@wowok/agent-mcp 3.1.3 → 3.1.4

package/dist/knowledge/baselines/rules/personal.json

@@ -0,0 +1,139 @@
+{
+  "comment": "Personal rule pack (R-PERSONAL) — declarative form of the retired in-code Personal risk rules. Facts are produced by the kernel extractor (personal-risk.ts, bound to the inherited registrar record caps and the sensitive-content heuristic); rules only reference fact names. Levels/wording can be retuned per rule and rules can be disabled (enabled=false, trace left) via the judgment document — factory rules can never be deleted or invented here.",
+  "facts": {
+    "sensitive_hits_found": "True when the sensitive-content heuristic matched at least one information entry (phone / email / private key / mnemonic / secret-named).",
+    "sensitive_patterns_text": "Pre-rendered match list ('name=kind' entries joined by '; ') for the evidence text.",
+    "is_mark_destroy": "The caller is invoking the irreversible mark destroy operation.",
+    "has_referrer": "A referrer address is set (self-attested, unverified on-chain).",
+    "is_mark_transfer": "The caller is invoking the mark transfer operation (the source address loses the mark).",
+    "information_count": "Raw information record count, passed through for evidence text.",
+    "information_count_over_limit": "True when information_count is provided and meets or exceeds the inherited record-count cap.",
+    "expects_dedicated_move_struct": "The caller assumes a dedicated Personal Move struct exists (it does not — Personal composes Entity + Resource).",
+    "singleton_enforced": "True when the SDK enforces the one-record-per-account singleton invariant.",
+    "max_record_count_registrar": "KERNEL CONSTANT — record-count cap Personal inherits from the registrar entity layer.",
+    "max_record_length": "KERNEL CONSTANT — per-record length cap inherited from the registrar entity layer.",
+    "max_address_count": "KERNEL CONSTANT — address-list cap that applies via the entity layer.",
+    "max_tags_count": "KERNEL CONSTANT — tag cap that applies via the resource layer."
+  },
+  "rules": [
+    {
+      "rule_id": "R-PERSONAL-01",
+      "dimension": "semantic",
+      "trigger": "sensitive-content heuristic matched an information entry",
+      "cases": [
+        {
+          "when": { "field": "sensitive_hits_found", "op": "eq", "value": true },
+          "level": "high",
+          "title": "Sensitive information leakage — on-chain data is permanent",
+          "description": "information is stored via Entity.info_add as on-chain Records. The schema description warns 'NEVER: phone, address, private keys' but the Move layer does not validate content. Once a phone number, physical address, email, or private key is written on-chain, it is permanent and publicly readable — there is no delete (info_remove only removes the named entry from the user's record; the data remains in the transaction history).",
+          "scenario": "User adds information {name: 'phone', value: '+8613800000000'}; number is public forever",
+          "mitigation": "MCP schema description MUST warn. AI agents MUST re-confirm before adding any information entry. Business layer should run a sensitive-data regex (phone/email/private-key/mnemonic) and reject matches. Use the 'local' tool for private data.",
+          "evidence": "sensitive patterns: ${sensitive_patterns_text}",
+          "stakeholders": ["user"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PERSONAL-02",
+      "dimension": "lifecycle",
+      "trigger": "mark destroy is being invoked",
+      "cases": [
+        {
+          "when": { "field": "is_mark_destroy", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "mark destroy is irreversible — identity mark permanently lost",
+          "description": "The 'destroy' mark op permanently deletes the Resource object backing the user's identity mark. There is no archive, no event, and no rollback. After destroy, the user has no on-chain identity mark until they create a new one, and any external system keyed on the old Resource address breaks.",
+          "scenario": "User destroys their mark; downstream services keyed on the old Resource address fail",
+          "mitigation": "Require explicit confirmation before destroy. SDK should refuse destroy if any live consumer still references the mark. Provide a 'replace' alternative that swaps the underlying Resource without losing continuity.",
+          "evidence": "is_mark_destroy=true (irreversible)",
+          "stakeholders": ["user", "consumer"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PERSONAL-03",
+      "dimension": "semantic",
+      "trigger": "a referrer address is set",
+      "cases": [
+        {
+          "when": { "field": "has_referrer", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "referrer chain can be abused to fabricate trust signals",
+          "description": "When registering, a user may specify any referrer address. There is no on-chain verification that the referrer actually invited the user. A sybil attacker can register many accounts chained to a reputable address, fabricating an association to borrow trust. The Registrar records referrer but does not validate consent.",
+          "scenario": "Attacker registers 100 accounts all citing a reputable merchant as referrer",
+          "mitigation": "Business layer should treat referrer as a self-attested hint, not a verified trust signal. Audit referrer chains off-chain; require the referrer to co-sign if used for trust scoring.",
+          "evidence": "has_referrer=true (self-attested, unverified)",
+          "stakeholders": ["user", "consumer"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PERSONAL-04",
+      "dimension": "structural",
+      "trigger": "information record count meets or exceeds the inherited cap",
+      "cases": [
+        {
+          "when": { "field": "information_count_over_limit", "op": "eq", "value": true },
+          "level": "low",
+          "title": "information inherits MAX_RECORD_COUNT_REGISTRAR=${max_record_count_registrar} — permissive",
+          "description": "Personal does not define its own record cap; it inherits Entity's MAX_RECORD_COUNT_REGISTRAR=${max_record_count_registrar} and MAX_RECORD_LENGTH=${max_record_length} per record. ${max_record_count_registrar} records per user is generous and can bloat on-chain storage if users add many entries. MAX_ADDRESS_COUNT=${max_address_count} and MAX_TAGS_COUNT=${max_tags_count} also apply via Entity/Resource.",
+          "scenario": "User adds 1000 information entries; Entity record storage is heavy and slow to read",
+          "mitigation": "Business layer should self-limit information count (e.g. ≤50). For bulk profile data, store off-chain and reference via a Repository or Proof.",
+          "evidence": "information_count=${information_count}, limit=${max_record_count_registrar}",
+          "stakeholders": ["user", "system"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PERSONAL-05",
+      "dimension": "lifecycle",
+      "trigger": "mark transfer is being invoked",
+      "cases": [
+        {
+          "when": { "field": "is_mark_transfer", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "mark transfer loses identity mark at the source address",
+          "description": "The 'transfer' mark op moves the Resource backing the identity mark to a new address. After transfer, the source address has no mark — any service that keyed identity on the source address loses the binding. There is no automatic forwarding stub left behind.",
+          "scenario": "User transfers mark to a new wallet; old-wallet-based logins all break",
+          "mitigation": "Surface a 'transfer will detach the mark from this address' warning. Consumers should track marks by Resource address, not by user address. Provide a migration window where both addresses are valid.",
+          "evidence": "is_mark_transfer=true (source loses mark)",
+          "stakeholders": ["user", "consumer"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PERSONAL-06",
+      "dimension": "cross_object",
+      "trigger": "caller assumes a dedicated Personal Move struct",
+      "cases": [
+        {
+          "when": { "field": "expects_dedicated_move_struct", "op": "eq", "value": true },
+          "level": "low",
+          "title": "Personal has no dedicated Move struct — depends entirely on Entity + Resource",
+          "description": "Personal is an SDK-layer construct: there is no dedicated Move module. The SDK composes Entity (information/description) and Resource (mark) on behalf of the user. Any breaking change in Entity or Resource directly affects Personal. The MCP layer cannot fix Personal bugs without touching Entity/Resource.",
+          "scenario": "Entity schema changes; Personal.information silently breaks",
+          "mitigation": "Track Entity and Resource changelogs as first-order dependencies of Personal. Add integration tests that exercise Personal flows whenever Entity/Resource change.",
+          "evidence": "expects_dedicated_move_struct=true (none exists)",
+          "stakeholders": ["system"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PERSONAL-07",
+      "dimension": "lifecycle",
+      "trigger": "singleton invariant not enforced by the SDK",
+      "cases": [
+        {
+          "when": { "field": "singleton_enforced", "op": "falsy" },
+          "level": "medium",
+          "title": "Singleton assumption — if violated, multiple Personal instances conflict",
+          "description": "Personal assumes each account has exactly one Entity record (and one Resource mark). The Move layer enforces this via the registration operation's idempotency (returns the existing Resource for already-registered users). But if the SDK ever bypasses registration and creates duplicates (e.g. via the forced re-registration path), downstream code that assumes a singleton would see inconsistent state.",
+          "scenario": "SDK calls the forced re-registration path; user now has two Resource marks",
+          "mitigation": "SDK MUST enforce the singleton invariant: refuse to call the forced re-registration path unless the user explicitly opts in. Document that forced re-registration invalidates the old Resource address.",
+          "evidence": "singleton_enforced=false (needs SDK guard)",
+          "stakeholders": ["user", "consumer"]
+        }
+      ]
+    }
+  ]
+}

package/dist/knowledge/baselines/rules/progress.json

@@ -0,0 +1,346 @@
+{
+  "comment": "Progress rule pack (R-PR) — declarative form of the retired in-code Progress risk rules. Facts are produced by the kernel extractor (progress-risk.ts, bound to the on-chain count limits and the Machine/Order/Repository cross-object semantics); rules only reference fact names. Levels/wording can be retuned per rule and rules can be disabled (enabled=false, trace left) via the judgment document — factory rules can never be deleted or invented here. R-PR-5-01 ships disabled: its E_ORDER_NOT_MATCH check needs an Order query and is left to the confirmation layer (the retired in-code check was a no-op).",
+  "facts": {
+    "named_operator_addr_count": "Address count of the progress_namedOperator op's operator list.",
+    "named_operator_name": "The named_operator name targeted by the op (display form).",
+    "max_named_operator_address_count": "KERNEL CONSTANT — on-chain MAX_NAMED_OPERATOR_ADDRESS_COUNT bound imported from @wowok/wowok.",
+    "named_operator_addr_count_exceeded": "True when the op's address list exceeds MAX_NAMED_OPERATOR_ADDRESS_COUNT (E_MAX_NAMED_OPERATOR_ADDRESS_COUNT ahead).",
+    "named_operator_count_current": "Current named-operator namespace count on the Progress (0 when unknown).",
+    "max_named_operator_count": "KERNEL CONSTANT — on-chain MAX_NAMED_OPERATOR_COUNT bound imported from @wowok/wowok.",
+    "named_operator_count_at_limit": "True when an 'add' op lands on a Progress already at MAX_NAMED_OPERATOR_COUNT (E_MAX_NAMED_OPERATOR_COUNT ahead).",
+    "context_repo_current": "Current context repository count on the Progress (0 when unknown).",
+    "context_repo_add_count": "Repositories the op would add (0 for remove; the clear op is not a candidate).",
+    "context_repo_total": "Projected repository count after the op.",
+    "max_context_repository_count": "KERNEL CONSTANT — on-chain MAX_CONTEXT_REPOSITORY_COUNT bound imported from @wowok/wowok.",
+    "context_repo_count_exceeded": "True when the projected repository count exceeds MAX_CONTEXT_REPOSITORY_COUNT (E_MAX_CONTEXT_REPOSITORY_COUNT ahead).",
+    "named_operator_empty_name": "True when a non-remove named_operator op targets the empty-string name — the reserved OrderHolder namespace.",
+    "task_submit_blocked": "True when a task submission targets a Progress that already has a task bound (E_TASK_ALREADY_SET ahead).",
+    "current_task_display": "The currently bound task (Order) object id (display form).",
+    "operate_message_over_long": "True when operate.message exceeds the 1024-char common::LONG_NAME bound.",
+    "operate_message_length": "Length of operate.message in characters.",
+    "operate_op_invalid": "True when operate.op is set but not one of next/hold/unhold/adminUnhold.",
+    "operate_op": "The operate.op value (display form).",
+    "admin_unhold_op": "True when operate.op is 'adminUnhold' (224-permission force release).",
+    "operate_forward": "The forward name the operate op advances (display form).",
+    "operate_next_node_name": "The target node name of the operate op (display form).",
+    "forward_named_operator": "The namedOperator governing the forward being advanced (echo).",
+    "forward_named_op_bypass": "True when the forward advance rides the namedOperator short-circuit, skipping the 220-225 permission-index check.",
+    "forward_has_guard_display": "Echo of whether the forward carries a Guard (display form).",
+    "guard_passport_required": "True when the forward has a Guard but no permission index — a Passport is required for the advance (E_NEED_PASSPORT ahead).",
+    "machine_published_false": "True when the context explicitly marks the Machine as unpublished (strict false).",
+    "machine_name": "The Machine object id the Progress binds to (raw echo, display form).",
+    "machine_name_or_unknown": "The Machine object id, or '(unknown)' when absent (description display form).",
+    "forward_reaccomplish": "True when an operate targets a forward that is already accomplished (E_FORWARD_ALREADY_ACCOMPLISHED ahead).",
+    "unhold_non_holder": "True when an 'unhold' op is signed by an address other than the current holder (E_NOT_THE_HOLDER ahead).",
+    "holder_display": "The address currently holding the forward (display form).",
+    "signer_display": "The address signing the operate op (display form).",
+    "repository_add_op": "True when the context carries a repository 'add' op (creates object-linker tx bindings).",
+    "repo_add_count": "Number of repositories the 'add' op introduces.",
+    "heterogeneous_host_types": "True when the target object types span more than one distinct host type (≥2 entries).",
+    "unique_target_types_csv_space": "Distinct target host types, comma-space-joined (description display form).",
+    "unique_target_types_csv": "Distinct target host types, comma-joined (evidence display form).",
+    "orderless_operate": "True when an operate targets a Progress with no bound task (task=null) — order-holder advance/hold unavailable (E_ORDER_NOT_MATCH)."
+  },
+  "rules": [
+    {
+      "rule_id": "R-PR-1-01",
+      "dimension": "structural",
+      "trigger": "named_operator addresses count > MAX_NAMED_OPERATOR_ADDRESS_COUNT (80)",
+      "cases": [
+        {
+          "when": { "field": "named_operator_addr_count_exceeded", "op": "eq", "value": true },
+          "level": "high",
+          "title": "named_operator address count exceeds limit",
+          "description": "named_operator \"${named_operator_name}\" has ${named_operator_addr_count} addresses, exceeds MAX_NAMED_OPERATOR_ADDRESS_COUNT ${max_named_operator_address_count}. Move aborts with E_MAX_NAMED_OPERATOR_ADDRESS_COUNT.",
+          "scenario": "Adding > 80 addresses to a single named operator",
+          "mitigation": "Split into multiple named_operator names, or remove inactive addresses first",
+          "evidence": "addr_count=${named_operator_addr_count}",
+          "stakeholders": ["owner", "named_operator"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PR-1-02",
+      "dimension": "structural",
+      "trigger": "Adding new named_operator would exceed MAX_NAMED_OPERATOR_COUNT (60)",
+      "cases": [
+        {
+          "when": { "field": "named_operator_count_at_limit", "op": "eq", "value": true },
+          "level": "high",
+          "title": "named_operator namespace count at limit",
+          "description": "Progress already has ${named_operator_count_current} named operators, at MAX_NAMED_OPERATOR_COUNT ${max_named_operator_count}. Adding a new name will abort with E_MAX_NAMED_OPERATOR_COUNT.",
+          "scenario": "Adding a 61st named_operator name to a full Progress",
+          "mitigation": "Use 'set' on an existing name (replace address list), or remove an unused name first",
+          "evidence": "named_operator_count=${named_operator_count_current}",
+          "stakeholders": ["owner"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PR-1-03",
+      "dimension": "structural",
+      "trigger": "context_repository add would exceed MAX_CONTEXT_REPOSITORY_COUNT (30)",
+      "cases": [
+        {
+          "when": { "field": "context_repo_count_exceeded", "op": "eq", "value": true },
+          "level": "high",
+          "title": "context_repository count exceeds limit",
+          "description": "Progress has ${context_repo_current} repositories, adding ${context_repo_add_count} would total ${context_repo_total}, exceeds MAX_CONTEXT_REPOSITORY_COUNT ${max_context_repository_count}. Move aborts with E_MAX_CONTEXT_REPOSITORY_COUNT.",
+          "scenario": "Adding too many context repositories",
+          "mitigation": "Remove unused repositories first, or use repository 'set' to replace the list",
+          "evidence": "current=${context_repo_current}, add=${context_repo_add_count}",
+          "stakeholders": ["owner"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PR-1-04",
+      "dimension": "structural",
+      "trigger": "named_operator name is empty string but is_order_holder_namespace=false",
+      "cases": [
+        {
+          "when": { "field": "named_operator_empty_name", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "named_operator name is empty (OrderHolder namespace)",
+          "description": "progress_namedOperator.name=\"\" — empty string maps to the OrderHolder namespace (the reserved no-name operator slot). This is typically set automatically when an Order is created through the buy flow, not by direct user op. Manual manipulation may overwrite order-payer authorization.",
+          "scenario": "User manually setting the empty-name namespace",
+          "mitigation": "If intentional (e.g. an internal order-ownership call), confirm. Otherwise use a non-empty name.",
+          "evidence": "name=\"\"",
+          "stakeholders": ["owner", "named_operator"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PR-2-01",
+      "dimension": "semantic",
+      "trigger": "task submission on a Progress that already has a task (E_TASK_ALREADY_SET)",
+      "cases": [
+        {
+          "when": { "field": "task_submit_blocked", "op": "eq", "value": true },
+          "level": "high",
+          "title": "Task already bound on this Progress (irreversible)",
+          "description": "Progress already has task=${current_task_display}. Task submission is one-time; Move aborts with E_TASK_ALREADY_SET. There is no way to change the task after first set.",
+          "scenario": "User tries to rebind Progress to a different Order",
+          "mitigation": "Create a new Progress through a new buy flow with the new Order; the old Progress is permanently bound",
+          "evidence": "current_task=${current_task_display}",
+          "stakeholders": ["owner", "submitter"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PR-2-02",
+      "dimension": "semantic",
+      "trigger": "operate.message exceeds MAX_LONG_NAME_LENGTH (long-name constraint)",
+      "cases": [
+        {
+          "when": { "field": "operate_message_over_long", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "operate.message exceeds long-name length",
+          "description": "operate.message length ${operate_message_length} exceeds MAX_LONG_NAME_LENGTH (1024). Move aborts in common::LONG_NAME check.",
+          "scenario": "Long deliverable message",
+          "mitigation": "Truncate message to ≤ 1024 chars; store full payload in a context Repository",
+          "evidence": "msg_len=${operate_message_length}",
+          "stakeholders": ["submitter"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PR-2-03",
+      "dimension": "semantic",
+      "trigger": "operate.op is not a valid enum value (schema-enforced, defense-in-depth)",
+      "cases": [
+        {
+          "when": { "field": "operate_op_invalid", "op": "eq", "value": true },
+          "level": "high",
+          "title": "operate.op must be one of: next, hold, unhold, adminUnhold",
+          "description": "op enum selects the Move function: next=accomplish, hold=hold(bHold=true), unhold=hold(bHold=false), adminUnhold=unhold (224 permission).",
+          "scenario": "Schema validation bypassed or stale client",
+          "mitigation": "Use one of: next, hold, unhold, adminUnhold",
+          "evidence": "op=${operate_op}",
+          "stakeholders": ["submitter"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PR-3-01",
+      "dimension": "permission",
+      "trigger": "op='adminUnhold' (224 permission) — force release bypassing holder check",
+      "cases": [
+        {
+          "when": { "field": "admin_unhold_op", "op": "eq", "value": true },
+          "level": "high",
+          "title": "adminUnhold bypasses holder check (broad blast radius)",
+          "description": "adminUnhold uses 224 permission to release a held forward WITHOUT verifying sender == holder. If 224 is granted too broadly, any 224-holder can release ANY held forward in this Progress.",
+          "scenario": "Admin force-releases a forward that the original holder still wanted held",
+          "mitigation": "1) Grant 224 only to dedicated recovery addresses. 2) Log every adminUnhold for audit. 3) Prefer normal unhold (holder self-release) when possible.",
+          "evidence": "adminUnhold=true, forward=${operate_forward}",
+          "stakeholders": ["owner", "named_operator", "submitter"],
+          "exposure": {
+            "loss_parties": [
+              { "role": "buyer", "basis": "A hold is the objection brake on a disputed delivery; a forced release lets the workflow advance past it toward the terminal allocation despite the objection." }
+            ],
+            "gain_paths": [
+              {
+                "role": "neutral",
+                "path": "A broad 224-grantee force-releases the blocking hold and the workflow proceeds to the allocation the hold was placed to stop.",
+                "viability": "conditional",
+                "gate": "Executes only when the 224 permission is granted beyond dedicated recovery addresses — the rule flags grant breadth, not an observed over-grant."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PR-3-02",
+      "dimension": "permission",
+      "trigger": "namedOperator short-circuit bypasses 220-225 permission check",
+      "cases": [
+        {
+          "when": { "field": "forward_named_op_bypass", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "Forward advance via named_operator short-circuits 220-225 check",
+          "description": "Forward \"${operate_forward}\" uses namedOperator=\"${forward_named_operator}\". Move's ASSERT_PERMISSION returns immediately if IsNamedOperator() succeeds, WITHOUT checking any permission index. Anyone in the named_operator list can advance this forward.",
+          "scenario": "Operator list too permissive (e.g. includes expired/compromised addresses)",
+          "mitigation": "1) Keep named_operator lists minimal. 2) Use namedOperator_remove to revoke access promptly. 3) For sensitive forwards, prefer Forward.permissionIndex (Some) for dual-check.",
+          "evidence": "named_operator=${forward_named_operator}",
+          "stakeholders": ["owner", "named_operator"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PR-3-03",
+      "dimension": "permission",
+      "trigger": "Forward has guard (Some) — Passport required but not provided",
+      "cases": [
+        {
+          "when": { "field": "guard_passport_required", "op": "eq", "value": true },
+          "level": "high",
+          "title": "Forward guard requires Passport",
+          "description": "Forward \"${operate_forward}\" has a guard (Some). The advance asserts E_NEED_PASSPORT for guarded forwards when called without a passport. Use the passport-bearing advance path (progress-level or order-holder) instead.",
+          "scenario": "User calls next() on a guarded forward without passport",
+          "mitigation": "Submit via *_with_passport variant; ensure submission data is valid for the Guard",
+          "evidence": "forward=${operate_forward}, has_guard=${forward_has_guard_display}",
+          "stakeholders": ["submitter"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PR-4-01",
+      "dimension": "lifecycle",
+      "trigger": "Machine not published — Progress cannot be created",
+      "cases": [
+        {
+          "when": { "field": "machine_published_false", "op": "eq", "value": true },
+          "level": "critical",
+          "title": "Machine not published — Progress creation blocked",
+          "description": "Machine ${machine_name_or_unknown} is not published. Progress requires a published Machine (creation asserts the published state). All Progress ops will fail with E_MACHINE_NOT_MATCH or similar.",
+          "scenario": "User attempts to create Progress before Machine publish",
+          "mitigation": "Publish the Machine first (205 permission), then create Progress",
+          "evidence": "machine=${machine_name}, published=false",
+          "stakeholders": ["owner"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PR-4-02",
+      "dimension": "lifecycle",
+      "trigger": "operate on already-accomplished forward (E_FORWARD_ALREADY_ACCOMPLISHED)",
+      "cases": [
+        {
+          "when": { "field": "forward_reaccomplish", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "Forward already accomplished — re-hold blocked",
+          "description": "Forward \"${operate_forward}\" to \"${operate_next_node_name}\" is already accomplished. Move aborts with E_FORWARD_ALREADY_ACCOMPLISHED on any re-hold attempt.",
+          "scenario": "User retries an already-completed forward (race condition or stale state)",
+          "mitigation": "Query Progress.current — if already past target, no action needed; if parallel session, use a different forward",
+          "evidence": "forward=${operate_forward}, accomplished=true",
+          "stakeholders": ["submitter"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PR-4-03",
+      "dimension": "lifecycle",
+      "trigger": "unhold by non-holder without 224 permission (E_NOT_THE_HOLDER)",
+      "cases": [
+        {
+          "when": { "field": "unhold_non_holder", "op": "eq", "value": true },
+          "level": "high",
+          "title": "unhold by non-holder — Move will abort E_NOT_THE_HOLDER",
+          "description": "Forward is held by ${holder_display}, but signer is ${signer_display}. Move aborts with E_NOT_THE_HOLDER unless signer has 224 permission (adminUnhold path).",
+          "scenario": "User other than holder tries to release a hold",
+          "mitigation": "1) Have the original holder call unhold. 2) If holder is unresponsive, use adminUnhold=true (requires 224).",
+          "evidence": "holder=${holder_display}, signer=${signer_display}",
+          "stakeholders": ["submitter"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PR-5-01",
+      "dimension": "cross_object",
+      "trigger": "order-holder advance called but progress.task != order address (E_ORDER_NOT_MATCH)",
+      "enabled": false,
+      "cases": [
+        {
+          "when": { "field": "always_true", "op": "eq", "value": false },
+          "level": "low",
+          "title": "order-holder advance without a matching bound Order (retired-inert)",
+          "description": "R-PR-5-01 is retired-inert in the factory pack (enabled=false): the E_ORDER_NOT_MATCH check needs an Order query that the pack-level context cannot perform, so it is left to the confirmation layer — mirroring the retired in-code check, which never fired. Re-enabling cannot make this case fire (its guard is unsatisfiable by design).",
+          "mitigation": "Full check requires querying Order — done at the confirmation layer."
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PR-5-02",
+      "dimension": "cross_object",
+      "trigger": "context repository add without object-linker tx binding check",
+      "cases": [
+        {
+          "when": { "field": "repository_add_op", "op": "eq", "value": true },
+          "level": "low",
+          "title": "Context repository add creates object-linker tx binding",
+          "description": "Adding ${repo_add_count} repository(ies) creates object-linker tx binding entries. If the Repository is later deleted through a disaffiliation transaction, cross-object queries that depend on it will return empty results without warning.",
+          "scenario": "Repository deleted while Progress still references it",
+          "mitigation": "Remove the context repository binding before deleting a Repository; audit object-linker bindings periodically",
+          "evidence": "add_count=${repo_add_count}",
+          "stakeholders": ["owner", "system"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PR-5-03",
+      "dimension": "cross_object",
+      "trigger": "Permission used by Progress is shared with other host objects",
+      "cases": [
+        {
+          "when": { "field": "heterogeneous_host_types", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "Permission shared across heterogeneous host objects",
+          "description": "Single Permission applied to ${unique_target_types_csv_space}. Progress builtin indexes (220-225) have different semantics per host object; granting 221 (PROGRESS_NAMED_OPERATOR) to a non-Progress entity is meaningless.",
+          "scenario": "One Permission for both Progress and Machine",
+          "mitigation": "Use separate Permission objects per host object type",
+          "evidence": "types=${unique_target_types_csv}",
+          "stakeholders": ["owner"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-PR-5-04",
+      "dimension": "cross_object",
+      "trigger": "Progress without bound Order (order=null) — order-holder advance/hold blocked",
+      "cases": [
+        {
+          "when": { "field": "orderless_operate", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "operate without bound Order — order-holder advance/hold unavailable",
+          "description": "Progress has no bound task (task=null). The order-holder advance and hold paths require progress.task == order address (E_ORDER_NOT_MATCH). Use plain next()/hold() instead.",
+          "scenario": "User tries order variant on a task-less Progress",
+          "mitigation": "Use non-order next()/hold() variant, OR submit the task first to bind an Order",
+          "evidence": "task=null",
+          "stakeholders": ["submitter"]
+        }
+      ]
+    }
+  ]
+}