@wowok/agent-mcp 3.1.3 → 3.1.5

package/dist/knowledge/baselines/judgment-baselines.json

@@ -0,0 +1,289 @@
+{
+  "version": 1,
+  "description": "Judgment baselines — the factory defaults for every judgment this process makes. Sections: evaluation (scoring standards), game (strategy-game parameters), match (demand↔service matching), monitor (order-monitor thresholds), mode (mode-evaluator posture), scorecard (strategy scorecard tuning), rules (declarative rule book — factory rule packs load from knowledge/baselines/rules/<domain>.json into this namespace and merge with your overrides at rule granularity). Layering: this factory document < your user document (<config dir>/judgment-baselines.json, key-granularity merge — it can replace values or disable rules, never delete these entries) < session runtime overrides < persona < explicit request. The user document hot-reloads on every save; an invalid edit is rejected with the last good version kept in force (see config_operation judgment_list). Example patch (any subset, deep-merged at key granularity, unknown keys rejected): {\"evaluation\": {\"severity_deduction\": {\"critical\": 40}}, \"monitor\": {\"thresholds\": {\"messenger_timeout_hours\": 12}}, \"match\": {\"top_n\": 3}}.",
+  "evaluation": {
+    "comment": "Graph service evaluation standards. Weights are relative; the aggregate renormalizes over the enabled rules. An account persona may override per-dimension weights at runtime (persona layer 'evaluation.weights'), and an explicit request injection wins over persona.",
+    "weights": {
+      "trust_arbitration": 20,
+      "trust_reviews": 35,
+      "trust_fulfillment": 20,
+      "trust_fund_safety": 15,
+      "trust_transparency": 10,
+      "risk_workflow": 35,
+      "risk_fund": 25,
+      "risk_trust": 20,
+      "risk_behavior": 20
+    },
+    "dimensions": {
+      "trust_arbitration": {
+        "label": "Arbitration",
+        "description": "Binding arbitration coverage of the service's payment paths."
+      },
+      "trust_reviews": {
+        "label": "Reputation",
+        "description": "Verified review votes on the service's review window."
+      },
+      "trust_fulfillment": {
+        "label": "Fulfillment",
+        "description": "Observed orders and a verifiable machine workflow (terminal set)."
+      },
+      "trust_fund_safety": {
+        "label": "Fund safety",
+        "description": "Compensation fund vs 3x windowed order volume (statutory ceiling)."
+      },
+      "trust_transparency": {
+        "label": "Transparency",
+        "description": "Snapshot self-description, lock duration and published flag."
+      },
+      "risk_workflow": {
+        "label": "Workflow risk",
+        "description": "Structural analyzer findings on the machine workflow."
+      },
+      "risk_fund": {
+        "label": "Fund risk",
+        "description": "Structural analyzer findings on fund paths and payouts."
+      },
+      "risk_trust": {
+        "label": "Trust-surface risk",
+        "description": "Structural analyzer findings on the trust surface (arb/review/fund hooks)."
+      },
+      "risk_behavior": {
+        "label": "Behavior risk",
+        "description": "Structural analyzer findings on operator behavior controls."
+      }
+    },
+    "severity_deduction": {
+      "critical": 50,
+      "high": 25,
+      "medium": 10,
+      "low": 5,
+      "info": 0
+    },
+    "level_bands": [
+      { "min": 85, "level": "low" },
+      { "min": 70, "level": "medium_low" },
+      { "min": 50, "level": "medium_high" },
+      { "min": 0, "level": "high" }
+    ],
+    "grade_words": {
+      "comment": "Readable per-side grade rendered from the score. trust: higher score = better service; risk: higher score = fewer findings (safer).",
+      "trust": [
+        { "min": 70, "word": "strong" },
+        { "min": 50, "word": "fair" },
+        { "min": 0, "word": "weak" }
+      ],
+      "risk": [
+        { "min": 80, "word": "low risk" },
+        { "min": 50, "word": "moderate risk" },
+        { "min": 0, "word": "high risk" }
+      ]
+    }
+  },
+  "game": {
+    "comment": "Strategy-game parameters: role value anchors, appetite multipliers and scoring constants for the gain/risk consistency evaluation (net = base + per_gain*gains − per_risk*risks*sensitivity, clamped 0-100). Keyword rules re-anchor a role's interests from a persona's natural-language red lines (Q5 dictionary — users retune keywords/effects, never invent outcome vocabulary).",
+    "outcome_semantics": {
+      "completion": ["fund_released_to_merchant", "refund_leverage_given_up"],
+      "refund": ["fund_returned_to_buyer", "arbitration_review_triggered"],
+      "advance": ["node_advanced"]
+    },
+    "role_interests": {
+      "customer": {
+        "prefer": ["fund_returned_to_buyer"],
+        "avoid": ["fund_released_to_merchant", "refund_leverage_given_up"],
+        "sensitivity": 1.0
+      },
+      "merchant": {
+        "prefer": ["fund_released_to_merchant"],
+        "avoid": ["fund_returned_to_buyer", "arbitration_review_triggered"],
+        "sensitivity": 1.0
+      },
+      "demander": { "prefer": ["node_advanced"], "avoid": [], "sensitivity": 1.0 },
+      "collaborator": { "prefer": ["node_advanced"], "avoid": [], "sensitivity": 1.0 },
+      "supplier": {
+        "prefer": ["fund_released_to_merchant", "node_advanced"],
+        "avoid": ["fund_returned_to_buyer"],
+        "sensitivity": 1.0
+      },
+      "prospect": {
+        "prefer": ["fund_returned_to_buyer"],
+        "avoid": ["fund_released_to_merchant", "arbitration_review_triggered", "refund_leverage_given_up"],
+        "sensitivity": 1.0
+      },
+      "arbitrator": { "prefer": [], "avoid": ["arbitration_review_triggered"], "sensitivity": 1.0 },
+      "neutral": { "prefer": [], "avoid": [], "sensitivity": 1.0 },
+      "system": { "prefer": [], "avoid": [], "sensitivity": 1.0 }
+    },
+    "appetite_multipliers": { "conservative": 1.5, "balanced": 1.0, "aggressive": 0.6 },
+    "scoring": { "base": 60, "per_gain": 20, "per_risk": 25 },
+    "keyword_rules": [
+      {
+        "id": "kw_arbitration",
+        "keywords": ["arbitration"],
+        "effect": "arbitration_review_triggered",
+        "anchor": "avoid",
+        "when_forbidden": true
+      },
+      {
+        "id": "kw_refund",
+        "keywords": ["refund"],
+        "effect": "fund_returned_to_buyer",
+        "anchor": "prefer",
+        "when_forbidden": false
+      },
+      {
+        "id": "kw_upfront",
+        "keywords": ["upfront", "before delivery"],
+        "effect": "fund_released_to_merchant",
+        "anchor": "avoid",
+        "when_forbidden": true
+      },
+      {
+        "id": "kw_milestone",
+        "keywords": ["milestone"],
+        "effect": "node_advanced",
+        "anchor": "prefer",
+        "when_forbidden": false
+      }
+    ],
+    "forbid_pattern": "forbid|never|\\bno\\b",
+    "arb": {
+      "comment": "Arbitration 7-state game tunables — a PARALLEL case-lifecycle interest model (effects are about the dispute case, not the fund lifecycle; it shares only the appetite multiplier with the fund game). effect_semantics publishes the kernel effect vocabulary; keyword_rules re-anchor a perspective's prefer/avoid from persona red lines (an unconditional keyword entry is expressed as a pair with when_forbidden true AND false); scoring: favorability = clamp(base + per_gain × gains − per_risk × risks × sensitivity).",
+      "effect_semantics": {
+        "case_advanced": ["the case moves forward"],
+        "case_extended": ["the case is prolonged — more cost and delay"],
+        "reversal_chance": ["a chance to overturn a ruling"],
+        "adverse_ruling": ["an unfavorable ruling lands"],
+        "case_closed": ["the case reaches a terminal state"],
+        "fees_received": ["fees or indemnity are collected"]
+      },
+      "role_interests": {
+        "arbitrator": {
+          "prefer": ["case_advanced", "fees_received", "case_closed"],
+          "avoid": ["case_extended"],
+          "sensitivity": 1.0
+        },
+        "customer": {
+          "prefer": ["reversal_chance", "case_closed"],
+          "avoid": ["adverse_ruling", "case_extended"],
+          "sensitivity": 1.0
+        },
+        "merchant": {
+          "prefer": ["case_closed", "fees_received"],
+          "avoid": ["adverse_ruling", "reversal_chance", "case_extended"],
+          "sensitivity": 1.0
+        }
+      },
+      "keyword_rules": [
+        {
+          "id": "arb_kw_arbitration_forbid",
+          "keywords": ["arbitration"],
+          "effect": "case_extended",
+          "anchor": "avoid",
+          "when_forbidden": true
+        },
+        {
+          "id": "arb_kw_refund",
+          "keywords": ["refund"],
+          "effect": "reversal_chance",
+          "anchor": "prefer",
+          "when_forbidden": false
+        },
+        {
+          "id": "arb_kw_prolong",
+          "keywords": ["prolong", "delay"],
+          "effect": "case_extended",
+          "anchor": "avoid",
+          "when_forbidden": false
+        },
+        {
+          "id": "arb_kw_prolong_forbid",
+          "keywords": ["prolong", "delay"],
+          "effect": "case_extended",
+          "anchor": "avoid",
+          "when_forbidden": true
+        }
+      ],
+      "forbid_pattern": "forbid|never|\\bno\\b",
+      "scoring": { "base": 60, "per_gain": 20, "per_risk": 25 }
+    }
+  },
+  "match": {
+    "comment": "Demand↔service matching standing defaults (builtin evaluation 'demand_match'): region relation scores, per-dimension weights, trust bands and neutrality. A per-request UserInjection can still reweight or disable dimensions; trust_bands match FIRST entry whose min ≤ trust (keep descending order).",
+    "region_scores": { "exact": 100, "contains": 85, "compatible": 60, "overlap": 40, "mismatch": 0 },
+    "weights": {
+      "region": 15,
+      "industry": 20,
+      "price": 15,
+      "trust": 15,
+      "capabilities": 30,
+      "tags": 5,
+      "acceptance": 10
+    },
+    "trust_bands": [
+      { "min": 75, "score": 100 },
+      { "min": 50, "score": 60 },
+      { "min": 25, "score": 30 },
+      { "min": 0, "score": 0 }
+    ],
+    "neutral_score": 50,
+    "price_over_budget_tolerance_pct": 10,
+    "top_n": 5
+  },
+  "monitor": {
+    "comment": "In-progress order monitoring standing defaults. A caller-supplied per-order threshold (MonitorThresholds on the monitor input) always wins over thresholds here. progress_stall_hours = 0 derives the stall threshold from the expected advancement duration (expected × stall_expected_multiplier); escalation holds the critical-grade posture.",
+    "thresholds": {
+      "progress_stall_hours": 0,
+      "compensation_drop_ratio": 0.3,
+      "compensation_coverage_min": 1.0,
+      "messenger_timeout_hours": 24,
+      "review_window_closing_days": 3,
+      "arb_window_closing_days": 3
+    },
+    "escalation": {
+      "default_expected_progress_hours": 24,
+      "stall_expected_multiplier": 2,
+      "stall_escalation_multiplier": 2,
+      "messenger_escalation_multiplier": 2,
+      "ratio_critical_threshold": 0.5
+    }
+  },
+  "mode": {
+    "comment": "Mode-evaluator posture: risk/benefit recommendation thresholds per risk appetite (merchant_guide evaluation preview). risk_benefit_ratio is computed by the kernel; only the posture thresholds are tunable here.",
+    "appetite_thresholds": {
+      "conservative": { "max_risk": 30, "min_benefit": 50 },
+      "balanced": { "max_risk": 60, "min_benefit": 60 },
+      "aggressive": { "max_risk": 100, "min_benefit": 80 }
+    }
+  },
+  "scorecard": {
+    "comment": "Strategy scorecard numeric tuning (Q7 — one scoring document): per-metric posture weights and advisory good/bad scoring anchors, plus the shop-evidence gate. Catalog identity (source/unit/direction/labels) stays kernel-owned; only these numbers are data. Anchors: full score at/beyond good, zero at/beyond bad, linear between (direction lives in the good/bad ordering). A factory anchor can be retuned, never removed; metric ids can never be invented here. Shop-evidence gate BY DESIGN: document layers (user doc / persona / industry) can retune shop_evidence_metrics but can never EMPTY it — array merges never delete entries, so a numeric overall grade always demands at least one available own-commercial metric. To browse without the gate for one session, use a runtime override (config_operation judgment_set path scorecard.shop_evidence_metrics value []).",
+    "metrics": {
+      "order_count": { "weight": { "volume": 0.2, "balanced": 0.15, "margin": 0.05 }, "good_threshold": 20, "bad_threshold": 5 },
+      "completed_count": { "weight": { "volume": 0.1, "balanced": 0.1, "margin": 0.1 } },
+      "completion_rate": { "weight": { "volume": 0.15, "balanced": 0.2, "margin": 0.15 }, "good_threshold": 0.9, "bad_threshold": 0.6 },
+      "repeat_customer_rate": { "weight": { "volume": 0.2, "balanced": 0.25, "margin": 0.2 }, "good_threshold": 0.25, "bad_threshold": 0.1 },
+      "dispute_rate": { "weight": { "volume": 0.1, "balanced": 0.15, "margin": 0.2 }, "good_threshold": 0.02, "bad_threshold": 0.05 },
+      "dd_to_order_rate": { "weight": { "volume": 0.15, "balanced": 0.1, "margin": 0.05 }, "good_threshold": 0.2, "bad_threshold": 0.05 },
+      "market_recent_orders": { "weight": { "volume": 0.05, "balanced": 0.02, "margin": 0.02 } },
+      "market_recent_gmv": { "weight": { "volume": 0.02, "balanced": 0.02, "margin": 0.02 } },
+      "supply_demand_ratio": { "weight": { "volume": 0.02, "balanced": 0.03, "margin": 0.05 }, "good_threshold": 1, "bad_threshold": 4 },
+      "market_active_services": { "weight": { "volume": 0.01, "balanced": 0.01, "margin": 0.01 } },
+      "competitor_count": { "weight": { "volume": 0.02, "balanced": 0.05, "margin": 0.1 }, "good_threshold": 5, "bad_threshold": 30 },
+      "category_enumerated_count": { "weight": { "volume": 0.02, "balanced": 0.05, "margin": 0.1 } },
+      "arbitration_trust_score": { "weight": { "volume": 0.05, "balanced": 0.1, "margin": 0.15 }, "good_threshold": 80, "bad_threshold": 50 },
+      "open_attention_count": { "weight": { "volume": 0.03, "balanced": 0.03, "margin": 0.05 }, "good_threshold": 0, "bad_threshold": 5 }
+    },
+    "shop_evidence_metrics": [
+      "order_count",
+      "completion_rate",
+      "repeat_customer_rate",
+      "dispute_rate",
+      "dd_to_order_rate",
+      "arbitration_trust_score"
+    ]
+  },
+  "rules": {
+    "comment": "Declarative rule book. Factory rule packs live in knowledge/baselines/rules/<domain>.json and merge into this namespace at load time (Q11 split files, single document view). Override at rule granularity: retune levels/wording or disable with enabled=false (a trace is left) — factory rules can never be deleted or invented here.",
+    "domains": {}
+  }
+}

package/dist/knowledge/baselines/risk-baselines.spec.js

@@ -1 +1 @@
-import{describe,expect,it}from'vitest';import{readFileSync,writeFileSync}from'node:fs';import{fileURLToPath}from'node:url';import{dirname,join}from'node:path';import{RISK_CASES}from'./risk-cases.js';import{aggregateProjectRisks}from'../../playbooks/service-build/risk-aggregator.js';import{assessTreasuryRisks}from'../treasury-risk.js';import{assessRewardRisks}from'../reward-risk.js';function toArray(a){if(Array['isArray'](a))return a;if(a&&typeof a==='object')for(const b of['risks','detected_risks']){const c=a[b];if(Array['isArray'](c))return c;}return[];}function normalize(a){return toArray(a)['map'](b=>{const c=b??{};return{'id':String(c['id']??c['risk_rule_id']??c['rule_id']??'?'),'level':String(c['level']??c['severity']??'?')['toUpperCase'](),...c['evidence']!=null?{'evidence':String(c['evidence'])}:{}};})['sort']((c,d)=>c['id']===d['id']?(c['evidence']??'')['localeCompare'](d['evidence']??''):c['id']['localeCompare'](d['id']));}function runCase(a,b){try{return{'risks':normalize(a(b)),'threw':![]};}catch(c){return{'risks':[],'threw':!![]};}}function collect(){const a={};for(const b of RISK_CASES){const d=runCase(b['run'],b['empty']),e=runCase(b['run'],b['trigger']);a[b['pack']]={'objectType':b['objectType'],'empty':d['risks'],'emptyThrew':d['threw'],'trigger':e['risks']};}return a;}const here=dirname(fileURLToPath(import.meta.url)),SNAPSHOT=join(here,'risk-baselines.json'),AGG_SNAPSHOT=join(here,'aggregator-baselines.json');function puzzlesFrom(a){const b={};for(const d of RISK_CASES){if(d['pack']==='arb')continue;b[d['objectType']]={'puzzle':a(d)};}return b;}async function runAggregator(a){const b=await aggregateProjectRisks({'project_prefix':'baseline','version':'v1','industry':'general','puzzles':puzzlesFrom(a)});return{'severity_summary':b['severity_summary'],'status':b['status'],'findings':b['findings']['map'](c=>({'risk_rule_id':c['risk_rule_id'],'object_type':c['object_type'],'severity':c['severity']})),'warnings':b['warnings']};}describe('write-side\x20risk\x20packs\x20—\x20pre-migration\x20baseline',()=>{it('every\x20pack\x20trigger\x20context\x20fires\x20at\x20least\x20one\x20pack-specific\x20rule',()=>{for(const a of RISK_CASES){const {risks:b}=runCase(a['run'],a['trigger']);expect(b['length'],'pack\x20'+a['pack']+'\x20trigger\x20fired\x20nothing')['toBeGreaterThan'](0x0);}}),it('matches\x20the\x20committed\x20snapshot\x20(regenerate\x20only\x20with\x20--update)',()=>{const a=collect();if(process['env']['UPDATE_RISK_BASELINE']==='1'){writeFileSync(SNAPSHOT,JSON['stringify'](a,null,0x2)+'\x0a','utf8');return;}const b=JSON['parse'](readFileSync(SNAPSHOT,'utf8'));expect(new Set(Object['keys'](a)))['toEqual'](new Set(Object['keys'](b)));for(const c of Object['keys'](a)['sort']()){expect(a[c],'pack\x20'+c+'\x20drifted')['toEqual'](b[c]);}});}),describe('risk\x20aggregator\x20—\x20Task\x2026\x20parity\x20(id/severity/status)',()=>{const a=[['empty',b=>b['empty']],['trigger',b=>b['trigger']]];it('matches\x20the\x20committed\x20snapshot\x20(regenerate\x20only\x20with\x20--update)',async()=>{const b={};for(const [d,e]of a)b[d]=await runAggregator(e);if(process['env']['UPDATE_RISK_BASELINE']==='1'){writeFileSync(AGG_SNAPSHOT,JSON['stringify'](b,null,0x2)+'\x0a','utf8');return;}const c=JSON['parse'](readFileSync(AGG_SNAPSHOT,'utf8'));expect(b)['toEqual'](c);}),it('trigger\x20row\x20produces\x20CRITICAL\x20blockers\x20(sanity:\x20status\x20machine\x20alive)',async()=>{const b=await runAggregator(d=>d['trigger']);expect(b['findings']['some'](c=>c['severity']==='CRITICAL'))['toBe'](!![]),expect(b['status'])['not']['toBe']('RISK_PASSED');}),it('TR-26.2\x20every\x20finding\x20carries\x20its\x20proposal-graph\x20path\x20(explainability)',async()=>{const b=await aggregateProjectRisks({'project_prefix':'baseline','version':'v1','industry':'general','puzzles':puzzlesFrom(d=>d['trigger'])});expect(b['findings']['length'])['toBeGreaterThan'](0x0);for(const c of b['findings']){expect(c['details']?.['proposal_node'],'finding\x20'+c['risk_rule_id']+'\x20has\x20no\x20proposal\x20node')['toMatch'](/^proposal::/),expect(c['details']?.['rule_source'],'finding\x20'+c['risk_rule_id']+'\x20has\x20no\x20analyzer\x20source')['not']['toBe']('');}});}),describe('R-T-2-04\x20—\x20external_withdraw\x20pays\x20only\x20the\x20transaction\x20sender',()=>{const a={'withdraw':{'amount_by_external_withdraw_guard':'release-guard','recipient':'0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}};it('flags\x20HIGH\x20(code\x2010\x20abort\x20ahead)\x20when\x20recipient\x20!=\x20known\x20sender',()=>{const {risks:b}=assessTreasuryRisks({...a,'sender_address':'0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'}),c=b['find'](d=>d['id']==='R-T-2-04');expect(c?.['level'])['toBe']('HIGH'),expect(c?.['description']??'')['toContain']('code\x2010');}),it('stays\x20silent\x20when\x20recipient\x20equals\x20the\x20sender',()=>{const {risks:b}=assessTreasuryRisks({...a,'sender_address':'0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'});expect(b['some'](c=>c['id']==='R-T-2-04'))['toBe'](![]);}),it('advises\x20MEDIUM\x20when\x20the\x20sender\x20is\x20not\x20known\x20at\x20analysis\x20time',()=>{const {risks:b}=assessTreasuryRisks(a),c=b['find'](d=>d['id']==='R-T-2-04');expect(c?.['level'])['toBe']('MEDIUM');}),it('does\x20not\x20fire\x20on\x20the\x20fixed\x20(permissioned)\x20withdraw\x20path',()=>{const {risks:b}=assessTreasuryRisks({'withdraw':{'amount_fixed':'1000','recipient':'0xcccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc'},'sender_address':'0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'});expect(b['some'](c=>c['id']==='R-T-2-04'))['toBe'](![]);});}),describe('R-T-4-04\x20—\x20mounting\x20external\x20Guards\x20(owner\x20diligence\x20reminder)',()=>{it('flags\x20MEDIUM\x20when\x20mounting\x20external\x20withdraw\x20Guards',()=>{const {risks:a}=assessTreasuryRisks({'external_withdraw_guard':{'op':'add','guards':[{'guard':'0xg1','identifier':0x0}]}}),b=a['find'](c=>c['id']==='R-T-4-04');expect(b?.['level'])['toBe']('MEDIUM'),expect(b?.['description']??'')['toContain']('code\x2010');}),it('flags\x20LOW\x20when\x20mounting\x20external\x20deposit\x20Guards',()=>{const {risks:a}=assessTreasuryRisks({'external_deposit_guard':{'op':'add','guards':[{'guard':'0xg2'}]}}),b=a['find'](c=>c['id']==='R-T-4-04');expect(b?.['level'])['toBe']('LOW');}),it('stays\x20silent\x20on\x20remove/clear',()=>{const {risks:a}=assessTreasuryRisks({'external_withdraw_guard':{'op':'remove','guards':['0xg1']}});expect(a['some'](b=>b['id']==='R-T-4-04'))['toBe'](![]);});}),describe('R-R-2-05\x20—\x20mounting\x20a\x20claim\x20Guard\x20with\x20a\x20GuardIdentifier\x20payout\x20slot',()=>{const a={'guard':'0xg1','amount':{'type':'fixed','value':'100'}};it('flags\x20MEDIUM\x20when\x20the\x20recipient\x20is\x20a\x20GuardIdentifier\x20slot',()=>{const {risks:b}=assessRewardRisks({'guard_add':[{...a,'recipient':{'GuardIdentifier':0x0}}]}),c=b['find'](d=>d['id']==='R-R-2-05');expect(c?.['level'])['toBe']('MEDIUM'),expect(c?.['description']??'')['toContain']('GuardIdentifier');}),it('stays\x20silent\x20for\x20Entity/Signer\x20recipients',()=>{const {risks:b}=assessRewardRisks({'guard_add':[{...a,'recipient':{'Entity':'0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}}]});expect(b['some'](c=>c['id']==='R-R-2-05'))['toBe'](![]);});});
+import{describe,expect,it}from'vitest';import{readFileSync,writeFileSync}from'node:fs';import{fileURLToPath}from'node:url';import{dirname,join}from'node:path';import{RISK_CASES}from'./risk-cases.js';import{aggregateProjectRisks}from'../../playbooks/service-build/risk-aggregator.js';import{assessTreasuryRisks}from'../treasury-risk.js';import{assessRewardRisks}from'../reward-risk.js';function toArray(a){if(Array['isArray'](a))return a;if(a&&typeof a==='object')for(const b of['risks','detected_risks']){const c=a[b];if(Array['isArray'](c))return c;}return[];}function normalize(a){return toArray(a)['map'](b=>{const c=b??{};return{'id':String(c['id']??c['risk_rule_id']??c['rule_id']??'?'),'level':String(c['level']??c['severity']??'?')['toLowerCase'](),...c['evidence']!=null?{'evidence':String(c['evidence'])}:{}};})['sort']((c,d)=>c['id']===d['id']?(c['evidence']??'')['localeCompare'](d['evidence']??''):c['id']['localeCompare'](d['id']));}function runCase(a,b){try{return{'risks':normalize(a(b)),'threw':![]};}catch(c){return{'risks':[],'threw':!![]};}}function collect(){const a={};for(const b of RISK_CASES){const d=runCase(b['run'],b['empty']),e=runCase(b['run'],b['trigger']);a[b['pack']]={'objectType':b['objectType'],'empty':d['risks'],'emptyThrew':d['threw'],'trigger':e['risks']};}return a;}const here=dirname(fileURLToPath(import.meta.url)),SNAPSHOT=join(here,'risk-baselines.json'),AGG_SNAPSHOT=join(here,'aggregator-baselines.json');function puzzlesFrom(a){const b={};for(const d of RISK_CASES){if(d['pack']==='arb')continue;b[d['objectType']]={'puzzle':a(d)};}return b;}async function runAggregator(a){const b=await aggregateProjectRisks({'project_prefix':'baseline','version':'v1','industry':'general','puzzles':puzzlesFrom(a)});return{'severity_summary':b['severity_summary'],'status':b['status'],'findings':b['findings']['map'](c=>({'risk_rule_id':c['risk_rule_id'],'object_type':c['object_type'],'severity':c['severity']})),'warnings':b['warnings']};}describe('write-side\x20risk\x20packs\x20—\x20pre-migration\x20baseline',()=>{it('every\x20pack\x20trigger\x20context\x20fires\x20at\x20least\x20one\x20pack-specific\x20rule',()=>{for(const a of RISK_CASES){const {risks:b}=runCase(a['run'],a['trigger']);expect(b['length'],'pack\x20'+a['pack']+'\x20trigger\x20fired\x20nothing')['toBeGreaterThan'](0x0);}}),it('matches\x20the\x20committed\x20snapshot\x20(regenerate\x20only\x20with\x20--update)',()=>{const a=collect();if(process['env']['UPDATE_RISK_BASELINE']==='1'){writeFileSync(SNAPSHOT,JSON['stringify'](a,null,0x2)+'\x0a','utf8');return;}const b=JSON['parse'](readFileSync(SNAPSHOT,'utf8'));expect(new Set(Object['keys'](a)))['toEqual'](new Set(Object['keys'](b)));for(const c of Object['keys'](a)['sort']()){expect(a[c],'pack\x20'+c+'\x20drifted')['toEqual'](b[c]);}});}),describe('risk\x20aggregator\x20—\x20Task\x2026\x20parity\x20(id/severity/status)',()=>{const a=[['empty',b=>b['empty']],['trigger',b=>b['trigger']]];it('matches\x20the\x20committed\x20snapshot\x20(regenerate\x20only\x20with\x20--update)',async()=>{const b={};for(const [d,e]of a)b[d]=await runAggregator(e);if(process['env']['UPDATE_RISK_BASELINE']==='1'){writeFileSync(AGG_SNAPSHOT,JSON['stringify'](b,null,0x2)+'\x0a','utf8');return;}const c=JSON['parse'](readFileSync(AGG_SNAPSHOT,'utf8'));expect(b)['toEqual'](c);}),it('trigger\x20row\x20produces\x20CRITICAL\x20blockers\x20(sanity:\x20status\x20machine\x20alive)',async()=>{const b=await runAggregator(d=>d['trigger']);expect(b['findings']['some'](c=>c['severity']==='critical'))['toBe'](!![]),expect(b['status'])['not']['toBe']('RISK_PASSED');}),it('TR-26.2\x20every\x20finding\x20carries\x20its\x20proposal-graph\x20path\x20(explainability)',async()=>{const b=await aggregateProjectRisks({'project_prefix':'baseline','version':'v1','industry':'general','puzzles':puzzlesFrom(d=>d['trigger'])});expect(b['findings']['length'])['toBeGreaterThan'](0x0);for(const c of b['findings']){expect(c['details']?.['proposal_node'],'finding\x20'+c['risk_rule_id']+'\x20has\x20no\x20proposal\x20node')['toMatch'](/^proposal::/),expect(c['details']?.['rule_source'],'finding\x20'+c['risk_rule_id']+'\x20has\x20no\x20analyzer\x20source')['not']['toBe']('');}});}),describe('R-T-2-04\x20—\x20external_withdraw\x20pays\x20only\x20the\x20transaction\x20sender',()=>{const a={'withdraw':{'amount_by_external_withdraw_guard':'release-guard','recipient':'0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}};it('flags\x20HIGH\x20(code\x2010\x20abort\x20ahead)\x20when\x20recipient\x20!=\x20known\x20sender',()=>{const {risks:b}=assessTreasuryRisks({...a,'sender_address':'0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'}),c=b['find'](d=>d['id']==='R-T-2-04');expect(c?.['level'])['toBe']('high'),expect(c?.['description']??'')['toContain']('code\x2010');}),it('stays\x20silent\x20when\x20recipient\x20equals\x20the\x20sender',()=>{const {risks:b}=assessTreasuryRisks({...a,'sender_address':'0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'});expect(b['some'](c=>c['id']==='R-T-2-04'))['toBe'](![]);}),it('advises\x20MEDIUM\x20when\x20the\x20sender\x20is\x20not\x20known\x20at\x20analysis\x20time',()=>{const {risks:b}=assessTreasuryRisks(a),c=b['find'](d=>d['id']==='R-T-2-04');expect(c?.['level'])['toBe']('medium');}),it('does\x20not\x20fire\x20on\x20the\x20fixed\x20(permissioned)\x20withdraw\x20path',()=>{const {risks:b}=assessTreasuryRisks({'withdraw':{'amount_fixed':'1000','recipient':'0xcccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc'},'sender_address':'0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb'});expect(b['some'](c=>c['id']==='R-T-2-04'))['toBe'](![]);});}),describe('R-T-4-04\x20—\x20mounting\x20external\x20Guards\x20(owner\x20diligence\x20reminder)',()=>{it('flags\x20MEDIUM\x20when\x20mounting\x20external\x20withdraw\x20Guards',()=>{const {risks:a}=assessTreasuryRisks({'external_withdraw_guard':{'op':'add','guards':[{'guard':'0xg1','identifier':0x0}]}}),b=a['find'](c=>c['id']==='R-T-4-04');expect(b?.['level'])['toBe']('medium'),expect(b?.['description']??'')['toContain']('code\x2010');}),it('flags\x20LOW\x20when\x20mounting\x20external\x20deposit\x20Guards',()=>{const {risks:a}=assessTreasuryRisks({'external_deposit_guard':{'op':'add','guards':[{'guard':'0xg2'}]}}),b=a['find'](c=>c['id']==='R-T-4-04');expect(b?.['level'])['toBe']('low');}),it('stays\x20silent\x20on\x20remove/clear',()=>{const {risks:a}=assessTreasuryRisks({'external_withdraw_guard':{'op':'remove','guards':['0xg1']}});expect(a['some'](b=>b['id']==='R-T-4-04'))['toBe'](![]);});}),describe('R-R-2-05\x20—\x20mounting\x20a\x20claim\x20Guard\x20with\x20a\x20GuardIdentifier\x20payout\x20slot',()=>{const a={'guard':'0xg1','amount':{'type':'fixed','value':'100'}};it('flags\x20MEDIUM\x20when\x20the\x20recipient\x20is\x20a\x20GuardIdentifier\x20slot',()=>{const {risks:b}=assessRewardRisks({'guard_add':[{...a,'recipient':{'GuardIdentifier':0x0}}]}),c=b['find'](d=>d['id']==='R-R-2-05');expect(c?.['level'])['toBe']('medium'),expect(c?.['description']??'')['toContain']('GuardIdentifier');}),it('stays\x20silent\x20for\x20Entity/Signer\x20recipients',()=>{const {risks:b}=assessRewardRisks({'guard_add':[{...a,'recipient':{'Entity':'0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}}]});expect(b['some'](c=>c['id']==='R-R-2-05'))['toBe'](![]);});});

package/dist/knowledge/baselines/rules/alloc_audit.json

@@ -0,0 +1,290 @@
+{
+  "comment": "alloc_audit — the Service order-allocator fund-destination audit (analyzer ALC1, knowledge/service-allocator-audit-node.ts). The kernel (recipient-constraint.ts) stays the SINGLE judgment authority for recipient semantics; this pack owns the read-side NARRATIVE and ATTRIBUTION as data: per-finding copy, severity pass-through (fact:base_level), the evidence-gap finding, and the buyer-facing fund-destination verdict. The binding emits one rule-book evaluation per canonical finding plus gap/summary; unknown canonical codes keep a generic kernel fallback. Rule ids cite the canonical codes (RC-FIND-01..08).",
+  "facts": {
+    "host_service": "Service object address under audit.",
+    "code": "Canonical recipient-constraint finding code (RC-FIND-01..08).",
+    "base_level": "Read-side severity of the canonical finding (high/medium/low; a resolution_required medium escalates to high so the read side matches the write-side severity gate).",
+    "evidence_paths": "Comma-joined guard expression paths that triggered the finding, or '(root)'. For RC-FIND-08 these are the relied sub-guard addresses.",
+    "evidence_count": "Number of evidence paths (sub-guard count for RC-FIND-08).",
+    "unfetched_count": "Guards referenced by the allocation template whose table/root were not fetched with the topology.",
+    "unfetched_list": "Comma-joined unfetched guard identifiers (with provenance notes).",
+    "allocator_count": "Order allocators in the service's allocation template.",
+    "guard_count": "Guards resolved for the audit, including one-level relies composition.",
+    "destinations_text": "Comma-joined beneficial owners across all recipients, or '(no recipients)'.",
+    "dest_unsafe": "true when an unbound Signer direct-pay path exists (safe_destination false).",
+    "resolution_required": "true when a residual remains that needs an explicit merchant resolution before ordering.",
+    "audit_summary": "The canonical audit's own summary sentence, cited verbatim."
+  },
+  "rules": [
+    {
+      "rule_id": "RC-FIND-01",
+      "dimension": "fund_destination",
+      "trigger": "Signer recipient whose guard binds no caller identity — direct fund theft path.",
+      "cases": [
+        {
+          "when": { "field": "code", "op": "eq", "value": "RC-FIND-01" },
+          "level": "fact:base_level",
+          "title": "Fund theft risk: Signer recipient without caller identity constraint",
+          "description": "The order allocator Guard of service ${host_service} delivers funds directly to the transaction caller (Recipient::Signer) but binds the Signer to no authorized identity — anyone satisfying the remaining conditions can take the funds (rule ${code}, evidence paths ${evidence_paths}).",
+          "mitigation": "Fix immediately: bind the Signer to a fixed address or a derived identity such as order.owner, or switch to an Entity / submitted object slot; do NOT pay this service before the fix.",
+          "exposure": {
+            "loss_parties": [
+              { "role": "merchant", "basis": "The allocation pool pays whoever triggers it; the funder (merchant pool or buyer escrow routed through it) loses the delivered share permanently." },
+              { "role": "buyer", "basis": "When the pool carries the buyer's escrowed order funds, the theft drains the escrow leg." }
+            ],
+            "gain_paths": [
+              { "role": "neutral", "path": "Any caller satisfying the remaining guard conditions takes the pool share directly into their own wallet (Recipient::Signer, destination = caller).", "viability": "viable", "gate": "Direct-pay + no identity binding is the theft path itself; nothing else gates it." }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "rule_id": "RC-FIND-02",
+      "dimension": "fund_destination",
+      "trigger": "Submission slot without scope binding — arbitrary qualifying claims.",
+      "cases": [
+        {
+          "when": { "field": "code", "op": "eq", "value": "RC-FIND-02" },
+          "level": "fact:base_level",
+          "title": "Insufficient allocation condition: submission slot has no scope binding",
+          "description": "The order allocator Guard of service ${host_service} leaves its submission slot without any scope constraint (no order.service binding, no repository cross-check, no permission membership): a caller can submit arbitrary qualifying objects/addresses to claim the funds (rule ${code}, evidence paths ${evidence_paths}).",
+          "mitigation": "Require the merchant to add order.service == this service (query 1563) before ordering; an unbound recipient slot can be claimed by others.",
+          "exposure": {
+            "loss_parties": [
+              { "role": "merchant", "basis": "The allocation pool funds an attacker-chosen destination instead of the intended recipient split." },
+              { "role": "buyer", "basis": "Escrowed order funds routed through the pool can be steered to a third party the buyer never contracted with." }
+            ],
+            "gain_paths": [
+              { "role": "neutral", "path": "Submit an attacker-controlled address (or an order the attacker owns) in the unscoped slot and collect the pool share.", "viability": "viable", "gate": "Nothing constrains the submitted value; the CoinWrapper lands at the submitted target — wallet targets are directly collectible." }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "rule_id": "RC-FIND-03",
+      "dimension": "fund_destination",
+      "trigger": "Cross-order settlement residual — pool choice contestable, destination safe.",
+      "cases": [
+        {
+          "when": { "field": "code", "op": "eq", "value": "RC-FIND-03" },
+          "level": "fact:base_level",
+          "title": "Cross-order settlement residual (explicit resolution required)",
+          "description": "When the order allocator Guard of service ${host_service} pays the submitted order object, that order is not bound to the Allocation being settled (alloc is permissionless and allocation context is not a Guard input): a caller owning ANY qualifying order can settle OTHER allocations. Funds still land at the submitted order and only its owner can withdraw — destination is safe, the pool CHOICE is the residual (rule ${code}, evidence paths ${evidence_paths}).",
+          "mitigation": "Require the merchant to pick ONE resolution and record it in the service description: (1) declare competition semantics and cap exposure via threshold/max; (2) switch to a fixed Entity (treasury) recipient — the only exclusive choice on the automatic order_allocators route; (3) drop automatic allocation and pin a per-order Guard (order.owner == constant) for trustless exclusivity.",
+          "exposure": {
+            "loss_parties": [
+              { "role": "buyer", "basis": "Whoever funded the victim allocation (typically the order-tied buyer escrow) loses their pool to another order's settlement." },
+              { "role": "merchant", "basis": "Intended per-order distribution semantics cannot be enforced; disputes over 'whose pool was consumed' land on the merchant." }
+            ],
+            "gain_paths": [
+              { "role": "supplier", "path": "A caller owning any qualifying order settles a different allocation and drains its pool into their own order (they are that order's owner and collect on withdrawal).", "viability": "conditional", "gate": "Requires the caller to hold a guard-qualifying order and the allocation's payment_info to be unbound; destination stays an order owner — only the pool CHOICE is contested." }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "rule_id": "RC-FIND-04",
+      "dimension": "fund_destination",
+      "trigger": "Standalone allocation with no issuer binding — anyone can trigger distribution.",
+      "cases": [
+        {
+          "when": { "field": "code", "op": "eq", "value": "RC-FIND-04" },
+          "level": "fact:base_level",
+          "title": "Standalone allocation without issuer identity constraint",
+          "description": "The allocator Guard associated with service ${host_service} is in standalone form (no Service/arbitration access-control layer) and binds no Signer identity: anyone can trigger distribution (rule ${code}).",
+          "mitigation": "Bind the issuer (Signer == owner/admin) or move the allocation into a Service access-control layer.",
+          "exposure": {
+            "loss_parties": [
+              { "role": "merchant", "basis": "Distribution timing escapes the issuer's control — the pool can be released before the intended moment or conditions." },
+              { "role": "buyer", "basis": "Escrow release no longer tracks the agreed schedule." }
+            ],
+            "gain_paths": [
+              { "role": "neutral", "path": "Trigger distribution early; the configured recipients receive funds ahead of schedule (destination itself is unchanged).", "viability": "viable", "gate": "No issuer binding means any account can fire the settlement entry; the gain is timing control, not redirection." }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "rule_id": "RC-FIND-05",
+      "dimension": "fund_destination",
+      "trigger": "Session-only guard queries — permanent deadlock after session migration (shortfall, nobody gains).",
+      "cases": [
+        {
+          "when": { "field": "code", "op": "eq", "value": "RC-FIND-05" },
+          "level": "medium",
+          "title": "Guard uses session-only queries — fails permanently after session migration",
+          "description": "The order allocator Guard of service ${host_service} uses session queries (1270/1271) at ${evidence_paths}: after the session migrates to history the query aborts (W_FIELD_NOT_FOUND) and the Guard fails permanently — allocation can never trigger (rule ${code}).",
+          "mitigation": "Require the merchant to switch to progress.current_time (1272) or history queries (1274-1279); session queries deadlock the allocation.",
+          "exposure": {
+            "loss_parties": [
+              { "role": "supplier", "basis": "Expected allocator payouts never release — the pool is stranded behind a permanently failing guard." },
+              { "role": "buyer", "basis": "The escrowed order leg the allocation should release is frozen with it." }
+            ],
+            "gain_paths": []
+          }
+        }
+      ]
+    },
+    {
+      "rule_id": "RC-FIND-06",
+      "dimension": "fund_destination",
+      "trigger": "Permissionless alloc — settlement timing front-run; destination provably unaffected.",
+      "cases": [
+        {
+          "when": { "field": "code", "op": "eq", "value": "RC-FIND-06" },
+          "level": "low",
+          "title": "Permissionless alloc — settlement timing can be front-run",
+          "description": "Once the Guard conditions of service ${host_service}'s allocation hold, anyone can trigger settlement (alloc is permissionless). For Entity/object recipients this affects timing only, not destination (rule ${code}).",
+          "mitigation": "Watch settlement events; constrain time-sensitive allocations via Guard time conditions.",
+          "exposure": {
+            "loss_parties": [
+              { "role": "buyer", "basis": "Settlement timing becomes unpredictable — the buyer cannot rely on the scheduled release moment." },
+              { "role": "merchant", "basis": "Distribution timing escapes merchant control." }
+            ],
+            "gain_paths": [
+              { "role": "neutral", "path": "Trigger settlement the instant conditions hold; destination is provably unaffected (object receipt = owner receipt).", "viability": "viable", "gate": "Timing control only — the theft path (destination redirect) is blocked by Wow ownership; severity stays informational." }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "rule_id": "RC-FIND-07",
+      "dimension": "fund_destination",
+      "trigger": "Submission slot not Address-typed — allocation config invalid at registration.",
+      "cases": [
+        {
+          "when": { "field": "code", "op": "eq", "value": "RC-FIND-07" },
+          "level": "medium",
+          "title": "Submission slot is not address-typed",
+          "description": "The GuardIdentifier recipient slot of the order allocator Guard of service ${host_service} is not Address-typed: the Allocator-add step rejects it (ERECIPIENT_IDENTIFIER_NOT_ADDRESS) and the allocation config is invalid (rule ${code}, evidence paths ${evidence_paths}).",
+          "mitigation": "Change the slot value_type to Address, or switch to an Entity recipient.",
+          "exposure": {
+            "loss_parties": [
+              { "role": "merchant", "basis": "The allocation configuration is rejected at registration — the intended distribution never goes live." }
+            ],
+            "gain_paths": []
+          }
+        }
+      ]
+    },
+    {
+      "rule_id": "RC-FIND-08",
+      "dimension": "fund_destination",
+      "trigger": "Sub-guard composition — constraints not credited; both error directions disclosed.",
+      "cases": [
+        {
+          "when": { "field": "code", "op": "eq", "value": "RC-FIND-08" },
+          "level": "fact:base_level",
+          "title": "Guard relies on sub-guards — their constraints are NOT credited by this audit",
+          "description": "The allocator Guard of service ${host_service} composes ${evidence_count} sub-guard(s) via relies (one level, <=4): scope/signer constraints may live in the sub-guards. This audit evaluates only the guard's own expression tree — sub-guard constraints are NOT credited, so scope-binding gaps (RC-FIND-02) may be over-reported and sub-guard-only conditions stay unverified (rule ${code}).",
+          "mitigation": "Read the relied sub-guards' table and root directly on-chain and verify their constraints manually, or re-run with an audit tool that resolves them automatically.",
+          "exposure": {
+            "loss_parties": [
+              { "role": "buyer", "basis": "The audit's conclusions for this guard are uncertain in both directions — a real gap may be hidden in, or falsely imputed to, the composed sub-guards." }
+            ],
+            "gain_paths": [
+              { "role": "neutral", "path": "If a sub-guard carries a constraint this audit missed, the paired gap findings overstate the exposure; if the root alone is weak, the paired findings understate nothing — the deciding predicate sits outside this audit's evidence.", "viability": "unverifiable", "gate": "Disclosure duty: resolve every relied sub-guard (table + root) and re-run the canonical audit before ordering." }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "rule_id": "RC-GAP",
+      "dimension": "evidence",
+      "trigger": "Referenced guard table/root not fetched — the audit would silently pass; emits a visible evidence gap (shortfall, nobody gains).",
+      "cases": [
+        {
+          "when": { "field": "unfetched_count", "op": "gt", "value": 0 },
+          "level": "info",
+          "title": "Allocator Guard evidence gap: expression tree not fetched — fund-destination audit incomplete",
+          "description": "The allocation template of service ${host_service} references ${unfetched_count} guard(s) whose table/root were not fetched with the topology (${unfetched_list}): fund ownership and condition sufficiency cannot be assessed.",
+          "mitigation": "Read these guards' table and root directly by address on-chain and re-audit; an evidence gap is not a pass.",
+          "exposure": {
+            "loss_parties": [
+              { "role": "buyer", "basis": "The buyer cannot assess fund ownership or condition sufficiency for the unresolved guards — the decision rests on undisclosed information." },
+              { "role": "merchant", "basis": "Undisclosed guard internals keep the allocation unverifiable for every counterparty." }
+            ],
+            "gain_paths": []
+          }
+        }
+      ]
+    },
+    {
+      "rule_id": "RC-SUMMARY",
+      "dimension": "verdict",
+      "trigger": "Buyer-facing fund-destination verdict over the whole allocation template (unsafe wins, then residual, then safe).",
+      "cases": [
+        {
+          "when": { "all": [ { "field": "dest_unsafe", "op": "truthy" }, { "field": "resolution_required", "op": "truthy" } ] },
+          "level": "high",
+          "title": "Fund destination and condition integrity: stealable destination exists (residual requires explicit decision)",
+          "description": "Service ${host_service} allocation template: ${allocator_count} allocator(s) / ${guard_count} resolved guard(s). Fund destinations = ${destinations_text}. WARNING: an unbound Signer direct-pay path exists — do not pay before the fix. ${audit_summary}",
+          "mitigation": "A fund theft path exists: do not pay this service and require the merchant to fix the Guard.",
+          "exposure": {
+            "loss_parties": [
+              { "role": "merchant", "basis": "Intended fund destinations: ${destinations_text} — any deviation from this split is a loss for the intended parties." },
+              { "role": "buyer", "basis": "An unbound direct-pay path exists on the order allocator — escrowed funds routed through it can be taken before fulfillment." }
+            ],
+            "gain_paths": [
+              { "role": "neutral", "path": "An unbound Recipient::Signer direct-pay path hands the pool share to whoever triggers settlement.", "viability": "viable", "gate": "Signer recipient with no caller binding — the destination IS the attacker's wallet." }
+            ]
+          }
+        },
+        {
+          "when": { "field": "dest_unsafe", "op": "truthy" },
+          "level": "high",
+          "title": "Fund destination and condition integrity: stealable destination exists",
+          "description": "Service ${host_service} allocation template: ${allocator_count} allocator(s) / ${guard_count} resolved guard(s). Fund destinations = ${destinations_text}. WARNING: an unbound Signer direct-pay path exists — do not pay before the fix. ${audit_summary}",
+          "mitigation": "A fund theft path exists: do not pay this service and require the merchant to fix the Guard.",
+          "exposure": {
+            "loss_parties": [
+              { "role": "merchant", "basis": "Intended fund destinations: ${destinations_text} — any deviation from this split is a loss for the intended parties." },
+              { "role": "buyer", "basis": "An unbound direct-pay path exists on the order allocator — escrowed funds routed through it can be taken before fulfillment." }
+            ],
+            "gain_paths": [
+              { "role": "neutral", "path": "An unbound Recipient::Signer direct-pay path hands the pool share to whoever triggers settlement.", "viability": "viable", "gate": "Signer recipient with no caller binding — the destination IS the attacker's wallet." }
+            ]
+          }
+        },
+        {
+          "when": { "all": [ { "field": "dest_unsafe", "op": "falsy" }, { "field": "resolution_required", "op": "truthy" } ] },
+          "level": "medium",
+          "title": "Fund destination and condition integrity: destination safe (residual requires explicit decision)",
+          "description": "Service ${host_service} allocation template: ${allocator_count} allocator(s) / ${guard_count} resolved guard(s). Fund destinations = ${destinations_text}. No recipient can be redirected to an arbitrary attacker-controlled address (order escrow is enforced by Wow ownership: only the order owner can extract via owner_receive). ${audit_summary}",
+          "mitigation": "Before ordering, require the merchant to pick one resolution for the residual (competition declaration + capped exposure / Entity treasury routing / per-order pinned Guards) and confirm it is written in the service description.",
+          "exposure": {
+            "loss_parties": [
+              { "role": "merchant", "basis": "Intended fund destinations: ${destinations_text} — any deviation from this split is a loss for the intended parties." },
+              { "role": "buyer", "basis": "Escrowed order funds route through these destinations; sufficiency gaps stall the buyer's release." }
+            ],
+            "gain_paths": [
+              { "role": "neutral", "path": "Redirect a settlement to an attacker-controlled address.", "viability": "conditional", "gate": "Destination stays an order/entity owner; only the pool CHOICE is contestable (cross-order settlement residual)." }
+            ]
+          }
+        },
+        {
+          "when": { "all": [ { "field": "dest_unsafe", "op": "falsy" }, { "field": "resolution_required", "op": "falsy" } ] },
+          "level": "info",
+          "title": "Fund destination and condition integrity: destination safe",
+          "description": "Service ${host_service} allocation template: ${allocator_count} allocator(s) / ${guard_count} resolved guard(s). Fund destinations = ${destinations_text}. No recipient can be redirected to an arbitrary attacker-controlled address (order escrow is enforced by Wow ownership: only the order owner can extract via owner_receive). ${audit_summary}",
+          "mitigation": "Destination is safe; verify condition sufficiency per the RC audit suggestions before ordering.",
+          "exposure": {
+            "loss_parties": [
+              { "role": "merchant", "basis": "Intended fund destinations: ${destinations_text} — any deviation from this split is a loss for the intended parties." },
+              { "role": "buyer", "basis": "Escrowed order funds route through these destinations; sufficiency gaps stall the buyer's release." }
+            ],
+            "gain_paths": [
+              { "role": "neutral", "path": "Redirect a settlement to an attacker-controlled address.", "viability": "blocked", "gate": "Every recipient is a fixed entity or an order-tied submission — object receipt = owner receipt, no attacker-controlled destination exists." }
+            ]
+          }
+        }
+      ]
+    }
+  ]
+}