b,'recommendation':'Investigate\x20manually.','auto_fixable':![]};return{'rule_id':c['id'],'name':c['name'],'severity':c['severity'],'detail':b,'recommendation':c['recommendation'],'auto_fixable':c['auto_fixable']};}export const MACHINE_RISK_VERSION='1.0.0';

package/dist/knowledge/order-risk.d.ts

@@ -1,4 +1,4 @@
-import { type OrderScene, type OrderPermissionLayer } from "./order-ledger.js";
+import { type OrderScene } from "./order-ledger.js";
 export type OrderRiskLevel = "CRITICAL" | "HIGH" | "MEDIUM" | "LOW";
 export type OrderRiskCategory = "structural" | "semantic" | "authority" | "lifecycle" | "cross_object";
 export interface OrderRisk {
@@ -47,9 +47,6 @@ export interface OrderRiskCheckContext {
 }
 export declare const ORDER_RISK_VERSION = "1.0.0";
 export declare function getAllOrderRiskRules(): OrderRiskRule[];
-export declare function getOrderRiskRulesCount(): number;
-export declare function getOrderRiskRulesByCategory(category: OrderRiskCategory): OrderRiskRule[];
-export declare function getOrderRiskRuleById(id: string): OrderRiskRule | undefined;
 export interface OrderRiskAssessment {
     summary: string;
     scene?: OrderScene;
@@ -60,8 +57,3 @@ export interface OrderRiskAssessment {
     needs_human_review: boolean;
 }
 export declare function assessOrderRisks(ctx: OrderRiskCheckContext): OrderRiskAssessment;
-export declare function checkPermissionLayer(operation: string, caller_is_owner: boolean, caller_is_agent: boolean): {
-    allowed: boolean;
-    layer: OrderPermissionLayer;
-    reason?: string;
-};

package/dist/knowledge/order-risk.js

@@ -1 +1 @@
-import{MAX_AGENT_COUNT,MAX_DISPUTE_COUNT}from'@wowok/wowok';import{findSceneById}from'./order-ledger.js';const R_O_1_01={'id':'R-O-1-01','category':'structural','trigger':'Order\x20has\x2014\x20fields\x20but\x20no\x20Permission\x20field\x20(unique\x20among\x2022\x20objects)','check':a=>{if(a['is_buy_operation'])return{'id':'R-O-1-01','level':'LOW','category':'structural','title':'Order\x20uses\x20owner/agent\x20dual-layer\x20(no\x20Permission)','description':'Order\x20is\x20the\x20only\x20business\x20object\x20among\x2022\x20WoWok\x20objects\x20that\x20does\x20NOT\x20use\x20the\x20Permission\x20system.\x20All\x20access\x20control\x20flows\x20through\x20assert_owner\x20and\x20has_op_permission\x20inline\x20functions.','affected_stakeholders':['system','owner','agent'],'scenario':'Developer\x20assumes\x20Order\x20uses\x20Permission\x20and\x20writes\x20permission::check\x20logic','mitigation':'Use\x20owner/agent\x20checks\x20directly.\x20Do\x20NOT\x20attempt\x20to\x20apply\x20a\x20Permission\x20object\x20to\x20Order.','evidence':'no_permission_field'};return null;}},R_O_1_02={'id':'R-O-1-02','category':'structural','trigger':'Item\x20count\x20check\x20(informational;\x20no\x20Move-level\x20limit\x20on\x20items)','check':a=>{if(!a['items']||a['items']['length']===0x0)return null;if(a['items']['length']>0x32)return{'id':'R-O-1-02','level':'LOW','category':'structural','title':'Large\x20items\x20list\x20may\x20exceed\x20tx\x20size\x20limits','description':a['items']['length']+'\x20items\x20in\x20a\x20single\x20Order\x20—\x20no\x20protocol\x20limit,\x20but\x20large\x20lists\x20increase\x20transaction\x20size\x20and\x20may\x20hit\x20gas/size\x20limits','affected_stakeholders':['owner'],'scenario':'Bulk\x20purchase\x20with\x20many\x20line\x20items','mitigation':'Split\x20into\x20multiple\x20Orders\x20if\x20items\x20>\x2050','evidence':'items_count='+a['items']['length']};return null;}},R_O_1_03={'id':'R-O-1-03','category':'structural','trigger':'dispute\x20count\x20>=\x20MAX_DISPUTE_COUNT\x20(10)','check':a=>{const b=a['current_dispute_count']??0x0;if(b>=MAX_DISPUTE_COUNT)return{'id':'R-O-1-03','level':'HIGH','category':'structural','title':'Dispute\x20count\x20at\x20MAX_DISPUTE_COUNT\x20limit','description':'Order\x20already\x20has\x20'+b+'\x20disputes\x20(MAX_DISPUTE_COUNT='+MAX_DISPUTE_COUNT+').\x20Next\x20dispute()\x20call\x20will\x20abort\x20E_MAX_DISPUTE_COUNT.','affected_stakeholders':['owner','agent','arbitrator'],'scenario':'Filing\x2011th\x20dispute\x20on\x20an\x20Order\x20with\x2010\x20existing\x20disputes','mitigation':'Resolve\x20existing\x20disputes\x20(via\x20arb_claim_compensation)\x20before\x20filing\x20new\x20ones.\x20Note:\x20claimed_by\x20blocks\x20ALL\x20future\x20disputes.','evidence':'dispute_count='+b};return null;}},R_O_1_04={'id':'R-O-1-04','category':'structural','trigger':'agent_set\x20—\x20list\x20REPLACEMENT\x20semantics\x20(omitted\x20agents\x20lose\x20access)\x20and\x20distinct\x20count\x20limit','check':a=>{if(!a['agent_set'])return null;const b=new Set(a['agent_set']['agents'])['size'];if(b>MAX_AGENT_COUNT)return{'id':'R-O-1-04','level':'HIGH','category':'structural','title':'Distinct\x20agent\x20count\x20exceeds\x20MAX_AGENT_COUNT','description':'Attempting\x20to\x20set\x20'+b+'\x20distinct\x20agents\x20(input\x20'+a['agent_set']['agents']['length']+';\x20duplicates\x20are\x20deduped\x20on-chain).\x20Move\x20asserts\x20length\x20<\x20MAX_AGENT_COUNT\x20('+MAX_AGENT_COUNT+')\x20before\x20each\x20push\x20—\x20the\x20call\x20will\x20abort\x20E_MAX_AGENT_COUNT.','affected_stakeholders':['owner','system'],'scenario':'Setting\x2011\x20distinct\x20agents\x20in\x20one\x20call','mitigation':'Reduce\x20to\x20at\x20most\x20'+MAX_AGENT_COUNT+'\x20distinct\x20agents\x20per\x20call,\x20or\x20set\x20in\x20two\x20batches\x20(second\x20call\x20REPLACES\x20the\x20first\x20—\x20union\x20the\x20lists\x20manually).','evidence':'distinct_agents='+b+',\x20input_count='+a['agent_set']['agents']['length']+',\x20max='+MAX_AGENT_COUNT};return null;}},R_O_1_05={'id':'R-O-1-05','category':'structural','trigger':'wip_hash\x20is\x20empty\x20string\x20in\x20any\x20item','check':a=>{if(!a['items'])return null;const b=a['items']['find'](c=>!c['wip_hash']||c['wip_hash']==='');if(b)return{'id':'R-O-1-05','level':'HIGH','category':'structural','title':'Empty\x20wip_hash\x20in\x20item','description':'Item\x20\x22'+b['name']+'\x22\x20has\x20empty\x20wip_hash.\x20Move\x20rejects\x20empty\x20strings\x20(F-O-18).','affected_stakeholders':['owner'],'scenario':'User\x20submits\x20item\x20without\x20computing\x20WIP\x20hash','mitigation':'Compute\x20wip_hash\x20from\x20the\x20work-in-progress\x20file\x20content\x20before\x20service::buy().','evidence':'item_name='+b['name']};return null;}},R_O_2_01={'id':'R-O-2-01','category':'semantic','trigger':'Order.machine\x20snapshot\x20differs\x20from\x20current\x20Service.machine','check':a=>{if(!a['current_service_machine']||!a['order_machine_snapshot'])return null;if(a['current_service_machine']!==a['order_machine_snapshot'])return{'id':'R-O-2-01','level':'HIGH','category':'semantic','title':'Machine\x20snapshot\x20diverges\x20from\x20Service.machine','description':'Order.machine='+a['order_machine_snapshot']+'\x20was\x20snapshotted\x20at\x20buy\x20time.\x20Service.machine\x20is\x20now\x20'+a['current_service_machine']+'.\x20Same\x20Service\x20has\x20Orders\x20running\x20different\x20Machine\x20versions.','affected_stakeholders':['owner','service_provider','arbitrator'],'scenario':'Service\x20provider\x20upgrades\x20Machine\x20after\x20some\x20Orders\x20are\x20created','mitigation':'Audit\x20each\x20Order\x27s\x20machine\x20snapshot\x20separately.\x20Document\x20Machine\x20version\x20per\x20Order.\x20Plan\x20migration\x20paths\x20for\x20legacy\x20Orders.','evidence':'order_machine='+a['order_machine_snapshot']+',\x20service_machine='+a['current_service_machine']};return null;}},R_O_2_02={'id':'R-O-2-02','category':'semantic','trigger':'SDK\x20uses\x20\x27builder\x27\x20field\x20for\x20Move\x27s\x20\x27owner\x27\x20field\x20(naming\x20deviation)','check':a=>{if(a['object'])return{'id':'R-O-2-02','level':'MEDIUM','category':'semantic','title':'SDK\x20builder\x20≠\x20Move\x20owner\x20(only\x20naming\x20deviation\x20in\x2022\x20objects)','description':'SDK\x20ObjectOrder.builder\x20corresponds\x20to\x20Move\x20Order.owner.\x20This\x20is\x20the\x20only\x20field\x20name\x20deviation\x20across\x20all\x2022\x20WoWok\x20objects.\x20All\x20Order\x20knowledge\x20uses\x20Move\x27s\x20\x27owner\x27\x20as\x20canonical.','affected_stakeholders':['system'],'scenario':'Developer\x20reads\x20SDK\x20\x27builder\x27\x20and\x20assumes\x20it\x27s\x20a\x20different\x20concept\x20from\x20owner','mitigation':'Use\x20moveToSdkField()/sdkToMoveField()\x20helpers\x20from\x20order-ledger.ts.\x20Document\x20\x27builder\x20=\x20owner\x27\x20in\x20all\x20SDK\x20consumers.','evidence':'sdk_field=builder,\x20move_field=owner'};return null;}},R_O_2_03={'id':'R-O-2-03','category':'semantic','trigger':'E_PROGRESS_NOT_SPECIFIED\x20—\x20single\x20real\x20semantics\x20(order::create\x20without\x20Progress),\x20commonly\x20misdocumented\x20as\x20an\x20agent_set/owner_change\x20freeze','check':a=>{if(!a['operation'])return null;if(a['operation']==='service_buy'&&a['progress_bound']===![])return{'id':'R-O-2-03','level':'HIGH','category':'semantic','title':'order::create\x20will\x20abort\x20E_PROGRESS_NOT_SPECIFIED\x20—\x20machine\x20bound\x20but\x20Progress\x20missing','description':'order::create\x20asserts\x20progress.is_some()\x20whenever\x20machine.is_some()\x20(order.move:132).\x20A\x20buy\x20against\x20a\x20machine-driven\x20Service\x20MUST\x20bind\x20a\x20Progress\x20object\x20(service::order_progress)\x20before\x20order::create,\x20else\x20E_PROGRESS_NOT_SPECIFIED\x20(code\x203).','affected_stakeholders':['owner'],'scenario':'Machine-driven\x20Service\x20purchased\x20without\x20creating/binding\x20the\x20Progress\x20object\x20first','mitigation':'Bind\x20Progress\x20before\x20order::create:\x20call\x20service::order_progress(service,\x20order,\x20machine,\x20...)\x20which\x20invokes\x20order::on_progress.\x20Note:\x20agent_set/owner_change\x20are\x20NOT\x20affected\x20—\x20they\x20are\x20never\x20frozen\x20by\x20Progress\x20binding.','evidence':'operation='+a['operation']+',\x20progress_bound='+a['progress_bound']};return null;}},R_O_2_04={'id':'R-O-2-04','category':'semantic','trigger':'SaleItem.item\x20→\x20PurchasedItem.name\x20field\x20name\x20mapping','check':a=>{if(a['is_buy_operation'])return{'id':'R-O-2-04','level':'LOW','category':'semantic','title':'SaleItem.item\x20(Move)\x20maps\x20to\x20PurchasedItem.name\x20(SDK)','description':'Move\x20struct\x20SaleItem\x20uses\x20field\x20\x27item\x27,\x20but\x20SDK\x20ObjectOrder.items\x20uses\x20field\x20\x27name\x27.\x20This\x20is\x20the\x20second\x20naming\x20deviation\x20in\x20Order\x20system\x20(after\x20builder/owner).','affected_stakeholders':['system'],'scenario':'Cross-layer\x20data\x20mapping\x20between\x20Move\x20and\x20SDK','mitigation':'Use\x20consistent\x20SDK\x20field\x20names\x20in\x20user-facing\x20code;\x20document\x20Move\x20↔\x20SDK\x20mapping\x20in\x20audit\x20logs.','evidence':'move_field=SaleItem.item,\x20sdk_field=PurchasedItem.name'};return null;}},R_O_3_01={'id':'R-O-3-01','category':'authority','trigger':'Agent\x20attempts\x20receive\x20or\x20transfer_to\x20(L1\x20owner-only\x20operations)','check':a=>{if(!a['operation'])return null;if((a['operation']==='receive'||a['operation']==='transfer_to')&&a['caller_is_agent']&&!a['caller_is_owner'])return{'id':'R-O-3-01','level':'HIGH','category':'authority','title':'Agent\x20attempting\x20owner-only\x20operation','description':'Agent\x20cannot\x20call\x20'+a['operation']+'\x20—\x20these\x20are\x20L1\x20owner-only\x20operations\x20(assert_owner).\x20Agent\x20can\x20operate\x20progress/arb_*/required_info\x20but\x20CANNOT\x20receive\x20funds\x20or\x20transfer\x20ownership.','affected_stakeholders':['agent','owner'],'scenario':'Logistics\x20agent\x20tries\x20to\x20collect\x20payment\x20on\x20behalf\x20of\x20buyer','mitigation':'Owner\x20must\x20call\x20receive/transfer_to\x20directly.\x20If\x20delegation\x20is\x20needed,\x20owner\x20can\x20transfer_to\x20a\x20multi-sig\x20wallet\x20that\x20includes\x20the\x20agent.','evidence':'operation='+a['operation']+',\x20caller=agent'};return null;}},R_O_3_02={'id':'R-O-3-02','category':'authority','trigger':'Non-owner\x20non-agent\x20attempts\x20operation\x20(no\x20permission)','check':a=>{if(!a['operation'])return null;if(a['caller_is_owner']===![]&&a['caller_is_agent']===![])return{'id':'R-O-3-02','level':'HIGH','category':'authority','title':'Non-owner\x20non-agent\x20attempting\x20operation','description':'Caller\x20is\x20neither\x20owner\x20nor\x20agent.\x20L2\x20operations\x20(progress,\x20arb_confirm,\x20arb_objection)\x20require\x20has_op_permission\x20—\x20aborts\x20E_NOT_OP_PERMISSION.\x20L1\x20operations\x20(transfer_to,\x20agent_set,\x20required_info_update)\x20additionally\x20require\x20assert_owner\x20—\x20aborts\x20E_NOT_THE_OWNER.','affected_stakeholders':['system'],'scenario':'Random\x20address\x20attempts\x20to\x20advance\x20someone\x20else\x27s\x20Order','mitigation':'Verify\x20caller\x20is\x20owner\x20or\x20in\x20agent[]\x20before\x20submitting\x20transaction.','evidence':'operation='+a['operation']+',\x20caller=unauthorized'};return null;}},R_O_3_03={'id':'R-O-3-03','category':'authority','trigger':'arb_claim_compensation\x20called\x20(sets\x20claimed_by,\x20irreversible)','check':a=>{if(a['operation']!=='arb_claim_compensation')return null;return{'id':'R-O-3-03','level':'HIGH','category':'authority','title':'arb_claim_compensation\x20is\x20IRREVERSIBLE\x20(claimed_by\x20one-time\x20set)','description':'Setting\x20claimed_by\x20is\x20permanent.\x20After\x20this\x20call:\x20(1)\x20claimed_by\x20cannot\x20be\x20reset,\x20(2)\x20NO\x20new\x20disputes\x20can\x20be\x20filed\x20(E_ORDER_ALREADY_CLAIMED),\x20(3)\x20all\x20unresolved\x20disputes\x20become\x20unactionable.\x20If\x20first\x20compensation\x20is\x20insufficient,\x20buyer\x20has\x20no\x20recourse.','affected_stakeholders':['owner','agent','arbitrator'],'scenario':'Buyer\x20claims\x20partial\x20compensation,\x20then\x20discovers\x20additional\x20damages','mitigation':'BEFORE\x20claiming:\x20(1)\x20enumerate\x20ALL\x20disputes,\x20(2)\x20ensure\x20proposition\x20covers\x20all\x20damages,\x20(3)\x20confirm\x20Arb\x20ruling\x20is\x20final.\x20Add\x20explicit\x20user\x20confirmation\x20(C-O-08).','evidence':'operation=arb_claim_compensation,\x20current_claimed_by='+(a['claimed_by_set']??![])};}},R_O_3_04={'id':'R-O-3-04','category':'authority','trigger':'dispute\x20attempted\x20after\x20claimed_by\x20is\x20set','check':a=>{if(a['claimed_by_set']&&(a['operation']==='arb_confirm'||a['operation']==='arb_objection'))return{'id':'R-O-3-04','level':'HIGH','category':'authority','title':'Cannot\x20file\x20new\x20dispute\x20after\x20claimed_by\x20is\x20set','description':'Order.claimed_by\x20is\x20set\x20—\x20any\x20new\x20dispute()\x20call\x20aborts\x20E_ORDER_ALREADY_CLAIMED.\x20arb_confirm/arb_objection\x20trigger\x20dispute()\x20internally.','affected_stakeholders':['owner','agent'],'scenario':'Buyer\x20claims\x20compensation\x20then\x20tries\x20to\x20file\x20additional\x20dispute','mitigation':'Resolve\x20ALL\x20disputes\x20BEFORE\x20calling\x20arb_claim_compensation.\x20claimed_by\x20is\x20terminal\x20for\x20dispute\x20flow.','evidence':'operation='+a['operation']+',\x20claimed_by_set=true'};return null;}},R_O_4_01={'id':'R-O-4-01','category':'lifecycle','trigger':'Attempt\x20to\x20create\x20Order\x20independently\x20(not\x20via\x20service::buy)','check':a=>{if(a['is_buy_operation']===![]&&a['operation']==='service_buy'&&!a['object'])return{'id':'R-O-4-01','level':'CRITICAL','category':'lifecycle','title':'Order\x20cannot\x20be\x20created\x20independently\x20(compound\x20creation\x20only)','description':'order::new()\x20is\x20package-only\x20—\x20only\x20service::buy()\x20can\x20create\x20Orders.\x20Any\x20attempt\x20to\x20call\x20order::new\x20directly\x20will\x20fail\x20at\x20the\x20Move\x20module\x20boundary.\x20Order\x20+\x20Allocation\x20+\x20Progress\x20are\x20created\x20atomically\x20in\x20one\x20transaction.','affected_stakeholders':['system','owner'],'scenario':'Developer\x20tries\x20to\x20construct\x20Order\x20independently\x20for\x20testing','mitigation':'Always\x20use\x20service::buy()\x20to\x20create\x20Orders.\x20For\x20testing,\x20deploy\x20a\x20minimal\x20Service\x20with\x20machine/allocators\x20configured.','evidence':'independent_creation_attempted'};return null;}},R_O_4_02={'id':'R-O-4-02','category':'lifecycle','trigger':'agent_set\x20attempted\x20mid-fulfillment\x20(Progress\x20bound)\x20—\x20replacement\x20may\x20revoke\x20active\x20agents','check':a=>{if(!a['operation'])return null;if(a['operation']==='agent_set'&&a['progress_bound'])return{'id':'R-O-4-02','level':'MEDIUM','category':'lifecycle','title':'Mid-fulfillment\x20agent_set\x20—\x20replacement\x20may\x20silently\x20revoke\x20active\x20agents','description':'agent_set\x20is\x20allowed\x20at\x20ANY\x20time\x20(no\x20Progress\x20freeze\x20exists\x20on-chain),\x20but\x20it\x20REPLACES\x20the\x20entire\x20list:\x20an\x20active\x20agent\x20omitted\x20from\x20the\x20new\x20list\x20immediately\x20loses\x20L2\x20access\x20(Progress\x20advance,\x20arb\x20operations)\x20and\x20their\x20EntityOrders\x20role\x20record\x20is\x20removed.\x20A\x20workflow\x20waiting\x20on\x20that\x20agent\x20to\x20advance\x20Progress\x20would\x20stall.','affected_stakeholders':['owner','agent'],'scenario':'Owner\x20adjusts\x20the\x20agent\x20list\x20mid-fulfillment\x20and\x20accidentally\x20drops\x20the\x20agent\x20responsible\x20for\x20the\x20next\x20Progress\x20node','mitigation':'When\x20changing\x20agents\x20mid-fulfillment,\x20always\x20include\x20the\x20union\x20of\x20current\x20active\x20agents\x20plus\x20the\x20additions.\x20Query\x20the\x20current\x20agent\x20list\x20first\x20(order\x20query),\x20merge,\x20then\x20submit.','evidence':'operation=agent_set,\x20progress_bound='+a['progress_bound']};return null;}},R_O_4_03={'id':'R-O-4-03','category':'lifecycle','trigger':'Progress\x20advance\x20attempted\x20without\x20progress\x20bound','check':a=>{if(a['operation']==='progress_advance'&&a['progress_bound']===![])return{'id':'R-O-4-03','level':'HIGH','category':'lifecycle','title':'Cannot\x20advance\x20Progress\x20—\x20no\x20Progress\x20bound\x20to\x20Order','description':'Order\x20has\x20no\x20progress\x20field\x20set\x20(Service\x20had\x20no\x20machine\x20configured).\x20Cannot\x20advance\x20a\x20non-existent\x20Progress.\x20SDK\x20CallOrder\x20validates\x20this\x20pre-flight\x20(CallOrder_Data.progress\x20requires\x20order.machine\x20and\x20order.progress).','affected_stakeholders':['owner','agent'],'scenario':'Buyer\x20tries\x20to\x20advance\x20Progress\x20on\x20an\x20Order\x20created\x20from\x20a\x20Service\x20without\x20machine','mitigation':'Use\x20a\x20Service\x20with\x20machine\x20configured.\x20If\x20manual\x20lifecycle\x20is\x20needed,\x20track\x20state\x20off-chain.','evidence':'operation=progress_advance,\x20progress_bound=false'};return null;}},R_O_4_04={'id':'R-O-4-04','category':'lifecycle','trigger':'arb_confirm/arb_objection/arb_claim_compensation\x20(irreversible\x20Arb\x20operations)','check':a=>{if(!a['operation'])return null;if(a['operation']==='arb_confirm'||a['operation']==='arb_objection'||a['operation']==='arb_claim_compensation')return{'id':'R-O-4-04','level':'HIGH','category':'lifecycle','title':a['operation']+'\x20is\x20irreversible\x20(triggers\x20Arb\x20flow)','description':a['operation']+'\x20triggers\x20the\x20Arbitration\x20workflow\x20which\x20cannot\x20be\x20undone.\x20arb_confirm\x20files\x20a\x20new\x20dispute,\x20arb_objection\x20requests\x20re-arbitration,\x20arb_claim_compensation\x20sets\x20claimed_by\x20permanently.','affected_stakeholders':['owner','agent','arbitrator'],'scenario':'User\x20accidentally\x20files\x20arb_confirm\x20without\x20understanding\x20consequences','mitigation':'Add\x20explicit\x20user\x20confirmation\x20(C-O-08,\x20C-O-11,\x20C-O-12)\x20before\x20these\x20operations.\x20Show\x20warning\x20text\x20describing\x20irreversibility.','evidence':'operation='+a['operation']};return null;}},R_O_4_05={'id':'R-O-4-05','category':'lifecycle','trigger':'receive\x20attempted\x20but\x20no\x20Receiving\x20exists\x20at\x20the\x20caller\x27s\x20address\x20(allocation::alloc\x20has\x20not\x20distributed\x20a\x20payment)','check':a=>{if(a['operation']==='receive'&&a['receiving_exists']===![])return{'id':'R-O-4-05','level':'HIGH','category':'lifecycle','title':'receive\x20blocked\x20—\x20no\x20Receiving\x20object\x20(allocation::alloc\x20has\x20not\x20run)','description':'owner_receive\x20is\x20gated\x20by\x20Receiving\x20existence:\x20allocation::alloc\x20must\x20have\x20run\x20on\x20the\x20Order\x27s\x20Allocation\x20object\x20and\x20included\x20the\x20caller\x27s\x20address\x20in\x20the\x20payment\x20recipients.\x20Without\x20a\x20Receiving,\x20the\x20transaction\x20cannot\x20be\x20constructed\x20(no\x20E_ORDER_DELIVERING\x20abort\x20exists\x20on-chain\x20—\x20Progress\x20terminal\x20state\x20is\x20NOT\x20a\x20receive\x20gate).','affected_stakeholders':['owner'],'scenario':'Buyer\x20tries\x20to\x20collect\x20a\x20payment\x20before\x20the\x20allocation\x20flow\x20has\x20distributed\x20it','mitigation':'1)\x20Confirm\x20allocation::alloc\x20has\x20run\x20on\x20the\x20Order\x27s\x20Allocation\x20(query\x20its\x20payment\x20vector)\x202)\x20Confirm\x20the\x20caller\x27s\x20address\x20is\x20in\x20the\x20allocator\x27s\x20sharing\x20recipients\x203)\x20Retry\x20receive\x20with\x20the\x20correct\x20Receiving\x20object\x20ID.\x20If\x20the\x20merchant\x20withholds\x20allocation,\x20file\x20arb_confirm\x20to\x20dispute.','evidence':'operation=receive,\x20receiving_exists='+a['receiving_exists']};return null;}},R_O_4_06={'id':'R-O-4-06','category':'lifecycle','trigger':'transfer_to\x20attempted\x20(irreversible\x20ownership\x20transfer)','check':a=>{if(a['operation']!=='transfer_to')return null;return{'id':'R-O-4-06','level':'CRITICAL','category':'lifecycle','title':'transfer_to\x20is\x20IRREVERSIBLE\x20—\x20new\x20owner\x20takes\x20over\x20ALL\x20permissions','description':'Ownership\x20transfer\x20to\x20'+(a['transfer_to_new_owner']??'(unknown)')+'\x20is\x20permanent.\x20New\x20owner\x20becomes\x20the\x20sole\x20receiver\x20of\x20payments\x20and\x20gains\x20full\x20L1\x20control.\x20Original\x20owner\x20loses\x20ALL\x20access.','affected_stakeholders':['owner'],'scenario':'Buyer\x20transfers\x20Order\x20to\x20wrong\x20address\x20by\x20mistake','mitigation':'1)\x20Verify\x20new\x20owner\x20address\x20twice.\x202)\x20Coordinate\x20with\x20new\x20owner\x20before\x20transfer.\x203)\x20Add\x20explicit\x20user\x20confirmation\x20(C-O-10).\x20Note:\x20transfer_to\x20is\x20allowed\x20at\x20any\x20time\x20(no\x20Progress\x20freeze\x20exists).','evidence':'new_owner='+a['transfer_to_new_owner']};}},R_O_5_01={'id':'R-O-5-01','category':'cross_object','trigger':'Service.machine\x20upgraded\x20after\x20Order\x20creation\x20(snapshot\x20divergence)','check':a=>{if(a['is_buy_operation'])return{'id':'R-O-5-01','level':'LOW','category':'cross_object','title':'Service\x20snapshot\x20mechanism\x20—\x20order.machine\x20is\x20a\x20copy,\x20not\x20a\x20reference','description':'When\x20service::buy()\x20creates\x20an\x20Order,\x20order.machine\x20is\x20COPIED\x20from\x20service.machine.\x20Future\x20Service.machine\x20upgrades\x20do\x20NOT\x20affect\x20this\x20Order.\x20Same\x20Service\x20may\x20have\x20Orders\x20running\x20different\x20Machine\x20versions.','affected_stakeholders':['owner','service_provider','arbitrator'],'scenario':'Service\x20provider\x20upgrades\x20Machine\x20workflow\x20—\x20old\x20Orders\x20keep\x20old\x20workflow','mitigation':'Track\x20Machine\x20version\x20per\x20Order\x20(via\x20order.machine\x20address).\x20Plan\x20migration\x20paths\x20for\x20legacy\x20Orders.\x20Document\x20that\x20old\x20Orders\x20are\x20decoupled.','evidence':'snapshot_mechanism'};return null;}},R_O_5_02={'id':'R-O-5-02','category':'cross_object','trigger':'Order\x20references\x20Progress\x20that\x20no\x20longer\x20exists\x20or\x20is\x20corrupted','check':a=>{if(a['progress_bound']&&a['object'])return{'id':'R-O-5-02','level':'MEDIUM','category':'cross_object','title':'Order-Progress\x201:1\x20binding\x20(E_PROGRESS_ALREADY_SPECIFIED)','description':'Order.progress\x20is\x20one-time-set\x20via\x20on_progress\x20(package-only).\x20Cannot\x20be\x20rebound.\x20If\x20Progress\x20object\x20is\x20corrupted,\x20Order\x20becomes\x20stuck\x20—\x20cannot\x20advance,\x20cannot\x20rebind.','affected_stakeholders':['owner','agent'],'scenario':'Progress\x20object\x20becomes\x20unresponsive\x20or\x20corrupted','mitigation':'Ensure\x20Progress\x20integrity\x20via\x20Machine\x20audit\x20before\x20publishing\x20Service.\x20Use\x20arb_claim_compensation\x20as\x20escape\x20hatch\x20if\x20Progress\x20is\x20stuck.','evidence':'progress_bound='+a['progress_bound']};return null;}},R_O_5_03={'id':'R-O-5-03','category':'cross_object','trigger':'Order\x20references\x20Allocation\x20that\x20no\x20longer\x20exists\x20or\x20is\x20corrupted','check':a=>{if(a['object']&&a['progress_bound'])return{'id':'R-O-5-03','level':'MEDIUM','category':'cross_object','title':'Order-Allocation\x201:1\x20binding\x20(E_ALLOCATION_ALREADY_SPECIFIED)','description':'Order.allocation\x20is\x20one-time-set\x20via\x20on_allocation\x20(package-only).\x20Cannot\x20be\x20rebound.\x20If\x20Allocation\x20object\x20is\x20corrupted,\x20fund\x20distribution\x20is\x20blocked.','affected_stakeholders':['owner','service_provider'],'scenario':'Allocation\x20object\x20has\x20wrong\x20allocator\x20configuration','mitigation':'Audit\x20order_allocators\x20configuration\x20on\x20Service\x20BEFORE\x20publishing.\x20Use\x20compensation_fund\x20as\x20fallback\x20fund\x20source.','evidence':'allocation_binding'};return null;}},R_O_5_04={'id':'R-O-5-04','category':'cross_object','trigger':'Arbitration\x20dispute\x20appended\x20to\x20Order.dispute\x20list','check':a=>{if(a['operation']==='arb_confirm')return{'id':'R-O-5-04','level':'LOW','category':'cross_object','title':'Arb\x20object\x20will\x20be\x20appended\x20to\x20order.dispute\x20(package-only\x20dispute())','description':'arb_confirm\x20triggers\x20Arb\x20module\x20to\x20call\x20order::dispute(arb_address),\x20appending\x20the\x20Arb\x20object\x20to\x20order.dispute\x20list.\x20Max\x2010\x20disputes\x20(MAX_DISPUTE_COUNT).\x20Frozen\x20when\x20claimed_by\x20is\x20set.','affected_stakeholders':['arbitrator','owner','agent'],'scenario':'Multiple\x20arb_confirm\x20calls\x20create\x20multiple\x20Arb\x20objects\x20on\x20same\x20Order','mitigation':'Track\x20dispute\x20count.\x20Once\x20at\x2010,\x20no\x20more\x20disputes\x20can\x20be\x20filed.\x20Resolve\x20existing\x20disputes\x20before\x20filing\x20new\x20ones.','evidence':'operation=arb_confirm,\x20current_disputes='+(a['current_dispute_count']??0x0)};return null;}},R_O_5_05={'id':'R-O-5-05','category':'cross_object','trigger':'External\x20system\x20expects\x20OrderCompletedEvent\x20(does\x20not\x20exist)','check':a=>{if(a['is_buy_operation']||a['object'])return{'id':'R-O-5-05','level':'MEDIUM','category':'cross_object','title':'Only\x20NewOrderEvent\x20emitted\x20—\x20no\x20OrderCompletedEvent','description':'Move\x20contract\x20ONLY\x20emits\x20NewOrderEvent\x20at\x20creation.\x20Order\x20completion/cancellation/refund\x20are\x20IMPLICIT\x20—\x20must\x20be\x20inferred\x20by\x20querying\x20Progress.current_node\x20(terminal?\x20cancel?)\x20or\x20Order.claimed_by.\x20External\x20monitoring\x20requires\x20polling,\x20not\x20event-driven.','affected_stakeholders':['system'],'scenario':'Analytics\x20dashboard\x20expects\x20OrderCompletedEvent\x20to\x20track\x20completion\x20rate','mitigation':'Build\x20composite\x20query:\x20NewOrderEvent\x20+\x20Order.progress\x20query\x20→\x20infer\x20completion.\x20Document\x20this\x20limitation\x20in\x20monitoring\x20tools.\x20Long-term:\x20advocate\x20for\x20Move\x20upgrade\x20to\x20add\x20OrderCompletedEvent.','evidence':'no_order_completed_event'};return null;}},R_O_5_06={'id':'R-O-5-06','category':'cross_object','trigger':'service::buy\x20pre-flight:\x20Service\x20not\x20published\x20or\x20paused','check':a=>{if(!a['is_buy_operation'])return null;if(a['service_published']===![])return{'id':'R-O-5-06','level':'CRITICAL','category':'cross_object','title':'Service\x20not\x20published\x20—\x20service::buy\x20will\x20abort\x20E_NOT_PUBLISHED','description':'Cannot\x20create\x20Order\x20from\x20an\x20unpublished\x20Service.\x20Service\x20must\x20be\x20published\x20(bPublished=true)\x20before\x20service::buy()\x20can\x20be\x20called.','affected_stakeholders':['owner'],'scenario':'Buyer\x20attempts\x20to\x20purchase\x20from\x20a\x20draft\x20Service','mitigation':'Verify\x20Service.bPublished=true\x20before\x20service::buy().\x20Service\x20owner\x20must\x20call\x20service::publish()\x20first.','evidence':'service_published='+a['service_published']};if(a['service_paused']===!![])return{'id':'R-O-5-06','level':'CRITICAL','category':'cross_object','title':'Service\x20paused\x20—\x20service::buy\x20will\x20abort\x20E_PAUSED','description':'Cannot\x20create\x20Order\x20from\x20a\x20paused\x20Service.\x20Service\x20must\x20be\x20unpaused\x20before\x20service::buy()\x20can\x20be\x20called.','affected_stakeholders':['owner'],'scenario':'Buyer\x20attempts\x20to\x20purchase\x20from\x20a\x20paused\x20Service\x20(e.g.\x20during\x20maintenance)','mitigation':'Wait\x20for\x20Service\x20owner\x20to\x20call\x20service::pause(false).\x20Check\x20Service.paused\x20before\x20service::buy().','evidence':'service_paused='+a['service_paused']};return null;}},ALL_RULES=[R_O_1_01,R_O_1_02,R_O_1_03,R_O_1_04,R_O_1_05,R_O_2_01,R_O_2_02,R_O_2_03,R_O_2_04,R_O_3_01,R_O_3_02,R_O_3_03,R_O_3_04,R_O_4_01,R_O_4_02,R_O_4_03,R_O_4_04,R_O_4_05,R_O_4_06,R_O_5_01,R_O_5_02,R_O_5_03,R_O_5_04,R_O_5_05,R_O_5_06];export const ORDER_RISK_VERSION='1.0.0';export function getAllOrderRiskRules(){return[...ALL_RULES];}export function getOrderRiskRulesCount(){return ALL_RULES['length'];}export function getOrderRiskRulesByCategory(a){return ALL_RULES['filter'](b=>b['category']===a);}export function getOrderRiskRuleById(a){return ALL_RULES['find'](b=>b['id']===a);}export function assessOrderRisks(a){const b=[];for(const g of ALL_RULES){const h=g['check'](a);if(h)b['push'](h);}const c=b['length']===0x0?'LOW':b['some'](i=>i['level']==='CRITICAL')?'CRITICAL':b['some'](i=>i['level']==='HIGH')?'HIGH':b['some'](i=>i['level']==='MEDIUM')?'MEDIUM':'LOW',d={};for(const i of b){d[i['category']]=(d[i['category']]??0x0)+0x1;}const e={};for(const j of b){for(const k of j['affected_stakeholders']){if(!e[k])e[k]=[];e[k]['push'](j['id']+':\x20'+j['mitigation']);}}let f;if(a['operation']){const l={'agent_set':'order_set_agent','required_info_update':'order_required_info','progress_advance':'order_advance','arb_confirm':'order_arb_confirm','arb_objection':'order_arb_objection','arb_claim_compensation':'order_arb_claim_compensation','receive':'order_receive','transfer_to':'order_transfer','service_buy':'order_create'};f=findSceneById(l[a['operation']]??'');}return{'summary':'Assessed\x20'+b['length']+'\x20risk(s)\x20across\x20'+Object['keys'](d)['length']+'\x20categories','scene':f,'risks':b,'overall_risk':c,'risks_by_category':d,'stakeholder_advice':e,'needs_human_review':b['some'](m=>m['level']==='CRITICAL'||m['level']==='HIGH')};}export function checkPermissionLayer(a,b,c){const d=['transfer_to','owner_change','agent_set','required_info_update'],e=['progress_advance','arb_confirm','arb_objection'],f=['on_progress','on_allocation','dispute','compensate'],g=['receive','arb_claim_compensation'];if(f['includes'](a))return{'allowed':![],'layer':'L3_package_only','reason':'Package-only\x20—\x20not\x20callable\x20externally'};if(d['includes'](a)){if(!b)return{'allowed':![],'layer':'L1_owner_only','reason':'Owner-only\x20operation\x20('+a+')\x20—\x20agent\x20or\x20unauthorized\x20caller'};return{'allowed':!![],'layer':'L1_owner_only'};}if(e['includes'](a)){if(!b&&!c)return{'allowed':![],'layer':'L2_owner_or_agent','reason':'Requires\x20owner\x20or\x20agent\x20permission\x20('+a+')'};return{'allowed':!![],'layer':'L2_owner_or_agent'};}if(g['includes'](a)){if(a==='receive')return{'allowed':!![],'layer':'L4_object_gated','reason':'No\x20permission\x20assert\x20—\x20caller\x20must\x20hold\x20a\x20Receiving\x20created\x20by\x20allocation::alloc;\x20funds\x20always\x20go\x20to\x20order.owner'};return{'allowed':!![],'layer':'L4_object_gated','reason':'No\x20op-permission\x20assert\x20—\x20gated\x20by\x20Arb\x20status\x20(must\x20be\x20Arbirated);\x20compensation\x20paid\x20to\x20tx\x20sender'};}return{'allowed':![],'layer':'L3_package_only','reason':'Unknown\x20operation:\x20'+a};}
+import{MAX_AGENT_COUNT,MAX_DISPUTE_COUNT}from'@wowok/wowok';import{findSceneById}from'./order-ledger.js';const R_O_1_01={'id':'R-O-1-01','category':'structural','trigger':'Order\x20has\x2014\x20fields\x20but\x20no\x20Permission\x20field\x20(unique\x20among\x2022\x20objects)','check':a=>{if(a['is_buy_operation'])return{'id':'R-O-1-01','level':'LOW','category':'structural','title':'Order\x20uses\x20owner/agent\x20dual-layer\x20(no\x20Permission)','description':'Order\x20is\x20the\x20only\x20business\x20object\x20among\x2022\x20WoWok\x20objects\x20that\x20does\x20NOT\x20use\x20the\x20Permission\x20system.\x20All\x20access\x20control\x20flows\x20through\x20assert_owner\x20and\x20has_op_permission\x20inline\x20functions.','affected_stakeholders':['system','owner','agent'],'scenario':'Developer\x20assumes\x20Order\x20uses\x20Permission\x20and\x20writes\x20permission::check\x20logic','mitigation':'Use\x20owner/agent\x20checks\x20directly.\x20Do\x20NOT\x20attempt\x20to\x20apply\x20a\x20Permission\x20object\x20to\x20Order.','evidence':'no_permission_field'};return null;}},R_O_1_02={'id':'R-O-1-02','category':'structural','trigger':'Item\x20count\x20check\x20(informational;\x20no\x20Move-level\x20limit\x20on\x20items)','check':a=>{if(!a['items']||a['items']['length']===0x0)return null;if(a['items']['length']>0x32)return{'id':'R-O-1-02','level':'LOW','category':'structural','title':'Large\x20items\x20list\x20may\x20exceed\x20tx\x20size\x20limits','description':a['items']['length']+'\x20items\x20in\x20a\x20single\x20Order\x20—\x20no\x20protocol\x20limit,\x20but\x20large\x20lists\x20increase\x20transaction\x20size\x20and\x20may\x20hit\x20gas/size\x20limits','affected_stakeholders':['owner'],'scenario':'Bulk\x20purchase\x20with\x20many\x20line\x20items','mitigation':'Split\x20into\x20multiple\x20Orders\x20if\x20items\x20>\x2050','evidence':'items_count='+a['items']['length']};return null;}},R_O_1_03={'id':'R-O-1-03','category':'structural','trigger':'dispute\x20count\x20>=\x20MAX_DISPUTE_COUNT\x20(10)','check':a=>{const b=a['current_dispute_count']??0x0;if(b>=MAX_DISPUTE_COUNT)return{'id':'R-O-1-03','level':'HIGH','category':'structural','title':'Dispute\x20count\x20at\x20MAX_DISPUTE_COUNT\x20limit','description':'Order\x20already\x20has\x20'+b+'\x20disputes\x20(MAX_DISPUTE_COUNT='+MAX_DISPUTE_COUNT+').\x20Next\x20dispute()\x20call\x20will\x20abort\x20E_MAX_DISPUTE_COUNT.','affected_stakeholders':['owner','agent','arbitrator'],'scenario':'Filing\x2011th\x20dispute\x20on\x20an\x20Order\x20with\x2010\x20existing\x20disputes','mitigation':'Resolve\x20existing\x20disputes\x20(via\x20arb_claim_compensation)\x20before\x20filing\x20new\x20ones.\x20Note:\x20claimed_by\x20blocks\x20ALL\x20future\x20disputes.','evidence':'dispute_count='+b};return null;}},R_O_1_04={'id':'R-O-1-04','category':'structural','trigger':'agent_set\x20—\x20list\x20REPLACEMENT\x20semantics\x20(omitted\x20agents\x20lose\x20access)\x20and\x20distinct\x20count\x20limit','check':a=>{if(!a['agent_set'])return null;const b=new Set(a['agent_set']['agents'])['size'];if(b>MAX_AGENT_COUNT)return{'id':'R-O-1-04','level':'HIGH','category':'structural','title':'Distinct\x20agent\x20count\x20exceeds\x20MAX_AGENT_COUNT','description':'Attempting\x20to\x20set\x20'+b+'\x20distinct\x20agents\x20(input\x20'+a['agent_set']['agents']['length']+';\x20duplicates\x20are\x20deduped\x20on-chain).\x20Move\x20asserts\x20length\x20<\x20MAX_AGENT_COUNT\x20('+MAX_AGENT_COUNT+')\x20before\x20each\x20push\x20—\x20the\x20call\x20will\x20abort\x20E_MAX_AGENT_COUNT.','affected_stakeholders':['owner','system'],'scenario':'Setting\x2011\x20distinct\x20agents\x20in\x20one\x20call','mitigation':'Reduce\x20to\x20at\x20most\x20'+MAX_AGENT_COUNT+'\x20distinct\x20agents\x20per\x20call,\x20or\x20set\x20in\x20two\x20batches\x20(second\x20call\x20REPLACES\x20the\x20first\x20—\x20union\x20the\x20lists\x20manually).','evidence':'distinct_agents='+b+',\x20input_count='+a['agent_set']['agents']['length']+',\x20max='+MAX_AGENT_COUNT};return null;}},R_O_1_05={'id':'R-O-1-05','category':'structural','trigger':'wip_hash\x20is\x20empty\x20string\x20in\x20any\x20item','check':a=>{if(!a['items'])return null;const b=a['items']['find'](c=>!c['wip_hash']||c['wip_hash']==='');if(b)return{'id':'R-O-1-05','level':'HIGH','category':'structural','title':'Empty\x20wip_hash\x20in\x20item','description':'Item\x20\x22'+b['name']+'\x22\x20has\x20empty\x20wip_hash.\x20Move\x20rejects\x20empty\x20strings\x20(F-O-18).','affected_stakeholders':['owner'],'scenario':'User\x20submits\x20item\x20without\x20computing\x20WIP\x20hash','mitigation':'Compute\x20wip_hash\x20from\x20the\x20work-in-progress\x20file\x20content\x20before\x20service::buy().','evidence':'item_name='+b['name']};return null;}},R_O_2_01={'id':'R-O-2-01','category':'semantic','trigger':'Order.machine\x20snapshot\x20differs\x20from\x20current\x20Service.machine','check':a=>{if(!a['current_service_machine']||!a['order_machine_snapshot'])return null;if(a['current_service_machine']!==a['order_machine_snapshot'])return{'id':'R-O-2-01','level':'HIGH','category':'semantic','title':'Machine\x20snapshot\x20diverges\x20from\x20Service.machine','description':'Order.machine='+a['order_machine_snapshot']+'\x20was\x20snapshotted\x20at\x20buy\x20time.\x20Service.machine\x20is\x20now\x20'+a['current_service_machine']+'.\x20Same\x20Service\x20has\x20Orders\x20running\x20different\x20Machine\x20versions.','affected_stakeholders':['owner','service_provider','arbitrator'],'scenario':'Service\x20provider\x20upgrades\x20Machine\x20after\x20some\x20Orders\x20are\x20created','mitigation':'Audit\x20each\x20Order\x27s\x20machine\x20snapshot\x20separately.\x20Document\x20Machine\x20version\x20per\x20Order.\x20Plan\x20migration\x20paths\x20for\x20legacy\x20Orders.','evidence':'order_machine='+a['order_machine_snapshot']+',\x20service_machine='+a['current_service_machine']};return null;}},R_O_2_02={'id':'R-O-2-02','category':'semantic','trigger':'SDK\x20uses\x20\x27builder\x27\x20field\x20for\x20Move\x27s\x20\x27owner\x27\x20field\x20(naming\x20deviation)','check':a=>{if(a['object'])return{'id':'R-O-2-02','level':'MEDIUM','category':'semantic','title':'SDK\x20builder\x20≠\x20Move\x20owner\x20(only\x20naming\x20deviation\x20in\x2022\x20objects)','description':'SDK\x20ObjectOrder.builder\x20corresponds\x20to\x20Move\x20Order.owner.\x20This\x20is\x20the\x20only\x20field\x20name\x20deviation\x20across\x20all\x2022\x20WoWok\x20objects.\x20All\x20Order\x20knowledge\x20uses\x20Move\x27s\x20\x27owner\x27\x20as\x20canonical.','affected_stakeholders':['system'],'scenario':'Developer\x20reads\x20SDK\x20\x27builder\x27\x20and\x20assumes\x20it\x27s\x20a\x20different\x20concept\x20from\x20owner','mitigation':'Use\x20moveToSdkField()/sdkToMoveField()\x20helpers\x20from\x20order-ledger.ts.\x20Document\x20\x27builder\x20=\x20owner\x27\x20in\x20all\x20SDK\x20consumers.','evidence':'sdk_field=builder,\x20move_field=owner'};return null;}},R_O_2_03={'id':'R-O-2-03','category':'semantic','trigger':'E_PROGRESS_NOT_SPECIFIED\x20—\x20single\x20real\x20semantics\x20(order::create\x20without\x20Progress),\x20commonly\x20misdocumented\x20as\x20an\x20agent_set/owner_change\x20freeze','check':a=>{if(!a['operation'])return null;if(a['operation']==='service_buy'&&a['progress_bound']===![])return{'id':'R-O-2-03','level':'HIGH','category':'semantic','title':'order::create\x20will\x20abort\x20E_PROGRESS_NOT_SPECIFIED\x20—\x20machine\x20bound\x20but\x20Progress\x20missing','description':'order::create\x20asserts\x20progress.is_some()\x20whenever\x20machine.is_some()\x20(order.move:132).\x20A\x20buy\x20against\x20a\x20machine-driven\x20Service\x20MUST\x20bind\x20a\x20Progress\x20object\x20(service::order_progress)\x20before\x20order::create,\x20else\x20E_PROGRESS_NOT_SPECIFIED\x20(code\x203).','affected_stakeholders':['owner'],'scenario':'Machine-driven\x20Service\x20purchased\x20without\x20creating/binding\x20the\x20Progress\x20object\x20first','mitigation':'Bind\x20Progress\x20before\x20order::create:\x20call\x20service::order_progress(service,\x20order,\x20machine,\x20...)\x20which\x20invokes\x20order::on_progress.\x20Note:\x20agent_set/owner_change\x20are\x20NOT\x20affected\x20—\x20they\x20are\x20never\x20frozen\x20by\x20Progress\x20binding.','evidence':'operation='+a['operation']+',\x20progress_bound='+a['progress_bound']};return null;}},R_O_2_04={'id':'R-O-2-04','category':'semantic','trigger':'SaleItem.item\x20→\x20PurchasedItem.name\x20field\x20name\x20mapping','check':a=>{if(a['is_buy_operation'])return{'id':'R-O-2-04','level':'LOW','category':'semantic','title':'SaleItem.item\x20(Move)\x20maps\x20to\x20PurchasedItem.name\x20(SDK)','description':'Move\x20struct\x20SaleItem\x20uses\x20field\x20\x27item\x27,\x20but\x20SDK\x20ObjectOrder.items\x20uses\x20field\x20\x27name\x27.\x20This\x20is\x20the\x20second\x20naming\x20deviation\x20in\x20Order\x20system\x20(after\x20builder/owner).','affected_stakeholders':['system'],'scenario':'Cross-layer\x20data\x20mapping\x20between\x20Move\x20and\x20SDK','mitigation':'Use\x20consistent\x20SDK\x20field\x20names\x20in\x20user-facing\x20code;\x20document\x20Move\x20↔\x20SDK\x20mapping\x20in\x20audit\x20logs.','evidence':'move_field=SaleItem.item,\x20sdk_field=PurchasedItem.name'};return null;}},R_O_3_01={'id':'R-O-3-01','category':'authority','trigger':'Agent\x20attempts\x20receive\x20or\x20transfer_to\x20(L1\x20owner-only\x20operations)','check':a=>{if(!a['operation'])return null;if((a['operation']==='receive'||a['operation']==='transfer_to')&&a['caller_is_agent']&&!a['caller_is_owner'])return{'id':'R-O-3-01','level':'HIGH','category':'authority','title':'Agent\x20attempting\x20owner-only\x20operation','description':'Agent\x20cannot\x20call\x20'+a['operation']+'\x20—\x20these\x20are\x20L1\x20owner-only\x20operations\x20(assert_owner).\x20Agent\x20can\x20operate\x20progress/arb_*/required_info\x20but\x20CANNOT\x20receive\x20funds\x20or\x20transfer\x20ownership.','affected_stakeholders':['agent','owner'],'scenario':'Logistics\x20agent\x20tries\x20to\x20collect\x20payment\x20on\x20behalf\x20of\x20buyer','mitigation':'Owner\x20must\x20call\x20receive/transfer_to\x20directly.\x20If\x20delegation\x20is\x20needed,\x20owner\x20can\x20transfer_to\x20a\x20multi-sig\x20wallet\x20that\x20includes\x20the\x20agent.','evidence':'operation='+a['operation']+',\x20caller=agent'};return null;}},R_O_3_02={'id':'R-O-3-02','category':'authority','trigger':'Non-owner\x20non-agent\x20attempts\x20operation\x20(no\x20permission)','check':a=>{if(!a['operation'])return null;if(a['caller_is_owner']===![]&&a['caller_is_agent']===![])return{'id':'R-O-3-02','level':'HIGH','category':'authority','title':'Non-owner\x20non-agent\x20attempting\x20operation','description':'Caller\x20is\x20neither\x20owner\x20nor\x20agent.\x20L2\x20operations\x20(progress,\x20arb_confirm,\x20arb_objection)\x20require\x20has_op_permission\x20—\x20aborts\x20E_NOT_OP_PERMISSION.\x20L1\x20operations\x20(transfer_to,\x20agent_set,\x20required_info_update)\x20additionally\x20require\x20assert_owner\x20—\x20aborts\x20E_NOT_THE_OWNER.','affected_stakeholders':['system'],'scenario':'Random\x20address\x20attempts\x20to\x20advance\x20someone\x20else\x27s\x20Order','mitigation':'Verify\x20caller\x20is\x20owner\x20or\x20in\x20agent[]\x20before\x20submitting\x20transaction.','evidence':'operation='+a['operation']+',\x20caller=unauthorized'};return null;}},R_O_3_03={'id':'R-O-3-03','category':'authority','trigger':'arb_claim_compensation\x20called\x20(sets\x20claimed_by,\x20irreversible)','check':a=>{if(a['operation']!=='arb_claim_compensation')return null;return{'id':'R-O-3-03','level':'HIGH','category':'authority','title':'arb_claim_compensation\x20is\x20IRREVERSIBLE\x20(claimed_by\x20one-time\x20set)','description':'Setting\x20claimed_by\x20is\x20permanent.\x20After\x20this\x20call:\x20(1)\x20claimed_by\x20cannot\x20be\x20reset,\x20(2)\x20NO\x20new\x20disputes\x20can\x20be\x20filed\x20(E_ORDER_ALREADY_CLAIMED),\x20(3)\x20all\x20unresolved\x20disputes\x20become\x20unactionable.\x20If\x20first\x20compensation\x20is\x20insufficient,\x20buyer\x20has\x20no\x20recourse.','affected_stakeholders':['owner','agent','arbitrator'],'scenario':'Buyer\x20claims\x20partial\x20compensation,\x20then\x20discovers\x20additional\x20damages','mitigation':'BEFORE\x20claiming:\x20(1)\x20enumerate\x20ALL\x20disputes,\x20(2)\x20ensure\x20proposition\x20covers\x20all\x20damages,\x20(3)\x20confirm\x20Arb\x20ruling\x20is\x20final.\x20Add\x20explicit\x20user\x20confirmation\x20(C-O-08).','evidence':'operation=arb_claim_compensation,\x20current_claimed_by='+(a['claimed_by_set']??![])};}},R_O_3_04={'id':'R-O-3-04','category':'authority','trigger':'dispute\x20attempted\x20after\x20claimed_by\x20is\x20set','check':a=>{if(a['claimed_by_set']&&(a['operation']==='arb_confirm'||a['operation']==='arb_objection'))return{'id':'R-O-3-04','level':'HIGH','category':'authority','title':'Cannot\x20file\x20new\x20dispute\x20after\x20claimed_by\x20is\x20set','description':'Order.claimed_by\x20is\x20set\x20—\x20any\x20new\x20dispute()\x20call\x20aborts\x20E_ORDER_ALREADY_CLAIMED.\x20arb_confirm/arb_objection\x20trigger\x20dispute()\x20internally.','affected_stakeholders':['owner','agent'],'scenario':'Buyer\x20claims\x20compensation\x20then\x20tries\x20to\x20file\x20additional\x20dispute','mitigation':'Resolve\x20ALL\x20disputes\x20BEFORE\x20calling\x20arb_claim_compensation.\x20claimed_by\x20is\x20terminal\x20for\x20dispute\x20flow.','evidence':'operation='+a['operation']+',\x20claimed_by_set=true'};return null;}},R_O_4_01={'id':'R-O-4-01','category':'lifecycle','trigger':'Attempt\x20to\x20create\x20Order\x20independently\x20(not\x20via\x20service::buy)','check':a=>{if(a['is_buy_operation']===![]&&a['operation']==='service_buy'&&!a['object'])return{'id':'R-O-4-01','level':'CRITICAL','category':'lifecycle','title':'Order\x20cannot\x20be\x20created\x20independently\x20(compound\x20creation\x20only)','description':'order::new()\x20is\x20package-only\x20—\x20only\x20service::buy()\x20can\x20create\x20Orders.\x20Any\x20attempt\x20to\x20call\x20order::new\x20directly\x20will\x20fail\x20at\x20the\x20Move\x20module\x20boundary.\x20Order\x20+\x20Allocation\x20+\x20Progress\x20are\x20created\x20atomically\x20in\x20one\x20transaction.','affected_stakeholders':['system','owner'],'scenario':'Developer\x20tries\x20to\x20construct\x20Order\x20independently\x20for\x20testing','mitigation':'Always\x20use\x20service::buy()\x20to\x20create\x20Orders.\x20For\x20testing,\x20deploy\x20a\x20minimal\x20Service\x20with\x20machine/allocators\x20configured.','evidence':'independent_creation_attempted'};return null;}},R_O_4_02={'id':'R-O-4-02','category':'lifecycle','trigger':'agent_set\x20attempted\x20mid-fulfillment\x20(Progress\x20bound)\x20—\x20replacement\x20may\x20revoke\x20active\x20agents','check':a=>{if(!a['operation'])return null;if(a['operation']==='agent_set'&&a['progress_bound'])return{'id':'R-O-4-02','level':'MEDIUM','category':'lifecycle','title':'Mid-fulfillment\x20agent_set\x20—\x20replacement\x20may\x20silently\x20revoke\x20active\x20agents','description':'agent_set\x20is\x20allowed\x20at\x20ANY\x20time\x20(no\x20Progress\x20freeze\x20exists\x20on-chain),\x20but\x20it\x20REPLACES\x20the\x20entire\x20list:\x20an\x20active\x20agent\x20omitted\x20from\x20the\x20new\x20list\x20immediately\x20loses\x20L2\x20access\x20(Progress\x20advance,\x20arb\x20operations)\x20and\x20their\x20EntityOrders\x20role\x20record\x20is\x20removed.\x20A\x20workflow\x20waiting\x20on\x20that\x20agent\x20to\x20advance\x20Progress\x20would\x20stall.','affected_stakeholders':['owner','agent'],'scenario':'Owner\x20adjusts\x20the\x20agent\x20list\x20mid-fulfillment\x20and\x20accidentally\x20drops\x20the\x20agent\x20responsible\x20for\x20the\x20next\x20Progress\x20node','mitigation':'When\x20changing\x20agents\x20mid-fulfillment,\x20always\x20include\x20the\x20union\x20of\x20current\x20active\x20agents\x20plus\x20the\x20additions.\x20Query\x20the\x20current\x20agent\x20list\x20first\x20(order\x20query),\x20merge,\x20then\x20submit.','evidence':'operation=agent_set,\x20progress_bound='+a['progress_bound']};return null;}},R_O_4_03={'id':'R-O-4-03','category':'lifecycle','trigger':'Progress\x20advance\x20attempted\x20without\x20progress\x20bound','check':a=>{if(a['operation']==='progress_advance'&&a['progress_bound']===![])return{'id':'R-O-4-03','level':'HIGH','category':'lifecycle','title':'Cannot\x20advance\x20Progress\x20—\x20no\x20Progress\x20bound\x20to\x20Order','description':'Order\x20has\x20no\x20progress\x20field\x20set\x20(Service\x20had\x20no\x20machine\x20configured).\x20Cannot\x20advance\x20a\x20non-existent\x20Progress.\x20SDK\x20CallOrder\x20validates\x20this\x20pre-flight\x20(CallOrder_Data.progress\x20requires\x20order.machine\x20and\x20order.progress).','affected_stakeholders':['owner','agent'],'scenario':'Buyer\x20tries\x20to\x20advance\x20Progress\x20on\x20an\x20Order\x20created\x20from\x20a\x20Service\x20without\x20machine','mitigation':'Use\x20a\x20Service\x20with\x20machine\x20configured.\x20If\x20manual\x20lifecycle\x20is\x20needed,\x20track\x20state\x20off-chain.','evidence':'operation=progress_advance,\x20progress_bound=false'};return null;}},R_O_4_04={'id':'R-O-4-04','category':'lifecycle','trigger':'arb_confirm/arb_objection/arb_claim_compensation\x20(irreversible\x20Arb\x20operations)','check':a=>{if(!a['operation'])return null;if(a['operation']==='arb_confirm'||a['operation']==='arb_objection'||a['operation']==='arb_claim_compensation')return{'id':'R-O-4-04','level':'HIGH','category':'lifecycle','title':a['operation']+'\x20is\x20irreversible\x20(triggers\x20Arb\x20flow)','description':a['operation']+'\x20triggers\x20the\x20Arbitration\x20workflow\x20which\x20cannot\x20be\x20undone.\x20arb_confirm\x20files\x20a\x20new\x20dispute,\x20arb_objection\x20requests\x20re-arbitration,\x20arb_claim_compensation\x20sets\x20claimed_by\x20permanently.','affected_stakeholders':['owner','agent','arbitrator'],'scenario':'User\x20accidentally\x20files\x20arb_confirm\x20without\x20understanding\x20consequences','mitigation':'Add\x20explicit\x20user\x20confirmation\x20(C-O-08,\x20C-O-11,\x20C-O-12)\x20before\x20these\x20operations.\x20Show\x20warning\x20text\x20describing\x20irreversibility.','evidence':'operation='+a['operation']};return null;}},R_O_4_05={'id':'R-O-4-05','category':'lifecycle','trigger':'receive\x20attempted\x20but\x20no\x20Receiving\x20exists\x20at\x20the\x20caller\x27s\x20address\x20(allocation::alloc\x20has\x20not\x20distributed\x20a\x20payment)','check':a=>{if(a['operation']==='receive'&&a['receiving_exists']===![])return{'id':'R-O-4-05','level':'HIGH','category':'lifecycle','title':'receive\x20blocked\x20—\x20no\x20Receiving\x20object\x20(allocation::alloc\x20has\x20not\x20run)','description':'owner_receive\x20is\x20gated\x20by\x20Receiving\x20existence:\x20allocation::alloc\x20must\x20have\x20run\x20on\x20the\x20Order\x27s\x20Allocation\x20object\x20and\x20included\x20the\x20caller\x27s\x20address\x20in\x20the\x20payment\x20recipients.\x20Without\x20a\x20Receiving,\x20the\x20transaction\x20cannot\x20be\x20constructed\x20(no\x20E_ORDER_DELIVERING\x20abort\x20exists\x20on-chain\x20—\x20Progress\x20terminal\x20state\x20is\x20NOT\x20a\x20receive\x20gate).','affected_stakeholders':['owner'],'scenario':'Buyer\x20tries\x20to\x20collect\x20a\x20payment\x20before\x20the\x20allocation\x20flow\x20has\x20distributed\x20it','mitigation':'1)\x20Confirm\x20allocation::alloc\x20has\x20run\x20on\x20the\x20Order\x27s\x20Allocation\x20(query\x20its\x20payment\x20vector)\x202)\x20Confirm\x20the\x20caller\x27s\x20address\x20is\x20in\x20the\x20allocator\x27s\x20sharing\x20recipients\x203)\x20Retry\x20receive\x20with\x20the\x20correct\x20Receiving\x20object\x20ID.\x20If\x20the\x20merchant\x20withholds\x20allocation,\x20file\x20arb_confirm\x20to\x20dispute.','evidence':'operation=receive,\x20receiving_exists='+a['receiving_exists']};return null;}},R_O_4_06={'id':'R-O-4-06','category':'lifecycle','trigger':'transfer_to\x20attempted\x20(irreversible\x20ownership\x20transfer)','check':a=>{if(a['operation']!=='transfer_to')return null;return{'id':'R-O-4-06','level':'CRITICAL','category':'lifecycle','title':'transfer_to\x20is\x20IRREVERSIBLE\x20—\x20new\x20owner\x20takes\x20over\x20ALL\x20permissions','description':'Ownership\x20transfer\x20to\x20'+(a['transfer_to_new_owner']??'(unknown)')+'\x20is\x20permanent.\x20New\x20owner\x20becomes\x20the\x20sole\x20receiver\x20of\x20payments\x20and\x20gains\x20full\x20L1\x20control.\x20Original\x20owner\x20loses\x20ALL\x20access.','affected_stakeholders':['owner'],'scenario':'Buyer\x20transfers\x20Order\x20to\x20wrong\x20address\x20by\x20mistake','mitigation':'1)\x20Verify\x20new\x20owner\x20address\x20twice.\x202)\x20Coordinate\x20with\x20new\x20owner\x20before\x20transfer.\x203)\x20Add\x20explicit\x20user\x20confirmation\x20(C-O-10).\x20Note:\x20transfer_to\x20is\x20allowed\x20at\x20any\x20time\x20(no\x20Progress\x20freeze\x20exists).','evidence':'new_owner='+a['transfer_to_new_owner']};}},R_O_5_01={'id':'R-O-5-01','category':'cross_object','trigger':'Service.machine\x20upgraded\x20after\x20Order\x20creation\x20(snapshot\x20divergence)','check':a=>{if(a['is_buy_operation'])return{'id':'R-O-5-01','level':'LOW','category':'cross_object','title':'Service\x20snapshot\x20mechanism\x20—\x20order.machine\x20is\x20a\x20copy,\x20not\x20a\x20reference','description':'When\x20service::buy()\x20creates\x20an\x20Order,\x20order.machine\x20is\x20COPIED\x20from\x20service.machine.\x20Future\x20Service.machine\x20upgrades\x20do\x20NOT\x20affect\x20this\x20Order.\x20Same\x20Service\x20may\x20have\x20Orders\x20running\x20different\x20Machine\x20versions.','affected_stakeholders':['owner','service_provider','arbitrator'],'scenario':'Service\x20provider\x20upgrades\x20Machine\x20workflow\x20—\x20old\x20Orders\x20keep\x20old\x20workflow','mitigation':'Track\x20Machine\x20version\x20per\x20Order\x20(via\x20order.machine\x20address).\x20Plan\x20migration\x20paths\x20for\x20legacy\x20Orders.\x20Document\x20that\x20old\x20Orders\x20are\x20decoupled.','evidence':'snapshot_mechanism'};return null;}},R_O_5_02={'id':'R-O-5-02','category':'cross_object','trigger':'Order\x20references\x20Progress\x20that\x20no\x20longer\x20exists\x20or\x20is\x20corrupted','check':a=>{if(a['progress_bound']&&a['object'])return{'id':'R-O-5-02','level':'MEDIUM','category':'cross_object','title':'Order-Progress\x201:1\x20binding\x20(E_PROGRESS_ALREADY_SPECIFIED)','description':'Order.progress\x20is\x20one-time-set\x20via\x20on_progress\x20(package-only).\x20Cannot\x20be\x20rebound.\x20If\x20Progress\x20object\x20is\x20corrupted,\x20Order\x20becomes\x20stuck\x20—\x20cannot\x20advance,\x20cannot\x20rebind.','affected_stakeholders':['owner','agent'],'scenario':'Progress\x20object\x20becomes\x20unresponsive\x20or\x20corrupted','mitigation':'Ensure\x20Progress\x20integrity\x20via\x20Machine\x20audit\x20before\x20publishing\x20Service.\x20Use\x20arb_claim_compensation\x20as\x20escape\x20hatch\x20if\x20Progress\x20is\x20stuck.','evidence':'progress_bound='+a['progress_bound']};return null;}},R_O_5_03={'id':'R-O-5-03','category':'cross_object','trigger':'Order\x20references\x20Allocation\x20that\x20no\x20longer\x20exists\x20or\x20is\x20corrupted','check':a=>{if(a['object']&&a['progress_bound'])return{'id':'R-O-5-03','level':'MEDIUM','category':'cross_object','title':'Order-Allocation\x201:1\x20binding\x20(E_ALLOCATION_ALREADY_SPECIFIED)','description':'Order.allocation\x20is\x20one-time-set\x20via\x20on_allocation\x20(package-only).\x20Cannot\x20be\x20rebound.\x20If\x20Allocation\x20object\x20is\x20corrupted,\x20fund\x20distribution\x20is\x20blocked.','affected_stakeholders':['owner','service_provider'],'scenario':'Allocation\x20object\x20has\x20wrong\x20allocator\x20configuration','mitigation':'Audit\x20order_allocators\x20configuration\x20on\x20Service\x20BEFORE\x20publishing.\x20Use\x20compensation_fund\x20as\x20fallback\x20fund\x20source.','evidence':'allocation_binding'};return null;}},R_O_5_04={'id':'R-O-5-04','category':'cross_object','trigger':'Arbitration\x20dispute\x20appended\x20to\x20Order.dispute\x20list','check':a=>{if(a['operation']==='arb_confirm')return{'id':'R-O-5-04','level':'LOW','category':'cross_object','title':'Arb\x20object\x20will\x20be\x20appended\x20to\x20order.dispute\x20(package-only\x20dispute())','description':'arb_confirm\x20triggers\x20Arb\x20module\x20to\x20call\x20order::dispute(arb_address),\x20appending\x20the\x20Arb\x20object\x20to\x20order.dispute\x20list.\x20Max\x2010\x20disputes\x20(MAX_DISPUTE_COUNT).\x20Frozen\x20when\x20claimed_by\x20is\x20set.','affected_stakeholders':['arbitrator','owner','agent'],'scenario':'Multiple\x20arb_confirm\x20calls\x20create\x20multiple\x20Arb\x20objects\x20on\x20same\x20Order','mitigation':'Track\x20dispute\x20count.\x20Once\x20at\x2010,\x20no\x20more\x20disputes\x20can\x20be\x20filed.\x20Resolve\x20existing\x20disputes\x20before\x20filing\x20new\x20ones.','evidence':'operation=arb_confirm,\x20current_disputes='+(a['current_dispute_count']??0x0)};return null;}},R_O_5_05={'id':'R-O-5-05','category':'cross_object','trigger':'External\x20system\x20expects\x20OrderCompletedEvent\x20(does\x20not\x20exist)','check':a=>{if(a['is_buy_operation']||a['object'])return{'id':'R-O-5-05','level':'MEDIUM','category':'cross_object','title':'Only\x20NewOrderEvent\x20emitted\x20—\x20no\x20OrderCompletedEvent','description':'Move\x20contract\x20ONLY\x20emits\x20NewOrderEvent\x20at\x20creation.\x20Order\x20completion/cancellation/refund\x20are\x20IMPLICIT\x20—\x20must\x20be\x20inferred\x20by\x20querying\x20Progress.current_node\x20(terminal?\x20cancel?)\x20or\x20Order.claimed_by.\x20External\x20monitoring\x20requires\x20polling,\x20not\x20event-driven.','affected_stakeholders':['system'],'scenario':'Analytics\x20dashboard\x20expects\x20OrderCompletedEvent\x20to\x20track\x20completion\x20rate','mitigation':'Build\x20composite\x20query:\x20NewOrderEvent\x20+\x20Order.progress\x20query\x20→\x20infer\x20completion.\x20Document\x20this\x20limitation\x20in\x20monitoring\x20tools.\x20Long-term:\x20advocate\x20for\x20Move\x20upgrade\x20to\x20add\x20OrderCompletedEvent.','evidence':'no_order_completed_event'};return null;}},R_O_5_06={'id':'R-O-5-06','category':'cross_object','trigger':'service::buy\x20pre-flight:\x20Service\x20not\x20published\x20or\x20paused','check':a=>{if(!a['is_buy_operation'])return null;if(a['service_published']===![])return{'id':'R-O-5-06','level':'CRITICAL','category':'cross_object','title':'Service\x20not\x20published\x20—\x20service::buy\x20will\x20abort\x20E_NOT_PUBLISHED','description':'Cannot\x20create\x20Order\x20from\x20an\x20unpublished\x20Service.\x20Service\x20must\x20be\x20published\x20(bPublished=true)\x20before\x20service::buy()\x20can\x20be\x20called.','affected_stakeholders':['owner'],'scenario':'Buyer\x20attempts\x20to\x20purchase\x20from\x20a\x20draft\x20Service','mitigation':'Verify\x20Service.bPublished=true\x20before\x20service::buy().\x20Service\x20owner\x20must\x20call\x20service::publish()\x20first.','evidence':'service_published='+a['service_published']};if(a['service_paused']===!![])return{'id':'R-O-5-06','level':'CRITICAL','category':'cross_object','title':'Service\x20paused\x20—\x20service::buy\x20will\x20abort\x20E_PAUSED','description':'Cannot\x20create\x20Order\x20from\x20a\x20paused\x20Service.\x20Service\x20must\x20be\x20unpaused\x20before\x20service::buy()\x20can\x20be\x20called.','affected_stakeholders':['owner'],'scenario':'Buyer\x20attempts\x20to\x20purchase\x20from\x20a\x20paused\x20Service\x20(e.g.\x20during\x20maintenance)','mitigation':'Wait\x20for\x20Service\x20owner\x20to\x20call\x20service::pause(false).\x20Check\x20Service.paused\x20before\x20service::buy().','evidence':'service_paused='+a['service_paused']};return null;}},ALL_RULES=[R_O_1_01,R_O_1_02,R_O_1_03,R_O_1_04,R_O_1_05,R_O_2_01,R_O_2_02,R_O_2_03,R_O_2_04,R_O_3_01,R_O_3_02,R_O_3_03,R_O_3_04,R_O_4_01,R_O_4_02,R_O_4_03,R_O_4_04,R_O_4_05,R_O_4_06,R_O_5_01,R_O_5_02,R_O_5_03,R_O_5_04,R_O_5_05,R_O_5_06];export const ORDER_RISK_VERSION='1.0.0';export function getAllOrderRiskRules(){return[...ALL_RULES];}export function assessOrderRisks(a){const b=[];for(const g of ALL_RULES){const h=g['check'](a);if(h)b['push'](h);}const c=b['length']===0x0?'LOW':b['some'](i=>i['level']==='CRITICAL')?'CRITICAL':b['some'](i=>i['level']==='HIGH')?'HIGH':b['some'](i=>i['level']==='MEDIUM')?'MEDIUM':'LOW',d={};for(const i of b){d[i['category']]=(d[i['category']]??0x0)+0x1;}const e={};for(const j of b){for(const k of j['affected_stakeholders']){if(!e[k])e[k]=[];e[k]['push'](j['id']+':\x20'+j['mitigation']);}}let f;if(a['operation']){const l={'agent_set':'order_set_agent','required_info_update':'order_required_info','progress_advance':'order_advance','arb_confirm':'order_arb_confirm','arb_objection':'order_arb_objection','arb_claim_compensation':'order_arb_claim_compensation','receive':'order_receive','transfer_to':'order_transfer','service_buy':'order_create'};f=findSceneById(l[a['operation']]??'');}return{'summary':'Assessed\x20'+b['length']+'\x20risk(s)\x20across\x20'+Object['keys'](d)['length']+'\x20categories','scene':f,'risks':b,'overall_risk':c,'risks_by_category':d,'stakeholder_advice':e,'needs_human_review':b['some'](m=>m['level']==='CRITICAL'||m['level']==='HIGH')};}

package/dist/knowledge/payment-risk.d.ts

@@ -34,4 +34,3 @@ export declare const PAYMENT_RISK_RULES: {
 }[];
 export declare const PAYMENT_RISK_VERSION = "1.0.0";
 export declare function checkPaymentRisks(ctx: PaymentRiskCheckContext): PaymentRisk[];
-export declare function getPaymentRiskById(id: string): PaymentRisk | undefined;

package/dist/knowledge/payment-risk.js

@@ -1 +1 @@
-import{MAX_RECIPIENT_COUNT}from'@wowok/wowok';const R_P_01={'rule':{'id':'R-PAYMENT-01','level':'HIGH','category':'permission','title':'unwrap()\x20performs\x20no\x20Payment\x20match\x20check\x20—\x20may\x20unwrap\x20wrong\x20CoinWrapper','description':'unwrap(wrapper,\x20ctx)\x20(payment.move:50)\x20returns\x20(Coin,\x20payment_address)\x20without\x20'+'verifying\x20that\x20wrapper.payment\x20matches\x20any\x20expected\x20Payment.\x20Callers\x20who\x20use\x20unwrap\x20'+'instead\x20of\x20unwrap_with_check\x20can\x20unwrap\x20a\x20CoinWrapper\x20that\x20was\x20minted\x20for\x20a\x20different\x20'+'Payment,\x20leading\x20to\x20fund\x20loss\x20or\x20accounting\x20corruption.\x20unwrap_with_check(payment_check)\x20'+'exists\x20specifically\x20to\x20enforce\x20the\x20match\x20(payment.move:54).','affected_stakeholders':['signer','recipient'],'scenario':'Caller\x20uses\x20unwrap\x20on\x20a\x20wrapper\x20from\x20a\x20different\x20Payment;\x20funds\x20are\x20released\x20anyway','mitigation':'SDK\x20should\x20force\x20callers\x20to\x20use\x20unwrap_with_check\x20and\x20deprecate\x20direct\x20unwrap\x20calls.\x20'+'The\x20only\x20safe\x20use\x20of\x20unwrap\x20is\x20when\x20the\x20caller\x20has\x20already\x20verified\x20the\x20match\x20off-chain.','related_move_error':'EPAYMENT_NOT_MATCH\x20(3)\x20—\x20only\x20raised\x20by\x20unwrap_with_check','auto_fixable':![]},'check':a=>{if(!a['uses_unsafe_unwrap'])return null;return{...R_P_01['rule'],'evidence':'uses_unsafe_unwrap=true\x20(no\x20Payment\x20match\x20check)'};}},R_P_02={'rule':{'id':'R-PAYMENT-02','level':'MEDIUM','category':'structural','title':'MAX_RECIPIENT_COUNT='+MAX_RECIPIENT_COUNT+'\x20permissive\x20—\x20gas\x20and\x20confirmation\x20cost','description':'A\x20single\x20Payment\x20may\x20carry\x20up\x20to\x20MAX_RECIPIENT_COUNT='+MAX_RECIPIENT_COUNT+'\x20recipients\x20'+'(payment.move:14).\x20The\x20limit\x20aborts\x20with\x20ERECIPIENT_COUNT_EXCEEDED\x20(1)\x20only\x20at\x20the\x20boundary.\x20'+'200\x20recipients\x20in\x20one\x20transaction\x20inflates\x20gas,\x20slows\x20finalization,\x20and\x20complicates\x20'+'retry\x20on\x20partial\x20failure.','affected_stakeholders':['signer','recipient'],'scenario':'Caller\x20submits\x20a\x20Payment\x20with\x20200\x20recipients;\x20transaction\x20is\x20heavy\x20and\x20slow','mitigation':'Business\x20layer\x20should\x20self-limit\x20recipient\x20count\x20(e.g.\x20≤50).\x20For\x20mass\x20payouts,\x20split\x20'+'across\x20multiple\x20Payment\x20objects\x20in\x20separate\x20transactions.','related_move_error':'ERECIPIENT_COUNT_EXCEEDED\x20(1)','auto_fixable':![]},'check':a=>{if(a['recipient_count']===undefined)return null;if(a['recipient_count']<MAX_RECIPIENT_COUNT)return null;return{...R_P_02['rule'],'evidence':'recipient_count='+a['recipient_count']+',\x20limit='+MAX_RECIPIENT_COUNT};}},R_P_03={'rule':{'id':'R-PAYMENT-03','level':'LOW','category':'lifecycle','title':'Payment\x20is\x20immutable\x20after\x20create\x20—\x20errors\x20cannot\x20be\x20corrected','description':'create()\x20calls\x20transfer::freeze_object(payment)\x20(payment.move:160).\x20All\x20fields\x20'+'(amount,\x20time,\x20info,\x20from_object,\x20signer,\x20record)\x20are\x20permanently\x20fixed.\x20There\x20is\x20no\x20'+'update,\x20refund,\x20or\x20void\x20API\x20on\x20the\x20Payment\x20object\x20itself\x20—\x20correction\x20requires\x20a\x20new\x20'+'Payment\x20(and\x20off-chain\x20reconciliation).','affected_stakeholders':['signer','consumer'],'scenario':'Signer\x20mistypes\x20a\x20recipient\x20address;\x20the\x20Payment\x20cannot\x20be\x20edited\x20post-create','mitigation':'Verify\x20all\x20fields\x20before\x20calling\x20create.\x20For\x20refunds,\x20create\x20a\x20new\x20Payment\x20in\x20the\x20'+'opposite\x20direction.\x20Off-chain\x20systems\x20should\x20treat\x20Payment\x20as\x20an\x20immutable\x20receipt.','auto_fixable':![]},'check':a=>{if(!a['expects_mutation'])return null;return{...R_P_03['rule'],'evidence':'expects_mutation=true\x20(Payment\x20is\x20frozen\x20at\x20create)'};}},R_P_04={'rule':{'id':'R-PAYMENT-04','level':'MEDIUM','category':'structural','title':'CoinWrapper\x20suppresses\x20coin_field\x20lint\x20—\x20Balance<T>\x20stored\x20in\x20a\x20struct\x20field','description':'CoinWrapper<phantom\x20T>\x20stores\x20Balance<T>\x20directly\x20in\x20a\x20struct\x20field\x20and\x20uses\x20'+'#[allow(lint(coin_field))]\x20to\x20suppress\x20the\x20Wow\x20lint\x20(payment.move:43-48).\x20The\x20lint\x20'+'normally\x20warns\x20against\x20storing\x20Balance\x20in\x20arbitrary\x20structs\x20because\x20of\x20object\x20'+'lifecycle\x20concerns.\x20The\x20suppression\x20is\x20intentional\x20but\x20should\x20be\x20reviewed\x20whenever\x20'+'the\x20Wow\x20framework\x20updates\x20its\x20coin_field\x20rules.','affected_stakeholders':['system'],'scenario':'Wow\x20framework\x20tightens\x20coin_field\x20lint\x20semantics;\x20CoinWrapper\x20becomes\x20non-compliant','mitigation':'Review\x20the\x20coin_field\x20suppression\x20on\x20each\x20Wow\x20upgrade.\x20Confirm\x20that\x20Balance<T>\x20'+'ownership\x20transfer\x20in\x20unwrap/unwrap_with_check\x20is\x20correct.','auto_fixable':![]},'check':a=>{if(a['coin_field_lint_reviewed'])return null;return{...R_P_04['rule'],'evidence':'coin_field_lint_reviewed=false\x20(needs\x20review)'};}},R_P_05={'rule':{'id':'R-PAYMENT-05','level':'LOW','category':'semantic','title':'PaymentInfo\x20has\x204\x20constructor\x20variants\x20—\x20caller\x20may\x20pick\x20the\x20wrong\x20one','description':'PaymentInfo\x20can\x20be\x20built\x20via\x20payment_info\x20(for_object+remark+index),\x20payment_info2\x20'+'(remark+index,\x20no\x20for_object),\x20payment_info_with_guard\x20(for_object+for_guard+remark+index),\x20'+'or\x20payment_info2_with_guard\x20(for_guard+remark+index,\x20no\x20for_object).\x20Selecting\x20the\x20'+'wrong\x20variant\x20leaves\x20for_object/for_guard\x20as\x20None,\x20breaking\x20downstream\x20lookups.','affected_stakeholders':['signer','consumer'],'scenario':'Caller\x20uses\x20payment_info2\x20when\x20they\x20meant\x20payment_info_with_guard;\x20for_object\x20is\x20lost','mitigation':'Document\x20each\x20variant\x27s\x20use\x20case\x20clearly.\x20SDK\x20should\x20pick\x20the\x20variant\x20automatically\x20'+'based\x20on\x20which\x20optional\x20fields\x20the\x20caller\x20provides.','auto_fixable':!![]},'check':a=>null},R_P_06={'rule':{'id':'R-PAYMENT-06','level':'MEDIUM','category':'cross_object','title':'object-linker\x20tx\x20registration\x20filters\x20recipients\x20by\x20is_object_address\x20—\x20user\x20addresses\x20skipped','description':'create()\x20iterates\x20recipients\x20and\x20only\x20calls\x20object_linker::affiliation_tx\x20for\x20addresses\x20that\x20'+'pass\x20util::is_object_address\x20(payment.move:147-161).\x20User\x20addresses\x20(EOAs)\x20are\x20not\x20'+'registered\x20in\x20the\x20object-linker\x20tx\x20index.\x20Callers\x20who\x20expect\x20every\x20recipient\x20to\x20'+'appear\x20in\x20object-linker\x20tx\x20queries\x20will\x20miss\x20EOA\x20recipients.','affected_stakeholders':['signer','consumer'],'scenario':'Caller\x20queries\x20object-linker\x20tx\x20for\x20all\x20Payment\x20recipients;\x20EOA\x20recipients\x20are\x20missing','mitigation':'Document\x20that\x20affiliation_tx\x20is\x20registered\x20only\x20for\x20object-address\x20recipients.\x20Off-chain\x20'+'systems\x20should\x20track\x20EOA\x20recipients\x20via\x20the\x20NewPaymentEvent\x20record,\x20not\x20via\x20object-linker\x20tx.','auto_fixable':![]},'check':a=>{if(!a['expects_user_recipient_registered'])return null;return{...R_P_06['rule'],'evidence':'expects_user_recipient_registered=true\x20(EOAs\x20are\x20skipped)'};}},R_P_07={'rule':{'id':'R-PAYMENT-07','level':'LOW','category':'semantic','title':'Payment.signer\x20records\x20payer\x20—\x20useful\x20for\x20provenance\x20but\x20not\x20authorization','description':'Payment.signer\x20is\x20set\x20to\x20ctx.sender()\x20at\x20creation\x20(payment.move).\x20It\x20can\x20be\x20read\x20via\x20'+'payment_signer<T>(payment)\x20for\x20provenance\x20(e.g.\x20\x27who\x20paid\x20for\x20this\x20order\x27).\x20It\x20is\x20'+'purely\x20informational\x20—\x20it\x20does\x20NOT\x20authorize\x20any\x20later\x20operation.\x20Consumers\x20must\x20not\x20'+'treat\x20signer\x20as\x20a\x20permission\x20grant.','affected_stakeholders':['consumer'],'scenario':'Consumer\x20treats\x20Payment.signer\x20as\x20authorizing\x20a\x20refund;\x20signer\x20is\x20just\x20provenance','mitigation':'Use\x20Payment.signer\x20only\x20for\x20audit/provenance.\x20Authorization\x20must\x20come\x20from\x20the\x20'+'referencing\x20object\x27s\x20own\x20Permission,\x20not\x20from\x20Payment.signer.','auto_fixable':![]},'check':a=>{if(!a['uses_signer_for_provenance'])return null;return{...R_P_07['rule'],'evidence':'uses_signer_for_provenance=true\x20(informational\x20only)'};}},R_P_08={'rule':{'id':'R-PAYMENT-08','level':'MEDIUM','category':'semantic','title':'Payment\x20scene\x20binding\x20(for_object\x20+\x20for_guard\x20+\x20index)\x20—\x20anti-reuse\x20for\x20exception\x20branches','description':'PaymentInfo\x20supports\x20for_object\x20(binds\x20to\x20specific\x20Order),\x20for_guard\x20(binds\x20to\x20specific\x20Guard),\x20'+'and\x20index\x20(binds\x20to\x20specific\x20Progress\x20step)\x20—\x20payment.move#L66-71.\x20When\x20all\x20three\x20are\x20set\x20via\x20'+'payment_info_with_guard\x20(payment.move#L82-86),\x20the\x20Payment\x20is\x20scene-bound:\x20it\x20can\x20ONLY\x20be\x20used\x20'+'in\x20the\x20specific\x20order\x20+\x20guard\x20+\x20progress\x20context.\x20This\x20is\x20the\x20anti-reuse\x20design\x20for\x20exception\x20'+'branch\x20compensation\x20(e.g.,\x20delivery\x20delay\x20>30min\x20triggers\x20auto-compensation).\x20'+'Payment\x20is\x20immutable\x20(freeze_object,\x20payment.move#L160)\x20—\x20binding\x20cannot\x20be\x20altered.\x20'+'VERIFIER-EVIDENCE\x20DESIGN:\x20customer\x20submits\x20Payment,\x20Guard\x20verifies\x20binding\x20fields\x20match\x20current\x20context.','affected_stakeholders':['signer','recipient','consumer'],'scenario':'Treasury\x20creates\x20compensation\x20Payment\x20with\x20PaymentInfo(for_object=order,\x20for_guard=exception_guard,\x20index=current_progress)\x20for\x20delivery\x20delay','mitigation':'Use\x20payment_info_with_guard\x20for\x20all\x20exception\x20branch\x20Payments.\x20Ensure\x20for_object,\x20for_guard,\x20and\x20index\x20'+'all\x20match\x20the\x20intended\x20context.\x20Use\x20tpl_payment_exception_compensation\x20(guard-templates.ts)\x20as\x20design\x20template.','auto_fixable':![]},'check':a=>{if(!a['uses_scene_binding'])return null;const b=[];if(!a['has_for_object'])b['push']('for_object\x20not\x20set\x20(Order\x20binding\x20missing)');if(!a['has_for_guard'])b['push']('for_guard\x20not\x20set\x20(Guard\x20binding\x20missing)');if(!a['has_index'])b['push']('index\x20not\x20set\x20(Progress\x20step\x20binding\x20missing)');if(b['length']===0x0)return null;return{...R_P_08['rule'],'evidence':'incomplete\x20scene\x20binding:\x20'+b['join'](',\x20')};}},R_P_09={'rule':{'id':'R-PAYMENT-09','level':'LOW','category':'semantic','title':'PaymentInfo\x20variant\x20selection\x20—\x20use\x20payment_info_with_guard\x20for\x20exception\x20branches','description':'PaymentInfo\x20has\x204\x20constructor\x20variants\x20(payment.move#L66-86):\x20'+'payment_info\x20(for_object+remark+index,\x20no\x20for_guard),\x20'+'payment_info2\x20(remark+index,\x20no\x20for_object/for_guard),\x20'+'payment_info_with_guard\x20(for_object+for_guard+remark+index\x20—\x20FULL\x20binding),\x20'+'payment_info2_with_guard\x20(for_guard+remark+index,\x20no\x20for_object).\x20'+'For\x20exception\x20branch\x20compensation,\x20ALWAYS\x20use\x20payment_info_with_guard\x20to\x20get\x20full\x20scene\x20binding.\x20'+'Using\x20payment_info\x20(without\x20for_guard)\x20or\x20payment_info2\x20(without\x20for_object)\x20weakens\x20anti-reuse\x20protection.','affected_stakeholders':['signer','consumer'],'scenario':'Caller\x20uses\x20payment_info\x20instead\x20of\x20payment_info_with_guard\x20for\x20exception\x20compensation;\x20for_guard\x20is\x20lost','mitigation':'For\x20exception\x20branch\x20Payments:\x20always\x20use\x20payment_info_with_guard(for_object,\x20for_guard,\x20remark,\x20index).\x20'+'For\x20simple\x20Payments\x20without\x20scene\x20binding:\x20payment_info\x20or\x20payment_info2\x20is\x20fine.\x20'+'SDK\x20should\x20auto-select\x20the\x20variant\x20based\x20on\x20which\x20fields\x20are\x20provided.','auto_fixable':!![]},'check':a=>{if(!a['uses_scene_binding'])return null;if(a['payment_info_variant']==='payment_info_with_guard')return null;return{...R_P_09['rule'],'evidence':'uses_scene_binding=true\x20but\x20variant='+(a['payment_info_variant']??'unknown')+'\x20(should\x20be\x20payment_info_with_guard)'};}};export const PAYMENT_RISK_RULES=[R_P_01,R_P_02,R_P_03,R_P_04,R_P_05,R_P_06,R_P_07,R_P_08,R_P_09];export const PAYMENT_RISK_VERSION='1.0.0';export function checkPaymentRisks(a){const b=[];for(const c of PAYMENT_RISK_RULES){const d=c['check'](a);if(d)b['push'](d);}return!b['find'](e=>e['id']==='R-PAYMENT-05')&&b['push'](R_P_05['rule']),b;}export function getPaymentRiskById(a){return PAYMENT_RISK_RULES['find'](b=>b['rule']['id']===a)?.['rule'];}
+import{MAX_RECIPIENT_COUNT}from'@wowok/wowok';const R_P_01={'rule':{'id':'R-PAYMENT-01','level':'HIGH','category':'permission','title':'unwrap()\x20performs\x20no\x20Payment\x20match\x20check\x20—\x20may\x20unwrap\x20wrong\x20CoinWrapper','description':'unwrap(wrapper,\x20ctx)\x20(payment.move:50)\x20returns\x20(Coin,\x20payment_address)\x20without\x20'+'verifying\x20that\x20wrapper.payment\x20matches\x20any\x20expected\x20Payment.\x20Callers\x20who\x20use\x20unwrap\x20'+'instead\x20of\x20unwrap_with_check\x20can\x20unwrap\x20a\x20CoinWrapper\x20that\x20was\x20minted\x20for\x20a\x20different\x20'+'Payment,\x20leading\x20to\x20fund\x20loss\x20or\x20accounting\x20corruption.\x20unwrap_with_check(payment_check)\x20'+'exists\x20specifically\x20to\x20enforce\x20the\x20match\x20(payment.move:54).','affected_stakeholders':['signer','recipient'],'scenario':'Caller\x20uses\x20unwrap\x20on\x20a\x20wrapper\x20from\x20a\x20different\x20Payment;\x20funds\x20are\x20released\x20anyway','mitigation':'SDK\x20should\x20force\x20callers\x20to\x20use\x20unwrap_with_check\x20and\x20deprecate\x20direct\x20unwrap\x20calls.\x20'+'The\x20only\x20safe\x20use\x20of\x20unwrap\x20is\x20when\x20the\x20caller\x20has\x20already\x20verified\x20the\x20match\x20off-chain.','related_move_error':'EPAYMENT_NOT_MATCH\x20(3)\x20—\x20only\x20raised\x20by\x20unwrap_with_check','auto_fixable':![]},'check':a=>{if(!a['uses_unsafe_unwrap'])return null;return{...R_P_01['rule'],'evidence':'uses_unsafe_unwrap=true\x20(no\x20Payment\x20match\x20check)'};}},R_P_02={'rule':{'id':'R-PAYMENT-02','level':'MEDIUM','category':'structural','title':'MAX_RECIPIENT_COUNT='+MAX_RECIPIENT_COUNT+'\x20permissive\x20—\x20gas\x20and\x20confirmation\x20cost','description':'A\x20single\x20Payment\x20may\x20carry\x20up\x20to\x20MAX_RECIPIENT_COUNT='+MAX_RECIPIENT_COUNT+'\x20recipients\x20'+'(payment.move:14).\x20The\x20limit\x20aborts\x20with\x20ERECIPIENT_COUNT_EXCEEDED\x20(1)\x20only\x20at\x20the\x20boundary.\x20'+'200\x20recipients\x20in\x20one\x20transaction\x20inflates\x20gas,\x20slows\x20finalization,\x20and\x20complicates\x20'+'retry\x20on\x20partial\x20failure.','affected_stakeholders':['signer','recipient'],'scenario':'Caller\x20submits\x20a\x20Payment\x20with\x20200\x20recipients;\x20transaction\x20is\x20heavy\x20and\x20slow','mitigation':'Business\x20layer\x20should\x20self-limit\x20recipient\x20count\x20(e.g.\x20≤50).\x20For\x20mass\x20payouts,\x20split\x20'+'across\x20multiple\x20Payment\x20objects\x20in\x20separate\x20transactions.','related_move_error':'ERECIPIENT_COUNT_EXCEEDED\x20(1)','auto_fixable':![]},'check':a=>{if(a['recipient_count']===undefined)return null;if(a['recipient_count']<MAX_RECIPIENT_COUNT)return null;return{...R_P_02['rule'],'evidence':'recipient_count='+a['recipient_count']+',\x20limit='+MAX_RECIPIENT_COUNT};}},R_P_03={'rule':{'id':'R-PAYMENT-03','level':'LOW','category':'lifecycle','title':'Payment\x20is\x20immutable\x20after\x20create\x20—\x20errors\x20cannot\x20be\x20corrected','description':'create()\x20calls\x20transfer::freeze_object(payment)\x20(payment.move:160).\x20All\x20fields\x20'+'(amount,\x20time,\x20info,\x20from_object,\x20signer,\x20record)\x20are\x20permanently\x20fixed.\x20There\x20is\x20no\x20'+'update,\x20refund,\x20or\x20void\x20API\x20on\x20the\x20Payment\x20object\x20itself\x20—\x20correction\x20requires\x20a\x20new\x20'+'Payment\x20(and\x20off-chain\x20reconciliation).','affected_stakeholders':['signer','consumer'],'scenario':'Signer\x20mistypes\x20a\x20recipient\x20address;\x20the\x20Payment\x20cannot\x20be\x20edited\x20post-create','mitigation':'Verify\x20all\x20fields\x20before\x20calling\x20create.\x20For\x20refunds,\x20create\x20a\x20new\x20Payment\x20in\x20the\x20'+'opposite\x20direction.\x20Off-chain\x20systems\x20should\x20treat\x20Payment\x20as\x20an\x20immutable\x20receipt.','auto_fixable':![]},'check':a=>{if(!a['expects_mutation'])return null;return{...R_P_03['rule'],'evidence':'expects_mutation=true\x20(Payment\x20is\x20frozen\x20at\x20create)'};}},R_P_04={'rule':{'id':'R-PAYMENT-04','level':'MEDIUM','category':'structural','title':'CoinWrapper\x20suppresses\x20coin_field\x20lint\x20—\x20Balance<T>\x20stored\x20in\x20a\x20struct\x20field','description':'CoinWrapper<phantom\x20T>\x20stores\x20Balance<T>\x20directly\x20in\x20a\x20struct\x20field\x20and\x20uses\x20'+'#[allow(lint(coin_field))]\x20to\x20suppress\x20the\x20Wow\x20lint\x20(payment.move:43-48).\x20The\x20lint\x20'+'normally\x20warns\x20against\x20storing\x20Balance\x20in\x20arbitrary\x20structs\x20because\x20of\x20object\x20'+'lifecycle\x20concerns.\x20The\x20suppression\x20is\x20intentional\x20but\x20should\x20be\x20reviewed\x20whenever\x20'+'the\x20Wow\x20framework\x20updates\x20its\x20coin_field\x20rules.','affected_stakeholders':['system'],'scenario':'Wow\x20framework\x20tightens\x20coin_field\x20lint\x20semantics;\x20CoinWrapper\x20becomes\x20non-compliant','mitigation':'Review\x20the\x20coin_field\x20suppression\x20on\x20each\x20Wow\x20upgrade.\x20Confirm\x20that\x20Balance<T>\x20'+'ownership\x20transfer\x20in\x20unwrap/unwrap_with_check\x20is\x20correct.','auto_fixable':![]},'check':a=>{if(a['coin_field_lint_reviewed'])return null;return{...R_P_04['rule'],'evidence':'coin_field_lint_reviewed=false\x20(needs\x20review)'};}},R_P_05={'rule':{'id':'R-PAYMENT-05','level':'LOW','category':'semantic','title':'PaymentInfo\x20has\x204\x20constructor\x20variants\x20—\x20caller\x20may\x20pick\x20the\x20wrong\x20one','description':'PaymentInfo\x20can\x20be\x20built\x20via\x20payment_info\x20(for_object+remark+index),\x20payment_info2\x20'+'(remark+index,\x20no\x20for_object),\x20payment_info_with_guard\x20(for_object+for_guard+remark+index),\x20'+'or\x20payment_info2_with_guard\x20(for_guard+remark+index,\x20no\x20for_object).\x20Selecting\x20the\x20'+'wrong\x20variant\x20leaves\x20for_object/for_guard\x20as\x20None,\x20breaking\x20downstream\x20lookups.','affected_stakeholders':['signer','consumer'],'scenario':'Caller\x20uses\x20payment_info2\x20when\x20they\x20meant\x20payment_info_with_guard;\x20for_object\x20is\x20lost','mitigation':'Document\x20each\x20variant\x27s\x20use\x20case\x20clearly.\x20SDK\x20should\x20pick\x20the\x20variant\x20automatically\x20'+'based\x20on\x20which\x20optional\x20fields\x20the\x20caller\x20provides.','auto_fixable':!![]},'check':a=>null},R_P_06={'rule':{'id':'R-PAYMENT-06','level':'MEDIUM','category':'cross_object','title':'object-linker\x20tx\x20registration\x20filters\x20recipients\x20by\x20is_object_address\x20—\x20user\x20addresses\x20skipped','description':'create()\x20iterates\x20recipients\x20and\x20only\x20calls\x20object_linker::affiliation_tx\x20for\x20addresses\x20that\x20'+'pass\x20util::is_object_address\x20(payment.move:147-161).\x20User\x20addresses\x20(EOAs)\x20are\x20not\x20'+'registered\x20in\x20the\x20object-linker\x20tx\x20index.\x20Callers\x20who\x20expect\x20every\x20recipient\x20to\x20'+'appear\x20in\x20object-linker\x20tx\x20queries\x20will\x20miss\x20EOA\x20recipients.','affected_stakeholders':['signer','consumer'],'scenario':'Caller\x20queries\x20object-linker\x20tx\x20for\x20all\x20Payment\x20recipients;\x20EOA\x20recipients\x20are\x20missing','mitigation':'Document\x20that\x20affiliation_tx\x20is\x20registered\x20only\x20for\x20object-address\x20recipients.\x20Off-chain\x20'+'systems\x20should\x20track\x20EOA\x20recipients\x20via\x20the\x20NewPaymentEvent\x20record,\x20not\x20via\x20object-linker\x20tx.','auto_fixable':![]},'check':a=>{if(!a['expects_user_recipient_registered'])return null;return{...R_P_06['rule'],'evidence':'expects_user_recipient_registered=true\x20(EOAs\x20are\x20skipped)'};}},R_P_07={'rule':{'id':'R-PAYMENT-07','level':'LOW','category':'semantic','title':'Payment.signer\x20records\x20payer\x20—\x20useful\x20for\x20provenance\x20but\x20not\x20authorization','description':'Payment.signer\x20is\x20set\x20to\x20ctx.sender()\x20at\x20creation\x20(payment.move).\x20It\x20can\x20be\x20read\x20via\x20'+'payment_signer<T>(payment)\x20for\x20provenance\x20(e.g.\x20\x27who\x20paid\x20for\x20this\x20order\x27).\x20It\x20is\x20'+'purely\x20informational\x20—\x20it\x20does\x20NOT\x20authorize\x20any\x20later\x20operation.\x20Consumers\x20must\x20not\x20'+'treat\x20signer\x20as\x20a\x20permission\x20grant.','affected_stakeholders':['consumer'],'scenario':'Consumer\x20treats\x20Payment.signer\x20as\x20authorizing\x20a\x20refund;\x20signer\x20is\x20just\x20provenance','mitigation':'Use\x20Payment.signer\x20only\x20for\x20audit/provenance.\x20Authorization\x20must\x20come\x20from\x20the\x20'+'referencing\x20object\x27s\x20own\x20Permission,\x20not\x20from\x20Payment.signer.','auto_fixable':![]},'check':a=>{if(!a['uses_signer_for_provenance'])return null;return{...R_P_07['rule'],'evidence':'uses_signer_for_provenance=true\x20(informational\x20only)'};}},R_P_08={'rule':{'id':'R-PAYMENT-08','level':'MEDIUM','category':'semantic','title':'Payment\x20scene\x20binding\x20(for_object\x20+\x20for_guard\x20+\x20index)\x20—\x20anti-reuse\x20for\x20exception\x20branches','description':'PaymentInfo\x20supports\x20for_object\x20(binds\x20to\x20specific\x20Order),\x20for_guard\x20(binds\x20to\x20specific\x20Guard),\x20'+'and\x20index\x20(binds\x20to\x20specific\x20Progress\x20step)\x20—\x20payment.move#L66-71.\x20When\x20all\x20three\x20are\x20set\x20via\x20'+'payment_info_with_guard\x20(payment.move#L82-86),\x20the\x20Payment\x20is\x20scene-bound:\x20it\x20can\x20ONLY\x20be\x20used\x20'+'in\x20the\x20specific\x20order\x20+\x20guard\x20+\x20progress\x20context.\x20This\x20is\x20the\x20anti-reuse\x20design\x20for\x20exception\x20'+'branch\x20compensation\x20(e.g.,\x20delivery\x20delay\x20>30min\x20triggers\x20auto-compensation).\x20'+'Payment\x20is\x20immutable\x20(freeze_object,\x20payment.move#L160)\x20—\x20binding\x20cannot\x20be\x20altered.\x20'+'VERIFIER-EVIDENCE\x20DESIGN:\x20customer\x20submits\x20Payment,\x20Guard\x20verifies\x20binding\x20fields\x20match\x20current\x20context.','affected_stakeholders':['signer','recipient','consumer'],'scenario':'Treasury\x20creates\x20compensation\x20Payment\x20with\x20PaymentInfo(for_object=order,\x20for_guard=exception_guard,\x20index=current_progress)\x20for\x20delivery\x20delay','mitigation':'Use\x20payment_info_with_guard\x20for\x20all\x20exception\x20branch\x20Payments.\x20Ensure\x20for_object,\x20for_guard,\x20and\x20index\x20'+'all\x20match\x20the\x20intended\x20context.\x20Use\x20tpl_payment_exception_compensation\x20(guard-templates.ts)\x20as\x20design\x20template.','auto_fixable':![]},'check':a=>{if(!a['uses_scene_binding'])return null;const b=[];if(!a['has_for_object'])b['push']('for_object\x20not\x20set\x20(Order\x20binding\x20missing)');if(!a['has_for_guard'])b['push']('for_guard\x20not\x20set\x20(Guard\x20binding\x20missing)');if(!a['has_index'])b['push']('index\x20not\x20set\x20(Progress\x20step\x20binding\x20missing)');if(b['length']===0x0)return null;return{...R_P_08['rule'],'evidence':'incomplete\x20scene\x20binding:\x20'+b['join'](',\x20')};}},R_P_09={'rule':{'id':'R-PAYMENT-09','level':'LOW','category':'semantic','title':'PaymentInfo\x20variant\x20selection\x20—\x20use\x20payment_info_with_guard\x20for\x20exception\x20branches','description':'PaymentInfo\x20has\x204\x20constructor\x20variants\x20(payment.move#L66-86):\x20'+'payment_info\x20(for_object+remark+index,\x20no\x20for_guard),\x20'+'payment_info2\x20(remark+index,\x20no\x20for_object/for_guard),\x20'+'payment_info_with_guard\x20(for_object+for_guard+remark+index\x20—\x20FULL\x20binding),\x20'+'payment_info2_with_guard\x20(for_guard+remark+index,\x20no\x20for_object).\x20'+'For\x20exception\x20branch\x20compensation,\x20ALWAYS\x20use\x20payment_info_with_guard\x20to\x20get\x20full\x20scene\x20binding.\x20'+'Using\x20payment_info\x20(without\x20for_guard)\x20or\x20payment_info2\x20(without\x20for_object)\x20weakens\x20anti-reuse\x20protection.','affected_stakeholders':['signer','consumer'],'scenario':'Caller\x20uses\x20payment_info\x20instead\x20of\x20payment_info_with_guard\x20for\x20exception\x20compensation;\x20for_guard\x20is\x20lost','mitigation':'For\x20exception\x20branch\x20Payments:\x20always\x20use\x20payment_info_with_guard(for_object,\x20for_guard,\x20remark,\x20index).\x20'+'For\x20simple\x20Payments\x20without\x20scene\x20binding:\x20payment_info\x20or\x20payment_info2\x20is\x20fine.\x20'+'SDK\x20should\x20auto-select\x20the\x20variant\x20based\x20on\x20which\x20fields\x20are\x20provided.','auto_fixable':!![]},'check':a=>{if(!a['uses_scene_binding'])return null;if(a['payment_info_variant']==='payment_info_with_guard')return null;return{...R_P_09['rule'],'evidence':'uses_scene_binding=true\x20but\x20variant='+(a['payment_info_variant']??'unknown')+'\x20(should\x20be\x20payment_info_with_guard)'};}};export const PAYMENT_RISK_RULES=[R_P_01,R_P_02,R_P_03,R_P_04,R_P_05,R_P_06,R_P_07,R_P_08,R_P_09];export const PAYMENT_RISK_VERSION='1.0.0';export function checkPaymentRisks(a){const b=[];for(const c of PAYMENT_RISK_RULES){const d=c['check'](a);if(d)b['push'](d);}return!b['find'](e=>e['id']==='R-PAYMENT-05')&&b['push'](R_P_05['rule']),b;}

package/dist/knowledge/permission-risk.d.ts

@@ -61,9 +61,6 @@ export interface RiskCheckContext {
     target_objects_types?: string[];
 }
 export declare const PERMISSION_RISK_VERSION = "1.0.0";
-export declare function getAllRiskRules(): RiskRule[];
-export declare function getRiskRulesCount(): number;
-export declare function getRiskRulesByCategory(category: RiskCategory): RiskRule[];
 export interface PermissionRiskAssessment {
     summary: string;
     scene?: PermissionScene;

package/dist/knowledge/permission-risk.js

@@ -1 +1 @@
-import{USER_DEFINED_PERM_INDEX_START,MAX_ENTITY_COUNT,MAX_PERM_FOR_ENTITY,MAX_ADMIN_COUNT}from'@wowok/wowok';import{isBuiltinPermission,findSceneByPermissionIndex}from'./permission-ledger.js';const R_P_01={'id':'R-P-1-01','category':'structural','trigger':'Custom\x20permission\x20index\x20<\x20USER_DEFINED_PERM_INDEX_START\x20(1000)\x20and\x20not\x20builtin','check':a=>{if(!a['table'])return null;if('index'in a['table']&&typeof a['table']['index']==='number'){const b=a['table']['index'];if(b<USER_DEFINED_PERM_INDEX_START&&!isBuiltinPermission(b))return{'id':'R-P-1-01','level':'CRITICAL','category':'structural','title':'Invalid\x20permission\x20index\x20(<\x201000\x20and\x20not\x20builtin)','description':'Permission\x20index\x20'+b+'\x20is\x20below\x20USER_DEFINED_PERM_INDEX_START\x20('+USER_DEFINED_PERM_INDEX_START+')\x20and\x20not\x20a\x20builtin\x20permission.\x20Custom\x20indexes\x20must\x20be\x20>=\x201000.','affected_stakeholders':['owner','admin','system'],'scenario':'User\x20defines\x20a\x20custom\x20permission\x20with\x20index\x20<\x201000','mitigation':'Use\x20index\x20>=\x20'+USER_DEFINED_PERM_INDEX_START+'\x20for\x20custom\x20permissions,\x20or\x20use\x20a\x20builtin\x20index\x20if\x20applicable','evidence':'index='+b};}return null;}},R_P_02={'id':'R-P-1-02','category':'structural','trigger':'Entity\x20count\x20exceeds\x20MAX_ENTITY_COUNT\x20(1000)','check':a=>{const b=a['current_entity_count']??0x0;if(b>MAX_ENTITY_COUNT)return{'id':'R-P-1-02','level':'HIGH','category':'structural','title':'Entity\x20count\x20exceeds\x20limit','description':'Permission\x20has\x20'+b+'\x20entities,\x20exceeds\x20MAX_ENTITY_COUNT\x20'+MAX_ENTITY_COUNT,'affected_stakeholders':['owner','admin'],'scenario':'Adding\x20entities\x20beyond\x20the\x20protocol\x20limit','mitigation':'Split\x20into\x20multiple\x20Permission\x20objects\x20or\x20remove\x20inactive\x20entities','evidence':'entity_count='+b};return null;}},R_P_03={'id':'R-P-1-03','category':'structural','trigger':'Per-entity\x20permission\x20count\x20exceeds\x20MAX_PERM_FOR_ENTITY\x20(1000)','check':a=>{if(a['table']&&'index'in a['table']&&Array['isArray'](a['table']['index'])){if(a['table']['index']['length']>MAX_PERM_FOR_ENTITY)return{'id':'R-P-1-03','level':'HIGH','category':'structural','title':'Per-entity\x20permission\x20count\x20exceeds\x20limit','description':'Entity\x20'+a['table']['entity']+'\x20has\x20'+a['table']['index']['length']+'\x20permissions,\x20exceeds\x20MAX_PERM_FOR_ENTITY\x20'+MAX_PERM_FOR_ENTITY,'affected_stakeholders':['entity','admin'],'scenario':'Granting\x20too\x20many\x20permissions\x20to\x20one\x20entity','mitigation':'Consolidate\x20similar\x20permissions\x20or\x20split\x20entity\x20into\x20multiple\x20roles','evidence':'perm_count='+a['table']['index']['length']};}return null;}},R_P_04={'id':'R-P-1-04','category':'structural','trigger':'Admin\x20count\x20exceeds\x20MAX_ADMIN_COUNT\x20(500)','check':a=>{if(a['admin']){const b=a['admin']['op']==='add'?(a['current_admin_count']??0x0)+a['admin']['addresses']['length']:a['admin']['addresses']['length'];if(b>MAX_ADMIN_COUNT)return{'id':'R-P-1-04','level':'HIGH','category':'structural','title':'Admin\x20count\x20exceeds\x20limit','description':'Admin\x20count\x20would\x20be\x20'+b+',\x20exceeds\x20MAX_ADMIN_COUNT\x20'+MAX_ADMIN_COUNT,'affected_stakeholders':['owner','admin'],'scenario':'Adding\x20too\x20many\x20admins','mitigation':'Remove\x20inactive\x20admins\x20before\x20adding\x20new\x20ones','evidence':'admin_count='+b};}return null;}},R_P_2_01={'id':'R-P-2-01','category':'semantic','trigger':'Builtin\x20permission\x20index\x20used\x20outside\x20its\x20host\x20object\x20scene','check':a=>{if(!a['table']||!('index'in a['table'])||typeof a['table']['index']!=='number')return null;const b=a['table']['index'];if(!isBuiltinPermission(b))return null;const c=findSceneByPermissionIndex(b);if(!c)return null;if(a['target_objects_types']&&a['target_objects_types']['length']>0x0){const d=a['target_objects_types']['filter'](e=>e!==c['host_object']);if(d['length']>0x0)return{'id':'R-P-2-01','level':'HIGH','category':'semantic','title':'Permission\x20index\x20host\x20object\x20mismatch','description':'Permission\x20'+b+'\x20('+c['builtin_indexes']['find'](e=>e['index']===b)?.['name']+')\x20is\x20for\x20'+c['host_object']+',\x20but\x20apply\x20targets:\x20'+d['join'](',\x20'),'affected_stakeholders':['owner','admin'],'scenario':'Using\x20SERVICE_*\x20index\x20on\x20Machine\x20object','mitigation':'Use\x20'+c['host_object']+'-specific\x20permission\x20indexes\x20for\x20'+d['join'](',\x20'),'evidence':'index='+b+',\x20targets='+d['join'](',')};}return null;}},R_P_2_02={'id':'R-P-2-02','category':'semantic','trigger':'Custom\x20permission\x20(>=\x201000)\x20without\x20remark','check':a=>{if(!a['table']||!('index'in a['table'])||typeof a['table']['index']!=='number')return null;const b=a['table']['index'];if(b<USER_DEFINED_PERM_INDEX_START)return null;if(a['remark']&&a['remark']['op']==='set'&&a['remark']['index']===b)return null;return{'id':'R-P-2-02','level':'LOW','category':'semantic','title':'Custom\x20permission\x20without\x20remark','description':'Custom\x20permission\x20'+b+'\x20has\x20no\x20remark;\x20future\x20maintainers\x20won\x27t\x20know\x20its\x20purpose','affected_stakeholders':['admin'],'scenario':'Adding\x20custom\x20permission\x20without\x20documentation','mitigation':'Add\x20remark:\x20{\x20op:\x20\x22set\x22,\x20index:\x20'+b+',\x20remark:\x20\x22<purpose>\x22\x20}','evidence':'index='+b};}},R_P_3_01={'id':'R-P-3-01','category':'authority','trigger':'Permission\x20over-concentration:\x20owner\x20is\x20the\x20only\x20admin','check':a=>{if(!a['admin']||a['admin']['op']!=='set')return null;if(a['admin']['addresses']['length']===0x1)return{'id':'R-P-3-01','level':'MEDIUM','category':'authority','title':'Permission\x20over-concentration','description':'Only\x20one\x20admin\x20(likely\x20owner);\x20loss\x20of\x20owner\x20key\x20means\x20permanent\x20lockout','affected_stakeholders':['owner'],'scenario':'Single-admin\x20Permission','mitigation':'Add\x201-2\x20backup\x20admins\x20with\x20limited\x20permission\x20indexes','evidence':'admin_count=1'};return null;}},R_P_3_02={'id':'R-P-3-02','category':'authority','trigger':'Permission\x20over-dispersion:\x20admin\x20count\x20>\x2050','check':a=>{if(!a['admin'])return null;const b=a['admin']['op']==='set'?a['admin']['addresses']['length']:a['current_admin_count']??0x0;if(b>0x32)return{'id':'R-P-3-02','level':'MEDIUM','category':'authority','title':'Permission\x20over-dispersion','description':b+'\x20admins\x20increases\x20coordination\x20cost\x20and\x20key-management\x20risk','affected_stakeholders':['owner','admin'],'scenario':'Large\x20admin\x20committee','mitigation':'Use\x20multi-sig\x20or\x20hierarchical\x20admin\x20structure','evidence':'admin_count='+b};return null;}},R_P_3_03={'id':'R-P-3-03','category':'authority','trigger':'UM\x20is\x20owner\x20self-reference','check':a=>{if(a['um']===undefined||a['um']===null)return null;if(a['builder']&&a['um']===a['builder'])return{'id':'R-P-3-03','level':'MEDIUM','category':'authority','title':'UM\x20is\x20owner\x20self-reference','description':'Setting\x20UM\x20to\x20owner\x20address\x20defeats\x20separation\x20of\x20concerns','affected_stakeholders':['owner'],'scenario':'Owner\x20delegates\x20UM\x20to\x20self','mitigation':'Use\x20a\x20separate\x20Contact\x20object\x20address\x20for\x20UM','evidence':'um='+a['um']};return null;}},R_P_4_01={'id':'R-P-4-01','category':'lifecycle','trigger':'Ownership\x20transfer\x20operation\x20(builder\x20field\x20set)','check':a=>{if(!a['builder'])return null;return{'id':'R-P-4-01','level':'HIGH','category':'lifecycle','title':'Ownership\x20transfer\x20—\x20irreversible','description':'Transferring\x20Permission\x20to\x20'+a['builder']+'.\x20Once\x20executed,\x20original\x20owner\x20loses\x20ALL\x20control\x20permanently.','affected_stakeholders':['owner'],'scenario':'Owner\x20transfers\x20Permission\x20to\x20new\x20address','mitigation':'1)\x20Verify\x20new\x20owner\x20address\x20twice.\x202)\x20Export\x20Permission\x20JSON\x20before\x20transfer.\x203)\x20Coordinate\x20with\x20new\x20owner\x20to\x20confirm\x20receipt.','evidence':'new_owner='+a['builder']};}},R_P_4_02={'id':'R-P-4-02','category':'lifecycle','trigger':'Apply\x20to\x20multiple\x20objects\x20at\x20once','check':a=>{if(!a['apply']||a['apply']['length']===0x0)return null;if(a['apply']['length']>0x3)return{'id':'R-P-4-02','level':'MEDIUM','category':'lifecycle','title':'Batch\x20apply\x20to\x20multiple\x20objects','description':'Applying\x20Permission\x20to\x20'+a['apply']['length']+'\x20objects\x20at\x20once;\x20if\x20any\x20object\x20type\x20mismatches,\x20transaction\x20may\x20fail\x20or\x20silently\x20misalign','affected_stakeholders':['owner'],'scenario':'Batch\x20apply\x20across\x20heterogeneous\x20objects','mitigation':'Apply\x20to\x201-3\x20objects\x20at\x20a\x20time;\x20verify\x20each\x20object\x20type\x20matches\x20permission\x20indexes','evidence':'apply_count='+a['apply']['length']};return null;}},R_P_4_03={'id':'R-P-4-03','category':'lifecycle','trigger':'Entity\x20replace\x20operation\x20(destructive)','check':a=>{if(!a['entity']||a['entity']['op']!=='replace')return null;return{'id':'R-P-4-03','level':'MEDIUM','category':'lifecycle','title':'Entity\x20replace\x20—\x20destructive','description':'Replacing\x20'+a['entity']['entity1']+'\x20with\x20'+a['entity']['entity2']+';\x20entity1\x20loses\x20ALL\x20permissions\x20permanently','affected_stakeholders':['entity'],'scenario':'Replacing\x20a\x20user\x20who\x20left\x20the\x20organization','mitigation':'Prefer\x20\x27copy\x27\x20over\x20\x27replace\x27\x20if\x20entity1\x20should\x20retain\x20permissions','evidence':'entity1='+a['entity']['entity1']+',\x20entity2='+a['entity']['entity2']};}},R_P_5_01={'id':'R-P-5-01','category':'cross_object','trigger':'Apply\x20to\x20Progress\x20object\x20(Permission\x20becomes\x20immutable\x20on\x20bind)','check':a=>{if(!a['apply'])return null;if(a['target_objects_types']?.['includes']('Progress'))return{'id':'R-P-5-01','level':'MEDIUM','category':'cross_object','title':'Apply\x20to\x20Progress\x20—\x20post-bind\x20mutability\x20limited','description':'Once\x20Permission\x20is\x20bound\x20to\x20Progress\x20(which\x20binds\x20Machine),\x20permission\x20table\x20changes\x20may\x20not\x20affect\x20already-published\x20Machine\x20workflow','affected_stakeholders':['owner'],'scenario':'Permission\x20shared\x20across\x20Machine/Progress','mitigation':'Configure\x20all\x20permission\x20indexes\x20before\x20Machine\x20publish','evidence':'target=Progress'};return null;}},R_P_5_02={'id':'R-P-5-02','category':'cross_object','trigger':'Permission\x20reused\x20across\x20multiple\x20host\x20object\x20types','check':a=>{if(!a['target_objects_types']||a['target_objects_types']['length']<0x2)return null;const b=new Set(a['target_objects_types']);if(b['size']>0x1)return{'id':'R-P-5-02','level':'MEDIUM','category':'cross_object','title':'Permission\x20shared\x20across\x20heterogeneous\x20objects','description':'Single\x20Permission\x20applied\x20to\x20'+[...b]['join'](',\x20')+';\x20permission\x20indexes\x20may\x20have\x20different\x20semantics\x20per\x20object','affected_stakeholders':['owner','admin'],'scenario':'One\x20Permission\x20for\x20both\x20Service\x20and\x20Treasury','mitigation':'Use\x20separate\x20Permission\x20objects\x20per\x20host\x20object\x20type\x20for\x20clarity','evidence':'types='+[...b]['join'](',')};return null;}},R_P_5_03={'id':'R-P-5-03','category':'cross_object','trigger':'Treasury\x20external_*_guard\x20management\x20(255/256)\x20granted\x20—\x20verify\x20guard\x20lists\x20are\x20populated','check':a=>{if(!a['table']||!('index'in a['table'])||typeof a['table']['index']!=='number')return null;const b=a['table']['index'];if(b===0xff||b===0x100)return{'id':'R-P-5-03','level':'HIGH','category':'cross_object','title':'Treasury\x20external\x20guard\x20management\x20granted\x20—\x20populate\x20guard\x20lists','description':'Permission\x20'+b+'\x20('+(b===0xff?'TREASURY_EXTERNAL_DEPOSIT_GUARD':'TREASURY_EXTERNAL_WITHDRAW_GUARD')+')\x20granted;\x20ensure\x20external_'+(b===0xff?'deposit':'withdraw')+'_guard\x20list\x20is\x20populated\x20via\x20external_*_guard_add\x20so\x20external\x20operations\x20are\x20authorized','affected_stakeholders':['owner','admin'],'scenario':'External\x20treasury\x20guard\x20management\x20without\x20populated\x20guard\x20lists','mitigation':'Call\x20treasury.external_'+(b===0xff?'deposit':'withdraw')+'_guard_add\x20to\x20register\x20Guard\x20objects;\x20external_deposit/external_withdraw\x20require\x20Guard\x20+\x20Passport\x20(no\x20Permission\x20index)','evidence':'index='+b};return null;}},ALL_RULES=[R_P_01,R_P_02,R_P_03,R_P_04,R_P_2_01,R_P_2_02,R_P_3_01,R_P_3_02,R_P_3_03,R_P_4_01,R_P_4_02,R_P_4_03,R_P_5_01,R_P_5_02,R_P_5_03];export const PERMISSION_RISK_VERSION='1.0.0';export function getAllRiskRules(){return[...ALL_RULES];}export function getRiskRulesCount(){return ALL_RULES['length'];}export function getRiskRulesByCategory(a){return ALL_RULES['filter'](b=>b['category']===a);}export function assessPermissionRisks(a){const b=[];for(const f of ALL_RULES){const g=f['check'](a);if(g)b['push'](g);}const c=b['length']===0x0?'LOW':b['some'](h=>h['level']==='CRITICAL')?'CRITICAL':b['some'](h=>h['level']==='HIGH')?'HIGH':b['some'](h=>h['level']==='MEDIUM')?'MEDIUM':'LOW',d={};for(const h of b){d[h['category']]=(d[h['category']]??0x0)+0x1;}const e={};for(const i of b){for(const j of i['affected_stakeholders']){if(!e[j])e[j]=[];e[j]['push'](i['id']+':\x20'+i['mitigation']);}}return{'summary':'Assessed\x20'+b['length']+'\x20risk(s)\x20across\x20'+Object['keys'](d)['length']+'\x20categories','risks':b,'overall_risk':c,'risks_by_category':d,'stakeholder_advice':e,'needs_human_review':b['some'](k=>k['level']==='CRITICAL'||k['level']==='HIGH')};}
+import{USER_DEFINED_PERM_INDEX_START,MAX_ENTITY_COUNT,MAX_PERM_FOR_ENTITY,MAX_ADMIN_COUNT}from'@wowok/wowok';import{isBuiltinPermission,findSceneByPermissionIndex}from'./permission-ledger.js';const R_P_01={'id':'R-P-1-01','category':'structural','trigger':'Custom\x20permission\x20index\x20<\x20USER_DEFINED_PERM_INDEX_START\x20(1000)\x20and\x20not\x20builtin','check':a=>{if(!a['table'])return null;if('index'in a['table']&&typeof a['table']['index']==='number'){const b=a['table']['index'];if(b<USER_DEFINED_PERM_INDEX_START&&!isBuiltinPermission(b))return{'id':'R-P-1-01','level':'CRITICAL','category':'structural','title':'Invalid\x20permission\x20index\x20(<\x201000\x20and\x20not\x20builtin)','description':'Permission\x20index\x20'+b+'\x20is\x20below\x20USER_DEFINED_PERM_INDEX_START\x20('+USER_DEFINED_PERM_INDEX_START+')\x20and\x20not\x20a\x20builtin\x20permission.\x20Custom\x20indexes\x20must\x20be\x20>=\x201000.','affected_stakeholders':['owner','admin','system'],'scenario':'User\x20defines\x20a\x20custom\x20permission\x20with\x20index\x20<\x201000','mitigation':'Use\x20index\x20>=\x20'+USER_DEFINED_PERM_INDEX_START+'\x20for\x20custom\x20permissions,\x20or\x20use\x20a\x20builtin\x20index\x20if\x20applicable','evidence':'index='+b};}return null;}},R_P_02={'id':'R-P-1-02','category':'structural','trigger':'Entity\x20count\x20exceeds\x20MAX_ENTITY_COUNT\x20(1000)','check':a=>{const b=a['current_entity_count']??0x0;if(b>MAX_ENTITY_COUNT)return{'id':'R-P-1-02','level':'HIGH','category':'structural','title':'Entity\x20count\x20exceeds\x20limit','description':'Permission\x20has\x20'+b+'\x20entities,\x20exceeds\x20MAX_ENTITY_COUNT\x20'+MAX_ENTITY_COUNT,'affected_stakeholders':['owner','admin'],'scenario':'Adding\x20entities\x20beyond\x20the\x20protocol\x20limit','mitigation':'Split\x20into\x20multiple\x20Permission\x20objects\x20or\x20remove\x20inactive\x20entities','evidence':'entity_count='+b};return null;}},R_P_03={'id':'R-P-1-03','category':'structural','trigger':'Per-entity\x20permission\x20count\x20exceeds\x20MAX_PERM_FOR_ENTITY\x20(1000)','check':a=>{if(a['table']&&'index'in a['table']&&Array['isArray'](a['table']['index'])){if(a['table']['index']['length']>MAX_PERM_FOR_ENTITY)return{'id':'R-P-1-03','level':'HIGH','category':'structural','title':'Per-entity\x20permission\x20count\x20exceeds\x20limit','description':'Entity\x20'+a['table']['entity']+'\x20has\x20'+a['table']['index']['length']+'\x20permissions,\x20exceeds\x20MAX_PERM_FOR_ENTITY\x20'+MAX_PERM_FOR_ENTITY,'affected_stakeholders':['entity','admin'],'scenario':'Granting\x20too\x20many\x20permissions\x20to\x20one\x20entity','mitigation':'Consolidate\x20similar\x20permissions\x20or\x20split\x20entity\x20into\x20multiple\x20roles','evidence':'perm_count='+a['table']['index']['length']};}return null;}},R_P_04={'id':'R-P-1-04','category':'structural','trigger':'Admin\x20count\x20exceeds\x20MAX_ADMIN_COUNT\x20(500)','check':a=>{if(a['admin']){const b=a['admin']['op']==='add'?(a['current_admin_count']??0x0)+a['admin']['addresses']['length']:a['admin']['addresses']['length'];if(b>MAX_ADMIN_COUNT)return{'id':'R-P-1-04','level':'HIGH','category':'structural','title':'Admin\x20count\x20exceeds\x20limit','description':'Admin\x20count\x20would\x20be\x20'+b+',\x20exceeds\x20MAX_ADMIN_COUNT\x20'+MAX_ADMIN_COUNT,'affected_stakeholders':['owner','admin'],'scenario':'Adding\x20too\x20many\x20admins','mitigation':'Remove\x20inactive\x20admins\x20before\x20adding\x20new\x20ones','evidence':'admin_count='+b};}return null;}},R_P_2_01={'id':'R-P-2-01','category':'semantic','trigger':'Builtin\x20permission\x20index\x20used\x20outside\x20its\x20host\x20object\x20scene','check':a=>{if(!a['table']||!('index'in a['table'])||typeof a['table']['index']!=='number')return null;const b=a['table']['index'];if(!isBuiltinPermission(b))return null;const c=findSceneByPermissionIndex(b);if(!c)return null;if(a['target_objects_types']&&a['target_objects_types']['length']>0x0){const d=a['target_objects_types']['filter'](e=>e!==c['host_object']);if(d['length']>0x0)return{'id':'R-P-2-01','level':'HIGH','category':'semantic','title':'Permission\x20index\x20host\x20object\x20mismatch','description':'Permission\x20'+b+'\x20('+c['builtin_indexes']['find'](e=>e['index']===b)?.['name']+')\x20is\x20for\x20'+c['host_object']+',\x20but\x20apply\x20targets:\x20'+d['join'](',\x20'),'affected_stakeholders':['owner','admin'],'scenario':'Using\x20SERVICE_*\x20index\x20on\x20Machine\x20object','mitigation':'Use\x20'+c['host_object']+'-specific\x20permission\x20indexes\x20for\x20'+d['join'](',\x20'),'evidence':'index='+b+',\x20targets='+d['join'](',')};}return null;}},R_P_2_02={'id':'R-P-2-02','category':'semantic','trigger':'Custom\x20permission\x20(>=\x201000)\x20without\x20remark','check':a=>{if(!a['table']||!('index'in a['table'])||typeof a['table']['index']!=='number')return null;const b=a['table']['index'];if(b<USER_DEFINED_PERM_INDEX_START)return null;if(a['remark']&&a['remark']['op']==='set'&&a['remark']['index']===b)return null;return{'id':'R-P-2-02','level':'LOW','category':'semantic','title':'Custom\x20permission\x20without\x20remark','description':'Custom\x20permission\x20'+b+'\x20has\x20no\x20remark;\x20future\x20maintainers\x20won\x27t\x20know\x20its\x20purpose','affected_stakeholders':['admin'],'scenario':'Adding\x20custom\x20permission\x20without\x20documentation','mitigation':'Add\x20remark:\x20{\x20op:\x20\x22set\x22,\x20index:\x20'+b+',\x20remark:\x20\x22<purpose>\x22\x20}','evidence':'index='+b};}},R_P_3_01={'id':'R-P-3-01','category':'authority','trigger':'Permission\x20over-concentration:\x20owner\x20is\x20the\x20only\x20admin','check':a=>{if(!a['admin']||a['admin']['op']!=='set')return null;if(a['admin']['addresses']['length']===0x1)return{'id':'R-P-3-01','level':'MEDIUM','category':'authority','title':'Permission\x20over-concentration','description':'Only\x20one\x20admin\x20(likely\x20owner);\x20loss\x20of\x20owner\x20key\x20means\x20permanent\x20lockout','affected_stakeholders':['owner'],'scenario':'Single-admin\x20Permission','mitigation':'Add\x201-2\x20backup\x20admins\x20with\x20limited\x20permission\x20indexes','evidence':'admin_count=1'};return null;}},R_P_3_02={'id':'R-P-3-02','category':'authority','trigger':'Permission\x20over-dispersion:\x20admin\x20count\x20>\x2050','check':a=>{if(!a['admin'])return null;const b=a['admin']['op']==='set'?a['admin']['addresses']['length']:a['current_admin_count']??0x0;if(b>0x32)return{'id':'R-P-3-02','level':'MEDIUM','category':'authority','title':'Permission\x20over-dispersion','description':b+'\x20admins\x20increases\x20coordination\x20cost\x20and\x20key-management\x20risk','affected_stakeholders':['owner','admin'],'scenario':'Large\x20admin\x20committee','mitigation':'Use\x20multi-sig\x20or\x20hierarchical\x20admin\x20structure','evidence':'admin_count='+b};return null;}},R_P_3_03={'id':'R-P-3-03','category':'authority','trigger':'UM\x20is\x20owner\x20self-reference','check':a=>{if(a['um']===undefined||a['um']===null)return null;if(a['builder']&&a['um']===a['builder'])return{'id':'R-P-3-03','level':'MEDIUM','category':'authority','title':'UM\x20is\x20owner\x20self-reference','description':'Setting\x20UM\x20to\x20owner\x20address\x20defeats\x20separation\x20of\x20concerns','affected_stakeholders':['owner'],'scenario':'Owner\x20delegates\x20UM\x20to\x20self','mitigation':'Use\x20a\x20separate\x20Contact\x20object\x20address\x20for\x20UM','evidence':'um='+a['um']};return null;}},R_P_4_01={'id':'R-P-4-01','category':'lifecycle','trigger':'Ownership\x20transfer\x20operation\x20(builder\x20field\x20set)','check':a=>{if(!a['builder'])return null;return{'id':'R-P-4-01','level':'HIGH','category':'lifecycle','title':'Ownership\x20transfer\x20—\x20irreversible','description':'Transferring\x20Permission\x20to\x20'+a['builder']+'.\x20Once\x20executed,\x20original\x20owner\x20loses\x20ALL\x20control\x20permanently.','affected_stakeholders':['owner'],'scenario':'Owner\x20transfers\x20Permission\x20to\x20new\x20address','mitigation':'1)\x20Verify\x20new\x20owner\x20address\x20twice.\x202)\x20Export\x20Permission\x20JSON\x20before\x20transfer.\x203)\x20Coordinate\x20with\x20new\x20owner\x20to\x20confirm\x20receipt.','evidence':'new_owner='+a['builder']};}},R_P_4_02={'id':'R-P-4-02','category':'lifecycle','trigger':'Apply\x20to\x20multiple\x20objects\x20at\x20once','check':a=>{if(!a['apply']||a['apply']['length']===0x0)return null;if(a['apply']['length']>0x3)return{'id':'R-P-4-02','level':'MEDIUM','category':'lifecycle','title':'Batch\x20apply\x20to\x20multiple\x20objects','description':'Applying\x20Permission\x20to\x20'+a['apply']['length']+'\x20objects\x20at\x20once;\x20if\x20any\x20object\x20type\x20mismatches,\x20transaction\x20may\x20fail\x20or\x20silently\x20misalign','affected_stakeholders':['owner'],'scenario':'Batch\x20apply\x20across\x20heterogeneous\x20objects','mitigation':'Apply\x20to\x201-3\x20objects\x20at\x20a\x20time;\x20verify\x20each\x20object\x20type\x20matches\x20permission\x20indexes','evidence':'apply_count='+a['apply']['length']};return null;}},R_P_4_03={'id':'R-P-4-03','category':'lifecycle','trigger':'Entity\x20replace\x20operation\x20(destructive)','check':a=>{if(!a['entity']||a['entity']['op']!=='replace')return null;return{'id':'R-P-4-03','level':'MEDIUM','category':'lifecycle','title':'Entity\x20replace\x20—\x20destructive','description':'Replacing\x20'+a['entity']['entity1']+'\x20with\x20'+a['entity']['entity2']+';\x20entity1\x20loses\x20ALL\x20permissions\x20permanently','affected_stakeholders':['entity'],'scenario':'Replacing\x20a\x20user\x20who\x20left\x20the\x20organization','mitigation':'Prefer\x20\x27copy\x27\x20over\x20\x27replace\x27\x20if\x20entity1\x20should\x20retain\x20permissions','evidence':'entity1='+a['entity']['entity1']+',\x20entity2='+a['entity']['entity2']};}},R_P_5_01={'id':'R-P-5-01','category':'cross_object','trigger':'Apply\x20to\x20Progress\x20object\x20(Permission\x20becomes\x20immutable\x20on\x20bind)','check':a=>{if(!a['apply'])return null;if(a['target_objects_types']?.['includes']('Progress'))return{'id':'R-P-5-01','level':'MEDIUM','category':'cross_object','title':'Apply\x20to\x20Progress\x20—\x20post-bind\x20mutability\x20limited','description':'Once\x20Permission\x20is\x20bound\x20to\x20Progress\x20(which\x20binds\x20Machine),\x20permission\x20table\x20changes\x20may\x20not\x20affect\x20already-published\x20Machine\x20workflow','affected_stakeholders':['owner'],'scenario':'Permission\x20shared\x20across\x20Machine/Progress','mitigation':'Configure\x20all\x20permission\x20indexes\x20before\x20Machine\x20publish','evidence':'target=Progress'};return null;}},R_P_5_02={'id':'R-P-5-02','category':'cross_object','trigger':'Permission\x20reused\x20across\x20multiple\x20host\x20object\x20types','check':a=>{if(!a['target_objects_types']||a['target_objects_types']['length']<0x2)return null;const b=new Set(a['target_objects_types']);if(b['size']>0x1)return{'id':'R-P-5-02','level':'MEDIUM','category':'cross_object','title':'Permission\x20shared\x20across\x20heterogeneous\x20objects','description':'Single\x20Permission\x20applied\x20to\x20'+[...b]['join'](',\x20')+';\x20permission\x20indexes\x20may\x20have\x20different\x20semantics\x20per\x20object','affected_stakeholders':['owner','admin'],'scenario':'One\x20Permission\x20for\x20both\x20Service\x20and\x20Treasury','mitigation':'Use\x20separate\x20Permission\x20objects\x20per\x20host\x20object\x20type\x20for\x20clarity','evidence':'types='+[...b]['join'](',')};return null;}},R_P_5_03={'id':'R-P-5-03','category':'cross_object','trigger':'Treasury\x20external_*_guard\x20management\x20(255/256)\x20granted\x20—\x20verify\x20guard\x20lists\x20are\x20populated','check':a=>{if(!a['table']||!('index'in a['table'])||typeof a['table']['index']!=='number')return null;const b=a['table']['index'];if(b===0xff||b===0x100)return{'id':'R-P-5-03','level':'HIGH','category':'cross_object','title':'Treasury\x20external\x20guard\x20management\x20granted\x20—\x20populate\x20guard\x20lists','description':'Permission\x20'+b+'\x20('+(b===0xff?'TREASURY_EXTERNAL_DEPOSIT_GUARD':'TREASURY_EXTERNAL_WITHDRAW_GUARD')+')\x20granted;\x20ensure\x20external_'+(b===0xff?'deposit':'withdraw')+'_guard\x20list\x20is\x20populated\x20via\x20external_*_guard_add\x20so\x20external\x20operations\x20are\x20authorized','affected_stakeholders':['owner','admin'],'scenario':'External\x20treasury\x20guard\x20management\x20without\x20populated\x20guard\x20lists','mitigation':'Call\x20treasury.external_'+(b===0xff?'deposit':'withdraw')+'_guard_add\x20to\x20register\x20Guard\x20objects;\x20external_deposit/external_withdraw\x20require\x20Guard\x20+\x20Passport\x20(no\x20Permission\x20index)','evidence':'index='+b};return null;}},ALL_RULES=[R_P_01,R_P_02,R_P_03,R_P_04,R_P_2_01,R_P_2_02,R_P_3_01,R_P_3_02,R_P_3_03,R_P_4_01,R_P_4_02,R_P_4_03,R_P_5_01,R_P_5_02,R_P_5_03];export const PERMISSION_RISK_VERSION='1.0.0';export function assessPermissionRisks(a){const b=[];for(const f of ALL_RULES){const g=f['check'](a);if(g)b['push'](g);}const c=b['length']===0x0?'LOW':b['some'](h=>h['level']==='CRITICAL')?'CRITICAL':b['some'](h=>h['level']==='HIGH')?'HIGH':b['some'](h=>h['level']==='MEDIUM')?'MEDIUM':'LOW',d={};for(const h of b){d[h['category']]=(d[h['category']]??0x0)+0x1;}const e={};for(const i of b){for(const j of i['affected_stakeholders']){if(!e[j])e[j]=[];e[j]['push'](i['id']+':\x20'+i['mitigation']);}}return{'summary':'Assessed\x20'+b['length']+'\x20risk(s)\x20across\x20'+Object['keys'](d)['length']+'\x20categories','risks':b,'overall_risk':c,'risks_by_category':d,'stakeholder_advice':e,'needs_human_review':b['some'](k=>k['level']==='CRITICAL'||k['level']==='HIGH')};}