@wowok/agent-mcp 3.1.3 → 3.1.4

package/dist/knowledge/baselines/rules/treasury.json

@@ -0,0 +1,440 @@
+{
+  "comment": "Treasury rule pack (R-T) — declarative form of the retired in-code Treasury risk rules. Facts are produced by the kernel extractor (treasury-risk.ts, bound to the treasury-puzzle chain limits); rules only reference fact names. Levels/wording can be retuned per rule and rules can be disabled (enabled=false, trace left) via the judgment document — factory rules can never be deleted or invented here.",
+  "facts": {
+    "description_length": "Length of the requested Treasury description (undefined when the context carries none).",
+    "max_description_length": "KERNEL CONSTANT — description cap (MAX_DESCRIPTION_LENGTH from treasury-puzzle).",
+    "description_over_limit": "description_length exceeds MAX_DESCRIPTION_LENGTH (chain-limit comparison sunk into the extractor).",
+    "external_deposit_guard_adding": "Number of guards added by an external_deposit_guard 'add' op (undefined for other ops).",
+    "external_deposit_guard_current": "Existing external_deposit_guard count at 'add' time (0 when the context carries none).",
+    "max_external_deposit_guard_count": "KERNEL CONSTANT — external deposit guard cap (MAX_EXTERNAL_DEPOSIT_GUARD_COUNT).",
+    "external_deposit_guard_over_limit": "An 'add' op would push the external_deposit_guard list over MAX_EXTERNAL_DEPOSIT_GUARD_COUNT.",
+    "external_withdraw_guard_adding": "Number of guards added by an external_withdraw_guard 'add' op (undefined for other ops).",
+    "external_withdraw_guard_current": "Existing external_withdraw_guard count at 'add' time (0 when the context carries none).",
+    "max_external_withdraw_guard_count": "KERNEL CONSTANT — external withdraw guard cap (MAX_EXTERNAL_WITHDRAW_GUARD_COUNT).",
+    "external_withdraw_guard_over_limit": "An 'add' op would push the external_withdraw_guard list over MAX_EXTERNAL_WITHDRAW_GUARD_COUNT.",
+    "external_withdraw_missing_identifier_guard": "First mounted (add/set) external_withdraw_guard entry whose required u8 identifier is absent (undefined when all entries carry one).",
+    "deposit_external_guard_name": "Requested external_deposit guard name (by_external_deposit_guard), only when the external deposit path is taken.",
+    "deposit_guard_list_empty": "External deposit requested while the Treasury's external_deposit_guard list is empty (count 0) — E_EXTERNAL_DEPOSIT_GUARD_NOT_FOUND ahead.",
+    "withdraw_external_guard_name": "Requested external_withdraw guard name (amount_by_external_withdraw_guard), only when the external withdraw path is taken.",
+    "withdraw_guard_list_empty": "External withdraw requested while the Treasury's external_withdraw_guard list is empty (count 0) — E_EXTERNAL_WITHDRAW_GUARD_NOT_FOUND ahead.",
+    "deposit_external_and_perm_252": "External deposit path requested while Permission index TREASURY_DEPOSIT (252) is also granted (mixed access paths).",
+    "external_deposit_split_refund": "External deposit with a coin value attached — values above the guard-specified amount are split and refunded.",
+    "external_deposit_coin_balance": "Coin balance attached to the external deposit (only when both the external path and a balance are present).",
+    "withdraw_via_guard_present": "The external withdraw path (amount_by_external_withdraw_guard) is requested.",
+    "external_withdraw_sender": "Transaction sender address, when resolvable at analysis time.",
+    "external_withdraw_sender_known": "The transaction sender is known (truthy) for this analysis.",
+    "external_withdraw_recipient": "Requested external_withdraw recipient (undefined when unset).",
+    "external_withdraw_recipient_unset": "Rendered external_withdraw recipient — '(unset)' when the context carries none (description display form).",
+    "withdraw_recipient_unknown": "Rendered withdraw recipient — '?' when the context carries none (evidence display form).",
+    "withdraw_recipient_word": "Rendered withdraw recipient — 'recipient' when the context carries none (description display form).",
+    "external_withdraw_recipient_mismatch": "Sender is known and the recipient is not the sender (case-insensitive compare) — guaranteed on-chain abort (treasury code 10).",
+    "external_withdraw_advisory": "External withdraw requested while the sender is not resolvable — advisory invariant reminder.",
+    "withdraw_amount_fixed": "Fixed (permissioned) withdraw amount requested.",
+    "perm_252_and_254": "Both TREASURY_DEPOSIT (252) and TREASURY_WITHDRAW (254) are granted — separation-of-duties review.",
+    "perm_has_255": "TREASURY_EXTERNAL_DEPOSIT_GUARD (255) is granted.",
+    "perm_has_256": "TREASURY_EXTERNAL_WITHDRAW_GUARD (256) is granted.",
+    "um_present": "The UM field is set in the context (set or revoked — not absent).",
+    "um_is_null": "The UM field is explicitly null (revocation).",
+    "um_value": "The UM value being set (undefined on revocation/absence).",
+    "external_withdraw_guard_mounted": "An external_withdraw_guard add/set op mounts release Guards (the Guard becomes a real fund gate).",
+    "external_deposit_guard_mounted": "An external_deposit_guard add/set op mounts deposit Guards.",
+    "withdraw_mount_guards": "Comma-space-joined guard addresses of the mounted external_withdraw_guard list.",
+    "deposit_mount_guards": "Comma-space-joined guard addresses of the mounted external_deposit_guard list.",
+    "shared_with_service": "The Treasury is shared with a Service via a common Permission object.",
+    "shared_allocator_display": "Rendered shared_with_allocator flag ('true'/'false'/'undefined') for evidence display.",
+    "shared_arbitration_display": "Rendered shared_with_arbitration flag ('true'/'false'/'undefined') for evidence display.",
+    "treasury_receive_253_missing": "Treasury is referenced by Allocator/Arbitration but no entity holds TREASURY_RECEIVE (253).",
+    "stale_treasury_indexes": "Granted permission indexes in the stale 259/260 range (R-T-01 regression scan; undefined when no index list is present).",
+    "stale_treasury_indexes_csv_sp": "Stale indexes joined with ', ' (description display form).",
+    "stale_treasury_indexes_csv": "Stale indexes joined with ',' (evidence display form)."
+  },
+  "rules": [
+    {
+      "rule_id": "R-T-1-01",
+      "dimension": "structural",
+      "trigger": "Description length exceeds MAX_DESCRIPTION_LENGTH (4000)",
+      "cases": [
+        {
+          "when": { "field": "description_over_limit", "op": "eq", "value": true },
+          "level": "high",
+          "title": "Description length exceeds limit",
+          "description": "Description length ${description_length} exceeds MAX_DESCRIPTION_LENGTH ${max_description_length}",
+          "scenario": "Setting a description longer than 4000 characters",
+          "mitigation": "Truncate description to fit within 4000 characters",
+          "evidence": "length=${description_length}",
+          "stakeholders": ["owner", "admin"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-T-1-02",
+      "dimension": "structural",
+      "trigger": "external_deposit_guard count exceeds MAX_EXTERNAL_DEPOSIT_GUARD_COUNT (100)",
+      "cases": [
+        {
+          "when": { "field": "external_deposit_guard_over_limit", "op": "eq", "value": true },
+          "level": "high",
+          "title": "external_deposit_guard count exceeds limit",
+          "description": "Adding ${external_deposit_guard_adding} guards to existing ${external_deposit_guard_current} would exceed MAX_EXTERNAL_DEPOSIT_GUARD_COUNT ${max_external_deposit_guard_count}",
+          "scenario": "Adding too many external deposit guards",
+          "mitigation": "Remove unused guards before adding new ones, or use 'set' to replace the list",
+          "evidence": "current=${external_deposit_guard_current}, adding=${external_deposit_guard_adding}, limit=${max_external_deposit_guard_count}",
+          "stakeholders": ["owner"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-T-1-03",
+      "dimension": "structural",
+      "trigger": "external_withdraw_guard count exceeds MAX_EXTERNAL_WITHDRAW_GUARD_COUNT (200)",
+      "cases": [
+        {
+          "when": { "field": "external_withdraw_guard_over_limit", "op": "eq", "value": true },
+          "level": "high",
+          "title": "external_withdraw_guard count exceeds limit",
+          "description": "Adding ${external_withdraw_guard_adding} guards to existing ${external_withdraw_guard_current} would exceed MAX_EXTERNAL_WITHDRAW_GUARD_COUNT ${max_external_withdraw_guard_count}",
+          "scenario": "Adding too many external withdraw guards",
+          "mitigation": "Remove unused guards before adding new ones, or use 'set' to replace the list",
+          "evidence": "current=${external_withdraw_guard_current}, adding=${external_withdraw_guard_adding}, limit=${max_external_withdraw_guard_count}",
+          "stakeholders": ["owner"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-T-1-04",
+      "dimension": "structural",
+      "trigger": "external_withdraw_guard.identifier is missing (required u8, not Option)",
+      "cases": [
+        {
+          "when": { "field": "external_withdraw_missing_identifier_guard", "op": "present" },
+          "level": "high",
+          "title": "external_withdraw_guard.identifier missing",
+          "description": "Guard ${external_withdraw_missing_identifier_guard} missing required identifier. AmountFromWithdrawGuard.identifier is u8 (not Option<u8>); withdraw amount must come from Guard table.",
+          "scenario": "Configuring external withdraw guard without amount source",
+          "mitigation": "Set identifier to the Guard table index that provides the withdraw amount (must be a number-type field)",
+          "evidence": "guard=${external_withdraw_missing_identifier_guard}, identifier=undefined",
+          "stakeholders": ["owner", "external_operator"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-T-2-01",
+      "dimension": "semantic",
+      "trigger": "External operation (deposit/withdraw) requested without corresponding guard configured",
+      "cases": [
+        {
+          "when": { "field": "deposit_guard_list_empty", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "External deposit guard list is empty",
+          "description": "Requesting external_deposit via guard ${deposit_external_guard_name}, but Treasury has no external_deposit_guard configured. Operation will abort with E_EXTERNAL_DEPOSIT_GUARD_NOT_FOUND.",
+          "scenario": "External deposit attempted before guard_add",
+          "mitigation": "Register an external-deposit guard first (Permission index 255) for guard ${deposit_external_guard_name}",
+          "evidence": "guard=${deposit_external_guard_name}, current_count=0",
+          "stakeholders": ["external_operator", "owner"]
+        },
+        {
+          "when": { "field": "withdraw_guard_list_empty", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "External withdraw guard list is empty",
+          "description": "Requesting external_withdraw via guard ${withdraw_external_guard_name}, but Treasury has no external_withdraw_guard configured. Operation will abort with E_EXTERNAL_WITHDRAW_GUARD_NOT_FOUND.",
+          "scenario": "External withdraw attempted before guard_add",
+          "mitigation": "Register an external-withdraw guard first (Permission index 256) for guard ${withdraw_external_guard_name}",
+          "evidence": "guard=${withdraw_external_guard_name}, current_count=0",
+          "stakeholders": ["external_operator", "owner"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-T-2-02",
+      "dimension": "semantic",
+      "trigger": "External operation paired with Permission path (confused access control)",
+      "cases": [
+        {
+          "when": { "field": "deposit_external_and_perm_252", "op": "eq", "value": true },
+          "level": "low",
+          "title": "Both Permission deposit and external deposit guard configured",
+          "description": "Treasury has both TREASURY_DEPOSIT (252) granted and external_deposit_guard configured. While not an error, mixing access paths complicates audit.",
+          "scenario": "Hybrid internal+external deposit setup",
+          "mitigation": "Document which path each depositor should use; consider splitting into separate Treasury objects for clarity",
+          "evidence": "has_perm_252=true, has_external_deposit_guard=true",
+          "stakeholders": ["owner", "admin"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-T-2-03",
+      "dimension": "semantic",
+      "trigger": "external_deposit amount exceeds guard-specified value (split-and-refund path)",
+      "cases": [
+        {
+          "when": { "field": "external_deposit_split_refund", "op": "eq", "value": true },
+          "level": "low",
+          "title": "External deposit may trigger split-and-refund",
+          "description": "If coin value (${external_deposit_coin_balance}) exceeds guard-specified amount, the excess will be split and refunded to sender. Verify intent.",
+          "scenario": "External deposit with coin value > guard limit",
+          "mitigation": "Pre-split the coin to exact guard-specified amount, or accept the refund behavior",
+          "evidence": "coin_balance=${external_deposit_coin_balance}",
+          "stakeholders": ["external_operator"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-T-2-04",
+      "dimension": "semantic",
+      "trigger": "external_withdraw destination is not the transaction sender — guaranteed on-chain abort (treasury code 10) when the sender is known; advisory otherwise",
+      "cases": [
+        {
+          "when": { "field": "external_withdraw_recipient_mismatch", "op": "eq", "value": true },
+          "level": "high",
+          "title": "external_withdraw recipient is not the sender",
+          "description": "external_withdraw pays only the transaction sender (the guard authorizes release but no predicate can constrain the destination). Recipient ${external_withdraw_recipient_unset} != sender ${external_withdraw_sender}; the call will abort with EEXTERNAL_RECIPIENT_NOT_SIGNER (treasury code 10).",
+          "scenario": "Guard-driven withdraw to an address other than the signer",
+          "mitigation": "Set recipient to the sender address, or use the permissioned withdraw (amount.fixed, index 254) to pay another address.",
+          "evidence": "guard=${withdraw_external_guard_name}, recipient=${withdraw_recipient_unknown}, sender=${external_withdraw_sender}",
+          "stakeholders": ["owner", "external_operator"]
+        },
+        {
+          "when": { "field": "external_withdraw_advisory", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "external_withdraw pays only the transaction sender",
+          "description": "external_withdraw via guard ${withdraw_external_guard_name} releases funds only to the transaction sender (Move truth, code 10). The sender is not known in this analysis, so verify recipient == sender before executing.",
+          "scenario": "Guard-driven withdraw planned before the signer is resolved",
+          "mitigation": "Ensure recipient equals the sender, or use the permissioned withdraw (amount.fixed) for a different destination.",
+          "evidence": "guard=${withdraw_external_guard_name}, recipient=${withdraw_recipient_unknown}",
+          "stakeholders": ["owner", "external_operator"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-T-3-01",
+      "dimension": "authority",
+      "trigger": "Same address holds both TREASURY_DEPOSIT (252) and TREASURY_WITHDRAW (254)",
+      "cases": [
+        {
+          "when": { "field": "perm_252_and_254", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "Deposit and withdraw permissions both present (review separation)",
+          "description": "Both TREASURY_DEPOSIT (252) and TREASURY_WITHDRAW (254) are granted. Verify they are assigned to different entities to enforce separation of duties.",
+          "scenario": "Single role can both add and remove funds",
+          "mitigation": "Assign 252 to depositor role, 254 to withdrawer role; use separate Permission objects if needed",
+          "evidence": "has_252=true, has_254=true",
+          "stakeholders": ["owner", "depositor", "withdrawer"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-T-3-02",
+      "dimension": "authority",
+      "trigger": "TREASURY_EXTERNAL_DEPOSIT_GUARD (255) granted to non-owner (admin-level risk)",
+      "cases": [
+        {
+          "when": { "field": "perm_has_255", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "External deposit guard management permission granted",
+          "description": "TREASURY_EXTERNAL_DEPOSIT_GUARD (255) is granted. Managing external_deposit_guard list controls who can externally deposit. Verify assignment scope.",
+          "scenario": "Guard management delegated to operator",
+          "mitigation": "Restrict 255 to owner/admin only; guard list changes affect external access policy",
+          "evidence": "has_perm_255=true",
+          "stakeholders": ["owner", "admin"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-T-3-03",
+      "dimension": "authority",
+      "trigger": "TREASURY_EXTERNAL_WITHDRAW_GUARD (256) granted — high-impact permission",
+      "cases": [
+        {
+          "when": { "field": "perm_has_256", "op": "eq", "value": true },
+          "level": "high",
+          "title": "External withdraw guard management permission granted",
+          "description": "TREASURY_EXTERNAL_WITHDRAW_GUARD (256) is granted. Managing external_withdraw_guard list controls who can externally withdraw (irreversible). Tightly restrict.",
+          "scenario": "External withdraw guard management delegated",
+          "mitigation": "Restrict 256 to owner only; consider multi-sig for production Treasury",
+          "evidence": "has_perm_256=true",
+          "stakeholders": ["owner", "withdrawer"],
+          "exposure": {
+            "loss_parties": [
+              { "role": "merchant", "basis": "The Treasury balance is exposed to permission-free external_withdraw release: whoever holds 256 can remount the release Guards, opening the gate to addresses they control." }
+            ],
+            "gain_paths": [
+              {
+                "role": "collaborator",
+                "path": "A non-owner 256 holder replaces the external_withdraw_guard list with a permissive Guard, then pulls funds via external_withdraw from any address that satisfies it — the release pays the transaction sender directly.",
+                "viability": "viable",
+                "gate": "Holding 256 implies guard-list write power ('set' replaces the whole list) and the withdraw itself involves no Treasury Permission; verify the holder's address set and guard-list history to confirm the abuse path."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "rule_id": "R-T-4-01",
+      "dimension": "lifecycle",
+      "trigger": "Internal withdraw (fixed amount) — irreversible fund operation",
+      "cases": [
+        {
+          "when": { "field": "withdraw_amount_fixed", "op": "truthy" },
+          "level": "critical",
+          "title": "Internal withdraw is irreversible",
+          "description": "Fixed withdraw of ${withdraw_amount_fixed} to ${withdraw_recipient_word}. Once executed, funds cannot be recovered without recipient cooperation.",
+          "scenario": "Permission-authorized withdraw (254)",
+          "mitigation": "1) Verify recipient address twice. 2) Confirm amount. 3) Check balance sufficiency. 4) Record Payment object for audit.",
+          "evidence": "amount=${withdraw_amount_fixed}, recipient=${withdraw_recipient_unknown}",
+          "stakeholders": ["owner", "withdrawer"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-T-4-02",
+      "dimension": "lifecycle",
+      "trigger": "External withdraw (via guard) — irreversible fund operation",
+      "cases": [
+        {
+          "when": { "field": "withdraw_via_guard_present", "op": "eq", "value": true },
+          "level": "critical",
+          "title": "External withdraw is irreversible",
+          "description": "External withdraw via guard ${withdraw_external_guard_name} to ${withdraw_recipient_word}. Amount is determined by the Guard table identifier; the guard only authorizes release and cannot constrain the destination. Move truth: external_withdraw pays only the transaction sender (abort code 10); paying another address requires the permissioned withdraw (amount.fixed, index 254).",
+          "scenario": "Guard-authorized external withdraw",
+          "mitigation": "1) Verify Guard rules match business intent. 2) Ensure recipient == transaction sender (or switch to the permissioned fixed withdraw to pay someone else). 3) Ensure the Guard identifier points to the correct amount field. 4) Test on testnet first.",
+          "evidence": "guard=${withdraw_external_guard_name}, recipient=${withdraw_recipient_unknown}",
+          "stakeholders": ["owner", "external_operator", "withdrawer"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-T-4-03",
+      "dimension": "lifecycle",
+      "trigger": "UM set or revoked — object-linker core binding change",
+      "cases": [
+        {
+          "when": { "all": [
+            { "field": "um_present", "op": "eq", "value": true },
+            { "field": "um_is_null", "op": "eq", "value": true }
+          ] },
+          "level": "low",
+          "title": "UM revocation",
+          "description": "Revoking UM disaffiliates the Contact from Treasury via the object-linker unbinding. Existing contact bindings become orphaned.",
+          "scenario": "Owner revokes UM (sets it to none)",
+          "mitigation": "Verify no active business process depends on UM before revoking",
+          "evidence": "um=null",
+          "stakeholders": ["owner"]
+        },
+        {
+          "when": { "all": [
+            { "field": "um_present", "op": "eq", "value": true },
+            { "field": "um_is_null", "op": "eq", "value": false }
+          ] },
+          "level": "low",
+          "title": "UM delegation",
+          "description": "Setting UM to ${um_value}. UM (Contact object) gains binding with Treasury via the object-linker affiliation binding.",
+          "scenario": "Owner delegates UM (sets it to a Contact)",
+          "mitigation": "Verify UM address is a valid Contact object (not a user wallet)",
+          "evidence": "um=${um_value}",
+          "stakeholders": ["owner"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-T-4-04",
+      "dimension": "lifecycle",
+      "trigger": "Mounting an external deposit/withdraw Guard (add/set) — the Guard becomes a real fund gate; owner due diligence before it goes live",
+      "cases": [
+        {
+          "when": { "field": "external_withdraw_guard_mounted", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "Mounting external withdraw Guards — verify the release gate before going live",
+          "description": "Each mounted Guard (${withdraw_mount_guards}) becomes a permission-free release gate on external_withdraw: any external party whose transaction makes the Guard predicate pass can trigger fund release, with no Treasury Permission involved. The withdraw amount is read from the Guard table at the identifier slot — verify the Guard predicate constrains that slot. Move truth: the destination is forced to the transaction sender (abort code 10 on mismatch), so this gate cannot pay a third party; paying staff or another address must use the permissioned withdraw (amount.fixed, index 254).",
+          "scenario": "Owner mounts external withdraw Guards during Treasury configuration",
+          "mitigation": "1) Review the full Guard definition (root and table) and confirm the predicate matches the intended release policy. 2) Confirm every mounted entry has the correct identifier for the amount slot. 3) Regress on testnet: a recipient other than the sender must abort with code 10; a sender self-pull must succeed. 4) Keep permission 256 owner-only.",
+          "evidence": "mount=withdraw, guards=[${withdraw_mount_guards}]",
+          "stakeholders": ["owner", "external_operator"],
+          "exposure": {
+            "loss_parties": [
+              { "role": "merchant", "basis": "Each mounted Guard is a permission-free release gate over the Treasury balance: any external party whose transaction satisfies the Guard predicate can pull funds out to themselves, with no Treasury Permission involved." }
+            ],
+            "gain_paths": [
+              {
+                "role": "collaborator",
+                "path": "An external operator whose address satisfies a mounted Guard (${withdraw_mount_guards}) triggers external_withdraw and receives the release directly — the destination is forced to the transaction sender.",
+                "viability": "unverifiable",
+                "gate": "The deciding facts sit in the Guard predicate internals (who can make it pass and what the amount slot reads) — audit the full Guard definition before the gate goes live."
+              }
+            ]
+          }
+        },
+        {
+          "when": { "all": [
+            { "field": "external_deposit_guard_mounted", "op": "eq", "value": true },
+            { "not": { "field": "external_withdraw_guard_mounted", "op": "eq", "value": true } }
+          ] },
+          "level": "low",
+          "title": "Mounting external deposit Guards — the Guard becomes a permission-free deposit gate",
+          "description": "Each mounted Guard (${deposit_mount_guards}) becomes a permission-free gate on external_deposit: any external party whose transaction makes the Guard predicate pass can deposit without a Treasury Permission. The deposited Coin is a transaction argument, so value can only come from the transaction sender — the flow direction is safe; store_from_id, when set, only resolves an address for record-keeping.",
+          "scenario": "Owner mounts external deposit Guards during Treasury configuration",
+          "mitigation": "1) Review the Guard definition and confirm the predicate matches the intended deposit policy. 2) Confirm store_from_id is used for record-keeping only, not as a destination. 3) Regress on testnet first.",
+          "evidence": "mount=deposit, guards=[${deposit_mount_guards}]",
+          "stakeholders": ["owner", "external_operator"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-T-5-01",
+      "dimension": "cross_object",
+      "trigger": "Treasury shared with Service via common Permission — verify alignment",
+      "cases": [
+        {
+          "when": { "field": "shared_with_service", "op": "truthy" },
+          "level": "medium",
+          "title": "Treasury-Service Permission sharing — verify index alignment",
+          "description": "Treasury and Service share a Permission object. Ensure Treasury indexes (250-258) and Service indexes (300-320) are assigned to intended entities; cross-object admin changes affect both.",
+          "scenario": "Single Permission for both Treasury and Service",
+          "mitigation": "Document which entities hold which indexes across both objects; review admin list changes for cross-impact",
+          "evidence": "shared_with_service=true",
+          "stakeholders": ["owner", "admin"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-T-5-02",
+      "dimension": "cross_object",
+      "trigger": "Treasury referenced by Allocator/Arbitration — receive (253) must be granted",
+      "cases": [
+        {
+          "when": { "field": "treasury_receive_253_missing", "op": "eq", "value": true },
+          "level": "high",
+          "title": "Treasury referenced by Allocator/Arbitration but TREASURY_RECEIVE (253) not granted",
+          "description": "Allocator/Arbitration will send CoinWrapper/Payment to Treasury, but no entity has TREASURY_RECEIVE (253) to call receive and convert to balance. Funds will accumulate as received objects without entering balance.",
+          "scenario": "Revenue collection setup without receive permission",
+          "mitigation": "Grant TREASURY_RECEIVE (253) to a trusted operator (or owner) who will regularly call receive to convert CoinWrapper to balance",
+          "evidence": "shared_allocator=${shared_allocator_display}, shared_arbitration=${shared_arbitration_display}, has_253=false",
+          "stakeholders": ["owner", "system"],
+          "exposure": {
+            "loss_parties": [
+              { "role": "merchant", "basis": "Allocator/Arbitration payouts are sent to this Treasury, but with no TREASURY_RECEIVE (253) holder the received CoinWrappers are never converted to balance — revenue accumulates inaccessible and can be neither withdrawn nor redeployed." }
+            ],
+            "gain_paths": []
+          }
+        }
+      ]
+    },
+    {
+      "rule_id": "R-T-0-01",
+      "dimension": "structural",
+      "trigger": "Permission index in 259-260 range detected (regression check for R-T-01)",
+      "cases": [
+        {
+          "when": { "field": "stale_treasury_indexes", "op": "truthy" },
+          "level": "critical",
+          "title": "Stale Treasury permission index 259/260 detected (R-T-01 regression)",
+          "description": "Permission indexes 259/260 are no longer valid Treasury indexes (SDK fixed to use 255-258 matching Move). Found: ${stale_treasury_indexes_csv_sp}",
+          "scenario": "SDK regression reintroducing off-by-2 divergence",
+          "mitigation": "Use canonical indexes: 255=EXTERNAL_DEPOSIT_GUARD, 256=EXTERNAL_WITHDRAW_GUARD, 257=OWNER_RECEIVE, 258=UM",
+          "evidence": "stale_indexes=${stale_treasury_indexes_csv}",
+          "stakeholders": ["owner", "admin", "system"]
+        }
+      ]
+    }
+  ]
+}

package/dist/knowledge/baselines/rules/util.json

@@ -0,0 +1,101 @@
+{
+  "comment": "Util rule pack (R-UTIL) — declarative form of the retired in-code Util risk rules. Facts are produced by the kernel extractor (util-risk.ts, bound to the on-chain address layout); rules only reference fact names. Levels/wording can be retuned per rule and rules can be disabled (enabled=false, trace left) via the judgment document — factory rules can never be deleted or invented here.",
+  "facts": {
+    "uses_typo_function_name": "The caller invokes the published child-object address check by its misspelled published name (the name is immutable on-chain, so the typo must be routed around, not fixed).",
+    "assumes_stable_address_bytes": "The caller assumes the address first-byte classification will stay valid across future protocol upgrades.",
+    "large_util_import": "The caller pulls a large fraction of the SDK utility module (single ~50KB file — navigation and coupling concern).",
+    "expects_util_events": "The caller expects the utility library to emit observability events (it is pure — it emits none).",
+    "bcs_manually_synced": "The caller maintains BCS layouts by hand instead of generating them from the on-chain struct layouts (drift risk).",
+    "address_byte_user": "KERNEL CONSTANT — first byte classifying user addresses in the on-chain address layout.",
+    "address_byte_object_regular": "KERNEL CONSTANT — first byte marking a regular/child object address.",
+    "address_byte_typed_min": "KERNEL CONSTANT — lower bound of the first-byte range marking typed business objects.",
+    "address_byte_typed_max": "KERNEL CONSTANT — upper bound of the first-byte range marking typed business objects."
+  },
+  "rules": [
+    {
+      "rule_id": "R-UTIL-01",
+      "dimension": "semantic",
+      "trigger": "caller uses the misspelled published child-object address check name",
+      "cases": [
+        {
+          "when": { "field": "uses_typo_function_name", "op": "eq", "value": true },
+          "level": "low",
+          "title": "The child-object address check was published with a misspelled name ('chiild') — cannot be renamed post-publish",
+          "description": "The Move layer defines the child-object address-byte check with a misspelled name (note the 'chiild' typo). The function is already published on mainnet, so the name cannot be fixed without a breaking package upgrade. Callers must use the misspelled name exactly; SDK wrappers should expose a correctly-spelled alias and route to the typo function.",
+          "scenario": "Caller writes is_child_object_address_byte; Move linker cannot resolve the symbol",
+          "mitigation": "SDK should expose isChildObjectAddressByte as the public API and internally call the typo'd Move function. Document the typo so future maintainers don't 'fix' it.",
+          "evidence": "uses_typo_function_name=true (must use 'chiild')",
+          "stakeholders": ["caller"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-UTIL-02",
+      "dimension": "semantic",
+      "trigger": "caller assumes address-byte thresholds survive protocol upgrades",
+      "cases": [
+        {
+          "when": { "field": "assumes_stable_address_bytes", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "Address-byte thresholds are hardcoded — Wow protocol upgrades could invalidate them",
+          "description": "Addresses are classified by first byte: user (${address_byte_user}), object (${address_byte_object_regular} for regular/child, or ${address_byte_typed_min}..${address_byte_typed_max} for typed business objects). These thresholds are hardcoded as Move constants, not configurable. If a future Wow protocol upgrade changes the address byte layout (e.g. reserves a new prefix), Util would silently misclassify addresses until the Move code is upgraded.",
+          "scenario": "Wow protocol upgrade introduces a new address prefix; Util misclassifies it as user",
+          "mitigation": "Track Wow protocol upgrades that touch address layout. When a change ships, upgrade the Move package and the SDK in lockstep. Add a sync test that asserts the byte values.",
+          "evidence": "assumes_stable_address_bytes=true (hardcoded ${address_byte_user}/${address_byte_object_regular}/${address_byte_typed_min}..${address_byte_typed_max})",
+          "stakeholders": ["caller", "system"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-UTIL-03",
+      "dimension": "structural",
+      "trigger": "caller pulls a large fraction of the ~50KB SDK utility module",
+      "cases": [
+        {
+          "when": { "field": "large_util_import", "op": "eq", "value": true },
+          "level": "low",
+          "title": "util.ts is ~50KB — over-concentrated, hard to navigate",
+          "description": "The SDK util.ts is ~50428 bytes, mixing BCS structure definitions, query condition builders, Guard query helpers, and address utilities. The size makes it hard to navigate and increases the risk of accidental circular imports. New contributors often import the wrong symbol because so many are exported from one file.",
+          "scenario": "Developer imports ProgressHistoryFindConditionsBCS and accidentally pulls in unrelated code",
+          "mitigation": "Consider splitting util.ts into focused sub-modules (bcs.ts, query.ts, address.ts). Until then, prefer named imports over namespace imports to keep bundles lean.",
+          "evidence": "large_util_import=true (consider sub-modules)",
+          "stakeholders": ["caller", "system"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-UTIL-04",
+      "dimension": "lifecycle",
+      "trigger": "caller expects observability events from the pure utility library",
+      "cases": [
+        {
+          "when": { "field": "expects_util_events", "op": "eq", "value": true },
+          "level": "low",
+          "title": "Util emits no events — tool-call observability is caller's responsibility",
+          "description": "Util functions are pure: they neither emit nor consume events. Callers cannot rely on an event stream to trace Util invocations. For audit and debugging, the calling module must record its own log entries around Util calls.",
+          "scenario": "Auditor expects Util-call events; none exist, the call chain is invisible",
+          "mitigation": "Callers should emit their own events or write logs around Util calls when auditability is required. Treat Util as an opaque library function.",
+          "evidence": "expects_util_events=true (none emitted)",
+          "stakeholders": ["caller"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-UTIL-05",
+      "dimension": "cross_object",
+      "trigger": "BCS layouts maintained by hand while on-chain structs evolve",
+      "cases": [
+        {
+          "when": { "field": "bcs_manually_synced", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "SDK BCS structures must stay in sync with Move structs — drift breaks queries",
+          "description": "util.ts defines BCS structures for Progress History / Session / Forward / Record query conditions. These must match the Move struct layouts byte-for-byte. If a Move struct adds a field and the SDK BCS is not regenerated, query submissions will deserialize incorrectly on-chain, producing silent failures or aborts.",
+          "scenario": "Progress struct adds a field; SDK BCS is stale; queries return wrong results",
+          "mitigation": "Generate BCS structures from Move source via codegen, or run a sync test that compares SDK BCS layouts against Move structs on every release.",
+          "evidence": "bcs_manually_synced=true (drift risk)",
+          "stakeholders": ["caller", "system"]
+        }
+      ]
+    }
+  ]
+}

package/dist/knowledge/bridge-risk.d.ts

@@ -1,4 +1,5 @@
-export type BridgeRiskLevel = "CRITICAL" | "HIGH" | "MEDIUM" | "LOW" | "INFO";
+import { type Facts } from "../config/rule-engine.js";
+export type BridgeRiskLevel = "critical" | "high" | "medium" | "low" | "info";
 export type BridgeRiskCategory = "structural" | "lifecycle" | "permission" | "cross_object" | "knowledge";
 export type BridgeStakeholder = "user" | "committee" | "operator" | "system";
 export interface BridgeRisk {
@@ -27,9 +28,9 @@ export interface BridgeRiskCheckContext {
     versioned_upgrade_in_progress?: boolean;
     constants_synced?: boolean;
 }
-export declare const BRIDGE_RISK_RULES: {
-    rule: BridgeRisk;
-    check: (ctx: BridgeRiskCheckContext) => BridgeRisk | null;
-}[];
+export declare function bridgeRiskFacts(ctx: BridgeRiskCheckContext): Facts;
 export declare const BRIDGE_RISK_VERSION = "1.0.0";
+export declare const BRIDGE_RISK_RULES: Array<BridgeRisk & {
+    trigger?: string;
+}>;
 export declare function checkBridgeRisks(ctx: BridgeRiskCheckContext): BridgeRisk[];

package/dist/knowledge/bridge-risk.js

@@ -1 +1 @@
-import{BRIDGE_MESSAGE_VERSION,BRIDGE_EVM_ADDRESS_LENGTH,BRIDGE_CURRENT_VERSION}from'@wowok/wowok';const SUPPORTED_TOKENS=['ETH','WETH','WBTC','USDC','USDT'],MAX_IDEMPOTENCY_KEY_LENGTH=0x80,BRIDGE_ERROR_CODE_COUNT=0x14,R_B_01={'rule':{'id':'R-BRIDGE-01','level':'CRITICAL','category':'permission','title':'Cross-chain\x20asset\x20security\x20—\x20committee\x20signature\x20verification\x20is\x20the\x20single\x20trust\x20root','description':'Bridge\x20committee\x20signatures\x20are\x20the\x20only\x20thing\x20preventing\x20forged\x20cross-chain\x20messages\x20'+'from\x20minting\x20tokens\x20out\x20of\x20thin\x20air\x20(bridge.move:60).\x20If\x20a\x20committee\x20key\x20is\x20'+'compromised,\x20or\x20if\x20the\x20verification\x20logic\x20has\x20a\x20bug,\x20an\x20attacker\x20can\x20claim\x20arbitrary\x20'+'amounts\x20of\x20ETH/WETH/WBTC/USDC/USDT.\x20The\x20TransferLimiter\x20caps\x20single-transfer\x20amounts\x20'+'but\x20does\x20not\x20prevent\x20repeated\x20small\x20attacks.','affected_stakeholders':['user','committee','system'],'scenario':'Committee\x20private\x20key\x20leaks;\x20attacker\x20forges\x20an\x20approved\x20transfer\x20and\x20claims\x20funds','mitigation':'Committee\x20members\x20MUST\x20use\x20HSM-backed\x20multi-sig.\x20Rotate\x20keys\x20on\x20a\x20schedule.\x20Audit\x20'+'committee\x20membership\x20and\x20signature\x20verification\x20logic\x20on\x20every\x20release.\x20Monitor\x20'+'limiter\x20utilization\x20for\x20suspicious\x20patterns.\x20Have\x20an\x20EmergencyOp\x20pause\x20plan\x20ready.','auto_fixable':![]},'check':a=>{if(!a['assumes_committee_infallible'])return null;return{...R_B_01['rule'],'evidence':'assumes_committee_infallible=true\x20(trust\x20root\x20is\x20single-point)'};}},R_B_02={'rule':{'id':'R-BRIDGE-02','level':'HIGH','category':'cross_object','title':'Bridge\x20is\x20mainnet-only\x20—\x20testnet\x20operations\x20will\x20fail','description':'The\x20Bridge\x20is\x20only\x20configured\x20on\x20mainnet.\x20testnet\x20nodes\x20do\x20not\x20have\x20the\x20bridge\x20'+'role\x20configured,\x20so\x20any\x20cross-chain\x20operation\x20(cross_chain_wow_to_evm,\x20'+'cross_chain_evm_to_wow,\x20claim_wow_to_evm,\x20etc.)\x20will\x20abort.\x20Developers\x20who\x20test\x20on\x20'+'testnet\x20will\x20see\x20EBridgeUnavailable\x20(8)\x20and\x20may\x20misdiagnose\x20it\x20as\x20a\x20code\x20bug.','affected_stakeholders':['user','operator'],'scenario':'Developer\x20runs\x20cross_chain_wow_to_evm\x20on\x20testnet;\x20aborts\x20with\x20EBridgeUnavailable','mitigation':'MCP\x20layer\x20MUST\x20validate\x20mainnet\x20environment\x20before\x20submitting\x20Bridge\x20ops.\x20Document\x20'+'the\x20mainnet-only\x20restriction\x20prominently.\x20For\x20testing,\x20use\x20mainnet\x20small-amount\x20'+'transactions\x20or\x20fork\x20tests.','related_move_error':'EBridgeUnavailable\x20(8)','auto_fixable':![]},'check':a=>{if(!a['is_non_mainnet'])return null;return{...R_B_02['rule'],'evidence':'is_non_mainnet=true\x20(Bridge\x20unavailable)'};}},R_B_03={'rule':{'id':'R-BRIDGE-03','level':'HIGH','category':'structural','title':'TransferLimiter\x20caps\x20single\x20and\x20cumulative\x20transfer\x20amounts\x20—\x20large\x20transfers\x20reject','description':'The\x20TransferLimiter\x20(bridge.move:64)\x20enforces\x20both\x20per-transfer\x20and\x20cumulative\x20'+'transfer\x20caps\x20per\x20token\x20type.\x20A\x20transfer\x20that\x20exceeds\x20the\x20cap\x20aborts\x20with\x20'+'ETokenAlreadyClaimedOrHitLimit\x20(15)\x20or\x20similar.\x20Users\x20attempting\x20large\x20cross-chain\x20'+'moves\x20will\x20see\x20their\x20transactions\x20rejected\x20and\x20may\x20misdiagnose\x20it\x20as\x20a\x20bug.','affected_stakeholders':['user'],'scenario':'User\x20attempts\x20to\x20bridge\x201000\x20ETH;\x20limiter\x20rejects\x20the\x20transfer','mitigation':'Document\x20the\x20limiter\x20semantics.\x20Before\x20submitting,\x20query\x20the\x20current\x20limiter\x20'+'utilization.\x20For\x20large\x20amounts,\x20split\x20into\x20batches\x20across\x20multiple\x20transactions\x20'+'and/or\x20time\x20windows.\x20Surface\x20the\x20remaining\x20cap\x20in\x20the\x20UI.','related_move_error':'ETokenAlreadyClaimedOrHitLimit\x20(15)','auto_fixable':![]},'check':a=>null},R_B_04={'rule':{'id':'R-BRIDGE-04','level':'MEDIUM','category':'permission','title':'activeEvmAccount\x20is\x20a\x20single\x20global\x20EVM\x20account\x20—\x20key\x20leak\x20affects\x20all\x20assets','description':'Bridge\x20uses\x20a\x20single\x20global\x20activeEvmAccount\x20that\x20is\x20auto-generated\x20and\x20transparent\x20'+'to\x20users.\x20All\x20cross-chain\x20EVM-side\x20operations\x20flow\x20through\x20this\x20one\x20account.\x20If\x20its\x20'+'private\x20key\x20leaks,\x20every\x20supported\x20token\x20(ETH/WETH/WBTC/USDC/USDT)\x20on\x20every\x20'+'supported\x20chain\x20is\x20at\x20risk.\x20There\x20is\x20no\x20per-user\x20EVM\x20account\x20isolation.','affected_stakeholders':['user','system'],'scenario':'activeEvmAccount\x20private\x20key\x20leaks;\x20attacker\x20drains\x20all\x20bridged\x20EVM\x20assets','mitigation':'Store\x20the\x20activeEvmAccount\x20key\x20in\x20an\x20HSM.\x20Rotate\x20the\x20key\x20on\x20a\x20schedule\x20and\x20via\x20'+'Versioned\x20upgrade.\x20Monitor\x20EVM-side\x20balances\x20for\x20anomalous\x20outflows.\x20Have\x20an\x20'+'EmergencyOp\x20pause\x20plan\x20ready.','auto_fixable':![]},'check':a=>{if(!a['assumes_per_user_evm_account'])return null;return{...R_B_04['rule'],'evidence':'assumes_per_user_evm_account=true\x20(it\x20is\x20global)'};}},R_B_05={'rule':{'id':'R-BRIDGE-05','level':'MEDIUM','category':'cross_object','title':'Public\x20EVM\x20RPCs\x20may\x20rate-limit\x20(HTTP\x20429)\x20—\x20cross-chain\x20ops\x20stall','description':'Bridge\x20ops\x20that\x20query\x20EVM\x20state\x20(query_active_evm_account,\x20query_supported_evm_chains,\x20'+'query_transfer_status,\x20etc.)\x20depend\x20on\x20an\x20EVM\x20RPC.\x20Public\x20RPCs\x20(e.g.\x20Infura\x20free\x20tier,\x20'+'Alchemy\x20free\x20tier)\x20frequently\x20return\x20HTTP\x20429\x20under\x20load.\x20A\x20429\x20mid-flow\x20stalls\x20the\x20'+'cross-chain\x20operation\x20and\x20may\x20confuse\x20the\x20user.\x20manage_evm_rpc\x20supports\x20multi-RPC\x20'+'rotation,\x20but\x20it\x20must\x20be\x20configured\x20in\x20advance.','affected_stakeholders':['user','operator'],'scenario':'User\x20queries\x20transfer\x20status;\x20public\x20RPC\x20returns\x20429;\x20UI\x20shows\x20generic\x20error','mitigation':'Configure\x20multiple\x20EVM\x20RPCs\x20via\x20manage_evm_rpc\x20and\x20enable\x20failover.\x20Use\x20a\x20paid\x20RPC\x20'+'tier\x20for\x20production.\x20Surface\x20429\x20as\x20\x27RPC\x20busy,\x20retry\x27\x20rather\x20than\x20\x27operation\x20failed\x27.','auto_fixable':![]},'check':a=>{if(!a['uses_public_evm_rpc'])return null;return{...R_B_05['rule'],'evidence':'uses_public_evm_rpc=true\x20(429\x20risk)'};}},R_B_06={'rule':{'id':'R-BRIDGE-06','level':'MEDIUM','category':'lifecycle','title':'EmergencyOp\x20can\x20pause\x20the\x20Bridge\x20—\x20assets\x20lock\x20during\x20pause','description':'EmergencyOp\x20(bridge.move:89-91)\x20can\x20pause\x20the\x20entire\x20Bridge.\x20While\x20paused,\x20no\x20'+'cross-chain\x20operations\x20proceed\x20—\x20assets\x20in\x20flight\x20cannot\x20be\x20claimed,\x20new\x20transfers\x20'+'cannot\x20be\x20initiated.\x20The\x20pause\x20is\x20intended\x20for\x20incident\x20response,\x20but\x20a\x20prolonged\x20'+'pause\x20locks\x20user\x20funds\x20for\x20the\x20duration.','affected_stakeholders':['user','operator'],'scenario':'Bridge\x20is\x20paused\x20for\x20incident\x20response;\x20users\x20cannot\x20claim\x20in-flight\x20transfers','mitigation':'Document\x20the\x20pause\x20scenario\x20and\x20the\x20emergency\x20plan.\x20Provide\x20a\x20status\x20page\x20showing\x20'+'pause\x20state.\x20Set\x20expectations\x20on\x20pause\x20duration\x20and\x20recovery.\x20Operators\x20should\x20'+'practice\x20un-pause\x20drills.','auto_fixable':![]},'check':a=>{if(!a['is_paused'])return null;return{...R_B_06['rule'],'evidence':'is_paused=true\x20(assets\x20locked)'};}},R_B_07={'rule':{'id':'R-BRIDGE-07','level':'LOW','category':'structural','title':'Only\x20'+SUPPORTED_TOKENS['length']+'\x20tokens\x20supported\x20—\x20unsupported\x20tokens\x20cannot\x20bridge','description':'Bridge\x20supports\x20exactly\x20'+SUPPORTED_TOKENS['length']+'\x20tokens:\x20'+SUPPORTED_TOKENS['join'](',\x20')+'.\x20'+'Any\x20other\x20token\x20(e.g.\x20DAI,\x20LINK,\x20custom\x20tokens)\x20cannot\x20be\x20bridged.\x20Users\x20holding\x20'+'unsupported\x20tokens\x20will\x20see\x20their\x20transfer\x20rejected\x20with\x20EUnexpectedTokenType\x20(3).','affected_stakeholders':['user'],'scenario':'User\x20attempts\x20to\x20bridge\x20DAI;\x20aborts\x20with\x20EUnexpectedTokenType','mitigation':'Document\x20the\x20supported\x20token\x20list\x20prominently.\x20UI\x20should\x20filter\x20the\x20token\x20picker\x20to\x20'+'supported\x20tokens\x20only.\x20For\x20unsupported\x20tokens,\x20recommend\x20an\x20alternative\x20bridge.','related_move_error':'EUnexpectedTokenType\x20(3)','auto_fixable':![]},'check':a=>{if(!a['unsupported_token'])return null;return{...R_B_07['rule'],'evidence':'unsupported_token='+a['unsupported_token']+'\x20(supported:\x20'+SUPPORTED_TOKENS['join'](',')+')'};}},R_B_08={'rule':{'id':'R-BRIDGE-08','level':'MEDIUM','category':'structural','title':'Idempotency\x20key\x20max\x20'+MAX_IDEMPOTENCY_KEY_LENGTH+'\x20chars\x20—\x20long\x20keys\x20truncate\x20or\x20reject','description':'BridgeIdempotencyKeySchema\x20accepts\x20strings\x20of\x20length\x201-'+MAX_IDEMPOTENCY_KEY_LENGTH+'.\x20'+'Callers\x20who\x20generate\x20idempotency\x20keys\x20from\x20long\x20sources\x20(e.g.\x20full\x20JSON\x20payloads,\x20'+'UUIDs\x20with\x20prefixes)\x20may\x20exceed\x20the\x20limit\x20and\x20see\x20the\x20operation\x20rejected.\x20The\x20limit\x20'+'exists\x20to\x20keep\x20on-chain\x20storage\x20bounded.','affected_stakeholders':['user'],'scenario':'Caller\x20uses\x20a\x20200-char\x20idempotency\x20key;\x20operation\x20rejected','mitigation':'Generate\x20idempotency\x20keys\x20from\x20a\x20hash\x20(e.g.\x20keccak256\x20of\x20the\x20payload,\x20hex-encoded\x20=\x20'+'66\x20chars)\x20or\x20a\x20UUID\x20(36\x20chars).\x20Validate\x20length\x20client-side\x20before\x20submission.','auto_fixable':!![]},'check':a=>{if(a['idempotency_key_length']===undefined)return null;if(a['idempotency_key_length']<=MAX_IDEMPOTENCY_KEY_LENGTH)return null;return{...R_B_08['rule'],'evidence':'idempotency_key_length='+a['idempotency_key_length']+',\x20limit='+MAX_IDEMPOTENCY_KEY_LENGTH};}},R_B_09={'rule':{'id':'R-BRIDGE-09','level':'LOW','category':'structural','title':BRIDGE_ERROR_CODE_COUNT+'\x20error\x20codes\x20—\x20debugging\x20requires\x20a\x20lookup\x20table','description':'Bridge\x20defines\x20'+BRIDGE_ERROR_CODE_COUNT+'\x20error\x20codes\x20(EUnexpectedMessageType=0\x20'+'through\x20ETokenValueIsZero=19).\x20Debugging\x20an\x20abort\x20requires\x20mapping\x20the\x20numeric\x20code\x20'+'back\x20to\x20its\x20name\x20and\x20meaning.\x20New\x20contributors\x20often\x20misread\x20codes\x20because\x20they\x20'+'are\x20not\x20enumerated\x20in\x20the\x20abort\x20message.','affected_stakeholders':['user','operator'],'scenario':'Bridge\x20aborts\x20with\x20code\x2015;\x20developer\x20does\x20not\x20know\x20what\x20ETokenAlreadyClaimedOrHitLimit\x20means','mitigation':'Publish\x20an\x20error-code\x20lookup\x20table\x20in\x20the\x20docs.\x20SDK\x20should\x20decode\x20abort\x20codes\x20into\x20'+'human-readable\x20strings.\x20MCP\x20layer\x20should\x20surface\x20the\x20decoded\x20name\x20in\x20error\x20messages.','auto_fixable':![]},'check':a=>{if(!a['expects_simple_error_codes'])return null;return{...R_B_09['rule'],'evidence':'expects_simple_error_codes=true\x20(there\x20are\x20'+BRIDGE_ERROR_CODE_COUNT+')'};}},R_B_10={'rule':{'id':'R-BRIDGE-10','level':'MEDIUM','category':'lifecycle','title':'Versioned\x20upgrade\x20(current='+BRIDGE_CURRENT_VERSION+')\x20can\x20brick\x20the\x20Bridge\x20if\x20botched','description':'Bridge\x20uses\x20Versioned\x20to\x20wrap\x20BridgeInner\x20(bridge.move:49),\x20supporting\x20schema\x20upgrades.\x20'+('The\x20current\x20version\x20is\x20BRIDGE_CURRENT_VERSION='+BRIDGE_CURRENT_VERSION+'.\x20An\x20upgrade\x20')+'that\x20mishandles\x20the\x20inner\x20version\x20migration\x20can\x20permanently\x20brick\x20the\x20Bridge\x20—\x20'+'funds\x20in\x20flight\x20would\x20be\x20locked,\x20and\x20recovery\x20requires\x20a\x20new\x20package\x20version.\x20The\x20'+('message_version\x20(current='+BRIDGE_MESSAGE_VERSION+')\x20and\x20EVM\x20address\x20length\x20')+('('+BRIDGE_EVM_ADDRESS_LENGTH+'\x20bytes)\x20are\x20also\x20versioned.'),'affected_stakeholders':['user','operator','system'],'scenario':'Upgrade\x20mishandles\x20BridgeInner\x20migration;\x20Bridge\x20becomes\x20unusable','mitigation':'Test\x20upgrades\x20on\x20a\x20fork\x20with\x20full\x20state\x20replay.\x20Keep\x20a\x20rollback\x20package\x20version\x20'+'ready.\x20Stage\x20upgrades\x20with\x20a\x20pause\x20window\x20so\x20users\x20can\x20complete\x20in-flight\x20ops.\x20'+'Audit\x20message_version\x20and\x20EVM\x20address\x20length\x20compatibility\x20on\x20every\x20upgrade.','related_move_error':'EWrongInnerVersion\x20(7)','auto_fixable':![]},'check':a=>{if(!a['versioned_upgrade_in_progress'])return null;return{...R_B_10['rule'],'evidence':'versioned_upgrade_in_progress=true\x20(current='+BRIDGE_CURRENT_VERSION+')'};}};export const BRIDGE_RISK_RULES=[R_B_01,R_B_02,R_B_03,R_B_04,R_B_05,R_B_06,R_B_07,R_B_08,R_B_09,R_B_10];export const BRIDGE_RISK_VERSION='1.0.0';export function checkBridgeRisks(a){const b=[];for(const c of BRIDGE_RISK_RULES){const d=c['check'](a);if(d)b['push'](d);}return!b['find'](e=>e['id']==='R-BRIDGE-03')&&b['push'](R_B_03['rule']),b;}
+import{getJudgmentDoc,factoryRulePack}from'../config/judgment.js';import{evaluateRuleBook,interpolate}from'../config/rule-engine.js';import{BRIDGE_MESSAGE_VERSION,BRIDGE_EVM_ADDRESS_LENGTH,BRIDGE_CURRENT_VERSION}from'@wowok/wowok';const SUPPORTED_TOKENS=['ETH','WETH','WBTC','USDC','USDT'],MAX_IDEMPOTENCY_KEY_LENGTH=0x80,BRIDGE_ERROR_CODE_COUNT=0x14,AUTO_FIXABLE_RULES=new Set(['R-BRIDGE-08']);export function bridgeRiskFacts(a){return{'assumes_committee_infallible':a['assumes_committee_infallible'],'is_non_mainnet':a['is_non_mainnet'],'transfer_amount':a['transfer_amount'],'assumes_per_user_evm_account':a['assumes_per_user_evm_account'],'uses_public_evm_rpc':a['uses_public_evm_rpc'],'is_paused':a['is_paused'],'unsupported_token':a['unsupported_token'],'idempotency_key_length':a['idempotency_key_length'],'idempotency_key_over_limit':a['idempotency_key_length']!==undefined&&a['idempotency_key_length']>MAX_IDEMPOTENCY_KEY_LENGTH,'expects_simple_error_codes':a['expects_simple_error_codes'],'versioned_upgrade_in_progress':a['versioned_upgrade_in_progress'],'constants_synced':a['constants_synced'],'supported_token_count':SUPPORTED_TOKENS['length'],'supported_tokens_display':SUPPORTED_TOKENS['join'](',\x20'),'supported_tokens_csv':SUPPORTED_TOKENS['join'](','),'max_idempotency_key_length':MAX_IDEMPOTENCY_KEY_LENGTH,'error_code_count':BRIDGE_ERROR_CODE_COUNT,'bridge_message_version':BRIDGE_MESSAGE_VERSION,'bridge_current_version':BRIDGE_CURRENT_VERSION,'bridge_evm_address_length':BRIDGE_EVM_ADDRESS_LENGTH,'always_true':!![]};}function bridgeRuleBook(){const a=getJudgmentDoc()['rules']['domains']['bridge'];if(!a)throw new Error('factory\x20rule\x20pack\x20\x27bridge\x27\x20missing\x20—\x20broken\x20installation');return a['rules'];}function findingToBridgeRisk(a){return{'id':a['rule_id'],'level':a['level'],'category':a['dimension']??'structural','title':a['title'],'description':a['description'],'affected_stakeholders':a['stakeholders']??[],'scenario':a['scenario']??'','mitigation':a['mitigation']??'','evidence':a['evidence'],'auto_fixable':AUTO_FIXABLE_RULES['has'](a['rule_id'])};}export const BRIDGE_RISK_VERSION='1.0.0';export const BRIDGE_RISK_RULES=((()=>{const a=factoryRulePack('bridge');if(!a)return[];const b=bridgeRiskFacts({});return a['rules']['map'](d=>{const e=d['cases'][0x0];return{'id':d['rule_id'],'level':e['level'],'category':d['dimension']??'structural','title':interpolate(e['title'],b),'description':interpolate(e['description'],b),'affected_stakeholders':e['stakeholders']??[],'scenario':e['scenario']===undefined?'':interpolate(e['scenario'],b),'mitigation':e['mitigation']===undefined?'':interpolate(e['mitigation'],b),'auto_fixable':AUTO_FIXABLE_RULES['has'](d['rule_id']),...d['trigger']===undefined?{}:{'trigger':d['trigger']}};});})());export function checkBridgeRisks(a){const {findings:b}=evaluateRuleBook(bridgeRuleBook(),bridgeRiskFacts(a));return b['map'](findingToBridgeRisk);}